Function at 0x7cf9c8ad
Capabilities:
Check if file exists
Create process on windows
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3d8
push ebx
push esi
push edi
lea eax, [ebp - 0x120]
push dword [ebp + 0xc]
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], esi
push dword [ebp + 8]
push 0x7cf36bc4
push 0x50
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x14
test eax, eax
je 0x7cf9cb08
mov ebx, 0x7cf36b40
push 0x20019
push ebx
push reloc.SHLWAPI.dll_ParseURLW
push 0x7d04b1fc
call fcn.7cf9c7e5
mov eax, dword [0x7d04b1fc]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
je 0x7cf9c94a
lea ecx, [ebp - 8]
mov dword [ebp - 8], 4
push ecx
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x120]
push esi
push ecx
push eax
mov dword [ebp - 0x2c], esi
call edi
test eax, eax
jne 0x7cf9c94a
cmp dword [ebp - 0x10], 4
jne 0x7cf9c94a
cmp dword [ebp - 0x2c], esi
mov dword [ebp - 0xc], 1
setne al
mov dword [ebp - 4], eax
cmp dword [ebp - 0xc], esi
jne 0x7cf9cb08
push 0x2001f
push ebx
push reloc.SHLWAPI.dll_ParseURLA
push 0x7d04b200
call fcn.7cf9c7e5
mov eax, dword [0x7d04b200]
cmp eax, esi
je 0x7cf9c9e6
push 0x10
lea ecx, [ebp - 8]
pop ebx
mov dword [ebp - 0x28], esi
push ecx
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x120]
push esi
push ecx
push eax
mov dword [ebp - 8], ebx
call edi
test eax, eax
jne 0x7cf9c9e6
cmp dword [ebp - 0x10], 3
jne 0x7cf9c9e6
cmp dword [ebp - 8], ebx
jne 0x7cf9c9e6
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
cmp dword [ebp - 0x28], esi
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
jne 0x7cf9c9d4
cmp eax, dword [ebp - 0x1c]
jb 0x7cf9c9e6
ja 0x7cf9c9c1
cmp ecx, dword [ebp - 0x20]
jb 0x7cf9c9e6
sub ecx, dword [ebp - 0x20]
sbb eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
jne 0x7cf9c9e6
cmp ecx, 0x5f5e100
ja 0x7cf9c9e6
xor eax, eax
cmp dword [ebp - 0x28], esi
mov dword [ebp - 0xc], 1
setne al
mov dword [ebp - 4], eax
cmp dword [ebp - 0xc], esi
jne 0x7cf9cb08
push dword [ebp + 0xc]
lea eax, [ebp - 0x1d0]
push dword [ebp + 8]
push 0x7cf36b20
push 0x57
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x14
test eax, eax
je 0x7cf9cb08
lea eax, [ebp - 0x3d8]
push 0x104
push eax
call fcn.7d03f96a
test eax, eax
je 0x7cf9cb08
lea eax, [ebp - 0x3d8]
push 0x7cf36af4
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x7cf9cb08
push 0x10
xor eax, eax
pop ecx
lea edi, [ebp - 0x7c]
mov dword [ebp - 0x80], 0x44
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x1d0]
push esi
push eax
lea eax, [ebp - 0x3d8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x7cf9caf6
push 0xffffffffffffffff
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp + 0xc]
push eax
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x7cf9cae4
xor eax, eax
cmp dword [ebp + 0xc], esi
sete al
cmp dword [0x7d04b200], esi
mov edi, eax
mov dword [ebp - 4], edi
je 0x7cf9cae4
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [ebp - 0x18]
push 0x10
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x28]
push eax
push 3
lea eax, [ebp - 0x120]
push esi
push eax
mov dword [ebp - 0x28], edi
push dword [0x7d04b200]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x38]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x3c]
call esi
jmp 0x7cf9cb08
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x7cf9cb08
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8