Function at 0x18000ec30
Capabilities:
Create directory
Create process on windows
Get hostname
Identify system language via api
Print debug messages
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
mov dword [rbp + 0x67], 0x4f4
lea rax, [fcn.1800054f0]
add rax, 0x14f
mov qword [rbp - 9], rax
mov dword [rbp - 1], 0x14f
movaps xmm0, xmmword [rbp - 9]
movdqa xmmword [rbp - 9], xmm0
lea rdx, [rbp + 0x67]
lea rcx, [rbp - 9]
call fcn.1800195e0
mov qword [0x18010d358], rax
mov byte [0x18010d354], 1
xor edi, edi
cmp dword [0x18010d350], 0xce641f38
jne 0x18000eda5
call qword [sym.imp.KERNEL32.dll_GetConsoleCP]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsValidCodePage]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaProcessorNodeEx]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindClose]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AllocateUserPhysicalPagesNuma]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLocaleName]
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x180127418]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStringTypeW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitCommEvent]
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadDescription]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeSynchronizationBarrier]
call qword [sym.imp.KERNEL32.dll_SetFileApisToOEM]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCommMask]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeSRWLock]
lea rax, [0x18000a150]
add rax, 0x1cc
mov qword [rbp - 9], rax
mov dword [rbp - 1], 0x1cc
movaps xmm0, xmmword [rbp - 9]
movdqa xmmword [rbp - 9], xmm0
lea rcx, [rbp - 9]
call fcn.180019410
lea rax, [0x180007a10]
add rax, 0x182
mov qword [rbp - 9], rax
mov dword [rbp - 1], 0x182
xor eax, eax
mov word [rbp + 7], ax
mov byte [rbp + 9], al
mov qword [rbp + 0xf], rdi
mov qword [rbp + 0x17], rdi
mov qword [rbp + 0x1f], rdi
mov qword [rbp + 0x27], rdi
mov qword [rbp + 0x2f], rdi
mov ecx, 0x10
call fcn.18006707c
mov qword [rax + 8], rdi
mov qword [rbp + 0xf], rax
lea rcx, [rbp + 0xf]
mov qword [rax], rcx
mov word [rbp + 0x3f], di
mov qword [rbp + 0x45], rdi
mov qword [rbp + 0x4d], rdi
xor eax, eax
mov word [rbp + 0x42], ax
mov byte [rbp + 0x44], al
mov word [rbp + 0x45], ax
mov byte [rbp + 0x47], al
mov word [rbp + 0x48], ax
mov byte [rbp + 0x4a], al
mov word [rbp + 0x4b], ax
mov byte [rbp + 0x4d], al
mov word [rbp + 0x4e], ax
mov byte [rbp + 0x50], al
mov word [rbp + 0x51], ax
mov byte [rbp + 0x53], al
mov dword [rbp + 0xb], edi
mov dword [rbp + 0x3b], edi
movaps xmm0, xmmword [rbp - 9]
movdqa xmmword [rbp - 9], xmm0
lea rdx, [rbp - 9]
lea rcx, [rbp + 7]
call fcn.18001bf60
movzx ebx, byte [rbp + 9]
lea rcx, [rbp + 0xf]
call fcn.180024330
mov rcx, qword [rbp + 0xf]
mov qword [rbp + 0xf], rdi
mov edx, 0x10
call fcn.180066f90
cmp dword [0x18010d350], 0x4a5117a6
jne 0x18000ef80
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThreadpoolIo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Wow64SuspendThread]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorCount]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSizeEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UnregisterWaitEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMemoryErrorHandlingCapabilities]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryTransactedW]
lea rcx, [0x180127458]
call qword [sym.imp.KERNEL32.dll_IsValidLocaleName]
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x180127480]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStringTypeW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetEvent]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadErrorMode]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFileInformationByHandle]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalLock]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateHardLinkTransactedW]
test bl, bl
jne 0x18000ef91
lea rcx, [0x1801274c0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret