Function at 0x18000ad90
Capabilities:
Copy file
Create thread
Get disk information
Read .ini file
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0xf0]
sub rsp, 0x1f0
cmp edx, 1
jne 0x18000b254
lea rax, [0x18000a1c0]
add rax, 0x1fa
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], 0x1fa
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.180010d20
lea rax, [0x18000a980]
add rax, 0x134
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], 0x134
xor eax, eax
mov word [rsp + 0x50], ax
mov byte [rsp + 0x52], al
xor edi, edi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], rdi
mov ecx, 0x10
call fcn.18007cf48
mov qword [rax + 8], rdi
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x58]
mov qword [rax], rcx
mov word [rbp - 0x78], di
mov qword [rbp - 0x72], rdi
mov qword [rbp - 0x6a], rdi
xor eax, eax
mov word [rbp - 0x75], ax
mov byte [rbp - 0x73], al
mov word [rbp - 0x72], ax
mov byte [rbp - 0x70], al
mov word [rbp - 0x6f], ax
mov byte [rbp - 0x6d], al
mov word [rbp - 0x6c], ax
mov byte [rbp - 0x6a], al
mov word [rbp - 0x69], ax
mov byte [rbp - 0x67], al
mov word [rbp - 0x66], ax
mov byte [rbp - 0x64], al
mov dword [rsp + 0x54], edi
mov dword [rbp - 0x7c], edi
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.1800131e0
nop
lea rcx, [rsp + 0x58]
call fcn.180016a10
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x58], rdi
mov edx, 0x10
call fcn.18007ce5c
xor ecx, ecx
call fcn.18008616c
mov ecx, eax
call fcn.180082d64
lea rbx, [0x18000a6f0]
lea rax, [rbx + 0x229]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], 0x229
xor eax, eax
mov word [rsp + 0x50], ax
mov byte [rsp + 0x52], al
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], rdi
mov ecx, 0x10
call fcn.18007cf48
mov qword [rax + 8], rdi
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x58]
mov qword [rax], rcx
mov word [rbp - 0x78], di
mov qword [rbp - 0x72], rdi
mov qword [rbp - 0x6a], rdi
xor eax, eax
mov word [rbp - 0x75], ax
mov byte [rbp - 0x73], al
mov word [rbp - 0x72], ax
mov byte [rbp - 0x70], al
mov word [rbp - 0x6f], ax
mov byte [rbp - 0x6d], al
mov word [rbp - 0x6c], ax
mov byte [rbp - 0x6a], al
mov word [rbp - 0x69], ax
mov byte [rbp - 0x67], al
mov word [rbp - 0x66], ax
mov byte [rbp - 0x64], al
mov dword [rsp + 0x54], edi
mov dword [rbp - 0x7c], edi
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea r8, [rbp + 0x10]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.180013020
nop
lea rcx, [rsp + 0x58]
call fcn.180016a10
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x58], rdi
mov edx, 0x10
call fcn.18007ce5c
add rbx, 0x227
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x48], 0x227
xor eax, eax
mov word [rsp + 0x50], ax
mov byte [rsp + 0x52], al
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], rdi
mov ecx, 0x10
call fcn.18007cf48
mov qword [rax + 8], rdi
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x58]
mov qword [rax], rcx
mov word [rbp - 0x78], di
mov qword [rbp - 0x72], rdi
mov qword [rbp - 0x6a], rdi
xor eax, eax
mov word [rbp - 0x75], ax
mov byte [rbp - 0x73], al
mov word [rbp - 0x72], ax
mov byte [rbp - 0x70], al
mov word [rbp - 0x6f], ax
mov byte [rbp - 0x6d], al
mov word [rbp - 0x6c], ax
mov byte [rbp - 0x6a], al
mov word [rbp - 0x69], ax
mov byte [rbp - 0x67], al
mov word [rbp - 0x66], ax
mov byte [rbp - 0x64], al
mov dword [rsp + 0x54], edi
mov dword [rbp - 0x7c], edi
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea r8, [rbp - 0x60]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.180013020
nop
lea rcx, [rsp + 0x58]
call fcn.180016a10
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x58], rdi
mov edx, 0x10
call fcn.18007ce5c
lea rax, [0x18000a7e0]
add rax, 0x1ac
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], 0x1ac
xor eax, eax
mov word [rsp + 0x50], ax
mov byte [rsp + 0x52], al
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], rdi
mov ecx, 0x10
call fcn.18007cf48
mov qword [rax + 8], rdi
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x58]
mov qword [rax], rcx
mov word [rbp - 0x78], di
mov qword [rbp - 0x72], rdi
mov qword [rbp - 0x6a], rdi
xor eax, eax
mov word [rbp - 0x75], ax
mov byte [rbp - 0x73], al
mov word [rbp - 0x72], ax
mov byte [rbp - 0x70], al
mov word [rbp - 0x6f], ax
mov byte [rbp - 0x6d], al
mov word [rbp - 0x6c], ax
mov byte [rbp - 0x6a], al
mov word [rbp - 0x69], ax
mov byte [rbp - 0x67], al
mov word [rbp - 0x66], ax
mov byte [rbp - 0x64], al
mov dword [rsp + 0x54], edi
mov dword [rbp - 0x7c], edi
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rax, [rbp + 0x80]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x60]
lea r8, [rbp + 0x10]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.180012e50
nop
lea rcx, [rsp + 0x58]
call fcn.180016a10
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x58], rdi
mov edx, 0x10
call fcn.18007ce5c
lea rax, [0x1800041d0]
add rax, 0x141
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], 0x141
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.180010d20
cmp dword [0x180107ce0], 0x8acce499
jne 0x18000b23a
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
call qword [sym.imp.KERNEL32.dll_SwitchToThread]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMask]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaHighestNodeNumber]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProfileIntW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelIoEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleAliasExesW]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
call qword [sym.imp.KERNEL32.dll_AllocConsole]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
mov eax, 1
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
cmp edx, 2
je 0x18000b23a
cmp edx, 3
jne 0x18000b394
cmp dword [0x180107ce0], 0x391d5b01
jne 0x18000b23a
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadpoolThreadMaximum]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CopyFileW]
xor edi, edi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DnsHostnameToComputerNameW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadpoolStackInformation]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AddVectoredContinueHandler]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteVolumeMountPointW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AddSecureMemoryCacheCallback]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GenerateConsoleCtrlEvent]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ChangeDisplaySettingsW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DebugActiveProcessStop]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetWindowDisplayAffinity]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemPowerState]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMaskEx]
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetProcessWindowStation]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetTimeZoneInformation]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalLock]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
call qword [sym.imp.USER32.dll_GetMenuCheckMarkDimensions]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetWindowLongW]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ToUnicodeEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesTransactedW]
jmp 0x18000b23a
test edx, edx
jne 0x18000b23a
mov r11d, 0x255d
inc r11d
test r11b, 1
jne 0x18000b3a2
mov ecx, 0x26e0
inc ecx
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea edx, [rdx + rdx*2]
cmp ecx, edx
jne 0x18000b3b0
lea eax, [rcx - 0x15af]
and eax, 0x80000003
jge 0x18000b3db
dec eax
or eax, 0xfffffffc
inc eax
mov edx, 0x2742
mov r8d, 0x15af
test eax, eax
cmove edx, r8d
mov r9d, edx
sub r9d, ecx
add r9d, 0x1671
test r9b, 1
lea r8d, [r9 - 0x1ce2]
cmove r8d, r9d
sub ecx, edx
lea ebx, [rcx*2 - 0xdacf]
mov r10d, 0xfffff686
sub r10d, ebx
mov edx, r8d
sub edx, ebx
add edx, r9d
lea r9d, [rdx + 0x53be]
add r8d, 0x6c0
mov ecx, r8d
lea eax, [rdx + 0x5fe4]
sub eax, r8d
sub r8d, 0x24cb
sub ebx, 0x773
add ecx, 0x6eb9
add ecx, r10d
add ecx, r11d
test cl, 1
je 0x18000b467
nop word [rax + rax]
inc ecx
test cl, 1
jne 0x18000b460
lea r10d, [rax + 0x5d38]
add r10d, edx
lea eax, [rbx + r8]
add eax, ecx
mov ecx, eax
sub r8d, 0x17b1
test al, 1
je 0x18000b48b
inc ecx
test cl, 1
jne 0x18000b484
sub r9d, eax
add eax, 0x17b1
mov edx, eax
sub edx, r9d
add edx, r10d
cmp eax, 0x776f
jne 0x18000b4d5
sub ecx, r8d
cmp ecx, 0x9b8b
jne 0x18000b4d5
cmp edx, 0x22c2b
jne 0x18000b4d5
cmp r8d, 0xffffc433
jne 0x18000b4d5
lea eax, [rbx + rbx]
cmp eax, 0xfffe39fc
jne 0x18000b4d5
cmp r9d, 0xe04f
je 0x18000b23a
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]