Function at 0x1800087e0
Capabilities:
Create directory
Get hostname
Get system information on windows
Get uefi variable
Hash data with crc32
Manipulate console buffer
Query environment variable
Read .ini file
Terminate process
Terminate thread
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x450
mov r8d, dword [0x180148604]
lea r14, [rsp + 0x50]
xor r12d, r12d
lea r13, str.16dJyabsZnmY57eIGq6
mov esi, r12d
mov ebp, 0x57
nop dword [rax]
cmp r8d, 0xcf681b02
je 0x180008b99
mov ebx, esi
lea r15, str.AgeZn61uUtauzesZD6pAoP6b1
mov edi, 8
nop dword [rax + rax]
cmp r8d, 0xc437821
jne 0x1800089a1
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AddVectoredContinueHandler]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFirmwareEnvironmentVariableW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryExW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDefaultCommConfigW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
xor r9d, r9d
mov dword [rsp + 0x28], r12d
xor r8d, r8d
mov qword [rsp + 0x20], r12
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CompareStringW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RemoveSecureMemoryCacheCallback]
xor r9d, r9d
mov qword [rsp + 0x20], r12
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UnlockFileEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaProcessorNode]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTapePartition]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesTransactedW]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SleepConditionVariableSRW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualUnlock]
mov qword [rsp + 0x30], r12
lea r8, str.mTVsN88ljBGI2Tcemi8v3rfHVS
mov dword [rsp + 0x28], r12d
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], r13
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNLSString]
mov qword [rsp + 0x48], r12
lea r8, str.AqUlXkaNGw2DKo435982AZC
mov qword [rsp + 0x40], r12
xor r9d, r9d
mov qword [rsp + 0x38], r12
xor edx, edx
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r15
lea rcx, str.UeujlgNuHY4oo74hbhAMfGI4Y1wN
call qword [sym.imp.KERNEL32.dll_FindNLSStringEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekConsoleInputW]
mov r8d, dword [0x180148604]
mov ecx, ebx
mov eax, ebx
and ecx, 1
shr eax, 1
neg ecx
and ecx, 0xedb88320
mov ebx, ecx
xor ebx, eax
sub rdi, 1
jne 0x180008840
mov dword [r14], ebx
lea r15, str.hr_I
add r14, 4
inc esi
cmp esi, 0x100
jl 0x180008820
mov ebx, 0xffffffff
nop dword [rax]
nop word [rax + rax]
dec rbp
cmp r8d, 0xe94cf29e
jne 0x180008b55
xor r9d, r9d
mov qword [rsp + 0x20], r12
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteFileEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCPInfoExW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadIdealProcessor]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadId]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCommBreak]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadpoolTimerEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiber]
call qword [sym.imp.KERNEL32.dll_GetThreadLocale]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommProperties]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteTapemark]
mov qword [rsp + 0x30], r12
lea r8, str.zWUjc9bP141YWkKUoF
mov dword [rsp + 0x28], r12d
lea rcx, str.MP9z34mjoTeTuWrPCGtK4ExlJ46t
xor r9d, r9d
mov qword [rsp + 0x20], r12
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetCalendarInfoEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTimeEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumberOfConsoleMouseButtons]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
xor r9d, r9d
mov qword [rsp + 0x28], r12
xor r8d, r8d
mov qword [rsp + 0x20], r12
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileBandwidthReservation]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteTimerQueueTimer]
xor r9d, r9d
lea rdx, str.rj8uMiMz6i1Wq882T195qv
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumDateFormatsExEx]
mov r8d, dword [0x180148604]
movzx edx, byte [r15]
mov ecx, ebx
xor rdx, rcx
shr ebx, 8
movzx ecx, dl
inc r15
xor ebx, dword [rsp + rcx*4 + 0x50]
test rbp, rbp
jne 0x1800089f0
lea r11, [rsp + 0x450]
not ebx
mov rbp, qword [r11 + 0x38]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]