Function at 0x180009c40
Capabilities:
Get file size
Get uefi variable
Move file
Read .ini file
Terminate process

Disassembly:
push rbx
sub rsp, 0x1b0
cmp edx, 1
jne 0x180009ead
mov dword [rsp + 0x58], 0x138
lea rax, [0x180009220]
add rax, 0x138
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x50], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
call fcn.18000fe20
mov dword [rsp + 0x58], 0x18d
lea rax, [0x180009830]
add rax, 0x18d
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x50], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
call fcn.180012e90
xor ecx, ecx
call fcn.180088eac
mov ecx, eax
call fcn.180085aa4
mov dword [rsp + 0x58], 0x14d
lea rbx, [0x1800095a0]
lea rax, [rbx + 0x14d]
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0xd0]
movaps xmm0, xmmword [rsp + 0x50]
lea rcx, [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
call fcn.180013050
mov dword [rsp + 0x58], 0x1ff
lea rdx, [rsp + 0x60]
add rbx, 0x1ff
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x50], rbx
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
call fcn.180013050
mov dword [rsp + 0x58], 0x18f
lea rax, [0x180009690]
add rax, 0x18f
lea r9, [rsp + 0x140]
mov qword [rsp + 0x50], rax
lea r8, [rsp + 0x60]
movaps xmm0, xmmword [rsp + 0x50]
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
call fcn.180013210
mov dword [rsp + 0x58], 0x27b
lea rax, [0x180004020]
add rax, 0x27b
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x50], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
call fcn.18000fe20
cmp dword [0x180125260], 0x5e85a213
jne 0x180009e9f
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteVolumeMountPointW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryDepthSList]
call qword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RemoveVectoredExceptionHandler]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PrefetchVirtualMemory]
xor ebx, ebx
lea rax, str.atowRQ7EZ4Y8t5Itf2xE
mov qword [rsp + 0x40], rbx
lea r8, str.DxK6Ra9IiA5BPd32rrx54R4DaDLRo
mov qword [rsp + 0x38], rbx
lea rcx, str.P76i96FTuPvlZ73EiOGh18r6YTix
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], ebx
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CompareStringEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesTransactedW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CancelThreadpoolIo]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitOnceBeginInitialize]
lea r9, str.W1X87JwvT5KXMyVnrJx6C85
mov qword [rsp + 0x28], rbx
xor r8d, r8d
mov dword [rsp + 0x20], ebx
lea rdx, str.Zog6n3u4g5OXq4IppN8V6
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumCalendarInfoExEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Wow64GetThreadContext]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFirmwareEnvironmentVariableW]
mov eax, 1
add rsp, 0x1b0
pop rbx
ret
cmp edx, 2
je 0x180009e9f
cmp edx, 3
jne 0x180009ff0
cmp dword [0x180125260], 0xc8e32d02
jne 0x180009e9f
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetHandleInformation]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlCaptureStackBackTrace]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetPropW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaProximityNodeEx]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
xor ebx, ebx
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], ebx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjectsEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnableWindow]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetKeyboardState]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DrawAnimatedRects]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFileIoOverlappedRange]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
xor r8d, r8d
mov qword [rsp + 0x20], rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWriteWatch]
mov r9d, dword [rsp + 0x1c8]
xor edx, edx
mov r8d, dword [rsp + 0x1c8]
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadConsoleOutputW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProfileStringW]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetRect]
xor ecx, ecx
call qword [sym.imp.USER32.dll_DdeGetLastError]
mov eax, 1
add rsp, 0x1b0
pop rbx
ret
test edx, edx
jne 0x180009e9f
mov qword [rsp + 0x1c0], rdi
mov r8d, 0x6b6
mov r9d, 0x572
nop dword [rax]
inc r8d
mov eax, 0x55555556
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r8d, ecx
jne 0x18000a010
mov r10d, 0x195b
inc r10d
test r10b, 1
jne 0x18000a030
lea ecx, [r8 - 0xcbc]
inc r9d
mov eax, 0x55555556
imul r9d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea edx, [rdx + rdx*2]
cmp r9d, edx
jne 0x18000a040
lea eax, [rcx - 0x1953]
lea r11d, [r9 + rcx]
add ecx, 0x211a
test cl, 1
je 0x18000a077
nop
inc ecx
test cl, 1
jne 0x18000a070
add eax, r10d
lea edx, [r11 + 0x3046]
sub edx, eax
add r11d, 0x4351
mov r10d, edx
sub ecx, 0x2385
sub r10d, eax
mov eax, 0xffffb1d3
sub eax, r11d
sub r10d, 0x2486
lea r9d, [rdx - 0x1102]
add ecx, eax
mov edx, 0xffffb759
mov eax, 0xffffffb7
sub edx, r9d
sub eax, r10d
add edx, 0xffffc343
add r9d, r11d
sub r9d, edx
test cl, 1
je 0x18000a0d7
nop
inc ecx
test cl, 1
jne 0x18000a0d0
add r11d, 0x343c
lea edx, [r10 + r10]
sub r9d, edx
add ecx, 0x37af
mov edi, 0x2165
mov ebx, 0xffffe022
lea r8d, [r11 + rax]
mov eax, 0x55555556
add r8d, r8d
add r11d, r8d
sub r8d, 0x11b1
imul r8d
add r11d, 0x1046
mov eax, edx
sub ebx, r11d
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
mov edx, 0xffffde9b
cmp r8d, eax
cmove edx, edi
mov rdi, qword [rsp + 0x1c0]
sub edx, ecx
add edx, r8d
cmp ecx, 0xffff9e55
jne 0x18000a174
cmp ebx, 0xfffe99c9
jne 0x18000a174
cmp edx, 0x13077
jne 0x18000a174
cmp r9d, 0xe333
jne 0x18000a174
sub r11d, edx
cmp r11d, 0x15e2
jne 0x18000a174
cmp r10d, 0x1726
je 0x180009e9f
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]