Function at 0x408080
Capabilities:
Delete file
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x438070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x48], 8
lea esi, [edi + 0x34]
jb 0x4080a2
mov eax, dword [esi]
jmp 0x4080a4
mov eax, esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 0
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push eax
push 0x80000001
call ebx
test eax, eax
jne 0x408103
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x4080fd
push 4
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 3
push eax
push 4
push 0
push str.Status
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov eax, dword [edi + 0x7c]
inc eax
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x24], eax
jb 0x408114
mov eax, dword [esi]
jmp 0x408116
mov eax, esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x20], 0
push ecx
lea ecx, [ebp - 0x20]
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push eax
push 0x80000001
call ebx
test eax, eax
jne 0x408168
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x408168
mov eax, dword [ebp - 0x24]
push 4
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push 4
push 0
push str.AlreadyRunCount
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push str..pipeKuGouServicePipe
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
je 0x408195
mov ecx, edi
call fcn.004082d0
test al, al
je 0x408195
mov ecx, esi
call fcn.00406d00
mov bl, al
test bl, bl
jne 0x408223
mov ecx, edi
call fcn.00408410
mov ecx, esi
call fcn.00406d00
mov bl, al
test bl, bl
jne 0x408223
cmp dword [esi + 0x14], 8
jb 0x4081b1
mov esi, dword [esi]
lea eax, [ebp - 0x28]
mov dword [ebp - 0x20], 0
push eax
lea eax, [ebp - 0x20]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push esi
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x408296
mov esi, dword [ebp - 0x20]
test esi, esi
je 0x408296
push 4
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 1
push eax
push 4
push 0
push str.Status
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040f284
mov esp, ebp
pop ebp
ret
lea eax, [edi + 0x80]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00409c80
add esp, 4
lea edx, [edi + 0x64]
mov ecx, eax
call fcn.00406da0
mov eax, dword [ebp - 8]
cmp eax, 8
jb 0x40827e
mov ecx, dword [ebp - 0x1c]
inc eax
cmp eax, 0x7fffffff
ja 0x4082a9
add eax, eax
cmp eax, 0x1000
jb 0x408275
test cl, 0x1f
jne 0x4082ae
mov eax, dword [ecx - 4]
cmp eax, ecx
jae 0x4082b3
sub ecx, eax
cmp ecx, 4
jb 0x4082b8
cmp ecx, 0x23
ja 0x4082bd
mov ecx, eax
push ecx
call fcn.0040f771
add esp, 4
cmp dword [edi + 0x2c], 0
je 0x408296
cmp dword [edi + 0x30], 8
lea eax, [edi + 0x1c]
jb 0x40828f
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040f284
mov esp, ebp
pop ebp
ret
call fcn.0041873b
call fcn.0041873b
call fcn.0041873b
call fcn.0041873b
call fcn.0041873b
int3