Function at 0x44d350
Capabilities:
Check os version
Delete registry value
Get common file path
Get file size
Query or enumerate registry value
Read file on windows
Set registry value
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49f4d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x3564
call fcn.0048db70
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push 0x104
lea eax, [ebp - 0x120]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push str._rerun
lea ecx, [ebp - 0x120]
push ecx
call fcn.0048e0a0
add esp, 8
mov dword [ebp - 0x18], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x14], SysStringLen
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x124], 0
mov dword [ebp - 4], 0
mov edx, 1
test edx, edx
je 0x44dab9
mov byte [ebp - 0x129], 0
mov dword [ebp - 0x130], 0
jmp 0x44d3f9
mov eax, dword [ebp - 0x130]
add eax, 1
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 2
jae 0x44d4e0
lea ecx, [ebp - 0x134]
push ecx
push 0x20019
push 0
push 0x4b77d8
mov edx, dword [ebp - 0x130]
mov eax, dword [ebp + edx*4 - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x44d4db
mov dword [ebp - 0x244], 0x104
lea ecx, [ebp - 0x244]
push ecx
lea edx, [ebp - 0x240]
push edx
push 0
push 0
push 0x4b6fbc
mov eax, dword [ebp - 0x134]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x44d4ce
lea ecx, [ebp - 0x240]
push ecx
lea edx, [ebp - 0x120]
push edx
call fcn.0049a8c5
add esp, 8
test eax, eax
jne 0x44d487
mov byte [ebp - 0x129], 1
jmp 0x44d4ce
lea eax, [ebp - 0x248]
push eax
push 0x20006
push 0
push 0x4b77d8
mov ecx, dword [ebp - 0x130]
mov edx, dword [ebp + ecx*4 - 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x44d4ce
push 0x4b6fbc
mov eax, dword [ebp - 0x248]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, dword [ebp - 0x248]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x134]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x44d3ea
movzx eax, byte [ebp - 0x129]
test eax, eax
jne 0x44d597
mov dword [ebp - 0x24c], 0
jmp 0x44d50a
mov ecx, dword [ebp - 0x24c]
add ecx, 1
mov dword [ebp - 0x24c], ecx
cmp dword [ebp - 0x24c], 2
jae 0x44d597
push 0
lea edx, [ebp - 0x250]
push edx
push 0
push 0x20006
push 0
push 0
push 0
push 0x4b77d8
mov eax, dword [ebp - 0x24c]
mov ecx, dword [ebp + eax*4 - 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x44d592
lea edx, [ebp - 0x120]
push edx
call fcn.0048bc60
add esp, 4
push eax
lea eax, [ebp - 0x120]
push eax
push 1
push 0
push 0x4b6fbc
mov ecx, dword [ebp - 0x250]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x254], eax
mov edx, dword [ebp - 0x250]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x254], 0
jne 0x44d592
jmp 0x44d597
jmp 0x44d4fb
cmp dword [ebp + 8], 0
je 0x44d5a2
jmp 0x44dab9
mov dword [ebp - 0x3574], 0x94
lea eax, [ebp - 0x3574]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
xor ecx, ecx
cmp dword [ebp - 0x3564], 2
sete cl
movzx edx, cl
test edx, edx
je 0x44d817
push 0
lea eax, [ebp - 0x258]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push str.SYSTEMCurrentControlSetControlSession_Manager
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x44d812
mov dword [ebp - 0xc8c], 0xa28
mov dword [ebp - 0x25c], 0
lea ecx, [ebp - 0xc8c]
push ecx
lea edx, [ebp - 0xc88]
push edx
push 0
push 0
push str.PendingFileRenameOperations
mov eax, dword [ebp - 0x258]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x44d6f7
mov dword [ebp - 0xc94], 0
jmp 0x44d659
mov ecx, dword [ebp - 0xc94]
add ecx, 1
mov dword [ebp - 0xc94], ecx
mov edx, dword [ebp - 0xc94]
cmp edx, dword [ebp - 0xc8c]
jae 0x44d68d
mov eax, dword [ebp - 0xc94]
movsx ecx, byte [ebp + eax - 0xc88]
push ecx
call fcn.0048c48e
add esp, 4
mov edx, dword [ebp - 0xc94]
mov byte [ebp + edx - 0xc88], al
jmp 0x44d64a
mov dword [ebp - 0xc90], 0
mov eax, dword [ebp - 0xc90]
cmp eax, dword [ebp - 0xc8c]
jae 0x44d6f7
push 0x4b8598
mov ecx, dword [ebp - 0xc90]
lea edx, [ebp + ecx - 0xc88]
push edx
call fcn.0048c340
add esp, 8
test eax, eax
je 0x44d6d6
push str.PendingFileRenameOperations
mov eax, dword [ebp - 0x258]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
lea ecx, [ebp - 0xc88]
push ecx
call fcn.0048bc60
add esp, 4
mov edx, dword [ebp - 0xc90]
lea eax, [edx + eax + 2]
mov dword [ebp - 0xc90], eax
jmp 0x44d697
push 0xa28
push 0
lea ecx, [ebp - 0xc88]
push ecx
call fcn.0048d000
add esp, 0xc
mov dword [ebp - 0xc8c], 0xa28
lea edx, [ebp - 0xc8c]
push edx
lea eax, [ebp - 0xc88]
push eax
push 0
push 0
push str.PendingFileRenameOperations2
mov ecx, dword [ebp - 0x258]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x44d805
mov dword [ebp - 0xc9c], 0
jmp 0x44d75e
mov edx, dword [ebp - 0xc9c]
add edx, 1
mov dword [ebp - 0xc9c], edx
lea eax, [ebp - 0xc88]
push eax
call fcn.0048bc60
add esp, 4
cmp dword [ebp - 0xc9c], eax
jae 0x44d79b
mov ecx, dword [ebp - 0xc9c]
movsx edx, byte [ebp + ecx - 0xc88]
push edx
call fcn.0048c48e
add esp, 4
mov ecx, dword [ebp - 0xc9c]
mov byte [ebp + ecx - 0xc88], al
jmp 0x44d74f
mov dword [ebp - 0xc98], 0
mov edx, dword [ebp - 0xc98]
cmp edx, dword [ebp - 0xc8c]
jae 0x44d805
push 0x4b8598
mov eax, dword [ebp - 0xc98]
lea ecx, [ebp + eax - 0xc88]
push ecx
call fcn.0048c340
add esp, 8
test eax, eax
je 0x44d7e4
push str.PendingFileRenameOperations
mov edx, dword [ebp - 0x258]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
lea eax, [ebp - 0xc88]
push eax
call fcn.0048bc60
add esp, 4
mov ecx, dword [ebp - 0xc98]
lea edx, [ecx + eax + 2]
mov dword [ebp - 0xc98], edx
jmp 0x44d7a5
mov eax, dword [ebp - 0x258]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x44daa9
push 0x104
lea ecx, [ebp - 0xda8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.wininit.ini
lea edx, [ebp - 0xda8]
push edx
call fcn.0048e0a0
add esp, 8
push 0
push 0x8000080
push 4
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0xda8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xca0], eax
cmp dword [ebp - 0xca0], 0xffffffff
je 0x44daa9
push 0
mov ecx, dword [ebp - 0xca0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0xdac], eax
cmp dword [ebp - 0xdac], 0x2710
jae 0x44da9c
mov dword [ebp - 0xdb0], 0
push 0
lea edx, [ebp - 0xdb0]
push edx
mov eax, dword [ebp - 0xdac]
push eax
lea ecx, [ebp - 0x34c8]
push ecx
mov edx, dword [ebp - 0xca0]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x34cc], 0
jmp 0x44d8dd
mov eax, dword [ebp - 0x34cc]
add eax, 1
mov dword [ebp - 0x34cc], eax
lea ecx, [ebp - 0x34c8]
push ecx
call fcn.0048bc60
add esp, 4
cmp dword [ebp - 0x34cc], eax
jae 0x44d91a
mov edx, dword [ebp - 0x34cc]
movsx eax, byte [ebp + edx - 0x34c8]
push eax
call fcn.0048c48e
add esp, 4
mov ecx, dword [ebp - 0x34cc]
mov byte [ebp + ecx - 0x34c8], al
jmp 0x44d8ce
push 0x4b8598
lea edx, [ebp - 0x34c8]
push edx
call fcn.0048c340
add esp, 8
mov dword [ebp - 0xdb4], eax
cmp dword [ebp - 0xdb4], 0
je 0x44da9c
mov eax, dword [ebp - 0xdb4]
mov dword [ebp - 0x34d8], eax
mov dword [ebp - 0x34d0], 0
mov ecx, dword [ebp - 0xdac]
mov dword [ebp - 0x34d4], ecx
mov edx, dword [ebp - 0xdac]
lea eax, [ebp + edx - 0x34c8]
cmp dword [ebp - 0x34d8], eax
jae 0x44d9bb
mov ecx, dword [ebp - 0x34d8]
movsx edx, byte [ecx]
cmp edx, 0xa
je 0x44d994
mov eax, dword [ebp - 0x34d8]
movsx ecx, byte [eax]
cmp ecx, 0xd
jne 0x44d9aa
mov edx, dword [ebp - 0x34d8]
lea eax, [ebp - 0x34c8]
sub edx, eax
mov dword [ebp - 0x34d4], edx
jmp 0x44d9bb
mov ecx, dword [ebp - 0x34d8]
add ecx, 1
mov dword [ebp - 0x34d8], ecx
jmp 0x44d963
mov edx, dword [ebp - 0xdb4]
mov dword [ebp - 0x34d8], edx
mov eax, dword [ebp - 0x34d8]
lea ecx, [ebp - 0x34c8]
cmp eax, ecx
jbe 0x44da1a
mov edx, dword [ebp - 0x34d8]
movsx eax, byte [edx]
cmp eax, 0xa
je 0x44d9f3
mov ecx, dword [ebp - 0x34d8]
movsx edx, byte [ecx]
cmp edx, 0xd
jne 0x44da09
mov eax, dword [ebp - 0x34d8]
lea ecx, [ebp - 0x34c8]
sub eax, ecx
mov dword [ebp - 0x34d0], eax
jmp 0x44da1a
mov edx, dword [ebp - 0x34d8]
sub edx, 1
mov dword [ebp - 0x34d8], edx
jmp 0x44d9c7
mov dword [ebp - 0x34dc], 0
push 0
push 0
push 0
mov eax, dword [ebp - 0xca0]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea ecx, [ebp - 0x34dc]
push ecx
mov edx, dword [ebp - 0x34d0]
add edx, 1
push edx
lea eax, [ebp - 0x34c8]
push eax
mov ecx, dword [ebp - 0xca0]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea edx, [ebp - 0x34dc]
push edx
mov eax, dword [ebp - 0xdb0]
sub eax, dword [ebp - 0x34d4]
push eax
mov ecx, dword [ebp - 0x34d4]
lea edx, [ebp + ecx - 0x34c8]
push edx
mov eax, dword [ebp - 0xca0]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0xca0]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov edx, dword [ebp - 0xca0]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x44d3ca
jmp 0x44dae0
mov dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4