Function at 0x421d70
Capabilities:
Check if file exists
Create process on windows
Delete file
Download url
Get common file path
Query or enumerate registry value
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1cc
mov eax, dword [0x4785c0]
xor eax, ebp
mov dword [ebp - 0x48], eax
push edi
mov dword [ebp - 0x1b8], ecx
mov eax, dword [ebp - 0x1b8]
cmp dword [eax + 0x84], 0
jne 0x421da3
mov eax, 1
jmp 0x42215e
call fcn.004010d0
mov dword [ebp - 0x1a0], eax
mov byte [ebp - 0x68], 0
xor ecx, ecx
mov dword [ebp - 0x67], ecx
mov dword [ebp - 0x63], ecx
mov dword [ebp - 0x5f], ecx
mov dword [ebp - 0x5b], ecx
mov dword [ebp - 0x57], ecx
mov dword [ebp - 0x53], ecx
mov dword [ebp - 0x4f], ecx
mov word [ebp - 0x4b], cx
mov byte [ebp - 0x49], cl
mov byte [ebp - 0x19c], 0
xor edx, edx
mov dword [ebp - 0x19b], edx
mov dword [ebp - 0x197], edx
mov dword [ebp - 0x193], edx
mov dword [ebp - 0x18f], edx
mov dword [ebp - 0x18b], edx
mov dword [ebp - 0x187], edx
mov dword [ebp - 0x183], edx
mov word [ebp - 0x17f], dx
mov byte [ebp - 0x17d], dl
mov dword [ebp - 0x1a4], 0
lea eax, [ebp - 0x1a4]
push eax
push 1
push 0
mov ecx, dword [str.SoftwareEnterSafeGZBank_Assistant]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0
jne 0x421eb9
mov dword [ebp - 0x1b0], 0x20
mov dword [ebp - 0x1ac], 1
lea edx, [ebp - 0x1b0]
push edx
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x1ac]
push ecx
push 0
push 0x468798
mov edx, dword [ebp - 0x1a4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x17c], eax
cmp dword [ebp - 0x17c], 0
jne 0x421e98
cmp dword [ebp - 0x1b0], 0
ja 0x421eac
mov eax, dword [ebp - 0x1a4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x42215e
mov ecx, dword [ebp - 0x1a4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x20
lea edx, [ebp - 0x19c]
push edx
mov eax, dword [str.http:__www.gzcb.com.cn_downloads_GZBank_Assistant_Setup.txt]
push eax
call fcn.00412c80
add esp, 0xc
test eax, eax
jne 0x421edb
xor eax, eax
jmp 0x42215e
lea ecx, [ebp - 0x19c]
push ecx
lea edx, [ebp - 0x68]
push edx
call fcn.00412630
add esp, 8
test eax, eax
jl 0x421efc
mov eax, 1
jmp 0x42215e
mov byte [ebp - 0x178], 0
push 0x103
push 0
lea eax, [ebp - 0x177]
push eax
call fcn.00446170
add esp, 0xc
lea ecx, [ebp - 0x178]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edx, [ebp - 0x178]
add edx, 0xffffffff
mov dword [ebp - 0x1bc], edx
mov eax, dword [ebp - 0x1bc]
mov cl, byte [eax + 1]
mov byte [ebp - 0x1bd], cl
add dword [ebp - 0x1bc], 1
cmp byte [ebp - 0x1bd], 0
jne 0x421f3a
mov edi, dword [ebp - 0x1bc]
mov edx, dword [str.FTISSETUP.exe]
mov dword [edi], edx
mov eax, dword [0x4687a4]
mov dword [edi + 4], eax
mov ecx, dword [0x4687a8]
mov dword [edi + 8], ecx
mov dx, word [0x4687ac]
mov word [edi + 0xc], dx
mov al, byte [0x4687ae]
mov byte [edi + 0xe], al
mov ecx, dword [str.http:__www.gzcb.com.cn_downloads_GZBank_Assistant_Setup.exe]
push ecx
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
lea edx, [ebp - 0x178]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x421fb6
lea eax, [ebp - 0x178]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0
lea ecx, [ebp - 0x178]
push ecx
mov edx, dword [str.http:__www.gzcb.com.cn_downloads_GZBank_Assistant_Setup.exe]
push edx
push 0
call sub.urlmon.dll_URLDownloadToFileA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x421fe4
xor eax, eax
jmp 0x42215e
lea eax, [ebp - 0x178]
mov dword [ebp - 0x1a8], eax
cmp dword [ebp - 0x1a8], 0
jne 0x422005
mov dword [ebp - 0x1c4], 0
jmp 0x42206d
mov ecx, dword [ebp - 0x1a8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x3fffffff
jle 0x42202d
mov dword [ebp - 0x1c8], 0
jmp 0x422061
mov eax, dword [ebp - 8]
shl eax, 1
call fcn.00446050
mov dword [ebp - 0x1cc], esp
mov edx, dword [ebp - 0x1a0]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x1a8]
push ecx
mov edx, dword [ebp - 0x1cc]
push edx
call fcn.00414b40
mov dword [ebp - 0x1c8], eax
mov eax, dword [ebp - 0x1c8]
mov dword [ebp - 0x1c4], eax
mov ecx, dword [ebp - 0x1c4]
mov dword [ebp - 0x1b4], ecx
call fcn.00412dc0
test eax, eax
jne 0x42208b
call fcn.00412e20
test eax, eax
je 0x4220a7
mov edx, dword [ebp - 0x1b4]
push edx
call fcn.00412e80
add esp, 4
test eax, eax
jne 0x4220a5
xor eax, eax
jmp 0x42215e
jmp 0x4220c1
mov eax, dword [ebp - 0x1b4]
push eax
call fcn.00412fd0
add esp, 4
test eax, eax
jne 0x4220c1
xor eax, eax
jmp 0x42215e
mov dword [ebp - 0x44], 0
push 0x38
push 0
lea ecx, [ebp - 0x40]
push ecx
call fcn.00446170
add esp, 0xc
mov dword [ebp - 0x44], 0x3c
mov dword [ebp - 0x40], 0x40
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
lea edx, [ebp - 0x178]
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], 0x467737
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov ecx, 0x484e98
call fcn.00413480
movzx eax, al
test eax, eax
je 0x422133
mov dword [ebp - 0x38], 0x4687b0
jmp 0x42213a
mov dword [ebp - 0x38], 0x46773a
lea ecx, [ebp - 0x44]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x42214c
xor eax, eax
jmp 0x42215e
push 0
mov ecx, dword [ebp - 0x1b8]
call fcn.0042708d
mov eax, 1
lea esp, [ebp - 0x1d0]
pop edi
mov ecx, dword [ebp - 0x48]
xor ecx, ebp
call fcn.00441de6
mov esp, ebp
pop ebp
ret