Function at 0x180005020
Capabilities:
Delete file
Get disk information
Get hostname
Terminate process

Disassembly:
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
call fcn.18004f228
mov r8d, dword [0x1800d8574]
mov ebx, eax
mov eax, 0x51eb851f
xor edi, edi
imul ebx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x64
sub ebx, ecx
inc ebx
cmp r8d, 0xcb5eaf1b
jne 0x180005167
call qword [sym.imp.USER32.dll_GetDoubleClickTime]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetTimer]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteFileTransactedW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetAppContainerNamedObjectPath]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
mov r9d, dword [rsp + 0x60]
xor edx, edx
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryThreadProfiling]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
call qword [sym.imp.KERNEL32.dll_GetACP]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ReuseDDElParam]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnableMenuItem]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalFindAtomW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ShowOwnedPopups]
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetTapePosition]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
mov r8d, dword [0x1800d8574]
mov eax, 0x55555556
imul ebx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp ebx, ecx
jne 0x1800052a4
cmp r8d, 0xc915f6a7
jne 0x180005281
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadpoolWaitEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDllDirectoryW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsThreadpoolTimerSet]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TerminateJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DebugActiveProcess]
lea rax, str.scFF86eI9kY48BiPkrtKU1oq9
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x28], rdi
lea rcx, str.Z2h5MghtvpDgdyI15XqSBtZ
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetDurationFormatEx]
mov r9d, dword [rsp + 0x60]
xor edx, edx
mov r8d, dword [rsp + 0x60]
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadConsoleOutputW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleProcessList]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
lea r8, str.he6o5KzWHFarJe1WxFM6fLAs8X6mp
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStringTypeA]
xor edx, edx
lea rcx, str.Hji63mWscDKkLX3ZI
call qword [sym.imp.KERNEL32.dll_LocaleNameToLCID]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualLock]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ContinueDebugEvent]
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edx, dword [rsp + 0x68]
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
test bl, 1
jne 0x180005332
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x48], 0x1a1
add rax, 0x1a1
mov qword [rsp + 0x40], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.18000dd50
mov qword [rsp + 0x70], rax
lea r9, [rsp + 0x68]
mov rax, qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea r8, [rsp + 0x60]
mov dword [rsp + 0x48], 0x130
lea rdx, [rsp + 0x70]
add rax, 0x130
mov dword [rsp + 0x60], 8
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x40]
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.18000dec0
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
mov r8d, 0xffffdb29
nop dword [rax + rax]
inc r8d
mov eax, 0x55555556
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r8d, ecx
jne 0x180005340
lea eax, [r8*2 + 0x700e]
mov ecx, r8d
sub ecx, eax
lea r11d, [r8 + 0x179b]
mov r9d, 0xffff425b
mov eax, 0x55555556
lea r8d, [rcx*4 + 0x12734]
sub r9d, r8d
lea r10d, [rcx*2 - 0x6b06]
sub r9d, r10d
sub r8d, r11d
imul r9d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r9d, ecx
je 0x1800053ca
nop dword [rax]
nop dword [rax + rax]
inc r9d
mov eax, 0x55555556
imul r9d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r9d, ecx
jne 0x1800053b0
lea eax, [r8*2 + 0x30fa]
sub r9d, 0x33da
sub eax, r9d
add eax, r10d
mov r10d, 0xd6c
mov ecx, eax
add eax, 0xffffe0b1
mov r8d, eax
sub ecx, r11d
sub r8d, r9d
sub ecx, 0x279c
add r8d, 0x1fc9
sub eax, r8d
add r8d, 0x165c
add eax, 0xc02
add ecx, eax
mov eax, 0xfffff3ef
sub eax, r8d
add r8d, 0xd27
add ecx, eax
mov eax, 0x1832
sub ecx, r8d
add ecx, 0xffffffce
sub eax, ecx
add r8d, eax
mov eax, 0x2643
lea r9d, [rcx + 0x220]
sub eax, r9d
sub r9d, 0x1b9b
lea edx, [r8 - 0x83c]
add r8d, eax
sub edx, r8d
add r8d, 0x1865
lea eax, [rdx + r8]
lea ecx, [r9 + rax*2]
lea eax, [r8*2 + 0x3b02]
sub r10d, ecx
lea edx, [rcx*2 - 0x3d54]
mov r8d, edx
sub r8d, eax
mov eax, 0xffffe333
sub eax, r8d
add r9d, eax
mov eax, edx
sub r8d, r9d
and eax, 0x80000003
jge 0x18000549c
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
lea ecx, [rdx + 0xedc]
mov eax, 0x55555556
cmove ecx, edx
sub ecx, r9d
add ecx, 0x266a
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea edx, [rdx + rdx*2]
cmp ecx, edx
je 0x1800054e7
nop word [rax + rax]
inc ecx
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea edx, [rdx + rdx*2]
cmp ecx, edx
jne 0x1800054d0
lea edx, [r8 - 0x39b]
add edx, r10d
lea eax, [rdx + r8]
cmp eax, 0xfffd3105
jne 0x18000554b
cmp edx, 0xffff9bf4
jne 0x18000554b
cmp ecx, 0xfffa8337
jne 0x18000554b
mov dword [rsp + 0x48], 0x168
lea rax, [fcn.1800544ec]
add rax, 0x168
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x40]
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.18000e060
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]