Function at 0x464740
Capabilities:
Delete file
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4693e2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x244
mov eax, dword [0x47fe44]
mov edx, dword [eax + 0xc]
push ebx
push esi
push edi
mov ecx, 0x47fe44
call edx
add eax, 0x10
mov dword [esp + 0xc], eax
mov esi, dword [esp + 0x260]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x48]
push ecx
xor ebx, ebx
push esi
mov dword [esp + 0x264], ebx
call fcn.0045eeb0
mov edi, eax
cmp edi, ebx
jge 0x4647cc
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov dword [esp + 0x258], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4647c5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
jmp 0x464b76
push ebp
mov ebp, dword [esp + 0x268]
mov ecx, ebp
call fcn.0045fa50
cmp esi, ebx
jne 0x4647e3
xor eax, eax
jmp 0x4647f3
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x4647e8
sub eax, edx
push eax
push esi
mov ecx, ebp
call fcn.00403cc5
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x48]
lea ecx, [esp + 0x14]
push ecx
push SysReAllocStringLen
push ebx
push edx
push eax
mov byte [esp + 0x270], 1
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x46485c
mov edi, dword [esp + 0x14]
lea ecx, [esp + 0x150]
push ecx
push 0x104
mov dword [esp + 0x1c], edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x4648dc
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x46488b
call esi
mov esi, eax
jmp 0x46489b
jle 0x464868
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov dword [esp + 0x25c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x4648c5
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
cmp edi, ebx
je 0x4648a6
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov dword [esp + 0x25c], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x464a4d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
jmp 0x464b75
lea ecx, [esp + 0x4c]
push ecx
push ebx
push 0x46fd08
lea edx, [esp + 0x15c]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x46493a
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x46490b
call esi
mov esi, eax
jmp 0x46491b
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
cmp edi, ebx
je 0x464a44
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x10]
call fcn.00402073
mov eax, esi
jmp 0x464b75
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 0x4c]
push eax
call esi
lea ecx, [esp + 0x4c]
push ecx
lea edx, [esp + 0x20]
push esi
push edx
call fcn.00464350
add esp, 0xc
mov dword [esp + 0x24], vtable.ATL::CAccessToken.0
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov byte [esp + 0x25c], 3
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x28
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
lea ecx, [esp + 0x24]
je 0x4649a6
mov edx, dword [esp + 0x24]
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x28], ecx
jmp 0x4649b2
push ebx
push 0x28
call fcn.004642e0
cmp al, bl
je 0x4649c2
push ebx
push ebx
push str.SeBackupPrivilege
lea ecx, [esp + 0x30]
call fcn.00440460
push ebx
lea edx, [esp + 0x50]
push edx
push edi
call dword [sym.imp.ADVAPI32.dll_RegSaveKeyA]
cmp eax, ebx
je 0x4649f1
jle 0x4649df
and eax, 0xffff
or eax, 0x80070000
lea ecx, [esp + 0x24]
mov esi, eax
call fcn.00440440
mov eax, dword [esp + 0x20]
push eax
jmp 0x464a2f
lea ecx, [esp + 0x24]
call fcn.00440440
mov dword [esp + 0x18], ebx
push ebx
push ebx
push 0x80
push 3
push ebx
push SysReAllocStringLen
lea ecx, [esp + 0x64]
push ecx
lea ecx, [esp + 0x34]
call fcn.0040abeb
mov esi, eax
cmp esi, ebx
jge 0x464a54
lea ecx, [esp + 0x18]
call fcn.0040c5f6
mov edx, dword [esp + 0x20]
push edx
mov byte [esp + 0x260], 1
call dword [esp + 0x20]
lea ecx, [esp + 0x14]
call fcn.00402895
lea ecx, [esp + 0x10]
call fcn.00402073
mov eax, esi
jmp 0x464b75
mov dword [esp + 0x24], ebx
mov dword [esp + 0x2c], ebx
mov eax, dword [esp + 0x18]
push 4
push 2
push ebx
push ebx
push ebx
push eax
lea ecx, [esp + 0x3c]
mov byte [esp + 0x274], 5
call fcn.00421e50
mov edi, eax
cmp edi, ebx
mov dword [esp + 0x44], edi
jge 0x464aee
mov eax, dword [esp + 0x24]
xor esi, esi
cmp eax, ebx
je 0x464a9f
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test eax, eax
jne 0x464a9f
call fcn.004021a3
mov esi, eax
mov eax, dword [esp + 0x2c]
cmp eax, ebx
je 0x464abb
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x464abb
cmp esi, ebx
jl 0x464abb
call fcn.004021a3
lea ecx, [esp + 0x18]
call fcn.0040c5f6
mov ecx, dword [esp + 0x20]
push ecx
mov byte [esp + 0x260], 1
call dword [esp + 0x20]
lea ecx, [esp + 0x14]
call fcn.00402895
lea ecx, [esp + 0x10]
call fcn.00402073
mov eax, edi
jmp 0x464b75
mov edx, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
add edx, 0xfffff000
push edx
lea eax, [esi + 0x1000]
push eax
lea ecx, [eax + 0x20]
push ecx
push ebp
call fcn.00464380
add esp, 0x10
xor edi, edi
cmp esi, ebx
je 0x464b29
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test eax, eax
jne 0x464b29
call fcn.004021a3
mov edi, eax
mov eax, dword [esp + 0x2c]
cmp eax, ebx
je 0x464b45
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x464b45
cmp edi, ebx
jl 0x464b45
call fcn.004021a3
lea ecx, [esp + 0x18]
call fcn.0040c5f6
mov eax, dword [esp + 0x20]
push eax
mov byte [esp + 0x260], 1
call dword [esp + 0x20]
lea ecx, [esp + 0x14]
call fcn.00402895
lea ecx, [esp + 0x10]
call fcn.00402073
mov eax, dword [esp + 0x44]
pop ebp
mov ecx, dword [esp + 0x250]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x250
ret 8