Function at 0x10006d20
Capabilities:
Delete file
Get disk information
Identify system language via api
Move file
Read .ini file
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
cmp dword [ebp + 0xc], 1
push ebx
push esi
push edi
jne 0x10006f43
mov ebx, dword [sym.imp.KERNEL32.dll_ReadConsoleInputW]
mov eax, 0x10005220
add eax, 0x233
mov edi, 0x10005660
mov dword [esp + 0x10], eax
add edi, 0x1be
mov eax, 0x100054c0
add eax, 0x192
mov dword [esp + 0x14], eax
mov esi, dword [esp + 0x14]
nop word [eax + eax]
push 0x1be
push edi
mov byte [0x100ae589], 1
call fcn.1000b540
add esp, 8
cmp dword [0x100ae258], 0xdc4cb35f
jne 0x10006f17
push 0
push 0
push 0
push 0
call ebx
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MoveFileTransactedW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetQueuedCompletionStatus]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadpoolThreadMinimum]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateHardLinkTransactedW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTapeParameters]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMask]
push 0
call dword [sym.imp.KERNEL32.dll_CancelThreadpoolIo]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
call dword [sym.imp.KERNEL32.dll_GetSystemDEPPolicy]
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileTransactedW]
push 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePrivateNamespaceW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStructW]
push 0x100b8e8c
call dword [sym.imp.KERNEL32.dll_IsValidLocaleName]
push 0
call dword [sym.imp.KERNEL32.dll_RequestWakeupLatency]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
push 0
call dword [sym.imp.KERNEL32.dll_FindCloseChangeNotification]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameTransactedW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessWorkingSetSize]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CloseThreadpoolCleanupGroupMembers]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeServerProcessId]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadpoolStackInformation]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommTimeouts]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddResourceAttributeAce]
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
push 0
push esi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ScrollConsoleScreenBufferW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0x233
push dword [esp + 0x14]
call fcn.1000b540
push 0x192
push dword [esp + 0x20]
call fcn.1000b540
add esp, 0x10
cmp byte [0x100ae589], 0
je 0x10006d70
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc