Function at 0x433840
Capabilities:
Check for time delay via gettickcount
Set uefi variable

Disassembly:
push 0xffffffffffffffff
push 0x44f075
mov eax, dword fs:[0]
push eax
sub esp, 0xa0
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x98], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x45f2b0]
xor eax, esp
push eax
lea eax, [esp + 0xb4]
mov dword fs:[0], eax
mov ebp, dword [esp + 0xc4]
push ebp
mov dword [esp + 0xc0], 3
call fcn.00432b90
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, 2
mov ebx, 0
je 0x4338ad
sub eax, 2
je 0x4338ad
sub eax, 4
jne 0x4338c9
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableA]
call dword [sym.imp.USER32.dll_GetActiveWindow]
call dword [sym.imp.USER32.dll_GetCapture]
call dword [sym.imp.USER32.dll_GetClipboardOwner]
call fcn.00437f69
cdq
mov ecx, 0x14
idiv ecx
mov esi, edx
inc esi
call fcn.00437f69
cdq
idiv esi
cmp edx, esi
jle 0x4338ec
mov edx, 1
jmp 0x4338f1
mov eax, esi
cdq
idiv esi
mov eax, 0x29d96b91
imul edx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 0xc3c
jle 0x43391e
push 0xc3c
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00430710
call fcn.00418790
lea ecx, [esp + 0x1c]
push ecx
sub esp, 0x1c
mov esi, esp
mov dword [esi + 0x18], 0xf
lea edi, [esi + 4]
mov dword [esi + 0x14], ebx
mov byte [edi], bl
mov eax, dword [esi + 0x18]
mov dword [esp + 0x34], esp
cmp eax, 0x10
jb 0x433947
mov ecx, dword [edi]
jmp 0x433949
mov ecx, edi
cmp ecx, str.qeY:
ja 0x433984
cmp eax, 0x10
jb 0x43395a
mov ecx, dword [edi]
jmp 0x43395c
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, str.qeY:
jbe 0x433984
cmp eax, 0x10
jb 0x433970
mov edi, dword [edi]
push 0x2f
mov eax, str.qeY:
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402d10
jmp 0x4339c7
cmp eax, 0x2f
jae 0x433996
mov ecx, dword [esi + 0x14]
push ecx
push 0x2f
mov ecx, esi
call fcn.00403480
mov ecx, dword [esi + 0x18]
cmp ecx, 0x10
jb 0x4339a2
mov eax, dword [edi]
jmp 0x4339a4
mov eax, edi
push 0x2f
push str.qeY:
push ecx
push eax
call fcn.00437feb
add esp, 0x10
cmp dword [esi + 0x18], 0x10
mov dword [esi + 0x14], 0x2f
jb 0x4339c4
mov edi, dword [edi]
mov byte [edi + 0x2f], bl
lea esi, [esp + 0x58]
call fcn.004014c0
mov byte [esp + 0xc0], 4
call fcn.00401770
mov byte [esp + 0xbc], 5
cmp dword [eax + 0x18], 0x10
jb 0x4339f0
mov edi, dword [eax + 4]
jmp 0x4339f3
lea edi, [eax + 4]
sub esp, 0x1c
mov esi, esp
mov eax, edi
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
mov dword [esp + 0x30], esp
mov byte [esi + 4], bl
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x433a10
sub eax, edx
push eax
push edi
mov ecx, esi
call fcn.00403090
push ebp
call fcn.00432340
cmp dword [esp + 0x34], 0x10
jb 0x433a3c
mov edx, dword [esp + 0x20]
push edx
call fcn.00437f8b
add esp, 4
mov edi, 0xf
lea esi, [esp + 0x38]
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
mov byte [esp + 0xbc], 3
call fcn.00429620
lea eax, [esp + 0x1c]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [esi + 0x18], edi
lea edi, [esi + 4]
mov dword [esi + 0x14], ebx
mov byte [edi], bl
mov eax, dword [esi + 0x18]
mov dword [esp + 0x34], esp
cmp eax, 0x10
jb 0x433a83
mov ecx, dword [edi]
jmp 0x433a85
mov ecx, edi
cmp ecx, 0x45666c
ja 0x433ac0
cmp eax, 0x10
jb 0x433a96
mov ecx, dword [edi]
jmp 0x433a98
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x45666c
jbe 0x433ac0
cmp eax, 0x10
jb 0x433aac
mov edi, dword [edi]
push 0x14
mov eax, 0x45666c
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402d10
jmp 0x433b03
cmp eax, 0x14
jae 0x433ad2
mov ecx, dword [esi + 0x14]
push ecx
push 0x14
mov ecx, esi
call fcn.00403480
mov ecx, dword [esi + 0x18]
cmp ecx, 0x10
jb 0x433ade
mov eax, dword [edi]
jmp 0x433ae0
mov eax, edi
push 0x14
push 0x45666c
push ecx
push eax
call fcn.00437feb
add esp, 0x10
cmp dword [esi + 0x18], 0x10
mov dword [esi + 0x14], 0x14
jb 0x433b00
mov edi, dword [edi]
mov byte [edi + 0x14], bl
lea esi, [esp + 0x58]
call fcn.004014c0
mov byte [esp + 0xc0], 6
call fcn.004018b0
mov byte [esp + 0xbc], 7
cmp dword [eax + 0x18], 0x10
jb 0x433b2c
mov ecx, dword [eax + 4]
jmp 0x433b2f
lea ecx, [eax + 4]
sub esp, 0x1c
mov esi, esp
mov eax, ecx
mov edi, 0xf
lea edx, [eax + 1]
mov dword [esp + 0x30], esp
mov dword [esi + 0x18], edi
mov dword [esi + 0x14], ebx
mov byte [esi + 4], bl
mov dword [esp + 0x30], edx
nop
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x433b50
sub eax, dword [esp + 0x30]
push eax
push ecx
mov ecx, esi
call fcn.00403090
push ebp
call fcn.00432340
cmp dword [esp + 0x34], 0x10
jb 0x433b7e
mov eax, dword [esp + 0x20]
push eax
call fcn.00437f8b
add esp, 4
lea esi, [esp + 0x38]
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], bl
mov byte [esp + 0xbc], 3
call fcn.00429620
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x124]
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push edx
mov byte [ecx + 4], bl
call fcn.00402d10
push ebp
call fcn.004322a0
mov dword [esp + 0xa8], edi
mov dword [esp + 0xa4], ebx
mov byte [esp + 0x94], bl
lea eax, [esp + 0x90]
push eax
sub esp, 0x1c
mov ecx, esp
mov byte [esp + 0xdc], 8
mov dword [esp + 0x34], esp
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x10c]
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push edx
mov byte [ecx + 4], bl
call fcn.00402d10
sub esp, 0x1c
mov ecx, esp
mov byte [esp + 0xf8], 9
mov dword [esp + 0x54], esp
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x10c]
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push eax
mov byte [ecx + 4], bl
call fcn.00402d10
mov byte [esp + 0xf8], 8
call fcn.00432fe0
cmp eax, ebx
jge 0x433d29
mov esi, pe_nt_image_headers32
cmp dword [esp + 0xa8], esi
jb 0x433c67
mov ecx, dword [esp + 0x94]
push ecx
call fcn.00437f8b
add esp, 4
mov dword [esp + 0xa8], edi
mov dword [esp + 0xa4], ebx
mov byte [esp + 0x94], bl
cmp dword [esp + 0xe0], esi
jb 0x433c95
mov edx, dword [esp + 0xcc]
push edx
call fcn.00437f8b
add esp, 4
mov dword [esp + 0xe0], edi
mov dword [esp + 0xdc], ebx
mov byte [esp + 0xcc], bl
cmp dword [esp + 0xfc], esi
jb 0x433cc3
mov eax, dword [esp + 0xe8]
push eax
call fcn.00437f8b
add esp, 4
mov dword [esp + 0xfc], edi
mov dword [esp + 0xf8], ebx
mov byte [esp + 0xe8], bl
cmp dword [esp + 0x118], esi
jb 0x433cf1
mov ecx, dword [esp + 0x104]
push ecx
call fcn.00437f8b
add esp, 4
cmp dword [esp + 0x134], esi
mov dword [esp + 0x118], edi
mov byte [esp + 0x104], bl
mov dword [esp + 0x114], ebx
jb 0x433d1f
mov edx, dword [esp + 0x120]
push edx
call fcn.00437f8b
add esp, 4
mov eax, 0x80004005
jmp 0x433f2b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, 2
je 0x433d3e
sub eax, 2
je 0x433d3e
sub eax, 4
jne 0x433d4e
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call fcn.004353a0
call fcn.004307e0
push 8
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x144]
mov esi, 0xf
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push eax
mov byte [ecx + 4], bl
call fcn.00402d10
sub esp, 0x1c
mov ecx, esp
mov byte [esp + 0xf8], 0xa
mov dword [esp + 0x50], esp
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0xd4]
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push edx
mov byte [ecx + 4], bl
call fcn.00402d10
push ebp
mov byte [esp + 0xfc], 8
call fcn.00431890
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 4
mov edi, eax
call esi
lea ecx, [esp + 0x14]
cmp eax, ecx
jle 0x433dcb
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x433dd7
push 0xe
call esi
lea edx, [esp + 0x14]
cmp eax, edx
jle 0x433ddc
call fcn.00406fe0
xor esi, esi
mov edi, edi
cmp edi, 1
jne 0x433f55
push 8
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x38], esp
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x144]
mov edi, 0xf
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push eax
mov byte [ecx + 4], bl
call fcn.00402d10
sub esp, 0x1c
mov ecx, esp
mov byte [esp + 0xf8], 0xb
mov dword [esp + 0x50], esp
push 0xffffffffffffffff
lea eax, [ebp + 0x38]
push ebx
mov dword [ecx + 0x18], edi
mov dword [ecx + 0x14], ebx
push eax
mov byte [ecx + 4], bl
call fcn.00402d10
push ebp
mov byte [esp + 0xfc], 8
call fcn.00431890
inc esi
cmp esi, 0x14
mov edi, eax
jl 0x433de0
mov esi, pe_nt_image_headers32
cmp dword [esp + 0xa8], esi
jb 0x433e6c
mov edx, dword [esp + 0x94]
push edx
call fcn.00437f8b
add esp, 4
mov edi, 0xf
mov dword [esp + 0xa8], edi
mov dword [esp + 0xa4], ebx
mov byte [esp + 0x94], bl
cmp dword [esp + 0xe0], esi
jb 0x433e9f
mov eax, dword [esp + 0xcc]
push eax
call fcn.00437f8b
add esp, 4
mov dword [esp + 0xe0], edi
mov dword [esp + 0xdc], ebx
mov byte [esp + 0xcc], bl
cmp dword [esp + 0xfc], esi
jb 0x433ecd
mov ecx, dword [esp + 0xe8]
push ecx
call fcn.00437f8b
add esp, 4
mov dword [esp + 0xfc], edi
mov dword [esp + 0xf8], ebx
mov byte [esp + 0xe8], bl
cmp dword [esp + 0x118], esi
jb 0x433efb
mov edx, dword [esp + 0x104]
push edx
call fcn.00437f8b
add esp, 4
mov dword [esp + 0x118], edi
mov dword [esp + 0x114], ebx
mov byte [esp + 0x104], bl
cmp dword [esp + 0x134], esi
jb 0x433f29
mov eax, dword [esp + 0x120]
push eax
call fcn.00437f8b
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0xb4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x98]
xor ecx, esp
call fcn.00437983
add esp, 0xac
ret 0x74
cmp edi, ebx
jge 0x434028
cmp dword [esp + 0xa8], 0x10
jb 0x433f77
mov ecx, dword [esp + 0x94]
push ecx
call fcn.00437f8b
add esp, 4
cmp dword [esp + 0xe0], 0x10
mov dword [esp + 0xa8], 0xf
mov dword [esp + 0xa4], ebx
mov byte [esp + 0x94], bl
jb 0x433faa
mov edx, dword [esp + 0xcc]
push edx
call fcn.00437f8b
add esp, 4
cmp dword [esp + 0xfc], 0x10
mov dword [esp + 0xe0], 0xf
mov dword [esp + 0xdc], ebx
mov byte [esp + 0xcc], bl
jb 0x433fdd
mov eax, dword [esp + 0xe8]
push eax
call fcn.00437f8b
add esp, 4
cmp dword [esp + 0x118], 0x10
mov dword [esp + 0xfc], 0xf
mov dword [esp + 0xf8], ebx
mov byte [esp + 0xe8], bl
jb 0x434010
mov ecx, dword [esp + 0x104]
push ecx
call fcn.00437f8b
add esp, 4
cmp dword [esp + 0x134], 0x10
mov dword [esp + 0x118], 0xf
jmp 0x433cff
mov ecx, ebp
call fcn.00431e30
mov edi, eax
call fcn.0042f900
test eax, eax
je 0x43403f
call fcn.00401440
mov esi, ebp
call fcn.00431c10
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, 2
je 0x43405b
sub eax, 2
je 0x43405b
sub eax, 4
jne 0x434066
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call fcn.00406c60
mov esi, pe_nt_image_headers32
cmp dword [esp + 0xa8], esi
jb 0x434084
mov eax, dword [esp + 0x94]
push eax
call fcn.00437f8b
add esp, 4
mov ebp, 0xf
mov dword [esp + 0xa8], ebp
mov dword [esp + 0xa4], ebx
mov byte [esp + 0x94], bl
cmp dword [esp + 0xe0], esi
jb 0x4340b7
mov ecx, dword [esp + 0xcc]
push ecx
call fcn.00437f8b
add esp, 4
mov dword [esp + 0xe0], ebp
mov dword [esp + 0xdc], ebx
mov byte [esp + 0xcc], bl
cmp dword [esp + 0xfc], esi
jb 0x4340e5
mov edx, dword [esp + 0xe8]
push edx
call fcn.00437f8b
add esp, 4
mov dword [esp + 0xfc], ebp
mov dword [esp + 0xf8], ebx
mov byte [esp + 0xe8], bl
cmp dword [esp + 0x118], esi
jb 0x434113
mov eax, dword [esp + 0x104]
push eax
call fcn.00437f8b
add esp, 4
mov dword [esp + 0x118], ebp
mov dword [esp + 0x114], ebx
mov byte [esp + 0x104], bl
cmp dword [esp + 0x134], esi
jb 0x434141
mov ecx, dword [esp + 0x120]
push ecx
call fcn.00437f8b
add esp, 4
mov eax, edi
jmp 0x433f2b