Function at 0x4023c7
Capabilities:
Check for time delay via gettickcount
Check os version
Delete file
Get geographical location
Resolve function by parsing pe exports
Set uefi variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x4542b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x18]
xor ebx, ebx
push edi
cmp eax, ebx
jne 0x40244a
xor edi, edi
inc edi
mov dword [esi + 0x18], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
dec eax
dec eax
je 0x402402
dec eax
dec eax
je 0x402402
sub eax, 4
je 0x402402
xor eax, eax
jmp 0x40240e
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
mov eax, edi
dec eax
jne 0x40243c
call fcn.00426054
push 4
lea eax, [ebp - 0xc]
push eax
push 0x20001009
mov edi, 0x400
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0x20
lea eax, [ebp - 0x2c]
push eax
push 0x58
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push ebx
call fcn.0042a8e7
add eax, 0x3c
jmp 0x4028ac
cmp eax, 1
jne 0x402484
lea eax, [ebp - 5]
mov dword [esi + 0x18], 2
mov byte [ebp - 5], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40245f
sub eax, edx
push 0
pop eax
setne al
dec eax
jne 0x4028a3
call fcn.0040158e
call fcn.0040161c
jmp 0x4028a3
cmp eax, 2
jne 0x4024e0
push ebx
mov dword [esi + 0x18], 4
call fcn.0042a8e7
add eax, 0xb4
adc edx, ebx
pop ecx
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], edx
call fcn.004295cd
cdq
push 0x14
pop ecx
idiv ecx
mov esi, edx
inc esi
call fcn.004295cd
cdq
idiv esi
cmp edx, esi
jle 0x4024c3
xor eax, eax
inc eax
jmp 0x4024ca
mov eax, esi
cdq
idiv esi
mov eax, edx
dec eax
jne 0x4028b5
call fcn.00401675
call fcn.004016f1
jmp 0x4028b5
cmp eax, 4
jne 0x40252b
push ebx
mov dword [esi + 0x18], 5
call fcn.0042a8e7
add eax, 0x3c
adc edx, ebx
pop ecx
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
dec eax
dec eax
je 0x402515
dec eax
dec eax
je 0x402515
sub eax, 4
jne 0x4028b5
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.00401734
call fcn.0040b4a9
jmp 0x4028b5
cmp eax, 5
jne 0x40253c
mov dword [esi + 0x18], 6
jmp 0x4028a3
cmp eax, 6
jne 0x402558
push ebx
mov dword [esi + 0x18], 8
call fcn.0042a8e7
add eax, 0xb4
jmp 0x4028ac
cmp eax, 8
jne 0x402574
mov dword [esi + 0x18], 0xa
push ebx
call fcn.0042a8e7
add eax, 0x12c
jmp 0x4028ac
push 0xa
pop edi
cmp eax, edi
jne 0x402584
mov dword [esi + 0x18], 0xc
jmp 0x402564
cmp eax, 0xc
jne 0x4025cc
mov dword [esi + 0x18], 0xe
call fcn.004295cd
cdq
push 0x14
pop ecx
idiv ecx
mov edi, edx
inc edi
call fcn.004295cd
cdq
idiv edi
cmp edx, edi
jg 0x4025b3
mov eax, edi
cdq
idiv edi
cmp edx, ebx
je 0x402564
call dword [sym.imp.USER32.dll_GetActiveWindow]
call dword [sym.imp.USER32.dll_GetCapture]
call dword [sym.imp.USER32.dll_GetClipboardOwner]
call fcn.0040177b
jmp 0x402564
cmp eax, 0xe
jne 0x40266a
mov ebx, esi
call fcn.00402b2b
call fcn.0040965a
inc dword [esi + 0x48]
cmp dword [esi + 0x48], 9
jbe 0x4025f2
mov dword [esi + 0x18], edi
jmp 0x4028b5
xor edi, edi
push edi
call fcn.0042a8e7
add eax, 0x12c
adc edx, edi
pop ecx
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], edx
call fcn.004295cd
call fcn.004295cd
xor ebx, ebx
call fcn.004012cd
test eax, eax
je 0x402622
call fcn.0041f338
call fcn.004295cd
call fcn.004295cd
push ebx
mov eax, esi
call fcn.00403310
add eax, 0x1c
cmp dword [eax + 0x14], edi
jne 0x40265f
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
push 0x38
cdq
pop ecx
idiv ecx
inc ebx
cmp ebx, eax
jb 0x40264f
xor ebx, ebx
cmp ebx, edi
jne 0x40262c
mov dword [esi + 0x18], 0xa
jmp 0x4028b5
add ebx, 0xf
mov dword [esi + 0x18], ebx
jmp 0x4028b5
cmp eax, 0xf
jne 0x4026f4
mov ebx, esi
call fcn.00402b2b
inc dword [esi + 0x48]
cmp dword [esi + 0x48], 9
ja 0x4025ea
push 0
call fcn.0042a8e7
add eax, 0x12c
adc edx, 0
mov dword [esi + 0x50], eax
xor ebx, ebx
lea eax, [ebp - 5]
pop ecx
mov dword [esi + 0x54], edx
inc ebx
mov byte [ebp - 5], 0
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4026aa
sub eax, edi
push 0
pop eax
setne al
dec eax
jne 0x4026c6
call fcn.004017d4
call fcn.00401838
push ebx
mov eax, esi
call fcn.00403310
add eax, 0x1c
cmp dword [eax + 0x14], 0
jne 0x40265f
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
push 0x38
cdq
pop ecx
idiv ecx
inc ebx
cmp ebx, eax
jb 0x4026ea
xor ebx, ebx
cmp ebx, 1
jne 0x4026c6
jmp 0x402653
cmp eax, 0x10
jne 0x4027d8
mov ebx, esi
call fcn.00402b2b
inc dword [esi + 0x48]
cmp dword [esi + 0x48], 9
ja 0x4025ea
push 0
call fcn.0042a8e7
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
pop ecx
add eax, 0x12c
push 2
adc edx, 0
pop ebx
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], edx
call edi
dec eax
dec eax
je 0x40273f
dec eax
dec eax
je 0x40273f
sub eax, 4
jne 0x402755
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableA]
call fcn.0040b4a9
call fcn.00401891
push ebx
mov eax, esi
call fcn.00403310
add eax, 0x1c
cmp dword [eax + 0x14], 0
jne 0x402783
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
push 0x38
cdq
pop ecx
idiv ecx
inc ebx
cmp ebx, eax
jb 0x402779
xor ebx, ebx
cmp ebx, 2
jne 0x402755
jmp 0x402653
add ebx, 0xf
mov dword [esi + 0x18], ebx
call edi
dec eax
dec eax
je 0x402798
dec eax
dec eax
je 0x402798
sub eax, 4
jne 0x4027b0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call dword [sym.imp.USER32.dll_GetActiveWindow]
call dword [sym.imp.USER32.dll_GetCapture]
call dword [sym.imp.USER32.dll_GetClipboardOwner]
lea eax, [ebp - 5]
mov byte [ebp - 5], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4027ba
sub eax, edx
je 0x4028b5
call fcn.004018d4
call fcn.0040199d
jmp 0x4028b5
cmp eax, 0x11
jne 0x4028a0
mov ebx, esi
call fcn.00402b2b
call fcn.00401270
test eax, eax
je 0x4027f6
call fcn.00401a31
inc dword [esi + 0x48]
cmp dword [esi + 0x48], 9
ja 0x4025ea
xor ebx, ebx
push ebx
call fcn.0042a8e7
add eax, 0x12c
adc edx, ebx
pop ecx
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], edx
xor edi, edi
call fcn.0040472c
test eax, eax
je 0x402829
call fcn.00401ab6
push edi
mov eax, esi
call fcn.00403310
add eax, 0x1c
cmp dword [eax + 0x14], ebx
jne 0x402898
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
push 0x38
cdq
pop ecx
idiv ecx
inc edi
cmp edi, eax
jb 0x40284c
xor edi, edi
call fcn.0040472c
dec eax
jne 0x40285e
call fcn.00401b27
call fcn.00401bb5
call dword [sym.imp.KERNEL32.dll_GetTickCount]
dec eax
dec eax
je 0x402875
dec eax
dec eax
je 0x402875
sub eax, 4
je 0x402875
xor eax, eax
jmp 0x402882
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
xor eax, eax
inc eax
dec eax
jne 0x40288f
call fcn.00409a52
call fcn.00401c19
cmp edi, ebx
jne 0x402829
jmp 0x402653
add edi, 0xf
jmp 0x4025ea
mov dword [esi + 0x18], ebx
push ebx
call fcn.0042a8e7
add eax, 0x78
adc edx, ebx
mov dword [esi + 0x54], edx
pop ecx
mov dword [esi + 0x50], eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00428d2e
leave
ret