Function at 0x180009a40
Capabilities:
Get disk information
Get hostname
Move file
Print debug messages

Disassembly:
sub rsp, 0x58
mov dword [rsp + 0x48], 0x157
lea rax, [fcn.180003ba0]
add rax, 0x157
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x60]
movaps xmm0, xmmword [rsp + 0x40]
lea rcx, [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x60], 0x755
call fcn.180016460
cmp dword [0x1801227d0], 0x6ec8fece
mov qword [0x1801227d8], rax
mov byte [0x1801227aa], 1
jne 0x180009b2b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AddSIDToBoundaryDescriptor]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryThreadCycleTime]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PulseEvent]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WakeAllConditionVariable]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleOriginalTitleW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSizeEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThreadpoolTimer]
call qword [sym.imp.KERNEL32.dll_SwitchToThread]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapSize]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadLocale]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateWaitableTimerExW]
mov dword [rsp + 0x48], 0x2a3
lea rax, [0x180006da0]
add rax, 0x2a3
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.180015020
mov dword [rsp + 0x48], 0x161
lea rax, [0x180004d20]
add rax, 0x161
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.1800166a0
cmp dword [0x1801227d0], 0xb692fd6c
movzx ebx, al
jne 0x180009caf
xor r8d, r8d
mov qword [rsp + 0x50], rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumberEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalFlags]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapeParameters]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlsGetValue]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCompressedFileSizeW]
xor edi, edi
xor r9d, r9d
mov dword [rsp + 0x30], edi
xor r8d, r8d
mov dword [rsp + 0x28], edi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
lea rax, [0x18013cc60]
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rdi
lea rcx, [0x18013cc90]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetDurationFormatEx]
xor r9d, r9d
mov dword [rsp + 0x20], edi
xor r8d, r8d
lea rdx, [0x18013ccc8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStringScripts]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MoveFileW]
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CompareStringW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapDestroy]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommProperties]
call qword [sym.imp.KERNEL32.dll_CreateTimerQueue]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EraseTape]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClosePrivateNamespace]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
mov rdi, qword [rsp + 0x50]
test bl, bl
mov rbx, qword [rsp + 0x68]
jne 0x180009cca
lea rcx, [0x18013cd00]
add rsp, 0x58
jmp qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add rsp, 0x58
ret