Function at 0x1400196c0
Capabilities:
Accept command line arguments
Create thread
Empty recycle bin quietly
Empty the recycle bin
Get disk information
Get system information on windows
Terminate process

Disassembly:
sub rsp, 0xa8
mov rax, qword [0x14003f060]
xor rax, rsp
mov qword [rsp + 0x70], rax
call fcn.14001d910
call fcn.140012800
mov qword [0x140041990], rax
test rax, rax
je 0x140019bd9
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xb8], rbp
mov qword [rsp + 0xa0], rdi
mov qword [rsp + 0x98], r12
mov qword [rsp + 0x90], r13
mov qword [rsp + 0x88], r14
xor r14d, r14d
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x80], r15
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x38]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
xor edx, edx
xor ecx, ecx
mov rdi, rax
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
mov ecx, dword [rsp + 0x38]
lea r8, [0x14000fe90]
mov rdx, rdi
call fcn.140015070
test rax, rax
je 0x140019787
mov rcx, rax
mov qword [0x14003fb60], rax
call fcn.140015100
mov dword [0x140041998], 1
call fcn.140012400
call fcn.1400126e0
call fcn.140012340
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 7]
call qword [sym.imp.SHELL32.dll_SHEmptyRecycleBinA]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x60]
lea rcx, [0x140041910]
lea eax, [rax*4]
lea edx, [rax + rax*2]
mov r12d, eax
add edx, edx
shr r12d, 1
call fcn.14001d960
lea edx, [r12 + r12*2]
lea rcx, [0x1400418c0]
call fcn.14001d960
lea rbx, [r12*8]
mov ebp, r12d
mov rcx, rbx
call fcn.14001d930
mov rcx, rbx
mov r13, rax
call fcn.14001d930
mov r15, rax
test r13, r13
je 0x140019b84
test rax, rax
je 0x140019b84
mov r8, rbx
mov qword [rsp + 0xc0], rsi
mov rcx, r13
call fcn.14001d8d0
mov rcx, r15
call fcn.14001d8d0
test r12d, r12d
je 0x140019895
mov rdi, r13
mov rbx, r15
sub rdi, r15
mov esi, ebp
nop
mov qword [rsp + 0x28], r14
lea r8, [0x140019200]
mov r9d, 1
mov dword [rsp + 0x20], r14d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], r14
lea r8, [0x140019200]
mov qword [rdi + rbx], rax
xor edx, edx
mov dword [rsp + 0x20], r14d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx], rax
lea rbx, [rbx + 8]
sub rsi, 1
jne 0x140019840
mov rdi, qword [rsp + 0x30]
mov ecx, dword [rsp + 0x38]
lea r8, [0x14000fea0]
mov rdx, rdi
call fcn.140015070
mov ecx, dword [rsp + 0x38]
lea r8, [0x14000feb0]
mov rdx, rdi
mov r14, rax
call fcn.140015070
mov rdi, rax
test r14, r14
je 0x14001994e
mov rcx, r14
mov esi, 1
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rdx, eax
test eax, eax
jle 0x140019900
xor eax, eax
mov ecx, eax
cmp word [r14 + rcx*2], 0x2c
jne 0x1400198f2
mov word [r14 + rcx*2], ax
inc esi
inc rcx
cmp rcx, rdx
jl 0x1400198e3
nop word [rax + rax]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
lea rcx, [rcx*2 + 2]
call fcn.14001d930
mov rdx, r14
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, rbx
call fcn.140019430
mov rcx, rbx
call fcn.14001d8b0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cdqe
lea r14, [r14 + rax*2]
sub esi, 1
jne 0x140019900
test rdi, rdi
je 0x1400199f8
mov rcx, rdi
mov esi, 1
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
test eax, eax
jle 0x140019985
xor edx, edx
mov eax, edx
cmp word [rdi + rax*2], 0x2c
jne 0x14001997d
mov word [rdi + rax*2], dx
inc esi
inc rax
cmp rax, rcx
jl 0x140019970
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
movsxd rcx, eax
add rcx, rcx
call fcn.14001d930
mov rdx, rdi
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 2
jne 0x1400199c9
cmp word [rbx + 2], 0x3a
jne 0x1400199c9
movzx ecx, word [rbx]
call fcn.1400195a0
jmp 0x1400199d1
mov rcx, rbx
call fcn.140018e60
mov rcx, rbx
call fcn.14001d8b0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cdqe
lea rdi, [rdi + rax*2]
sub esi, 1
jne 0x140019985
test rdi, rdi
jne 0x140019a90
test r14, r14
jne 0x140019a90
lea r8, [0x14000fec0]
xor edx, edx
mov ecx, 0x1f0001
call qword [sym.imp.KERNEL32.dll_OpenMutexA]
test rax, rax
jne 0x140019a90
lea r8, [0x14000fec0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rsi, qword [rsp + 0x30]
mov ecx, dword [rsp + 0x38]
mov rdx, rsi
call fcn.140015010
cmp al, 1
jne 0x140019a47
xor ecx, ecx
call fcn.140019300
call fcn.140012000
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
test eax, eax
je 0x140019a79
mov ebx, 0x41
nop dword [rax]
test dil, 1
je 0x140019a6e
movzx ecx, bx
call fcn.1400195a0
shr edi, 1
inc bx
cmp bx, 0x5a
jbe 0x140019a60
mov ecx, dword [rsp + 0x38]
mov rdx, rsi
call fcn.140015010
test al, al
jne 0x140019a90
xor ecx, ecx
call fcn.140019300
mov rsi, qword [rsp + 0xc0]
test r12d, r12d
je 0x140019b3f
mov rbx, rbp
nop dword [rax]
nop dword [rax + rax]
xor edx, edx
lea rcx, [0x1400418c0]
lea r8d, [rdx + 1]
call fcn.14001d9f0
sub rbx, 1
jne 0x140019ab0
mov r9d, 0xffffffff
lea r8d, [rbx + 1]
mov rdx, r13
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rbx, rbp
xor edx, edx
lea rcx, [0x140041910]
lea r8d, [rdx + 1]
call fcn.14001d9f0
sub rbx, 1
jne 0x140019ae1
mov r9d, 0xffffffff
lea r8d, [rbx + 1]
mov rdx, r15
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
call fcn.140012340
mov rdi, r13
mov rbx, r15
sub rdi, r15
nop dword [rax]
mov rcx, qword [rbx + rdi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rbx, [rbx + 8]
sub rbp, 1
jne 0x140019b20
jmp 0x140019b74
mov r9d, 0xffffffff
mov r8d, 1
mov rdx, r13
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov r9d, 0xffffffff
mov r8d, 1
mov rdx, r15
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
call fcn.140012340
mov rcx, r13
call fcn.14001d8b0
mov rcx, r15
call fcn.14001d8b0
cmp dword [0x140041998], 0
mov r15, qword [rsp + 0x80]
mov r14, qword [rsp + 0x88]
mov r13, qword [rsp + 0x90]
mov r12, qword [rsp + 0x98]
mov rdi, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0xb8]
mov rbx, qword [rsp + 0xb0]
je 0x140019bca
call fcn.1400152b0
mov rcx, qword [0x140041990]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
call fcn.1400128a0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]