Function at 0x42abf0
Capabilities:
Delete file
Set registry value
Set uefi variable

Disassembly:
push 0xffffffffffffffff
push 0x44e7d1
mov eax, dword fs:[0]
push eax
sub esp, 0x84
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x80], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4612b0]
xor eax, esp
push eax
lea eax, [esp + 0x98]
mov dword fs:[0], eax
mov eax, dword [esp + 0xa8]
mov dword [esp + 0x18], eax
mov dword [esp + 0xa0], 2
call fcn.00417970
test eax, eax
je 0x42ac4f
call fcn.0041a8f0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, 2
je 0x42ac70
sub eax, 2
je 0x42ac70
sub eax, 4
je 0x42ac70
xor ecx, ecx
jmp 0x42ac83
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableA]
mov ecx, 1
mov eax, 0xa16b312f
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp ecx, 0xcb
jle 0x42acb3
push 0xcb
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.0041b0f0
call fcn.00431240
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push 0
shr esi, 0x18
call fcn.0043af41
imul eax, eax, 0x63
add esp, 4
cmp esi, eax
jbe 0x42acdc
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.0041b160
call fcn.00417740
test eax, eax
je 0x42acea
call fcn.0041b230
mov eax, dword [esp + 0xb0]
mov ebx, 0x10
cmp dword [esp + 0xc4], ebx
jae 0x42ad06
lea eax, [esp + 0xb0]
lea edx, [esp + 0x14]
push edx
push 0xf003f
push 0
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebp, eax
cmp ebp, 2
jne 0x42ae9d
mov eax, dword [esp + 0xb0]
cmp dword [esp + 0xc4], ebx
jae 0x42ad40
lea eax, [esp + 0xb0]
push 0
lea ecx, [esp + 0x18]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov ebp, eax
mov eax, dword [esp + 0xb0]
cmp dword [esp + 0xc4], ebx
jae 0x42ad79
lea eax, [esp + 0xb0]
push eax
push closesocket
lea edx, [esp + 0x28]
push edx
sub esp, 0x1c
mov esi, esp
mov dword [esi + 0x18], 0xf
lea edi, [esi + 4]
mov dword [esi + 0x14], 0
mov byte [edi], 0
mov eax, dword [esi + 0x18]
mov dword [esp + 0x44], esp
cmp eax, ebx
jb 0x42adac
mov ecx, dword [edi]
jmp 0x42adae
mov ecx, edi
cmp ecx, 0x457ac4
ja 0x42ade7
cmp eax, ebx
jb 0x42adbe
mov ecx, dword [edi]
jmp 0x42adc0
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x457ac4
jbe 0x42ade7
cmp eax, ebx
jb 0x42add3
mov edi, dword [edi]
push 0x38
mov eax, 0x457ac4
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402be0
jmp 0x42ae29
cmp eax, 0x38
jae 0x42adf9
mov ecx, dword [esi + 0x14]
push ecx
push 0x38
mov ecx, esi
call fcn.00403340
mov ecx, dword [esi + 0x18]
cmp ecx, ebx
jb 0x42ae04
mov eax, dword [edi]
jmp 0x42ae06
mov eax, edi
push 0x38
push 0x457ac4
push ecx
push eax
call fcn.00439ca9
add esp, 0x10
mov dword [esi + 0x14], 0x38
cmp dword [esi + 0x18], ebx
jb 0x42ae25
mov edi, dword [edi]
mov byte [edi + 0x38], 0
lea esi, [esp + 0x64]
call fcn.004014e0
mov byte [esp + 0xac], 3
call fcn.004016a0
mov byte [esp + 0xa8], 4
cmp dword [eax + 0x18], ebx
jb 0x42ae51
mov eax, dword [eax + 4]
jmp 0x42ae54
add eax, 4
mov edx, dword [esp + 0x20]
push eax
push 1
push edx
call fcn.0041da70
add esp, 0x14
cmp dword [esp + 0x38], ebx
jb 0x42ae77
mov eax, dword [esp + 0x24]
push eax
call fcn.00439c49
add esp, 4
lea esi, [esp + 0x3c]
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], 0
mov byte [esp + 0x24], 0
mov byte [esp + 0xa0], 2
call fcn.004037a0
cmp ebp, 5
jne 0x42afda
mov eax, dword [esp + 0xb0]
cmp dword [esp + 0xc4], ebx
jae 0x42aebd
lea eax, [esp + 0xb0]
push eax
push closesocket
lea ecx, [esp + 0x28]
push ecx
sub esp, 0x1c
mov esi, esp
xor ebp, ebp
mov dword [esi + 0x18], 0xf
lea edi, [esi + 4]
mov dword [esi + 0x14], ebp
mov byte [edi], 0
mov eax, dword [esi + 0x18]
mov dword [esp + 0x44], esp
cmp eax, ebx
jb 0x42aeee
mov ecx, dword [edi]
jmp 0x42aef0
mov ecx, edi
cmp ecx, 0x457b00
ja 0x42af29
cmp eax, ebx
jb 0x42af00
mov ecx, dword [edi]
jmp 0x42af02
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x457b00
jbe 0x42af29
cmp eax, ebx
jb 0x42af15
mov edi, dword [edi]
push 0x3b
mov eax, 0x457b00
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402be0
jmp 0x42af6b
cmp eax, 0x3b
jae 0x42af3b
mov ecx, dword [esi + 0x14]
push ecx
push 0x3b
mov ecx, esi
call fcn.00403340
mov ecx, dword [esi + 0x18]
cmp ecx, ebx
jb 0x42af46
mov eax, dword [edi]
jmp 0x42af48
mov eax, edi
push 0x3b
push 0x457b00
push ecx
push eax
call fcn.00439ca9
add esp, 0x10
mov dword [esi + 0x14], 0x3b
cmp dword [esi + 0x18], ebx
jb 0x42af67
mov edi, dword [edi]
mov byte [edi + 0x3b], 0
lea esi, [esp + 0x64]
call fcn.004014e0
mov ecx, eax
mov byte [esp + 0xac], 5
call fcn.00401760
mov byte [esp + 0xa8], 6
cmp dword [eax + 0x18], ebx
jb 0x42af95
mov eax, dword [eax + 4]
jmp 0x42af98
add eax, 4
mov edx, dword [esp + 0x20]
push eax
push 1
push edx
call fcn.0041da70
add esp, 0x14
cmp dword [esp + 0x38], ebx
jb 0x42afbb
mov eax, dword [esp + 0x24]
push eax
call fcn.00439c49
add esp, 4
lea esi, [esp + 0x3c]
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], ebp
mov byte [esp + 0x24], 0
call fcn.004037a0
jmp 0x42b1fb
test ebp, ebp
je 0x42b167
call fcn.004176e0
test eax, eax
je 0x42aff0
call fcn.0041b2e0
mov eax, dword [esp + 0xb0]
cmp dword [esp + 0xc4], ebx
jae 0x42b007
lea eax, [esp + 0xb0]
push eax
push closesocket
push ebp
sub esp, 0x1c
mov esi, esp
mov dword [esi + 0x18], 0xf
lea edi, [esi + 4]
mov dword [esi + 0x14], 0
mov byte [edi], 0
mov eax, dword [esi + 0x18]
lea ebp, [esp + 0x48]
mov dword [esp + 0x44], esp
cmp eax, ebx
jb 0x42b03a
mov ecx, dword [edi]
jmp 0x42b03c
mov ecx, edi
cmp ecx, str._DRTSN
ja 0x42b075
cmp eax, ebx
jb 0x42b04c
mov ecx, dword [edi]
jmp 0x42b04e
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, str._DRTSN
jbe 0x42b075
cmp eax, ebx
jb 0x42b061
mov edi, dword [edi]
push 0x3e
mov eax, str._DRTSN
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402be0
jmp 0x42b0b7
cmp eax, 0x3e
jae 0x42b087
mov ecx, dword [esi + 0x14]
push ecx
push 0x3e
mov ecx, esi
call fcn.00403340
mov ecx, dword [esi + 0x18]
cmp ecx, ebx
jb 0x42b092
mov eax, dword [edi]
jmp 0x42b094
mov eax, edi
push 0x3e
push str._DRTSN
push ecx
push eax
call fcn.00439ca9
add esp, 0x10
mov dword [esi + 0x14], 0x3e
cmp dword [esi + 0x18], ebx
jb 0x42b0b3
mov edi, dword [edi]
mov byte [edi + 0x3e], 0
lea esi, [esp + 0x64]
call fcn.004014e0
mov edx, ebp
mov ecx, eax
mov byte [esp + 0xac], 7
call fcn.00401a80
mov byte [esp + 0xac], 8
cmp dword [eax + 0x18], ebx
jb 0x42b0e3
mov eax, dword [eax + 4]
jmp 0x42b0e6
add eax, 4
mov edx, dword [esp + 0x24]
push eax
push 1
push edx
call fcn.0041da70
add esp, 0x18
cmp dword [esp + 0x38], ebx
jb 0x42b109
mov eax, dword [esp + 0x24]
push eax
call fcn.00439c49
add esp, 4
lea esi, [esp + 0x3c]
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], 0
mov byte [esp + 0x24], 0
mov byte [esp + 0xa0], 2
call fcn.004037a0
call fcn.00417bd0
mov ecx, eax
mov eax, 0x30c30c31
imul ecx
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp ecx, 0x15
jle 0x42b1fb
push 0x15
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00431240
call fcn.0041a8a0
jmp 0x42b1fb
mov edx, dword [esp + 0x14]
test edx, edx
je 0x42b20a
mov ecx, dword [esp + 0xe8]
cmp dword [esp + 0xfc], ebx
jae 0x42b18a
lea ecx, [esp + 0xe8]
mov eax, dword [esp + 0xcc]
cmp dword [esp + 0xe0], ebx
jae 0x42b1a1
lea eax, [esp + 0xcc]
mov esi, dword [esp + 0xf8]
push esi
push ecx
push 1
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x42b1fb
call fcn.004179d0
mov ecx, eax
mov eax, 0x19c2d14f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 0x13e
jle 0x42b1fb
push 0x13e
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.USER32.dll_GetActiveWindow]
call dword [sym.imp.USER32.dll_GetCapture]
call dword [sym.imp.USER32.dll_GetClipboardOwner]
call fcn.00401350
mov eax, dword [esp + 0x14]
test eax, eax
je 0x42b20a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0xc4], ebx
jb 0x42b223
mov ecx, dword [esp + 0xb0]
push ecx
call fcn.00439c49
add esp, 4
mov esi, 0xf
mov dword [esp + 0xc4], esi
mov dword [esp + 0xc0], 0
mov byte [esp + 0xb0], 0
cmp dword [esp + 0xe0], ebx
jb 0x42b25b
mov edx, dword [esp + 0xcc]
push edx
call fcn.00439c49
add esp, 4
mov dword [esp + 0xe0], esi
mov dword [esp + 0xdc], 0
mov byte [esp + 0xcc], 0
cmp dword [esp + 0xfc], ebx
jb 0x42b28e
mov eax, dword [esp + 0xe8]
push eax
call fcn.00439c49
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x98]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.00439641
add esp, 0x90
ret 0x58