Function at 0x4237d0
Capabilities:
Check if file exists
Create process on windows
Delete file
Delete registry key
Get disk information
Get file attributes
Get file size
Parse pe header
Query or enumerate registry key
Query or enumerate registry value
Read file on windows
Write and execute a file
Write file on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43d4ab
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x738
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x4574c8]
mov esi, dword [0x4574c0]
push 0x40
mov dword [ebp - 0x604], eax
lea eax, [ebp - 0x5d0]
push 0
push eax
mov dword [ebp - 0x5f0], esi
call fcn.0042a4e0
add esp, 0xc
mov dword [ebp - 0x6dc], 0
xorps xmm0, xmm0
lea eax, [ebp - 0x748]
movups xmmword [ebp - 0x6fc], xmm0
push 0x44
push 0
push eax
movups xmmword [ebp - 0x6ec], xmm0
call fcn.0042a4e0
add esp, 0xc
lea eax, [ebp - 0x6d0]
push 0x30
push 0
push eax
call fcn.0042a4e0
movzx eax, word [0x4574e0]
add esp, 0xc
mov word [ebp - 0x1c], ax
xorps xmm0, xmm0
xor eax, eax
mov dword [ebp - 0x624], 0
mov word [ebp - 0x16], ax
push 0x42
push eax
lea eax, [ebp - 0x68]
movq qword [ebp - 0x538], xmm0
push eax
movups xmmword [ebp - 0x548], xmm0
mov dword [ebp - 0x610], 0
mov dword [ebp - 0x5f8], 0
mov dword [ebp - 0x5fc], 0
mov dword [ebp - 0x5ec], 0
mov dword [ebp - 0x600], 0
mov dword [ebp - 0x5e8], 0
mov dword [ebp - 0x1a], 0x5c003a
call fcn.0042a4e0
add esp, 0xc
lea eax, [ebp - 0x530]
push 0x230
push 0
push eax
call fcn.0042a4e0
movups xmm0, xmmword [str.REG.exe_EXPORT__HKCU..Override..___]
movzx eax, word [0x44d7c8]
add esp, 0xc
mov word [ebp - 0x2b8], ax
lea eax, [ebp - 0x2b6]
movups xmmword [ebp - 0x300], xmm0
movups xmm0, xmmword [0x44d790]
push 0x24a
push 0
movups xmmword [ebp - 0x2f0], xmm0
push eax
movups xmm0, xmmword [0x44d7a0]
movups xmmword [ebp - 0x2e0], xmm0
movups xmm0, xmmword [0x44d7b0]
movups xmmword [ebp - 0x2d0], xmm0
movq xmm0, qword [0x44d7c0]
movq qword [ebp - 0x2c0], xmm0
call fcn.0042a4e0
add esp, 0xc
mov byte [ebp - 0x5d9], 0
xorps xmm0, xmm0
movq qword [ebp - 0x6d8], xmm0
movups xmmword [ebp - 0x570], xmm0
push 0x10212
push 0
push dword [0x45764c]
movups xmmword [ebp - 0x560], xmm0
movq qword [ebp - 0x550], xmm0
movq qword [ebp - 0x630], xmm0
mov edi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
call edi
mov dword [ebp - 0x5d8], eax
mov dword [ebp - 0x618], eax
test eax, eax
je 0x423a16
push 0x300
push 0
push dword [0x45764c]
mov dword [ebp - 0x6b0], 0x20
call edi
mov dword [ebp - 0x5e4], eax
mov ecx, eax
mov dword [ebp - 0x6b8], eax
mov dword [ebp - 0x6a8], ecx
test eax, eax
jne 0x423a27
push dword [ebp - 0x5d8]
push eax
push dword [0x45764c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [0x45771c], 8
xor al, al
jmp 0x424c0d
mov edi, dword [sym.imp.KERNEL32.dll_FormatMessageW]
xor eax, eax
mov word [ebp - 0x718], ax
lea eax, [ebp - 0x60c]
push eax
push 0x104
push 0x457720
push 0x400
push 0
push dword [0x45631c]
mov dword [ebp - 0x748], 0x44
push 0x2400
mov dword [ebp - 0x71c], 1
mov dword [ebp - 0x60c], str.Dll_Registry_Export
call edi
sub esp, 8
lea ecx, [ebp - 0x6a0]
push 0x457720
push dword [0x45633c]
sub esp, 8
push 0x457720
call fcn.00402d80
lea ecx, [ebp - 0x6a0]
mov dword [ebp - 4], 0
call fcn.00402fd0
push 0x4037c0
push 0xfa
push 0x65
push dword [ebp - 0x698]
lea eax, [ebp - 0x6a0]
mov dword [0x45754c], eax
call dword [sym.imp.USER32.dll_SetTimer]
movzx ecx, byte [ebp - 0x662]
test eax, eax
lea eax, [ebp - 0x614]
mov dword [ebp - 0x614], 0
mov edx, 1
mov dword [ebp - 0x628], 0
push eax
cmovne ecx, edx
push 0x2000e
mov byte [ebp - 0x662], cl
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x423b3e
lea eax, [ebp - 0x628]
push eax
push 2
push dword [ebp - 0x614]
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
push dword [ebp - 0x614]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x628]
mov dword [ebp - 0x5f4], eax
mov dword [ebp - 0x6b4], eax
mov eax, 1
mov dword [ebp - 0x6c0], 0xffffffff
mov dword [ebp - 0x6bc], 0xffffffff
mov dword [0x45771c], 0
mov dword [ebp - 0x608], eax
cmp esi, eax
jbe 0x4240cd
nop dword [eax + eax]
mov ecx, dword [ebp - 0x604]
mov esi, dword [ecx + eax*4]
mov eax, dword [ebp - 0x69c]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
jne 0x424175
mov edi, dword [ebp - 0x6ac]
mov eax, dword [ebp - 0x6b0]
cmp edi, eax
jne 0x423bf9
mov edx, dword [ebp - 0x5e4]
add eax, eax
mov dword [ebp - 0x6b0], eax
lea eax, [eax + eax*2]
shl eax, 3
push eax
push edx
push 0
push dword [0x45764c]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov dword [ebp - 0x6a8], eax
test eax, eax
je 0x4240c7
mov ecx, eax
mov dword [ebp - 0x5e4], ecx
mov dword [ebp - 0x6b8], ecx
lea ecx, [edi + edi*2]
lea ecx, [eax + ecx*8]
mov dword [ebp - 0x6a8], ecx
cmp word [esi], 0x2f
jne 0x423c33
movzx eax, word [esi + 2]
cmp eax, 0x44
jne 0x423cbc
movzx eax, word [esi + 4]
cmp eax, 0x52
je 0x423c1a
cmp eax, 0x72
jne 0x423c33
movzx eax, word [esi + 6]
cmp eax, 0x45
je 0x423c28
cmp eax, 0x65
jne 0x423c33
cmp word [esi + 8], 0
je 0x4240ae
push ecx
lea eax, [ebp - 0x5e8]
mov ecx, esi
push eax
lea edx, [ebp - 0x618]
call fcn.00404830
add esp, 8
test al, al
je 0x4240ae
mov esi, dword [ebp - 0x6a8]
mov ax, word [0x457638]
mov ecx, dword [ebp - 0x5d8]
push 0
push 0x2000080
push 3
mov word [esi + 4], ax
mov eax, dword [ebp - 0x5e8]
push 0
push 7
sub eax, ecx
push 0x120089
sar eax, 1
push ecx
mov word [esi + 6], ax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x423ea0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x4240ae
cmp dword [0x4574d4], 0
je 0x424c2b
jmp 0x4240ae
cmp eax, 0x41
je 0x423cc6
cmp eax, 0x61
jne 0x423ced
movzx ecx, word [esi + 4]
cmp ecx, 0x52
je 0x423cd4
cmp ecx, 0x72
jne 0x423ced
cmp word [esi + 6], 0
jne 0x423ced
cmp dword [0x4574d4], 0
je 0x424c2b
jmp 0x423c33
cmp eax, 0x41
je 0x423cfb
cmp eax, 0x61
jne 0x423c33
cmp word [esi + 4], 0x3d
jne 0x423c33
lea ecx, [esi + 6]
mov byte [ebp - 0x5d1], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x620], xmm0
test ecx, ecx
je 0x423e8b
movzx eax, word [ecx]
test ax, ax
je 0x423e8b
nop
cmp ax, 9
je 0x423de0
cmp ax, 0x20
je 0x423de0
cmp ax, 0xd
je 0x423de0
cmp ax, 0xa
je 0x423de0
mov edx, 0xa0
cmp ax, dx
je 0x423de0
cmp ax, 0xc
je 0x423de0
cmp ax, 0xb
je 0x423de0
mov edx, 0x85
cmp ax, dx
je 0x423de0
mov edx, 0x2028
cmp ax, dx
je 0x423de0
mov edx, 0x2029
cmp ax, dx
je 0x423de0
mov edx, 0x202f
cmp ax, dx
je 0x423de0
mov edx, 0x1680
cmp ax, dx
je 0x423de0
mov edx, 0x180e
cmp ax, dx
je 0x423de0
mov edx, 0x1fff
cmp ax, dx
jbe 0x423dc2
mov edx, 0x200c
cmp ax, dx
jb 0x423de0
mov edx, 0x3000
cmp ax, dx
je 0x423de0
mov edx, 0xfeff
cmp ax, dx
je 0x423de0
mov edx, 0x205f
cmp ax, dx
jne 0x423dec
movzx eax, word [ecx + 2]
add ecx, 2
jmp 0x423d30
mov dword [ebp - 0x5e0], ecx
cmp ax, 0x2b
je 0x423e08
movzx edx, ax
cmp ax, 0x2d
jne 0x423e15
mov byte [ebp - 0x5d1], 1
movzx edx, word [ecx + 2]
add ecx, 2
mov dword [ebp - 0x5e0], ecx
mov esi, dword [ebp - 0x620]
cmp dx, 0x30
jb 0x423e72
mov edi, dword [ebp - 0x61c]
movzx edx, dx
nop word [eax + eax]
cmp dx, 0x39
ja 0x423e72
mov eax, esi
mov ecx, edi
shld ecx, eax, 2
shl eax, 2
add esi, eax
movzx eax, dx
cdq
adc edi, ecx
shld edi, esi, 1
add esi, esi
add esi, eax
mov eax, dword [ebp - 0x5e0]
adc edi, edx
sub esi, 0x30
sbb edi, 0
add eax, 2
mov dword [ebp - 0x5e0], eax
movzx eax, word [eax]
mov edx, eax
cmp eax, 0x30
jae 0x423e30
mov eax, esi
neg eax
cmp byte [ebp - 0x5d1], 0
cmove eax, esi
or dword [ebp - 0x610], eax
jmp 0x4240ae
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
or dword [ebp - 0x610], eax
jmp 0x4240ae
push 0x23
push 8
lea eax, [ebp - 0x630]
mov dword [ebp - 0x630], 0
and dword [esi], 0x7fffffff
push eax
lea eax, [ebp - 0x6d8]
push eax
push edi
call dword [0x4576d0]
test eax, eax
jns 0x423f24
push 4
push 0x28
lea eax, [ebp - 0x570]
push eax
lea eax, [ebp - 0x6d8]
push eax
push edi
call dword [0x4576d0]
test eax, eax
js 0x4240a7
mov eax, dword [ebp - 0x550]
mov dword [ebp - 0x630], eax
mov eax, dword [ebp - 0x5d8]
mov ax, word [eax + 8]
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
je 0x423f34
cmp eax, 2
je 0x423f34
or dword [esi], 0x80000000
jmp 0x423f34
test dword [ebp - 0x630], 0x410
jne 0x4240a7
cmp dword [esi], 0
jl 0x423f68
cmp dword [0x4574d4], 0
jne 0x423f68
movzx eax, word [esi + 6]
mov edx, dword [ebp - 0x5d8]
mov ecx, dword [ebp - 0x5f4]
push 0x120156
push eax
call fcn.00403fc0
add esp, 8
test al, al
je 0x424106
push 0
lea eax, [ebp - 0x5f8]
push eax
push 0x40
lea eax, [ebp - 0x5d0]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4240a7
cmp dword [ebp - 0x5f8], 0x40
jb 0x4240a7
mov eax, 0x5a4d
cmp word [ebp - 0x5d0], ax
jne 0x4240a7
mov eax, dword [ebp - 0x594]
test eax, eax
je 0x4240a7
push 0
push 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, dword [ebp - 0x594]
jne 0x4240a7
push 0
lea eax, [ebp - 0x5f8]
push eax
push 0x1a
lea eax, [ebp - 0x58c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4240a7
cmp dword [ebp - 0x5f8], 0x1a
jb 0x4240a7
cmp dword [ebp - 0x58c], 0x4550
jne 0x4240a7
mov eax, dword [ebp - 0x576]
and eax, 0x2002
cmp eax, 0x2002
jne 0x4240a7
add esi, 8
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov eax, dword [esi]
add dword [ebp - 0x650], eax
mov eax, dword [esi + 4]
mov esi, dword [ebp - 0x6a8]
adc dword [ebp - 0x64c], eax
movzx eax, word [esi + 4]
lea eax, [eax*2 + 0xa]
push eax
push 0
push dword [0x45764c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esi + 0x10], eax
test eax, eax
je 0x424121
movzx ecx, word [esi + 4]
lea ecx, [ecx*2 + 2]
push ecx
push dword [ebp - 0x5d8]
push eax
call fcn.0043c9e0
add esp, 0xc
add dword [ebp - 0x640], 1
adc dword [ebp - 0x63c], 0
add esi, 0x18
inc dword [ebp - 0x6cc]
inc dword [ebp - 0x6ac]
mov dword [ebp - 0x6a8], esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x608]
inc eax
mov dword [ebp - 0x608], eax
cmp eax, dword [ebp - 0x5f0]
jb 0x423b80
mov edi, dword [sym.imp.KERNEL32.dll_FormatMessageW]
cmp dword [ebp - 0x640], 0
je 0x424bbe
mov ecx, dword [ebp - 0x64c]
mov eax, dword [ebp - 0x650]
test ecx, ecx
jne 0x4241b6
cmp eax, 0x63
ja 0x4241b6
mov dword [ebp - 0x638], 1
jmp 0x4241c7
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x4574d4], 0
je 0x424c2b
mov eax, 5
jmp 0x424126
mov eax, 8
cmp byte [ebp - 0x662], 0
mov dword [0x45771c], eax
je 0x42413f
lea ecx, [ebp - 0x6a0]
call fcn.004036e0
sub esp, 8
lea ecx, [ebp - 0x6a0]
call fcn.00403080
push 0x320
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push dword [0x45771c]
lea ecx, [ebp - 0x6a0]
push 0x5dc
call fcn.00403330
jmp 0x424bbe
push 0x65
push dword [ebp - 0x698]
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [ebp - 0x69c]
push 0
push 0
push 0x44413c
mov byte [ebp - 0x662], 0
mov ecx, dword [eax]
push 2
push eax
call dword [ecx + 0x28]
mov eax, dword [ebp - 0x69c]
push 0
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x30]
jmp 0x424bbe
push 0
push 0x64
push ecx
push eax
call fcn.0043d1d0
mov dword [ebp - 0x638], eax
push 0x65
push dword [ebp - 0x698]
mov dword [ebp - 0x660], 1
mov dword [ebp - 0x65c], 0
mov byte [ebp - 0x661], 1
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [ebp - 0x69c]
push 0
push 0
push 0x44413c
mov byte [ebp - 0x662], 0
mov ecx, dword [eax]
push 2
push eax
call dword [ecx + 0x28]
mov eax, dword [ebp - 0x69c]
push 0
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x30]
cmp byte [ebp - 0x667], 0
je 0x42425b
mov eax, dword [ebp - 0x694]
mov byte [ebp - 0x667], 0
test eax, eax
je 0x42425b
push 0
push 0
push 0x40a
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x50000000
push 0xfffffffffffffff0
push dword [ebp - 0x694]
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov esi, dword [0x45754c]
mov ecx, dword [esi + 0x60]
call fcn.00428880
push 0x14
push 0x457550
mov dword [ebp - 0x620], eax
push dword [esi + 0x54]
push dword [esi + 0x50]
call dword [sym.imp.SHLWAPI.dll_StrFormatByteSizeW]
push 0x2a
push str.Dll_Registry_Export:
push 0x457720
mov dword [ebp - 0x61c], eax
call fcn.0043c9e0
add esp, 0xc
lea eax, [ebp - 0x620]
push eax
push 0xef
push 0x45774a
push 0x400
push 0
push dword [0x4563bc]
push 0x2400
call edi
mov eax, dword [ebp - 0x69c]
push 0
push 0
push 0x457720
mov ecx, dword [eax]
push 1
push eax
call dword [ecx + 0x28]
mov dword [ebp - 0x6a0], eax
mov eax, dword [ebp - 0x69c]
push 0
mov byte [ebp - 0x661], 1
push 1
mov ecx, dword [eax]
push eax
call dword [ecx + 0x30]
mov esi, dword [0x4576bc]
mov dword [ebp - 0x6a0], eax
lea eax, [esi*2 - 8]
push eax
mov eax, dword [0x4574cc]
add eax, 8
push eax
lea eax, [ebp - 0x530]
push eax
call fcn.0043c9e0
movups xmm0, xmmword [str.__ROPK_.reg]
lea eax, [esi - 4]
add esp, 0xc
movzx ecx, ax
mov eax, ecx
add ecx, 0xb
movzx esi, cx
add esi, esi
push esi
movups xmmword [ebp + eax*2 - 0x530], xmm0
movq xmm0, qword [0x44d830]
movq qword [ebp + eax*2 - 0x520], xmm0
lea eax, [ebp - 0x530]
push eax
lea eax, [ebp - 0x2b8]
push eax
call fcn.0043c9e0
movq xmm0, qword [str.___y]
add esp, 0xc
mov ax, word [0x44d840]
mov edi, dword [ebp - 0x640]
movq qword [ebp + esi - 0x2b8], xmm0
mov word [ebp + esi - 0x2b0], ax
mov esi, dword [ebp - 0x5e4]
mov dword [ebp - 0x5f4], edi
mov dword [ebp - 0x6a8], esi
test edi, edi
je 0x424b2c
mov eax, dword [ebp - 0x69c]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
jne 0x424b2c
movzx ecx, word [esi + 6]
mov eax, dword [esi + 0x10]
push 0
push 1
lea eax, [eax + ecx*2]
mov ecx, dword [ebp - 0x69c]
push eax
push 2
push ecx
mov edx, dword [ecx]
call dword [edx + 0x28]
mov dword [ebp - 0x6a0], eax
mov dword [0x45771c], 0
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x604], eax
test eax, eax
je 0x424a6b
push str.DllRegisterServer
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov dword [ebp - 0x5f0], esi
test esi, esi
je 0x424a01
cmp byte [ebp - 0x5d9], 0
jne 0x424553
push 0
lea eax, [ebp - 0x624]
push eax
push 0
push 0xf003f
push 4
push 0
push 0
push str...Override..
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [0x45771c], eax
test eax, eax
jne 0x424a0c
lea ecx, [ebp - 0x544]
mov edi, 0x20
mov dword [ebp - 0x608], ecx
nop dword [eax]
cmp edi, 0xc0
jae 0x42453e
mov esi, dword [edi + 0x456760]
test esi, esi
je 0x4244a3
push 0x457630
mov edx, 0x7fff
mov ecx, esi
call fcn.00402470
test eax, eax
js 0x4244a8
mov ecx, dword [0x457630]
jmp 0x4244b0
mov eax, 0x80070057
xor ecx, ecx
mov dword [0x457630], ecx
test eax, eax
js 0x4244b9
movzx eax, cx
jmp 0x4244cc
test esi, esi
je 0x4244ca
cmp word [esi], 0
je 0x4244ca
mov eax, 0x7fff
jmp 0x4244cc
xor eax, eax
inc eax
mov dword [ebp - 0x5ec], eax
add eax, eax
push eax
lea eax, [ebp - 0x68]
push esi
push eax
call fcn.0043c9e0
mov esi, dword [ebp - 0x608]
lea eax, [ebp - 0x68]
add esp, 0xc
push 0
push esi
push 0
push 0xf003f
push 4
push 0
push 0
push eax
push dword [ebp - 0x624]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [0x45771c], eax
test eax, eax
jne 0x424525
push dword [esi]
push dword [edi + 0x456750]
call dword [sym.imp.ADVAPI32.dll_RegOverridePredefKey]
mov dword [0x45771c], eax
add esi, 4
add edi, 0x20
mov dword [ebp - 0x608], esi
test eax, eax
je 0x424470
jmp 0x424a0c
test eax, eax
jne 0x424a0c
mov esi, dword [ebp - 0x5f0]
mov byte [ebp - 0x5d9], 1
call esi
mov esi, 1
nop word [eax + eax]
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x5ec]
mov dword [ebp - 0x5ec], 0x20
push eax
lea eax, [ebp - 0x68]
push eax
push 0
push dword [ebp + esi*4 - 0x548]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
jne 0x4245ce
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x5ec]
mov dword [ebp - 0x5ec], 0x20
push eax
lea eax, [ebp - 0x68]
push eax
push 0
push dword [ebp + esi*4 - 0x548]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
jne 0x4245ce
inc esi
cmp esi, 6
jb 0x424560
jmp 0x42461f
lea eax, [ebp - 0x6fc]
push eax
lea eax, [ebp - 0x748]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x300]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x42461f
push 0xffffffffffffffff
push dword [ebp - 0x6fc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x6fc]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x6f8]
call edi
cmp esi, 6
je 0x424a0c
push ecx
push 0x457638
sub esp, 8
lea edx, [ebp - 0x600]
lea ecx, [ebp - 0x530]
call fcn.00403a60
add esp, 0x10
test eax, eax
je 0x4249f5
mov edx, dword [ebp - 0x600]
lea ecx, [ebp - 0x6ec]
push 0x1f
push eax
call fcn.00416cd0
add esp, 8
test al, al
je 0x4249f5
mov eax, dword [ebp - 0x6e8]
mov dword [ebp - 0x5e8], eax
cmp eax, 7
jb 0x4249f5
mov edx, dword [ebp - 0x5e4]
mov edi, 1
movzx esi, word [edx + 4]
movzx eax, word [edx + 6]
mov edx, dword [edx + 0x10]
movzx ecx, si
mov dword [ebp - 0x5e0], esi
mov esi, ecx
sub esi, eax
lea eax, [ecx + ecx]
mov dword [ebp - 0x618], eax
lea edx, [edx + eax]
je 0x4246ce
movzx eax, word [edx - 2]
sub edx, 2
cmp eax, 0x2e
je 0x4246ce
cmp eax, 0x5c
je 0x4246ce
cmp eax, 0x2f
je 0x4246ce
inc edi
sub esi, 1
jne 0x4246b2
xor ecx, ecx
movzx eax, di
cmp word [edx], 0x2e
mov edi, dword [ebp - 0x5e4]
cmove ecx, eax
movzx esi, cx
mov dword [ebp - 0x5f0], esi
cmp dword [edi], 0
jge 0x424796
movzx ecx, word [edi + 6]
mov eax, dword [ebp - 0x5e0]
sub eax, ecx
mov dword [ebp - 0x5e0], eax
movzx edi, ax
mov eax, dword [0x4576b4]
movzx eax, ax
lea esi, [eax + eax]
push esi
push dword [0x4574d0]
push dword [ebp - 0x5d8]
call fcn.0043c9e0
add esp, 0xc
lea eax, [edi + edi]
push eax
mov eax, dword [ebp - 0x5e4]
movzx ecx, word [eax + 6]
mov eax, dword [eax + 0x10]
lea eax, [eax + ecx*2]
push eax
mov eax, dword [ebp - 0x5d8]
add eax, esi
push eax
call fcn.0043c9e0
mov edx, dword [ebp - 0x5f0]
add esp, 0xc
mov ecx, dword [0x4576b4]
mov esi, dword [ebp - 0x5d8]
movq xmm0, qword [str..reg]
movzx eax, dx
sub edi, eax
movzx eax, cx
add edi, eax
movq qword [esi + edi*2], xmm0
mov ax, word [0x44d87c]
mov word [esi + edi*2 + 8], ax
mov esi, dword [ebp - 0x5e0]
movzx eax, si
sub eax, edx
mov edx, dword [ebp - 0x5d8]
add eax, ecx
jmp 0x4247dc
push dword [ebp - 0x618]
push dword [edi + 0x10]
push dword [ebp - 0x5d8]
call fcn.0043c9e0
movzx ecx, word [edi + 4]
add esp, 0xc
mov edx, dword [ebp - 0x5d8]
movq xmm0, qword [str..reg]
movzx eax, si
sub ecx, eax
movq qword [edx + ecx*2], xmm0
movzx eax, word [0x44d87c]
mov word [edx + ecx*2 + 8], ax
movzx eax, word [edi + 4]
sub ax, si
test byte [ebp - 0x610], 2
movzx esi, ax
jne 0x424812
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x424812
mov ecx, dword [ebp - 0x5d8]
lea edx, [esi + 4]
push 0x80e8
call fcn.00404280
add esp, 4
mov dword [ebp - 0x5d8], eax
jmp 0x424818
mov eax, dword [ebp - 0x5d8]
push 0
push 0xa000080
push 2
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x5e0], esi
cmp esi, 0xffffffff
je 0x424a01
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 0x5fc]
push 0
push eax
push 2
push 0x44e5a7
push esi
call edi
push 0
lea eax, [ebp - 0x5fc]
push eax
push 0x50
push str.Windows_Registry_Editor_Version_5.00_r_n_r_n
push esi
call edi
mov ecx, dword [ebp - 0x5e8]
test ecx, ecx
je 0x4249ec
mov edi, dword [ebp - 0x6ec]
add edi, 0x12
movzx eax, byte [edi - 1]
mov esi, dword [edi - 0xe]
cmp esi, eax
je 0x4249d0
test byte [edi], 2
jne 0x424930
cmp ecx, 1
jbe 0x424930
sub esi, eax
mov dword [ebp - 0x5ec], esi
mov eax, dword [edi + 2]
movzx ecx, byte [edi + 0x13]
lea edx, [eax + ecx*2]
mov al, byte [edi - 2]
cmp al, byte [edi + 0x12]
jne 0x424930
mov eax, dword [edi + 6]
sub eax, ecx
cmp esi, eax
ja 0x424930
movzx eax, word [edx + esi*2]
cmp eax, 0x5c
je 0x4248d7
cmp eax, 0x5d
jne 0x424930
movzx ecx, byte [edi - 1]
add esi, esi
mov eax, dword [edi - 0x12]
cmp esi, 0xfffe
mov dword [0x45641c], edx
lea eax, [eax + ecx*2]
mov ecx, 0xfffe
mov dword [0x456414], eax
movzx eax, si
cmova eax, ecx
movzx eax, ax
mov word [0x456410], ax
mov word [0x456418], ax
cmp ax, cx
jae 0x424970
push 1
push 0x456410
push 0x456418
call dword [0x457674]
movzx eax, al
test eax, eax
jne 0x4249d0
mov esi, dword [ebp - 0x5e0]
lea eax, [ebp - 0x5fc]
push 0
push eax
push 2
push 0x44d8d4
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0x5fc]
push eax
mov eax, dword [edi - 0xa]
lea eax, [eax*2 - 2]
push eax
push dword [edi - 0x12]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x4249d6
push 1
push 0x456410
push 0x456418
call dword [0x457674]
test al, al
je 0x424930
movzx edx, word [0x456418]
mov eax, dword [0x45641c]
mov ecx, edx
shr ecx, 1
sub esi, edx
lea eax, [eax + ecx*2]
movzx ecx, word [0x456410]
mov dword [0x45641c], eax
mov eax, dword [0x456414]
shr ecx, 1
lea eax, [eax + ecx*2]
mov dword [0x456414], eax
cmp esi, 0xfffe
jae 0x4249cc
mov word [0x456410], si
mov word [0x456418], si
test esi, esi
jne 0x424970
mov esi, dword [ebp - 0x5e0]
add edi, 0x14
sub dword [ebp - 0x5e8], 1
mov ecx, dword [ebp - 0x5e8]
jne 0x424885
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x424a0c
mov dword [0x45771c], 0xd
jmp 0x424a0c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x45771c], eax
push dword [ebp - 0x604]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push dword [ebp - 0x600]
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
push 0
push dword [0x45764c]
call esi
push dword [ebp - 0x6ec]
mov dword [ebp - 0x600], 0
push 0
push dword [0x45764c]
call esi
lea ecx, [ebp - 0x548]
mov dword [ebp - 0x6ec], 0
call fcn.004235b0
mov esi, dword [0x45771c]
mov edi, dword [ebp - 0x5f4]
jmp 0x424a79
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [0x45771c], esi
mov edx, dword [ebp - 0x5e4]
mov ecx, dword [ebp - 0x648]
mov eax, dword [ebp - 0x644]
push 0
add ecx, dword [edx + 8]
push dword [ebp - 0x638]
mov dword [ebp - 0x648], ecx
adc eax, dword [edx + 0xc]
push eax
push ecx
mov dword [ebp - 0x644], eax
call fcn.0043d1d0
mov dword [ebp - 0x658], eax
mov dword [ebp - 0x654], edx
cmp edx, dword [ebp - 0x65c]
jb 0x424adb
ja 0x424aca
cmp eax, dword [ebp - 0x660]
jbe 0x424adb
lea ecx, [ebp - 0x6a0]
call fcn.004031a0
mov esi, dword [0x45771c]
add dword [ebp - 0x640], 0xffffffff
adc dword [ebp - 0x63c], 0xffffffff
test esi, esi
je 0x424b08
cmp edi, 1
lea ecx, [ebp - 0x6a0]
sete al
movzx eax, al
push eax
push esi
push 0x3e8
call fcn.00403330
mov esi, dword [ebp - 0x5e4]
dec edi
add esi, 0x18
mov dword [ebp - 0x5f4], edi
mov dword [ebp - 0x5e4], esi
mov dword [ebp - 0x6a8], esi
test edi, edi
jne 0x4243a7
lea eax, [ebp - 0x530]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp byte [ebp - 0x5d9], 0
je 0x424ba1
lea esi, [ebp - 0x544]
mov edi, 0x20
nop dword [eax]
push dword [esi]
call dword [0x457718]
mov dword [0x45771c], eax
test eax, eax
je 0x424b6d
push eax
call dword [0x457640]
mov dword [0x45771c], eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push dword [edi + 0x456750]
call dword [sym.imp.ADVAPI32.dll_RegOverridePredefKey]
add edi, 0x20
add esi, 4
cmp edi, 0xc0
jb 0x424b50
push str...Override..
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea ecx, [ebp - 0x6a0]
mov byte [ebp - 0x658], 0x64
call fcn.004031a0
push 0x258
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp - 0x5d8]
push 0
push dword [0x45764c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
sub esp, 8
lea ecx, [ebp - 0x6d0]
call fcn.00403870
add esp, 8
lea ecx, [ebp - 0x6a0]
call fcn.00403270
cmp dword [0x45771c], 0
lea ecx, [ebp - 0x6a0]
sete byte [ebp - 0x5d1]
call fcn.00402f30
mov al, byte [ebp - 0x5d1]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00428cd6
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push dword [ebp - 0x5d8]
push 0
push dword [0x45764c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
sub esp, 0xc
lea edx, [ebp - 0x6d0]
lea ecx, [ebp - 0x6a0]
call fcn.00403910
int3