Function at 0x180008560
Capabilities:
Create directory
Create process on windows
Get common file path
Hash data with crc32
Identify system language via api
Monitor clipboard content
Read .ini file
Set environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x450
xor r12d, r12d
lea r15, str.hr_I
mov esi, r12d
lea r14, [rsp + 0x50]
mov ebp, 0x57
nop dword [rax + rax]
cmp dword [0x1801227d0], 0x332e00b0
jne 0x1800086ce
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DnsHostnameToComputerNameW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InterlockedPushListSListEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockShared]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolIo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUserGeoID]
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsCharUpperW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetThreadDesktop]
call qword [sym.imp.USER32.dll_SoundSentry]
xor ecx, ecx
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformationForYear]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DefDlgProcW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphoreWhenCallbackReturns]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_AnimateWindow]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetWindowDC]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDynamicTimeZoneInformation]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetCursorInfo]
xor ecx, ecx
call qword [sym.imp.USER32.dll_UnloadKeyboardLayout]
xor ecx, ecx
call qword [sym.imp.USER32.dll_AddClipboardFormatListener]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForThreadpoolTimerCallbacks]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSizeEx]
xor ecx, ecx
call qword [sym.imp.USER32.dll_DdeGetLastError]
xor ecx, ecx
call qword [sym.imp.USER32.dll_UnregisterSuspendResumeNotification]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessShutdownParameters]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSubMenu]
mov ebx, esi
mov edi, 8
nop word [rax + rax]
cmp dword [0x1801227d0], 0x8f239e89
jne 0x1800087e0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaNodeNumberFromHandle]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeClientComputerNameW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapSize]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_lstrcatW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DnsHostnameToComputerNameW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadProfiling]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCommBreak]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolCleanupGroup]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryExW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FatalAppExitW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
xor edx, edx
lea rcx, [0x18013c8a0]
call qword [sym.imp.KERNEL32.dll_WinExec]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
mov ecx, ebx
mov eax, ebx
and ecx, 1
shr eax, 1
neg ecx
and ecx, 0xedb88320
mov ebx, ecx
xor ebx, eax
sub rdi, 1
jne 0x1800086e0
mov dword [r14], ebx
inc esi
add r14, 4
cmp esi, 0x100
jl 0x1800085a0
mov ebx, 0xffffffff
lea rdi, [0x18013c8b8]
lea rsi, [0x18013c950]
nop word [rax + rax]
dec rbp
cmp dword [0x1801227d0], 0xc3af780b
jne 0x180008a17
mov dword [rsp + 0x28], r12d
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], r12d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandleEx]
mov qword [rsp + 0x48], r12
lea r8, [0x18013c8f0]
mov qword [rsp + 0x40], r12
lea rcx, [0x18013c920]
mov qword [rsp + 0x38], r12
xor r9d, r9d
mov qword [rsp + 0x30], r12
xor edx, edx
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FindNLSStringEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EndUpdateResourceW]
call qword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapeStatus]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor r9d, r9d
mov dword [rsp + 0x20], r12d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLocaleName]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsBadCodePtr]
xor r9d, r9d
mov dword [rsp + 0x28], r12d
xor r8d, r8d
mov dword [rsp + 0x20], r12d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateSemaphoreExW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleCP]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLocaleName]
xor r9d, r9d
mov qword [rsp + 0x20], r12
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov qword [rsp + 0x48], r12
lea r8, [0x18013c990]
mov qword [rsp + 0x40], r12
lea rcx, [0x18013c9b8]
mov qword [rsp + 0x38], r12
xor r9d, r9d
mov qword [rsp + 0x30], r12
xor edx, edx
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_FindNLSStringEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushConsoleInputBuffer]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RaiseException]
movzx edx, byte [r15]
mov ecx, ebx
xor rdx, rcx
shr ebx, 8
movzx ecx, dl
inc r15
xor ebx, dword [rsp + rcx*4 + 0x50]
test rbp, rbp
jne 0x180008830
lea r11, [rsp + 0x450]
not ebx
mov rbp, qword [r11 + 0x28]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret