Function at 0x180009930
Capabilities:
Copy file
Delete directory
Enumerate system firmware tables
Identify system language via api
Query environment variable
Read .ini file
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xd0
mov edi, 1
xor r14d, r14d
test edx, edx
jne 0x180009b1c
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReadThreadProfilingData]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumCalendarInfoExW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RegisterBadMemoryNotification]
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReadFileEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushConsoleInputBuffer]
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FoldStringW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockShared]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelIo]
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x28], r14
lea rax, [0x1800fa228]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [0x1800fa250]
call qword [sym.imp.KERNEL32.dll_GetDurationFormatEx]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlUnwind]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteProfileSectionW]
call qword [sym.imp.KERNEL32.dll_GetMaximumProcessorGroupCount]
xor r8d, r8d
lea rdx, [0x1800fa280]
lea rcx, [0x1800fa2b8]
call qword [sym.imp.KERNEL32.dll_CopyFile2]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumSystemFirmwareTables]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetAppContainerNamedObjectPath]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalSize]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrencyFormatW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlUnwind]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemFileCacheSize]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumSystemGeoID]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OfferVirtualMemory]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ApplicationRecoveryInProgress]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPreferredUILanguages]
jmp 0x18000a07a
cmp edx, edi
jne 0x18000a07a
cmp dword [0x1800e1e00], 0xe8461a34
jne 0x180009c83
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessPriorityBoost]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsBadWritePtr]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetApplicationRestartSettings]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
lea r9, [0x1800fa2f0]
xor r8d, r8d
xor edx, edx
lea rcx, [0x1800fa320]
call qword [sym.imp.KERNEL32.dll_GetTimeFormatEx]
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiberEx]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapSetInformation]
call qword [sym.imp.KERNEL32.dll_CreateThreadpoolCleanupGroup]
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
lea rdx, [0x1800fa358]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadDescription]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Wow64EnableWow64FsRedirection]
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStringTypeExW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DebugActiveProcess]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
lock add dword [r14], edi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateWaitableTimerW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFirmwareType]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProtectedPolicy]
lea rax, [0x1800088b4]
mov ecx, 0x19c
add rax, rcx
mov qword [rbp - 0x39], rax
mov dword [rbp - 0x31], ecx
movaps xmm0, xmmword [rbp - 0x39]
movdqa xmmword [rbp - 0x39], xmm0
lea rcx, [rbp - 0x39]
call fcn.18000e8b0
lea rax, [0x1800055a0]
mov ecx, 0x185
add rax, rcx
mov qword [rbp - 0x39], rax
mov dword [rbp - 0x31], ecx
movaps xmm0, xmmword [rbp - 0x39]
movdqa xmmword [rbp - 0x39], xmm0
lea rcx, [rbp - 0x39]
call fcn.18000e8b0
lea rbx, [0x180006a90]
add rbx, 0x14b
xor eax, eax
mov qword [rbp - 0x19], rax
xorps xmm0, xmm0
movdqa xmmword [rbp - 9], xmm0
mov qword [rbp + 7], r14
mov qword [rbp + 0xf], r14
mov qword [rbp + 0x17], r14
lea ecx, [rax + 0x10]
call fcn.1800526d4
mov qword [rax + 8], r14
mov qword [rbp - 9], rax
lea rcx, [rbp - 9]
mov qword [rax], rcx
mov word [rbp + 0x27], r14w
mov qword [rbp + 0x2d], r14
mov qword [rbp + 0x35], r14
xor eax, eax
mov word [rbp + 0x2a], ax
mov byte [rbp + 0x2c], al
mov word [rbp + 0x2d], ax
mov byte [rbp + 0x2f], al
mov word [rbp + 0x30], ax
mov byte [rbp + 0x32], al
mov word [rbp + 0x33], ax
mov byte [rbp + 0x35], al
mov word [rbp + 0x36], ax
mov byte [rbp + 0x38], al
mov word [rbp + 0x39], ax
mov byte [rbp + 0x3b], al
mov dword [rbp + 0x23], r14d
mov dword [rbp - 0xd], r14d
mov r8b, dil
lea rdx, [rbp - 0x3f]
lea rcx, [rbp - 0x19]
call fcn.1800165b4
lea rax, [rbp - 0x19]
mov qword [rbp + 0x7f], rax
lea rdx, [rbp + 0x7f]
call fcn.18002c474
mov byte [rbp + 0x6f], r14b
mov r8b, dil
lea rdx, [rbp + 0x6f]
lea rcx, [rbp - 0x19]
call fcn.180017088
mov byte [rbp + 0x7f], r14b
mov r8b, dil
lea rdx, [rbp + 0x7f]
lea rcx, [rbp - 0x19]
call fcn.1800170f8
mov byte [rbp - 0x49], r14b
mov r8b, dil
lea rdx, [rbp - 0x49]
lea rcx, [rbp - 0x19]
call fcn.180017168
mov byte [rbp - 0x48], r14b
mov r8b, dil
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x19]
call fcn.180017088
mov byte [rbp - 0x47], r14b
mov r8b, dil
lea rdx, [rbp - 0x47]
lea rcx, [rbp - 0x19]
call fcn.1800170f8
mov byte [rbp - 0x46], r14b
mov r8b, dil
lea rdx, [rbp - 0x46]
lea rcx, [rbp - 0x19]
call fcn.180017168
mov byte [rbp - 0x45], r14b
mov r8b, dil
lea rdx, [rbp - 0x45]
lea rcx, [rbp - 0x19]
call fcn.180017088
mov byte [rbp - 0x44], r14b
mov r8b, dil
lea rdx, [rbp - 0x44]
lea rcx, [rbp - 0x19]
call fcn.1800170f8
mov byte [rbp - 0x43], r14b
mov r8b, dil
lea rdx, [rbp - 0x43]
lea rcx, [rbp - 0x19]
call fcn.180017168
mov byte [rbp - 0x42], r14b
mov r8b, dil
lea rdx, [rbp - 0x42]
lea rcx, [rbp - 0x19]
call fcn.180017088
mov byte [rbp - 0x41], r14b
mov r8b, dil
lea rdx, [rbp - 0x41]
lea rcx, [rbp - 0x19]
call fcn.1800170f8
mov byte [rbp - 0x40], r14b
mov r8b, dil
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x19]
call fcn.1800171d8
mov qword [rbp - 0x39], rbx
mov dword [rbp - 0x31], 0x14b
mov eax, dword [rbp - 0x2d]
mov dword [rbp - 0x2d], eax
mov r8b, dil
lea rdx, [rbp - 0x39]
lea rcx, [rbp - 0x19]
call fcn.180017248
mov edi, dword [rbp - 0x15]
lea rcx, [rbp - 9]
call fcn.1800129dc
cmp dword [0x1800e1e00], 0x7b39b230
jne 0x18000a07a
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call qword [sym.imp.KERNEL32.dll_AllocConsole]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WakeConditionVariable]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteFiber]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadpoolStackInformation]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ChangeTimerQueueTimer]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AllocateUserPhysicalPages]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetNextDlgGroupItem]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea r8, [0x1800fa380]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCriticalSectionSpinCount]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetEvent]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetNextDlgTabItem]
xor ecx, ecx
call qword [sym.imp.USER32.dll_CharNextW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProfileIntW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstFileExW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_DestroyMenu]
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ToAscii]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetGUIThreadInfo]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetWindowDC]
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
lea r9, [0x1800fa3a0]
xor r8d, r8d
lea rdx, [0x1800fa3d8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindStringOrdinal]
xor ecx, ecx
call qword [sym.imp.USER32.dll_ArrangeIconicWindows]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_UnionRect]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CopyFileExW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteProfileStringW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_RedrawWindow]
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteFileEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaProcessorNodeEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsValidLocale]
call qword [sym.imp.USER32.dll_CreatePopupMenu]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetClassLongW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_CheckDlgButton]
xor r9d, r9d
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UpdateResourceW]
mov eax, edi
mov rbx, qword [rsp + 0xf0]
add rsp, 0xd0
pop r14
pop rdi
pop rbp
ret