Function at 0x428840
Capabilities:
Check os version
Get common file path
Persist via run registry key
Query or enumerate registry value

Disassembly:
sub rsp, 0x7d8
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x40], 0
mov r8d, 0x104
xor edx, edx
lea rcx, [0x00461ca0]
call sub.msvcrt.dll_memset
mov r8d, 0x104
xor edx, edx
lea rcx, [0x00461b90]
call sub.msvcrt.dll_memset
mov r8d, 0x104
xor edx, edx
lea rcx, [0x00461a80]
call sub.msvcrt.dll_memset
mov r8d, 0x104
xor edx, edx
lea rcx, [0x00461970]
call sub.msvcrt.dll_memset
mov r8d, 0x104
xor edx, edx
lea rcx, [0x00461860]
call sub.msvcrt.dll_memset
mov r8d, 0x104
xor edx, edx
lea rcx, [0x00461750]
call sub.msvcrt.dll_memset
mov r8d, 0x104
xor edx, edx
lea rcx, [0x00461640]
call sub.msvcrt.dll_memset
mov r8d, 0x104
xor edx, edx
lea rcx, [0x00461530]
call sub.msvcrt.dll_memset
mov r8d, 0x104
xor edx, edx
lea rcx, [0x00461420]
call sub.msvcrt.dll_memset
mov r8d, 0x104
xor edx, edx
lea rcx, [0x00461310]
call sub.msvcrt.dll_memset
mov r8d, 0x104
xor edx, edx
lea rcx, [0x00461200]
call sub.msvcrt.dll_memset
call fcn.004323f0
mov dword [rsp + 0x7c0], eax
cmp dword [rsp + 0x7c0], 0x10
je 0x428955
cmp dword [rsp + 0x7c0], 0x20
je 0x428955
jmp 0x42895f
mov dword [rsp + 0x54], 0
jmp 0x428967
mov dword [rsp + 0x54], 0xffffffff
call fcn.00428670
cmp eax, 8
jne 0x42897e
mov dword [rsp + 0x7c4], 1
jmp 0x428989
mov dword [rsp + 0x7c4], 0
mov eax, dword [rsp + 0x7c4]
mov dword [rsp + 0x104], eax
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x100]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x108]
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x44]
lea rcx, [rsp + 0x48]
call fcn.00428720
mov dword [rsp + 0x60], 0x94
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x428bc6
cmp dword [rsp + 0x70], 2
jne 0x428bc6
cmp dword [rsp + 0x64], 5
jb 0x428a13
cmp dword [rsp + 0x6c], 0x8f8
jae 0x428a0b
mov dword [rsp + 0x40], 1
jmp 0x428a13
mov dword [rsp + 0x50], 1
cmp dword [rsp + 0x40], 1
je 0x428a25
cmp dword [rsp + 0x50], 1
jne 0x428bc6
mov eax, dword [rsp + 0x100]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x4c]
mov r8d, dword [rsp + 0x48]
lea rdx, str.VEN_1002DEV__04XSUBSYS__08lXREV__02X
lea rcx, [0x00461310]
call qword [sym.imp.USER32.dll_wsprintfA]
lea r8, [rsp + 0x54]
lea rdx, [0x00461ca0]
lea rcx, [0x00461310]
call fcn.00429440
test eax, eax
jne 0x428a9b
mov r8d, dword [rsp + 0x48]
lea rdx, str.VEN_1002DEV__04X
lea rcx, [0x00461310]
call qword [sym.imp.USER32.dll_wsprintfA]
lea r8, [rsp + 0x54]
lea rdx, [0x00461ca0]
lea rcx, [0x00461310]
call fcn.00429440
lea rdx, [0x00461b90]
lea rcx, [0x00461ca0]
call fcn.00429c60
test eax, eax
je 0x428bc6
lea rax, [0x00461420]
mov qword [rsp + 0x30], rax
lea rax, [0x00461530]
mov qword [rsp + 0x28], rax
lea rax, [0x00461640]
mov qword [rsp + 0x20], rax
lea r9, [0x00461860]
lea r8, [0x00461a80]
lea rdx, [0x00461970]
lea rcx, [0x00461b90]
call fcn.00429d40
lea rcx, [0x00461640]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x428bc6
mov edx, 0x104
lea rcx, [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov r8d, 0x104
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
jne 0x428b56
mov edx, 0x104
lea rcx, [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea rdx, str.Inf_
lea rcx, [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
lea rdx, [0x00461640]
lea rcx, [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov byte [rsp + 0x220], 0x88
mov r8d, 0x4000
lea rdx, [rsp + 0x220]
lea rcx, [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_OpenFile]
cmp eax, 0xffffffff
jne 0x428bb1
mov byte [rsp + 0x110], 0
lea rdx, [rsp + 0x110]
lea rcx, [0x00461640]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, 0x104
lea rcx, [rsp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov r8d, 0x104
lea rdx, [rsp + 0x2b0]
lea rcx, [rsp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
jne 0x428c0c
mov edx, 0x104
lea rcx, [rsp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea rdx, [0x00461860]
lea rcx, [rsp + 0x3c0]
call sub.msvcrt.dll_strcpy
lea rax, [rsp + 0x3c0]
mov qword [rsp + 0x20], rax
lea r9, [0x0043afa4]
lea r8, [rsp + 0x2b0]
lea rdx, [0x0043afa8]
lea rcx, [0x00461860]
call qword [sym.imp.msvcrt.dll_sprintf]
mov r8d, 0x34
xor edx, edx
lea rcx, [rsp + 0x4d0]
call sub.msvcrt.dll_memset
lea rdx, [0x00461860]
lea rcx, [rsp + 0x4d0]
call fcn.004324d0
mov eax, dword [rsp + 0x4dc]
and eax, 0xffff
mov ecx, dword [rsp + 0x4dc]
shr ecx, 0x10
and ecx, 0xffff
mov edx, dword [rsp + 0x4d8]
and edx, 0xffff
mov r8d, dword [rsp + 0x4d8]
shr r8d, 0x10
and r8d, 0xffff
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
mov r9d, edx
lea rdx, [0x0043afb0]
lea rcx, [0x004610f0]
call qword [sym.imp.msvcrt.dll_sprintf]
lea r9, str.ATI3DUAG.DLL
lea r8, [rsp + 0x2b0]
lea rdx, [0x0043afd0]
lea rcx, [0x00460fe0]
call qword [sym.imp.msvcrt.dll_sprintf]
mov r8d, 0x34
xor edx, edx
lea rcx, [rsp + 0x4d0]
call sub.msvcrt.dll_memset
lea rdx, [0x00460fe0]
lea rcx, [rsp + 0x4d0]
call fcn.004324d0
mov eax, dword [rsp + 0x4dc]
and eax, 0xffff
mov ecx, dword [rsp + 0x4dc]
shr ecx, 0x10
and ecx, 0xffff
mov edx, dword [rsp + 0x4d8]
and edx, 0xffff
mov r8d, dword [rsp + 0x4d8]
shr r8d, 0x10
and r8d, 0xffff
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
mov r9d, edx
lea rdx, [0x0043afd8]
lea rcx, [0x00460ed0]
call qword [sym.imp.msvcrt.dll_sprintf]
call fcn.004323f0
mov dword [rsp + 0x7c8], eax
cmp dword [rsp + 0x7c8], 0x10
je 0x428d9d
cmp dword [rsp + 0x7c8], 0x20
je 0x428d9d
jmp 0x428dc0
lea r9, str.ATIOGLXX.DLL
lea r8, [rsp + 0x2b0]
lea rdx, [0x0043aff8]
lea rcx, [0x00460dc0]
call qword [sym.imp.msvcrt.dll_sprintf]
mov r8d, 0x34
xor edx, edx
lea rcx, [rsp + 0x4d0]
call sub.msvcrt.dll_memset
lea rdx, [0x00460dc0]
lea rcx, [rsp + 0x4d0]
call fcn.004324d0
mov eax, dword [rsp + 0x4dc]
and eax, 0xffff
mov ecx, dword [rsp + 0x4dc]
shr ecx, 0x10
and ecx, 0xffff
mov edx, dword [rsp + 0x4d8]
and edx, 0xffff
mov r8d, dword [rsp + 0x4d8]
shr r8d, 0x10
and r8d, 0xffff
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
mov r9d, edx
lea rdx, [0x0043b000]
lea rcx, [0x00460cb0]
call qword [sym.imp.msvcrt.dll_sprintf]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
lea rcx, [rsp + 0x510]
call qword [sym.imp.msvcrt.dll_sprintf]
mov dword [rsp + 0x508], 0x104
mov eax, dword [rsp + 0x508]
mov r8, rax
xor edx, edx
lea rcx, [rsp + 0x630]
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x620]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rsp + 0x510]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x428ee1
lea rax, [rsp + 0x508]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x630]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ATIPTA
mov rcx, qword [rsp + 0x620]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x620]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rsp + 0x630]
lea rcx, [0x00460ba0]
call sub.msvcrt.dll_strcpy
mov r8d, 0x34
xor edx, edx
lea rcx, [rsp + 0x4d0]
call sub.msvcrt.dll_memset
lea rdx, [0x00460ba0]
lea rcx, [rsp + 0x4d0]
call fcn.004324d0
mov eax, dword [rsp + 0x4dc]
and eax, 0xffff
mov ecx, dword [rsp + 0x4dc]
shr ecx, 0x10
and ecx, 0xffff
mov edx, dword [rsp + 0x4d8]
and edx, 0xffff
mov r8d, dword [rsp + 0x4d8]
shr r8d, 0x10
and r8d, 0xffff
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
mov r9d, edx
lea rdx, str._d._d._d._d
lea rcx, [0x00460a90]
call qword [sym.imp.msvcrt.dll_sprintf]
lea rcx, [0x004610f0]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x428fae
xor r8d, r8d
lea rdx, [0x004610f0]
lea rcx, [0x0043b058]
call fcn.00414f50
lea rcx, [0x00460ed0]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x428fd5
xor r8d, r8d
lea rdx, [0x00460ed0]
lea rcx, [0x0043b078]
call fcn.00414f50
lea rcx, [0x00460cb0]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x428ffc
xor r8d, r8d
lea rdx, [0x00460cb0]
lea rcx, [0x0043b098]
call fcn.00414f50
lea rcx, [0x00460a90]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x429023
xor r8d, r8d
lea rdx, [0x00460a90]
lea rcx, [0x0043b0b8]
call fcn.00414f50
mov dword [rsp + 0x744], 0
mov dword [rsp + 0x740], 0x64
call fcn.004323f0
mov dword [rsp + 0x744], eax
mov eax, dword [rsp + 0x744]
mov dword [rsp + 0x7cc], eax
cmp dword [rsp + 0x7cc], 0x10
je 0x429069
cmp dword [rsp + 0x7cc], 0x20
je 0x429069
jmp 0x429089
mov r9d, dword [rsp + 0x740]
lea r8, [rsp + 0x750]
mov edx, dword [rsp + 0x54]
lea rcx, [0x00429400]
call fcn.00430840
mov r8d, dword [rsp + 0x54]
lea rdx, [rsp + 0x750]
lea rcx, [0x0043b0d8]
call fcn.00414f50
lea rcx, [0x00461ca0]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x4290c9
xor r8d, r8d
lea rdx, [0x00461ca0]
lea rcx, [0x0043b108]
call fcn.00414f50
lea rcx, [0x00461b90]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x4290f0
xor r8d, r8d
lea rdx, [0x00461b90]
lea rcx, [0x0043b120]
call fcn.00414f50
lea rcx, [0x00461970]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x429117
xor r8d, r8d
lea rdx, [0x00461970]
lea rcx, [0x0043b138]
call fcn.00414f50
lea rcx, [0x00461a80]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x42913e
xor r8d, r8d
lea rdx, [0x00461a80]
lea rcx, [0x0043b148]
call fcn.00414f50
lea rcx, [0x00461860]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x429165
xor r8d, r8d
lea rdx, [0x00461860]
lea rcx, [0x0043b160]
call fcn.00414f50
lea rcx, [0x00461750]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x42918c
xor r8d, r8d
lea rdx, [0x00461750]
lea rcx, [0x0043b170]
call fcn.00414f50
lea rcx, [0x00461640]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x4291b3
xor r8d, r8d
lea rdx, [0x00461640]
lea rcx, [0x0043b180]
call fcn.00414f50
lea rcx, [0x00461530]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x4291da
xor r8d, r8d
lea rdx, [0x00461530]
lea rcx, [0x0043b190]
call fcn.00414f50
lea rcx, [0x00461420]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x429201
xor r8d, r8d
lea rdx, [0x00461420]
lea rcx, [0x0043b1a8]
call fcn.00414f50
add rsp, 0x7d8
ret