Function at 0x4284d0
Capabilities:
Get common file path
Get disk information
Get file size
Get hostname
Manipulate console buffer
Read .ini file
Set uefi variable
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x42d52b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x16f8
call fcn.00411f20
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProfileSectionA]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableW]
push esi
xor eax, eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetDefaultCommConfigW]
mov dword [esp + 0x10], eax
mov esi, dword [esp + 0x10]
cmp eax, 0x2cf6b
jge 0x42852d
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_CharToOemBuffA]
mov eax, dword [esp + 0x10]
cmp dword [0x7b980c], 0x6fb
jne 0x428581
push 0x30
lea eax, [esp + 0x4c]
push 0
push eax
mov dword [esp + 0x50], 0
call fcn.0040f440
add esp, 0xc
push esi
lea ecx, [esp + 0x48]
push ecx
push 0
call edi
push 0
lea edx, [esp + 0x30c]
push edx
push 0x403f14
call ebx
push 0
push 0
push 0x403fc0
push 0x404004
call ebp
mov eax, dword [esp + 0x10]
cmp eax, 0x1e7e0166
jle 0x42859c
cmp dword [esp + 0x10], 0xc0f00a
je 0x42859c
cmp dword [esp + 0x50], 0x92805e8
jne 0x4285ae
inc eax
mov dword [esp + 0x10], eax
cmp eax, 0x7d605
jl 0x428516
jmp 0x4285e7
cmp dword [0x7b980c], 0x28
jne 0x4285e7
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x70c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x404014
push 0x40401c
push 0x404030
call dword [sym.imp.KERNEL32.dll_WriteProfileStringA]
cmp dword [0x7b980c], 0xcf8
jne 0x428661
push 0
push 0
call fcn.004123da
xor edx, edx
xor edi, edi
push 0x40403c
mov dword [esp + 0x38], 7
mov dword [esp + 0x34], edi
mov word [esp + 0x24], dx
call fcn.0040820b
mov esi, eax
add esp, 0xc
lea eax, [esp + 0x18]
call fcn.00406390
lea eax, [esp + 0x78]
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1718], edi
call fcn.00405900
cmp dword [esp + 0x2c], 8
jb 0x428652
mov ecx, dword [esp + 0x18]
push ecx
call fcn.00408226
add esp, 4
push edi
call fcn.0040832f
add esp, 4
push edi
call fcn.004085c1
mov edi, dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
mov ebp, dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileSize]
xor esi, esi
cmp esi, 0x408
jne 0x428688
mov eax, 0x5d1
add dword [0x7b980c], eax
cmp dword [0x7b980c], 0xca3
jne 0x4286b9
push 0
push 0
push 0
push 0
call edi
xor edx, edx
lea ecx, [esp + 0x14]
push ecx
push edx
push edx
push 0x4040b0
push edx
mov dword [esp + 0x24], edx
call ebp
push 0
push 0
call ebx
inc esi
cmp esi, 0x1518d4
jl 0x428675
mov eax, dword [0x7b980c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [0x7b9774], eax
mov eax, dword [0x7b980c]
xor esi, esi
test eax, eax
je 0x42877b
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessShutdownParameters]
mov ebx, dword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsA]
mov ebp, dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
cmp eax, 0xfe
jne 0x428742
push 0
lea ecx, [esp + 0x70c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
push 0
call edi
xor eax, eax
lea edx, [esp + 0x18]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
push edx
lea eax, [esp + 0x48]
push eax
push 0x4040dc
call ebx
call fcn.00428030
mov eax, dword [0x7b980c]
cmp eax, 0x29
jne 0x428772
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call ebp
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
mov eax, dword [0x7b980c]
inc esi
cmp esi, eax
jb 0x4286f6
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov edi, 0x9682ab
cmp eax, 3
jne 0x42879e
push 0
push 0
push 0
push 0
push 0
push 0
call esi
mov eax, dword [0x7b980c]
dec edi
jne 0x428786
mov esi, dword [sym.imp.KERNEL32.dll_GetLargestConsoleWindowSize]
mov ebx, 0x25887
mov edi, 0xabebc05c
mov dword [0x7b977c], edi
cmp eax, 0x222
jne 0x4287d7
push 0
lea ecx, [esp + 0x70c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0
call esi
mov eax, dword [0x7b980c]
dec ebx
jne 0x4287b1
mov byte [0x435ac0], bl
call fcn.00427f80
call fcn.004282d0
mov ebp, dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalFlags]
mov ebx, dword [sym.imp.KERNEL32.dll_LocalFlags]
xor esi, esi
mov edi, edi
cmp dword [0x7b980c], 0xba
jne 0x428817
push 0x4040e8
push 0
push 0
call ebp
push 0
call edi
push 0
call ebx
cmp esi, 0x2f64
jne 0x428832
mov eax, 0x513a
add dword [0x7b9774], eax
inc esi
cmp esi, 0x1605a
jl 0x428800
mov esi, dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov edi, 0x1e6dcb
mov ebx, 0x85
jmp 0x428850
cmp dword [0x7b980c], ebx
jne 0x42885a
call esi
dec edi
jne 0x428850
push 0x403f08
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp dword [0x7b980c], 0xc30
jne 0x42893d
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
push edi
call dword [sym.imp.KERNEL32.dll_SetConsoleCP]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
lea edx, [esp + 0x1c8]
push edx
push 0x40412c
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push edi
call esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateActCtxW]
push edi
lea ecx, [esp + 0x14]
push ecx
push edi
lea edx, [esp + 0x314]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_ReadConsoleA]
push edi
lea eax, [esp + 0x70c]
push eax
lea ecx, [esp + 0x44]
push ecx
lea edx, [esp + 0x44]
push edx
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x48]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
push 0x404138
call esi
push edi
lea edx, [esp + 0xf0c]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_VerLanguageNameW]
push edi
push edi
call dword [sym.imp.KERNEL32.dll_SetProcessAffinityMask]
lea eax, [esp + 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_SetTimeZoneInformation]
push edi
call dword [sym.imp.KERNEL32.dll_ZombifyActCtx]
push 0x404148
call dword [sym.imp.KERNEL32.dll_DeleteVolumeMountPointW]
mov ecx, dword [esp + 0x170c]
pop edi
xor eax, eax
mov dword fs:[0], ecx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret