Function at 0x180005dd0
Capabilities:
Create process on windows
Log keystrokes via polling
Manipulate console buffer
Set uefi variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r13, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemPowerStatus]
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetUserPreferredUILanguages]
xor ebx, ebx
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapePosition]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetCursorInfo]
xor ecx, ecx
xor edx, edx
call qword [sym.imp.USER32.dll_VkKeyScanExW]
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableExW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
xor ecx, ecx
call qword [sym.imp.USER32.dll_PostQuitMessage]
mov r9d, dword [rsp + 0x88]
xor edx, edx
mov r8d, dword [rsp + 0x88]
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WriteConsoleOutputW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetConsoleProcessList]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsValidLocale]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WriteProfileSectionW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentConsoleFont]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ScrollWindow]
xor ecx, ecx
call qword [sym.imp.USER32.dll_DdeDisconnect]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsDialogMessageW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DdeEnableCallback]
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsIconic]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapFree]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetKeyboardState]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
mov qword [rsp + 0x48], rbx
xor r9d, r9d
mov qword [rsp + 0x40], rbx
xor r8d, r8d
mov qword [rsp + 0x38], rbx
xor edx, edx
mov qword [rsp + 0x30], rbx
xor ecx, ecx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov r9d, 0x2653
inc r9d
test r9b, 1
jne 0x180005f56
mov r8d, 0x3b99
nop word [rax + rax]
inc r8d
mov eax, 0x55555556
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r8d, ecx
jne 0x180005f70
lea edx, [r8 + 0x38be]
add r9d, 0x45
lea r11d, [rdx + 0x1bb5]
mov r10d, 0xffffe764
sub r10d, edx
lea edi, [rdx + 0x9baa]
sub edx, r8d
lea esi, [r11 + 0x9baa]
add edx, 0x22a5
mov ecx, 0x1350
test r11b, 1
mov eax, 0xb28
cmove ecx, eax
sub r10d, edi
add ecx, r11d
lea ebx, [rdx + 0x6413]
test cl, 1
je 0x180005fe7
nop dword [rax]
inc ecx
test cl, 1
jne 0x180005fe0
test sil, 1
je 0x180005ff4
lea esi, [r11 + 0x971d]
add ecx, 0xb29
lea r11d, [rdx + rdx]
add ecx, esi
add r10d, r9d
mov r8d, ebx
mov eax, 0x55555556
sub r8d, r10d
add r8d, ecx
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r8d, ecx
je 0x18000602f
lea eax, [r8 - 0x33c4]
test r8d, r8d
jg 0x180006036
lea eax, [r8 - 0x574]
add eax, esi
lea r8d, [r11 + 0x8035]
lea ecx, [rbx + 0x3744]
mov edx, r8d
sub ecx, eax
lea r12d, [rbx + 0x3744]
add ebx, 0x5ab2
sub edi, 0x2d60
lea r15d, [rax*2 + 0x35b9]
mov ebp, 0x3920
sub ebp, esi
lea r14d, [rcx - 0x5bee]
sub ebp, r8d
add r14d, r10d
lea eax, [rbx + r15]
add r14d, edx
add r8d, 0xbc
add edx, 0xffffcf7d
add ecx, 0xffffe27b
add r10d, edx
sub edi, r14d
sub r14d, eax
sub edi, r8d
lea r11d, [r8 - 0x2eb1]
lea esi, [rcx + rsi*2]
add esi, r11d
lea ecx, [r15 + r8]
sub r11d, r10d
sub r10d, r14d
sub esi, r11d
lea ebx, [r10 - 0x13d9]
add r10d, 0xffffed03
add ebx, r15d
lea edx, [r10 - 0x697a]
lea edx, [rdx + rdi*2]
test dl, 1
je 0x1800060e7
nop dword [rax]
inc edx
test dl, 1
jne 0x1800060e0
sub r11d, 0x4235
mov eax, 0x34e
sub eax, edx
add eax, eax
sub eax, r11d
add eax, ecx
cmp eax, 0xffd9854a
jne 0x180006165
cmp edx, 0x188940
jne 0x180006165
cmp ebp, 0xfffddafb
jne 0x180006165
lea ecx, [rbp + 0x3661]
add ecx, r15d
add ecx, r12d
cmp ecx, 0x99843
jne 0x180006165
cmp r10d, 0xff943
jne 0x180006165
cmp esi, 0xfffd8a6a
jne 0x180006165
lea eax, [rbx + r11]
cmp eax, 0x1bbf4a
jne 0x180006165
cmp ebx, 0x1a8894
jne 0x180006165
lea eax, [rdx + r14]
cmp eax, 0x80d1b
jne 0x180006165
cmp r9d, 0x2699
jne 0x180006165
mov eax, dword [r13]
jmp 0x18000616a
mov eax, 1
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret