Function at 0x41264b
Capabilities:
Check for time delay via gettickcount
Check mutex and terminate process on windows
Check mutex on windows
Create process on windows
Set uefi variable
Terminate process

Disassembly:
push 0x1dc
mov eax, 0x440e83
call fcn.0042b376
and dword [ebp - 0x84], 0
mov eax, dword [ecx + 0x2e8]
sub eax, dword [ecx + 0x2e4]
mov dword [ebp - 0x8c], ecx
add ecx, 0x2d8
mov dword [ebp - 0x9c], ecx
cdq
mov ecx, 0x8c
idiv ecx
test eax, eax
jne 0x412696
mov eax, 0x80004005
call fcn.0042b3f9
ret
cmp dword [0x4558e0], 2
jne 0x412710
push 2
lea eax, [ebp - 0x48]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x94], esp
push 2
push 0x4487f8
call fcn.0040801d
lea edi, [ebp - 0x18c]
call fcn.00426ea5
and dword [ebp - 4], 0
xor ebx, ebx
inc ebx
mov ecx, eax
mov dword [ebp - 0x84], ebx
call fcn.004270be
cmp dword [eax + 0x18], 0x10
mov dword [ebp - 0x84], 3
jb 0x4126f0
mov eax, dword [eax + 4]
jmp 0x4126f3
add eax, 4
push eax
mov eax, dword [0x4558e4]
push dword [eax + 4]
call fcn.0042a445
add esp, 0xc
test eax, eax
jne 0x412713
mov byte [ebp - 0x8d], bl
jmp 0x41271a
xor ebx, ebx
inc ebx
mov byte [ebp - 0x8d], 0
test byte [ebp - 0x84], 2
je 0x412735
and dword [ebp - 0x84], 0xfffffffd
push 0
push ebx
lea ecx, [ebp - 0x48]
call fcn.0040329c
or dword [ebp - 4], 0xffffffff
test byte [ebp - 0x84], bl
je 0x41274c
lea esi, [ebp - 0x18c]
call fcn.00417161
cmp byte [ebp - 0x8d], 0
je 0x41275c
xor eax, eax
jmp 0x412690
push 0
push 0x100
lea eax, [ebp - 0x48]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x94], esp
push 0x14
push 0x4487fc
call fcn.0040801d
lea edi, [ebp - 0x18c]
call fcn.00426ea5
mov ecx, eax
mov dword [ebp - 4], ebx
call fcn.004270be
mov byte [ebp - 4], 2
cmp dword [eax + 0x18], 0x10
jb 0x4127a2
mov eax, dword [eax + 4]
jmp 0x4127a5
add eax, 4
lea ecx, [ebp - 0x98]
push ecx
mov ebx, eax
call fcn.00417955
mov ecx, dword [ebp - 0x8c]
add ecx, 0x244
push eax
push ecx
mov byte [ebp - 4], 3
mov dword [ebp - 0xa0], ecx
call fcn.00419577
movzx edi, al
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0xa4], edi
mov byte [ebp - 4], 2
call fcn.004179e3
xor ebx, ebx
push ebx
push 1
lea ecx, [ebp - 0x48]
call fcn.0040329c
lea esi, [ebp - 0x18c]
call fcn.00417161
push ebx
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x4c], 0xf
call fcn.00403636
mov dword [ebp - 4], 4
cmp edi, ebx
je 0x412951
push ebx
lea eax, [ebp - 0xdc]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x94], esp
push 0xa
push 0x448814
call fcn.0040801d
lea edi, [ebp - 0x1e8]
call fcn.00426ea5
mov ecx, eax
mov byte [ebp - 4], 5
call fcn.00427269
mov byte [ebp - 4], 6
cmp dword [eax + 0x18], 0x10
jb 0x412867
mov eax, dword [eax + 4]
jmp 0x41286a
add eax, 4
push eax
lea ecx, [ebp - 0x2c]
call fcn.00402e72
push eax
push 0x100
lea eax, [ebp - 0x48]
push eax
sub esp, 0x1c
mov byte [ebp - 4], 7
mov esi, esp
mov dword [ebp - 0x94], esp
push 0xc
push 0x448820
call fcn.0040801d
lea edi, [ebp - 0x18c]
call fcn.00426ea5
mov byte [ebp - 4], 8
call fcn.00426f18
mov byte [ebp - 4], 9
cmp dword [eax + 0x18], 0x10
jb 0x4128bb
mov eax, dword [eax + 4]
jmp 0x4128be
add eax, 4
lea ecx, [ebp - 0x88]
push ecx
mov ebx, eax
call fcn.00417955
mov ebx, dword [ebp - 0xa0]
push eax
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 0xa
call fcn.004195f2
add esp, 0xc
push 0xffffffffffffffff
xor edi, edi
push edi
push eax
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0xb
call fcn.004031c2
xor ebx, ebx
push edi
inc ebx
push ebx
lea ecx, [ebp - 0x80]
call fcn.0040329c
lea eax, [ebp - 0x88]
push eax
mov byte [ebp - 4], 9
call fcn.004179e3
push edi
push ebx
lea ecx, [ebp - 0x48]
call fcn.0040329c
lea esi, [ebp - 0x18c]
call fcn.00417161
push edi
push ebx
lea ecx, [ebp - 0x2c]
call fcn.0040329c
push edi
push ebx
lea ecx, [ebp - 0xdc]
call fcn.0040329c
lea esi, [ebp - 0x1e8]
call fcn.00417161
mov dword [ebp - 4], 4
xor ebx, ebx
mov edi, dword [ebp - 0x9c]
mov eax, dword [edi + 0x10]
sub eax, dword [edi + 0xc]
mov ecx, 0x8c
cdq
idiv ecx
mov dword [ebp - 0x84], ebx
test eax, eax
jbe 0x412bd1
push dword [ebp - 0x84]
mov eax, edi
call fcn.00417560
cmp dword [eax + 0x74], 0xffffffff
je 0x412bb1
mov esi, dword [ebp - 0x8c]
push dword [ebp - 0x84]
add esi, 0x2c0
mov eax, edi
mov dword [ebp - 0x94], esi
call fcn.00417560
push dword [eax + 0x74]
mov eax, esi
call fcn.004174cd
add eax, 0x1c
cmp dword [eax + 0x14], ebx
je 0x412ab6
push dword [ebp - 0x84]
mov eax, edi
call fcn.00417560
push dword [eax + 0x74]
mov eax, esi
call fcn.004174cd
add eax, 0x1c
push eax
lea ecx, [ebp - 0x2c]
call fcn.00402e94
mov byte [ebp - 4], 0xe
call fcn.004094e1
test eax, eax
je 0x4129f9
call fcn.0040b684
call fcn.0040b724
mov eax, dword [ebp - 0x18]
cmp eax, ebx
je 0x412a1f
lea edi, [eax - 1]
lea eax, [ebp - 0x2c]
call fcn.00408121
cmp byte [eax], 0x5c
je 0x412a1f
xor ebx, ebx
push 0x5c
inc ebx
lea edi, [ebp - 0x2c]
call fcn.0040842d
xor ebx, ebx
mov edi, dword [ebp - 0x9c]
push dword [ebp - 0x84]
mov eax, edi
call fcn.00417560
push 0xffffffffffffffff
add eax, 0x3c
push ebx
lea esi, [ebp - 0x2c]
call fcn.00408389
mov eax, dword [ebp - 0xa0]
push 0x10
pop esi
cmp dword [eax + 0x18], esi
jb 0x412a53
mov eax, dword [eax + 4]
jmp 0x412a56
add eax, 4
mov ecx, dword [ebp - 0x28]
cmp dword [ebp - 0x14], esi
jae 0x412a61
lea ecx, [ebp - 0x28]
push eax
push ecx
call fcn.00428726
pop ecx
pop ecx
test eax, eax
je 0x412cc3
cmp dword [ebp - 0xa4], ebx
je 0x412aa1
mov ecx, dword [ebp - 0x60]
cmp dword [ebp - 0x4c], esi
jae 0x412a85
lea ecx, [ebp - 0x60]
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x14], esi
jae 0x412a90
lea eax, [ebp - 0x28]
push ecx
push eax
call fcn.00428726
pop ecx
pop ecx
test eax, eax
je 0x412cc3
push ebx
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 4
call fcn.0040329c
mov esi, dword [ebp - 0x94]
push dword [ebp - 0x84]
mov eax, edi
call fcn.00417560
push dword [eax + 0x74]
mov eax, esi
call fcn.004174cd
cmp dword [eax + 0x14], ebx
je 0x412bb1
push dword [ebp - 0x84]
mov eax, edi
call fcn.00417560
push dword [eax + 0x74]
mov eax, esi
call fcn.004174cd
push eax
lea ecx, [ebp - 0x48]
call fcn.00402e94
mov byte [ebp - 4], 0xf
mov eax, dword [ebp - 0x34]
cmp eax, ebx
je 0x412b20
lea edi, [eax - 1]
lea eax, [ebp - 0x48]
call fcn.00408121
cmp byte [eax], 0x5c
je 0x412b20
xor ebx, ebx
push 0x5c
inc ebx
lea edi, [ebp - 0x48]
call fcn.0040842d
xor ebx, ebx
mov edi, dword [ebp - 0x9c]
push dword [ebp - 0x84]
mov eax, edi
call fcn.00417560
push 0xffffffffffffffff
add eax, 0x3c
push ebx
lea esi, [ebp - 0x48]
call fcn.00408389
mov eax, dword [ebp - 0xa0]
push 0x10
pop esi
cmp dword [eax + 0x18], esi
jb 0x412b54
mov eax, dword [eax + 4]
jmp 0x412b57
add eax, 4
mov ecx, dword [ebp - 0x44]
cmp dword [ebp - 0x30], esi
jae 0x412b62
lea ecx, [ebp - 0x44]
push eax
push ecx
call fcn.00428726
pop ecx
pop ecx
test eax, eax
je 0x412cde
cmp dword [ebp - 0xa4], ebx
je 0x412ba2
mov ecx, dword [ebp - 0x60]
cmp dword [ebp - 0x4c], esi
jae 0x412b86
lea ecx, [ebp - 0x60]
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x30], esi
jae 0x412b91
lea eax, [ebp - 0x44]
push ecx
push eax
call fcn.00428726
pop ecx
pop ecx
test eax, eax
je 0x412ce3
push ebx
push 1
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 4
call fcn.0040329c
mov eax, dword [edi + 0x10]
sub eax, dword [edi + 0xc]
mov ecx, 0x8c
cdq
idiv ecx
inc dword [ebp - 0x84]
cmp dword [ebp - 0x84], eax
jb 0x412973
mov eax, dword [edi + 0x10]
sub eax, dword [edi + 0xc]
mov ecx, 0x8c
cdq
idiv ecx
mov dword [ebp - 0x84], ebx
test eax, eax
jbe 0x412fc9
push 4
pop esi
push dword [ebp - 0x84]
mov eax, edi
call fcn.00417560
add eax, 0x58
cmp dword [eax + 0x14], ebx
je 0x412fa9
push ebx
call fcn.0042a13f
pop ecx
mov dword [ebp - 4], esi
push dword [ebp - 0x84]
mov eax, edi
call fcn.00417560
sub esp, 0x1c
add eax, 0x58
mov ecx, esp
mov dword [ebp - 0x94], esp
push eax
call fcn.00402e94
push dword [ebp - 0x8c]
call fcn.0040de4a
mov dword [ebp - 0x94], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
dec eax
dec eax
je 0x412c57
dec eax
dec eax
je 0x412c57
sub eax, esi
jne 0x412c62
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], esi
cmp dword [ebp - 0x94], ebx
jl 0x412fa9
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax + 0x17c]
cmp eax, ebx
je 0x412d8b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x94], eax
call fcn.004094e1
dec eax
jne 0x412ca4
call fcn.0040b77d
call fcn.004017c3
call fcn.00428e21
cdq
push 0x14
pop ecx
idiv ecx
mov edi, edx
inc edi
call fcn.00428e21
cdq
idiv edi
cmp edx, edi
jle 0x412d02
xor edx, edx
inc edx
jmp 0x412d07
lea ecx, [ebp - 0x2c]
push ebx
push 1
call fcn.0040329c
push ebx
push 1
lea ecx, [ebp - 0x64]
call fcn.0040329c
jmp 0x412755
lea ecx, [ebp - 0x48]
jmp 0x412cc6
push ebx
push 1
lea ecx, [ebp - 0x48]
call fcn.0040329c
xor esi, esi
push ebx
push 1
lea ecx, [ebp - 0x64]
call fcn.0040329c
mov eax, esi
jmp 0x412690
mov eax, edi
cdq
idiv edi
mov eax, edx
dec eax
jne 0x412d16
call fcn.0040b802
call fcn.0040b845
cmp dword [ebp - 0x94], ebx
je 0x412fd3
mov eax, dword [ebp - 0x8c]
mov dword [eax + 0x17c], ebx
call fcn.004094e1
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push ebx
shr edi, 0x18
call fcn.0042a13f
imul eax, eax, 0x63
pop ecx
cmp edi, eax
jbe 0x412d5a
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call fcn.004017c3
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
dec eax
dec eax
je 0x412d77
dec eax
dec eax
je 0x412d77
sub eax, esi
jne 0x412d8b
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableA]
call fcn.0040b93d
call fcn.0040ba35
mov eax, dword [ebp - 0x8c]
add eax, 0x180
cmp dword [eax + 0x18], 0x10
jb 0x412da1
mov eax, dword [eax + 4]
jmp 0x412da4
add eax, 4
push eax
push ebx
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov ecx, dword [ebp - 0x8c]
mov dword [ecx + 0x17c], eax
cmp eax, ebx
jne 0x413055
mov dword [ebp - 0x20], ebx
xor eax, eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push ebx
shr esi, 0x18
call fcn.0042a13f
imul eax, eax, 0x63
pop ecx
cmp esi, eax
jbe 0x412df5
push ebx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
call fcn.00409b8b
push 0x40
lea eax, [ebp - 0x1d4]
push ebx
push eax
mov dword [ebp - 0x1d8], ebx
call fcn.00431170
xor eax, eax
add esp, 0xc
mov word [ebp - 0x1a8], ax
lea eax, [ebp - 0xdc]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x94], esp
push 3
push 0x448880
mov dword [ebp - 0x1ac], 1
call fcn.0040801d
lea edi, [ebp - 0x18c]
call fcn.00426ea5
mov byte [ebp - 4], 0x1a
call fcn.0042700a
mov byte [ebp - 4], 0x1b
cmp dword [eax + 0x18], 0x10
jb 0x412e61
mov eax, dword [eax + 4]
jmp 0x412e64
add eax, 4
push eax
mov eax, dword [ebp - 0x9c]
push ecx
push dword [ebp - 0x84]
call fcn.00417560
add eax, 0x58
add esp, 4
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.00419421
add esp, 0xc
push ebx
push 1
lea ecx, [ebp - 0xdc]
call fcn.0040329c
lea esi, [ebp - 0x18c]
mov byte [ebp - 4], 0x1e
call fcn.00417161
cmp dword [ebp - 0x68], 0x10
mov eax, dword [ebp - 0x7c]
jae 0x412eb3
lea eax, [ebp - 0x7c]
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x1d8]
push ecx
push ebx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0x2710
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, eax
cmp edi, 0x102
jne 0x413097
push dword [ebp - 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x1c]
call esi
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [ebp - 0x8c]
call fcn.0040e82c
cmp dword [ebp - 0x68], 0x10
mov eax, dword [ebp - 0x7c]
jae 0x412f1e
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0xc0]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x94], esp
push 0x22
push 0x4488b4
call fcn.0040801d
lea edi, [ebp - 0x134]
call fcn.00426ea5
mov byte [ebp - 4], 0x23
call fcn.00426f82
mov byte [ebp - 4], 0x24
cmp dword [eax + 0x18], 0x10
jb 0x412f60
mov eax, dword [eax + 4]
jmp 0x412f63
add eax, 4
mov ebx, dword [ebp - 0x8c]
push eax
push 1
call fcn.0040e8e1
add esp, 0xc
push 0
push 1
lea ecx, [ebp - 0xc0]
call fcn.0040329c
lea esi, [ebp - 0x134]
call fcn.00417161
push 0
push 1
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 4
call fcn.0040329c
mov edi, dword [ebp - 0x9c]
push 4
xor ebx, ebx
pop esi
mov eax, dword [edi + 0x10]
sub eax, dword [edi + 0xc]
mov ecx, 0x8c
cdq
idiv ecx
inc dword [ebp - 0x84]
cmp dword [ebp - 0x84], eax
jb 0x412bf0
mov esi, 0x80004005
jmp 0x412cf0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0xc0]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x94], esp
push 0x26
push 0x448830
call fcn.0040801d
lea edi, [ebp - 0x134]
call fcn.00426ea5
mov byte [ebp - 4], 0x14
call fcn.00426f82
mov byte [ebp - 4], 0x15
cmp dword [eax + 0x18], 0x10
jb 0x41301b
mov eax, dword [eax + 4]
jmp 0x41301e
add eax, 4
mov ebx, dword [ebp - 0x8c]
push eax
push 1
call fcn.0040e8e1
add esp, 0xc
push 0
push 1
lea ecx, [ebp - 0xc0]
call fcn.0040329c
lea esi, [ebp - 0x134]
call fcn.00417161
mov esi, 0x80004005
xor ebx, ebx
jmp 0x412cf0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0xc0]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x94], esp
push 0x25
push 0x448858
call fcn.0040801d
lea edi, [ebp - 0x134]
call fcn.00426ea5
mov byte [ebp - 4], 0x18
call fcn.00426f18
mov byte [ebp - 4], 0x19
jmp 0x413010
push ebx
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
call fcn.00428e21
cdq
push 0x14
pop ecx
idiv ecx
mov esi, edx
inc esi
call fcn.00428e21
cdq
idiv esi
cmp edx, esi
jg 0x4130c4
mov eax, esi
cdq
idiv esi
cmp edx, ebx
je 0x4130ce
call fcn.0040cb42
call fcn.0040ba7e
push dword [ebp - 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
mov dword [ebp - 4], 0x1e
push dword [ebp - 0x1c]
call esi
push edi
lea eax, [ebp - 0xc0]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x94], esp
push 0x2f
push str.3DRTSN
call fcn.0040801d
lea edi, [ebp - 0x134]
call fcn.00426ea5
mov ecx, eax
mov byte [ebp - 4], 0x21
call fcn.004270be
mov byte [ebp - 4], 0x22
cmp dword [eax + 0x18], 0x10
jb 0x413129
mov eax, dword [eax + 4]
jmp 0x41312c
add eax, 4
mov ebx, dword [ebp - 0x8c]
push eax
push 1
call fcn.0040e8e1
add esp, 0xc
push 0
push 1
lea ecx, [ebp - 0xc0]
call fcn.0040329c
lea esi, [ebp - 0x134]
call fcn.00417161
push 0
push 1
lea ecx, [ebp - 0x80]
call fcn.0040329c
jmp 0x413049