Function at 0x4853b0
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
add esp, 0xfffffba0
mov ecx, dword [esp + 0x464]
mov al, 0xc2
push ebx
mov byte [esp + 0x15], al
xor ebx, ebx
mov byte [esp + 0x19], al
push esi
lea eax, [esp + 0xc]
push edi
push eax
push 0x20019
push ebx
push ecx
push reloc.WS2_32.dll_bind
mov dword [esp + 0x28], 0xaac56b
mov word [esp + 0x2c], 0xcd44
mov word [esp + 0x2e], 0x11d0
mov byte [esp + 0x30], 0x8c
mov byte [esp + 0x32], bl
mov byte [esp + 0x33], 0xc0
mov byte [esp + 0x34], 0x4f
mov byte [esp + 0x36], 0x95
mov byte [esp + 0x37], 0xee
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
or eax, eax
je 0x485426
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x460
ret
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x168]
lea edx, [esp + 0x24]
push edx
push eax
push ebx
push ebx
push str.ImagePath
push ecx
mov dword [esp + 0x3c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
or eax, eax
je 0x48548b
lea edx, [esp + 0x64]
push 0x104
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x64]
mov eax, dword [esp + 0x474]
push eax
push ecx
lea edx, [esp + 0x6c]
push str._sDRIVERS_s
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
lea edi, [esp + 0x74]
add esp, 0x10
mov dword [esp + 0xc], edi
jmp 0x4854ed
lea eax, [esp + 0x168]
push 0x4eb364
push eax
call fcn.004b0520
add esp, 8
test eax, eax
je 0x4854b1
lea ecx, [esp + 0x168]
mov dword [esp + 0xc], ecx
jmp 0x4854e9
lea edx, [esp + 0x64]
push 0x104
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x64]
mov eax, dword [esp + 0x474]
push eax
push ecx
lea edx, [esp + 0x6c]
push str._sDRIVERS_s
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x74]
sub esp, 0xfffffff0
mov dword [esp + 0xc], eax
mov edi, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call fcn.00485370
mov ecx, eax
sub esp, 0xfffffffc
cmp ecx, ebx
je 0x48551a
add eax, 0xfffffffe
pop edi
pop esi
pop ebx
neg eax
sbb eax, eax
and eax, ecx
add esp, 0x460
ret
mov al, byte [edi]
xor esi, esi
cmp al, bl
je 0x485547
push ebp
lea ebp, [esp + 0x270]
push 1
push edi
push ebp
call fcn.004b251f
mov al, byte [edi + 1]
sub esp, 0xfffffff4
inc esi
add ebp, 2
inc edi
cmp al, bl
jne 0x48552a
mov edi, dword [esp + 0x10]
pop ebp
push 1
lea edx, [esi + edi]
lea eax, [esp + esi*2 + 0x270]
push edx
push eax
call fcn.004b251f
mov ecx, 0xb
lea esi, [esp + 0x278]
mov edx, 0x10
xor eax, eax
lea edi, [esp + 0x44]
mov dword [esp + 0x38], esi
rep stosd dword es:[edi], eax
add esp, 0xc
lea eax, [esp + 0x28]
push str.wintrust.dll
mov dword [esp + 0x2c], edx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], 0x2c
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], 2
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], 1
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], ebx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x4855e3
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
sub esp, 0xfffffba0
ret
push str.WinVerifyTrust
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
mov dword [0x500008], eax
jne 0x485608
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
sub esp, 0xfffffba0
ret
lea edx, [esp + 0x14]
lea ecx, [esp + 0x38]
push ecx
push edx
push 0xffffffffffffffff
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
pop edi
pop esi
pop ebx
sub esp, 0xfffffba0
ret