Function at 0x180003ba0
Capabilities:
Check for debugger via api
Clear file content
Create directory
Get disk information
Get file size
Get memory capacity
Identify system language via api
Set current directory
Set uefi variable

Disassembly:
mov dword [rsp + 8], ecx
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x270]
sub rsp, 0x370
xor edi, edi
call fcn.180080c78
mov ebx, eax
mov eax, 0x51eb851f
imul ebx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x64
sub ebx, ecx
inc ebx
mov r8d, dword [0x1801227d0]
cmp r8d, 0x9b698914
jne 0x180003cef
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PowerCreateRequest]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ConvertThreadToFiberEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetComputerNameExW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsValidCodePage]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessIdOfThread]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadpoolTimer]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableExW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessMitigationPolicy]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForDebugEvent]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WakeAllConditionVariable]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
xor edx, edx
mov qword [rsp + 0x20], rdi
mov r9d, dword [rbp + 0x298]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleDisplayMode]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
mov r8d, dword [0x1801227d0]
mov eax, 0x55555556
imul ebx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp ebx, ecx
jne 0x180003dd1
movsxd rcx, dword [rbp + 0x290]
call fcn.18007b14c
mov rbx, rax
cmp dword [0x1801227d0], 0x3a63f7a8
jne 0x1800043ee
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_AdjustWindowRectEx]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_BackupSeek]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_CascadeWindows]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFiberEx]
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea rdx, [0x18013bdc8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x1800043ee
mov eax, ebx
and eax, 0x80000003
jge 0x180003de1
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
jne 0x18000418e
call fcn.180080c78
and eax, 0x80000003
jge 0x180003dfc
dec eax
or eax, 0xfffffffc
inc eax
inc eax
test al, 1
jne 0x1800040d8
mov dword [rbp + 0x298], 0x104
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add rax, 0x19d
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], 0x19d
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea r8, [rbp + 0x60]
lea rdx, [rbp + 0x298]
lea rcx, [rsp + 0x40]
call fcn.180012e00
mov rax, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
add rax, 0x230
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], 0x230
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.180013040
mov ebx, eax
mov dword [rbp + 0x298], edi
mov rcx, qword [sym.imp.KERNEL32.dll_GlobalAlloc]
add rcx, 0x1c9
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x48], 0x1c9
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea r8, [rbp + 0x290]
lea rdx, [rbp + 0x298]
lea rcx, [rsp + 0x40]
call fcn.180013270
mov qword [rbp + 0x2a0], rax
lea rcx, [rsp + 0x70]
call fcn.18000a510
nop
lea rdx, [0x18013bde0]
lea rcx, [rsp + 0x70]
call fcn.1800134b0
mov rcx, rax
lea rdx, [rbp + 0x60]
call fcn.1800134b0
mov rcx, rax
lea rdx, [0x18013bddc]
call fcn.1800134b0
lea rdx, [0x18013be08]
lea rcx, [rsp + 0x70]
call fcn.1800134b0
test bl, 0x10
je 0x180003f28
lea rdx, [0x18013be28]
lea rcx, [rsp + 0x70]
call fcn.1800134b0
test bl, 1
je 0x180003f3e
lea rdx, [0x18013be48]
lea rcx, [rsp + 0x70]
call fcn.1800134b0
test bl, 2
je 0x180003f54
lea rdx, [0x18013be68]
lea rcx, [rsp + 0x70]
call fcn.1800134b0
test bl, 4
je 0x180003f6a
lea rdx, [0x18013be80]
lea rcx, [rsp + 0x70]
call fcn.1800134b0
test bl, 0x20
je 0x180003f80
lea rdx, [0x18013be98]
lea rcx, [rsp + 0x70]
call fcn.1800134b0
bt ebx, 0xb
jae 0x180003f97
lea rdx, [0x18013beb8]
lea rcx, [rsp + 0x70]
call fcn.1800134b0
bt ebx, 0xe
jae 0x180003fae
lea rdx, [0x18013bed8]
lea rcx, [rsp + 0x70]
call fcn.1800134b0
bt ebx, 8
jae 0x180003fc5
lea rdx, [0x18013bef8]
lea rcx, [rsp + 0x70]
call fcn.1800134b0
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x78]
call fcn.18000f050
nop
lea rax, [rsp + 0x50]
cmp qword [rsp + 0x68], 7
cmova rax, qword [rsp + 0x50]
mov qword [rbp + 0x298], rax
mov rax, qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rax, 0x1d7
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], 0x1d7
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rbp + 0x298]
lea rcx, [rsp + 0x40]
call fcn.180013770
nop
lea rcx, [rsp + 0x50]
call fcn.18000cac0
mov rax, qword [sym.imp.KERNEL32.dll_GlobalLock]
add rax, 0x1c6
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], 0x1c6
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rbp + 0x2a0]
lea rcx, [rsp + 0x40]
call fcn.1800139a0
mov rbx, rax
mov rax, qword [rsp + 0x70]
movsxd rcx, dword [rax + 4]
lea rax, [0x18013ac88]
mov qword [rsp + rcx + 0x70], rax
mov rax, qword [rsp + 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x88]
mov dword [rsp + rcx + 0x6c], edx
lea rcx, [rsp + 0x78]
call fcn.18000ac30
mov rax, qword [rsp + 0x70]
movsxd rcx, dword [rax + 4]
lea rax, [0x18013aba8]
mov qword [rsp + rcx + 0x70], rax
mov rax, qword [rsp + 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rsp + rcx + 0x6c], edx
lea rax, [0x18013b8c8]
mov qword [rbp - 8], rax
lea rcx, [rbp - 8]
call fcn.180079d1c
nop
jmp 0x1800043ee
movsxd rdx, dword [rbp + 0x290]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rbp + 0x298], rax
cmp dword [0x1801227d0], 0x9685dde2
jne 0x180004153
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForThreadpoolWorkCallbacks]
call qword [sym.imp.USER32.dll_CloseClipboard]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetUserObjectSecurity]
call qword [sym.imp.USER32.dll_CloseClipboard]
xor ecx, ecx
call qword [sym.imp.USER32.dll_DdeGetLastError]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetClassLongW]
call qword [sym.imp.USER32.dll_GetInputState]
mov rax, qword [sym.imp.KERNEL32.dll_LocalLock]
add rax, 0x13c
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], 0x13c
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rbp + 0x298]
lea rcx, [rsp + 0x40]
call fcn.1800139a0
jmp 0x1800043eb
test bl, 1
jne 0x180004258
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
add rax, 0x17b
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], 0x17b
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.180013bd0
cmp dword [0x1801227d0], 0x56828029
jne 0x18000423e
call qword [sym.imp.KERNEL32.dll_GetThreadErrorMode]
call qword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
call qword [sym.imp.KERNEL32.dll_GetErrorMode]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SubmitThreadpoolWork]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDateFormatW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [0x18013bf18]
call qword [sym.imp.KERNEL32.dll_FindFirstStreamTransactedW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemRegistryQuota]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeLibraryAndExitThread]
movsxd r8, dword [rbp + 0x290]
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
jmp 0x1800043eb
cmp r8d, 0x704335de
jne 0x180004380
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteProfileSectionW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessShutdownParameters]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapeParameters]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessAffinityMask]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CheckTokenCapability]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetEvent]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProtectedPolicy]
lea rcx, [0x18013bf40]
call qword [sym.imp.KERNEL32.dll_AddDllDirectory]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
lea rax, [0x18013bf68]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [0x18013bf88]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNLSString]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateWaitableTimerExW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SleepConditionVariableCS]
xor ecx, ecx
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_QueryIdleProcessorCycleTimeEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
mov dword [rbp + 0x298], 4
mov dword [rbp + 0x2a0], 0x3000
mov qword [rbp + 0x2a8], rdi
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
add rax, 0x12d
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], 0x12d
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rax, [rbp + 0x298]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x2a0]
lea r8, [rbp + 0x290]
lea rdx, [rbp + 0x2a8]
lea rcx, [rsp + 0x40]
call fcn.180013df0
mov rbx, rax
test rbx, rbx
jne 0x1800044b9
cmp dword [0x1801227d0], 0x68cc1f3b
jne 0x180004480
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CheckTokenMembershipEx]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThreadpoolIo]
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DefineDosDeviceW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadLocale]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DebugBreakProcess]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapeParameters]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UnregisterWaitEx]
lea rax, [fcn.18008bd58]
add rax, 0x29b
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], 0x29b
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rbp + 0x290]
lea rcx, [rsp + 0x40]
call fcn.180012280
mov rbx, rax
mov rax, rbx
add rsp, 0x370
pop rdi
pop rbx
pop rbp
ret