Function at 0x180009a40
Capabilities:
Create thread
Enumerate gui resources
Enumerate system firmware tables
Get common file path
Manipulate console buffer

Disassembly:
push rbx
sub rsp, 0x1a0
cmp edx, 1
jne 0x180009cd2
mov dword [rsp + 0x48], 0x283
lea rax, [0x180008fe0]
add rax, 0x283
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.18000fab0
mov dword [rsp + 0x48], 0x169
lea rax, [0x180009630]
add rax, 0x169
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.180012cf0
xor ecx, ecx
call fcn.180078b7c
mov ecx, eax
call fcn.180075774
mov dword [rsp + 0x48], 0x21e
lea rbx, [0x1800093a0]
lea rax, [rbx + 0x21e]
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0xc0]
movaps xmm0, xmmword [rsp + 0x40]
lea rcx, [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.180012eb0
mov dword [rsp + 0x48], 0x146
lea rdx, [rsp + 0x50]
add rbx, 0x146
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rbx
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.180012eb0
mov dword [rsp + 0x48], 0x1c7
lea rax, [0x180009490]
add rax, 0x1c7
lea r9, [rsp + 0x130]
mov qword [rsp + 0x40], rax
lea r8, [rsp + 0x50]
movaps xmm0, xmmword [rsp + 0x40]
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.180013070
mov dword [rsp + 0x48], 0x21a
lea rax, [0x180003f90]
add rax, 0x21a
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.18000fab0
cmp dword [0x180115cb8], 0x6f3365a4
jne 0x180009dfa
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitOnceBeginInitialize]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindClose]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EndUpdateResourceW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextFileNameW]
xor ebx, ebx
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetApplicationRecoveryCallback]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommModemStatus]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeSListHead]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDllDirectoryW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiber]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemPreferredUILanguages]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitCommEvent]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeClientSessionId]
mov r9d, dword [rsp + 0x1b8]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumSystemFirmwareTables]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CheckTokenCapability]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
xor r8d, r8d
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushViewOfFile]
mov eax, 1
add rsp, 0x1a0
pop rbx
ret
cmp edx, 3
jne 0x180009dfa
cmp dword [0x180115cb8], 0xcc77e64
jne 0x180009dfa
xor ecx, ecx
call qword [sym.imp.USER32.dll_DdeDisconnect]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DefineDosDeviceW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetClassLongPtrW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetNextDlgTabItem]
xor ebx, ebx
xor r9d, r9d
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov dword [rsp + 0x28], ebx
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], ebx
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ToUnicodeEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_RealGetWindowClassW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleOriginalTitleW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Wow64GetThreadContext]
call qword [sym.imp.KERNEL32.dll_AreFileApisANSI]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateWaitableTimerExW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
xor ecx, ecx
call qword [sym.imp.USER32.dll_DestroyMenu]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolCleanupGroup]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProfileStringW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_RegisterPointerInputTarget]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov eax, 1
add rsp, 0x1a0
pop rbx
ret