Function at 0x180009980
Capabilities:
Copy file
Enumerate system firmware tables
Get common file path
Get file size
Manipulate console buffer
Move file
Print debug messages
Set environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov dword [rsp + 0x58], 0x15a
lea rax, [0x180003c50]
add rax, 0x15a
mov dword [rsp + 0x70], 0x66f
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x70]
movaps xmm0, xmmword [rsp + 0x50]
lea rcx, [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
call fcn.180016440
xor edi, edi
mov qword [0x18012ef18], rax
cmp dword [0x18012ef10], 0xad94e59d
mov byte [0x18012ef16], 1
jne 0x180009b2b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryInformationJobObject]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DebugBreakProcess]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCriticalSectionSpinCount]
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
call qword [sym.imp.KERNEL32.dll_GetThreadUILanguage]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteFiber]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PowerSetRequest]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumSystemFirmwareTables]
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CopyFileTransactedW]
call qword [sym.imp.KERNEL32.dll_FlushProcessWriteBuffers]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstChangeNotificationW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetComputerNameExW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFirmwareType]
mov dword [rsp + 0x30], edi
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
xor r8d, r8d
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MoveFileTransactedW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalFree]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNLSVersion]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaProximityNode]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHeaps]
mov dword [rsp + 0x58], 0x141
lea rax, [0x180006c70]
add rax, 0x141
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x50], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
call fcn.180015000
mov dword [rsp + 0x58], 0x17a
lea rax, [0x180004dc0]
add rax, 0x17a
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x50], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
call fcn.180016680
cmp dword [0x18012ef10], 0xd1dafe76
movzx ebx, al
jne 0x180009c85
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFileTime]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
lea rcx, [0x180149ca0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_FindFirstFileNameTransactedW]
mov qword [rsp + 0x40], rdi
lea r8, [0x180149cc8]
mov qword [rsp + 0x38], rdi
lea rcx, [0x180149d00]
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_LCMapStringEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
lea r9, [0x180149d40]
mov dword [rsp + 0x20], edi
xor r8d, r8d
lea rdx, [0x180149d78]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VerifyScripts]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AddAtomW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteProfileStringW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeClientSessionId]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDllDirectoryW]
mov edx, dword [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor r9d, r9d
mov dword [rsp + 0x20], edi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
test bl, bl
jne 0x180009c96
lea rcx, [0x180149da0]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret