Function at 0x10004110
Capabilities:
Copy file
Get disk size
Terminate thread
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x10]
push edx
mov ecx, dword [ebp + 8]
call fcn.10012870
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
jne 0x10004140
fld qword [0x1006b380]
jmp 0x1000431d
mov eax, dword [0x10078b04]
xor ecx, ecx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ecx
cmp dword [ebp - 8], 0xb3065880
jne 0x10004302
cmp dword [ebp - 4], 0
jne 0x10004302
xor edx, edx
lock dec dword [edx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForThreadpoolTimerCallbacks]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_InitializeSynchronizationBarrier]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileTransactedW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_IsValidLanguageGroup]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_InterlockedPushListSListEx]
push str.MKKmh96sUD3W5RGGy3p6e2s3GKfz
push 0
push 0
push str.59G8n29WQmKOH2d5bluat7Wa6n
push 0
push 0
push str.iJf4GF1lmUvXHw116
call dword [sym.imp.KERNEL32.dll_GetDateFormatEx]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
push 0
call dword [sym.imp.KERNEL32.dll_ClearCommBreak]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_Wow64SetThreadContext]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetTapePosition]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapValidate]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfoEx]
push 0
push str.9Ju2QF73ggwZWu6Cr
push str.l7MGB9oxMEELrYHaBNpD4Ni4t
call dword [sym.imp.KERNEL32.dll_CopyFile2]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WaitForThreadpoolWaitCallbacks]
push 0
push str.SUJN3TaLSXfoU5AJY
push 0
push 0
push 0
push str.4TxenoTS224b58YSVcZ4558GRl
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
call dword [sym.imp.KERNEL32.dll_InitOnceInitialize]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLogicalProcessorInformationEx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReleaseMutexWhenCallbackReturns]
push 0
call dword [sym.imp.KERNEL32.dll_SwitchToFiber]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
call fcn.1005f480
divsd xmm0, qword [0x1006b378]
movsd qword [ebp - 0x18], xmm0
fld qword [ebp - 0x18]
mov esp, ebp
pop ebp
ret