Function at 0x180008800
Capabilities:
Connect pipe
Delete file
Get common file path
Get file size
Get geographical location
Get system information on windows
Hash data with crc32
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x440
xor r12d, r12d
lea r15, str.hr_I
mov esi, r12d
lea r14, [rsp + 0x40]
mov ebp, 0x57
nop dword [rax + rax]
cmp dword [0x18012a980], 0x9e8f91f7
jne 0x1800089a4
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_FrameRect]
xor r9d, r9d
mov qword [rsp + 0x20], r12
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DialogBoxParamW]
call qword [sym.imp.KERNEL32.dll_FreeConsole]
mov dword [rsp + 0x30], r12d
xor r9d, r9d
mov qword [rsp + 0x28], r12
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapViewOfFileExNuma]
xor ecx, ecx
call qword [sym.imp.USER32.dll_CharLowerW]
xor r9d, r9d
mov dword [rsp + 0x20], r12d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UnlockFile]
xor r9d, r9d
lea rdx, [0x180145bd8]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStringTypeW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFileShortNameW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolCleanupGroup]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DiscardVirtualMemory]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnumDisplaySettingsExW]
xor r9d, r9d
mov qword [rsp + 0x20], r12
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetUserObjectSecurity]
xor ecx, ecx
call qword [sym.imp.USER32.dll_UnregisterSuspendResumeNotification]
call qword [sym.imp.USER32.dll_GetMessagePos]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetScrollBarInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
call qword [sym.imp.USER32.dll_IsWow64Message]
lock add dword [r12], r12d
mov qword [rsp + 0x30], r12
xor r9d, r9d
mov dword [rsp + 0x28], r12d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], r12d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_BackupWrite]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCompact]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeServerSessionId]
xor r9d, r9d
mov qword [rsp + 0x20], r12
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReuseDDElParam]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
mov ebx, esi
mov edi, 8
nop dword [rax + rax]
cmp dword [0x18012a980], 0xe39fbc88
jne 0x180008ada
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PurgeComm]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessGroupAffinity]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ApplicationRecoveryFinished]
xor r9d, r9d
mov dword [rsp + 0x28], r12d
xor r8d, r8d
mov qword [rsp + 0x20], r12
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
xor r9d, r9d
mov qword [rsp + 0x20], r12
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateConsoleScreenBuffer]
xor r9d, r9d
mov qword [rsp + 0x28], r12
xor r8d, r8d
mov qword [rsp + 0x20], r12
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SearchPathW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateJobObjectW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessDEPPolicy]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleCP]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaProximityNodeEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetUserGeoID]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFileValidData]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSearchPathMode]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleDisplayMode]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
xor r9d, r9d
mov dword [rsp + 0x20], r12d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetOverlappedResultEx]
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SubmitThreadpoolWork]
mov ecx, ebx
mov eax, ebx
and ecx, 1
shr eax, 1
neg ecx
and ecx, 0xedb88320
mov ebx, ecx
xor ebx, eax
sub rdi, 1
jne 0x1800089b0
mov dword [r14], ebx
inc esi
add r14, 4
cmp esi, 0x100
jl 0x180008840
mov ebx, 0xffffffff
dec rbp
cmp dword [0x18012a980], 0x5aa5b82c
jne 0x180008c46
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OfferVirtualMemory]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SubmitThreadpoolWork]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapWalk]
xor r8d, r8d
lea rdx, [0x180145c10]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNLSVersionEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteTimerQueueTimer]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
call qword [sym.imp.KERNEL32.dll_GetOEMCP]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteFileTransactedW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UnregisterWaitEx]
mov qword [rsp + 0x30], r12
xor r9d, r9d
mov qword [rsp + 0x28], r12
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UpdateProcThreadAttribute]
call qword [sym.imp.KERNEL32.dll_GetVersion]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Wow64EnableWow64FsRedirection]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AddSIDToBoundaryDescriptor]
mov dword [rsp + 0x30], r12d
xor r9d, r9d
mov qword [rsp + 0x28], r12
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapViewOfFileExNuma]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentConsoleFontEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessAffinityUpdateMode]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleSelectionInfo]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
movzx edx, byte [r15]
mov ecx, ebx
xor rdx, rcx
shr ebx, 8
movzx ecx, dl
inc r15
xor ebx, dword [rsp + rcx*4 + 0x40]
test rbp, rbp
jne 0x180008b13
lea r11, [rsp + 0x440]
not ebx
mov rbp, qword [r11 + 0x28]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret