Function at 0x419750
Capabilities:
Check if file exists
Delete file
Get common file path
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x26c
mov eax, dword [0x48c8b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
mov esi, edx
mov dword [ebp - 0x244], ecx
push 0x47c3e0
mov ecx, ebx
mov dword [ebp - 0x250], esi
mov dword [ebp - 0x238], edi
call fcn.00416dd0
push ebx
mov ecx, edi
call fcn.00416f30
push edi
mov ecx, esi
call fcn.00416f30
mov ecx, dword [ebp - 0x244]
push esi
call fcn.00416f30
push str.WindowsTempA.bin
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x254]
push eax
call fcn.0040de20
push str.WindowsTempB.bin
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x258]
push eax
call fcn.0040de20
add esp, 0x18
lea ecx, [ebp - 0x26c]
call fcn.004263dd
mov edi, dword [ebp - 0x254]
push 0
push 0x1001
push edi
lea ecx, [ebp - 0x26c]
call fcn.004268d4
mov esi, dword [ebp - 0x258]
test eax, eax
jne 0x41980e
push 4
push 0x47cb5c
jmp 0x419852
lea ecx, [ebp - 0x26c]
call fcn.004266a8
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41983d
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x41983d
push 0x47cb5c
mov ecx, ebx
call fcn.00416b50
jmp 0x419859
push 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateHardLinkW]
test eax, eax
jne 0x419859
push 4
push 0x47cb68
mov ecx, ebx
call fcn.00416dd0
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41986b
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41987d
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x14
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x234], ax
lea eax, [ebp - 0x232]
push eax
mov dword [ebp - 0x248], 0
mov dword [ebp - 0x24c], 0
mov dword [ebp - 0x23c], 0
call fcn.004470b0
mov eax, dword [ebp + 8]
add esp, 0xc
cmp dword [eax - 0xc], 0
jl 0x419edf
mov cx, word [ebp - 0x2c]
cmp cx, word [eax]
je 0x419998
push 0x20
push str.WindowsSystem32configSOFTWARE
lea ecx, [ebp + 8]
call fcn.004165a0
push dword [ebp + 8]
push str.SOFTWARE
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
test eax, eax
je 0x419924
push 4
push 0x47cb74
mov ecx, ebx
call fcn.00416dd0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x238], eax
jmp 0x419e6c
lea eax, [ebp - 0x248]
push eax
push 0x20019
push 0
push str.SOFTWARE
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4199d5
push 0x47cb74
mov ecx, ebx
call fcn.00416b50
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x23c]
mov dword [ebp - 0x238], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x248]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 8]
cmp dword [eax - 0xc], 0
jge 0x419e3d
jmp 0x419ee9
lea eax, [ebp - 0x248]
push eax
push 0x20119
push 0
push str.SOFTWARE
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4199d5
push 4
push 0x47cb74
mov ecx, ebx
call fcn.00416dd0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x419e72
lea eax, [ebp - 0x24c]
push eax
push 0x20019
push 0
push str.Wow6432NodeMicrosoftWindows_NTCurrentVersion
push dword [ebp - 0x248]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x419a0c
mov ecx, dword [ebp - 0x250]
push 5
push str.AMD64
call fcn.00416dd0
jmp 0x419a43
lea eax, [ebp - 0x24c]
push eax
push 0x20019
push 0
push str.MicrosoftWindows_NTCurrentVersion
push dword [ebp - 0x248]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41994a
mov ecx, dword [ebp - 0x250]
push 0x47cac8
call fcn.00416b50
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x234]
push eax
push 0
push 0
push 0x47cad0
push dword [ebp - 0x24c]
mov dword [ebp - 0x240], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x419e2a
lea edx, [ebp - 0x234]
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x419a81
sub edx, ecx
mov ecx, dword [ebp - 0x244]
sar edx, 1
push edx
lea eax, [ebp - 0x234]
push eax
call fcn.00416dd0
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x234]
push eax
push 0
push 0
push 0x47caec
push dword [ebp - 0x24c]
mov dword [ebp - 0x240], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41994a
mov ecx, dword [ebp - 0x238]
lea eax, [ebp - 0x234]
push eax
call fcn.00416b50
mov ecx, dword [ebp - 0x238]
call fcn.0041a0a0
test al, al
je 0x419b12
mov ecx, dword [ebp - 0x238]
call fcn.0041a060
test al, al
je 0x419b12
push 0x47cb94
jmp 0x41994f
lea eax, [ebp - 0x23c]
push eax
push 0x20019
push 0
push str.MicrosoftWindowsCurrentVersionWindowsUpdateAuto_Update
push dword [ebp - 0x248]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x419bc8
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x234]
push eax
push 0
push 0
push str.InstallInProgress
push dword [ebp - 0x23c]
mov dword [ebp - 0x240], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x419b7c
cmp dword [ebp - 0x234], eax
je 0x419b7c
push 0x47cc3c
jmp 0x41994f
lea eax, [ebp - 0x244]
push eax
push 0x20019
push 0
push str.RebootRequired
push dword [ebp - 0x23c]
mov dword [ebp - 0x244], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x419bc0
push dword [ebp - 0x244]
call eax
push 0x47cc68
jmp 0x41994f
push dword [ebp - 0x23c]
call eax
lea eax, [ebp - 0x23c]
push eax
push 0x20019
push 0
push str.MicrosoftWindowsCurrentVersionComponent_Based_ServicingSessionsPending
push dword [ebp - 0x248]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x419cfb
push 0x104
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x244], eax
lea eax, [ebp - 0x234]
push eax
push 0
push dword [ebp - 0x23c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x419cef
lea ecx, [ecx]
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x234]
push eax
push dword [ebp - 0x23c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x419956
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x234]
push eax
push 0
push 0
push str.PendingSequence
push dword [ebp - 0x238]
mov dword [ebp - 0x240], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x419cb5
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x234]
push eax
push 0
push 0
push str.Complete
push dword [ebp - 0x238]
mov dword [ebp - 0x240], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x419df7
cmp dword [ebp - 0x234], 1
jne 0x419df7
push dword [ebp - 0x238]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x244]
push 0x104
lea ecx, [ebp - 0x234]
inc eax
push ecx
push eax
push dword [ebp - 0x23c]
mov dword [ebp - 0x244], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x419c20
push dword [ebp - 0x23c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x23c]
push eax
push 0x20019
push 0
push str.MicrosoftWindowsCurrentVersionComponent_Based_ServicingPackages
push dword [ebp - 0x248]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41994a
push 0x104
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x244], eax
lea eax, [ebp - 0x234]
push eax
push 0
push dword [ebp - 0x23c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x419de6
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x234]
push eax
push dword [ebp - 0x23c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x41994a
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x234]
push eax
push 0
push 0
push str.CurrentState
push dword [ebp - 0x238]
mov dword [ebp - 0x240], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x419dac
cmp dword [ebp - 0x234], 0x60
je 0x419e0d
push dword [ebp - 0x238]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x244]
push 0x104
lea ecx, [ebp - 0x234]
inc eax
push ecx
push eax
push dword [ebp - 0x23c]
mov dword [ebp - 0x244], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x419d50
push dword [ebp - 0x23c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x419956
push dword [ebp - 0x238]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x47cc68
jmp 0x41994f
push 0x47cc68
mov ecx, ebx
call fcn.00416b50
push dword [ebp - 0x238]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x419956
push 4
push 0x47cb74
mov ecx, ebx
call fcn.00416dd0
jmp 0x419956
mov cx, word [ebp - 0x2c]
cmp cx, word [eax]
je 0x419e56
push str.SOFTWARE
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
mov eax, dword [ebx]
cmp dword [eax - 0xc], 0
jne 0x419e6c
push 2
push 0x47cde4
mov ecx, ebx
call fcn.00416dd0
mov ebx, dword [ebp - 0x238]
lea ecx, [ebp - 0x26c]
call fcn.00426453
lea edx, [esi - 0x10]
or esi, 0xffffffff
lea ecx, [edx + 0xc]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x419e99
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
mov ecx, esi
lea eax, [edi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x419eb2
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp + 8]
add edi, 0xfffffff0
lea eax, [edi + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x419ecc
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0043ddbb
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.00416fc0
push 0x80070057
call fcn.00416fc0
int3