Function at 0x4082e9
Capabilities:
Create process on windows
Delete registry key
Get file size
Get installed programs
Read file on windows

Disassembly:
push 0x148
mov eax, 0x44cf32
call fcn.00439970
mov edi, ecx
mov dword [ebp - 0x94], edi
xor ebx, ebx
mov dword [ebp - 4], ebx
fldz
fstp qword [ebp - 0xb8]
mov dword [ebp - 0xb0], ebx
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0xbc], eax
call fcn.00402e21
lea esi, [eax + 0x10]
mov dword [ebp - 0xa0], esi
mov byte [ebp - 4], 2
mov eax, dword [esi - 0xc]
cmp eax, ebx
jne 0x40837a
lea esi, [ebp - 0x8c]
call fcn.00426770
lea edi, [ebp - 0xa0]
mov byte [ebp - 4], 3
call fcn.00404a69
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x8c]
add eax, 0xfffffff0
call fcn.00402f9a
mov edi, dword [ebp - 0x94]
mov esi, dword [ebp - 0xa0]
push ebx
push 0x80
push 3
push ebx
push 1
push closesocket
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x84], eax
je 0x4084c3
push ebx
push eax
mov dword [ebp - 0x7c], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0x3e
mov dword [ebp - 0x8c], eax
lea eax, [ebp - 0x76]
push ebx
push eax
mov word [ebp - 0x78], bx
call fcn.00434800
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
add esp, 0xc
push ebx
lea eax, [ebp - 0x7c]
push eax
push 0x40
lea eax, [ebp - 0x78]
push eax
push dword [ebp - 0x84]
call esi
test eax, eax
je 0x4084a9
mov eax, dword [ebp - 0x3c]
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
push ebx
add eax, 0xfffffffc
push eax
push dword [ebp - 0x84]
mov dword [ebp - 0x88], ebx
call edi
push ebx
lea eax, [ebp - 0x7c]
push eax
push 4
lea eax, [ebp - 0x88]
push eax
push dword [ebp - 0x84]
call esi
test eax, eax
je 0x4084a3
mov eax, dword [ebp - 0x88]
cmp eax, ebx
jbe 0x4084a3
cmp eax, dword [ebp - 0x8c]
jae 0x4084a3
push ebx
push ebx
push eax
push dword [ebp - 0x84]
call edi
push ebx
lea eax, [ebp - 0x7c]
push eax
push 4
lea eax, [ebp - 0x80]
push eax
push dword [ebp - 0x84]
mov dword [ebp - 0x80], ebx
call esi
test eax, eax
je 0x4084a3
mov eax, dword [ebp - 0x8c]
sub eax, dword [ebp - 0x88]
cmp dword [ebp - 0x80], eax
jae 0x4084a3
push dword [ebp - 0x80]
call fcn.004343c0
pop ecx
push ebx
mov edi, eax
lea eax, [ebp - 0x7c]
push eax
push dword [ebp - 0x80]
push edi
push dword [ebp - 0x84]
call esi
test eax, eax
je 0x4084a3
mov ecx, edi
lea esi, [ebp - 0xb8]
call fcn.00427e00
test al, al
je 0x4084a3
mov dword [ebp - 0x90], 1
mov edi, dword [ebp - 0x94]
push dword [ebp - 0x84]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x90], ebx
jne 0x4084ee
mov esi, dword [ebp - 0xa0]
lea eax, [esi - 0x10]
call fcn.00402f9a
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], bl
call fcn.00427210
mov eax, dword [ebp - 0xbc]
call fcn.00402f9a
xor eax, eax
call fcn.004399ba
ret 4
lea eax, [ebp - 0x100]
push eax
call fcn.0042d1c0
lea eax, [ebp - 0x120]
push eax
mov byte [ebp - 4], 4
call fcn.0042d1c0
push str.root
push str.setup
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 5
call fcn.00427700
mov ecx, eax
call fcn.00427700
call fcn.00427590
lea ecx, [ebp - 0x120]
push ecx
call fcn.0042d5a0
push 0xfde9
push eax
lea eax, [ebp - 0x100]
push eax
call fcn.0042c640
lea ecx, [ebp - 0xa4]
push ecx
mov ecx, eax
call fcn.00403216
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0xa4]
cmp dword [eax - 0xc], ebx
jne 0x4085b8
add eax, 0xfffffff0
call fcn.00402f9a
lea esi, [ebp - 0x120]
call fcn.0042d210
lea edi, [ebp - 0x100]
call fcn.0042c530
mov eax, dword [ebp - 0xa0]
add eax, 0xfffffff0
call fcn.00402f9a
xor esi, esi
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], bl
call fcn.00427210
mov eax, dword [ebp - 0xbc]
call fcn.00402f9a
mov eax, esi
jmp 0x4084e6
lea esi, [ebp - 0xe0]
call fcn.00401e5e
lea eax, [ebp - 0x8c]
push str.iTools.exe
push eax
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 7
call fcn.00401d56
mov byte [ebp - 4], 8
mov eax, dword [eax]
mov ecx, esi
push ecx
mov ecx, eax
call fcn.0042dcc0
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x8c]
add esp, 0xc
add eax, 0xfffffff0
call fcn.00402f9a
lea eax, [ebp - 0x8c]
push eax
mov ecx, str.PrivateBuild
call fcn.00403216
mov eax, esi
push eax
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 9
call fcn.00401e81
push dword [eax]
call fcn.0043530b
mov dword [edi + 0x9f4], eax
mov eax, dword [ebp - 0x8c]
pop ecx
add eax, 0xfffffff0
call fcn.00402f9a
mov dword [ebp - 0x84], ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallThinkSky
lea esi, [ebp - 0x84]
mov byte [ebp - 4], 0xa
call fcn.0040b23d
test eax, eax
jne 0x4086c8
lea eax, [ebp - 0x8c]
push eax
push str.Channel
mov eax, esi
push eax
mov dword [ebp - 0x8c], ebx
mov dword [ebp - 0x90], ebx
call fcn.00404e12
test eax, eax
jne 0x408694
mov eax, dword [ebp - 0x8c]
cmp eax, ebx
je 0x408694
mov dword [edi + 0x9f8], eax
lea eax, [ebp - 0x90]
push eax
push str.Version
lea eax, [ebp - 0x84]
push eax
call fcn.00404e12
test eax, eax
jne 0x4086c8
mov eax, dword [ebp - 0x90]
cmp eax, ebx
je 0x4086c8
cmp dword [edi + 0x9f4], ebx
jne 0x4086c8
mov dword [edi + 0x9f4], eax
push dword [edi + 0x440]
mov edi, str.ck_WxS
call fcn.0041e430
mov edi, str.uninstrun
mov ecx, edi
lea edx, [ebp - 0xb8]
call fcn.00427ac0
test al, al
je 0x408843
mov eax, dword [ebp - 0x94]
cmp dword [eax + 0x44c], ebx
jne 0x408843
push edi
lea ecx, [ebp - 0xb8]
call fcn.00427700
cmp dword [eax + 8], 4
jne 0x408843
push edi
lea ecx, [ebp - 0xb8]
mov dword [ebp - 0x7c], ebx
call fcn.00427700
call fcn.004275b0
test eax, eax
jbe 0x408843
mov eax, dword [0x45fb34]
mov ecx, 0x45fb34
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x80], eax
push edi
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0xb
call fcn.00427700
mov ecx, dword [ebp - 0x7c]
mov edx, eax
call fcn.00427600
call fcn.00427590
push ebx
push eax
lea eax, [ebp - 0x100]
push eax
call fcn.0042c640
push eax
push dword [ebp - 0xa4]
lea eax, [ebp - 0x80]
push str._s_s
push eax
call fcn.00402dc0
push 0x44
lea eax, [ebp - 0x78]
push ebx
push eax
call fcn.00434800
add esp, 0x1c
push 0x10
lea eax, [ebp - 0xd0]
push ebx
push eax
call fcn.00434800
add esp, 0xc
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x78]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea esi, [ebp - 0x80]
call fcn.00404b5e
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4087e7
push dword [ebp - 0xd0]
mov edi, dword [ebp - 0x94]
call fcn.00409fff
mov edi, str.uninstrun
cmp dword [ebp - 0x80], ebx
jne 0x4087f0
xor eax, eax
jmp 0x4087f9
push dword [ebp - 0x80]
call fcn.00434f36
pop ecx
lea edx, [ebp - 0x80]
call fcn.00402f31
push dword [ebp - 0xd0]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xcc]
call esi
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0x80]
add eax, 0xfffffff0
call fcn.00402f9a
inc dword [ebp - 0x7c]
push edi
lea ecx, [ebp - 0xb8]
call fcn.00427700
call fcn.004275b0
cmp dword [ebp - 0x7c], eax
jb 0x408736
mov eax, dword [0x45fb34]
mov ecx, 0x45fb34
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x8c], eax
push 0x5a
lea eax, [ebp - 0x8c]
push 0x453acc
push eax
mov byte [ebp - 4], 0xc
call fcn.00402dc0
mov eax, dword [ebp - 0x94]
mov edi, dword [ebp - 0x8c]
add esp, 0xc
push dword [eax + 0x440]
call fcn.0041e430
push str.desktop
push str.shortcut
push str.setup
lea ecx, [ebp - 0xb8]
call fcn.00427700
mov ecx, eax
call fcn.00427700
mov ecx, eax
call fcn.00427700
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], ebx
call fcn.004275b0
test eax, eax
mov edi, str.name
mov esi, str.file
jbe 0x408985
mov ecx, dword [ebp - 0x7c]
mov edx, dword [ebp - 0x80]
push edi
call fcn.00427600
mov ecx, eax
call fcn.00427700
call fcn.00427590
push ebx
push eax
lea eax, [ebp - 0x100]
push eax
call fcn.0042c640
lea ecx, [ebp - 0x90]
push ecx
mov ecx, eax
call fcn.00403216
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x7c]
mov edx, dword [ebp - 0x80]
push esi
call fcn.00427600
mov ecx, eax
call fcn.00427700
call fcn.00427590
push ebx
push eax
lea eax, [ebp - 0x100]
push eax
call fcn.0042c640
lea ecx, [ebp - 0x98]
push ecx
mov ecx, eax
call fcn.00403216
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0x90]
cmp dword [eax - 0xc], ebx
je 0x408951
push eax
call fcn.0042e250
pop ecx
mov eax, dword [ebp - 0x98]
add eax, 0xfffffff0
call fcn.00402f9a
mov byte [ebp - 4], 0xc
mov eax, dword [ebp - 0x90]
add eax, 0xfffffff0
call fcn.00402f9a
mov eax, dword [ebp - 0x80]
inc dword [ebp - 0x7c]
call fcn.004275b0
cmp dword [ebp - 0x7c], eax
jb 0x4088cf
push str.taskbar
push str.shortcut
push str.setup
lea ecx, [ebp - 0xb8]
call fcn.00427700
mov ecx, eax
call fcn.00427700
mov ecx, eax
call fcn.00427700
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x7c], ebx
call fcn.004275b0
test eax, eax
jbe 0x408b10
mov ecx, dword [ebp - 0x7c]
mov edx, dword [ebp - 0x90]
push edi
call fcn.00427600
mov ecx, eax
call fcn.00427700
call fcn.00427590
push ebx
push eax
lea eax, [ebp - 0x100]
push eax
call fcn.0042c640
lea ecx, [ebp - 0x88]
push ecx
mov ecx, eax
call fcn.00403216
mov byte [ebp - 4], 0xf
mov ecx, dword [ebp - 0x7c]
mov edx, dword [ebp - 0x90]
push esi
call fcn.00427600
mov ecx, eax
call fcn.00427700
call fcn.00427590
push ebx
push eax
lea eax, [ebp - 0x100]
push eax
call fcn.0042c640
lea ecx, [ebp - 0x9c]
push ecx
mov ecx, eax
call fcn.00403216
mov byte [ebp - 4], 0x10
mov eax, dword [ebp - 0x88]
cmp dword [eax - 0xc], ebx
je 0x408ad9
call fcn.00408e53
test eax, eax
je 0x408acd
mov eax, dword [0x45fb34]
mov ecx, 0x45fb34
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x98], eax
lea eax, [ebp - 0xd4]
push eax
mov byte [ebp - 4], 0x11
call fcn.00426cd0
pop ecx
mov byte [ebp - 4], 0x12
push dword [ebp - 0x88]
push dword [eax]
lea eax, [ebp - 0x98]
push str._s_s.lnk
push eax
call fcn.00402dc0
mov eax, dword [ebp - 0xd4]
add esp, 0x10
add eax, 0xfffffff0
call fcn.00402f9a
push ebx
push ebx
push ebx
push dword [ebp - 0x98]
push str.taskbarunpin
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov byte [ebp - 4], 0x10
mov eax, dword [ebp - 0x98]
add eax, 0xfffffff0
call fcn.00402f9a
push dword [ebp - 0x88]
call fcn.0042e330
pop ecx
mov eax, dword [ebp - 0x9c]
add eax, 0xfffffff0
call fcn.00402f9a
mov byte [ebp - 4], 0xc
mov eax, dword [ebp - 0x88]
add eax, 0xfffffff0
call fcn.00402f9a
mov eax, dword [ebp - 0x90]
inc dword [ebp - 0x7c]
call fcn.004275b0
cmp dword [ebp - 0x7c], eax
jb 0x4089c3
mov eax, dword [0x45fb34]
mov edi, 0x45fb34
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x98], eax
mov byte [ebp - 4], 0x13
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x88], ebx
call fcn.004275b0
test eax, eax
jbe 0x408b8e
mov ecx, dword [ebp - 0x88]
mov edx, dword [ebp - 0x80]
push esi
call fcn.00427600
mov ecx, eax
call fcn.00427700
call fcn.00427590
push 0xfde9
push eax
lea eax, [ebp - 0x100]
push eax
call fcn.0042c640
push eax
lea eax, [ebp - 0x98]
push eax
call fcn.004031ed
mov eax, dword [ebp - 0x80]
inc dword [ebp - 0x88]
call fcn.004275b0
cmp dword [ebp - 0x88], eax
jb 0x408b3e
mov eax, dword [0x45fb34]
mov ecx, edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x94]
mov byte [ebp - 4], 0x14
push dword [ebp - 0x98]
push dword [eax + 0x464]
lea eax, [ebp - 0x90]
push str._s_s
push eax
call fcn.00402dc0
add esp, 0x10
push 0x4537ac
push 0x4537b0
lea eax, [ebp - 0x90]
push eax
call fcn.0040a3b1
lea esi, [ebp - 0xc0]
call fcn.00426dc0
lea eax, [ebp - 0x9c]
push 0x452f54
push eax
mov ecx, esi
mov byte [ebp - 4], 0x15
call fcn.00401d56
pop ecx
pop ecx
mov byte [ebp - 4], 0x16
mov ecx, dword [eax]
call fcn.00426510
mov eax, dword [ebp - 0x9c]
add eax, 0xfffffff0
call fcn.00402f9a
push ebx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], 0xf
call fcn.00401353
lea eax, [ebp - 0xb8]
push eax
lea esi, [ebp - 0x2c]
mov byte [ebp - 4], 0x17
call fcn.00427d80
mov esi, dword [ebp - 0x94]
push dword [esi + 0x440]
mov edi, str.ck_W_Rd
call fcn.0041e430
lea eax, [ebp - 0x154]
push eax
call fcn.0042cb40
mov byte [ebp - 4], 0x18
mov eax, dword [ebp - 0xa4]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x9c], esp
mov edi, esp
call fcn.00402e21
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0xb8]
mov ecx, esi
push eax
lea esi, [ebp - 0xd0]
call fcn.0040afb3
mov dword [ebp - 0x9c], esp
mov esi, esp
push 0x14
mov byte [ebp - 4], 0x19
call fcn.0043477b
pop ecx
mov dword [ebp - 0x9c], eax
mov byte [ebp - 4], 0x1a
cmp eax, ebx
je 0x408cc8
lea ecx, [ebp - 0xd0]
push ecx
push eax
call fcn.0040b045
jmp 0x408cca
xor eax, eax
mov byte [ebp - 4], 0x19
call fcn.0040b01e
mov byte [ebp - 4], 0x18
mov eax, dword [ebp - 0xc4]
add eax, 0xfffffff0
call fcn.00402f9a
lea ecx, [ebp - 0x154]
call fcn.0042ce10
lea eax, [ebp - 0x154]
call fcn.0042cf50
mov eax, dword [ebp - 0x94]
push dword [eax + 0x440]
mov edi, 0x453b18
call fcn.0041e430
lea eax, [ebp - 0x88]
push eax
push 0x2001f
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push closesocket
mov dword [ebp - 0x88], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x408d79
xor eax, eax
cmp dword [ebp - 0x84], ebx
je 0x408d50
push dword [ebp - 0x84]
call esi
cmp eax, ebx
mov edi, dword [ebp - 0x88]
mov dword [ebp - 0x84], edi
jne 0x408d79
push str.ThinkSky
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp edi, ebx
je 0x408d79
push edi
call esi
mov dword [ebp - 0x84], ebx
mov eax, dword [ebp + 8]
cmp dword [eax - 0xc], ebx
jne 0x408d8c
mov eax, dword [ebp - 0x94]
call fcn.00405ee7
lea eax, [ebp - 0x154]
push eax
mov byte [ebp - 4], 0x17
call fcn.0042cc30
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.00401308
mov eax, dword [ebp - 0xc0]
add eax, 0xfffffff0
call fcn.00402f9a
mov eax, dword [ebp - 0x90]
add eax, 0xfffffff0
call fcn.00402f9a
mov eax, dword [ebp - 0x98]
add eax, 0xfffffff0
call fcn.00402f9a
mov eax, dword [ebp - 0x8c]
add eax, 0xfffffff0
call fcn.00402f9a
cmp dword [ebp - 0x84], ebx
je 0x408def
push dword [ebp - 0x84]
call esi
lea eax, [ebp - 0xe0]
mov byte [ebp - 4], 6
call fcn.004023ce
mov eax, dword [ebp - 0xa4]
add eax, 0xfffffff0
call fcn.00402f9a
lea esi, [ebp - 0x120]
call fcn.0042d210
lea edi, [ebp - 0x100]
call fcn.0042c530
mov eax, dword [ebp - 0xa0]
add eax, 0xfffffff0
call fcn.00402f9a
xor esi, esi
inc esi
jmp 0x408598