Function at 0x405655
Capabilities:
Contain obfuscated stackstrings
Get file attributes
Get geographical location
Set uefi variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa58
push ebx
push esi
xor esi, esi
cmp dword [0x2c197dc], 0x16
push edi
jne 0x4056e2
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push esi
lea eax, [ebp - 4]
push eax
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WriteConsoleA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateJobObject]
push esi
call dword [sym.imp.KERNEL32.dll_FindVolumeMountPointClose]
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
push 0x929
push 0xea
call fcn.0040621d
push esi
push esi
call fcn.00406321
push esi
call fcn.004065f7
add esp, 0xc
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.004052b6
fstp st(0)
push ecx
push ecx
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.00405293
fstp st(0)
push esi
call fcn.0040667b
pop ecx
cmp dword [0x2c197dc], 0xc
jne 0x405738
push esi
lea eax, [ebp - 0xa58]
push eax
push esi
push 0x404fb8
push esi
call dword [sym.imp.KERNEL32.dll_FoldStringW]
push esi
call fcn.00406851
push ecx
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.00405270
fstp st(0)
lea ecx, [ebp - 0x118]
call fcn.004060a5
lea ecx, [ebp - 0x118]
call fcn.004060b6
push esi
call fcn.00406665
pop ecx
push esi
call fcn.00406b6d
push 0x404fd0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push dword [0x2c197dc]
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push esi
mov dword [0x2c18ddc], eax
call ebx
mov dword [0x2c18dd8], eax
call fcn.004055ab
xor edi, edi
cmp dword [0x2c197dc], esi
jbe 0x4057ab
mov eax, dword [0x2c197e0]
mov al, byte [eax + edi + 0xb2d3b]
mov ecx, dword [0x2c18dd8]
mov byte [ecx + edi], al
cmp dword [0x2c197dc], 0x292
jne 0x4057a2
push 0x404fe0
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
inc edi
cmp edi, dword [0x2c197dc]
jb 0x40576b
xor edi, edi
mov eax, dword [0x2c197dc]
add eax, edi
cmp eax, 0x5e
jne 0x4057dd
push esi
lea eax, [ebp - 0xa58]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LCMapStringW]
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthW]
push 0x404ff0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc edi
cmp edi, 0x40c893
jl 0x4057ad
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp edi, 0x12070ad
jge 0x405f7e
mov dword [ebp - 0x58], 0x31732346
mov dword [ebp - 0x50], 0x7799a07f
mov dword [ebp - 0x64], 0x246dfe47
mov dword [ebp - 0xdc], 0x73ed798b
mov dword [ebp - 0xd8], 0x33008a28
mov dword [ebp - 0x48], 0xd9339e8
mov dword [ebp - 0xd0], 0x26ce5fca
mov dword [ebp - 0x84], 0x6c11980e
mov dword [ebp - 0x78], 0x69a124a5
mov dword [ebp - 0xc], 0x405692b1
mov dword [ebp - 4], 0x6ab4d175
mov dword [ebp - 8], 0xe50d09b
mov dword [ebp - 0xc8], 0x3e2fd81
mov dword [ebp - 0x54], 0x5f178d18
mov dword [ebp - 0x6c], 0x4faa6f3
mov dword [ebp - 0x70], 0x1106e7c4
mov dword [ebp - 0x40], 0x2f8b9767
mov dword [ebp - 0x3c], 0x3c453da1
mov dword [ebp - 0xcc], 0x97e2adf
mov dword [ebp - 0x38], 0x7b448142
mov dword [ebp - 0x30], 0x30e82783
mov dword [ebp - 0xfc], 0x39d9d960
mov dword [ebp - 0xf8], 0x1e4bf5b2
mov dword [ebp - 0x28], 0x17e6e2ff
mov dword [ebp - 0x7c], 0x4f218548
mov dword [ebp - 0x34], 0x3cfea964
mov dword [ebp - 0xc0], 0x69135918
mov dword [ebp - 0x98], 0x7251e604
mov dword [ebp - 0x24], 0x6e840f7e
mov dword [ebp - 0xbc], 0x21ea3115
mov dword [ebp - 0x14], 0x5cb355ce
mov dword [ebp - 0x104], 0x29f77811
mov dword [ebp - 0xa8], 0xfd82b4f
mov dword [ebp - 0xb8], 0x4f65f6d9
mov dword [ebp - 0x68], 0x388ee7b2
mov dword [ebp - 0x8c], 0x4e5e6ac7
mov dword [ebp - 0x90], 0x3c126acc
mov dword [ebp - 0x94], 0x60bfe4bf
mov dword [ebp - 0x9c], 0x4df7a890
mov dword [ebp - 0x1c], 0x5fefadbc
mov dword [ebp - 0x88], 0x2c85954b
mov dword [ebp - 0xb4], 0x649f867e
mov dword [ebp - 0x4c], 0x5bf03806
mov dword [ebp - 0x80], 0x3a5e56e7
mov dword [ebp - 0xb0], 0x168935d1
mov dword [ebp - 0xf0], 0x2fd0d9d8
mov dword [ebp - 0xec], 0x54d8bcb1
mov dword [ebp - 0xa4], 0x766193cd
mov dword [ebp - 0x74], 0xa761634
mov dword [ebp - 0x5c], 0x3f943eed
mov dword [ebp - 0xe4], 0x5b16df01
mov dword [ebp - 0x20], 0x596186da
mov dword [ebp - 0x10c], 0x199779ef
mov dword [ebp - 0x44], 0x2eae1e4f
mov dword [ebp - 0x108], 0x7e3d12bf
mov dword [ebp - 0xac], 0x70423121
mov dword [ebp - 0x2c], 0x8843f06
mov dword [ebp - 0xe8], 0x576a6324
mov dword [ebp - 0x60], 0x13ae10fd
mov dword [ebp - 0x100], 0x2cc78849
mov dword [ebp - 0x18], 0x53472f83
mov dword [ebp - 0xe0], 0x7ccb8978
mov dword [ebp - 0xc4], 0x714f6876
mov dword [ebp - 0xf4], 0x1b29566a
mov dword [ebp - 0xa0], 0x5d415b5e
mov dword [ebp - 0x10], 0x1973daa5
mov dword [ebp - 0xd4], 0x747eca6c
mov eax, 0x546ad8fc
mul dword [ebp - 0x58]
mov eax, dword [ebp - 0x58]
add dword [ebp - 0x50], 0x2cd88f62
mov eax, 0x63231926
mul dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
add dword [ebp - 0x64], 0x4129c379
sub dword [ebp - 0x58], 0x794bf704
sub dword [ebp - 0xdc], 0x69b7b104
mov eax, 0x79c397c4
mul dword [ebp - 0x64]
mov eax, dword [ebp - 0x64]
mov eax, 0x18b498da
mul dword [ebp - 0xdc]
mov eax, dword [ebp - 0xdc]
mov eax, 0x6dab39f7
mul dword [ebp - 0x58]
mov eax, dword [ebp - 0x58]
mov eax, 0x6654cdcd
mul dword [ebp - 0x64]
mov eax, dword [ebp - 0x64]
mov eax, 0x1fe79e40
mul dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
sub dword [ebp - 0x64], 0x77dd1824
sub dword [ebp - 0x50], 0xf7aa296
add dword [ebp - 0xd8], 0x5b822878
add dword [ebp - 0x58], 0x525e589b
sub dword [ebp - 0xd0], 0x5f4ae403
sub dword [ebp - 0x64], 0x4cb1e13f
mov eax, 0x19dcd33c
mul dword [ebp - 0xdc]
mov eax, dword [ebp - 0xdc]
sub dword [ebp - 0x48], 0xaa3e227
sub dword [ebp - 0xd0], 0x25fbb222
sub dword [ebp - 0x50], 0x486657ad
sub dword [ebp - 0x50], 0x4eff1b49
sub dword [ebp - 0xd8], 0x66d63bfc
add dword [ebp - 0xdc], 0x33308508
sub dword [ebp - 0x50], 0x433a53c6
mov eax, 0x5d2532e
mul dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
mov eax, 0x3ec338c8
mul dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
add dword [ebp - 0x64], 0x62b5e75d
mov eax, 0x2e393c7c
mul dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, 0x1d172e32
mul dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
add dword [ebp - 0x48], 0x7486862d
add dword [ebp - 8], 0x41ac9de9
add dword [ebp - 0x48], 0x3809fb2e
add dword [ebp - 0x58], 0x2616ca0
mov eax, 0x7b06f284
mul dword [ebp - 4]
mov eax, dword [ebp - 4]
sub dword [ebp - 0xc8], 0x57eba8eb
mov eax, 0x42c369a0
mul dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
add dword [ebp - 0xd0], 0x3ae9bf0f
add dword [ebp - 0xd0], 0x314e5b25
sub dword [ebp - 4], 0x148f3069
mov eax, 0x5f76a61f
mul dword [ebp - 8]
mov eax, dword [ebp - 8]
sub dword [ebp - 0x50], 0x7761f3f9
sub dword [ebp - 0x64], 0x6cfcc2b7
mov eax, 0x12c9bf7b
mul dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
sub dword [ebp - 0xd8], 0x36e7a064
add dword [ebp - 0x3c], 0x52c8e5e2
add dword [ebp - 0xd0], 0x31fddb72
add dword [ebp - 0x54], 0x4a86fe0
mov eax, 0x3ba2b62d
mul dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
sub dword [ebp - 0x84], 0x1dcd427a
add dword [ebp - 0x84], 0x5dca4ff5
mov eax, 0x6e3095c1
mul dword [ebp - 0x84]
mov eax, dword [ebp - 0x84]
mov eax, 0x676926a9
mul dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, 0x2450917c
mul dword [ebp - 0x84]
mov eax, dword [ebp - 0x84]
add dword [ebp - 0x6c], 0x597abbd7
add dword [ebp - 0x70], 0x5d5bbf57
sub dword [ebp - 0x78], 0x60635147
sub dword [ebp - 0x54], 0x6f6945fe
mov eax, 0x1cc165ae
mul dword [ebp - 0x84]
mov eax, dword [ebp - 0x84]
sub dword [ebp - 0x48], 0x7c5d522c
mov eax, 0x31ee1f9b
mul dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
add dword [ebp - 0xdc], 0x14800a00
sub dword [ebp - 0xcc], 0x609d7b4c
mov eax, 0x15897786
mul dword [ebp - 0xd0]
mov eax, dword [ebp - 0xd0]
add dword [ebp - 0x6c], 0x7bf8e3d9
mov eax, 0x7c647349
mul dword [ebp - 0x7c]
mov eax, dword [ebp - 0x7c]
mov eax, 0x7a72f2aa
mul dword [ebp - 0x104]
mov eax, dword [ebp - 0x104]
mov eax, 0x32cfa02
mul dword [ebp - 0xc8]
mov eax, dword [ebp - 0xc8]
mov eax, 0x3ce1d876
mul dword [ebp - 0x54]
mov eax, dword [ebp - 0x54]
mov eax, 0x72124c72
mul dword [ebp - 0xc8]
mov eax, dword [ebp - 0xc8]
mov eax, 0x570a0ea9
mul dword [ebp - 0xc8]
mov eax, dword [ebp - 0xc8]
add dword [ebp - 0x6c], 0x3814653e
add dword [ebp - 0xb8], 0x202c7fbf
mov eax, 0x5d9fc6e4
mul dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, 0x60a0dc0
mul dword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
sub dword [ebp - 0x3c], 0x3746e701
mov eax, 0x4b278059
mul dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
sub dword [ebp - 0x50], 0xbc33d3e
add dword [ebp - 0x40], 0x12390644
add dword [ebp - 0xfc], 0x162b4ebf
add dword [ebp - 0x34], 0x29f8ef75
add dword [ebp - 0x58], 0x29af1602
mov eax, 0x243a706e
mul dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
sub dword [ebp - 0x48], 0x2b0448f3
add dword [ebp - 0x54], 0x22a7fc54
sub dword [ebp - 0x1c], 0x7a10aec0
add dword [ebp - 0x38], 0x7ab28b81
mov eax, 0x7003a73e
mul dword [ebp - 0x84]
mov eax, dword [ebp - 0x84]
sub dword [ebp - 0x78], 0x2124a476
add dword [ebp - 0x50], 0xb3f147a
add dword [ebp - 0x88], 0x1d75e7e7
sub dword [ebp - 0x38], 0x7f19b086
sub dword [ebp - 0x98], 0x6cbc5395
mov eax, 0x7b6a7903
mul dword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
mov eax, 0x3d62cee6
mul dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, 0x2e0f9ffe
mul dword [ebp - 0xa4]
mov eax, dword [ebp - 0xa4]
mov eax, 0x4e4d67fe
mul dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
sub dword [ebp - 0x8c], 0x564afb46
mov eax, 0x15c6f5e3
mul dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, 0x4bec203
mul dword [ebp - 0x98]
mov eax, dword [ebp - 0x98]
sub dword [ebp - 0xa8], 0x627794ef
sub dword [ebp - 0x94], 0x568b4075
sub dword [ebp - 0xd8], 0x70a7614
add dword [ebp - 0x44], 0x6603ae8c
sub dword [ebp - 0xa8], 0x6b69729a
sub dword [ebp - 0x28], 0x28b0775c
add dword [ebp - 0xd8], 0x62f2ea4
mov eax, 0x62ae827f
mul dword [ebp - 0xfc]
mov eax, dword [ebp - 0xfc]
sub dword [ebp - 0x78], 0x6aa5e798
sub dword [ebp - 0x78], 0x52c1adef
add dword [ebp - 0x98], 0x1865986
mov eax, 0x55359278
mul dword [ebp - 0x9c]
mov eax, dword [ebp - 0x9c]
mov eax, 0x634816df
mul dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
sub dword [ebp - 0x58], 0x7aa3c724
add dword [ebp - 0x20], 0x5955f6f1
sub dword [ebp - 0xdc], 0x1530fe08
mov eax, 0xf7efb6d
mul dword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
add dword [ebp - 0x14], 0x379be39d
sub dword [ebp - 0x1c], 0x70eeec01
add dword [ebp - 0x54], 0x67db0962
mov eax, 0x2b40a27e
mul dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, 0x3204a400
mul dword [ebp - 0xdc]
mov eax, dword [ebp - 0xdc]
sub dword [ebp - 0x74], 0x150a6507
mov eax, 0x757e3ca0
mul dword [ebp - 0x88]
mov eax, dword [ebp - 0x88]
mov eax, 0x5cc147d0
mul dword [ebp - 0xbc]
mov eax, dword [ebp - 0xbc]
add dword [ebp - 0x64], 0x75d4399a
sub dword [ebp - 0x1c], 0x6de1d3f1
mov eax, 0x7f89465
mul dword [ebp - 0xb8]
mov eax, dword [ebp - 0xb8]
mov eax, 0x50d8ab57
mul dword [ebp - 0x88]
mov eax, dword [ebp - 0x88]
add dword [ebp - 0x2c], 0x1f3e7c4f
mov eax, 0x54e42247
mul dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
add dword [ebp - 0x94], 0x3622c9a3
mov eax, 0x3a1ffb0e
mul dword [ebp - 0xb0]
mov eax, dword [ebp - 0xb0]
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetGeoInfoW]
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
cmp edi, 0x11b19e2
jg 0x405fa4
inc edi
cmp edi, 0x16e9e2f4
jl 0x4057e8
call fcn.004054ba
xor ecx, ecx
cmp ecx, 0x770e
jne 0x405fb8
call fcn.00405591
inc ecx
cmp ecx, 0x286b97d
jl 0x405fab
push 0x7b
pop edi
cmp dword [0x2c197dc], 0xd
jne 0x405fe4
lea eax, [ebp - 0x658]
push eax
push esi
push 0x405004
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
push esi
push esi
call ebx
cmp dword [0x2c197dc], 0xf
jne 0x405ffd
push esi
push esi
lea eax, [ebp - 0xa58]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
dec edi
jne 0x405fc4
mov edi, 0x184cc
cmp dword [0x2c197dc], 0x1833b
jne 0x40605e
push 0x405034
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push 0x405044
call dword [sym.imp.KERNEL32.dll_SetComputerNameW]
push esi
push esi
push 0x405060
push 0x405080
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableA]
push esi
lea eax, [ebp - 0xa58]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesW]
push 0x4050a8
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0x4050c0
push esi
call dword [sym.imp.KERNEL32.dll_SetFileShortNameA]
dec edi
jne 0x406005
call fcn.004052d9
call dword [0x2c18dd8]
pop edi
pop esi
pop ebx
leave
ret