Function at 0x180004e90
Capabilities:
Get system firmware table
Set file attributes
Write file on windows

Disassembly:
push rbx
sub rsp, 0x50
mov dword [rsp + 0x48], 0x233
lea rax, [fcn.180005120]
add rax, 0x233
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.1800108f0
mov rax, qword [0x18010cce8]
xor ebx, ebx
mov r8d, dword [0x18010ccf0]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx + 0x3e08]
mov dword [rax + 4], 0x6e2158c6
cmp r8d, 0x4d340939
jne 0x180004fdd
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetComputerNameExW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalFree]
call qword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenEventW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteFile]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_SetWorldTransform]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_SetRectRgn]
xor ecx, ecx
call qword [sym.imp.GDI32.dll_StrokePath]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_ExtSelectClipRgn]
mov dword [rsp + 0x30], ebx
xor r9d, r9d
mov qword [rsp + 0x28], rbx
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_SetDIBits]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetComputerNameExW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_GetTextCharsetInfo]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CheckTokenMembershipEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_GetTextExtentPointI]
mov r8d, dword [0x18010ccf0]
mov rax, qword [0x18010ccf8]
mov rcx, qword [rax + 0x10]
mov rax, qword [0x18010cce8]
mov edx, dword [rcx + 0x47c8]
mov rcx, qword [rax + 0x10]
sub edx, 0x626cab10
mov rax, qword [rcx + 0x3e08]
mov dword [rax], edx
cmp r8d, 0xa279fa95
jne 0x1800050c7
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaProximityNode]
xor ecx, ecx
call qword [sym.imp.GDI32.dll_EndPage]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelSynchronousIo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenMutexW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_SetMetaFileBitsEx]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_TextOutW]
call qword [sym.imp.KERNEL32.dll_UnregisterApplicationRecoveryCallback]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFileInformationByHandle]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_PolyBezier]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateEllipticRgn]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTapePartition]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsThreadpoolTimerSet]
mov rax, qword [0x18010cce8]
mov rcx, qword [rax + 0x10]
mov rax, qword [0x18010ccf8]
mov rdx, qword [rcx + 0x3e08]
mov rcx, qword [rax + 0x10]
mov eax, dword [rcx + 0x47c8]
add dword [rdx + 4], eax
mov rax, qword [0x18010cce0]
mov r8, qword [rax + 0x10]
mov rax, qword [0x18010cce8]
mov rcx, qword [rax + 0x10]
mov eax, dword [r8 + 0x33d8]
mov rdx, qword [rcx + 0x3e08]
mov dword [rdx + 8], eax
add rsp, 0x50
pop rbx
ret