Function at 0x1000be20
Capabilities:
Connect pipe
Get disk information
Get disk size
Get geographical location
Get memory capacity
Get system firmware table
Get system information on windows
Identify system language via api
Manipulate console buffer
Move file
Print debug messages
Read .ini file
Read file on windows
Set console window title
Set uefi variable
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x10], 1
mov dword [ebp - 4], 1
cmp dword [ebp + 0xc], 1
jne 0x1000c0d7
movzx eax, byte [0x10040b00]
test eax, eax
je 0x1000c0d7
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 3
jne 0x1000c0d7
call dword [sym.imp.GDI32.dll_GdiGetBatchLimit]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_StretchDIBits]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapSize]
push 0
call dword [sym.imp.GDI32.dll_DeleteDC]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileTransactedW]
push 0
call dword [sym.imp.KERNEL32.dll_FlushConsoleInputBuffer]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessIdOfThread]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_Chord]
push 0
call dword [sym.imp.KERNEL32.dll_FindAtomW]
push 0
call dword [sym.imp.KERNEL32.dll_DeleteVolumeMountPointW]
push 0
push 0x100697cc
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_Escape]
call dword [sym.imp.KERNEL32.dll_CreateTimerQueue]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteProfileStringW]
push 0
call dword [sym.imp.KERNEL32.dll_CallbackMayRunLong]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MulDiv]
push 0
push 0x100697e4
call dword [sym.imp.KERNEL32.dll_LocaleNameToLCID]
push 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenFileById]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeClientProcessId]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessPreferredUILanguages]
push 0
call dword [sym.imp.KERNEL32.dll_GetPhysicallyInstalledSystemMemory]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleCursorInfo]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetSystemFileCacheSize]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CreatePolyPolygonRgn]
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_PlayMetaFileRecord]
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeClientProcessId]
push 0
call dword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualUnlock]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EscapeCommFunction]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_ScaleWindowExtEx]
push 0
call dword [sym.imp.GDI32.dll_SaveDC]
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_PlayEnhMetaFileRecord]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 8], ecx
push 0
mov edx, dword [ebp - 8]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetOverlappedResultEx]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_InitializeProcThreadAttributeList]
call dword [sym.imp.KERNEL32.dll_FlushProcessWriteBuffers]
push 0
call dword [sym.imp.GDI32.dll_GetBkMode]
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableExW]
push 0
push 0
call dword [sym.imp.GDI32.dll_ResizePalette]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
push 0
call dword [sym.imp.KERNEL32.dll_WakeConditionVariable]
push 0
push 0
push 0x10069804
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsEx]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableW]
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectExW]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
push 0
mov ecx, dword [ebp - 0xc]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputAttribute]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddVectoredExceptionHandler]
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemPowerStatus]
movzx edx, byte [0x10040b00]
test edx, edx
je 0x1000c0e7
call fcn.1000a430
cmp dword [0x10040b04], 0x7a9d792
jne 0x1000c2bd
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
push 0
push 0
push 0x1006982c
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_ExtEscape]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleOriginalTitleW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_EnumObjects]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTapePosition]
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveSecureMemoryCacheCallback]
push 0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsExW]
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetCharWidth32W]
push 0
call dword [sym.imp.KERNEL32.dll_FlsAlloc]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeClientSessionId]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
call dword [sym.imp.KERNEL32.dll_GetSystemDEPPolicy]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadpoolWaitEx]
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GdiComment]
push 0x10069844
push 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreExW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_Wow64GetThreadContext]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadpoolStackInformation]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 0
call dword [sym.imp.KERNEL32.dll_SubmitThreadpoolWork]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TrySubmitThreadpoolCallback]
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetEnhMetaFilePaletteEntries]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GenerateConsoleCtrlEvent]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReleaseMutexWhenCallbackReturns]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumberOfConsoleInputEvents]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetWaitableTimer]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleMode]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 4], 0
jne 0x1000c2cd
push 0
call fcn.100069f0
add esp, 4
cmp dword [0x10040b04], 0xc01075
jne 0x1000c558
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EndUpdateResourceW]
push 0
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_SetBitmapDimensionEx]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumUILanguagesW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetComputerNameExW]
push 0
call dword [sym.imp.KERNEL32.dll_Wow64EnableWow64FsRedirection]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleOriginalTitleW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadpoolThreadMinimum]
push 0
push 0
call dword [sym.imp.GDI32.dll_SetWorldTransform]
push 0
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemCodePagesW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeClientSessionId]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push 0
call dword [sym.imp.GDI32.dll_StrokeAndFillPath]
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetCharABCWidthsFloatW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetWinMetaFileBits]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
push 0
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push 0x10069860
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingFromApp]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ClearCommError]
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CreateRectRgn]
push 0
push 0
push 0x10069888
push 0
call dword [sym.imp.KERNEL32.dll_GetFileMUIInfo]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessPreferredUILanguages]
push 0
call dword [sym.imp.KERNEL32.dll_LocalHandle]
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_SelectPalette]
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetAtomNameW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReclaimVirtualMemory]
push 0
push 0x100698c4
push 0
call dword [sym.imp.KERNEL32.dll_GetNLSVersionEx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFiberEx]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CancelIoEx]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCurrentConsoleFontEx]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBW]
push 0
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
xor eax, eax
xor ecx, ecx
xchg dword [ecx], eax
push 0
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_SetWindowExtEx]
push 0
call dword [sym.imp.GDI32.dll_UpdateColors]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameTransactedW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadIdealProcessor]
call dword [sym.imp.KERNEL32.dll_IsThreadAFiber]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetTapePosition]
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 0xc