Function at 0x100036d0
Capabilities:
Copy file
Get uefi variable
Move file
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10c
push ebx
push esi
push edi
mov ebx, ecx
mov dword [esp + 0x10], ecx
call fcn.10002fc0
test al, al
je 0x100036f0
call ebx
mov eax, dword [0x10074f60]
mov eax, dword [eax + 0xac4]
mov dword [esp + 0xc], eax
test ebx, ebx
jne 0x100038a3
push ebx
call dword [sym.imp.KERNEL32.dll_HeapUnlock]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileTransactedW]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EscapeCommFunction]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetThreadPriorityBoost]
push ebx
call dword [sym.imp.KERNEL32.dll_SetConsoleHistoryInfo]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetFirmwareEnvironmentVariableW]
push ebx
push ebx
call dword [sym.imp.GDI32.dll_PlayMetaFile]
push ebx
call dword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.GDI32.dll_GetDIBits]
push ebx
push ebx
call dword [sym.imp.GDI32.dll_SetEnhMetaFileBits]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push ebx
call dword [sym.imp.GDI32.dll_SetMetaRgn]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThreadpoolTimer]
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFileEx]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetCommModemStatus]
push ebx
call dword [sym.imp.KERNEL32.dll_AddAtomW]
push ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetCalendarInfoW]
push ebx
push ebx
call dword [sym.imp.GDI32.dll_GetClipBox]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteProfileSectionW]
push ebx
call dword [sym.imp.GDI32.dll_AbortDoc]
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x1007dea8
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileMUIPath]
push ebx
push ebx
push ebx
call dword [sym.imp.GDI32.dll_SetTextJustification]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
call dword [sym.imp.KERNEL32.dll_IsThreadAFiber]
push ebx
push ebx
call dword [sym.imp.GDI32.dll_SetPolyFillMode]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetCommMask]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateSymbolicLinkTransactedW]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push ebx
push ebx
call dword [sym.imp.GDI32.dll_GetCurrentPositionEx]
mov esi, dword [sym.imp.KERNEL32.dll_CreateConsoleScreenBuffer]
push ebx
push ebx
push ebx
push ebx
push ebx
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_WakeAllConditionVariable]
push ebx
call dword [sym.imp.GDI32.dll_GetStockObject]
push ebx
push ebx
call dword [sym.imp.GDI32.dll_GetRgnBox]
push ebx
push ebx
push ebx
push ebx
push ebx
call esi
call dword [sym.imp.KERNEL32.dll_FlushProcessWriteBuffers]
push ebx
push 0x1007ded0
push 0x1007df00
call dword [sym.imp.KERNEL32.dll_CopyFile2]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesTransactedW]
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveVectoredContinueHandler]
push ebx
push ebx
call dword [sym.imp.GDI32.dll_SetWorldTransform]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReclaimVirtualMemory]
mov ecx, dword [0x10073d50]
jmp 0x100038b3
mov ecx, dword [0x10073d50]
mov ebx, dword [ecx + 0xa40]
mov dword [esp + 0x10], ebx
xor eax, eax
mov byte [esp + eax + 0x18], al
inc eax
cmp eax, 0x100
jl 0x100038b5
mov ebx, dword [ecx + 0x3d8]
xor edi, edi
xor esi, esi
nop dword [eax + eax]
mov dl, byte [esp + esi + 0x18]
mov eax, esi
and eax, 0xf
movzx ecx, dl
movzx eax, byte [eax + ebx]
add edi, eax
add edi, ecx
and edi, 0x800000ff
jns 0x100038f4
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [esp + edi + 0x18]
mov byte [esp + esi + 0x18], al
inc esi
mov byte [esp + edi + 0x18], dl
cmp esi, 0x100
jl 0x100038d0
mov ebx, dword [esp + 0x10]
xor esi, esi
xor edi, edi
mov dword [esp + 0x14], esi
cmp dword [esp + 0xc], esi
jle 0x10003976
nop dword [eax + eax]
inc esi
and esi, 0x800000ff
jns 0x10003931
dec esi
or esi, 0xffffff00
inc esi
mov cl, byte [esp + esi + 0x18]
movzx edx, cl
add edi, edx
and edi, 0x800000ff
jns 0x1000394a
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [esp + edi + 0x18]
mov byte [esp + esi + 0x18], al
mov byte [esp + edi + 0x18], cl
movzx eax, byte [esp + esi + 0x18]
mov ecx, dword [esp + 0x14]
add eax, edx
movzx eax, al
mov al, byte [esp + eax + 0x18]
xor byte [ecx + ebx], al
inc ecx
mov dword [esp + 0x14], ecx
cmp ecx, dword [esp + 0xc]
jl 0x10003920
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret