Function at 0x401000
Capabilities:
Create directory
Enumerate processes via ntquerysysteminformation
Extract resource via kernel32 functions
Get system information on windows
Set uefi variable

Disassembly:
push 0x1a0
mov eax, 0x415805
call fcn.00407680
lea eax, [ebp - 0x1ac]
push eax
call fcn.004019be
xor eax, eax
xor ebx, ebx
mov dword [ebp - 4], ebx
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x30
stosd dword es:[edi], eax
lea eax, [ebp - 0x84]
push ebx
push eax
mov dword [ebp - 0xa0], 1
call fcn.0040bcf0
add esp, 0xc
push 5
pop ecx
push 7
mov esi, 0x418fe8
lea edi, [ebp - 0x38]
rep movsd dword es:[edi], dword [esi]
pop ecx
xor eax, eax
mov esi, str.BOOTX64.EFI
lea edi, [ebp - 0x54]
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x98]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push ebx
stosd dword es:[edi], eax
push 0x14
lea eax, [ebp - 0x98]
push eax
push 0x5a
mov dword [ebp - 0xbc], ebx
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0xb4], ebx
mov dword [ebp - 0xa4], ebx
mov dword [ebp - 0xb0], ebx
mov dword [ebp - 0xac], ebx
mov dword [ebp - 0xa8], ebx
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
jne 0x4010b5
cmp dword [ebp - 0x88], 2
je 0x4010f0
push str.system_is_not_EFI_n
call fcn.00405684
pop ecx
push 2
pop esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14c]
call fcn.00401b4b
lea eax, [ebp - 0x14c]
push eax
mov dword [ebp - method.std::basic_ios_char__struct_std::char_traits_char__.virtual_0], vtable.std::ios_base.0
call fcn.00404abc
pop ecx
mov eax, esi
jmp 0x401882
call fcn.004032d0
test eax, eax
jne 0x401109
push str.EFI_variable_error_n
call fcn.00405684
xor esi, esi
pop ecx
inc esi
jmp 0x4010c3
push 0x10
mov byte [ebp - 4], 1
call fcn.00404a46
pop ecx
mov edi, eax
mov esi, 0x208
push esi
mov dword [ebp - 0xb4], edi
call fcn.00404a46
pop ecx
push esi
mov dword [ebp - 0xa4], eax
call fcn.00404a46
pop ecx
push esi
mov dword [ebp - 0xb0], eax
call fcn.00404a46
pop ecx
push esi
mov dword [ebp - 0xac], eax
call fcn.00404a46
pop ecx
push 0x48
mov dword [ebp - 0xa8], eax
call fcn.00404a46
mov esi, eax
pop ecx
cmp esi, ebx
je 0x401178
push 0x48
push ebx
push esi
call fcn.0040bcf0
add esp, 0xc
mov dword [ebp - 0x9c], esi
jmp 0x40117e
mov dword [ebp - 0x9c], ebx
push edi
call fcn.004048a0
lea eax, [ebp - 0x9c]
push eax
call fcn.00403320
pop ecx
pop ecx
cmp eax, 0xe
jne 0x4011d0
push 1
lea eax, [ebp - 0xa0]
push eax
lea ecx, [ebp - 0xec]
mov dword [ebp - 0xa0], str.bad_allocation
call fcn.0040569c
mov dword [ebp - 0xec], vtable.std::bad_alloc.0
push 0x41a6cc
lea eax, [ebp - 0xec]
push eax
call fcn.004071b1
push dword [ebp - 0x9c]
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
push edi
push str._sEFI_s
push dword [ebp - 0xa4]
call esi
push edi
push str._sEFIWINDSLIC
push dword [ebp - 0xb0]
call esi
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0xa4]
push 0x4190a4
push dword [ebp - 0xac]
call esi
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x9c]
push str.EFI_s_s
push dword [ebp - 0xa8]
call esi
call fcn.004047b0
push edi
call fcn.004048f0
add esp, 0x40
push dword [ebp - 0xb0]
call fcn.00403660
pop ecx
push dword [ebp - 0xa4]
call fcn.00403660
pop ecx
cmp eax, ebx
je 0x40125a
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x401240
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
cmp eax, ebx
je 0x4012a7
mov ecx, 0x4190c8
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40128f
cmp dx, bx
je 0x40128b
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40128f
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x401269
xor eax, eax
jmp 0x401294
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x4012a7
push str.uninstalling_WindSLIC_n
call fcn.00405684
jmp 0x40174c
push ebx
push dword [ebp - 0xa4]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x40173a
push dword [ebp - 0xac]
push str.installing_WindSLIC_to:__s_n
call fcn.00405684
mov edi, dword [sym.imp.KERNEL32.dll_FindResourceW]
pop ecx
pop ecx
push 0x419138
push 0x65
push 0
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
push esi
push 0
call ebx
push esi
push 0
mov dword [ebp - 0xc4], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push dword [ebp - 0xc4]
mov esi, eax
call fcn.00404a46
pop ecx
push dword [ebp - 0xc4]
mov dword [ebp - 0xb8], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LockResource]
call esi
push eax
push dword [ebp - 0xb8]
call fcn.00406e50
add esp, 0xc
push 0x419140
push 0x66
push 0
call edi
mov edi, eax
push edi
push 0
call ebx
push eax
mov dword [ebp - 0xc8], eax
call fcn.00404a46
pop ecx
push edi
mov ebx, eax
xor edi, edi
push edi
mov dword [ebp - 0xe0], ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push dword [ebp - 0xc8]
push eax
call esi
push eax
push ebx
call fcn.00406e50
push edi
call fcn.00405896
push eax
call fcn.00405863
add esp, 0x14
xor esi, esi
cmp esi, 0x10
jae 0x401399
call fcn.00405875
push 0x5d
cdq
pop ecx
idiv ecx
add dl, 0x21
mov byte [ebp + esi - 0x24], dl
inc esi
jmp 0x40137f
push 0xf
pop eax
xor esi, esi
cmp esi, dword [ebp - 0xc8]
jae 0x4013b9
mov cl, byte [ebp + eax - 0x24]
xor byte [esi + ebx], cl
dec eax
cmp eax, 0xffffffff
jne 0x4013b6
push 0xf
pop eax
inc esi
jmp 0x40139e
xor eax, eax
cmp eax, 0x10
jae 0x4013c7
not byte [ebp + eax - 0x24]
inc eax
jmp 0x4013bb
mov dword [ebp - 0xc0], edi
mov eax, dword [ebp - 0xc4]
add eax, 0xfffffffa
cmp dword [ebp - 0xc0], eax
jae 0x401574
mov ebx, dword [ebp - 0xc0]
add ebx, dword [ebp - 0xb8]
xor ecx, ecx
xor esi, esi
cmp byte [ebx], 0x53
mov dword [ebp - 0xd4], ecx
mov dword [ebp - 0xdc], ecx
mov dword [ebp - 0xd8], ecx
mov dword [ebp - 0xd0], ecx
mov dword [ebp - 0xcc], ecx
jne 0x40145c
cmp byte [ebx + 1], 0x4c
jne 0x40145c
cmp byte [ebx + 2], 0x50
jne 0x40145c
cmp byte [ebx + 3], 0x53
jne 0x40145c
cmp byte [ebx + 4], 0x54
jne 0x40145c
cmp byte [ebx + 5], 0x52
jne 0x40145c
push 8
pop ecx
xor eax, eax
push 0xa
mov edi, ebx
rep stosd dword es:[edi], eax
pop eax
push eax
mov eax, str.AcerSystem
push eax
push ebx
call fcn.00406e50
xor edi, edi
inc edi
add esp, 0xc
mov dword [ebp - 0xdc], edi
xor ecx, ecx
jmp 0x40145f
xor edi, edi
inc edi
cmp byte [ebx], 0x4b
jne 0x401493
cmp byte [ebx + 1], 0x45
jne 0x401493
cmp byte [ebx + 2], 0x59
jne 0x401493
cmp byte [ebx + 3], 0x4b
jne 0x401493
cmp byte [ebx + 4], 0x45
jne 0x401493
cmp byte [ebx + 5], 0x59
jne 0x401493
lea esi, [ebp - 0x24]
mov edi, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor esi, esi
xor edi, edi
inc esi
xor ecx, ecx
inc edi
cmp byte [ebx], 0x53
jne 0x4014d3
cmp byte [ebx + 1], 0x4c
jne 0x4014d3
cmp byte [ebx + 2], 0x49
jne 0x4014d3
cmp byte [ebx + 3], 0x43
jne 0x4014d3
cmp byte [ebx + 4], 0x76
jne 0x4014d3
cmp byte [ebx + 5], 1
jne 0x4014d3
push dword [ebp - 0xc8]
push dword [ebp - 0xe0]
push ebx
call fcn.00406e50
add esp, 0xc
mov dword [ebp - 0xd4], edi
xor ecx, ecx
cmp byte [ebx], 0x41
jne 0x4014f5
cmp byte [ebx + 1], 0x41
jne 0x4014f5
cmp byte [ebx + 2], 0x41
jne 0x4014f5
cmp byte [ebx + 3], 0x41
jne 0x4014f5
push 0xa
pop eax
mov dword [ebx], eax
mov dword [ebp - 0xd8], edi
cmp byte [ebx], 0x42
jne 0x401519
cmp byte [ebx + 1], 0x42
jne 0x401519
cmp byte [ebx + 2], 0x42
jne 0x401519
cmp byte [ebx + 3], 0x42
jne 0x401519
mov eax, 0xf0000
mov dword [ebx], eax
mov dword [ebp - 0xd0], edi
cmp byte [ebx], 0x43
jne 0x40153d
cmp byte [ebx + 1], 0x43
jne 0x40153d
cmp byte [ebx + 2], 0x43
jne 0x40153d
cmp byte [ebx + 3], 0x43
jne 0x40153d
mov eax, 0xfffff
mov dword [ebx], eax
mov dword [ebp - 0xcc], edi
cmp esi, ecx
je 0x401569
cmp dword [ebp - 0xd4], ecx
je 0x401569
cmp dword [ebp - 0xdc], ecx
je 0x401569
cmp dword [ebp - 0xcc], ecx
je 0x401569
cmp dword [ebp - 0xd0], ecx
je 0x401569
cmp dword [ebp - 0xd8], ecx
jne 0x401574
inc dword [ebp - 0xc0]
jmp 0x4013cd
push dword [ebp - 0xac]
lea eax, [ebp - 0x1ac]
push eax
call fcn.00401a8d
xor ebx, ebx
cmp dword [ebp - 0x154], ebx
je 0x4015e7
push ebx
push dword [ebp - 0xc4]
lea eax, [ebp - 0x1ac]
push dword [ebp - 0xb8]
push eax
call fcn.004018a2
lea eax, [ebp - 0x1a8]
call fcn.0040229f
cmp eax, ebx
jne 0x4015e7
mov eax, dword [ebp - 0x1ac]
mov ecx, dword [eax + 4]
lea ecx, [ebp + ecx - 0x1ac]
mov eax, dword [ecx + 0xc]
or eax, 2
cmp dword [ecx + 0x38], ebx
jne 0x4015d6
or eax, 4
and eax, 0x17
mov dword [ecx + 0xc], eax
test dword [ecx + 0x10], eax
je 0x4015e7
push ebx
call fcn.0040317e
push dword [ebp - 0xb8]
call fcn.004058e7
push dword [ebp - 0xe0]
call fcn.004058e7
pop ecx
pop ecx
call fcn.00403d70
call fcn.00403b30
call fcn.00403fc0
mov edi, eax
cmp edi, 0xffffffff
jne 0x401625
push str.find_free_boot_entry_failed
call fcn.00405684
pop ecx
jmp 0x401757
push edi
lea eax, [ebp - 0x84]
push 0x4191c8
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
push dword [ebp - 0xa8]
lea eax, [ebp - 0xbc]
push eax
push ebx
lea ecx, [ebp - 0x38]
call fcn.00404110
add esp, 0x18
cmp eax, 0xe
jne 0x40168e
push 1
lea eax, [ebp - 0xa0]
push eax
lea ecx, [ebp - 0x104]
mov dword [ebp - 0xa0], str.bad_allocation
call fcn.0040569c
mov dword [ebp - method.std::bad_alloc.virtual_0], vtable.std::bad_alloc.0
push 0x41a6cc
lea eax, [ebp - 0x104]
jmp 0x4011ca
push dword [ebp - 0xbc]
call fcn.00404a46
pop ecx
push dword [ebp - 0xa8]
mov esi, eax
lea eax, [ebp - 0xbc]
push eax
push esi
lea ecx, [ebp - 0x38]
call fcn.00404110
add esp, 0xc
cmp eax, ebx
je 0x4016f6
cmp eax, 0xe
jne 0x401729
push 1
lea eax, [ebp - 0xa0]
push eax
lea ecx, [ebp - 0xf8]
mov dword [ebp - 0xa0], str.bad_allocation
call fcn.0040569c
mov dword [ebp - 0xf8], vtable.std::bad_alloc.0
push 0x41a6cc
lea eax, [ebp - 0xf8]
jmp 0x4011ca
lea eax, [ebp - 0x84]
push eax
push str.adding_WindSLIC_boot_entry:__s_n
call fcn.00405684
pop ecx
pop ecx
push dword [ebp - 0xbc]
lea eax, [ebp - 0x84]
push esi
push str.8BE4DF61_93CA_11d2_AA0D_00E098032B8C
push eax
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableW]
push edi
call fcn.00403910
pop ecx
push esi
mov dword [ebp - 0xa0], ebx
call fcn.004058e7
jmp 0x40161f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.create_directory_failed:__X_n
call fcn.00405684
pop ecx
pop ecx
call fcn.00403d70
call fcn.00403b30
push dword [ebp - 0xb4]
call fcn.004049a0
pop ecx
push dword [ebp - 0x9c]
call fcn.004058e7
push dword [ebp - 0xa8]
call fcn.004058e7
push dword [ebp - 0xac]
call fcn.004058e7
push dword [ebp - 0xa4]
call fcn.004058e7
push dword [ebp - 0xb0]
call fcn.004058e7
push dword [ebp - 0xb4]
call fcn.004058e7
or dword [ebp - 4], 0xffffffff
add esp, 0x18
lea ecx, [ebp - 0x14c]
call fcn.00401b4b
lea eax, [ebp - 0x14c]
push eax
mov dword [ebp - method.std::basic_ios_char__struct_std::char_traits_char__.virtual_0], vtable.std::ios_base.0
call fcn.00404abc
mov eax, dword [ebp - 0xa0]
pop ecx
jmp 0x401882
call fcn.004076dc
ret