Function at 0x10005b70
Capabilities:
Connect pipe
Copy file
Create pipe
Delete directory
Get common file path
Get file size
Get hostname
Get memory capacity
Get system information on windows
Identify system language via api
Set console window title
Set current directory
Terminate process
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10035d9d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x478
push esi
push edi
call fcn.100035f0
push 0x10090d38
lea ecx, [ebp - 0x74]
call fcn.1000be70
mov dword [ebp - 4], 0
lea eax, [ebp - 0x74]
push eax
call fcn.10005a60
add esp, 4
mov dword [ebp - 0x50], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x74]
call fcn.1000bda0
cmp dword [0x10037b08], 0x7825249
jne 0x10005d96
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea eax, [ebp - 0x27c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jbe 0x10005de8
cmp dword [ebp - 0x48], 0x104
jae 0x10005de8
lea ecx, [ebp - 0x484]
push ecx
push 0
push 0x10090e48
lea edx, [ebp - 0x27c]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x10005de8
lea eax, [ebp - 0x484]
push eax
call fcn.10009640
add esp, 4
push 0x4fad6f3d
push 0xef6a4fba
push 0x75fb58f2
call fcn.10005390
add esp, 0xc
cmp dword [0x10037b08], 0x7825249
jne 0x10005fba
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadpoolThreadMaximum]
push 0
call dword [sym.imp.GDI32.dll_GetGraphicsMode]
push 0
push 0
call dword [sym.imp.GDI32.dll_CreateHatchBrush]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMask]
push 0
call dword [sym.imp.KERNEL32.dll_CloseThreadpoolWait]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetSystemPowerState]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ClosePrivateNamespace]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DeleteTimerQueueEx]
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleCP]
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryTransactedW]
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleHistoryInfo]
call dword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
xor eax, eax
xor edx, edx
xor esi, esi
xor edi, edi
xor ecx, ecx
push ebx
mov ebx, edi
lock cmpxchg8b qword [esi]
mov edi, ebx
pop ebx
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTapeParameters]
push 0
call dword [sym.imp.GDI32.dll_GdiSetBatchLimit]
push 0
call dword [sym.imp.KERNEL32.dll_CancelSynchronousIo]
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FlsSetValue]
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetBoundsRect]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFiber]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_PlgBlt]
push 0
call dword [sym.imp.KERNEL32.dll_PowerCreateRequest]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFileExNuma]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
push 0
push 0
push 0
push 0x10090e54
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TzSpecificLocalTimeToSystemTime]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceLanguagesW]
push 0
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStructW]
mov ecx, dword [ebp - 0x50]
push ecx
call fcn.10004f00
add esp, 4
mov dword [ebp - 0x5c], eax
cmp dword [0x10037b08], 0x7825249
jne 0x10006139
push 0
call dword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileBandwidthReservation]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
push 0
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThreadpoolWork]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapSize]
push 0
call dword [sym.imp.KERNEL32.dll_QueryDepthSList]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFiberEx]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProfileStringW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetMailslotInfo]
push 0
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetTapeParameters]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TransmitCommChar]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_RtlCaptureStackBackTrace]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDllDirectory]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExW]
push 0
push 0
push 0x10090e70
push 0
push 0x10090e98
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExEx]
push 0
call dword [sym.imp.KERNEL32.dll_FindAtomW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadDescription]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetApplicationRestartSettings]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeServerSessionId]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
push 0
call fcn.10004d00
add esp, 4
mov dword [ebp - 0x18], 0x375
mov dword [ebp - 0x1c], 0
mov edx, dword [ebp - 0x1c]
add edx, 0x21d6
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x2c], 0x1421
mov dword [ebp - 0x10], 0xba8
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x20], 0x151c
mov dword [ebp - 0x34], 0x24ed
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x34]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
and ecx, 0x80000003
jns 0x100061a0
dec ecx
or ecx, 0xfffffffc
inc ecx
test ecx, ecx
je 0x100061b6
cmp dword [ebp - 0x20], 0
jle 0x100061b6
mov edx, dword [ebp - 0x20]
sub edx, 0x1daa
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x40], 0
jmp 0x100061d1
mov ecx, dword [ebp - 0x40]
add ecx, 1
mov dword [ebp - 0x40], ecx
cmp dword [ebp - 0x40], 0x10
jge 0x100061e2
mov edx, dword [ebp - 0x2c]
add edx, 8
mov dword [ebp - 0x2c], edx
jmp 0x100061c8
mov eax, dword [ebp - 0x14]
add eax, 0x219b
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x30], 0
mov ecx, dword [ebp - 0x30]
add ecx, 0x1123
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x10]
sub edx, 0x219c
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x3c], 0xbfb
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x3c]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
add ecx, 0x808
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
add edx, 0x20ac
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x38], 0x1879
mov eax, dword [ebp - 0x38]
add eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x18]
add ecx, 0xbe9
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 0x30]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x28]
add eax, 0x8b3
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], 0
mov ecx, dword [ebp - 0x24]
add ecx, 0xf66
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x38]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x10]
sub eax, 0x324
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x10]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x1c]
add edx, 0x1cfe
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x38]
sub eax, 0x6b1
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
add ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 0x28]
add edx, 0x159b
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x1c]
add eax, 0x56c
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x28]
add ecx, 0xaad
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x10]
add edx, 0x18f1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x14]
add eax, 0xe5f
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x18]
add ecx, 0x361
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x14]
sub edx, 0x710
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x3c]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x20]
add ecx, 0x2200
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x44], 0
jmp 0x1000632d
mov edx, dword [ebp - 0x44]
add edx, 1
mov dword [ebp - 0x44], edx
cmp dword [ebp - 0x44], 0x43
jge 0x1000633e
mov eax, dword [ebp - 0x28]
sub eax, 8
mov dword [ebp - 0x28], eax
jmp 0x10006324
mov ecx, dword [ebp - 0x2c]
sub ecx, 0x12ce
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x34]
sub edx, 0x969
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x18]
add eax, 0x97c
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x18]
add edx, dword [ebp - 0x34]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x20]
sub eax, 0x49c
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x28]
add ecx, 0x20a3
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x34]
add edx, dword [ebp - 0x10]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x14]
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x24]
add ecx, 0x1283
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x14]
add edx, dword [ebp - 0x34]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x3c]
and eax, 0x80000003
jns 0x100063c0
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
je 0x100063d6
cmp dword [ebp - 0x3c], 0
jle 0x100063d6
mov ecx, dword [ebp - 0x3c]
add ecx, 0xbef
mov dword [ebp - 0x3c], ecx
mov edx, dword [ebp - 0x1c]
sub edx, 0xc02
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x24]
sub eax, 0x1fce
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x2c]
sub ecx, dword [ebp - 0x30]
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x2c]
sub edx, 0x6bc
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x10]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x24]
add edx, dword [ebp - 0x10]
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x2c]
add eax, 0x1e6b
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x30]
add ecx, 0x1cd0
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x20]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x10]
sub eax, 0x937
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 0x30]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x14]
sub edx, 0xf1b
mov dword [ebp - 0x14], edx
push 0
push 0
call fcn.10006990
add esp, 8
mov eax, 4
imul ecx, eax, 0xe5
mov edx, dword [0x10087b5c]
mov eax, dword [edx + ecx]
mov dword [ebp - 0x54], eax
call dword [ebp - 0x54]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNLSVersion]
push 0
call dword [sym.imp.KERNEL32.dll_FindAtomW]
push 0
call dword [sym.imp.KERNEL32.dll_Wow64EnableWow64FsRedirection]
push 0
call dword [sym.imp.KERNEL32.dll_LocalUnlock]
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadStackGuarantee]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDevicePowerState]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemFileCacheSize]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessIdOfThread]
push 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DiscardVirtualMemory]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteTimerQueue]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TerminateThread]
call dword [sym.imp.KERNEL32.dll_GetLargePageMinimum]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationW]
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
push 0
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandleEx]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileTransactedW]
push 0
call dword [sym.imp.KERNEL32.dll_FlsGetValue]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenPrivateNamespaceW]
push 0
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockShared]
push 0
call dword [sym.imp.KERNEL32.dll_SetComputerNameW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeServerSessionId]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThreadpoolIo]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMask]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemPreferredUILanguages]
push 0
call dword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
call dword [sym.imp.KERNEL32.dll_SetFileApisToANSI]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileValidData]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_InitOnceComplete]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadDirectoryChangesW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret