Function at 0x1800071b0
Capabilities:
Create directory
Delete directory
Get disk information
Get memory capacity
Manipulate console buffer
Print debug messages
Terminate process

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xf0
xor ecx, ecx
call fcn.18007780c
mov ecx, eax
call fcn.180074404
call fcn.1800743d8
and eax, 0x80000003
jge 0x1800071ea
dec eax
or eax, 0xfffffffc
inc eax
xor edi, edi
mov ebx, edi
test eax, eax
jne 0x1800072f2
cmp dword [0x1800f8cb8], 0xca4f31ab
jne 0x1800072de
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_LogicalToPhysicalPoint]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSysColorBrush]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_UnionRect]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfoEx]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSysColor]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetDlgItemInt]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteProcThreadAttributeList]
xor ecx, ecx
call qword [sym.imp.USER32.dll_ShowCursor]
xor ecx, ecx
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_QueryIdleProcessorCycleTimeEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rdx, qword [rbp + 0x6f]
call fcn.180001fb0
add rsp, 0xf0
pop rdi
pop rbx
pop rbp
ret
cmp eax, 1
jne 0x1800073e1
mov dword [rbp + 0x67], 4
mov dword [rbp + 0x77], 0x3000
mov qword [rbp + 0x7f], rdi
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
add rax, 0x176
mov qword [rbp + 0x17], rax
mov dword [rbp + 0x1f], 0x176
xorps xmm0, xmm0
movups xmmword [rbp - 0x59], xmm0
mov qword [rbp - 0x41], rdi
mov qword [rbp - 0x39], rdi
mov qword [rbp - 0x31], rdi
mov qword [rbp - 0x29], rdi
mov qword [rbp - 0x21], rdi
mov ecx, 0x10
call fcn.18006e5e8
mov qword [rax + 8], rdi
mov qword [rbp - 0x41], rax
lea rcx, [rbp - 0x41]
mov qword [rax], rcx
mov word [rbp - 0x11], bx
mov qword [rbp - 0xb], rdi
mov qword [rbp - 3], rdi
xor eax, eax
mov word [rbp - 0xe], ax
mov byte [rbp - 0xc], al
mov word [rbp - 0xb], ax
mov byte [rbp - 9], al
mov word [rbp - 8], ax
mov byte [rbp - 6], al
mov word [rbp - 5], ax
mov byte [rbp - 3], al
mov word [rbp - 2], ax
mov byte [rbp], al
mov word [rbp + 1], ax
mov byte [rbp + 3], al
mov dword [rbp - 0x45], edi
mov dword [rbp - 0x15], edi
movaps xmm0, xmmword [rbp + 0x17]
movdqa xmmword [rbp + 7], xmm0
lea rax, [rbp + 0x67]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x77]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x6f]
lea r8, [rbp + 0x7f]
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x59]
call fcn.1800144f0
mov rbx, qword [rbp - 0x51]
lea rcx, [rbp - 0x41]
call fcn.1800175b0
mov rcx, qword [rbp - 0x41]
mov qword [rbp - 0x41], rdi
jmp 0x180007abe
cmp eax, 2
jne 0x18000767d
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
add rax, 0x26b
mov qword [rbp + 0x17], rax
mov dword [rbp + 0x1f], 0x26b
xorps xmm0, xmm0
movups xmmword [rbp - 0x59], xmm0
mov qword [rbp - 0x41], rdi
mov qword [rbp - 0x39], rdi
mov qword [rbp - 0x31], rdi
mov qword [rbp - 0x29], rdi
mov qword [rbp - 0x21], rdi
mov ecx, 0x10
call fcn.18006e5e8
mov qword [rax + 8], rdi
mov qword [rbp - 0x41], rax
lea rcx, [rbp - 0x41]
mov qword [rax], rcx
mov word [rbp - 0x11], bx
mov qword [rbp - 0xb], rdi
mov qword [rbp - 3], rdi
xor eax, eax
mov word [rbp - 0xe], ax
mov byte [rbp - 0xc], al
mov word [rbp - 0xb], ax
mov byte [rbp - 9], al
mov word [rbp - 8], ax
mov byte [rbp - 6], al
mov word [rbp - 5], ax
mov byte [rbp - 3], al
mov word [rbp - 2], ax
mov byte [rbp], al
mov word [rbp + 1], ax
mov byte [rbp + 3], al
mov dword [rbp - 0x45], edi
mov dword [rbp - 0x15], edi
movaps xmm0, xmmword [rbp + 0x17]
movdqa xmmword [rbp + 7], xmm0
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x59]
call fcn.1800142d0
mov rbx, qword [rbp - 0x51]
lea rcx, [rbp - 0x41]
call fcn.1800175b0
mov rcx, qword [rbp - 0x41]
mov qword [rbp - 0x41], rdi
mov edx, 0x10
call fcn.18006e4fc
mov qword [rbp + 0x77], rbx
cmp dword [0x1800f8cb8], 0x8d4bb2b
jne 0x1800075a9
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8, [0x1801109e8]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStringTypeA]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ApplicationRecoveryFinished]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalHandle]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlCaptureStackBackTrace]
mov qword [rsp + 0x20], rdi
mov r9d, dword [rbp + 0x67]
mov r8d, dword [rbp + 0x67]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteConsoleOutputW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleHistoryInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadIdealProcessor]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsThreadpoolTimerSet]
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryTransactedW]
mov dword [rbp + 0x67], 8
mov rax, qword [sym.imp.KERNEL32.dll_HeapAlloc]
add rax, 0x265
mov qword [rbp + 0x17], rax
mov dword [rbp + 0x1f], 0x265
xorps xmm0, xmm0
movups xmmword [rbp - 0x59], xmm0
mov qword [rbp - 0x41], rdi
mov qword [rbp - 0x39], rdi
mov qword [rbp - 0x31], rdi
mov qword [rbp - 0x29], rdi
mov qword [rbp - 0x21], rdi
mov ecx, 0x10
call fcn.18006e5e8
mov qword [rax + 8], rdi
mov qword [rbp - 0x41], rax
lea rcx, [rbp - 0x41]
mov qword [rax], rcx
mov word [rbp - 0x11], 0
mov qword [rbp - 0xb], rdi
mov qword [rbp - 3], rdi
xor eax, eax
mov word [rbp - 0xe], ax
mov byte [rbp - 0xc], al
mov word [rbp - 0xb], ax
mov byte [rbp - 9], al
mov word [rbp - 8], ax
mov byte [rbp - 6], al
mov word [rbp - 5], ax
mov byte [rbp - 3], al
mov word [rbp - 2], ax
mov byte [rbp], al
mov word [rbp + 1], ax
mov byte [rbp + 3], al
mov dword [rbp - 0x45], edi
mov dword [rbp - 0x15], edi
movaps xmm0, xmmword [rbp + 0x17]
movdqa xmmword [rbp + 7], xmm0
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x67]
lea r8, [rbp + 0x77]
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x59]
call fcn.180014090
mov rbx, qword [rbp - 0x51]
lea rcx, [rbp - 0x41]
call fcn.1800175b0
mov rcx, qword [rbp - 0x41]
mov qword [rbp - 0x41], rdi
jmp 0x180007abe
cmp eax, 3
jne 0x180007ac8
mov dword [rbp + 0x67], edi
mov rax, qword [sym.imp.KERNEL32.dll_LocalAlloc]
add rax, 0x1eb
mov qword [rbp + 0x17], rax
mov dword [rbp + 0x1f], 0x1eb
xorps xmm0, xmm0
movups xmmword [rbp - 0x59], xmm0
mov qword [rbp - 0x41], rdi
mov qword [rbp - 0x39], rdi
mov qword [rbp - 0x31], rdi
mov qword [rbp - 0x29], rdi
mov qword [rbp - 0x21], rdi
mov ecx, 0x10
call fcn.18006e5e8
mov qword [rax + 8], rdi
mov qword [rbp - 0x41], rax
lea rcx, [rbp - 0x41]
mov qword [rax], rcx
mov word [rbp - 0x11], bx
mov qword [rbp - 0xb], rdi
mov qword [rbp - 3], rdi
xor eax, eax
mov word [rbp - 0xe], ax
mov byte [rbp - 0xc], al
mov word [rbp - 0xb], ax
mov byte [rbp - 9], al
mov word [rbp - 8], ax
mov byte [rbp - 6], al
mov word [rbp - 5], ax
mov byte [rbp - 3], al
mov word [rbp - 2], ax
mov byte [rbp], al
mov word [rbp + 1], ax
mov byte [rbp + 3], al
mov dword [rbp - 0x45], edi
mov dword [rbp - 0x15], edi
movaps xmm0, xmmword [rbp + 0x17]
movdqa xmmword [rbp + 7], xmm0
lea r9, [rbp + 0x6f]
lea r8, [rbp + 0x67]
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x59]
call fcn.180016c90
mov rbx, qword [rbp - 0x51]
lea rcx, [rbp - 0x41]
call fcn.1800175b0
mov rcx, qword [rbp - 0x41]
mov qword [rbp - 0x41], rdi
mov edx, 0x10
call fcn.18006e4fc
mov qword [rbp + 0x37], rbx
mov dword [rbp + 0x67], 4
mov dword [rbp + 0x77], 0x3000
mov dword [rbp + 0x7f], 0x400
mov qword [rbp + 0x2f], rdi
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
add rax, 0x1ab
mov qword [rbp + 7], rax
mov dword [rbp + 0xf], 0x1ab
xorps xmm0, xmm0
movups xmmword [rbp - 0x59], xmm0
mov qword [rbp - 0x41], rdi
mov qword [rbp - 0x39], rdi
mov qword [rbp - 0x31], rdi
mov qword [rbp - 0x29], rdi
mov qword [rbp - 0x21], rdi
mov ecx, 0x10
call fcn.18006e5e8
mov qword [rax + 8], rdi
mov qword [rbp - 0x41], rax
lea rcx, [rbp - 0x41]
mov qword [rax], rcx
mov word [rbp - 0x11], 0
mov qword [rbp - 0xb], rdi
mov qword [rbp - 3], rdi
xor eax, eax
mov word [rbp - 0xe], ax
mov byte [rbp - 0xc], al
mov word [rbp - 0xb], ax
mov byte [rbp - 9], al
mov word [rbp - 8], ax
mov byte [rbp - 6], al
mov word [rbp - 5], ax
mov byte [rbp - 3], al
mov word [rbp - 2], ax
mov byte [rbp], al
mov word [rbp + 1], ax
mov byte [rbp + 3], al
mov dword [rbp - 0x45], edi
mov dword [rbp - 0x15], edi
movaps xmm0, xmmword [rbp + 7]
movdqa xmmword [rbp + 7], xmm0
lea rax, [rbp + 0x67]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x77]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x7f]
lea r8, [rbp + 0x2f]
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x59]
call fcn.180013e50
mov rbx, qword [rbp - 0x51]
lea rcx, [rbp - 0x41]
call fcn.1800175b0
mov rcx, qword [rbp - 0x41]
mov qword [rbp - 0x41], rdi
mov edx, 0x10
call fcn.18006e4fc
mov qword [rbp + 0x27], rbx
mov rax, qword [sym.imp.KERNEL32.dll_LocalLock]
add rax, 0x1fa
mov qword [rbp + 7], rax
mov dword [rbp + 0xf], 0x1fa
movaps xmm0, xmmword [rbp + 7]
movdqa xmmword [rbp + 7], xmm0
lea rdx, [rbp + 0x37]
lea rcx, [rbp + 7]
call fcn.1800104d0
mov rbx, rax
cmp dword [0x1800f8cb8], 0xc553b07c
jne 0x1800079ed
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessDEPPolicy]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLogicalProcessorInformationEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadDescription]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPreferredUILanguages]
mov qword [rsp + 0x20], rdi
mov r9d, dword [rbp + 0x67]
mov r8d, dword [rbp + 0x67]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReadConsoleOutputW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumDateFormatsW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call qword [sym.imp.KERNEL32.dll_GetACP]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapLock]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaNodeNumberFromHandle]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
lea rax, [0x180110a00]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [0x180110a30]
xor edx, edx
lea rcx, [0x180110a58]
call qword [sym.imp.KERNEL32.dll_CompareStringEx]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov dword [rsp + 0x38], edi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LCMapStringW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalHandle]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeServerProcessId]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TzSpecificLocalTimeToSystemTime]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetTapeParameters]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov dword [rbp + 0x67], 0x8000
mov dword [rbp + 0x77], edi
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFree]
add rax, 0x1a3
mov qword [rbp + 7], rax
mov dword [rbp + 0xf], 0x1a3
xor eax, eax
mov word [rbp - 0x59], ax
mov byte [rbp - 0x57], al
mov qword [rbp - 0x51], rdi
mov qword [rbp - 0x49], rdi
mov qword [rbp - 0x41], rdi
mov qword [rbp - 0x39], rdi
mov qword [rbp - 0x31], rdi
mov ecx, 0x10
call fcn.18006e5e8
mov qword [rax + 8], rdi
mov qword [rbp - 0x51], rax
lea rcx, [rbp - 0x51]
mov qword [rax], rcx
mov word [rbp - 0x21], 0
mov qword [rbp - 0x1b], rdi
mov qword [rbp - 0x13], rdi
xor eax, eax
mov word [rbp - 0x1e], ax
mov byte [rbp - 0x1c], al
mov word [rbp - 0x1b], ax
mov byte [rbp - 0x19], al
mov word [rbp - 0x18], ax
mov byte [rbp - 0x16], al
mov word [rbp - 0x15], ax
mov byte [rbp - 0x13], al
mov word [rbp - 0x12], ax
mov byte [rbp - 0x10], al
mov word [rbp - 0xf], ax
mov byte [rbp - 0xd], al
mov dword [rbp - 0x55], edi
mov dword [rbp - 0x25], edi
movaps xmm0, xmmword [rbp + 7]
movdqa xmmword [rbp + 7], xmm0
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x77]
lea r8, [rbp + 0x27]
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x59]
call fcn.180013c10
nop
lea rcx, [rbp - 0x51]
call fcn.1800175b0
mov rcx, qword [rbp - 0x51]
mov qword [rbp - 0x51], rdi
mov edx, 0x10
call fcn.18006e4fc
mov rax, rbx
add rsp, 0xf0
pop rdi
pop rbx
pop rbp
ret