Function at 0x1000bba0
Capabilities:
Copy file
Get disk information
Get file attributes
Get geographical location
Get hostname
Move file
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x10], 1
mov dword [ebp - 4], 1
cmp dword [ebp + 0xc], 1
jne 0x1000be68
movzx eax, byte [0x10040b00]
test eax, eax
je 0x1000be68
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 3
jne 0x1000be68
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_SetPixelV]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommProperties]
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0
call dword [sym.imp.GDI32.dll_GetGraphicsMode]
push 0
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0
call dword [sym.imp.GDI32.dll_DeleteEnhMetaFile]
push 0
push 0
push 0
push 0x1006b948
push 0
push 0x1006b96c
call dword [sym.imp.KERNEL32.dll_GetNumberFormatEx]
push 0
push 0
push 0x1006b9a8
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsEx]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
call dword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
push 0
push 0
call dword [sym.imp.GDI32.dll_SetMapperFlags]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckNameLegalDOS8Dot3W]
push 0
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_StretchDIBits]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DiscardVirtualMemory]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetOverlappedResultEx]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenJobObjectW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
push 0
call dword [sym.imp.KERNEL32.dll_CloseThreadpoolWork]
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_LineTo]
push 0
call dword [sym.imp.GDI32.dll_StartPage]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_PtInRegion]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
movzx ecx, byte [0x10040b00]
test ecx, ecx
je 0x1000be78
call fcn.1000a380
cmp dword [0x10040b04], 0x7a9d792
jne 0x1000c084
push 0
push 0
call dword [sym.imp.GDI32.dll_GetBrushOrgEx]
push 0
push 0
call dword [sym.imp.GDI32.dll_GetWorldTransform]
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
push 0
push 0
call dword [sym.imp.GDI32.dll_SetMapperFlags]
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_MoveToEx]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BackupRead]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_BitBlt]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_Wow64SetThreadContext]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventExW]
push 0
push 0
push 0x1006b9f8
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDurationFormat]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleCursorInfo]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLogicalProcessorInformation]
mov edx, dword [ebp - 0x14]
mov dword [ebp - 8], edx
push 0
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputAttribute]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleDisplayMode]
push 0
call dword [sym.imp.GDI32.dll_BeginPath]
push 0
call dword [sym.imp.KERNEL32.dll_CloseThreadpoolWait]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumLanguageGroupLocalesW]
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0xc], ecx
push 0
mov edx, dword [ebp - 0xc]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ScrollConsoleScreenBufferW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLocaleName]
push 0
call dword [sym.imp.GDI32.dll_PathToRegion]
push 0x1006ba20
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadDescription]
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetCharABCWidthsW]
push 0
call dword [sym.imp.GDI32.dll_RemoveFontMemResourceEx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleOriginalTitleW]
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetEnhMetaFilePaletteEntries]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFinalPathNameByHandleW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileInformationByHandle]
push 0
push 0
call dword [sym.imp.GDI32.dll_SetEnhMetaFileBits]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FreeLibraryAndExitThread]
cmp dword [ebp - 4], 0
jne 0x1000c094
push 0
call fcn.10005f50
add esp, 4
cmp dword [0x10040b04], 0xc01075
jne 0x1000c22b
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CheckTokenCapability]
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetPath]
push 0
push 0
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileW]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessVersion]
call dword [sym.imp.KERNEL32.dll_IsThreadAFiber]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TzSpecificLocalTimeToSystemTime]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
push 0
push 0
call dword [sym.imp.GDI32.dll_SetWorldTransform]
push 0
push 0
call dword [sym.imp.GDI32.dll_GetBrushOrgEx]
push 0
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_SetRectRgn]
push 0
call dword [sym.imp.GDI32.dll_GdiSetBatchLimit]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0
call dword [sym.imp.KERNEL32.dll_SetTimeZoneInformation]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadTimes]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameTransactedW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetAppContainerNamedObjectPath]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
push 0
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_IntersectClipRect]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLogicalProcessorInformation]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThreadpoolTimer]
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GdiComment]
push 0
call dword [sym.imp.KERNEL32.dll_LocalSize]
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CombineRgn]
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleActiveScreenBuffer]
push 0
call dword [sym.imp.KERNEL32.dll_GetUserGeoID]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
call dword [sym.imp.KERNEL32.dll_GetThreadUILanguage]
push 0
push 0x1006ba5c
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_IsNLSDefinedString]
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 0xc