Function at 0x180009e20
Capabilities:
Delete file
Enumerate system firmware tables
Get disk information
Get disk size
Get system firmware table
Read .ini file
Set uefi variable
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0xe0]
sub rsp, 0x1e0
cmp edx, 1
jne 0x18000a332
lea rax, [0x180009280]
add rax, 0x1f8
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], 0x1f8
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
call fcn.18000f220
lea rax, [0x180009a10]
add rax, 0x151
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], 0x151
xor eax, eax
mov word [rsp + 0x40], ax
mov byte [rsp + 0x42], al
xor edi, edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rdi
mov ecx, 0x10
call fcn.180080288
mov qword [rax + 8], rdi
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x48]
mov qword [rax], rcx
mov word [rsp + 0x78], di
mov qword [rsp + 0x7e], rdi
mov qword [rbp - 0x7a], rdi
xor eax, eax
mov word [rsp + 0x7b], ax
mov byte [rsp + 0x7d], al
mov word [rsp + 0x7e], ax
mov byte [rbp - 0x80], al
mov word [rbp - 0x7f], ax
mov byte [rbp - 0x7d], al
mov word [rbp - 0x7c], ax
mov byte [rbp - 0x7a], al
mov word [rbp - 0x79], ax
mov byte [rbp - 0x77], al
mov word [rbp - 0x76], ax
mov byte [rbp - 0x74], al
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x74], edi
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.1800121b0
nop
lea rcx, [rsp + 0x48]
call fcn.180016bd0
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x48], rdi
mov edx, 0x10
call fcn.18008019c
xor ecx, ecx
call fcn.18008cfd0
mov ecx, eax
call fcn.180089ad8
lea rbx, [0x180009780]
lea rax, [rbx + 0x24c]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], 0x24c
xor eax, eax
mov word [rsp + 0x40], ax
mov byte [rsp + 0x42], al
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rdi
mov ecx, 0x10
call fcn.180080288
mov qword [rax + 8], rdi
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x48]
mov qword [rax], rcx
mov word [rsp + 0x78], di
mov qword [rsp + 0x7e], rdi
mov qword [rbp - 0x7a], rdi
xor eax, eax
mov word [rsp + 0x7b], ax
mov byte [rsp + 0x7d], al
mov word [rsp + 0x7e], ax
mov byte [rbp - 0x80], al
mov word [rbp - 0x7f], ax
mov byte [rbp - 0x7d], al
mov word [rbp - 0x7c], ax
mov byte [rbp - 0x7a], al
mov word [rbp - 0x79], ax
mov byte [rbp - 0x77], al
mov word [rbp - 0x76], ax
mov byte [rbp - 0x74], al
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x74], edi
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea r8, [rbp]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.180011f80
nop
lea rcx, [rsp + 0x48]
call fcn.180016bd0
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x48], rdi
mov edx, 0x10
call fcn.18008019c
add rbx, 0x11b
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x38], 0x11b
xor eax, eax
mov word [rsp + 0x40], ax
mov byte [rsp + 0x42], al
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rdi
mov ecx, 0x10
call fcn.180080288
mov qword [rax + 8], rdi
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x48]
mov qword [rax], rcx
mov word [rsp + 0x78], di
mov qword [rsp + 0x7e], rdi
mov qword [rbp - 0x7a], rdi
xor eax, eax
mov word [rsp + 0x7b], ax
mov byte [rsp + 0x7d], al
mov word [rsp + 0x7e], ax
mov byte [rbp - 0x80], al
mov word [rbp - 0x7f], ax
mov byte [rbp - 0x7d], al
mov word [rbp - 0x7c], ax
mov byte [rbp - 0x7a], al
mov word [rbp - 0x79], ax
mov byte [rbp - 0x77], al
mov word [rbp - 0x76], ax
mov byte [rbp - 0x74], al
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x74], edi
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea r8, [rbp - 0x70]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.180011f80
nop
lea rcx, [rsp + 0x48]
call fcn.180016bd0
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x48], rdi
mov edx, 0x10
call fcn.18008019c
lea rax, [0x180009870]
add rax, 0x1d4
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], 0x1d4
xor eax, eax
mov word [rsp + 0x40], ax
mov byte [rsp + 0x42], al
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rdi
mov ecx, 0x10
call fcn.180080288
mov qword [rax + 8], rdi
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x48]
mov qword [rax], rcx
mov word [rsp + 0x78], di
mov qword [rsp + 0x7e], rdi
mov qword [rbp - 0x7a], rdi
xor eax, eax
mov word [rsp + 0x7b], ax
mov byte [rsp + 0x7d], al
mov word [rsp + 0x7e], ax
mov byte [rbp - 0x80], al
mov word [rbp - 0x7f], ax
mov byte [rbp - 0x7d], al
mov word [rbp - 0x7c], ax
mov byte [rbp - 0x7a], al
mov word [rbp - 0x79], ax
mov byte [rbp - 0x77], al
mov word [rbp - 0x76], ax
mov byte [rbp - 0x74], al
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x74], edi
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea rax, [rbp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x70]
lea r8, [rbp]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.180011d40
nop
lea rcx, [rsp + 0x48]
call fcn.180016bd0
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x48], rdi
mov edx, 0x10
call fcn.18008019c
lea rax, [0x180003d10]
add rax, 0x161
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], 0x161
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
call fcn.18000f220
cmp dword [0x18010e3e4], 0x99487366
jne 0x18000a31a
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCompact]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolTimer]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ResetWriteWatch]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteFileTransactedW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PowerCreateRequest]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProfileSectionW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLargestConsoleWindowSize]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFinalPathNameByHandleW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PowerSetRequest]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AllocateUserPhysicalPages]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetVolumeMountPointW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCPInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLocaleName]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolCleanupGroup]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [0x1801271d8]
call qword [sym.imp.KERNEL32.dll_FindFirstFileNameW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
mov eax, 1
mov rbx, qword [rsp + 0x200]
add rsp, 0x1e0
pop rdi
pop rsi
pop rbp
ret
cmp edx, 2
je 0x18000a31a
cmp edx, 3
jne 0x18000a490
cmp dword [0x18010e3e4], 0xb647a907
jne 0x18000a31a
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelIoEx]
xor edx, edx
xor edi, edi
mov qword [rsp + 0x20], rdi
mov r9d, dword [rbp + 0x108]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InvertRect]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetDlgItemInt]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommConfig]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_TranslateAcceleratorW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DdeCreateStringHandleW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_PhysicalToLogicalPoint]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetClassWord]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnableMenuItem]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitOnceInitialize]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
xor ecx, ecx
call qword [sym.imp.USER32.dll_RemoveClipboardFormatListener]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaProcessorNodeEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetUserObjectInformationW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumSystemFirmwareTables]
call qword [sym.imp.KERNEL32.dll_IsSystemResumeAutomatic]
jmp 0x18000a31a
test edx, edx
jne 0x18000a31a
mov ecx, 0x4ae
nop dword [rax]
inc ecx
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea edx, [rdx + rdx*2]
cmp ecx, edx
jne 0x18000a4a0
sub ecx, 0x3fa3
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
lea edx, [rcx - 0x211c]
cmp ecx, eax
cmove edx, ecx
lea eax, [rdx - 0x4573]
lea r9d, [rdx + 0x94a8]
add r9d, eax
lea r11d, [rax + 0x7e57]
lea r10d, [rdx + 0xaef1]
mov ebx, 0xffffed21
sub ebx, r11d
sub r10d, ebx
lea edi, [r11 + 0xd586]
mov edx, ebx
sub edx, r9d
add ebx, 0x12ce
mov r8d, ebx
lea eax, [r9 + rbx]
lea ecx, [r11 + 0x3c87]
lea r9d, [rdx + 0x98c7]
sub r11d, 0x1647
sub ebx, 0x78
sub r10d, 0x97a
add ecx, eax
sub r9d, ecx
sub ecx, r10d
lea edx, [r8 + 0x3c]
add edx, ebx
add edx, r11d
mov eax, ecx
sub eax, r11d
add ebx, eax
lea esi, [rcx - 0x26c]
add esi, ebx
add ebx, 0x1bcc
mov eax, 0xffffe652
sub eax, esi
add r11d, eax
add r9d, 0xffffd30c
add r9d, edi
add r9d, r10d
mov ecx, esi
sub ecx, edx
sub esi, edi
mov eax, 0xfffff25a
mov r8d, 0x1a00
sub eax, r11d
add edi, eax
sub r9d, edi
add r11d, 0xfffff89c
sub ecx, ebx
add ecx, esi
lea r10d, [rsi - 0x3608]
add r10d, ecx
nop word [rax + rax]
inc r8d
mov eax, 0x55555556
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r8d, ecx
jne 0x18000a5b0
mov ecx, r11d
add esi, 0x1e48
mov eax, r11d
and eax, 0x80000003
jge 0x18000a5e4
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
je 0x18000a5f2
test ecx, ecx
jle 0x18000a5f2
add ecx, 0xd2e
lea edx, [rdi + 0xc8]
add edx, ecx
cmp r11d, 0x16f2
jne 0x18000a646
cmp esi, 0xfffefa77
jne 0x18000a646
cmp r10d, 0xfffcf209
jne 0x18000a646
cmp ecx, 0x2420
jne 0x18000a646
lea eax, [rbx + rdx]
cmp eax, 0xbd98
jne 0x18000a646
lea eax, [r9 + r9]
cmp eax, 0x2ed26
jne 0x18000a646
cmp r8d, 0x1a01
jne 0x18000a646
cmp edx, 0xab47
je 0x18000a31a
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]