Function at 0x1800049d0
Capabilities:
Create mailslot
Extract resource via kernel32 functions
Manipulate console buffer

Disassembly:
push rbx
sub rsp, 0x60
mov dword [rsp + 0x58], 0x26d
lea rax, [fcn.180004ce0]
add rax, 0x26d
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x50], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
call fcn.18000f3b0
mov rax, qword [0x1800fc3e0]
xor ebx, ebx
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x1400]
mov dword [rax + 4], 0xe96eddba
cmp dword [0x1800fc3e8], 0x4804a694
jne 0x180004b34
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_GetOutlineTextMetricsW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadGroupAffinity]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
lea rcx, [0x1801149e8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_FindFirstFileNameTransactedW]
mov dword [rsp + 0x30], ebx
xor r9d, r9d
mov qword [rsp + 0x28], rbx
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryProtectedPolicy]
xor r9d, r9d
mov dword [rsp + 0x28], ebx
xor r8d, r8d
mov qword [rsp + 0x20], rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrencyFormatW]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DebugBreakProcess]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenPrivateNamespaceW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
xor r9d, r9d
mov dword [rsp + 0x28], ebx
xor r8d, r8d
mov qword [rsp + 0x20], rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UpdateResourceW]
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CloseEnhMetaFile]
lock add dword [rbx], ebx
mov rax, qword [0x1800fc3f0]
mov rcx, qword [rax + 0x18]
mov rax, qword [0x1800fc3e0]
mov edx, dword [rcx + 0x14b8]
mov rcx, qword [rax + 0x18]
sub edx, 0x745a87de
mov rax, qword [rcx + 0x1400]
mov dword [rax], edx
cmp dword [0x1800fc3e8], 0x6d052b94
jne 0x180004c88
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadPriorityBoost]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FatalExit]
mov rax, qword [0x1800fc3e0]
mov rcx, qword [rax + 0x18]
mov rax, qword [0x1800fc3f0]
mov rdx, qword [rcx + 0x1400]
mov rcx, qword [rax + 0x18]
mov eax, dword [rcx + 0x14b8]
add dword [rdx + 4], eax
mov rax, qword [0x1800fc3d8]
mov r8, qword [rax + 0x18]
mov rax, qword [0x1800fc3e0]
mov rcx, qword [rax + 0x18]
mov eax, dword [r8 + 0x2fa0]
mov rdx, qword [rcx + 0x1400]
mov dword [rdx + 8], eax
add rsp, 0x60
pop rbx
ret