Function at 0x416eef
Capabilities:
Delete file
Persist via app paths registry key
Set file attributes
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x558
mov eax, dword [0x4242b4]
push esi
mov dword [ebp - 4], eax
mov esi, ecx
call fcn.0040de86
cmp eax, 1
je 0x416f36
cmp eax, 3
jle 0x416f28
cmp eax, 5
jle 0x416f36
cmp eax, 7
je 0x416f36
cmp eax, 9
je 0x416f36
cmp eax, 0xb
je 0x416f36
or eax, 0xffffffff
mov dword [esi + 0x178], eax
jmp 0x4178ff
test byte [ebp + 0xe], 1
je 0x4178f9
test byte [ebp + 0xe], 2
push ebx
push edi
jne 0x41725b
mov ecx, esi
call fcn.00411d6e
test eax, eax
je 0x41725b
push 0x408ca0
lea eax, [esi + 0xcf8]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.0040c2ca
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jne 0x416f8f
push 0x408c74
call fcn.0040be00
jmp 0x41700b
xor eax, eax
push eax
lea ecx, [ebp - 0x520]
push ecx
push eax
push 2
push eax
push eax
push eax
push 0x408c34
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x416fbb
push eax
push 0x408bf0
jmp 0x417005
lea eax, [ebp - 0x108]
push eax
call edi
inc eax
push eax
lea eax, [ebp - 0x108]
push eax
push 1
push 0
push 0x401627
push dword [ebp - 0x520]
call ebx
test eax, eax
je 0x416fef
push eax
push 0x408ba8
call fcn.0040be00
pop ecx
pop ecx
push dword [ebp - 0x520]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x41700c
push eax
push 0x408b68
call fcn.0040be00
pop ecx
pop ecx
call fcn.0040dcd4
cmp eax, 1
je 0x417024
call fcn.0040ddf3
cmp eax, 1
jne 0x41725b
xor eax, eax
push eax
lea ecx, [ebp - 0x51c]
push ecx
push eax
push 2
push eax
push eax
push eax
push 0x408b34
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x41705a
push eax
push 0x408af0
call fcn.0040be00
pop ecx
pop ecx
jmp 0x4178f7
push 0x104
lea eax, [ebp - 0x518]
push eax
push 0x13af
mov ecx, esi
call fcn.0040f1a4
lea eax, [ebp - 0x518]
push eax
call edi
inc eax
push eax
lea eax, [ebp - 0x518]
push eax
push 1
push 0
push 0x401627
push dword [ebp - 0x51c]
call ebx
test eax, eax
je 0x4170a6
push eax
push 0x408aa8
call fcn.0040be00
pop ecx
pop ecx
push 0x408ca0
lea eax, [esi + 0x384]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.0040c2ca
test eax, eax
je 0x4170f6
lea eax, [ebp - 0x108]
push eax
call edi
inc eax
push eax
lea eax, [ebp - 0x108]
push eax
push 1
push 0
push 0x408aa0
push dword [ebp - 0x51c]
call ebx
test eax, eax
je 0x4170f6
push eax
push 0x408a58
call fcn.0040be00
pop ecx
pop ecx
push 0x104
lea eax, [ebp - 0x518]
push eax
push 0x13b0
mov ecx, esi
call fcn.0040f1a4
lea eax, [ebp - 0x518]
push eax
call edi
inc eax
push eax
lea eax, [ebp - 0x518]
push eax
push 1
push 0
push 0x408a4c
push dword [ebp - 0x51c]
call ebx
test eax, eax
je 0x417142
push eax
push 0x408a00
call fcn.0040be00
pop ecx
pop ecx
push dword [ebp - 0x51c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x41715f
push eax
push 0x4089bc
call fcn.0040be00
pop ecx
pop ecx
lea ebx, [esi + 0x384]
push ebx
mov edi, 0x4089ac
push edi
call fcn.0040c335
test eax, eax
je 0x41725b
push edi
push ebx
lea eax, [ebp - 0x108]
push eax
call fcn.0040c2ca
lea eax, [ebp - 0x558]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.0040c246
test eax, eax
je 0x417250
mov eax, dword [ebp - 0x550]
shr eax, 0x10
cmp ax, 4
jne 0x41725b
cmp word [ebp - 0x550], 0xa
jne 0x41725b
mov eax, dword [ebp - 0x54c]
mov ecx, 0x585
cmp ax, cx
jne 0x41725b
push ecx
shr eax, 0x10
push eax
push 0xa
push 4
push 0x408980
call fcn.0040be00
add esp, 0x14
push 0x80
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x417216
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x408948
call fcn.0040be00
pop ecx
pop ecx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x417244
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x108]
push eax
push 0x408918
call fcn.0040be00
add esp, 0xc
jmp 0x41725b
mov dword [esi + 0x178], 1
jmp 0x41725b
push 0x4088f0
call fcn.0040be00
pop ecx
call fcn.0040dcd4
xor ebx, ebx
test eax, eax
je 0x417282
push ebx
push 0x4088e8
mov ecx, esi
call fcn.004148d7
cmp eax, ebx
jge 0x417282
mov dword [esi + 0x178], eax
jmp 0x4178f7
call fcn.0040d7cb
test eax, eax
jne 0x41729d
push 1
push 0x4088e0
mov ecx, esi
call fcn.004148d7
cmp eax, ebx
jl 0x417277
lea ecx, [esi + 0x58c]
push ecx
lea eax, [esi + 0x74]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.0040c2ca
test eax, eax
jne 0x4172d2
push 0x4088b4
call fcn.0040be00
pop ecx
mov dword [esi + 0x178], 0xfffffff7
jmp 0x4178f7
call fcn.0040de86
dec eax
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
je 0x417341
sub eax, 3
je 0x4172f4
dec eax
je 0x417314
dec eax
dec eax
je 0x4172f4
dec eax
dec eax
je 0x4172f4
dec eax
dec eax
jne 0x41734f
push 0x402af8
lea eax, [esi + 0x74]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.0040c2ca
test eax, eax
jne 0x41731b
push 0x408888
jmp 0x4172bd
push 0x408874
jmp 0x417346
call fcn.0040daba
test eax, eax
je 0x41732b
mov eax, 0x408860
jmp 0x41733e
call fcn.0040d401
test eax, eax
mov eax, 0x40884c
jne 0x41733e
mov eax, 0x408834
push eax
jmp 0x417346
push 0x408820
lea eax, [ebp - 0x20c]
push eax
call edi
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
mov ecx, esi
call fcn.00414729
cmp eax, ebx
jl 0x417277
mov edi, 0x8000000
test dword [esi + 0x68], edi
je 0x4173fc
call fcn.0040dcd4
test eax, eax
jne 0x41738c
call fcn.0040ddf3
test eax, eax
je 0x4173bd
push ebx
push 0x408818
lea eax, [ebp - 0x108]
push eax
mov ecx, esi
call fcn.00413dba
test eax, eax
jne 0x4173bd
push 0x408818
lea eax, [ebp - 0x108]
push eax
push 0x407638
call fcn.0040be00
add esp, 0xc
push 0x40880c
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
call fcn.0040d401
test eax, eax
je 0x4173df
push 0x408808
jmp 0x4173ed
call fcn.0040d7cb
test eax, eax
je 0x41740e
push 0x408800
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
jmp 0x41740e
push 0x4087f0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, esi
call fcn.004115c4
test eax, eax
je 0x41741e
test dword [esi + 0x68], edi
je 0x417498
push ebx
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
mov ecx, esi
call fcn.00413dba
test eax, eax
jne 0x417458
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
push 0x407638
call fcn.0040be00
add esp, 0xc
jmp 0x4178f7
test dword [esi + 0x68], edi
je 0x417498
call fcn.0040dcd4
test eax, eax
mov eax, 0x4087e4
jne 0x417470
mov eax, 0x4087d8
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebx
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
mov ecx, esi
call fcn.00413dba
test eax, eax
je 0x417438
call fcn.0040dcd4
test eax, eax
je 0x417505
push 0x4087cc
lea eax, [esi + 0x74]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.0040c2ca
test eax, eax
jne 0x4174c4
push 0x4087a8
jmp 0x4172bd
push ebx
lea eax, [ebp - 0x414]
push eax
call fcn.0040c335
test eax, eax
je 0x417505
push 0x40879c
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebx
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
mov ecx, esi
call fcn.00413dba
test eax, eax
je 0x417438
call fcn.0040db35
test eax, eax
jne 0x417563
push 0x405d74
lea eax, [esi + 0x74]
push eax
lea eax, [ebp - 0x108]
push eax
mov dword [esi + 4], 1
call fcn.0040c2ca
test eax, eax
jne 0x417538
push 0x408770
jmp 0x4172bd
push ebx
lea edi, [esi + 0x794]
push edi
lea eax, [ebp - 0x108]
push eax
mov ecx, esi
call fcn.00413dba
test eax, eax
jne 0x417558
push edi
jmp 0x41743f
push ebx
mov ecx, esi
call fcn.00413063
mov dword [esi + 4], ebx
cmp dword [esi + 0x99c], ebx
je 0x41776f
call fcn.0040daba
test eax, eax
je 0x417593
push 0x4065dc
mov ecx, esi
call fcn.00410774
test eax, eax
jne 0x417593
push 0x407528
call fcn.0040be00
pop ecx
mov dword [esi + 4], 1
call fcn.0040dcd4
test eax, eax
jne 0x4175ac
call fcn.0040ddf3
test eax, eax
je 0x4175da
push ebx
mov edi, 0x408818
lea eax, [esi + 0x898]
push edi
push eax
mov ecx, esi
call fcn.00413dba
test eax, eax
jne 0x4175da
push edi
lea eax, [esi + 0x898]
push eax
push 0x408740
call fcn.0040be00
add esp, 0xc
push ebx
push 0x408734
mov ecx, esi
call fcn.004143cf
test eax, eax
je 0x417604
push ebx
push dword [esi + 0x99c]
lea eax, [esi + 0x898]
push eax
mov ecx, esi
call fcn.00413dba
test eax, eax
jne 0x417624
push dword [esi + 0x99c]
lea eax, [esi + 0x898]
push eax
push 0x408740
call fcn.0040be00
add esp, 0xc
mov dword [esi + 0x99c], ebx
push ebx
mov ecx, esi
call fcn.00413063
mov dword [esi + 4], ebx
call fcn.0040d401
test eax, eax
jne 0x417664
call fcn.0040d7cb
test eax, eax
jne 0x417664
call fcn.0040daba
test eax, eax
je 0x41776f
cmp dword [esi + 0x20], ebx
jne 0x41776f
cmp dword [esi + 0xac4], 1
je 0x41776f
call fcn.0040daba
test eax, eax
je 0x417703
lea eax, [esi + 0x17c]
push eax
mov edi, 0x407064
push edi
mov dword [ebp - 0x524], 3
call fcn.0040c335
test eax, eax
lea eax, [esi + 0x17c]
je 0x4176a7
push edi
push eax
lea eax, [ebp - 0x310]
push eax
call fcn.0040c2ca
jmp 0x4176ca
push eax
mov edi, 0x407058
push edi
call fcn.0040c335
test eax, eax
je 0x4176bf
lea eax, [esi + 0x17c]
jmp 0x417697
push 0x4086f8
call fcn.0040be00
pop ecx
mov eax, dword [esi + 0x75fc]
cmp eax, ebx
je 0x4176ef
lea ecx, [ebp - 0x524]
push ecx
push 0x413156
push ebx
lea ecx, [ebp - 0x310]
push ecx
call dword [eax + 0x20]
cmp eax, ebx
jne 0x417703
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4086b8
call fcn.0040be00
pop ecx
jmp 0x41776e
push 0x402af8
lea eax, [esi + 0x74]
push eax
lea eax, [ebp - 0x310]
push eax
call fcn.0040c2ca
test eax, eax
je 0x417764
push ebx
mov edi, 0x4086a0
push edi
lea eax, [ebp - 0x310]
push eax
mov ecx, esi
call fcn.00413dba
test eax, eax
jne 0x41774c
push edi
lea eax, [ebp - 0x310]
push eax
push 0x407638
call fcn.0040be00
add esp, 0xc
jmp 0x41776f
push 0x408688
push 0x424040
push 0x402ab4
mov ecx, esi
call fcn.00419b90
jmp 0x41776f
push 0x408658
call fcn.0040be00
pop ecx
call fcn.0040d401
test eax, eax
jne 0x4177a4
call fcn.0040d7cb
test eax, eax
jne 0x4177a4
call fcn.0040daba
test eax, eax
je 0x41784c
cmp dword [esi + 0x20], ebx
jne 0x41784c
cmp dword [esi + 0xac4], 1
je 0x41784c
call fcn.0040db5a
test eax, eax
mov eax, 0x408644
jne 0x4177b7
mov eax, 0x408634
push 0x104
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push 0x402af8
lea eax, [esi + 0x74]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.0040c2ca
test eax, eax
je 0x417841
push ebx
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x414]
push eax
mov ecx, esi
call fcn.00413dba
test eax, eax
jne 0x41781a
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x414]
push eax
push 0x407638
call fcn.0040be00
add esp, 0xc
jmp 0x41784c
call fcn.0040db5a
test eax, eax
mov eax, 0x40280c
jne 0x41782d
mov eax, 0x401a0c
push 0x408624
push 0x424030
push eax
mov ecx, esi
call fcn.00419b90
jmp 0x41784c
push 0x4085f4
call fcn.0040be00
pop ecx
cmp dword [esi + 0xc], ebx
je 0x417860
mov ecx, esi
call fcn.00416543
cmp eax, ebx
jl 0x417277
push dword [esi + 0xad8]
lea edi, [esi + 0xacc]
push dword [esi + 0xad4]
push dword [esi + 0xad0]
push dword [edi]
push 0x4085c0
call fcn.0040be00
add esp, 0x14
lea eax, [esi + 0xac8]
push eax
push ebx
push ebx
push ebx
push 0x12
mov ecx, esi
mov dword [eax], 3
mov dword [edi], ebx
mov dword [esi + 0xad0], ebx
call fcn.00412acf
mov ecx, esi
call fcn.0041a76d
test eax, eax
je 0x4178df
push 0x104
lea eax, [ebp - 0x414]
push eax
push 0x139e
mov ecx, esi
call fcn.0040f1a4
push ebx
push ebx
lea eax, [ebp - 0x414]
push eax
push 0x40
push 0x13
mov ecx, esi
call fcn.00412acf
push ebx
push ebx
push ebx
push ebx
push ebx
mov ecx, esi
call fcn.00412acf
push ebx
push ebx
push ebx
push ebx
push ebx
mov ecx, esi
call fcn.00412acf
pop edi
pop ebx
mov eax, dword [esi + 0x178]
mov ecx, dword [ebp - 4]
pop esi
call fcn.0041a84f
leave
ret 8