Function at 0x180003ec0
Capabilities:
Connect pipe
Create directory
Delete directory
Delete file
Get common file path
Get disk size
Get file size
Get geographical location
Get system information on windows
Move file
Read .ini file
Read pipe
Write pipe

Disassembly:
mov dword [rsp + 8], ecx
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x40]
sub rsp, 0x140
call fcn.180099548
mov ebx, eax
mov eax, 0x51eb851f
imul ebx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x64
sub ebx, ecx
inc ebx
xor edi, edi
mov r8d, dword [0x180148604]
cmp r8d, 0xaa5b62c9
jne 0x180004008
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSizeEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeServerSessionId]
call qword [sym.imp.KERNEL32.dll_UnregisterApplicationRecoveryCallback]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TerminateJobObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlsAlloc]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AddAtomW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MoveFileW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DebugSetProcessKillOnExit]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesTransactedW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextVolumeW]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReadDirectoryChangesW]
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CallNamedPipeW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexExW]
mov r8d, dword [0x180148604]
mov eax, 0x55555556
imul ebx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp ebx, ecx
jne 0x1800040b7
movsxd rcx, dword [rbp + 0x60]
call fcn.180093a1c
mov rbx, rax
cmp dword [0x180148604], 0x5f7f465
jne 0x180004780
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetForegroundWindow]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreatePrivateNamespaceW]
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_CopyImage]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelThreadpoolIo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DdeCreateStringHandleW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStructW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
jmp 0x180004780
mov eax, ebx
and eax, 0x80000003
jge 0x1800040c7
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
jne 0x180004543
call fcn.180099548
and eax, 0x80000003
jge 0x1800040e2
dec eax
or eax, 0xfffffffc
inc eax
inc eax
test al, 1
jne 0x180004435
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
add rax, 0x294
mov qword [rbp - 0x30], rax
mov dword [rbp - 0x28], 0x294
movaps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.180012f60
mov qword [rbp - 0x50], rax
lea rax, [rbp - 0x10]
mov qword [rbp + 0x70], rax
lea rax, [rbp - 8]
mov qword [rbp + 0x78], rax
lea rax, [rbp - 0x30]
mov qword [rbp - 0x60], rax
lea rax, [rbp - 0x40]
mov qword [rbp - 0x58], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessTimes]
add rax, 0x291
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], 0x291
xor eax, eax
mov word [rsp + 0x50], ax
mov byte [rsp + 0x52], al
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], rdi
mov ecx, 0x10
call fcn.180093670
mov qword [rax + 8], rdi
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x58]
mov qword [rax], rcx
mov word [rbp - 0x78], di
mov qword [rbp - 0x72], rdi
mov qword [rbp - 0x6a], rdi
xor eax, eax
mov word [rbp - 0x75], ax
mov byte [rbp - 0x73], al
mov word [rbp - 0x72], ax
mov byte [rbp - 0x70], al
mov word [rbp - 0x6f], ax
mov byte [rbp - 0x6d], al
mov word [rbp - 0x6c], ax
mov byte [rbp - 0x6a], al
mov word [rbp - 0x69], ax
mov byte [rbp - 0x67], al
mov word [rbp - 0x66], ax
mov byte [rbp - 0x64], al
mov dword [rbp - 0x7c], edi
mov dword [rsp + 0x54], edi
lea rcx, [rsp + 0x50]
call fcn.18002bc00
test al, al
je 0x180004217
lea rdx, [rbp + 0x68]
lea rcx, [rsp + 0x50]
call fcn.18002bd90
mov byte [rbp - 0x78], 0
lea rcx, [rsp + 0x50]
mov qword [rbp - 0x20], rcx
and al, 1
mov byte [rbp - 0x18], al
mov dl, 1
lea rcx, [rbp - 0x20]
call fcn.1800190e0
lea rcx, [rsp + 0x50]
call fcn.180030130
lea rax, [rsp + 0x50]
mov qword [rbp + 0x68], rax
lea rdx, [rbp + 0x68]
call fcn.180025420
mov byte [rbp + 0x68], 0
mov r8b, 1
lea rdx, [rbp + 0x68]
lea rcx, [rsp + 0x50]
call fcn.1800251b0
mov byte [rbp + 0x68], 0
mov r8b, 1
lea rdx, [rbp + 0x68]
lea rcx, [rsp + 0x50]
call fcn.180025280
mov byte [rbp + 0x68], 0
mov r8b, 1
lea rdx, [rbp + 0x68]
lea rcx, [rsp + 0x50]
call fcn.180025350
mov byte [rbp + 0x68], 0
mov r8b, 1
lea rdx, [rbp + 0x68]
lea rcx, [rsp + 0x50]
call fcn.1800251b0
mov byte [rbp + 0x68], 0
mov r8b, 1
lea rdx, [rbp + 0x68]
lea rcx, [rsp + 0x50]
call fcn.180025280
mov byte [rbp + 0x68], 0
mov r8b, 1
lea rdx, [rbp + 0x68]
lea rcx, [rsp + 0x50]
call fcn.1800255e0
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rbp], xmm0
lea rax, [rbp + 0x70]
mov qword [rbp + 0x10], rax
lea rax, [rbp + 0x78]
mov qword [rbp + 0x18], rax
lea rax, [rbp - 0x60]
mov qword [rbp + 0x20], rax
lea rax, [rbp - 0x58]
mov qword [rbp + 0x28], rax
lea rax, [rbp - 0x50]
mov qword [rbp + 0x30], rax
mov r8b, 1
lea rdx, [rbp]
lea rcx, [rsp + 0x50]
call fcn.1800256b0
nop
lea rcx, [rsp + 0x58]
call fcn.180018900
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x58], rdi
mov edx, 0x10
call fcn.180093584
lea rax, [rbp - 0x48]
mov qword [rbp + 0x68], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
add rax, 0x159
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], 0x159
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rbp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.180013110
mov dword [rbp + 0x68], edi
mov rax, qword [sym.imp.KERNEL32.dll_GlobalAlloc]
add rax, 0x233
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], 0x233
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea r8, [rbp + 0x60]
lea rdx, [rbp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.1800132d0
mov qword [rbp - 0x38], rax
movabs r8, 0xd6bf94d5e57a42bd
mov rax, r8
mul qword [rbp - 0x48]
mov rcx, rdx
shr rcx, 0x17
mov rax, r8
mul qword [rbp - 0x40]
shr rdx, 0x17
sub rcx, rdx
cmp rcx, 0x12c
jbe 0x1800043fd
mov dword [rbp + 0x68], 1
mov dword [rbp + 0x70], 1
mov qword [rbp + 0x78], rdi
mov rax, qword [sym.imp.KERNEL32.dll_CreateSemaphoreA]
add rax, 0x148
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], 0x148
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea r9, [rbp + 0x68]
lea r8, [rbp + 0x70]
lea rdx, [rbp + 0x78]
lea rcx, [rsp + 0x40]
call fcn.1800134a0
mov rax, qword [sym.imp.KERNEL32.dll_GlobalLock]
add rax, 0x1cb
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], 0x1cb
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rbp - 0x38]
lea rcx, [rsp + 0x40]
call fcn.180013690
jmp 0x18000477d
movsxd rdx, dword [rbp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbp + 0x68], rax
cmp dword [0x180148604], 0xb1b8410b
jne 0x18000450b
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteFileTransactedW]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SendDlgItemMessageW]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_UnregisterSuspendResumeNotification]
mov word [rsp + 0x20], di
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxExW]
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
call qword [sym.imp.USER32.dll_GetClipboardOwner]
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetCaretBlinkTime]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TerminateJobObject]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetComputerNameW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemPowerStatus]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DrawTextExW]
mov rax, qword [sym.imp.KERNEL32.dll_LocalLock]
add rax, 0x28a
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], 0x28a
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rbp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.180013690
jmp 0x18000477d
test bl, 1
jne 0x1800045ec
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
add rax, 0x192
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], 0x192
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.180012f60
mov rbx, rax
cmp dword [0x180148604], 0x47c4bb02
jne 0x1800045d5
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AddSIDToBoundaryDescriptor]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor r8d, r8d
xor edx, edx
lea rcx, str.A27rEFnnsJPSCP2BlMn
call qword [sym.imp.KERNEL32.dll_ResolveLocaleName]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemFileCacheSize]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RegisterBadMemoryNotification]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
movsxd r8, dword [rbp + 0x60]
mov edx, 8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
jmp 0x18000477d
cmp r8d, 0xb141e661
jne 0x180004727
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryTransactedW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolTimer]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumSystemLanguageGroupsW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateWaitableTimerExW]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemFileCacheSize]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessWorkingSetSizeEx]
lock inc dword [rdi]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockShared]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfoEx]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStructW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReadConsoleInputW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SwitchToFiber]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RequestWakeupLatency]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8, str.QTluM71fGu6vvoU
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStringTypeA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetDefaultDllDirectories]
xor r8d, r8d
lea rdx, str.ipNF9bxoyzmlzZe63a46fyHttN9h3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsValidNLSVersion]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
mov dword [rbp + 0x68], 4
mov dword [rbp + 0x70], 0x3000
mov qword [rbp + 0x78], rdi
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
add rax, 0x240
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], 0x240
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rax, [rbp + 0x68]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x70]
lea r8, [rbp + 0x60]
lea rdx, [rbp + 0x78]
lea rcx, [rsp + 0x40]
call fcn.180013850
mov rbx, rax
test rbx, rbx
jne 0x1800048b3
cmp dword [0x180148604], 0x28ecf4d3
jne 0x180004875
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindAtomW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlsAlloc]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeClientSessionId]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDateFormatW]
call qword [sym.imp.KERNEL32.dll_GetACP]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetUserGeoID]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapSize]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetVolumeMountPointW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLocaleName]
mov qword [rsp + 0x20], rdi
mov r9d, dword [rbp + 0x68]
mov r8d, dword [rbp + 0x68]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReadConsoleOutputW]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFullPathNameTransactedW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFileTime]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadpoolThreadMinimum]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
lea rax, [fcn.1800a2660]
add rax, 0x280
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], 0x280
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.180012a20
add rsp, 0x140
pop rdi
pop rbx
pop rbp
ret
mov rax, rbx
add rsp, 0x140
pop rdi
pop rbx
pop rbp
ret