Function at 0x180006820
Capabilities:
Accept command line arguments
Copy file
Enumerate gui resources
Enumerate system firmware tables
Get hostname
Get keyboard layout
Query environment variable
Set uefi variable
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rdi, rcx
xor ecx, ecx
call fcn.18007f98c
mov ecx, eax
call fcn.18007c584
call fcn.18007c558
and eax, 0x80000003
jge 0x18000685d
dec eax
or eax, 0xfffffffc
inc eax
xor esi, esi
mov ebx, esi
test eax, eax
jne 0x1800069d4
cmp dword [0x180100cd8], 0xf77a7fd1
jne 0x1800069c0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DrawEdge]
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapViewOfFileExNuma]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapUnlock]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CopyFileTransactedW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_FlashWindow]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteTapemark]
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ChangeDisplaySettingsExW]
call qword [sym.imp.USER32.dll_SetProcessDPIAware]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnumWindowStationsW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FatalExit]
mov rdx, qword [rbp + 0x58]
mov rcx, rdi
call fcn.180001fb0
mov rbx, rax
jmp 0x180007030
cmp eax, 1
jne 0x180006bc6
mov r8d, 0xffffbafc
nop dword [rax]
nop word [rax + rax]
inc r8d
mov eax, 0x55555556
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r8d, ecx
jne 0x1800069f0
lea eax, [r8 + r8]
cmp r8d, 0xffffbafd
jne 0x180006bba
cmp eax, 0xffff75fa
jne 0x180006bba
mov dword [rbp + 0x68], 4
mov dword [rsp + 0x50], 0x3000
mov qword [rbp - 0x30], rsi
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
add rax, 0x213
mov qword [rbp - 0x28], rax
mov dword [rbp - 0x20], 0x213
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x68], rsi
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x58], rsi
mov ecx, 0x10
call fcn.180076768
mov qword [rax + 8], rsi
mov qword [rbp - 0x78], rax
lea rcx, [rbp - 0x78]
mov qword [rax], rcx
mov word [rbp - 0x48], bx
mov qword [rbp - 0x42], rsi
mov qword [rbp - 0x3a], rsi
xor eax, eax
mov word [rbp - 0x45], ax
mov byte [rbp - 0x43], al
mov word [rbp - 0x42], ax
mov byte [rbp - 0x40], al
mov word [rbp - 0x3f], ax
mov byte [rbp - 0x3d], al
mov word [rbp - 0x3c], ax
mov byte [rbp - 0x3a], al
mov word [rbp - 0x39], ax
mov byte [rbp - 0x37], al
mov word [rbp - 0x36], ax
mov byte [rbp - 0x34], al
mov dword [rbp - 0x4c], esi
mov dword [rbp - 0x7c], esi
lea rcx, [rsp + 0x70]
call fcn.180026ef0
test al, al
je 0x180006b0a
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x70]
call fcn.180027080
mov byte [rbp - 0x48], 0
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x60], rcx
and al, 1
mov byte [rsp + 0x68], al
mov dl, 1
lea rcx, [rsp + 0x60]
call fcn.180014b90
lea rcx, [rsp + 0x70]
call fcn.180029a70
lea rax, [rsp + 0x70]
mov qword [rbp + 0x60], rax
lea rdx, [rbp + 0x60]
call fcn.180017720
mov byte [rbp + 0x60], 0
mov r8b, 1
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x70]
call fcn.18001ed00
mov byte [rbp + 0x60], 0
mov r8b, 1
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x70]
call fcn.18001edd0
mov byte [rbp + 0x60], 0
mov r8b, 1
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x70]
call fcn.18001ef70
movups xmm0, xmmword [rbp - 0x28]
movups xmmword [rbp - 0x10], xmm0
lea rax, [rbp + 0x68]
mov qword [rbp], rax
lea rax, [rsp + 0x50]
mov qword [rbp + 8], rax
lea rax, [rbp + 0x58]
mov qword [rbp + 0x10], rax
lea rax, [rbp - 0x30]
mov qword [rbp + 0x18], rax
mov r8b, 1
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x70]
call fcn.18001f040
mov rbx, qword [rsp + 0x78]
lea rcx, [rbp - 0x78]
call fcn.180013f70
mov rcx, qword [rbp - 0x78]
mov qword [rbp - 0x78], rsi
mov edx, 0x10
call fcn.18007667c
jmp 0x180007030
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
cmp eax, 2
jne 0x180006cf6
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
add rax, 0x215
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x215
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.1800114c0
mov qword [rbp + 0x68], rax
cmp dword [0x180100cd8], 0xd07c2973
jne 0x180006cac
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapDestroy]
xor r8d, r8d
xor edx, edx
lea rcx, [0x180118958]
call qword [sym.imp.KERNEL32.dll_ResolveLocaleName]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryThreadCycleTime]
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EscapeCommFunction]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferInfoEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommProperties]
lock inc dword [rsi]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumSystemFirmwareTables]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
xor edx, edx
xor ecx, ecx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalFlags]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemTimes]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlCaptureStackBackTrace]
mov dword [rbp + 0x60], 8
mov rax, qword [sym.imp.KERNEL32.dll_HeapAlloc]
add rax, 0x1e5
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x1e5
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x40], xmm0
lea r9, [rbp + 0x58]
lea r8, [rbp + 0x60]
lea rdx, [rbp + 0x68]
lea rcx, [rsp + 0x40]
call fcn.180011630
mov rbx, rax
jmp 0x180007030
cmp eax, 3
jne 0x180007030
mov dword [rbp + 0x60], esi
mov rax, qword [sym.imp.KERNEL32.dll_LocalAlloc]
add rax, 0x146
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x146
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x40], xmm0
lea r8, [rbp + 0x58]
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.18000f260
mov qword [rbp - 0x28], rax
mov dword [rbp + 0x68], 4
mov dword [rsp + 0x50], 0x3000
mov dword [rbp - 0x30], 0x400
mov qword [rbp - 0x18], rsi
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
add rax, 0x138
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], 0x138
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x68], rsi
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x58], rsi
mov ecx, 0x10
call fcn.180076768
mov qword [rax + 8], rsi
mov qword [rbp - 0x78], rax
lea rcx, [rbp - 0x78]
mov qword [rax], rcx
mov word [rbp - 0x48], bx
mov qword [rbp - 0x42], rsi
mov qword [rbp - 0x3a], rsi
xor eax, eax
mov word [rbp - 0x45], ax
mov byte [rbp - 0x43], al
mov word [rbp - 0x42], ax
mov byte [rbp - 0x40], al
mov word [rbp - 0x3f], ax
mov byte [rbp - 0x3d], al
mov word [rbp - 0x3c], ax
mov byte [rbp - 0x3a], al
mov word [rbp - 0x39], ax
mov byte [rbp - 0x37], al
mov word [rbp - 0x36], ax
mov byte [rbp - 0x34], al
mov dword [rbp - 0x4c], esi
mov dword [rbp - 0x7c], esi
lea rcx, [rsp + 0x70]
call fcn.1800276a0
test al, al
je 0x180006e27
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x70]
call fcn.180027830
mov byte [rbp - 0x48], 0
lea rcx, [rsp + 0x70]
mov qword [rbp + 0x20], rcx
and al, 1
mov byte [rbp + 0x28], al
mov dl, 1
lea rcx, [rbp + 0x20]
call fcn.180014ce0
lea rcx, [rsp + 0x70]
call fcn.180029a70
lea rax, [rsp + 0x70]
mov qword [rbp + 0x60], rax
lea rdx, [rbp + 0x60]
call fcn.1800171e0
mov byte [rbp + 0x60], 0
mov r8b, 1
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x70]
call fcn.18001e0d0
mov byte [rbp + 0x60], 0
mov r8b, 1
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x70]
call fcn.18001e1a0
mov byte [rbp + 0x60], 0
mov r8b, 1
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x70]
call fcn.18001e340
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rbp - 0x10], xmm0
lea rax, [rbp + 0x68]
mov qword [rbp], rax
lea rax, [rsp + 0x50]
mov qword [rbp + 8], rax
lea rax, [rbp - 0x30]
mov qword [rbp + 0x10], rax
lea rax, [rbp - 0x18]
mov qword [rbp + 0x18], rax
mov r8b, 1
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x70]
call fcn.18001e410
mov rbx, qword [rsp + 0x78]
lea rcx, [rbp - 0x78]
call fcn.180013f70
mov rcx, qword [rbp - 0x78]
mov qword [rbp - 0x78], rsi
mov edx, 0x10
call fcn.18007667c
mov qword [rsp + 0x60], rbx
mov rax, qword [sym.imp.KERNEL32.dll_LocalLock]
add rax, 0x118
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], 0x118
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rbp - 0x28]
lea rcx, [rsp + 0x40]
call fcn.18000f3f0
mov rbx, rax
cmp dword [0x180100cd8], 0x71e7d644
jne 0x180006fea
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AllocateUserPhysicalPagesNuma]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GenerateConsoleCtrlEvent]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitOnceComplete]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitOnceComplete]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateWaitableTimerExW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlsSetValue]
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableExW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessId]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryProtectedPolicy]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetProtectedPolicy]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessMitigationPolicy]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteTapemark]
mov dword [rbp + 0x60], 0x8000
mov dword [rbp + 0x68], esi
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFree]
add rax, 0x1d0
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x48], 0x1d0
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea r9, [rbp + 0x60]
lea r8, [rbp + 0x68]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.1800117d0
mov rax, rbx
mov rbx, qword [rsp + 0x150]
add rsp, 0x130
pop rdi
pop rsi
pop rbp
ret