Function at 0x18000c4f0
Capabilities:
Create directory
Get keyboard layout
Hash data with crc32
Move file
Persist via application shimming
Print debug messages
Read .ini file
Set environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x10], rdx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x440
lea r15, [0x1800c48a0]
xor r12d, r12d
mov qword [rsp + 0x478], r15
lea r14, [rsp + 0x40]
lea r15, [0x180128228]
mov ebp, 0x5c
mov esi, r12d
lea r13, [0x180128270]
nop dword [rax]
nop word [rax + rax]
cmp dword [0x18010e3e0], 0xd5575194
jne 0x18000c723
xor r9d, r9d
mov dword [rsp + 0x20], r12d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_PeekMessageW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetClipboardViewer]
xor ecx, ecx
call qword [sym.imp.USER32.dll_LockWindowUpdate]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryTransactedW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlsFree]
xor r9d, r9d
mov qword [rsp + 0x20], r12
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateDialogParamW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DrawAnimatedRects]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFileIoOverlappedRange]
lock add dword [r12], r12d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHeaps]
xor r9d, r9d
mov dword [rsp + 0x28], r12d
xor r8d, r8d
mov qword [rsp + 0x20], r12
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumberFormatW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Wow64EnableWow64FsRedirection]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindCloseChangeNotification]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommError]
xor r9d, r9d
mov qword [rsp + 0x20], r12
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDefaultCommConfigW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeClientSessionId]
mov qword [rsp + 0x38], r12
lea r8, [0x180128238]
mov qword [rsp + 0x30], r15
xor r9d, r9d
mov dword [rsp + 0x28], r12d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], r12
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
xor r9d, r9d
mov qword [rsp + 0x20], r12
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_BroadcastSystemMessageW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_CallMsgFilterW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PowerCreateRequest]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFileInformationByHandle]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferInfoEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapUserPhysicalPagesScatter]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LCIDToLocaleName]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumSystemGeoID]
call qword [sym.imp.USER32.dll_InSendMessage]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetComputerNameW]
mov ebx, esi
mov edi, 8
nop word [rax + rax]
cmp dword [0x18010e3e0], 0x3c158bc5
jne 0x18000c885
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PowerCreateRequest]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateSymbolicLinkTransactedW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetVolumeLabelW]
call qword [sym.imp.KERNEL32.dll_GetSystemDEPPolicy]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
xor r9d, r9d
mov dword [rsp + 0x28], r12d
xor r8d, r8d
mov qword [rsp + 0x20], r12
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrencyFormatW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
mov dword [rsp + 0x30], r12d
xor r9d, r9d
mov qword [rsp + 0x28], r12
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r13
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDurationFormat]
lock dec dword [r12]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], r12
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AddScopedPolicyIDAce]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommConfig]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryThreadCycleTime]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
xor r9d, r9d
mov dword [rsp + 0x28], r12d
xor r8d, r8d
mov qword [rsp + 0x20], r12
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrencyFormatW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetStdHandle]
xor r9d, r9d
mov dword [rsp + 0x28], r12d
xor r8d, r8d
mov qword [rsp + 0x20], r12
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UpdateResourceW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLocalTime]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumberOfConsoleInputEvents]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLargestConsoleWindowSize]
mov ecx, ebx
mov eax, ebx
and ecx, 1
shr eax, 1
neg ecx
and ecx, 0xedb88320
mov ebx, ecx
xor ebx, eax
sub rdi, 1
jne 0x18000c730
mov dword [r14], ebx
inc esi
add r14, 4
cmp esi, 0x100
jl 0x18000c550
mov r15, qword [rsp + 0x478]
mov ebx, 0xffffffff
nop word [rax + rax]
dec rbp
cmp dword [0x18010e3e0], 0x801c9500
jne 0x18000ca34
xor r9d, r9d
mov qword [rsp + 0x20], r12
xor r8d, r8d
lea rcx, [0x1801282a8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_FindFirstFileNameTransactedW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProfileIntW]
xor r9d, r9d
mov dword [rsp + 0x28], r12d
xor r8d, r8d
mov qword [rsp + 0x20], r12
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenFileById]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetComputerNameW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteProfileSectionW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSizeEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WakeAllConditionVariable]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
call qword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateSymbolicLinkW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapWalk]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFileShortNameW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumSystemLocalesEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThreadpool]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
movzx edx, byte [r15]
mov ecx, ebx
xor rdx, rcx
shr ebx, 8
movzx ecx, dl
inc r15
xor ebx, dword [rsp + rcx*4 + 0x40]
test rbp, rbp
jne 0x18000c8d0
lea r11, [rsp + 0x440]
not ebx
mov rbp, qword [r11 + 0x40]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret