Function at 0x180007198
Capabilities:
Create directory
Get disk information
Get geographical location
Get memory capacity
Move file
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
cmp dword [0x1800c2890], 0x1e7f8f8c
mov ebx, edx
jne 0x1800073c1
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForThreadpoolIoCallbacks]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReOpenFile]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockShared]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTime]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForThreadpoolTimerCallbacks]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryTransactedW]
xor edi, edi
xor r9d, r9d
mov dword [rsp + 0x38], edi
xor r8d, r8d
mov qword [rsp + 0x30], rdi
xor edx, edx
mov qword [rsp + 0x28], rdi
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
call qword [sym.imp.KERNEL32.dll_IsThreadAFiber]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLocaleName]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OfferVirtualMemory]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AllocateUserPhysicalPages]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov qword [rsp + 0x48], rdi
xor r9d, r9d
mov qword [rsp + 0x40], rdi
xor r8d, r8d
mov qword [rsp + 0x38], rdi
xor edx, edx
mov qword [rsp + 0x30], rdi
xor ecx, ecx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateFileTransactedW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThreadpoolIo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadpoolThreadMaximum]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessIdOfThread]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsValidCodePage]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadIdealProcessor]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RemoveVectoredContinueHandler]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SubmitThreadpoolWork]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsBadWritePtr]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalLock]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
xor r8d, r8d
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCalendarInfoW]
lea rax, str.j1y39J6Q3f9l1D8ClwD
xor r8d, r8d
mov qword [rsp + 0x30], rax
lea r9, str.C4cqm5yknbcpDMIKUHftLdsVy
mov dword [rsp + 0x28], edi
lea rcx, str.41wbf6y8AC3PyqBo
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_GetDateFormatEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetUserGeoID]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForThreadpoolWorkCallbacks]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitOnceInitialize]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlsGetValue]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaAvailableMemoryNode]
call qword [sym.imp.KERNEL32.dll_GetSystemDEPPolicy]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalLock]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelThreadpoolIo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UnregisterWaitEx]
sub ebx, 1
je 0x1800073d2
sub ebx, 1
je 0x1800073ff
cmp ebx, 1
je 0x1800073ff
jmp 0x18000742c
mov ecx, 0x1bf
lea rax, [0x180006d5c]
mov dword [rsp + 0x58], ecx
add rax, rcx
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x50]
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
call fcn.180009bd4
mov ecx, 0x1f7
lea rax, [0x1800070e8]
mov dword [rsp + 0x58], ecx
add rax, rcx
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x50]
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
call fcn.180009bd4
mov rbx, qword [rsp + 0x70]
mov eax, 1
add rsp, 0x60
pop rdi
ret