Function at 0x1800053e0
Capabilities:
Get file size
Get graphical window text
Get uefi variable
Log keystrokes
Manipulate console buffer
Set environment variable
Set file attributes
Terminate process

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
call fcn.1800484e8
mov ebx, eax
mov eax, 0x51eb851f
imul ebx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x64
sub ebx, ecx
inc ebx
xor edi, edi
mov r8d, dword [0x1800d2574]
cmp r8d, 0xf8be4276
jne 0x180005536
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadImageW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetWindowTextW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DdeConnect]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSysColorBrush]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_RegisterPointerInputTargetEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetUpdateRgn]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CheckNameLegalDOS8Dot3W]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalReAlloc]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetWindowRgn]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowExW]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReleaseMutexWhenCallbackReturns]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_AttachThreadInput]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EndUpdateResourceW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WaitForThreadpoolIoCallbacks]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DdeAddData]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov r8d, dword [0x1800d2574]
mov eax, 0x55555556
imul ebx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp ebx, ecx
jne 0x1800056aa
cmp r8d, 0xaf93feaf
jne 0x180005688
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapeStatus]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCommConfig]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFirmwareEnvironmentVariableW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClosePrivateNamespace]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleOriginalTitleW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov dword [rsp + 0x20], edi
xor r9d, r9d
lea r8, str.9E1tS49lM425H5WpkaXTxCl7X
xor edx, edx
lea rcx, str.G92W1h5GhD6RQir7Yb8
call qword [sym.imp.KERNEL32.dll_CompareStringOrdinal]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaNodeNumberFromHandle]
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetOverlappedResultEx]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CompareStringW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProfileSectionW]
call qword [sym.imp.KERNEL32.dll_UnregisterApplicationRestart]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaProximityNodeEx]
call qword [sym.imp.KERNEL32.dll_SwitchToThread]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCommBreak]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUserGeoID]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapDestroy]
mov qword [rsp + 0x20], rdi
mov r9d, dword [rbp + 0x67]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov edx, dword [rbp + 0x6f]
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
add rsp, 0xa0
pop rdi
pop rbx
pop rbp
ret
test bl, 1
jne 0x1800057a2
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
add rax, 0x1e6
mov qword [rbp - 0x29], rax
mov dword [rbp - 0x21], 0x1e6
movaps xmm0, xmmword [rbp - 0x29]
movdqa xmmword [rbp - 0x29], xmm0
lea rcx, [rbp - 0x29]
call fcn.18000d720
mov qword [rbp + 0x77], rax
mov dword [rbp + 0x67], 8
mov rax, qword [sym.imp.KERNEL32.dll_HeapAlloc]
add rax, 0x266
mov qword [rbp - 0x29], rax
mov dword [rbp - 0x21], 0x266
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
mov qword [rbp - 1], rdi
mov qword [rbp + 7], rdi
mov qword [rbp + 0xf], rdi
mov qword [rbp + 0x17], rdi
mov qword [rbp + 0x1f], rdi
mov ecx, 0x10
call fcn.18004268c
mov qword [rax + 8], rdi
mov qword [rbp - 1], rax
lea rcx, [rbp - 1]
mov qword [rax], rcx
mov word [rbp + 0x2f], di
mov qword [rbp + 0x35], rdi
mov qword [rbp + 0x3d], rdi
xor eax, eax
mov word [rbp + 0x32], ax
mov byte [rbp + 0x34], al
mov word [rbp + 0x35], ax
mov byte [rbp + 0x37], al
mov word [rbp + 0x38], ax
mov byte [rbp + 0x3a], al
mov word [rbp + 0x3b], ax
mov byte [rbp + 0x3d], al
mov word [rbp + 0x3e], ax
mov byte [rbp + 0x40], al
mov word [rbp + 0x41], ax
mov byte [rbp + 0x43], al
mov dword [rbp - 5], edi
mov dword [rbp + 0x2b], edi
movaps xmm0, xmmword [rbp - 0x29]
movdqa xmmword [rbp - 0x29], xmm0
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x67]
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x19]
call fcn.180010060
mov rbx, qword [rbp - 0x11]
jmp 0x180005865
mov eax, 0xbe37
inc eax
test al, 1
jne 0x1800057a7
sub eax, 0x5599c
cmp eax, 0xfffb649c
jne 0x18000588e
lea rax, [fcn.18004d7ac]
add rax, 0x122
mov qword [rbp - 0x29], rax
mov dword [rbp - 0x21], 0x122
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
mov qword [rbp - 1], rdi
mov qword [rbp + 7], rdi
mov qword [rbp + 0xf], rdi
mov qword [rbp + 0x17], rdi
mov qword [rbp + 0x1f], rdi
mov ecx, 0x10
call fcn.18004268c
mov qword [rax + 8], rdi
mov qword [rbp - 1], rax
lea rcx, [rbp - 1]
mov qword [rax], rcx
mov word [rbp + 0x2f], di
mov qword [rbp + 0x35], rdi
mov qword [rbp + 0x3d], rdi
xor eax, eax
mov word [rbp + 0x32], ax
mov byte [rbp + 0x34], al
mov word [rbp + 0x35], ax
mov byte [rbp + 0x37], al
mov word [rbp + 0x38], ax
mov byte [rbp + 0x3a], al
mov word [rbp + 0x3b], ax
mov byte [rbp + 0x3d], al
mov word [rbp + 0x3e], ax
mov byte [rbp + 0x40], al
mov word [rbp + 0x41], ax
mov byte [rbp + 0x43], al
mov dword [rbp - 5], edi
mov dword [rbp + 0x2b], edi
movaps xmm0, xmmword [rbp - 0x29]
movdqa xmmword [rbp - 0x29], xmm0
lea r8, [rbp + 0x6f]
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x19]
call fcn.18000fe30
mov rbx, qword [rbp - 0x11]
lea rcx, [rbp - 1]
call fcn.180011a80
mov rcx, qword [rbp - 1]
mov qword [rbp - 1], rdi
mov edx, 0x10
call fcn.1800425a0
mov rax, rbx
add rsp, 0xa0
pop rdi
pop rbx
pop rbp
ret
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]