Function at 0x4071ee
Capabilities:
Delete file
Set uefi variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43e9a7
mov eax, dword fs:[0]
push eax
mov eax, 0x2858
call fcn.00438db0
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x40]
mov dword [ebp - 0x281c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
xor ebx, ebx
push ebx
shr esi, 0x18
call fcn.0042a8e7
imul eax, eax, 0x63
pop ecx
cmp esi, eax
jbe 0x40724e
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableA]
xor esi, esi
inc esi
mov dword [ebp - 4], esi
cmp dword [ebp + 0x1c], ebx
jne 0x40728e
push ebx
push esi
lea ecx, [ebp + 8]
call fcn.004035bd
push ebx
push esi
lea ecx, [ebp + 0x24]
call fcn.004035bd
mov eax, 0x80004005
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00428d2e
leave
ret 0x3c
cmp dword [ebp + 0x38], ebx
je 0x407259
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
push 2
pop esi
sub eax, esi
je 0x4072ab
sub eax, esi
je 0x4072ab
sub eax, 4
jne 0x4072b7
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.004050c5
lea eax, [ebp - 0x2815]
mov byte [ebp - 0x2815], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4072c6
sub eax, edx
push 0
pop eax
setne al
dec eax
jne 0x4072e2
call fcn.00409a52
call fcn.00405136
call edi
sub eax, esi
je 0x4072f5
sub eax, esi
je 0x4072f5
sub eax, 4
je 0x4072f5
xor eax, eax
jmp 0x407303
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
xor eax, eax
inc eax
dec eax
jne 0x407310
call fcn.0040c095
call fcn.004051c4
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x2860]
push ebx
push eax
call fcn.00431920
add esp, 0xc
mov dword [ebp - 0x2860], esi
call fcn.0040965a
cmp dword [ebp + 0x20], 0x10
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x284c], eax
mov eax, dword [ebp + 0xc]
jae 0x407344
lea eax, [ebp + 0xc]
mov dword [ebp - 0x2850], eax
mov eax, dword [ebp + 0x38]
mov dword [ebp - 0x2830], eax
call fcn.004012cd
xor esi, esi
inc esi
mov dword [ebp - 4], esi
cmp dword [ebp + 0x3c], 0x10
mov eax, dword [ebp + 0x28]
jae 0x40736a
lea eax, [ebp + 0x28]
push 0x50
mov dword [ebp - 0x2834], eax
pop eax
mov dword [ebp - 0x2854], 3
mov word [ebp - 0x2848], ax
call edi
dec eax
dec eax
je 0x407393
dec eax
dec eax
je 0x407393
sub eax, 4
jne 0x4073a2
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableA]
call fcn.00405207
push 0x27ff
lea eax, [ebp - 0x2813]
push ebx
push eax
mov byte [ebp - 0x2814], bl
call fcn.00431920
add esp, 0xc
mov dword [ebp - 0x2820], 0x2800
call fcn.004046d5
dec eax
jne 0x4073d9
call fcn.004052ce
call fcn.00405311
lea eax, [ebp - 0x2820]
push eax
lea eax, [ebp - 0x2814]
push eax
push ebx
lea eax, [ebp - 0x2860]
push eax
call dword [sym.imp.WININET.dll_InternetCreateUrlA]
test eax, eax
jne 0x407419
mov edi, 0x80004005
push ebx
push esi
lea ecx, [ebp + 8]
call fcn.004035bd
push ebx
push esi
lea ecx, [ebp + 0x24]
call fcn.004035bd
mov eax, edi
jmp 0x407272
mov ecx, dword [ebp - 0x281c]
lea eax, [ebp - 0x2814]
push eax
call fcn.00403575
xor edi, edi
jmp 0x4073fe