Function at 0x180008510
Capabilities:
Check for debugger via api
Connect pipe
Delete file
Get disk size
Get system firmware table
Hash data with crc32
Set uefi variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x10], rdx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x440
xor r12d, r12d
lea r15, str.hr_I
mov esi, r12d
lea r14, [rsp + 0x40]
mov ebp, 0x57
nop word [rax + rax]
cmp dword [0x18012ef10], 0x24fd2738
jne 0x1800086a8
xor r9d, r9d
mov dword [rsp + 0x20], r12d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_LookupIconIdFromDirectoryEx]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDlgItemTextW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReadConsoleInputW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetSystemCursor]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFirmwareType]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_IntersectRect]
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetFocus]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLargestConsoleWindowSize]
mov qword [rsp + 0x38], r12
xor r9d, r9d
mov qword [rsp + 0x30], r12
xor r8d, r8d
mov qword [rsp + 0x28], r12
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], r12d
call qword [sym.imp.KERNEL32.dll_ReadDirectoryChangesW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CallbackMayRunLong]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RemoveVectoredContinueHandler]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenThread]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetWindowContextHelpId]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetParent]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetTimer]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitAtomTable]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
xor r9d, r9d
mov dword [rsp + 0x20], r12d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MsgWaitForMultipleObjectsEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemTime]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDllDirectoryW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetPropW]
mov ebx, esi
mov edi, 8
nop
cmp dword [0x18012ef10], 0x9cf215f2
jne 0x1800087ab
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadProfiling]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UnregisterWaitEx]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WakeAllConditionVariable]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindAtomW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleFontSize]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAddAtomW]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumber]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetApplicationRestartSettings]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryThreadCycleTime]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Wow64EnableWow64FsRedirection]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MulDiv]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualLock]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DebugActiveProcess]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WakeAllConditionVariable]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMask]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableW]
mov ecx, ebx
mov eax, ebx
and ecx, 1
shr eax, 1
neg ecx
and ecx, 0xedb88320
mov ebx, ecx
xor ebx, eax
sub rdi, 1
jne 0x1800086b0
mov dword [r14], ebx
inc esi
add r14, 4
cmp esi, 0x100
jl 0x180008550
mov ebx, dword [rsp + 0x478]
lea r14, [0x1801499e8]
mov edi, dword [rsp + 0x478]
mov esi, 0xffffffff
nop dword [rax]
dec rbp
cmp dword [0x18012ef10], 0x80e89145
jne 0x180008939
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov r9d, ebx
mov qword [rsp + 0x20], r12
mov r8d, edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReadConsoleOutputW]
xor r9d, r9d
mov qword [rsp + 0x28], r12
xor r8d, r8d
mov qword [rsp + 0x20], r12
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReplaceFileW]
mov qword [rsp + 0x30], r12
lea r8, [0x180149a10]
mov dword [rsp + 0x28], r12d
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], r14
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNLSString]
xor r9d, r9d
mov qword [rsp + 0x20], r12
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapePosition]
xor r9d, r9d
mov dword [rsp + 0x28], r12d
xor r8d, r8d
mov qword [rsp + 0x20], r12
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrencyFormatW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
lock inc dword [r12]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadDescription]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapSetInformation]
lea rcx, [0x180149a50]
call qword [sym.imp.KERNEL32.dll_IsValidLocaleName]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumberOfConsoleInputEvents]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessIdOfThread]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSizeEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleSelectionInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTimeEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeSListHead]
movzx edx, byte [r15]
mov ecx, esi
xor rdx, rcx
shr esi, 8
movzx ecx, dl
inc r15
xor esi, dword [rsp + rcx*4 + 0x40]
test rbp, rbp
jne 0x180008800
lea r11, [rsp + 0x440]
not esi
mov rbx, qword [r11 + 0x30]
mov eax, esi
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret