Function at 0x180004000
Capabilities:
Delete directory
Get file size
Get hostname
Terminate process
Terminate thread

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x40
cmp dword [rcx + 0x18], 0
mov rbx, rcx
jne 0x18000427f
call fcn.180043238
mov r9d, eax
mov eax, 0x55555556
imul r9d
mov r8d, edx
shr r8d, 0x1f
add edx, r8d
lea ecx, [rdx + rdx*2]
sub r9d, ecx
mov ecx, 1
inc r9d
mov dword [rbx + 0x18], r9d
call fcn.18003d360
mov edx, dword [rbx + 0x18]
mov rdi, rax
sub edx, 1
je 0x180004262
sub edx, 1
je 0x180004082
cmp edx, 1
jne 0x180004272
mov edx, 0x3ec0
mov rcx, rax
call fcn.180005b60
mov qword [rbx + 0x10], rax
jmp 0x180004272
mov qword [rsp + 0x78], rbp
mov ecx, 0xffffe23d
mov qword [rsp + 0x80], r15
nop dword [rax]
nop dword [rax + rax]
inc ecx
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea edx, [rdx + rdx*2]
cmp ecx, edx
jne 0x1800040a0
mov r8d, 0xffffee0d
nop dword [rax]
inc r8d
test r8b, 1
jne 0x1800040c0
mov eax, 0x58ce
lea edx, [rcx - 0x118c0]
sub eax, ecx
lea r15d, [rcx - 0x4d71]
sub edx, eax
lea r11d, [r8 - 0x15714]
mov r9d, eax
add edx, 0x2b65
sub r9d, r8d
mov r13d, 0xfffff282
lea r10d, [rax + 0x749]
add r9d, 0x3eeb8
sub r13d, r9d
mov eax, 0xffffffa1
sub r9d, r10d
lea esi, [rdx + 0x5623]
sub eax, esi
lea ebp, [rdx*2 - 0x625]
add r13d, 0x1a27
add r9d, eax
mov r12d, r13d
mov r14d, 0x9fd2
sub r12d, r14d
mov eax, r11d
sub r15d, edx
add r10d, 0x1f9f
and eax, 0x80000003
jge 0x180004151
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
je 0x180004161
test r11d, r11d
jle 0x180004161
add r11d, 0x1784
lea eax, [r14 + rbp]
sub r9d, r10d
add r11d, eax
lea r14d, [r13 - 0x1b31f]
add esi, 0x284
mov r8d, r9d
add r8d, 0xffffe96a
mov eax, 0xffffe881
sub eax, esi
add r8d, r15d
mov r15, qword [rsp + 0x80]
add r9d, eax
mov eax, 0x55555556
add r10d, 0x1d973
imul r8d
sub ebp, r9d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r8d, ecx
je 0x1800041da
nop dword [rax + rax]
inc r8d
mov eax, 0x55555556
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r8d, ecx
jne 0x1800041c0
sub r14d, r11d
test r10b, 1
je 0x1800041ef
test r10d, r10d
jle 0x1800041ef
add r10d, 0x14de
cmp ebp, 0xfff75ded
mov rbp, qword [rsp + 0x78]
jne 0x180004256
cmp esi, 0xfffed6fc
jne 0x180004256
cmp r13d, 0xfffb9570
jne 0x180004256
cmp r12d, 0xfffaf59e
jne 0x180004256
cmp r14d, 0xfffdb500
jne 0x180004256
cmp r9d, 0x59898
jne 0x180004256
cmp r8d, 0x586f8
jne 0x180004256
cmp r10d, 0x276ea
jne 0x180004256
cmp r11d, 0xfffc2d51
jne 0x180004256
mov edx, 0x3ec0
mov rcx, rdi
call fcn.180005b60
mov qword [rbx + 8], rax
jmp 0x180004272
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov edx, 0x3ec0
mov rcx, rdi
call fcn.180005b60
mov qword [rbx], rax
mov edx, 1
mov rcx, rdi
call fcn.18003d274
mov edx, dword [0x1800c7fa0]
xor esi, esi
cmp edx, 0xc996138d
jne 0x18000439e
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetMenuInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsChild]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolWork]
xor ecx, ecx
call qword [sym.imp.USER32.dll_BringWindowToTop]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DdeSetQualityOfService]
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetTabbedTextExtentW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_FreeDDElParam]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_PhysicalToLogicalPoint]
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ChangeDisplaySettingsExW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_RegisterWindowMessageW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessWorkingSetSize]
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetNumaAvailableMemoryNodeEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteTimerQueueEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThreadpoolWork]
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetAppContainerNamedObjectPath]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitOnceComplete]
mov edx, dword [0x1800c7fa0]
mov ecx, dword [rbx + 0x18]
mov rdi, rsi
sub ecx, 1
je 0x1800043bf
sub ecx, 1
je 0x1800043b9
cmp ecx, 1
jne 0x1800043c2
mov rdi, qword [rbx + 0x10]
jmp 0x1800043c2
mov rdi, qword [rbx + 8]
jmp 0x1800043c2
mov rdi, qword [rbx]
cmp edx, 0x24f40382
jne 0x180004536
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_RegisterPointerInputTarget]
mov dword [rsp + 0x30], esi
xor r9d, r9d
mov dword [rsp + 0x28], esi
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], esi
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetWinEventHook]
lea rdx, str.Cxso5RH2pyNjd1Jz48Xd1Thva5t
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadDescription]
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], esi
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InvalidateRect]
xor r9d, r9d
mov dword [rsp + 0x28], esi
xor r8d, r8d
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ToUnicode]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetNumaAvailableMemoryNodeEx]
mov dword [rsp + 0x30], esi
xor r9d, r9d
mov dword [rsp + 0x28], esi
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], esi
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetWindowPos]
mov r9d, dword [rsp + 0x70]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReadConsoleOutputAttribute]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetCursorInfo]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_CheckRadioButton]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ImpersonateDdeClientWindow]
xor ecx, ecx
call qword [sym.imp.USER32.dll_BringWindowToTop]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PowerClearRequest]
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesTransactedW]
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetMenuItemBitmaps]
mov rbx, qword [rsp + 0x88]
mov rax, rdi
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret