Function at 0x407638
Capabilities:
Check if file exists
Delete file
Get file attributes
Persist via run registry key

Disassembly:
push 0x228
mov eax, 0x40d835
call fcn.0040d3c7
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov eax, dword [0x40f038]
cmp eax, 0x40f038
je 0x407673
test byte [eax + 0x1c], 8
je 0x407673
push edi
push dword [eax + 0x14]
mov edx, 0x401ec0
push dword [eax + 0x10]
push 0x24
pop ecx
call fcn.004044cc
lea eax, [ebp - 0x21c]
push eax
push ecx
push 3
push 0
push ecx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionAccessibility
push 0x80000001
mov ecx, ebx
call fcn.0040574e
mov esi, eax
test esi, esi
je 0x4076ce
mov eax, dword [0x40f038]
cmp eax, 0x40f038
je 0x4076b8
test byte [eax + 0x1c], 8
je 0x4076b8
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x25
pop ecx
call fcn.004058e8
test esi, esi
jle 0x407962
movzx esi, si
or esi, 0x80070000
jmp 0x407962
push ecx
push edi
push str.Configuration
mov ecx, ebx
call fcn.0040585f
mov esi, eax
test esi, esi
je 0x4076ff
mov eax, dword [0x40f038]
cmp eax, 0x40f038
je 0x4076b8
test byte [eax + 0x1c], 8
je 0x4076b8
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x26
jmp 0x4076b2
xor ecx, ecx
mov ebx, ecx
mov dword [ebp - 0x234], ebx
mov dword [ebp - 0x230], ecx
mov dword [ebp - 0x22c], ecx
lea eax, [ebp - 0x21c]
mov dword [ebp - 4], ecx
push eax
push 0x20019
push ecx
push 0x401d48
push 0x80000001
mov dword [ebp - 0x21c], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x40791e
mov ebx, dword [ebp - 0x21c]
push 0x208
push eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x234], ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x21c], 0x104
lea eax, [ebp - 0x21c]
lea ecx, [ebp - 0x234]
push eax
lea eax, [ebp - 0x218]
push eax
push 0x401dcc
call fcn.004057ae
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x228]
call fcn.00407b84
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x224]
call fcn.00407b84
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x220]
call fcn.00407b84
push 0x17
push 0x401ddc
lea ecx, [ebp - 0x228]
mov byte [ebp - 4], 3
call fcn.00407cf4
push 0xd
push 0x401e0c
lea ecx, [ebp - 0x224]
call fcn.00407cf4
push 0xe
push 0x401e28
lea ecx, [ebp - 0x220]
call fcn.00407cf4
push dword [ebp - 0x228]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x407853
push 0x401e48
mov ecx, edi
call fcn.00408052
push dword [ebp - 0x228]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [0x40f038]
mov esi, 0x40f038
cmp eax, esi
je 0x407858
test byte [eax + 0x1c], 0x10
je 0x407858
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x28
pop ecx
call fcn.004058c6
jmp 0x407858
mov esi, 0x40f038
push dword [ebp - 0x224]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40789e
push 0x401e60
mov ecx, edi
call fcn.00408052
push dword [ebp - 0x224]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [0x40f038]
cmp eax, esi
je 0x40789e
test byte [eax + 0x1c], 0x10
je 0x40789e
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x29
pop ecx
call fcn.004058c6
push dword [ebp - 0x220]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4078e4
push 0x401e80
mov ecx, edi
call fcn.00408052
push dword [ebp - 0x220]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [0x40f038]
cmp eax, esi
je 0x4078e4
test byte [eax + 0x1c], 0x10
je 0x4078e4
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x2a
pop ecx
call fcn.004058c6
mov byte [ebp - 4], 2
xor esi, esi
mov ecx, dword [ebp - 0x220]
lea ecx, [ecx - 0x10]
call fcn.004036aa
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x224]
lea ecx, [ecx - 0x10]
call fcn.004036aa
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x228]
lea ecx, [ecx - 0x10]
call fcn.004036aa
jmp 0x40794c
mov eax, dword [0x40f038]
cmp eax, 0x40f038
je 0x40793f
test byte [eax + 0x1c], 8
je 0x40793f
push esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x27
pop ecx
call fcn.004058e8
test esi, esi
jle 0x40794c
movzx esi, si
or esi, 0x80070000
or dword [ebp - 4], 0xffffffff
test ebx, ebx
je 0x407962
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x234], 0
mov eax, esi
call fcn.0040d376
ret 0xc