Function at 0x1800151b0
Capabilities:
Get common file path
Get uefi variable

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
push r14
lea rbp, [rsp - 0x1458]
mov eax, 0x1558
call fcn.180110950
sub rsp, rax
mov rax, qword [0x180185680]
xor rax, rsp
mov qword [rbp + 0x1440], rax
mov r14, qword [rdx + 0x10]
xor edi, edi
mov qword [rsp + 0x15a0], r12
mov esi, edi
mov qword [rsp + 0x38], r14
mov rbx, rdx
mov r13d, ecx
mov dword [rsp + 0x30], 0x10
mov qword [rsp + 0x1550], r15
nop word [rax + rax]
mov r9d, 1
lea rax, [rbp + 0x830]
mov r8, r14
mov qword [rsp + 0x20], rax
mov edx, r13d
lea ecx, [r9 + 2]
call fcn.180016860
test eax, eax
jne 0x180015256
mov r9d, 1
lea rax, [rbp + 0x830]
mov r8, r14
mov qword [rsp + 0x20], rax
mov edx, r13d
lea ecx, [r9 + 2]
call sym.SafeBase64.dll_KrnlRWDisk
inc esi
test eax, eax
jne 0x180015292
cmp esi, 2
jb 0x180015210
xor eax, eax
mov r15, qword [rsp + 0x1550]
mov r12, qword [rsp + 0x15a0]
mov rcx, qword [rbp + 0x1440]
xor rcx, rsp
call fcn.18010faf0
add rsp, 0x1558
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov eax, 0xaa55
cmp word [rbp + 0xa2e], ax
jne 0x180015261
movzx ecx, byte [rbx + 0x63]
lea r15, str.FAT16
lea r11, [0x1801552ec]
lea rsi, [0x1801552f4]
lea r10, [0x180155304]
lea r9, [0x18015530c]
sub ecx, 5
je 0x1800153fa
sub ecx, 1
je 0x18001543e
sub ecx, 1
je 0x1800154bd
cmp ecx, 1
je 0x1800154fe
mov rax, r9
mov edx, edi
lea rax, [rax + 1]
inc edx
cmp byte [rax], dil
jne 0x1800152f0
mov r8d, edi
test edx, edx
je 0x18001532d
mov rcx, rdi
nop word [rax + rax]
movzx eax, byte [rcx + r9]
cmp byte [rbp + rcx + 0x833], al
jne 0x180015542
inc r8d
inc rcx
cmp r8d, edx
jb 0x180015310
mov word [rbx + 0x63], 0x808
mov rdx, qword [rbx + 0x10]
lea r8, [rsp + 0x60]
mov ecx, r13d
call sym.SafeBase64.dll_GetPartDriverInfo
test eax, eax
je 0x180015887
cmp byte [rbx + 0x63], 9
jne 0x180015359
movzx eax, byte [rbp - 0x74]
mov byte [rbx + 0x63], al
movzx eax, byte [rbp - 0x6c]
lea rcx, [rbp + 0xa30]
mov edx, 0x104
mov byte [rbx + 0x65], al
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x180015887
movzx ecx, byte [rbx + 0x65]
movzx eax, byte [rbp + 0xa30]
or cl, 0x20
or al, 0x20
cmp cl, al
jne 0x180015887
mov esi, edi
nop dword [rax]
nop dword [rax + rax]
mov r9d, 1
lea rax, [rbp + 0xc40]
mov r8d, r9d
mov qword [rsp + 0x20], rax
mov edx, r13d
lea ecx, [r9 + 2]
call fcn.180016860
test eax, eax
jne 0x1800153e6
mov r9d, 1
lea rax, [rbp + 0xc40]
mov r8d, r9d
mov qword [rsp + 0x20], rax
mov edx, r13d
lea ecx, [r9 + 2]
call sym.SafeBase64.dll_KrnlRWDisk
inc esi
test eax, eax
jne 0x180015754
cmp esi, 2
jb 0x1800153a0
jmp 0x180015768
mov rax, r15
mov edx, edi
nop
lea rax, [rax + 1]
inc edx
cmp byte [rax], dil
jne 0x180015400
mov r8d, edi
test edx, edx
je 0x180015333
mov rcx, rdi
nop dword [rax]
movzx eax, byte [rcx + r15]
cmp byte [rbp + rcx + 0x866], al
jne 0x18001543e
inc r8d
inc rcx
cmp r8d, edx
jb 0x180015420
jmp 0x180015333
mov rax, r11
mov edx, edi
lea rax, [rax + 1]
inc edx
cmp byte [rax], dil
jne 0x180015443
mov r8d, edi
test edx, edx
je 0x180015333
mov rcx, rdi
nop dword [rax]
movzx eax, byte [rcx + r11]
cmp byte [rbp + rcx + 0x882], al
jne 0x18001547e
inc r8d
inc rcx
cmp r8d, edx
jb 0x180015460
jmp 0x180015333
mov rax, rsi
mov edx, edi
lea rax, [rax + 1]
inc edx
cmp byte [rax], dil
jne 0x180015483
mov r8d, edi
test edx, edx
je 0x180015333
mov rcx, rdi
nop dword [rax]
movzx eax, byte [rcx + rsi]
cmp byte [rbp + rcx + 0x882], al
jne 0x1800154bd
inc r8d
inc rcx
cmp r8d, edx
jb 0x1800154a0
jmp 0x180015333
mov rax, r10
mov edx, edi
lea rax, [rax + 1]
inc edx
cmp byte [rax], dil
jne 0x1800154c2
mov r8d, edi
test edx, edx
je 0x180015333
mov rcx, rdi
nop dword [rax + rax]
movzx eax, byte [rcx + r10]
cmp byte [rbp + rcx + 0x833], al
jne 0x1800154fe
inc r8d
inc rcx
cmp r8d, edx
jb 0x1800154e0
jmp 0x180015333
mov rax, r9
mov edx, edi
lea rax, [rax + 1]
inc edx
cmp byte [rax], dil
jne 0x180015503
mov r8d, edi
test edx, edx
je 0x180015333
mov rcx, rdi
nop dword [rax]
movzx eax, byte [rcx + r9]
cmp byte [rbp + rcx + 0x833], al
jne 0x1800152eb
inc r8d
inc rcx
cmp r8d, edx
jb 0x180015520
jmp 0x180015333
mov rax, r10
mov edx, edi
nop word [rax + rax]
lea rax, [rax + 1]
inc edx
cmp byte [rax], dil
jne 0x180015550
mov r8d, edi
test edx, edx
je 0x180015589
mov rcx, rdi
nop word [rax + rax]
movzx eax, byte [rcx + r10]
cmp byte [rbp + rcx + 0x833], al
jne 0x180015594
inc r8d
inc rcx
cmp r8d, edx
jb 0x180015570
mov word [rbx + 0x63], 0x707
jmp 0x180015333
lea r9, [0x1801552fc]
mov edx, edi
mov rax, r9
lea rax, [rax + 1]
inc edx
cmp byte [rax], dil
jne 0x1800155a0
mov r8d, edi
test edx, edx
je 0x1800155d9
mov rcx, rdi
nop word [rax + rax]
movzx eax, byte [rcx + r9]
cmp byte [rbp + rcx + 0x833], al
jne 0x1800155e4
inc r8d
inc rcx
cmp r8d, edx
jb 0x1800155c0
mov word [rbx + 0x63], 0x1704
jmp 0x180015333
mov rax, r11
mov edx, edi
nop dword [rax]
lea rax, [rax + 1]
inc edx
cmp byte [rax], dil
jne 0x1800155f0
mov r8d, edi
test edx, edx
je 0x180015629
mov rcx, rdi
nop word [rax + rax]
movzx eax, byte [rcx + r11]
cmp byte [rbp + rcx + 0x882], al
jne 0x180015634
inc r8d
inc rcx
cmp r8d, edx
jb 0x180015610
mov word [rbx + 0x63], 0xb06
jmp 0x180015333
mov rax, rsi
mov edx, edi
nop dword [rax]
lea rax, [rax + 1]
inc edx
cmp byte [rax], dil
jne 0x180015640
mov r8d, edi
test edx, edx
je 0x180015678
mov rcx, rdi
nop word [rax + rax]
movzx eax, byte [rcx + rsi]
cmp byte [rbp + rcx + 0x882], al
jne 0x180015683
inc r8d
inc rcx
cmp r8d, edx
jb 0x180015660
mov word [rbx + 0x63], 0x5806
jmp 0x180015333
mov rax, r15
mov edx, edi
nop dword [rax + rax]
lea rax, [rax + 1]
inc edx
cmp byte [rax], dil
jne 0x180015690
mov r8d, edi
test edx, edx
je 0x1800156c9
mov rcx, rdi
nop word [rax + rax]
movzx eax, byte [rcx + r15]
cmp byte [rbp + rcx + 0x866], al
jne 0x1800156d4
inc r8d
inc rcx
cmp r8d, edx
jb 0x1800156b0
mov word [rbx + 0x63], 0xe05
jmp 0x180015333
mov esi, edi
nop word [rax + rax]
mov r9d, 1
lea rax, [rbp + 0x30]
lea r8, [r14 + 1]
mov qword [rsp + 0x20], rax
mov edx, r13d
lea ecx, [r9 + 2]
call fcn.180016860
test eax, eax
jne 0x180015722
mov r9d, 1
lea rax, [rbp + 0x30]
lea r8, [r14 + 1]
mov qword [rsp + 0x20], rax
mov edx, r13d
lea ecx, [r9 + 2]
call sym.SafeBase64.dll_KrnlRWDisk
inc esi
test eax, eax
jne 0x180015732
cmp esi, 2
jb 0x1800156e0
jmp 0x180015261
cmp dword [rbp + 0x30], 0x41615252
jne 0x18001574b
cmp dword [rbp + 0x22c], 0xaa550000
je 0x180015629
mov byte [rbx + 0x63], 9
jmp 0x180015333
mov rax, qword [rbp + 0xc40]
cmp rax, qword [str.EFI_PART]
je 0x180015883
xor edx, edx
lea rcx, [rbp + 0xc40]
mov r8d, 0x800
call fcn.180113150
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.GetFirmwareType
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800157b4
lea rcx, [rsp + 0x48]
call rax
test eax, eax
je 0x1800157b4
cmp dword [rsp + 0x48], 2
je 0x180015883
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x40]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x18001581f
lea r8, [rsp + 0x54]
xor ecx, ecx
lea rdx, str.SeSystemEnvironmentPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rsp + 0x40]
lea r8, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x28], rdi
xor edx, edx
mov dword [rsp + 0x50], 1
mov dword [rsp + 0x5c], 2
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, 0x800
lea r8, [rbp + 0xc40]
lea rdx, str.8BE4DF61_93CA_11D2_AA0D_00E098032B8C
lea rcx, str.BootOrder
call qword [sym.imp.KERNEL32.dll_GetFirmwareEnvironmentVariableW]
test eax, eax
jne 0x180015883
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e6
je 0x180015883
mov r9d, 0x800
lea r8, [rbp + 0xc40]
lea rdx, str.00000000_0000_0000_0000_000000000000
lea rcx, [0x180154cbc]
call qword [sym.imp.KERNEL32.dll_GetFirmwareEnvironmentVariableW]
test eax, eax
jne 0x180015883
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e6
jne 0x180015887
mov byte [rbx + 0x66], 1
movzx ecx, byte [rbx + 0x63]
mov r12, qword [rbp + 0x860]
mov r10, qword [rbp + 0x850]
mov r15, qword [rbp + 0x84c]
mov rsi, qword [rbp + 0x83d]
mov r9, qword [rbp + 0x83b]
mov r11, qword [rbp + 0x840]
mov r14, qword [rbp + 0x83e]
sub ecx, 5
je 0x180015961
sub ecx, 1
je 0x180015928
sub ecx, 1
je 0x1800158fd
cmp ecx, 1
jne 0x180015b37
mov rcx, qword [rbp + 0x854]
mov eax, dword [rbp + 0x868]
mov dword [rbx + 0x54], ecx
mov r8d, ecx
mov dword [rbx + 0x50], r10d
mov dword [rbx + 4], edi
mov byte [rbx + 0x61], 1
mov dword [rbx], eax
jmp 0x1800159aa
movzx eax, r9w
mov dword [rbx + 0x50], eax
movzx eax, sil
mov dword [rbx + 0x54], eax
mov eax, dword [rbp + 0x878]
movzx r8d, sil
mov dword [rbx], eax
mov dword [rbx + 4], r15d
mov byte [rbx + 0x61], 1
imul r8, r12
jmp 0x1800159aa
mov r8, qword [rbp + 0x854]
movzx eax, r14w
movzx edx, r11b
imul edx, r8d
mov dword [rbx + 0x58], r8d
mov byte [rbx + 0x61], 4
add edx, eax
mov eax, dword [rbp + 0x873]
mov dword [rbx], eax
mov eax, dword [rbp + 0x85c]
add eax, 0xfffffffe
mov dword [rbx + 0x5c], edx
imul r8d, eax
mov eax, edx
jmp 0x1800159a7
mov r8, qword [rbp + 0x846]
movzx eax, word [rbp + 0x841]
shr eax, 4
movzx edx, r8w
movzx ecx, r11b
imul ecx, edx
movzx r8d, r8w
mov byte [rbx + 0x61], 2
mov dword [rbx + 0x58], edx
add ecx, eax
movzx eax, r14w
add ecx, eax
mov eax, dword [rbp + 0x857]
mov dword [rbx], eax
movzx eax, r11b
imul r8, rax
movzx eax, r14w
mov dword [rbx + 0x5c], ecx
add r8, rax
mov rdx, qword [rsp + 0x38]
lea rax, [r8 + rdx]
mov qword [rbx + 0x38], rax
movzx ecx, byte [rbx + 0x63]
sub ecx, 7
je 0x180015a2d
cmp ecx, 1
je 0x180015b37
mov eax, dword [rbx + 0x58]
movzx ecx, r14w
add rcx, rdx
mov dword [rbx + 4], r15d
add rax, rcx
mov qword [rbx + 0x28], rcx
mov ecx, dword [rbx + 0x5c]
mov qword [rbx + 0x40], rax
movzx eax, r9w
mov dword [rbx + 0x50], eax
movzx eax, sil
mov dword [rbx + 0x54], eax
lea rax, [rcx + rdx]
mov qword [rbx + 0x30], rax
mov rax, qword [rbp + 0x843]
test ax, ax
jne 0x180015a0c
mov eax, r10d
jmp 0x180015a0f
movzx eax, ax
sub rax, rcx
mov byte [rbx + 0x62], r11b
movzx ecx, sil
xor edx, edx
div rcx
mov qword [rbx + 0x48], rax
mov eax, 1
jmp 0x180015263
movzx ecx, byte [rbp + 0x870]
mov r14, qword [rbp + 0x858]
movzx r8d, r9w
movzx edx, sil
call fcn.180014790
cmp eax, 4
ja 0x180015261
mov r15, qword [rsp + 0x38]
lea eax, [rax + rax*2]
movzx ecx, sil
add eax, eax
imul rcx, r12
movsxd rsi, eax
lea rax, [r15 + rcx]
add rsi, rax
nop dword [rax]
mov r9d, 4
lea rax, [rbp + 0x30]
mov r8, rsi
mov qword [rsp + 0x20], rax
mov edx, r13d
lea ecx, [r9 - 1]
call fcn.180016860
test eax, eax
jne 0x180015ab0
mov r9d, 4
lea rax, [rbp + 0x30]
mov r8, rsi
mov qword [rsp + 0x20], rax
mov edx, r13d
lea ecx, [r9 - 1]
call sym.SafeBase64.dll_KrnlRWDisk
inc edi
test eax, eax
jne 0x180015ac0
cmp edi, 2
jb 0x180015a70
jmp 0x180015261
lea r8, [rsp + 0x30]
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x30]
call fcn.180014850
test eax, eax
je 0x180015261
mov edx, dword [rbx + 0x54]
mov r8d, dword [rsp + 0x30]
mov ecx, edx
imul ecx, dword [rbp - 0x50]
mov eax, edx
imul eax, dword [rbp - 0x4c]
add rcx, r15
mov qword [rbx + 0x28], rcx
mov dword [rbx + 0x58], eax
cmp r8d, 1
jle 0x180015b14
mov ecx, edx
imul ecx, dword [rbp - 0x48]
add rcx, r15
mov qword [rbx + 0x40], rcx
mov ecx, edx
imul ecx, dword [rbp - 0x44]
mov dword [rbx + 0x5c], ecx
mov byte [rbx + 0x62], r8b
mov qword [rbx + 0x30], r15
test edx, edx
je 0x180015261
mov rcx, rdx
mov rax, r14
xor edx, edx
div rcx
sub rax, 2
mov qword [rbx + 0x48], rax
mov eax, 1
jmp 0x180015263