Function at 0x180004e70
Capabilities:
Copy file
Create pipe
Get system firmware table
Get system information on windows
Move file
Read .ini file

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
lea rax, [fcn.1800052b0]
add rax, 0x188
mov qword [rbp - 0x19], rax
mov dword [rbp - 0x11], 0x188
xor eax, eax
mov qword [rbp - 9], rax
xorps xmm0, xmm0
movdqa xmmword [rbp + 7], xmm0
xor ebx, ebx
mov qword [rbp + 0x17], rbx
mov qword [rbp + 0x1f], rbx
mov qword [rbp + 0x27], rbx
mov ecx, 0x10
call fcn.180080288
mov qword [rax + 8], rbx
mov qword [rbp + 7], rax
lea rcx, [rbp + 7]
mov qword [rax], rcx
mov word [rbp + 0x37], bx
mov qword [rbp + 0x3d], rbx
mov qword [rbp + 0x45], rbx
xor eax, eax
mov word [rbp + 0x3a], ax
mov byte [rbp + 0x3c], al
mov word [rbp + 0x3d], ax
mov byte [rbp + 0x3f], al
mov word [rbp + 0x40], ax
mov byte [rbp + 0x42], al
mov word [rbp + 0x43], ax
mov byte [rbp + 0x45], al
mov word [rbp + 0x46], ax
mov byte [rbp + 0x48], al
mov word [rbp + 0x49], ax
mov byte [rbp + 0x4b], al
mov dword [rbp + 3], ebx
mov dword [rbp + 0x33], ebx
movaps xmm0, xmmword [rbp - 0x19]
movdqa xmmword [rbp - 0x19], xmm0
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 9]
call fcn.180014b90
nop
lea rcx, [rbp + 7]
call fcn.180016bd0
mov rcx, qword [rbp + 7]
mov qword [rbp + 7], rbx
mov edx, 0x10
call fcn.18008019c
mov rax, qword [0x18010e3f8]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0xc50]
mov dword [rax + 4], 0x34889fc4
cmp dword [0x18010e3e4], 0x2166683c
jne 0x180005098
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemPowerStatus]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_RectInRegion]
lock dec dword [rbx]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexExW]
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetNumaAvailableMemoryNodeEx]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov dword [rsp + 0x20], ebx
lea r9, [0x1801269c0]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsNLSDefinedString]
xor ecx, ecx
call qword [sym.imp.GDI32.dll_UpdateColors]
mov dword [rsp + 0x48], ebx
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_PlgBlt]
call qword [sym.imp.KERNEL32.dll_DebugBreak]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RemoveVectoredContinueHandler]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_DPtoLP]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RemoveVectoredContinueHandler]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_TransmitCommChar]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_GetDIBColorTable]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsW]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CopyFileTransactedW]
mov rax, qword [0x18010e400]
mov rcx, qword [rax + 0x18]
mov edx, dword [rcx + 0x2a28]
add edx, 0x467c1816
mov rax, qword [0x18010e3f8]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0xc50]
mov dword [rax], edx
cmp dword [0x18010e3e4], 0x524e7a31
jne 0x180005248
mov dword [rsp + 0x20], ebx
xor r9d, r9d
lea r8, [0x1801269f8]
xor edx, edx
lea rcx, [0x180126a28]
call qword [sym.imp.KERNEL32.dll_CompareStringOrdinal]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockFileEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleProcessList]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
lea r9, [0x180126a58]
xor r8d, r8d
lea rdx, [0x180126a88]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumCalendarInfoExEx]
xor ecx, ecx
call qword [sym.imp.GDI32.dll_DeleteObject]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateWaitableTimerExW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RegisterApplicationRecoveryCallback]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForThreadpoolWorkCallbacks]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PowerCreateRequest]
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CheckNameLegalDOS8Dot3W]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFileCompletionNotificationModes]
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
xor ecx, ecx
call qword [sym.imp.GDI32.dll_PathToRegion]
xor r8d, r8d
lea rdx, [0x180126ac0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsValidNLSVersion]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetDynamicTimeZoneInformation]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaHighestNodeNumber]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_PlayEnhMetaFile]
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AddSecureMemoryCacheCallback]
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadIOPendingFlag]
mov rax, qword [0x18010e3f8]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0xc50]
mov rax, qword [0x18010e400]
mov rcx, qword [rax + 0x18]
mov eax, dword [rcx + 0x2a28]
add dword [rdx + 4], eax
mov rax, qword [0x18010e3f0]
mov r8, qword [rax + 0x18]
mov rax, qword [0x18010e3f8]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0xc50]
mov eax, dword [r8 + 0x3770]
mov dword [rdx + 8], eax
mov rbx, qword [rsp + 0xd8]
add rsp, 0xc0
pop rbp
ret