Function at 0x180006850
Capabilities:
Copy file
Enumerate gui resources
Extract resource via kernel32 functions
Get common file path
Get disk information
Get keyboard layout
Identify system language via api
Manipulate console buffer
Move file
Shutdown system
Terminate process
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push rbx
push rdi
push r13
lea rbp, [rsp - 0x3f]
sub rsp, 0x98
mov rdi, rcx
xor ecx, ecx
call fcn.180088eac
mov ecx, eax
call fcn.180085aa4
call fcn.180085a78
and eax, 0x80000003
jge 0x18000688a
dec eax
or eax, 0xfffffffc
inc eax
xor r13d, r13d
mov qword [rsp + 0xc0], rsi
mov ebx, r13d
test eax, eax
jne 0x1800069e8
cmp dword [0x180125260], 0x24def218
jne 0x1800069d4
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenThread]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteTimerQueueEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ExitWindowsEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayoutList]
xor ecx, ecx
call qword [sym.imp.USER32.dll_CharNextW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCriticalSectionSpinCount]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadpoolStackInformation]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Wow64SetThreadContext]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForThreadpoolTimerCallbacks]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DdeNameService]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapValidate]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PulseEvent]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeLibraryWhenCallbackReturns]
mov qword [rsp + 0x38], r13
xor r9d, r9d
mov dword [rsp + 0x30], r13d
xor r8d, r8d
mov qword [rsp + 0x28], r13
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r13d
call qword [sym.imp.USER32.dll_CreateDesktopExW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
xor r9d, r9d
mov qword [rsp + 0x20], r13
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_RealGetWindowClassW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_UnregisterClassW]
xor r9d, r9d
mov qword [rsp + 0x20], r13
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapePosition]
call qword [sym.imp.USER32.dll_GetCursor]
xor r9d, r9d
mov dword [rsp + 0x28], r13d
xor r8d, r8d
mov dword [rsp + 0x20], r13d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MoveWindow]
mov rdx, qword [rbp + 0x6f]
mov rcx, rdi
call fcn.180001fb0
mov rbx, rax
jmp 0x180007104
cmp eax, 1
jne 0x180006d1e
mov qword [rsp + 0x90], r12
mov ecx, 0x1fa6
mov qword [rsp + 0x88], r14
mov qword [rsp + 0x80], r15
nop
inc ecx
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea edx, [rdx + rdx*2]
cmp ecx, edx
jne 0x180006a10
lea r8d, [rcx - 0x47c9]
mov eax, 0x55555556
imul r8d
mov r11d, 0x11d58
mov eax, edx
sub r11d, ecx
shr eax, 0x1f
mov r9d, r11d
add edx, eax
lea edx, [rdx + rdx*2]
cmp r8d, edx
je 0x180006a7a
nop dword [rax]
nop word [rax + rax]
inc r8d
mov eax, 0x55555556
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea edx, [rdx + rdx*2]
cmp r8d, edx
jne 0x180006a60
sub r8d, r11d
lea eax, [rcx - 0x3c6f]
lea edx, [r9 - 0x20e8]
add r11d, 0x2d75
add edx, eax
lea r9d, [rax + 0x99a]
sub r11d, edx
add r9d, ecx
lea r10d, [r8 + 0x1425]
sub ecx, 0x5717
add edx, r10d
add r11d, 0x2967
mov eax, 0xffffbb25
mov r12d, r10d
sub eax, r10d
mov r14d, ecx
sub eax, r11d
sub r10d, 0x93
add r9d, eax
lea r8d, [rdx - 0x1f62]
lea r15d, [rdx - 0xa3c5]
mov eax, 0x55555556
imul r9d
add r8d, ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea edx, [rdx + rdx*2]
cmp r9d, edx
je 0x180006b1a
nop word [rax + rax]
inc r9d
mov eax, 0x55555556
imul r9d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea edx, [rdx + rdx*2]
cmp r9d, edx
jne 0x180006b00
sub ecx, 0x416
add r11d, r15d
sub r10d, ecx
lea edi, [rcx + r9]
test r8b, 1
je 0x180006b3a
mov ebx, 0x781d
test r8d, r8d
jg 0x180006b3f
mov ebx, 0x3a85
lea eax, [rdi*2 + 0x3b4e]
mov r9d, r10d
sub r9d, eax
mov eax, 0x55555556
imul r11d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r11d, ecx
je 0x180006b6d
mov esi, 0xffffe3e7
test r11d, r11d
jg 0x180006b72
mov esi, 0xffffcdbd
add r8d, ebx
add r8d, r9d
test r8b, 1
je 0x180006b8a
test r8d, r8d
jle 0x180006b8a
add r8d, 0x1f97
lea r9d, [rdi + 0x13aa]
mov eax, 0x55555556
imul r9d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r9d, ecx
je 0x180006bca
nop dword [rax + rax]
inc r9d
mov eax, 0x55555556
imul r9d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r9d, ecx
jne 0x180006bb0
add r8d, 0x2b71
lea eax, [rsi + r9*2]
add eax, r11d
sub r14d, r8d
add r10d, 0xbe6
mov edx, 0xae05
sub edx, r15d
sub r8d, r10d
mov r15, qword [rsp + 0x80]
lea esi, [r9 + rax]
lea edi, [rax + 0x2f4]
sub r8d, edi
lea r11d, [rdx - 0x2dae]
add r11d, r14d
lea ebx, [rdx + 0x8a8]
mov r14, qword [rsp + 0x88]
add ebx, r10d
add r9d, ebx
add r8d, 0xffffb77e
add esi, ebx
lea eax, [r11 - 0x93e1]
sub r11d, r9d
add eax, r12d
mov r12, qword [rsp + 0x90]
add r11d, eax
add r8d, eax
sub r9d, eax
sub r11d, edi
add eax, 0x1ea
sub eax, r9d
test r9b, 1
je 0x180006c62
mov ecx, 0x232e
test r9d, r9d
jg 0x180006c67
mov ecx, 0xffffdcd2
lea edx, [rcx + r9]
cmp edi, 0xffffa993
jne 0x180006d12
cmp esi, 0xa4cc
jne 0x180006d12
cmp edx, 0xffffdb37
jne 0x180006d12
cmp ebx, 0xe14a
jne 0x180006d12
cmp r11d, 0x2fd5d
jne 0x180006d12
cmp r8d, 0x7188
jne 0x180006d12
cmp eax, 0x1034d
jne 0x180006d12
cmp r10d, 0xffff352d
jne 0x180006d12
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea r9, [rbp + 0x7f]
add rax, 0x23d
mov dword [rbp + 0xf], 0x23d
mov qword [rbp + 7], rax
lea r8, [rbp + 0x6f]
movaps xmm0, xmmword [rbp + 7]
lea rax, [rbp + 0x77]
lea rdx, [rbp - 0x19]
movdqa xmmword [rbp + 0x17], xmm0
lea rcx, [rbp + 0x17]
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x77], 4
mov dword [rbp + 0x7f], 0x3000
mov qword [rbp - 0x19], r13
call fcn.1800116d0
mov rbx, rax
jmp 0x180007104
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x180006f24
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea rcx, [rbp + 0x17]
add rax, 0x1fc
mov dword [rbp + 0xf], 0x1fc
mov qword [rbp + 7], rax
movaps xmm0, xmmword [rbp + 7]
movdqa xmmword [rbp + 0x17], xmm0
call fcn.1800118b0
cmp dword [0x180125260], 0xa9dbdee0
mov qword [rbp + 0x7f], rax
jne 0x180006edf
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CommConfigDialogW]
xor r9d, r9d
mov dword [rsp + 0x20], r13d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProfileStringW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeLibraryWhenCallbackReturns]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RaiseException]
mov rax, qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea r9, [rbp + 0x6f]
add rax, 0x288
mov dword [rbp + 0xf], 0x288
mov qword [rbp + 7], rax
lea r8, [rbp + 0x77]
movaps xmm0, xmmword [rbp + 7]
lea rdx, [rbp + 0x7f]
lea rcx, [rbp + 0x17]
movdqa xmmword [rbp + 0x17], xmm0
mov dword [rbp + 0x77], 8
call fcn.180011a60
mov rbx, rax
jmp 0x180007104
cmp eax, 3
jne 0x180007104
mov rax, qword [sym.imp.KERNEL32.dll_LocalAlloc]
lea r8, [rbp + 0x6f]
add rax, 0x18d
mov dword [rbp + 0xf], 0x18d
mov qword [rbp + 7], rax
lea rdx, [rbp + 0x77]
movaps xmm0, xmmword [rbp + 7]
lea rcx, [rbp + 0x17]
movdqa xmmword [rbp + 0x17], xmm0
mov dword [rbp + 0x77], r13d
call fcn.18000f210
mov qword [rbp - 9], rax
lea r9, [rbp + 0x7f]
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea r8, [rbp - 0x19]
add rax, 0x271
mov dword [rbp + 0x1f], 0x271
mov qword [rbp + 0x17], rax
lea rdx, [rbp - 0x11]
movaps xmm0, xmmword [rbp + 0x17]
lea rax, [rbp + 0x77]
lea rcx, [rbp + 0x17]
movdqa xmmword [rbp + 0x17], xmm0
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x77], 4
mov dword [rbp + 0x7f], 0x3000
mov dword [rbp - 0x19], 0x400
mov qword [rbp - 0x11], r13
call fcn.180011c40
mov qword [rbp + 7], rax
lea rdx, [rbp - 9]
mov rax, qword [sym.imp.KERNEL32.dll_LocalLock]
lea rcx, [rbp + 0x17]
mov dword [rbp + 0x1f], 0x25e
add rax, 0x25e
mov qword [rbp + 0x17], rax
movaps xmm0, xmmword [rbp + 0x17]
movdqa xmmword [rbp + 0x17], xmm0
call fcn.18000f3e0
cmp dword [0x180125260], 0xd3ff22c6
mov rbx, rax
jne 0x1800070c3
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexExW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetVolumeMountPointW]
mov dword [rsp + 0x30], r13d
xor r9d, r9d
mov dword [rsp + 0x28], r13d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], r13d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateWaitableTimerExW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessShutdownParameters]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadpoolThreadMinimum]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EraseTape]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCommConfig]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadPriorityBoost]
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFree]
lea r9, [rbp + 0x77]
mov dword [rbp + 0x1f], 0x1f2
lea r8, [rbp + 0x7f]
add rax, 0x1f2
mov dword [rbp + 0x77], 0x8000
mov qword [rbp + 0x17], rax
lea rdx, [rbp + 7]
movaps xmm0, xmmword [rbp + 0x17]
lea rcx, [rbp + 0x17]
movdqa xmmword [rbp + 0x17], xmm0
mov dword [rbp + 0x7f], r13d
call fcn.180011e20
mov rsi, qword [rsp + 0xc0]
mov rax, rbx
add rsp, 0x98
pop r13
pop rdi
pop rbx
pop rbp
ret