Function at 0x1800057c0
Capabilities:
Create directory
Delete file
Get disk information
Identify system language via api
Terminate process

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0xb8
call fcn.180044dc8
mov ebx, eax
mov eax, 0x51eb851f
imul ebx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x64
sub ebx, ecx
inc ebx
xor r15d, r15d
mov r8d, dword [0x1800c9fa0]
cmp r8d, 0x52e9baef
jne 0x18000590f
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_CharLowerBuffW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetClassWord]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetLayeredWindowAttributes]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryTransactedW]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
call qword [sym.imp.USER32.dll_GetClipboardSequenceNumber]
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetMenuItemBitmaps]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RegisterApplicationRecoveryCallback]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_AdjustWindowRect]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphoreWhenCallbackReturns]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetWindowRect]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ShowWindow]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnumDisplaySettingsExW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DdePostAdvise]
call qword [sym.imp.KERNEL32.dll_UnregisterApplicationRecoveryCallback]
xor edx, edx
lea rcx, str.d6P2ceGF85Lt5hdO
call qword [sym.imp.KERNEL32.dll_LoadPackagedLibrary]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WakeConditionVariable]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_WaitForInputIdle]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetMenuBarInfo]
mov r8d, dword [0x1800c9fa0]
mov eax, 0x55555556
imul ebx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp ebx, ecx
jne 0x180005a4a
cmp r8d, 0x5e295851
jne 0x180005a2b
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
lea rdx, str.RpDs6ULI563RDn8981Am8bCbXTDV
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileMUIPath]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
call qword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthW]
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lock dec dword [r15]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFileCompletionNotificationModes]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindClose]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushConsoleInputBuffer]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFullPathNameTransactedW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsValidLanguageGroup]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PulseEvent]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemFileCacheSize]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThreadpoolIo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalSize]
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlPcToFileHeader]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFirmwareType]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov edx, dword [rbp + 0x6f]
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
jmp 0x180005da8
test bl, 1
jne 0x180005b45
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
add rax, 0x177
mov qword [rbp - 0x49], rax
mov dword [rbp - 0x41], 0x177
movaps xmm0, xmmword [rbp - 0x49]
movdqa xmmword [rbp - 0x49], xmm0
lea rcx, [rbp - 0x49]
call fcn.18000c0e0
mov qword [rbp + 0x77], rax
mov dword [rbp + 0x67], 8
mov rax, qword [sym.imp.KERNEL32.dll_HeapAlloc]
add rax, 0x1df
mov qword [rbp - 0x49], rax
mov dword [rbp - 0x41], 0x1df
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
mov qword [rbp - 0x21], r15
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov ecx, 0x10
call fcn.18003eef0
mov qword [rax + 8], r15
mov qword [rbp - 0x21], rax
lea rcx, [rbp - 0x21]
mov qword [rax], rcx
mov word [rbp + 0xf], r15w
mov qword [rbp + 0x15], r15
mov qword [rbp + 0x1d], r15
xor eax, eax
mov word [rbp + 0x12], ax
mov byte [rbp + 0x14], al
mov word [rbp + 0x15], ax
mov byte [rbp + 0x17], al
mov word [rbp + 0x18], ax
mov byte [rbp + 0x1a], al
mov word [rbp + 0x1b], ax
mov byte [rbp + 0x1d], al
mov word [rbp + 0x1e], ax
mov byte [rbp + 0x20], al
mov word [rbp + 0x21], ax
mov byte [rbp + 0x23], al
mov dword [rbp - 0x25], r15d
mov dword [rbp + 0xb], r15d
movaps xmm0, xmmword [rbp - 0x49]
movdqa xmmword [rbp - 0x49], xmm0
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x67]
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 0x39]
call fcn.18000dbc0
mov rbx, qword [rbp - 0x31]
jmp 0x180005d8d
mov ecx, 0xffffb80b
nop word [rax + rax]
inc ecx
test cl, 1
jne 0x180005b50
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea edx, [rdx + rdx*2]
cmp ecx, edx
je 0x180005b87
nop dword [rax]
inc ecx
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea edx, [rdx + rdx*2]
cmp ecx, edx
jne 0x180005b70
lea r14d, [rcx + 0x7646]
mov r10d, 0xffffe8b8
sub r10d, ecx
mov r8d, 0xffffbf8e
mov r9d, 0xfffff3c7
inc r9d
test r9b, 1
jne 0x180005ba3
lea ebx, [rcx + 0x9614]
mov r11d, 0x98ff
sub r11d, r9d
add r9d, r10d
sub r11d, ebx
add ebx, 0x19ab
nop word [rax + rax]
inc r8d
mov eax, 0x55555556
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r8d, ecx
jne 0x180005bd0
mov esi, r14d
sub esi, r8d
sub r8d, 0x19ab
lea edx, [r10 + 0x39df]
sub r9d, ebx
mov eax, r14d
sub eax, r9d
add eax, r10d
lea edi, [r8 - 0x11e92]
add edi, eax
mov ecx, edx
test dl, 1
je 0x180005c24
test edx, edx
jle 0x180005c24
lea ecx, [rdx + 0x3cb]
mov eax, 0xffffda85
sub eax, edi
add r8d, eax
mov eax, 0xffffdfae
sub eax, r10d
lea edx, [rsi + 0x33cd]
sub ecx, r8d
lea r10d, [r11 + 0x175b]
add r10d, edi
sub ecx, edx
sub r10d, eax
lea r11d, [rax + 0x26b1]
mov eax, 0xa8ab
sub edx, r11d
nop dword [rax]
inc eax
test al, 1
jne 0x180005c60
cmp edi, 0xffff29a7
jne 0x180005dbb
cmp ecx, 0xffff7504
jne 0x180005dbb
cmp r9d, 0xffffbca9
jne 0x180005dbb
cmp r14d, 0x2e52
jne 0x180005dbb
cmp eax, 0xa8ac
jne 0x180005dbb
cmp edx, 0xccdd
jne 0x180005dbb
cmp ebx, 0x67cb
jne 0x180005dbb
cmp r11d, 0xffffd5b3
jne 0x180005dbb
cmp r8d, 0x56c2
jne 0x180005dbb
cmp r10d, 0xffffe917
jne 0x180005dbb
lea rax, [fcn.180049254]
add rax, 0x16a
mov qword [rbp - 0x49], rax
mov dword [rbp - 0x41], 0x16a
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
mov qword [rbp - 0x21], r15
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov ecx, 0x10
call fcn.18003eef0
mov qword [rax + 8], r15
mov qword [rbp - 0x21], rax
lea rcx, [rbp - 0x21]
mov qword [rax], rcx
mov word [rbp + 0xf], r15w
mov qword [rbp + 0x15], r15
mov qword [rbp + 0x1d], r15
xor eax, eax
mov word [rbp + 0x12], ax
mov byte [rbp + 0x14], al
mov word [rbp + 0x15], ax
mov byte [rbp + 0x17], al
mov word [rbp + 0x18], ax
mov byte [rbp + 0x1a], al
mov word [rbp + 0x1b], ax
mov byte [rbp + 0x1d], al
mov word [rbp + 0x1e], ax
mov byte [rbp + 0x20], al
mov word [rbp + 0x21], ax
mov byte [rbp + 0x23], al
mov dword [rbp - 0x25], r15d
mov dword [rbp + 0xb], r15d
movaps xmm0, xmmword [rbp - 0x49]
movdqa xmmword [rbp - 0x49], xmm0
lea r8, [rbp + 0x6f]
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 0x39]
call fcn.18000d9d0
mov rbx, qword [rbp - 0x31]
lea rcx, [rbp - 0x21]
call fcn.18000f280
mov rcx, qword [rbp - 0x21]
mov qword [rbp - 0x21], r15
mov edx, 0x10
call fcn.18003ee04
mov rax, rbx
add rsp, 0xb8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]