Function at 0x180004680
Capabilities:
Connect pipe
Enumerate files on windows
Get common file path
Get disk size
Manipulate console buffer
Print debug messages
Read .ini file
Set uefi variable
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x88
mov ecx, 0x18
call fcn.180023654
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1800046b2
mov rcx, qword [rsp + 0x50]
call fcn.1800096d0
mov qword [rsp + 0x58], rax
jmp 0x1800046bb
mov qword [rsp + 0x58], 0
mov rax, qword [rsp + 0x58]
mov qword [0x18007adb0], rax
mov eax, dword [0x18007ada4]
mov ecx, 0xaea037b4
cmp rax, rcx
jne 0x1800048ec
call qword [sym.imp.KERNEL32.dll_UnregisterApplicationRecoveryCallback]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteFiber]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ApplicationRecoveryFinished]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolCleanupGroup]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Wow64SetThreadContext]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableExW]
call qword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolWait]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalGetAtomNameW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EraseTape]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationByHandleW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, 7
mov edx, 0x80000000
lea rcx, str.stylers.model.xml
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x70], rax
cmp qword [rsp + 0x70], 0xffffffffffffffff
jne 0x180004935
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [rsp + 0x40], 0
jmp 0x180004949
mov eax, dword [rsp + 0x40]
inc eax
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 4
jge 0x180004d31
movsxd rax, dword [rsp + 0x40]
lea rcx, [0x1800757d8]
mov eax, dword [rcx + rax*4]
mov dword [rsp + 0x44], eax
cmp dword [0x18007ada4], 0x313c7171
jne 0x180004b45
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleFontSize]
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LCMapStringW]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.rQEbgBJTmhqJAVPfcEUV
xor edx, edx
lea rcx, str.RwQaQyumzSrdKyTLkDpAdXkEXeWlT
call qword [sym.imp.KERNEL32.dll_GetCalendarInfoEx]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThreadpoolWait]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AttachConsole]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueueUserWorkItem]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThreadpoolWait]
xor edi, edi
xor esi, esi
xor ecx, ecx
rep movsb byte [rdi], byte [rsi]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisconnectNamedPipe]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetComputerNameExW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessPreferredUILanguages]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSectionEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitOnceBeginInitialize]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapeParameters]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryIdleProcessorCycleTime]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.bnbDXJRYwyRDcVYvACPBxOYmpGY
xor edx, edx
lea rcx, str.stBfPQUlMdLbjsI
call qword [sym.imp.KERNEL32.dll_GetNumberFormatEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessDEPPolicy]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteBoundaryDescriptor]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThreadpool]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolTimer]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteTimerQueue]
mov eax, dword [0x18007add0]
mov ecx, dword [rsp + 0x44]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x44], eax
mov eax, dword [0x18007ada4]
mov ecx, 0xca5e7da3
cmp rax, rcx
jne 0x180004d1b
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlsFree]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumCalendarInfoExW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SleepConditionVariableCS]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLocaleName]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeConditionVariable]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThreadpoolWork]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetDefaultDllDirectories]
call qword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CommConfigDialogW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Beep]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsValidCodePage]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Wow64EnableWow64FsRedirection]
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextVolumeW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemTimes]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call qword [sym.imp.KERNEL32.dll_UnregisterApplicationRestart]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDefaultCommConfigW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleOriginalTitleW]
lea rax, str.hJvpzhnNSaAWlbUfHX
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingFromApp]
call qword [sym.imp.KERNEL32.dll_GetConsoleCP]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetApplicationRestartSettings]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
call qword [sym.imp.KERNEL32.dll_FlushProcessWriteBuffers]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessorNumberEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNLSVersion]
lea rdx, [rsp + 0x44]
mov rcx, qword [0x18007adb0]
call fcn.180009770
jmp 0x18000493f
add rsp, 0x88
pop rdi
pop rsi
ret