Function at 0x1800055f0
Capabilities:
Enumerate gui resources
Extract resource via kernel32 functions
Manipulate console buffer
Query environment variable
Read clipboard data
Set uefi variable
Terminate process

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbx
push rdi
sub rsp, 0x68
call fcn.18004b7d8
mov r8d, dword [0x1800cefa0]
mov ebx, eax
mov eax, 0x51eb851f
xor edi, edi
imul ebx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x64
sub ebx, ecx
inc ebx
cmp r8d, 0x793130e8
jne 0x180005701
mov r9d, dword [rsp + 0x80]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadBitmapW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_EndDialog]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RemoveDllDirectory]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryIdleProcessorCycleTime]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
call qword [sym.imp.USER32.dll_GetKBCodePage]
xor ecx, ecx
call qword [sym.imp.USER32.dll_CopyIcon]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LockResource]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetPhysicalCursorPos]
mov r9d, dword [rsp + 0x80]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SetPropW]
xor edx, edx
lea rcx, str.Fq4o4al69ELNey8dy
call qword [sym.imp.KERNEL32.dll_LocaleNameToLCID]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetClipboardData]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
mov r8d, dword [0x1800cefa0]
mov qword [rsp + 0x98], rbp
mov eax, 0x55555556
imul ebx
mov qword [rsp + 0x60], rsi
mov eax, edx
mov qword [rsp + 0x58], r14
shr eax, 0x1f
add edx, eax
mov qword [rsp + 0x50], r15
lea ecx, [rdx + rdx*2]
cmp ebx, ecx
jne 0x180005851
cmp r8d, 0xa716ad75
jne 0x180005818
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], edi
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor r9d, r9d
lea rdx, str.qHGdyPe1SC18u1h
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetStringTypeW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov dword [rsp + 0x30], edi
xor r9d, r9d
mov qword [rsp + 0x28], rdi
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MapViewOfFileExNuma]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SleepConditionVariableSRW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindVolumeClose]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ClearCommError]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetCalendarInfoW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DeleteSynchronizationBarrier]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AddIntegrityLabelToBoundaryDescriptor]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
mov edx, dword [rsp + 0x88]
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x98]
add rsp, 0x68
pop rdi
pop rbx
ret
test bl, 1
jne 0x1800058e8
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x48], 0x1b5
add rax, 0x1b5
mov qword [rsp + 0x40], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.18000bef0
mov qword [rsp + 0x90], rax
lea r9, [rsp + 0x88]
mov rax, qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea r8, [rsp + 0x80]
mov dword [rsp + 0x48], 0x29c
lea rdx, [rsp + 0x90]
add rax, 0x29c
mov dword [rsp + 0x80], 8
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x40]
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.18000c0a0
jmp 0x180005833
mov r8d, 0x24cf
nop
inc r8d
test r8b, 1
jne 0x1800058f0
mov ebx, 0xffffcf0c
mov r9d, 0xfffff1b5
sub ebx, r8d
nop word [rax + rax]
inc r9d
mov eax, 0x55555556
imul r9d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r9d, ecx
jne 0x180005910
lea edx, [r8 + 0xf57e]
mov eax, edx
and eax, 0x80000003
jge 0x180005941
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
je 0x18000594f
test edx, edx
jle 0x18000594f
sub edx, 0x1f57
lea ecx, [rdx + 0xe53]
add ebx, 0xffffdf0d
add edx, 0x4de0
lea r11d, [r9 + 0x8d7]
mov eax, 0xbd55
mov ebp, ebx
sub eax, ebx
sub ebp, edx
add ebp, 0x2d78
lea r9d, [rdx + 0x1ca1]
lea r8d, [rax + 0xde96]
add r8d, ecx
lea esi, [rbp*2 + 0xb5c]
sub esi, ebx
lea edi, [r8 + rax*2]
lea eax, [rdi + rcx]
sub r8d, edi
lea r10d, [rax - 0x22de]
add r11d, r8d
lea r14d, [rax + 0x64db]
add esi, r8d
lea ecx, [rbx - 0x692]
lea eax, [r9 + r9]
sub eax, edx
lea r15d, [r11 + 0x2e23]
add edi, eax
lea r8d, [rsi - 0x112d]
mov eax, ecx
mov edx, r15d
sub eax, r10d
sub edx, ebp
add r8d, eax
sub edx, edi
mov eax, 0x2bec
sub eax, ecx
add edi, eax
lea eax, [r8 + 0x2cd8]
add eax, edx
lea ecx, [r14 + r8]
add r11d, eax
add ecx, r9d
mov eax, edi
lea r9d, [r10 + r10]
sub r8d, esi
and eax, 0x80000003
jge 0x180005a0f
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
je 0x180005a1c
mov eax, 0x8f3
test edi, edi
jg 0x180005a21
mov eax, 0xfffff70d
lea edx, [rcx - 0x203f]
lea r10d, [rdi + rax]
lea eax, [r9 + r8]
lea r9d, [rdx - 0x1c35]
add r9d, eax
mov ecx, r9d
and ecx, 0x80000003
jge 0x180005a4b
dec ecx
or ecx, 0xfffffffc
inc ecx
sub edx, r11d
cmp edx, 0x122b82
jne 0x180005af4
lea eax, [r15 + r15]
cmp eax, 0xfffb8132
jne 0x180005af4
test ecx, ecx
mov eax, 0x1579
mov edx, 0xffffea87
cmove eax, edx
add eax, r9d
cmp eax, 0x1de97
jne 0x180005af4
cmp r14d, 0x6f229
jne 0x180005af4
lea eax, [r10 + r8]
cmp eax, 0xbf5f
jne 0x180005af4
cmp ebp, 0xfffe6dea
jne 0x180005af4
cmp r11d, 0xffea08c9
jne 0x180005af4
cmp r8d, 0xfff9071a
jne 0x180005af4
cmp esi, 0xfffaf5cf
jne 0x180005af4
mov dword [rsp + 0x48], 0x263
lea rax, [fcn.18004fc64]
add rax, 0x263
lea rdx, [rsp + 0x88]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x40]
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call fcn.18000c280
jmp 0x180005833
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]