Function at 0x100041a0
Capabilities:
Create directory
Delete directory
Enumerate system firmware tables
Get disk size
Print debug messages
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x30]
push ecx
lea edx, [ebp - 0x18]
push edx
mov ecx, dword [ebp + 8]
call fcn.10011fb0
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
jne 0x100041d0
fld qword [0x1006a3b0]
jmp 0x10004426
mov eax, dword [0x10077b04]
xor ecx, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0x10], 0xdaba66ec
jne 0x1000440b
cmp dword [ebp - 0xc], 0
jne 0x1000440b
push 0
call dword [sym.imp.KERNEL32.dll_QueryUnbiasedInterruptTime]
push 0
call dword [sym.imp.KERNEL32.dll_DebugActiveProcessStop]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSectionWhenCallbackReturns]
push 0
push 0
push 0
push 0
push str.ybvxzdekH5osa8u
push 0
push str.S52y7K4pt6fnOK8atIub
call dword [sym.imp.KERNEL32.dll_GetCalendarInfoEx]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExW]
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
push 0
mov eax, dword [ebp - 4]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputAttribute]
push 0
call dword [sym.imp.KERNEL32.dll_SwitchToFiber]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AllocateUserPhysicalPagesNuma]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueueUserWorkItem]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetVolumeLabelW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_PeekConsoleInputW]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
call dword [sym.imp.KERNEL32.dll_GetTapeStatus]
push 0
call dword [sym.imp.KERNEL32.dll_CloseThreadpoolTimer]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadDirectoryChangesW]
push 0
call dword [sym.imp.KERNEL32.dll_DebugSetProcessKillOnExit]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaProximityNodeEx]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformationForYear]
push str.U6riVP6C6Q4NQJD84gS
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingFromApp]
push 0
call dword [sym.imp.KERNEL32.dll_CloseThreadpool]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
xor ecx, ecx
xor edx, edx
xchg dword [edx], ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
push 0
push 0
push str.5S4l3rcFtDNiIn2OzEdke
push 0
push 0
push str.HYRVNQZkYM9vd1Ia2h
call dword [sym.imp.KERNEL32.dll_GetTimeFormatEx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetDefaultCommConfigW]
push 0
call dword [sym.imp.KERNEL32.dll_InitializeConditionVariable]
push 0
push 0
push str.16fgy741vIIL19xx55ath7v7QDU4
call dword [sym.imp.KERNEL32.dll_ResolveLocaleName]
push 0
push str.xBE7RCdwyFDUho74E6rOe14iDZ74
push 0
call dword [sym.imp.KERNEL32.dll_GetNLSVersionEx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_Wow64SetThreadContext]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push 0
call dword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0
push 0
push str.a12TvGz6H541FjMqOR
push 0
push str.JizVladuEL4X6b9Z2oM2
call dword [sym.imp.KERNEL32.dll_CompareStringOrdinal]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFiber]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GlobalReAlloc]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetWaitableTimer]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeServerProcessId]
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemFirmwareTables]
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
call fcn.1005efd0
divsd xmm0, qword [0x1006a3a8]
movsd qword [ebp - 0x20], xmm0
fld qword [ebp - 0x20]
mov esp, ebp
pop ebp
ret