Function at 0x180003ed0
Capabilities:
Delete file
Get disk information
Get geographical location
Manipulate console buffer
Read .ini file
Read clipboard data
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
cmp dword [rcx + 0x18], 0
mov rbx, rcx
jne 0x180003fad
call fcn.1800458b8
mov r9d, eax
mov eax, 0x55555556
imul r9d
mov r8d, edx
shr r8d, 0x1f
add edx, r8d
lea ecx, [rdx + rdx*2]
sub r9d, ecx
mov ecx, 1
inc r9d
mov dword [rbx + 0x18], r9d
call fcn.18003f9e0
mov edx, dword [rbx + 0x18]
mov rdi, rax
sub edx, 1
je 0x180003f8e
sub edx, 1
je 0x180003f40
cmp edx, 1
jne 0x180003fa0
mov edx, 0x3ec0
mov rcx, rax
call fcn.180005660
mov qword [rbx + 0x10], rax
jmp 0x180003fa0
mov ecx, 0x143b
nop word [rax + rax]
inc ecx
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea edx, [rdx + rdx*2]
cmp ecx, edx
jne 0x180003f50
cmp ecx, 0x143d
jne 0x180003f82
mov edx, 0x3ec0
mov rcx, rdi
call fcn.180005660
mov qword [rbx + 8], rax
jmp 0x180003fa0
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov edx, 0x3ec0
mov rcx, rdi
call fcn.180005660
mov qword [rbx], rax
nop
mov edx, 1
mov rcx, rdi
call fcn.18003f8f4
mov edx, dword [0x1800c8fa0]
mov qword [rsp + 0x50], rsi
xor esi, esi
cmp edx, 0xcc190c24
jne 0x1800040d5
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessInJob]
call qword [sym.imp.USER32.dll_GetOpenClipboardWindow]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
xor r9d, r9d
mov dword [rsp + 0x20], esi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetScrollRange]
xor ecx, ecx
call qword [sym.imp.USER32.dll_DestroyCursor]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnumThreadWindows]
xor r9d, r9d
mov word [rsp + 0x20], si
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetGeoInfoW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsWindowEnabled]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetWindowRgn]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetClipboardData]
xor r9d, r9d
mov qword [rsp + 0x28], rsi
xor r8d, r8d
mov qword [rsp + 0x20], rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
xor r9d, r9d
mov qword [rsp + 0x28], rsi
xor r8d, r8d
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor r9d, r9d
mov dword [rsp + 0x20], esi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_CheckMenuRadioItem]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDlgItemTextW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessMitigationPolicy]
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
mov edx, dword [0x1800c8fa0]
mov ecx, dword [rbx + 0x18]
mov rdi, rsi
sub ecx, 1
je 0x1800040f6
sub ecx, 1
je 0x1800040f0
cmp ecx, 1
jne 0x1800040f9
mov rdi, qword [rbx + 0x10]
jmp 0x1800040f9
mov rdi, qword [rbx + 8]
jmp 0x1800040f9
mov rdi, qword [rbx]
cmp edx, 0x298f5bc8
jne 0x1800041b5
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLocaleName]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextStreamW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueueUserWorkItem]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalLock]
mov dword [rsp + 0x38], esi
xor r9d, r9d
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov qword [rsp + 0x28], rsi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
call qword [sym.imp.USER32.dll_GetCursor]
xor edx, edx
lea rcx, str.1yNMGPs6e83D455ta
call qword [sym.imp.KERNEL32.dll_LocaleNameToLCID]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_CharToOemW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryUnbiasedInterruptTime]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rsi, qword [rsp + 0x50]
mov rax, rdi
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret