Function at 0x180006d10
Capabilities:
Get file size
Move file
Query environment variable
Read .ini file
Terminate process

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x70
xor ecx, ecx
call fcn.180085b10
mov ecx, eax
call fcn.180081dbc
call fcn.180081d90
and eax, 0x80000003
jge 0x180006d45
dec eax
or eax, 0xfffffffc
inc eax
xor edi, edi
mov ebx, edi
test eax, eax
jne 0x180006e93
cmp dword [0x18012e8b8], 0xd9995bca
jne 0x180006e82
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Beep]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
call qword [sym.imp.USER32.dll_GetDesktopWindow]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommConfig]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMask]
xor ecx, ecx
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetProcessorSystemCycleTime]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
call qword [sym.imp.USER32.dll_WaitMessage]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DdeCmpStringHandles]
xor ecx, ecx
call qword [sym.imp.USER32.dll_ShowCaret]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleCursorInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLocaleName]
mov r9d, dword [rbp + 0x20]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteConsoleOutputAttribute]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetClassLongW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeSListHead]
xor ecx, ecx
call qword [sym.imp.USER32.dll_DestroyCursor]
call qword [sym.imp.KERNEL32.dll_GetOEMCP]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [rsp + 0x30], edi
xor r9d, r9d
mov qword [rsp + 0x28], rdi
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetWaitableTimerEx]
mov rdx, qword [rbp + 0x28]
call fcn.180002ad0
add rsp, 0x70
pop rdi
pop rbx
pop rbp
ret
cmp eax, 1
jne 0x180006f25
mov ecx, 0xffffcb49
inc ecx
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea edx, [rdx + rdx*2]
cmp ecx, edx
jne 0x180006ea1
cmp ecx, 0xffffcb4a
jne 0x180006f19
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea r9, [rbp + 0x30]
add rax, 0x14d
mov dword [rbp - 0x18], 0x14d
mov qword [rbp - 0x20], rax
lea r8, [rbp + 0x28]
movaps xmm0, xmmword [rbp - 0x20]
lea rax, [rbp + 0x20]
lea rdx, [rbp + 0x38]
movdqa xmmword [rbp - 0x10], xmm0
lea rcx, [rbp - 0x10]
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x20], 4
mov dword [rbp + 0x30], 0x3000
mov qword [rbp + 0x38], rdi
call fcn.180012850
add rsp, 0x70
pop rdi
pop rbx
pop rbp
ret
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x1800070c7
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea rcx, [rbp - 0x10]
add rax, 0x263
mov dword [rbp - 0x18], 0x263
mov qword [rbp - 0x20], rax
movaps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rbp - 0x10], xmm0
call fcn.180012a30
cmp dword [0x18012e8b8], 0x8f42fdf8
mov qword [rbp + 0x30], rax
jne 0x180007082
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov qword [rsp + 0x28], rdi
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReadThreadProfilingData]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
call qword [sym.imp.KERNEL32.dll_GetACP]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointW]
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LCMapStringW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WakeAllConditionVariable]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov qword [rsp + 0x30], rdi
lea r8, str.wMUVPfx78e2775UA8Wbg
mov dword [rsp + 0x28], edi
lea rcx, str.Xy3iOwWav4vmJSRpyJd11n
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetCalendarInfoEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapValidate]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetTimeZoneInformation]
mov rax, qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea r9, [rbp + 0x28]
add rax, 0x218
mov dword [rbp - 0x18], 0x218
mov qword [rbp - 0x20], rax
lea r8, [rbp + 0x20]
movaps xmm0, xmmword [rbp - 0x20]
lea rdx, [rbp + 0x30]
lea rcx, [rbp - 0x10]
movdqa xmmword [rbp - 0x10], xmm0
mov dword [rbp + 0x20], 8
call fcn.180012be0
add rsp, 0x70
pop rdi
pop rbx
pop rbp
ret
cmp eax, 3
jne 0x1800072b9
mov rax, qword [sym.imp.KERNEL32.dll_LocalAlloc]
lea r8, [rbp + 0x28]
add rax, 0x14a
mov dword [rbp - 0x18], 0x14a
mov qword [rbp - 0x20], rax
lea rdx, [rbp + 0x20]
movaps xmm0, xmmword [rbp - 0x20]
lea rcx, [rbp - 0x10]
movdqa xmmword [rbp - 0x10], xmm0
mov dword [rbp + 0x20], edi
call fcn.180010700
mov qword [rbp - 0x28], rax
lea r9, [rbp + 0x30]
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea r8, [rbp + 0x38]
add rax, 0x1c2
mov dword [rbp - 8], 0x1c2
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x30]
movaps xmm0, xmmword [rbp - 0x10]
lea rax, [rbp + 0x20]
lea rcx, [rbp - 0x10]
movdqa xmmword [rbp - 0x10], xmm0
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x20], 4
mov dword [rbp + 0x30], 0x3000
mov dword [rbp + 0x38], 0x400
mov qword [rbp - 0x30], rdi
call fcn.180012dc0
mov qword [rbp - 0x20], rax
lea rdx, [rbp - 0x28]
mov rax, qword [sym.imp.KERNEL32.dll_LocalLock]
lea rcx, [rbp - 0x10]
mov dword [rbp - 8], 0x177
add rax, 0x177
mov qword [rbp - 0x10], rax
movaps xmm0, xmmword [rbp - 0x10]
movdqa xmmword [rbp - 0x10], xmm0
call fcn.1800108d0
cmp dword [0x18012e8b8], 0x828d2b1c
mov rbx, rax
jne 0x180007279
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFileIoOverlappedRange]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushConsoleInputBuffer]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TerminateJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitOnceInitialize]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RaiseException]
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFree]
lea r9, [rbp + 0x20]
mov dword [rbp - 8], 0x21c
lea r8, [rbp + 0x30]
add rax, 0x21c
mov dword [rbp + 0x20], 0x8000
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x20]
movaps xmm0, xmmword [rbp - 0x10]
lea rcx, [rbp - 0x10]
movdqa xmmword [rbp - 0x10], xmm0
mov dword [rbp + 0x30], edi
call fcn.180012fa0
mov rax, rbx
add rsp, 0x70
pop rdi
pop rbx
pop rbp
ret