Function at 0x588a04
Capabilities:
Check if file exists
Get file attributes
Get hostname
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x33
push 0
push 0
dec ecx
jne 0x588a0c
push ecx
push ebx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x588db8
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov eax, dword [ebp - 8]
call fcn.0057f600
test al, al
je 0x588d54
mov eax, dword [ebp - 8]
cmp byte [eax + 0x60], 0
je 0x588d54
mov eax, dword [ebp - 8]
cmp byte [eax + 0x61], 0
je 0x588bdd
lea edx, [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.00589124
mov eax, dword [ebp - 8]
call fcn.00588fc8
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x588bd4
mov eax, dword [ebp - 8]
mov byte [eax + 8], 1
lea eax, [ebp - 0x13c]
call fcn.00580f54
cmp byte [ebp - 0x12c], 0
je 0x588ab1
push 0x2a
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x44]
push eax
push 0x32
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x34]
call fcn.00405ed4
push eax
call dword [0x5d4600]
mov dword [ebp - 0x10], eax
jmp 0x588ad6
push 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x5c]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x30]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x48]
call fcn.004063f4
push eax
call dword [0x5d4614]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
sete byte [ebp - 9]
cmp byte [ebp - 9], 0
je 0x588bc7
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.005891d0
mov dword [ebp - 0x10], 0x104
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x119]
push eax
call sub.kernel32.dll_GetComputerNameA
push 0x588dd0
lea eax, [ebp - 0x144]
lea edx, [ebp - 0x119]
mov ecx, 0x105
call fcn.00405cb4
push dword [ebp - 0x144]
push 0x588ddc
lea edx, [ebp - 0x148]
mov eax, dword [ebp - 8]
call fcn.00587b80
push dword [ebp - 0x148]
lea eax, [ebp - 0x140]
mov edx, 4
call fcn.00405dd8
mov eax, dword [ebp - 0x140]
call fcn.00405ed4
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x588bd4
push 0x588dd0
lea eax, [ebp - 0x150]
lea edx, [ebp - 0x119]
mov ecx, 0x105
call fcn.00405cb4
push dword [ebp - 0x150]
push 0x588ddc
lea edx, [ebp - 0x154]
mov eax, dword [ebp - 8]
call fcn.00587b80
push dword [ebp - 0x154]
lea eax, [ebp - 0x14c]
mov edx, 4
call fcn.00405dd8
mov eax, dword [ebp - 0x14c]
call fcn.00405ed4
push eax
call sub.kernel32.dll_GetFileAttributesA
jmp 0x588bd4
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.0057efb0
mov eax, dword [ebp - 8]
mov byte [eax + 0x61], 0
jmp 0x588be1
mov byte [ebp - 9], 1
cmp byte [ebp - 9], 0
je 0x588d54
lea eax, [ebp - 0x174]
call fcn.00580f54
cmp byte [ebp - 0x164], 0
je 0x588c24
push 0
push 0x2a
mov eax, dword [ebp - 8]
mov ebx, dword [eax + 0x44]
push ebx
push 0x32
push ebx
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x34]
call fcn.00405ed4
push eax
call dword [0x5d460c]
mov dword [ebp - 0x10], eax
jmp 0x588c55
push 0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x5c]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x30]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x4c]
call fcn.004063f4
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x48]
call fcn.004063f4
push eax
call dword [0x5d4620]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
sete byte [ebp - 9]
cmp byte [ebp - 9], 0
je 0x588d47
lea eax, [ebp - 0x194]
call fcn.00580f54
cmp byte [ebp - 0x184], 0
je 0x588d2f
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x44]
test byte [eax + 0xf], 1
je 0x588d2f
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x19c]
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x44]
mov ecx, 0xd
call fcn.00405cb4
mov ecx, dword [ebp - 0x19c]
lea eax, [ebp - 0x198]
mov edx, 0x588de8
call fcn.00405d5c
mov eax, dword [ebp - 0x198]
call fcn.00405ed4
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyA
test eax, eax
jne 0x588d2f
xor eax, eax
push ebp
push 0x588d28
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3c]
call fcn.00405d04
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x3c]
call fcn.00405ed4
push eax
push 1
push 0
push 0x588e24
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegSetValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x588d2f
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 8]
mov byte [eax + 0x60], 0
mov eax, dword [ebp - 8]
call fcn.00588728
mov eax, dword [ebp - 8]
mov byte [eax + 9], 1
jmp 0x588d54
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.0057efb0
mov eax, dword [ebp - 8]
mov byte [eax + 0x60], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x588dbf
lea eax, [ebp - 0x19c]
mov edx, 2
call fcn.00405a68
lea eax, [ebp - 0x194]
mov edx, dword [0x580e64]
mov ecx, 2
call fcn.0040685c
lea eax, [ebp - 0x154]
mov edx, 6
call fcn.00405a68
lea eax, [ebp - 0x13c]
mov edx, dword [0x580e64]
call fcn.00406810
lea eax, [ebp - 4]
call fcn.00407c68
ret