Function at 0x1400197c0
Capabilities:
Accept command line arguments
Create thread
Empty recycle bin quietly
Empty the recycle bin
Get disk information
Get system information on windows
Terminate process

Disassembly:
sub rsp, 0xa8
mov rax, qword [0x140041060]
xor rax, rsp
mov qword [rsp + 0x70], rax
call fcn.14001da20
call fcn.140012900
mov qword [0x140043990], rax
test rax, rax
je 0x140019cd9
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xb8], rbp
mov qword [rsp + 0xa0], rdi
mov qword [rsp + 0x98], r12
mov qword [rsp + 0x90], r13
mov qword [rsp + 0x88], r14
xor r14d, r14d
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x80], r15
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x38]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
xor edx, edx
xor ecx, ecx
mov rdi, rax
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
mov ecx, dword [rsp + 0x38]
lea r8, [0x14000ff58]
mov rdx, rdi
call fcn.140015170
test rax, rax
je 0x140019887
mov rcx, rax
mov qword [0x140041b60], rax
call fcn.140015200
mov dword [0x140043998], 1
call fcn.140012500
call fcn.1400127e0
call fcn.140012440
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 7]
call qword [sym.imp.SHELL32.dll_SHEmptyRecycleBinA]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x60]
lea rcx, [0x140043910]
lea eax, [rax*4]
lea edx, [rax + rax*2]
mov r12d, eax
add edx, edx
shr r12d, 1
call fcn.14001da70
lea edx, [r12 + r12*2]
lea rcx, [0x1400438c0]
call fcn.14001da70
lea rbx, [r12*8]
mov ebp, r12d
mov rcx, rbx
call fcn.14001da40
mov rcx, rbx
mov r13, rax
call fcn.14001da40
mov r15, rax
test r13, r13
je 0x140019c84
test rax, rax
je 0x140019c84
mov r8, rbx
mov qword [rsp + 0xc0], rsi
mov rcx, r13
call fcn.14001d9e0
mov rcx, r15
call fcn.14001d9e0
test r12d, r12d
je 0x140019995
mov rdi, r13
mov rbx, r15
sub rdi, r15
mov esi, ebp
nop
mov qword [rsp + 0x28], r14
lea r8, [0x140019300]
mov r9d, 1
mov dword [rsp + 0x20], r14d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], r14
lea r8, [0x140019300]
mov qword [rdi + rbx], rax
xor edx, edx
mov dword [rsp + 0x20], r14d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx], rax
lea rbx, [rbx + 8]
sub rsi, 1
jne 0x140019940
mov rdi, qword [rsp + 0x30]
mov ecx, dword [rsp + 0x38]
lea r8, [0x14000ff68]
mov rdx, rdi
call fcn.140015170
mov ecx, dword [rsp + 0x38]
lea r8, [0x14000ff78]
mov rdx, rdi
mov r14, rax
call fcn.140015170
mov rdi, rax
test r14, r14
je 0x140019a4e
mov rcx, r14
mov esi, 1
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rdx, eax
test eax, eax
jle 0x140019a00
xor eax, eax
mov ecx, eax
cmp word [r14 + rcx*2], 0x2c
jne 0x1400199f2
mov word [r14 + rcx*2], ax
inc esi
inc rcx
cmp rcx, rdx
jl 0x1400199e3
nop word [rax + rax]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
lea rcx, [rcx*2 + 2]
call fcn.14001da40
mov rdx, r14
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, rbx
call fcn.140019530
mov rcx, rbx
call fcn.14001d9c0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cdqe
lea r14, [r14 + rax*2]
sub esi, 1
jne 0x140019a00
test rdi, rdi
je 0x140019af8
mov rcx, rdi
mov esi, 1
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
test eax, eax
jle 0x140019a85
xor edx, edx
mov eax, edx
cmp word [rdi + rax*2], 0x2c
jne 0x140019a7d
mov word [rdi + rax*2], dx
inc esi
inc rax
cmp rax, rcx
jl 0x140019a70
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
movsxd rcx, eax
add rcx, rcx
call fcn.14001da40
mov rdx, rdi
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 2
jne 0x140019ac9
cmp word [rbx + 2], 0x3a
jne 0x140019ac9
movzx ecx, word [rbx]
call fcn.1400196a0
jmp 0x140019ad1
mov rcx, rbx
call fcn.140018f60
mov rcx, rbx
call fcn.14001d9c0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cdqe
lea rdi, [rdi + rax*2]
sub esi, 1
jne 0x140019a85
test rdi, rdi
jne 0x140019b90
test r14, r14
jne 0x140019b90
lea r8, [0x14000ff88]
xor edx, edx
mov ecx, 0x1f0001
call qword [sym.imp.KERNEL32.dll_OpenMutexA]
test rax, rax
jne 0x140019b90
lea r8, [0x14000ff88]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rsi, qword [rsp + 0x30]
mov ecx, dword [rsp + 0x38]
mov rdx, rsi
call fcn.140015110
cmp al, 1
jne 0x140019b47
xor ecx, ecx
call fcn.140019400
call fcn.140012100
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
test eax, eax
je 0x140019b79
mov ebx, 0x41
nop dword [rax]
test dil, 1
je 0x140019b6e
movzx ecx, bx
call fcn.1400196a0
shr edi, 1
inc bx
cmp bx, 0x5a
jbe 0x140019b60
mov ecx, dword [rsp + 0x38]
mov rdx, rsi
call fcn.140015110
test al, al
jne 0x140019b90
xor ecx, ecx
call fcn.140019400
mov rsi, qword [rsp + 0xc0]
test r12d, r12d
je 0x140019c3f
mov rbx, rbp
nop dword [rax]
nop dword [rax + rax]
xor edx, edx
lea rcx, [0x1400438c0]
lea r8d, [rdx + 1]
call fcn.14001db00
sub rbx, 1
jne 0x140019bb0
mov r9d, 0xffffffff
lea r8d, [rbx + 1]
mov rdx, r13
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rbx, rbp
xor edx, edx
lea rcx, [0x140043910]
lea r8d, [rdx + 1]
call fcn.14001db00
sub rbx, 1
jne 0x140019be1
mov r9d, 0xffffffff
lea r8d, [rbx + 1]
mov rdx, r15
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
call fcn.140012440
mov rdi, r13
mov rbx, r15
sub rdi, r15
nop dword [rax]
mov rcx, qword [rbx + rdi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rbx, [rbx + 8]
sub rbp, 1
jne 0x140019c20
jmp 0x140019c74
mov r9d, 0xffffffff
mov r8d, 1
mov rdx, r13
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov r9d, 0xffffffff
mov r8d, 1
mov rdx, r15
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
call fcn.140012440
mov rcx, r13
call fcn.14001d9c0
mov rcx, r15
call fcn.14001d9c0
cmp dword [0x140043998], 0
mov r15, qword [rsp + 0x80]
mov r14, qword [rsp + 0x88]
mov r13, qword [rsp + 0x90]
mov r12, qword [rsp + 0x98]
mov rdi, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0xb8]
mov rbx, qword [rsp + 0xb0]
je 0x140019cca
call fcn.1400153b0
mov rcx, qword [0x140043990]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
call fcn.1400129a0
lea rcx, [0x14000ffc0]
call fcn.1400267f0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]