Function at 0x404850
Capabilities:
Check if file exists
Delete registry value
Get file attributes
Persist via run registry key
Query environment variable
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x431ee6
mov eax, dword fs:[0]
push eax
sub esp, 0x438
mov eax, dword [0x448090]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x440], ecx
call fcn.004047b0
test eax, eax
je 0x404d66
mov eax, dword [0x448020]
mov ecx, 0x448020
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x41c], esi
push 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x104
or eax, ecx
jge 0x4048e0
push 0x104
lea ecx, [ebp - 0x41c]
call fcn.004026b0
mov esi, dword [ebp - 0x41c]
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x104
push esi
push 0
call ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x42c], eax
cmp edi, 0xffffffff
jne 0x404917
push dword [esi - 8]
push esi
call fcn.00420547
mov edi, eax
mov eax, dword [ebp - 0x42c]
add esp, 8
test edi, edi
js 0x404be1
cmp edi, dword [esi - 8]
jg 0x404be1
xor ecx, ecx
mov dword [esi - 0xc], edi
mov word [esi + edi*2], cx
cmp eax, 0x7a
jne 0x404995
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x7fff
or eax, ecx
jge 0x404960
push 0x7fff
lea ecx, [ebp - 0x41c]
call fcn.004026b0
mov esi, dword [ebp - 0x41c]
push 0x7fff
push esi
push 0
call ebx
cmp eax, 0xffffffff
jne 0x40497b
push dword [esi - 8]
push esi
call fcn.00420547
add esp, 8
test eax, eax
js 0x404be1
cmp eax, dword [esi - 8]
jg 0x404be1
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
cmp dword [esi - 4], 1
jle 0x4049af
push dword [esi - 0xc]
lea ecx, [ebp - 0x41c]
call fcn.004025f0
mov esi, dword [ebp - 0x41c]
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push dword [esi - 8]
push esi
call fcn.00420547
add esp, 8
test eax, eax
js 0x404be1
cmp eax, dword [esi - 8]
jg 0x404be1
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
sub esp, 8
lea ecx, [ebp - 0x41c]
call fcn.00404d90
push 0x17
push str.PCKeeper.exe___autorun
lea ecx, [ebp - 0x41c]
call fcn.004032b0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x438]
push eax
push 0x20119
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionProfileList
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x438], 0
call ebx
mov edi, dword [ebp - 0x41c]
or ecx, 0xffffffff
test eax, eax
jne 0x404d48
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
mov dword [ebp - 0x424], ecx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x210]
push eax
push ecx
push dword [ebp - 0x438]
mov dword [ebp - 0x444], 0xff
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
sete al
test al, al
je 0x404d45
inc dword [ebp - 0x424]
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404a90
sub ecx, edx
sar ecx, 1
cmp ecx, 9
mov ecx, dword [ebp - 0x424]
jb 0x404a45
lea eax, [ebp - 0x428]
push eax
push 0x20119
push 0
lea eax, [ebp - 0x210]
push eax
push SysStringLen
mov dword [ebp - 0x428], 0
call ebx
test eax, eax
je 0x404c9d
lea eax, [ebp - 0x434]
push eax
push 0x20119
push 0
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x438]
mov dword [ebp - 0x434], 0
call ebx
test eax, eax
jne 0x404c9d
mov dword [ebp - 0x42c], eax
mov eax, dword [0x448020]
mov ecx, 0x448020
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x420], esi
lea eax, [ebp - 0x43c]
push eax
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x42c]
push eax
push 0
mov byte [ebp - 4], 1
push str.ProfileImagePath
push dword [ebp - 0x434]
mov dword [ebp - 0x43c], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x404c08
mov eax, dword [ebp - 0x43c]
cmp eax, 0x206
jae 0x404c08
and eax, 0xfffffffe
cmp eax, 0x208
jae 0x404d40
xor ecx, ecx
mov word [ebp + eax - 0x418], cx
mov eax, dword [ebp - 0x42c]
cmp eax, 2
jne 0x404beb
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x104
or eax, ecx
jge 0x404bbf
push 0x104
lea ecx, [ebp - 0x420]
call fcn.004026b0
mov esi, dword [ebp - 0x420]
push 0x104
push esi
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x420]
call fcn.00402260
jmp 0x404c08
push 0x80070057
call fcn.00402950
cmp eax, 1
jne 0x404c08
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x420]
call fcn.00402500
mov esi, dword [ebp - 0x420]
cmp dword [esi - 0xc], 0
je 0x404c6d
push str.NTUSER.DAT
lea ecx, [ebp - 0x420]
call fcn.004031e0
mov esi, dword [ebp - 0x420]
push esi
mov dword [ebp - 0x428], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x404c6d
push esi
lea eax, [ebp - 0x210]
push eax
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
test eax, eax
jne 0x404c6d
lea eax, [ebp - 0x428]
push eax
push 0x20119
push 0
lea eax, [ebp - 0x210]
push eax
push SysStringLen
call ebx
push dword [ebp - 0x434]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esi, 0xfffffff0
mov byte [ebp - 4], 0
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x404c97
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x428]
mov ecx, dword [ebp - 0x424]
test eax, eax
je 0x404a45
lea ecx, [ebp - 0x430]
push ecx
push 0x10102
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push eax
mov dword [ebp - 0x430], 0
call ebx
test eax, eax
jne 0x404d2d
mov ecx, dword [ebp - 0x430]
test ecx, ecx
je 0x404d2d
cmp dword [ebp - 0x440], eax
je 0x404d19
mov eax, dword [edi - 0xc]
add eax, eax
push eax
push edi
push 1
push 0
push str.PCKeeper2
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x430]
call esi
push dword [ebp - 0x428]
call esi
mov ecx, dword [ebp - 0x424]
jmp 0x404a45
push str.PCKeeper2
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x430]
call esi
push dword [ebp - 0x428]
call esi
mov ecx, dword [ebp - 0x424]
jmp 0x404a45
call fcn.00420c9c
or ecx, 0xffffffff
add edi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [edi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x404d66
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041fe49
mov esp, ebp
pop ebp
ret