Function at 0x10005520
Capabilities:
Copy file
Create directory
Get keyboard layout
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0x10065eb0
call fcn.10006150
add esp, 4
cmp dword [ebp + 8], 0
je 0x100057ad
push 0x10065f24
mov eax, dword [ebp + 8]
push eax
call fcn.1002936b
add esp, 8
test eax, eax
jne 0x100057ad
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadDescription]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
push 0
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0
call dword [sym.imp.USER32.dll_LockSetForegroundWindow]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LCMapStringW]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_InitializeSynchronizationBarrier]
push 0
push 0
push 0
push 0
push 0x10065f3c
push 0
push 0x10065f70
push 0
push 0x10065f98
call dword [sym.imp.KERNEL32.dll_CompareStringEx]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNLSVersion]
push 0
push 0x10065fd0
push 0x10065ffc
call dword [sym.imp.KERNEL32.dll_CopyFile2]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
push 0
push 0
call dword [sym.imp.USER32.dll_GetGuiResources]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SetPropW]
push 0
push 0
call dword [sym.imp.USER32.dll_GetIconInfoExW]
push 0
call dword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExW]
push 0
call dword [sym.imp.USER32.dll_GetClipCursor]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateHardLinkW]
push 0
call dword [sym.imp.USER32.dll_GetDC]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLongPathNameTransactedW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetApplicationRecoveryCallback]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_mouse_event]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetStdHandle]
push 0
call dword [sym.imp.USER32.dll_ShowCaret]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateConsoleScreenBuffer]
call dword [sym.imp.KERNEL32.dll_AllocConsole]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_AppendMenuW]
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SetWindowRgn]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
push 0
mov edx, dword [ebp - 4]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapSize]
push 0
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphoreWhenCallbackReturns]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SetRect]
push 0
push 0
call dword [sym.imp.USER32.dll_ExitWindowsEx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaNodeNumberFromHandle]
push 0
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckNameLegalDOS8Dot3W]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_AdjustWindowRectEx]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
push 0
call dword [sym.imp.USER32.dll_GetMenuContextHelpId]
mov eax, 4
imul ecx, eax, 0x9a
add ecx, dword [0x1005c2a8]
push ecx
mov edx, 4
imul eax, edx, 0x9a
mov ecx, dword [0x1005c2a8]
mov edx, dword [ecx + eax]
push edx
mov eax, 4
imul ecx, eax, 0x2d
mov edx, dword [0x1005c2a8]
mov eax, dword [edx + ecx]
push eax
mov ecx, 4
imul edx, ecx, 0xa9
mov eax, dword [0x1005c2c4]
mov ecx, dword [eax + edx]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esp, ebp
pop ebp
ret