Function at 0x180006c10
Capabilities:
Extract resource via kernel32 functions
Get common file path
Get disk information
Set uefi variable
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xe0
mov rdi, rcx
xor ecx, ecx
call fcn.18007a6f0
mov ecx, eax
call fcn.1800771f8
call fcn.1800771cc
and eax, 0x80000003
jge 0x180006c4d
dec eax
or eax, 0xfffffffc
inc eax
xor esi, esi
mov ebx, esi
test eax, eax
jne 0x180006d8e
cmp dword [0x1800fb3e8], 0xcecbf68f
jne 0x180006d7a
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnumThreadWindows]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetMenuItemCount]
lea rax, [0x180113d88]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingFromApp]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetDlgItemInt]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetUpdatedClipboardFormats]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateWaitableTimerExW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Wow64EnableWow64FsRedirection]
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetMenuItemCount]
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableExW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHeaps]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPreferredUILanguages]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumDateFormatsW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_UnloadKeyboardLayout]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InflateRect]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolTimer]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadpoolTimerEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteSynchronizationBarrier]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InvalidateRgn]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferInfoEx]
mov rdx, qword [rbp + 0x6f]
mov rcx, rdi
call fcn.1800022f0
mov rbx, rax
jmp 0x180007604
cmp eax, 1
jne 0x180006f5b
mov r8d, 0x99d
nop dword [rax]
inc r8d
test r8b, 1
jne 0x180006da0
lea eax, [r8 + r8]
add r8d, 0x3cbf
lea r11d, [rax + 0xfa57]
lea ecx, [r8 - 0x3464]
mov r10d, 0xffffe93f
sub r10d, r11d
lea r9d, [r8 + rcx]
sub r10d, r8d
lea edx, [rax + 0xf943]
add edx, r10d
mov eax, r9d
sub eax, ecx
lea ebx, [rax*2 - 0xae]
sub r9d, edx
mov eax, 0xffffeb5b
sub eax, r8d
lea ecx, [rax + 0x7869]
lea edx, [rdx*2 + 0x1194]
add eax, 0x8ca
add r9d, eax
sub edx, r9d
lea r8d, [rax + rcx]
sub r11d, ecx
cmp r9d, 0x6450
jne 0x180006f4f
cmp r10d, 0xfffe954f
jne 0x180006f4f
cmp edx, 0xfffef0e0
jne 0x180006f4f
cmp r8d, 0xffffcb2f
jne 0x180006f4f
cmp ebx, 0x8c0c
jne 0x180006f4f
cmp r11d, 0xf02c
jne 0x180006f4f
cmp ecx, 0x1d67
jne 0x180006f4f
mov dword [rbp + 0x77], 4
mov dword [rbp + 0x7f], 0x3000
mov qword [rbp + 0x27], rsi
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
add rax, 0x26a
mov qword [rbp + 0x17], rax
mov dword [rbp + 0x1f], 0x26a
xorps xmm0, xmm0
movups xmmword [rbp - 0x59], xmm0
mov qword [rbp - 0x41], rsi
mov qword [rbp - 0x39], rsi
mov qword [rbp - 0x31], rsi
mov qword [rbp - 0x29], rsi
mov qword [rbp - 0x21], rsi
mov ecx, 0x10
call fcn.18006d9a8
mov qword [rax + 8], rsi
mov qword [rbp - 0x41], rax
lea rcx, [rbp - 0x41]
mov qword [rax], rcx
mov word [rbp - 0x11], si
mov qword [rbp - 0xb], rsi
mov qword [rbp - 3], rsi
xor eax, eax
mov word [rbp - 0xe], ax
mov byte [rbp - 0xc], al
mov word [rbp - 0xb], ax
mov byte [rbp - 9], al
mov word [rbp - 8], ax
mov byte [rbp - 6], al
mov word [rbp - 5], ax
mov byte [rbp - 3], al
mov word [rbp - 2], ax
mov byte [rbp], al
mov word [rbp + 1], ax
mov byte [rbp + 3], al
mov dword [rbp - 0x45], esi
mov dword [rbp - 0x15], esi
movaps xmm0, xmmword [rbp + 0x17]
movdqa xmmword [rbp + 7], xmm0
lea rax, [rbp + 0x77]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x6f]
lea r8, [rbp + 0x27]
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x59]
call fcn.180013cd0
mov rbx, qword [rbp - 0x51]
lea rcx, [rbp - 0x41]
call fcn.180016c70
mov rcx, qword [rbp - 0x41]
mov qword [rbp - 0x41], rsi
jmp 0x1800075fa
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x18000721b
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
add rax, 0x27a
mov qword [rbp + 0x17], rax
mov dword [rbp + 0x1f], 0x27a
xorps xmm0, xmm0
movups xmmword [rbp - 0x59], xmm0
mov qword [rbp - 0x41], rsi
mov qword [rbp - 0x39], rsi
mov qword [rbp - 0x31], rsi
mov qword [rbp - 0x29], rsi
mov qword [rbp - 0x21], rsi
mov ecx, 0x10
call fcn.18006d9a8
mov qword [rax + 8], rsi
mov qword [rbp - 0x41], rax
lea rcx, [rbp - 0x41]
mov qword [rax], rcx
mov word [rbp - 0x11], bx
mov qword [rbp - 0xb], rsi
mov qword [rbp - 3], rsi
xor eax, eax
mov word [rbp - 0xe], ax
mov byte [rbp - 0xc], al
mov word [rbp - 0xb], ax
mov byte [rbp - 9], al
mov word [rbp - 8], ax
mov byte [rbp - 6], al
mov word [rbp - 5], ax
mov byte [rbp - 3], al
mov word [rbp - 2], ax
mov byte [rbp], al
mov word [rbp + 1], ax
mov byte [rbp + 3], al
mov dword [rbp - 0x45], esi
mov dword [rbp - 0x15], esi
movaps xmm0, xmmword [rbp + 0x17]
movdqa xmmword [rbp + 7], xmm0
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x59]
call fcn.180013ab0
mov rbx, qword [rbp - 0x51]
lea rcx, [rbp - 0x41]
call fcn.180016c70
mov rcx, qword [rbp - 0x41]
mov qword [rbp - 0x41], rsi
mov edx, 0x10
call fcn.18006d8bc
mov qword [rbp + 0x7f], rbx
cmp dword [0x1800fb3e8], 0x5238b4d5
jne 0x180007147
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadpoolTimer]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDllDirectoryW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapSize]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetWaitableTimerEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiberEx]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateHardLinkW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RemoveSecureMemoryCacheCallback]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadGroupAffinity]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadpoolWaitEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadpoolTimerEx]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
mov dword [rsp + 0x38], esi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
lock inc dword [rsi]
mov dword [rbp + 0x77], 8
mov rax, qword [sym.imp.KERNEL32.dll_HeapAlloc]
add rax, 0x22b
mov qword [rbp + 0x17], rax
mov dword [rbp + 0x1f], 0x22b
xorps xmm0, xmm0
movups xmmword [rbp - 0x59], xmm0
mov qword [rbp - 0x41], rsi
mov qword [rbp - 0x39], rsi
mov qword [rbp - 0x31], rsi
mov qword [rbp - 0x29], rsi
mov qword [rbp - 0x21], rsi
mov ecx, 0x10
call fcn.18006d9a8
mov qword [rax + 8], rsi
mov qword [rbp - 0x41], rax
lea rcx, [rbp - 0x41]
mov qword [rax], rcx
mov word [rbp - 0x11], 0
mov qword [rbp - 0xb], rsi
mov qword [rbp - 3], rsi
xor eax, eax
mov word [rbp - 0xe], ax
mov byte [rbp - 0xc], al
mov word [rbp - 0xb], ax
mov byte [rbp - 9], al
mov word [rbp - 8], ax
mov byte [rbp - 6], al
mov word [rbp - 5], ax
mov byte [rbp - 3], al
mov word [rbp - 2], ax
mov byte [rbp], al
mov word [rbp + 1], ax
mov byte [rbp + 3], al
mov dword [rbp - 0x45], esi
mov dword [rbp - 0x15], esi
movaps xmm0, xmmword [rbp + 0x17]
movdqa xmmword [rbp + 7], xmm0
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x77]
lea r8, [rbp + 0x7f]
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x59]
call fcn.180013870
mov rbx, qword [rbp - 0x51]
lea rcx, [rbp - 0x41]
call fcn.180016c70
mov rcx, qword [rbp - 0x41]
mov qword [rbp - 0x41], rsi
jmp 0x1800075fa
cmp eax, 3
jne 0x180007604
mov dword [rbp + 0x77], esi
mov rax, qword [sym.imp.KERNEL32.dll_LocalAlloc]
add rax, 0x22d
mov qword [rbp + 0x17], rax
mov dword [rbp + 0x1f], 0x22d
xorps xmm0, xmm0
movups xmmword [rbp - 0x59], xmm0
mov qword [rbp - 0x41], rsi
mov qword [rbp - 0x39], rsi
mov qword [rbp - 0x31], rsi
mov qword [rbp - 0x29], rsi
mov qword [rbp - 0x21], rsi
mov ecx, 0x10
call fcn.18006d9a8
mov qword [rax + 8], rsi
mov qword [rbp - 0x41], rax
lea rcx, [rbp - 0x41]
mov qword [rax], rcx
mov word [rbp - 0x11], bx
mov qword [rbp - 0xb], rsi
mov qword [rbp - 3], rsi
xor eax, eax
mov word [rbp - 0xe], ax
mov byte [rbp - 0xc], al
mov word [rbp - 0xb], ax
mov byte [rbp - 9], al
mov word [rbp - 8], ax
mov byte [rbp - 6], al
mov word [rbp - 5], ax
mov byte [rbp - 3], al
mov word [rbp - 2], ax
mov byte [rbp], al
mov word [rbp + 1], ax
mov byte [rbp + 3], al
mov dword [rbp - 0x45], esi
mov dword [rbp - 0x15], esi
movaps xmm0, xmmword [rbp + 0x17]
movdqa xmmword [rbp + 7], xmm0
lea r9, [rbp + 0x6f]
lea r8, [rbp + 0x77]
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x59]
call fcn.180016470
mov rbx, qword [rbp - 0x51]
lea rcx, [rbp - 0x41]
call fcn.180016c70
mov rcx, qword [rbp - 0x41]
mov qword [rbp - 0x41], rsi
mov edx, 0x10
call fcn.18006d8bc
mov qword [rbp + 0x3f], rbx
mov dword [rbp + 0x77], 4
mov dword [rbp + 0x7f], 0x3000
mov dword [rbp + 0x27], 0x400
mov qword [rbp + 0x37], rsi
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
add rax, 0x1c9
mov qword [rbp + 7], rax
mov dword [rbp + 0xf], 0x1c9
xorps xmm0, xmm0
movups xmmword [rbp - 0x59], xmm0
mov qword [rbp - 0x41], rsi
mov qword [rbp - 0x39], rsi
mov qword [rbp - 0x31], rsi
mov qword [rbp - 0x29], rsi
mov qword [rbp - 0x21], rsi
mov ecx, 0x10
call fcn.18006d9a8
mov qword [rax + 8], rsi
mov qword [rbp - 0x41], rax
lea rcx, [rbp - 0x41]
mov qword [rax], rcx
mov word [rbp - 0x11], 0
mov qword [rbp - 0xb], rsi
mov qword [rbp - 3], rsi
xor eax, eax
mov word [rbp - 0xe], ax
mov byte [rbp - 0xc], al
mov word [rbp - 0xb], ax
mov byte [rbp - 9], al
mov word [rbp - 8], ax
mov byte [rbp - 6], al
mov word [rbp - 5], ax
mov byte [rbp - 3], al
mov word [rbp - 2], ax
mov byte [rbp], al
mov word [rbp + 1], ax
mov byte [rbp + 3], al
mov dword [rbp - 0x45], esi
mov dword [rbp - 0x15], esi
movaps xmm0, xmmword [rbp + 7]
movdqa xmmword [rbp + 7], xmm0
lea rax, [rbp + 0x77]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x27]
lea r8, [rbp + 0x37]
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x59]
call fcn.180013630
mov rbx, qword [rbp - 0x51]
lea rcx, [rbp - 0x41]
call fcn.180016c70
mov rcx, qword [rbp - 0x41]
mov qword [rbp - 0x41], rsi
mov edx, 0x10
call fcn.18006d8bc
mov qword [rbp + 0x2f], rbx
mov rax, qword [sym.imp.KERNEL32.dll_LocalLock]
add rax, 0x1a9
mov qword [rbp + 7], rax
mov dword [rbp + 0xf], 0x1a9
movaps xmm0, xmmword [rbp + 7]
movdqa xmmword [rbp + 7], xmm0
lea rdx, [rbp + 0x3f]
lea rcx, [rbp + 7]
call fcn.18000f1d0
mov rbx, rax
cmp dword [0x1800fb3e8], 0xf79b0bf2
jne 0x180007529
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [0x180113db0]
call qword [sym.imp.KERNEL32.dll_FindFirstStreamW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InterlockedPushListSListEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemPowerStatus]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalSize]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolWait]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsThreadpoolTimerSet]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleFontSize]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessMitigationPolicy]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCalendarInfoW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], rsi
lea rax, [0x180113dd8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [0x180113e00]
call qword [sym.imp.KERNEL32.dll_GetDurationFormatEx]
call qword [sym.imp.KERNEL32.dll_FlushProcessWriteBuffers]
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_BackupSeek]
mov dword [rbp + 0x77], 0x8000
mov dword [rbp + 0x7f], esi
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFree]
add rax, 0x13e
mov qword [rbp + 7], rax
mov dword [rbp + 0xf], 0x13e
xor eax, eax
mov word [rbp - 0x59], ax
mov byte [rbp - 0x57], al
mov qword [rbp - 0x51], rsi
mov qword [rbp - 0x49], rsi
mov qword [rbp - 0x41], rsi
mov qword [rbp - 0x39], rsi
mov qword [rbp - 0x31], rsi
mov ecx, 0x10
call fcn.18006d9a8
mov qword [rax + 8], rsi
mov qword [rbp - 0x51], rax
lea rcx, [rbp - 0x51]
mov qword [rax], rcx
mov word [rbp - 0x21], 0
mov qword [rbp - 0x1b], rsi
mov qword [rbp - 0x13], rsi
xor eax, eax
mov word [rbp - 0x1e], ax
mov byte [rbp - 0x1c], al
mov word [rbp - 0x1b], ax
mov byte [rbp - 0x19], al
mov word [rbp - 0x18], ax
mov byte [rbp - 0x16], al
mov word [rbp - 0x15], ax
mov byte [rbp - 0x13], al
mov word [rbp - 0x12], ax
mov byte [rbp - 0x10], al
mov word [rbp - 0xf], ax
mov byte [rbp - 0xd], al
mov dword [rbp - 0x55], esi
mov dword [rbp - 0x25], esi
movaps xmm0, xmmword [rbp + 7]
movdqa xmmword [rbp + 7], xmm0
lea rax, [rbp + 0x77]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x7f]
lea r8, [rbp + 0x2f]
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x59]
call fcn.1800133f0
nop
lea rcx, [rbp - 0x51]
call fcn.180016c70
mov rcx, qword [rbp - 0x51]
mov qword [rbp - 0x51], rsi
mov edx, 0x10
call fcn.18006d8bc
mov rax, rbx
mov rbx, qword [rsp + 0x100]
add rsp, 0xe0
pop rdi
pop rsi
pop rbp
ret