Function at 0x18001c4b0
Capabilities:
Create process on windows
Create thread
Delete directory
Delete file
Get disk information
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x410]
sub rsp, 0x510
mov rax, qword [0x18008b0c0]
xor rax, rsp
mov qword [rbp + 0x400], rax
mov rbx, rcx
mov byte [rsp + 0x40], 0
mov rcx, qword [rcx + 8]
sub rcx, qword [rbx]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r12, rax
mov rdx, qword [rbx]
mov r8, qword [rbx + 8]
sub r8, rdx
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
movups xmm0, xmmword [str.1234567812345678]
movups xmmword [rsp + 0x30], xmm0
mov rcx, qword [rbx + 8]
sub rcx, qword [rbx]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r15, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm0
movups xmmword [rbp + 0x50], xmm0
mov dword [rbp + 0x60], eax
lea rdx, str.1234567812345678
lea rcx, [rbp - 0x20]
call fcn.180001ef0
mov r8, qword [rbx + 8]
sub r8, qword [rbx]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x30]
xor edx, edx
lea rcx, [rbp - 0x20]
call fcn.180001fe0
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
xor r13d, r13d
mov qword [rbp - 0x58], r13
mov qword [rbp - 0x50], r13
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [r15 + r8], r13b
jne 0x18001c5a3
mov rdx, r15
lea rcx, [rbp - 0x68]
call fcn.18002a330
nop
mov rcx, qword [rbx + 8]
sub rcx, qword [rbx]
mov rdx, qword [rbp - 0x58]
cmp rcx, rdx
ja 0x18001c5e1
mov qword [rbp - 0x58], rcx
lea rax, [rbp - 0x68]
cmp qword [rbp - 0x50], 0xf
cmova rax, qword [rbp - 0x68]
mov byte [rax + rcx], 0
jmp 0x18001c631
mov rsi, rcx
sub rsi, rdx
mov r8, qword [rbp - 0x50]
mov rax, r8
sub rax, rdx
cmp rsi, rax
ja 0x18001c61d
mov qword [rbp - 0x58], rcx
lea rbx, [rbp - 0x68]
cmp r8, 0xf
cmova rbx, qword [rbp - 0x68]
add rbx, rdx
mov r8, rsi
xor edx, edx
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
mov byte [rbx + rsi], 0
jmp 0x18001c631
mov byte [rsp + 0x20], 0
mov r9, rsi
mov rdx, rsi
lea rcx, [rbp - 0x68]
call fcn.18002a980
lea rdx, [rbp - 0x68]
lea rcx, [rsp + 0x70]
call fcn.180021090
mov rdx, rax
lea rcx, [rbp - 0x48]
call fcn.180014630
nop
lea rcx, [rbp - 0x48]
cmp qword [rbp - 0x30], 0xf
cmova rcx, qword [rbp - 0x48]
mov edx, 0x3a
call qword [sym.imp.VCRUNTIME140.dll_strchr]
test rax, rax
je 0x18001cced
mov byte [rax], 0
lea r10, [rbp - 0x48]
cmp qword [rbp - 0x30], 0xf
cmova r10, qword [rbp - 0x48]
lea rbx, [rax + 1]
mov r9d, r13d
lea r11, [0x180000000]
nop dword [rax]
movsxd rax, r9d
lea rcx, [rax + rax*4]
lea rax, [r11 + 0x8b170]
lea rax, [rax + rcx*8]
mov r8, r10
sub r8, rax
nop dword [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x18001c6c3
inc rax
test ecx, ecx
jne 0x18001c6b0
test edx, edx
je 0x18001c6d5
inc r9d
cmp r9d, 0x14
jl 0x18001c690
jmp 0x18001cced
cmp r9d, 0xffffffff
je 0x18001cced
cmp r9d, 0x13
ja case.default.0x18001c6f7
movsxd rax, r9d
mov edx, dword [r11 + rax*4 + 0x1cdc0]
add rdx, r11
jmp rdx
mov rcx, rbx
call fcn.1800155a0
jmp 0x18001cced
mov rcx, rbx
call fcn.180016060
jmp 0x18001cced
mov rcx, rbx
call fcn.180016340
jmp 0x18001cced
mov rcx, rbx
call fcn.1800145a0
mov rbx, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x18001c73e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
call fcn.1800620a0
jmp 0x18001cced
mov rcx, rbx
call fcn.1800145a0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x18001c775
lea rdx, [0x1800720d0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.180029b00
jmp 0x18001c7ae
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
cmp eax, 3
jne 0x18001c797
lea rdx, [0x1800720e8]
call fcn.180029b00
jmp 0x18001c7ae
lea rdx, [0x180072108]
call fcn.180029b00
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x180029ce0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
jmp 0x18001cced
mov rcx, rbx
call fcn.1800157b0
jmp 0x18001cced
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov r14d, eax
mov ecx, 0x23a6
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
je 0x18001cced
mov byte [rax], 0
lea rcx, [rax - 1]
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x18001c7f7
movzx eax, word [0x180071f0c]
mov word [rcx], ax
mov sil, 0x41
nop dword [rax]
test r14b, 1
je 0x18001c86d
mov rax, rdi
nop dword [rax]
inc rax
cmp byte [rbx + rax], 0
jne 0x18001c820
cmp rax, 1
jbe 0x18001c846
lea rcx, [rbx - 1]
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x18001c833
movzx eax, word [0x180071f10]
mov word [rcx], ax
movsx r9d, sil
mov rcx, rdi
nop dword [rax]
inc rcx
cmp byte [rbx + rcx], 0
jne 0x18001c850
add rcx, rbx
lea r8, str._drive_:__c:_
mov edx, 0x23a6
call fcn.180002230
shr r14d, 1
je 0x18001c87b
inc sil
cmp sil, 0x5a
jle 0x18001c810
lea rcx, [rbx - 1]
nop
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x18001c880
movzx eax, word [0x180071320]
mov word [rcx], ax
mov dword [0x180090e2c], r13d
call fcn.180015370
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rdx, rbx
lea rcx, [0x180071f28]
call fcn.180014d60
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x18001cced
mov rcx, qword [0x180090eb0]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x18001c8de
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x180090e2c], 1
lea rcx, str.exit_n
call fcn.1800155a0
jmp 0x18001cced
mov rcx, rbx
call fcn.180018810
jmp 0x18001cced
mov rcx, rbx
call fcn.180018d70
jmp 0x18001cced
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
inc rdi
cmp byte [rbx + rdi], 0
jne 0x18001c924
mov r8, rdi
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.18002a330
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rdi, rax
lea rbx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rbx, qword [rsp + 0x50]
mov dword [rax], r13d
mov r8d, 0xa
lea rdx, [rbp - 0x70]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtol]
mov esi, eax
cmp rbx, qword [rbp - 0x70]
jne 0x18001c984
lea rcx, str.invalid_stoi_argument
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xinvalid_argument_char_const____ptr64_]
int3
cmp dword [rdi], 0x22
jne 0x18001c997
lea rcx, str.stoi_argument_out_of_range
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const____ptr64_]
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x18001c9d7
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001c9d2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18001c9d2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800620a0
mov r8d, esi
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x18001ca15
lea rdx, str.Failed_to_open_process.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.180001460
mov rcx, rax
lea rdx, [0x1800299c0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x18001cced
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x18001ca55
lea rdx, str.Failed_to_terminate_process.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.180001460
mov rcx, rax
lea rdx, [0x1800299c0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18001cced
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.180017c10
jmp 0x18001cced
cmp byte [0x180090e31], 0
jne 0x18001cab5
cmp byte [rbx], 0x31
jne 0x18001cab5
cmp byte [rbx + 1], 0
jne 0x18001cab5
mov byte [0x180090e31], 1
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, [0x18001b360]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x18001cced
cmp byte [rbx], 0x30
jne 0x18001cced
cmp byte [rbx + 1], 0
jne 0x18001cced
mov byte [0x180090e31], 0
jmp 0x18001cced
cmp byte [rbx], 0x31
jne 0x18001cb0d
cmp byte [rbx + 1], 0
jne 0x18001cb0d
mov byte [0x180090e30], 1
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, [0x1800190e0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x18001cced
cmp byte [rbx], 0x32
jne 0x18001cced
cmp byte [rbx + 1], 0
jne 0x18001cced
mov byte [0x180090e30], 0
lea rcx, [0x1800190e0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18001cced
mov rcx, rbx
call fcn.1800145a0
mov rbx, rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r13
xor r9d, r9d
mov r8, rax
lea rdx, [0x1800726b8]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rcx, rbx
call fcn.1800620a0
jmp 0x18001cced
mov rcx, rbx
call fcn.18001c1a0
jmp 0x18001cced
mov dword [0x180090e28], r13d
jmp 0x18001cced
mov dword [0x180090e2c], r13d
call fcn.180015370
jmp 0x18001cced
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov r14d, eax
mov ecx, 0x23a6
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
je 0x18001cced
mov byte [rax], 0
lea rcx, [rax - 1]
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x18001cbc4
movzx eax, word [0x180071f0c]
mov word [rcx], ax
mov sil, 0x41
nop word [rax + rax]
test r14b, 1
je 0x18001cc3d
mov rax, rdi
nop dword [rax]
inc rax
cmp byte [rbx + rax], 0
jne 0x18001cbf0
cmp rax, 1
jbe 0x18001cc16
lea rcx, [rbx - 1]
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x18001cc03
movzx eax, word [0x180071f10]
mov word [rcx], ax
movsx r9d, sil
mov rcx, rdi
nop dword [rax]
inc rcx
cmp byte [rbx + rcx], 0
jne 0x18001cc20
add rcx, rbx
lea r8, str._drive_:__c:_
mov edx, 0x23a6
call fcn.180002230
shr r14d, 1
je 0x18001cc4b
inc sil
cmp sil, 0x5a
jle 0x18001cbe0
lea rcx, [rbx - 1]
nop
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x18001cc50
movzx eax, word [0x180071320]
mov word [rcx], ax
jmp 0x18001c8aa
mov dword [rsp + 0x28], 0x104
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
mov r9d, edi
mov r8, rbx
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea r9, [rbp - 0x20]
lea r8, [0x1800720c0]
mov edx, 0x104
lea rcx, [rbp + 0x1f0]
call fcn.180002170
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], r13
xor r8d, r8d
lea rdx, [0x1800720c8]
lea rcx, [rsp + 0x30]
call fcn.180029f00
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x1f0]
call fcn.180016d60
jmp 0x18001cced
lea rcx, str.error_n
call fcn.180001330
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 0xf
jbe 0x18001cd3e
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001cd39
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18001cd39
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800620a0
movdqa xmm0, xmmword [0x180075de0]
movdqu xmmword [rbp - 0x38], xmm0
mov byte [rbp - 0x48], 0
mov rdx, qword [rbp - 0x50]
cmp rdx, 0xf
jbe 0x18001cd8d
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001cd88
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18001cd88
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800620a0
mov rcx, qword [rbp + 0x400]
xor rcx, rsp
call fcn.180061d10
lea r11, [rsp + 0x510]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret