Function at 0x1800087f0
Capabilities:
Copy file
Create directory
Create pipe
Delete file
Enumerate files on windows
Extract resource via kernel32 functions
Get disk information
Get file size
Hash data with crc32
Log keystrokes
Log keystrokes via polling
Manipulate console buffer
Query environment variable
Read .ini file
Terminate process
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x10], rdx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x440
mov ebx, dword [rsp + 0x478]
lea r13, str.hr_I
mov edi, dword [rsp + 0x478]
lea r15, [rsp + 0x40]
xor esi, esi
mov r12d, 0x57
mov r14d, esi
jmp 0x180008842
xor esi, esi
cmp dword [0x180125770], 0xcbc5a741
jne 0x1800089ee
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetDefaultCommConfigW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThreadpoolWork]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsW]
call qword [sym.imp.USER32.dll_InSendMessage]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RequestWakeupLatency]
mov qword [rsp + 0x38], rsi
xor r9d, r9d
mov dword [rsp + 0x30], esi
xor r8d, r8d
mov dword [rsp + 0x28], esi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DefWindowProcW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [rsp + 0x30], esi
xor r9d, r9d
mov dword [rsp + 0x28], esi
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov dword [rsp + 0x38], esi
xor r9d, r9d
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov qword [rsp + 0x28], rsi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationByHandleW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeClientSessionId]
call qword [sym.imp.USER32.dll_GetClipboardSequenceNumber]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadpoolTimerEx]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetWindowDC]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryTransactedW]
xor r9d, r9d
mov dword [rsp + 0x20], esi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MsgWaitForMultipleObjectsEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetWindowRgn]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AttachConsole]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteFileTransactedW]
call qword [sym.imp.USER32.dll_AnyPopup]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlsFree]
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetKeyboardState]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetClassInfoExW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetWindowRgn]
mov esi, r14d
mov ebp, 8
nop word [rax + rax]
cmp dword [0x180125770], 0xe8329e7e
jne 0x180008b5d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLogicalProcessorInformationEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CopyFileW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WakeAllConditionVariable]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rax
xor edx, edx
mov dword [rsp + 0x28], eax
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemTimes]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitOnceInitialize]
mov r9d, ebx
mov qword [rsp + 0x20], 0
mov r8d, edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReadConsoleOutputW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelThreadpoolIo]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPreferredUILanguages]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextFileNameW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor r9d, r9d
mov dword [rsp + 0x20], 0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FoldStringW]
xor eax, eax
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov dword [rsp + 0x28], eax
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileTransactedW]
mov ecx, esi
mov eax, esi
and ecx, 1
shr eax, 1
neg ecx
and ecx, 0xedb88320
mov esi, ecx
xor esi, eax
sub rbp, 1
jne 0x180008a00
mov dword [r15], esi
inc r14d
add r15, 4
cmp r14d, 0x100
jl 0x180008840
mov ebx, dword [rsp + 0x478]
mov esi, 0xffffffff
mov edi, dword [rsp + 0x478]
nop word [rax + rax]
dec r12
cmp dword [0x180125770], 0xcde28a0b
jne 0x180008d25
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindVolumeClose]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryThreadProfiling]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolTimer]
call qword [sym.imp.KERNEL32.dll_CreateThreadpoolCleanupGroup]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferInfoEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_StartThreadpoolIo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PowerClearRequest]
xor ebp, ebp
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbp
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStructW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryUnbiasedInterruptTime]
mov r9d, ebx
mov qword [rsp + 0x20], rbp
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteConsoleOutputAttribute]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor r8d, r8d
lea rdx, [0x18013fac8]
lea rcx, [0x18013faf0]
call qword [sym.imp.KERNEL32.dll_CopyFile2]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapUnlock]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClosePrivateNamespace]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CheckTokenCapability]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AddIntegrityLabelToBoundaryDescriptor]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
xor r9d, r9d
mov dword [rsp + 0x28], ebp
xor r8d, r8d
mov qword [rsp + 0x20], rbp
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CopyFileExW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateSymbolicLinkTransactedW]
mov edx, edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
movzx edx, byte [r13]
mov ecx, esi
xor rdx, rcx
shr esi, 8
movzx ecx, dl
inc r13
xor esi, dword [rsp + rcx*4 + 0x40]
test r12, r12
jne 0x180008bb0
lea r11, [rsp + 0x440]
not esi
mov rbx, qword [r11 + 0x30]
mov eax, esi
mov rsi, qword [r11 + 0x48]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret