Function at 0x1800044a0
Capabilities:
Connect pipe
Enumerate files on windows
Get common file path
Get disk size
Manipulate console buffer
Print debug messages
Read .ini file
Set uefi variable
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x88
mov ecx, 0x18
call fcn.180024884
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1800044d2
mov rcx, qword [rsp + 0x50]
call fcn.180009eb0
mov qword [rsp + 0x58], rax
jmp 0x1800044db
mov qword [rsp + 0x58], 0
mov rax, qword [rsp + 0x58]
mov qword [0x18007bdb0], rax
mov eax, dword [0x18007bda4]
mov ecx, 0x82655894
cmp rax, rcx
jne 0x18000470c
call qword [sym.imp.KERNEL32.dll_UnregisterApplicationRecoveryCallback]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteFiber]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ApplicationRecoveryFinished]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolCleanupGroup]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Wow64SetThreadContext]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableExW]
call qword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolWait]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalGetAtomNameW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EraseTape]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationByHandleW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 7
mov edx, 0x80000000
lea rcx, str.Qt5Network.dll
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x70], rax
cmp qword [rsp + 0x70], 0xffffffffffffffff
jne 0x180004755
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [rsp + 0x40], 0
jmp 0x180004769
mov eax, dword [rsp + 0x40]
inc eax
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 4
jge 0x180004b51
movsxd rax, dword [rsp + 0x40]
lea rcx, [0x1800767d8]
mov eax, dword [rcx + rax*4]
mov dword [rsp + 0x44], eax
mov eax, dword [0x18007bda4]
mov ecx, 0xcda22ac6
cmp rax, rcx
jne 0x180004969
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleFontSize]
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LCMapStringW]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.bJPepBdtYzcEGIzyynbgdb
xor edx, edx
lea rcx, str.FHfmvmUpJMwWQEpWSXLOAm
call qword [sym.imp.KERNEL32.dll_GetCalendarInfoEx]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThreadpoolWait]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AttachConsole]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueueUserWorkItem]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThreadpoolWait]
xor edi, edi
xor esi, esi
xor ecx, ecx
rep movsb byte [rdi], byte [rsi]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetComputerNameExW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPreferredUILanguages]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSectionEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitOnceBeginInitialize]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapeParameters]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryIdleProcessorCycleTime]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.ZxmTIzGBPsVsZWuO
xor edx, edx
lea rcx, str.dOOxFkUbfNcTfVXrWTMpNXulXHwu
call qword [sym.imp.KERNEL32.dll_GetNumberFormatEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessDEPPolicy]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteBoundaryDescriptor]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThreadpool]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolTimer]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteTimerQueue]
mov eax, dword [0x18007bdd0]
mov ecx, dword [rsp + 0x44]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x44], eax
cmp dword [0x18007bda4], 0x500a849
jne 0x180004b3b
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlsFree]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumCalendarInfoExW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SleepConditionVariableCS]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLocaleName]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeConditionVariable]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThreadpoolWork]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetDefaultDllDirectories]
call qword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CommConfigDialogW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Beep]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsValidCodePage]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Wow64EnableWow64FsRedirection]
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextVolumeW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemTimes]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call qword [sym.imp.KERNEL32.dll_UnregisterApplicationRestart]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDefaultCommConfigW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleOriginalTitleW]
lea rax, str.BNCEbgqitOngucZyNAchbJkGpv
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingFromApp]
call qword [sym.imp.KERNEL32.dll_GetConsoleCP]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetApplicationRestartSettings]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call qword [sym.imp.KERNEL32.dll_FlushProcessWriteBuffers]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumberEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNLSVersion]
lea rdx, [rsp + 0x44]
mov rcx, qword [0x18007bdb0]
call fcn.180009f50
jmp 0x18000475f
add rsp, 0x88
pop rdi
pop rsi
ret