Function at 0x40de4a
Capabilities:
Create process on windows
Set uefi variable
Terminate process

Disassembly:
push 0x1e4
mov eax, 0x43e08f
call fcn.0042b376
mov eax, dword [ebp + 8]
mov dword [ebp - 0xa8], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
xor eax, eax
mov dword [ebp - 0xbc], ebx
lea edi, [ebp - 0xb8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x40
stosd dword es:[edi], eax
lea eax, [ebp - 0x13c]
push ebx
push eax
mov dword [ebp - 0xac], 0x80004005
mov dword [ebp - 0x140], ebx
call fcn.00431170
add esp, 0xc
push ebx
mov dword [ebp - 0x114], 1
call fcn.0042a13f
pop ecx
xor eax, eax
push ebx
mov word [ebp - 0x110], ax
call fcn.0042a13f
pop ecx
push ebx
call fcn.0042a13f
pop ecx
mov dword [ebp - 0xa4], ebx
call fcn.00428e21
cdq
push 0x64
pop ecx
idiv ecx
push 0x63
push ebx
mov byte [ebp - 0x78], bl
mov esi, edx
inc esi
mov eax, esi
imul eax, eax, 5
add eax, 0x15
mov dword [ebp - 0xa0], eax
lea eax, [ebp - 0x77]
push eax
call fcn.00431170
add esp, 0xc
push esi
lea eax, [ebp - 0xf4]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x9c], esp
push 2
push 0x448048
call fcn.0040801d
lea edi, [ebp - 0x1f0]
call fcn.00426ea5
mov byte [ebp - 4], 1
call fcn.00426f82
cmp dword [eax + 0x18], 0x10
jb 0x40df34
mov eax, dword [eax + 4]
jmp 0x40df37
add eax, 4
push eax
lea eax, [ebp - 0x78]
push 0x64
push eax
call fcn.0042a272
add esp, 0x10
push ebx
push 1
lea ecx, [ebp - 0xf4]
call fcn.0040329c
lea esi, [ebp - 0x1f0]
mov byte [ebp - 4], bl
call fcn.00417161
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push ebx
mov esi, eax
call fcn.0042a13f
mov dword [ebp - 0x9c], esi
fild dword [ebp - 0x9c]
pop ecx
mov edi, eax
test esi, esi
jge 0x40df89
fadd qword [0x44a9c8]
call fcn.00438ef0
mov dword [ebp - 0x9c], edi
fild dword [ebp - 0x9c]
test edi, edi
jge 0x40dfa4
fadd qword [0x44a9c8]
fcompp
fnstsw ax
test ah, 5
jp 0x40dfbd
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
call fcn.004017c3
lea eax, [ebp - 0xf4]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x9c], esp
push 4
push 0x44804c
call fcn.0040801d
lea edi, [ebp - 0x1f0]
call fcn.00426ea5
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.00427269
mov byte [ebp - 4], 3
cmp dword [eax + 0x18], 0x10
jb 0x40e000
mov eax, dword [eax + 4]
jmp 0x40e003
add eax, 4
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x94]
push eax
call fcn.00419421
add esp, 0xc
push ebx
push 1
lea ecx, [ebp - 0xf4]
call fcn.0040329c
lea esi, [ebp - 0x1f0]
mov byte [ebp - 4], 6
call fcn.00417161
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x94]
push eax
call fcn.004080db
lea eax, [ebp - 0x95]
mov byte [ebp - 0x95], bl
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40e053
sub eax, esi
je 0x40e068
call fcn.00409b8b
call fcn.0040c1a4
cmp dword [ebp - 0x7c], 0x10
mov eax, dword [ebp - 0x90]
jae 0x40e07a
lea eax, [ebp - 0x90]
lea ecx, [ebp - 0xbc]
push ecx
lea ecx, [ebp - 0x140]
push ecx
push ebx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edi, eax
lea eax, [ebp - 0x95]
mov byte [ebp - 0x95], bl
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40e0ab
sub eax, esi
je 0x40e0bb
call fcn.0040cb42
cmp edi, ebx
jne 0x40e190
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0xd8]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x9c], esp
push 0x2d
push str._WRUH
call fcn.0040801d
lea edi, [ebp - 0x198]
call fcn.00426ea5
mov ecx, eax
mov byte [ebp - 4], 7
call fcn.004270be
mov byte [ebp - 4], 8
cmp dword [eax + 0x18], 0x10
jb 0x40e10d
mov eax, dword [eax + 4]
jmp 0x40e110
add eax, 4
mov ebx, dword [ebp - 0xa8]
push eax
push 1
call fcn.0040e8e1
add esp, 0xc
xor ebx, ebx
push ebx
push 1
lea ecx, [ebp - 0xd8]
call fcn.0040329c
lea esi, [ebp - 0x198]
call fcn.00417161
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
mov esi, eax
push ebx
shr esi, 0x18
call fcn.0042a13f
imul eax, eax, 0x63
pop ecx
cmp esi, eax
jbe 0x40e161
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableA]
call edi
mov esi, eax
sub esi, 0x7ff90000
xor ebx, ebx
push ebx
push 1
lea ecx, [ebp - 0x94]
call fcn.0040329c
push ebx
push 1
lea ecx, [ebp + 0xc]
call fcn.0040329c
mov eax, esi
call fcn.0042b3f9
ret 0x20
push 0x1388
push dword [ebp - 0xbc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0xa4], eax
cmp eax, 0x102
jne 0x40e284
lea eax, [ebp - 0xd8]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x9c], esp
push 0x20
push 0x448084
call fcn.0040801d
lea edi, [ebp - 0x198]
call fcn.00426ea5
mov byte [ebp - 4], 0xb
call fcn.0042700a
mov byte [ebp - 4], 0xc
cmp dword [eax + 0x18], 0x10
jb 0x40e1f3
mov eax, dword [eax + 4]
jmp 0x40e1f6
add eax, 4
mov ebx, dword [ebp - 0xa8]
push eax
push 1
call fcn.0040e8e1
pop ecx
pop ecx
xor ebx, ebx
push ebx
push 1
lea ecx, [ebp - 0xd8]
call fcn.0040329c
lea esi, [ebp - 0x198]
mov byte [ebp - 4], 6
call fcn.00417161
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push ebx
shr esi, 0x18
call fcn.0042a13f
imul eax, eax, 0x63
pop ecx
cmp esi, eax
jbe 0x40e24a
push ebx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
call fcn.0040cb42
push ebx
push dword [ebp - 0xbc]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea eax, [ebp - 0x95]
mov byte [ebp - 0x95], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40e266
sub eax, edx
je 0x40e364
call fcn.0040c1a4
call fcn.00409c09
jmp 0x40e364
lea eax, [ebp - 0xa4]
push eax
push dword [ebp - 0xbc]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x40e366
mov eax, dword [ebp - 0xa4]
cmp eax, dword [ebp - 0xa0]
jne 0x40e2b8
mov dword [ebp - 0xac], ebx
jmp 0x40e366
push eax
lea eax, [ebp - 0xd8]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x9c], esp
push 0x1a
push 0x4480a8
call fcn.0040801d
lea edi, [ebp - 0x198]
call fcn.00426ea5
mov byte [ebp - 4], 0xd
call fcn.00426f82
mov byte [ebp - 4], 0xe
cmp dword [eax + 0x18], 0x10
jb 0x40e2fa
mov eax, dword [eax + 4]
jmp 0x40e2fd
add eax, 4
mov ebx, dword [ebp - 0xa8]
push eax
push 1
call fcn.0040e8e1
add esp, 0xc
xor edi, edi
push edi
push 1
lea ecx, [ebp - 0xd8]
call fcn.0040329c
lea esi, [ebp - 0x198]
call fcn.00417161
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push edi
shr esi, 0x18
call fcn.0042a13f
imul eax, eax, 0x63
pop ecx
cmp esi, eax
jbe 0x40e352
push edi
push edi
push edi
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call fcn.00409c8e
call fcn.004094e1
dec eax
jne 0x40e364
call fcn.00409cff
call fcn.0040cb42
xor ebx, ebx
push dword [ebp - 0xbc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
call fcn.00428e21
call fcn.00428e21
push dword [ebp - 0xb8]
call esi
mov esi, dword [ebp - 0xac]
jmp 0x40e16d