Function at 0x180009620
Capabilities:
Delete directory
Get disk information
Get file attributes
Get system information on windows
Identify system language via api
Read .ini file
Terminate process

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xe8
movzx eax, byte [0x18007bdd4]
test eax, eax
jne 0x180009ce3
mov r8d, 0x1f7
lea rdx, [0x180009480]
lea rcx, [rsp + 0xa0]
call fcn.18000b180
lea rcx, [rsp + 0x60]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x60]
call fcn.18000b520
mov eax, dword [0x18007bda4]
mov ecx, 0xf0052322
cmp rax, rcx
jne 0x1800097ef
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.umkLpZtHluhtqRoSfcyj
xor edx, edx
lea rcx, str.aJEyFtnkWGmXUCZhGueTuqIevtgfe
call qword [sym.imp.KERNEL32.dll_GetCalendarInfoEx]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadpoolThreadMaximum]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetDefaultDllDirectories]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, str.WqJoxsKAaDMNHFbTblEcGZVZW
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileMUIPath]
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaProcessorNodeEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Wow64EnableWow64FsRedirection]
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
lea rax, str.lWyqFWHNmRoRcntiYvV
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, str.hHIuMkqVqUXVdwVjrxnLGNnuF
xor edx, edx
lea rcx, str.zeYtmprhWIddWOXpt
call qword [sym.imp.KERNEL32.dll_CompareStringEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIdealProcessorEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeSListHead]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDefaultCommConfigW]
mov r8d, 0x14d
lea rdx, [0x180005200]
lea rcx, [rsp + 0xb0]
call fcn.18000b180
lea rcx, [rsp + 0x70]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x70]
call fcn.18000b520
mov eax, dword [0x18007bda4]
mov ecx, 0xde5ad43d
cmp rax, rcx
jne 0x180009914
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindAtomW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FatalAppExitW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessorSystemCycleTime]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalReAlloc]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Wow64SetThreadContext]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryTransactedW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LCIDToLocaleName]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadPreferredUILanguages]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaNodeNumberFromHandle]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapUnlock]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CallbackMayRunLong]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolCleanupGroupMembers]
call qword [sym.imp.KERNEL32.dll_UnregisterApplicationRecoveryCallback]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UnlockFile]
mov r8d, 0x12f
lea rdx, [0x180002050]
lea rcx, [rsp + 0xc0]
call fcn.18000b180
lea rcx, [rsp + 0x80]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x80]
call fcn.18000b520
mov byte [0x18007bdd4], 1
cmp dword [0x18007bda4], 0x17689997
jne 0x180009b1a
xor edx, edx
lea rcx, str.tmTlitFrkdNttNo
call qword [sym.imp.KERNEL32.dll_LoadPackagedLibrary]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolCleanupGroupMembers]
xor r9d, r9d
xor r8d, r8d
lea rdx, str.bnrFlXQIqfgSojtDHrRb
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStringTypeW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUserGeoID]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitOnceBeginInitialize]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCommConfig]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformationForYear]
call qword [sym.imp.KERNEL32.dll_FlushProcessWriteBuffers]
mov qword [rsp + 0x38], 0
lea rax, str.CgbaqHQAFbBmvjccHLST
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.TRKPxzfxJZYuEnMfQtKxDe
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor r9d, r9d
xor r8d, r8d
lea rdx, str.YrHmoBxOmOHUXpPenwixGJtWsrr
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileMUIInfo]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetQueuedCompletionStatus]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitOnceComplete]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitOnceInitialize]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
call qword [sym.imp.KERNEL32.dll_SetFileApisToOEM]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLocaleName]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCommConfig]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrepareTape]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FoldStringW]
call qword [sym.imp.KERNEL32.dll_GetErrorMode]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeSListHead]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteFiber]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindClose]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
call qword [sym.imp.KERNEL32.dll_CreateTimerQueue]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov dword [rsp + 0x50], 0xb0b0
mov r8d, 0x126
lea rdx, [0x180005fe0]
lea rcx, [rsp + 0xd0]
call fcn.18000b180
lea rcx, [rsp + 0x90]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x90]
call fcn.18000b580
cmp dword [0x18007bda4], 0x1b8b685b
jne 0x180009cde
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaProcessorNodeEx]
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaAvailableMemoryNode]
call qword [sym.imp.KERNEL32.dll_GetLargePageMinimum]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumberOfConsoleMouseButtons]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpool]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionW]
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingNumaW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessIdOfThread]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Beep]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSectionWhenCallbackReturns]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryProcessCycleTime]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumSystemLanguageGroupsW]
call qword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DebugActiveProcessStop]
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaAvailableMemoryNodeEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStructW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TzSpecificLocalTimeToSystemTime]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommConfig]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_BackupRead]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadProfiling]
jmp 0x180009637
mov eax, 1
add rsp, 0xe8
pop rdi
pop rsi
ret