Function at 0x414001
Capabilities:
Delete file
Get geographical location
Query or enumerate registry value
Resolve dns
Set uefi variable

Disassembly:
push 0x520
mov eax, 0x4403e6
call fcn.0042b376
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3a0]
mov dword [ebp - 0x4b4], eax
cmp ecx, 6
jbe 0x41403f
and dword [eax + 0x3a0], 0
mov dword [eax + 0x39c], 1
xor eax, eax
call fcn.0042b3f9
ret 4
push 0xf
inc ecx
pop edi
xor ebx, ebx
mov dword [eax + 0x3a0], ecx
push ebx
lea ecx, [ebp - 0x468]
mov dword [ebp - 0x4b0], ebx
mov dword [ebp - 0x450], edi
call fcn.00403636
mov dword [ebp - 4], ebx
push ebx
lea ecx, [ebp - 0x430]
mov dword [ebp - 0x418], edi
call fcn.00403636
mov byte [ebp - 4], 1
call fcn.00428e21
cdq
push 0x14
pop ecx
idiv ecx
mov esi, edx
inc esi
call fcn.00428e21
cdq
idiv esi
cmp edx, esi
jg 0x41409f
mov eax, esi
cdq
idiv esi
cmp edx, ebx
je 0x4140a4
call fcn.0040c1a4
push ebx
lea ecx, [ebp - 0x44c]
mov dword [ebp - 0x434], edi
call fcn.00403636
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
dec eax
dec eax
je 0x4140cd
dec eax
dec eax
je 0x4140cd
sub eax, 4
jne 0x4140dc
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableA]
call fcn.00401dee
lea eax, [ebp - 0x4b0]
push eax
push 1
push ebx
lea eax, [ebp - 0x4d0]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x4ac], esp
push 0x41
push 0x448a10
call fcn.0040801d
lea edi, [ebp - 0x52c]
call fcn.00426ea5
mov byte [ebp - 4], 3
call fcn.0042700a
cmp dword [eax + 0x18], 0x10
jb 0x414123
mov eax, dword [eax + 4]
jmp 0x414126
add eax, 4
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push ebx
push 1
lea ecx, [ebp - 0x4d0]
mov edi, eax
call fcn.0040329c
lea esi, [ebp - 0x52c]
mov byte [ebp - 4], 2
call fcn.00417161
cmp edi, ebx
jne 0x4143fe
cmp dword [ebp - 0x4b0], ebx
je 0x414412
push 0x3ff
lea eax, [ebp - 0x413]
push ebx
push eax
mov byte [ebp - 0x414], bl
call fcn.00431170
mov esi, 0x400
add esp, 0xc
mov dword [ebp - 0x4ac], esi
call fcn.004094e1
test eax, eax
je 0x4141c0
push 4
lea eax, [ebp - 0x4a8]
push eax
push 0x20001009
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0x20
lea eax, [ebp - 0x4d4]
push eax
push 0x58
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
call fcn.0040bef2
lea eax, [ebp - 0x4ac]
push eax
lea eax, [ebp - 0x414]
push eax
push ebx
push ebx
lea eax, [ebp - 0x4d0]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x4a8], esp
push 0x12
push 0x448a54
call fcn.0040801d
lea edi, [ebp - 0x52c]
call fcn.00426ea5
mov byte [ebp - 4], 4
call fcn.0042700a
cmp dword [eax + 0x18], 0x10
jb 0x41420d
mov eax, dword [eax + 4]
jmp 0x414210
add eax, 4
push eax
push dword [ebp - 0x4b0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push ebx
push 1
lea ecx, [ebp - 0x4d0]
mov edi, eax
call fcn.0040329c
lea esi, [ebp - 0x52c]
call fcn.00417161
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push ebx
shr esi, 0x18
call fcn.0042a13f
imul eax, eax, 0x63
pop ecx
cmp esi, eax
jbe 0x414258
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 4], 2
cmp edi, ebx
jne 0x414275
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x468]
call fcn.00403254
mov eax, 0x400
push eax
mov dword [ebp - 0x4ac], eax
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.00431170
lea eax, [ebp - 0x4a1]
add esp, 0xc
mov byte [ebp - 0x4a1], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4142a0
sub eax, edx
push 0
pop eax
setne al
dec eax
jne 0x4142bc
call fcn.0040bf3b
call fcn.0040bfc9
lea eax, [ebp - 0x4ac]
push eax
lea eax, [ebp - 0x414]
push eax
push ebx
push ebx
lea eax, [ebp - 0x4d0]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x4a8], esp
push 0x12
push 0x448a68
call fcn.0040801d
lea edi, [ebp - 0x52c]
call fcn.00426ea5
mov ecx, eax
mov byte [ebp - 4], 7
call fcn.004270be
cmp dword [eax + 0x18], 0x10
jb 0x41430b
mov eax, dword [eax + 4]
jmp 0x41430e
add eax, 4
push eax
push dword [ebp - 0x4b0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push ebx
push 1
lea ecx, [ebp - 0x4d0]
mov edi, eax
call fcn.0040329c
lea esi, [ebp - 0x52c]
mov byte [ebp - 4], 2
call fcn.00417161
cmp edi, ebx
jne 0x414350
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x430]
call fcn.00403254
mov eax, 0x400
push eax
mov dword [ebp - 0x4ac], eax
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.00431170
add esp, 0xc
lea eax, [ebp - 0x4ac]
push eax
lea eax, [ebp - 0x414]
push eax
push ebx
push ebx
lea eax, [ebp - 0x4d0]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x4a8], esp
push 0x12
push str._b_t:_1__T
call fcn.0040801d
lea edi, [ebp - 0x52c]
call fcn.00426ea5
mov byte [ebp - 4], 8
call fcn.00426f82
cmp dword [eax + 0x18], 0x10
jb 0x4143b9
mov eax, dword [eax + 4]
jmp 0x4143bc
add eax, 4
push eax
push dword [ebp - 0x4b0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push ebx
push 1
lea ecx, [ebp - 0x4d0]
mov edi, eax
call fcn.0040329c
lea esi, [ebp - 0x52c]
mov byte [ebp - 4], 2
call fcn.00417161
cmp edi, ebx
jne 0x4143fe
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x44c]
call fcn.00403254
cmp dword [ebp - 0x4b0], ebx
je 0x414412
push dword [ebp - 0x4b0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x454], ebx
jne 0x4144b8
lea eax, [ebp - 0x4d0]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x4a8], esp
push 0x10
push 0x448a90
call fcn.0040801d
lea edi, [ebp - 0x52c]
call fcn.00426ea5
mov ecx, eax
mov byte [ebp - 4], 9
call fcn.00427269
mov byte [ebp - 4], 0xa
cmp dword [eax + 0x18], 0x10
jb 0x414461
mov eax, dword [eax + 4]
jmp 0x414464
add eax, 4
push eax
lea ecx, [ebp - 0x468]
call fcn.00403254
push ebx
push 1
lea ecx, [ebp - 0x4d0]
call fcn.0040329c
lea esi, [ebp - 0x52c]
mov byte [ebp - 4], 2
call fcn.00417161
lea eax, [ebp - 0x4a1]
mov byte [ebp - 0x4a1], bl
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x41449c
sub eax, esi
push 0
pop eax
setne al
dec eax
jne 0x4144b8
call fcn.0040c00c
call fcn.0040c104
cmp dword [ebp - 0x41c], ebx
jne 0x41452d
lea eax, [ebp - 0x4d0]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x4a8], esp
push 0x10
push 0x448aa4
call fcn.0040801d
lea edi, [ebp - 0x52c]
call fcn.00426ea5
mov byte [ebp - 4], 0xb
call fcn.0042700a
mov byte [ebp - 4], 0xc
cmp dword [eax + 0x18], 0x10
jb 0x414501
mov eax, dword [eax + 4]
jmp 0x414504
add eax, 4
push eax
lea ecx, [ebp - 0x430]
call fcn.00403254
push ebx
push 1
lea ecx, [ebp - 0x4d0]
call fcn.0040329c
lea esi, [ebp - 0x52c]
mov byte [ebp - 4], 2
call fcn.00417161
cmp dword [ebp - 0x438], ebx
jne 0x4145a4
lea eax, [ebp - 0x4d0]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x4a8], esp
push 8
push 0x448ab8
call fcn.0040801d
lea edi, [ebp - 0x52c]
call fcn.00426ea5
mov ecx, eax
mov byte [ebp - 4], 0xd
call fcn.004270be
mov byte [ebp - 4], 0xe
cmp dword [eax + 0x18], 0x10
jb 0x414578
mov eax, dword [eax + 4]
jmp 0x41457b
add eax, 4
push eax
lea ecx, [ebp - 0x44c]
call fcn.00403254
push ebx
push 1
lea ecx, [ebp - 0x4d0]
call fcn.0040329c
lea esi, [ebp - 0x52c]
mov byte [ebp - 4], 2
call fcn.00417161
cmp dword [ebp - 0x450], 0x10
mov eax, dword [ebp - 0x464]
jae 0x4145b9
lea eax, [ebp - 0x464]
push eax
call sub.WS2_32.dll_gethostbyname
push ebx
cmp eax, ebx
jne 0x4145f7
push 1
lea ecx, [ebp - 0x44c]
call fcn.0040329c
push ebx
push 1
lea ecx, [ebp - 0x430]
call fcn.0040329c
push ebx
push 1
lea ecx, [ebp - 0x468]
call fcn.0040329c
mov eax, 0x80004005
jmp 0x414037
lea ecx, [ebp - 0x484]
mov dword [ebp - 0x46c], 0xf
call fcn.00403636
lea eax, [ebp - 0x484]
push eax
sub esp, 0x1c
mov byte [ebp - 4], 0xf
lea eax, [ebp - 0x44c]
mov ecx, esp
mov dword [ebp - 0x4a8], esp
push eax
call fcn.00402e94
sub esp, 0x1c
mov byte [ebp - 4], 0x10
lea eax, [ebp - 0x430]
mov ecx, esp
mov dword [ebp - 0x4ac], esp
push eax
call fcn.00402e94
mov byte [ebp - 4], 0xf
call fcn.00406f61
mov edi, eax
lea eax, [ebp - 0x4a1]
mov byte [ebp - 0x4a1], bl
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x414663
sub eax, esi
je 0x414678
call fcn.0040c1a4
call fcn.0040c265
lea eax, [ebp - 0x4a1]
mov byte [ebp - 0x4a1], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x414687
sub eax, edx
je 0x414697
call fcn.0040c2e1
cmp edi, ebx
jge 0x41476d
cmp dword [ebp - 0x434], 0x10
mov eax, dword [ebp - 0x448]
jae 0x4146b4
lea eax, [ebp - 0x448]
cmp dword [ebp - 0x418], 0x10
push eax
mov eax, dword [ebp - 0x42c]
jae 0x4146ca
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x4d0]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x4a8], esp
push 0x3f
push 0x448ac8
call fcn.0040801d
lea edi, [ebp - 0x52c]
call fcn.00426ea5
mov ecx, eax
mov byte [ebp - 4], 0x11
call fcn.00427269
mov byte [ebp - 4], 0x12
cmp dword [eax + 0x18], 0x10
jb 0x41470e
mov eax, dword [eax + 4]
jmp 0x414711
add eax, 4
mov ebx, dword [ebp - 0x4b4]
push eax
push 1
call fcn.0040e8e1
add esp, 0x10
xor edi, edi
xor ebx, ebx
push edi
inc ebx
push ebx
lea ecx, [ebp - 0x4d0]
call fcn.0040329c
lea esi, [ebp - 0x52c]
call fcn.00417161
push edi
push ebx
lea ecx, [ebp - 0x484]
call fcn.0040329c
push edi
push ebx
lea ecx, [ebp - 0x44c]
call fcn.0040329c
push edi
push ebx
lea ecx, [ebp - 0x430]
call fcn.0040329c
push edi
push ebx
jmp 0x4145e2
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x4a8], esp
push 0x4445ef
call fcn.00402e72
sub esp, 0x1c
mov byte [ebp - 4], 0x13
lea eax, [ebp - 0x484]
mov ecx, esp
mov dword [ebp - 0x4ac], esp
push eax
call fcn.00402e94
mov edi, dword [ebp - 0x4b4]
lea ecx, [edi + 0x18]
mov byte [ebp - 4], 0xf
call fcn.004061c0
mov dword [ebp - 0x4b4], eax
call fcn.00428e21
cdq
push 0x14
pop ecx
idiv ecx
mov esi, edx
inc esi
call fcn.00428e21
cdq
idiv esi
cmp edx, esi
jle 0x4147d6
xor esi, esi
inc esi
mov edx, esi
jmp 0x4147de
mov eax, esi
cdq
idiv esi
xor esi, esi
inc esi
mov eax, edx
dec eax
jne 0x414817
call fcn.0040c3a8
push 4
lea eax, [ebp - 0x4a8]
push eax
push 0x20001009
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0x20
lea eax, [ebp - 0x4d4]
push eax
push 0x58
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp dword [ebp - 0x4b4], ebx
push ebx
jge 0x41484d
push esi
lea ecx, [ebp - 0x484]
call fcn.0040329c
push ebx
push esi
lea ecx, [ebp - 0x44c]
call fcn.0040329c
push ebx
push esi
lea ecx, [ebp - 0x430]
call fcn.0040329c
push ebx
push esi
jmp 0x4145e2
lea ecx, [ebp - 0x4a0]
mov dword [ebp - 0x488], 0xf
call fcn.00403636
lea ecx, [ebp - 0x4a0]
lea eax, [edi + 0x18]
mov byte [ebp - 4], 0x14
call fcn.00406b16
test eax, eax
jge 0x4148c5
mov edi, 0x80004005
push ebx
push esi
lea ecx, [ebp - 0x4a0]
call fcn.0040329c
push ebx
push esi
lea ecx, [ebp - 0x484]
call fcn.0040329c
push ebx
push esi
lea ecx, [ebp - 0x44c]
call fcn.0040329c
push ebx
push esi
lea ecx, [ebp - 0x430]
call fcn.0040329c
push ebx
push esi
lea ecx, [ebp - 0x468]
call fcn.0040329c
mov eax, edi
jmp 0x414037
mov dword [edi + 0x39c], esi
mov dword [edi + 0x3a0], ebx
xor edi, edi
jmp 0x41487d