Function at 0x180009de0
Capabilities:
Create pipe
Create thread
Get disk size
Get file size
Get session user name
Get uefi variable
Manipulate console buffer
Read .ini file
Read pipe
Set uefi variable
Write pipe

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x110]
sub rsp, 0x210
mov edi, 1
cmp edx, edi
jne 0x18000a01a
mov dword [rsp + 0x68], 0x1ff
lea rax, [0x180003b10]
add rax, 0x1ff
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x60], rax
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
call fcn.18000dae0
cmp dword [0x1800cc038], 0xc9be03ae
jne 0x180009fd4
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r9d, dword [rbp + 0x138]
xor ebx, ebx
xor r8d, r8d
mov qword [rsp + 0x20], rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterA]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFirmwareEnvironmentVariableA]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
xor r8d, r8d
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableExA]
xor edx, edx
lea rcx, str.c6ynrqnk2o7651Klw92I
call qword [sym.imp.KERNEL32.dll_LoadModule]
mov qword [rsp + 0x38], rbx
xor r9d, r9d
mov dword [rsp + 0x30], ebx
xor r8d, r8d
mov dword [rsp + 0x28], ebx
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov r9d, dword [rbp + 0x138]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterA]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], ebx
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteTapemark]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointA]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommError]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalUnlock]
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov qword [rsp + 0x28], rbx
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], ebx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransactNamedPipe]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIdealProcessorEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFileShortNameA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ApplicationRecoveryFinished]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCommMask]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_BindIoCompletionCallback]
mov dword [rsp + 0x68], 0x202
lea rax, [0x180005380]
add rax, 0x202
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x60], rax
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
call fcn.18000dae0
mov edi, eax
mov eax, edi
mov rbx, qword [rsp + 0x230]
add rsp, 0x210
pop rdi
pop rsi
pop rbp
ret
cmp edx, 3
jne 0x18000a005
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edx, 3
mov ecx, 6
mov rsi, rax
call fcn.180002080
test al, al
je 0x18000a005
xor edx, edx
mov ecx, 0xa
call fcn.180002080
test al, al
jne 0x18000a005
xor r9d, r9d
lea rdx, [rbp + 0x148]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x18000a005
mov rax, qword [rbp + 0x148]
movabs rcx, 0x1c0000000
and rax, 0xffffffffc0000000
cmp rax, rcx
jae 0x18000a005
lea rdx, [rbp + 0x138]
mov dword [rbp + 0x138], 0x101
lea rcx, [rbp]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x18000a005
lea rcx, [rbp]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x18000a0b0
cmp rax, 0x19
jne 0x18000a005
movzx eax, byte [0x18006b6e8]
xor ebx, ebx
movups xmm0, xmmword [str.qXbkiFSbYNSJogdB]
mov byte [rsp + 0x70], al
mov edx, 0x7f00
lea rax, [0x180009c20]
mov qword [rbp - 0x80], 0x50
xor ecx, ecx
mov qword [rbp - 0x78], rax
movups xmmword [rsp + 0x60], xmm0
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x68], rsi
call qword [sym.imp.USER32.dll_LoadIconA]
mov edx, 0x7f00
xor ecx, ecx
mov qword [rbp - 0x60], rax
call qword [sym.imp.USER32.dll_LoadCursorA]
movdqa xmm0, xmmword [0x18006b770]
mov edx, 0x7f00
mov qword [rbp - 0x58], rax
xor ecx, ecx
lea rax, [rsp + 0x60]
movdqa xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], rax
call qword [sym.imp.USER32.dll_LoadIconA]
lea rcx, [rbp - 0x80]
mov qword [rbp - 0x38], rax
call qword [sym.imp.USER32.dll_RegisterClassExA]
test ax, ax
je 0x18000a1c4
mov qword [rsp + 0x58], rbx
lea r8, str.Colorful_Squares
mov qword [rsp + 0x50], rsi
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x48], rbx
mov r9d, 0xcf0000
mov qword [rsp + 0x40], rbx
mov ecx, 0x200
mov dword [rsp + 0x38], 0x190
mov dword [rsp + 0x30], 0x190
mov dword [rsp + 0x28], 0x80000000
mov dword [rsp + 0x20], 0x80000000
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rbx, rax
test rax, rax
jne 0x18000a1cb
mov r9d, 0x30
lea r8, str.Error_
lea rdx, str.Window_Creation_Failed_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x18000a007
mov edx, edi
mov rcx, rbx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, rbx
call qword [sym.imp.USER32.dll_UpdateWindow]
xor r9d, r9d
lea rcx, [rbp - 0x30]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jle 0x18000a21f
lea rcx, [rbp - 0x30]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp - 0x30]
call qword [sym.imp.USER32.dll_DispatchMessageA]
xor r9d, r9d
lea rcx, [rbp - 0x30]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jg 0x18000a1f5
mov eax, dword [rbp - 0x20]
jmp 0x18000a007