Function at 0x1800062e0
Capabilities:
Get common file path
Get disk information
Identify system language via api
Log keystrokes via polling
Set uefi variable
Terminate process

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x60
xor ecx, ecx
call fcn.18008b920
mov ecx, eax
call fcn.180088428
call fcn.1800883fc
and eax, 0x80000003
jge 0x180006315
dec eax
or eax, 0xfffffffc
inc eax
xor edi, edi
mov ebx, edi
test eax, eax
jne 0x180006410
cmp dword [0x18010c3d4], 0x347b39fa
jne 0x1800063ff
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetMessageW]
call qword [sym.imp.USER32.dll_GetOpenClipboardWindow]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RemoveDllDirectory]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetWindowPlacement]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnumDisplaySettingsExW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_StartThreadpoolIo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetSystemPowerState]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyNameTextW]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
lea r8, [0x180124f60]
xor ecx, ecx
lea rdx, [0x180124fa0]
call qword [sym.imp.KERNEL32.dll_NotifyUILanguageChange]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSysColorBrush]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MulDiv]
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
call qword [sym.imp.USER32.dll_GetDialogBaseUnits]
xor r9d, r9d
mov dword [rsp + 0x20], edi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetMouseMovePointsEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadBitmapW]
mov rdx, qword [rbp + 0x28]
call fcn.1800022f0
add rsp, 0x60
pop rdi
pop rbx
pop rbp
ret
cmp eax, 1
jne 0x180006553
mov eax, 0xffffef93
nop
inc eax
test al, 1
jne 0x180006420
add eax, 0x11215
mov ecx, 0x7c3
lea edx, [rax + 0x16817]
sub eax, edx
lea r8d, [rax - 0x2035]
nop
inc ecx
test cl, 1
jne 0x180006440
lea r9d, [rcx + 0x4988]
sub ecx, r8d
add eax, ecx
test al, 1
je 0x18000645d
inc eax
test al, 1
jne 0x180006457
lea r8d, [r9 + rdx]
mov r10d, 0xe2b
lea ecx, [rax - 0x215f]
mov r9d, 0xffffd772
sub r9d, r8d
test al, 1
cmove ecx, eax
sub r10d, r9d
lea r11d, [r9 + 0x4c5]
add r10d, r8d
sub r9d, 0x76b
add r11d, ecx
sub r10d, r9d
mov eax, 0x55555556
add r10d, 0xffffe94f
mov r8d, r10d
sub r8d, r9d
sub r9d, r10d
add r9d, r11d
add r9d, r8d
imul r9d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r9d, ecx
je 0x1800064ce
test r9d, r9d
jle 0x1800064ce
sub r9d, 0xc47
cmp r11d, 0xfffd4925
jne 0x180006547
cmp r9d, r11d
jne 0x180006547
cmp r10d, 0x88125
jne 0x180006547
cmp r8d, 0xb6c2a
jne 0x180006547
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea r9, [rbp + 0x30]
add rax, 0x13a
mov dword [rbp - 0x18], 0x13a
mov qword [rbp - 0x20], rax
lea r8, [rbp + 0x28]
movaps xmm0, xmmword [rbp - 0x20]
lea rax, [rbp + 0x20]
lea rdx, [rbp + 0x38]
movdqa xmmword [rbp - 0x10], xmm0
lea rcx, [rbp - 0x10]
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x20], 4
mov dword [rbp + 0x30], 0x3000
mov qword [rbp + 0x38], rdi
call fcn.180010690
add rsp, 0x60
pop rdi
pop rbx
pop rbp
ret
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x1800066c4
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea rcx, [rbp - 0x10]
add rax, 0x252
mov dword [rbp - 0x18], 0x252
mov qword [rbp - 0x20], rax
movaps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rbp - 0x10], xmm0
call fcn.1800108f0
cmp dword [0x18010c3d4], 0x48be1ff
mov qword [rbp + 0x30], rax
jne 0x18000667f
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CheckTokenMembershipEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadErrorMode]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseThreadpoolWait]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryThreadCycleTime]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
call qword [sym.imp.KERNEL32.dll_AllocConsole]
xor r9d, r9d
lea rcx, [0x180124fe0]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_FindFirstFileNameW]
lea rdx, [0x180125020]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadDescription]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeClientComputerNameW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindClose]
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryW]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
lea rcx, [0x180125050]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_FindFirstStreamTransactedW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
call qword [sym.imp.KERNEL32.dll_GetSystemDEPPolicy]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelIo]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlCaptureStackBackTrace]
mov rax, qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea r9, [rbp + 0x28]
add rax, 0x209
mov dword [rbp - 0x18], 0x209
mov qword [rbp - 0x20], rax
lea r8, [rbp + 0x20]
movaps xmm0, xmmword [rbp - 0x20]
lea rdx, [rbp + 0x30]
lea rcx, [rbp - 0x10]
movdqa xmmword [rbp - 0x10], xmm0
mov dword [rbp + 0x20], 8
call fcn.180010b20
add rsp, 0x60
pop rdi
pop rbx
pop rbp
ret
cmp eax, 3
jne 0x1800068d0
mov rax, qword [sym.imp.KERNEL32.dll_LocalAlloc]
lea r8, [rbp + 0x28]
add rax, 0x199
mov dword [rbp - 0x18], 0x199
mov qword [rbp - 0x20], rax
lea rdx, [rbp + 0x20]
movaps xmm0, xmmword [rbp - 0x20]
lea rcx, [rbp - 0x10]
movdqa xmmword [rbp - 0x10], xmm0
mov dword [rbp + 0x20], edi
call fcn.18000dbb0
mov qword [rbp - 0x28], rax
lea r9, [rbp + 0x30]
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea r8, [rbp + 0x38]
add rax, 0x25e
mov dword [rbp - 8], 0x25e
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x30]
movaps xmm0, xmmword [rbp - 0x10]
lea rax, [rbp + 0x20]
lea rcx, [rbp - 0x10]
movdqa xmmword [rbp - 0x10], xmm0
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x20], 4
mov dword [rbp + 0x30], 0x3000
mov dword [rbp + 0x38], 0x400
mov qword [rbp - 0x30], rdi
call fcn.180010d70
mov qword [rbp - 0x20], rax
lea rdx, [rbp - 0x28]
mov rax, qword [sym.imp.KERNEL32.dll_LocalLock]
lea rcx, [rbp - 0x10]
mov dword [rbp - 8], 0x250
add rax, 0x250
mov qword [rbp - 0x10], rax
movaps xmm0, xmmword [rbp - 0x10]
movdqa xmmword [rbp - 0x10], xmm0
call fcn.18000ddf0
cmp dword [0x18010c3d4], 0xa72aa5ab
mov rbx, rax
jne 0x180006890
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleSelectionInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReclaimVirtualMemory]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessAffinityUpdateMode]
xor ecx, ecx
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GlobalGetAtomNameW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetVolumeMountPointW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TzSpecificLocalTimeToSystemTimeEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDllDirectoryW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForThreadpoolWaitCallbacks]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
xor edx, edx
lea rcx, [0x180125078]
call qword [sym.imp.KERNEL32.dll_LocaleNameToLCID]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockShared]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InterlockedPushListSListEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadId]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LCIDToLocaleName]
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFree]
lea r9, [rbp + 0x20]
mov dword [rbp - 8], 0x15a
lea r8, [rbp + 0x30]
add rax, 0x15a
mov dword [rbp + 0x20], 0x8000
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x20]
movaps xmm0, xmmword [rbp - 0x10]
lea rcx, [rbp - 0x10]
movdqa xmmword [rbp - 0x10], xmm0
mov dword [rbp + 0x30], edi
call fcn.180010fd0
mov rax, rbx
add rsp, 0x60
pop rdi
pop rbx
pop rbp
ret