Function at 0x4a79dc
Capabilities:
Get common file path
Persist via run registry key
Print debug messages
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fa3bc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5d8
push esi
mov dword [ebp - 0x5d4], ecx
lea ecx, [ebp - 0x114]
call fcn.00401900
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x338]
call fcn.00401900
mov byte [ebp - 4], 1
mov dword [ebp - 0x120], 1
mov dword [ebp - 0x22c], 1
push 0x104
push 0
lea eax, [ebp - 0x440]
push eax
call fcn.004cf390
add esp, 0xc
mov ecx, dword [ebp - 0x5d4]
add ecx, 0x21c
push ecx
push 0
push 0
push 0x531f18
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov ecx, dword [ebp - 0x5d4]
add ecx, 0x1dec
call fcn.00429df0
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x228], 0
jmp 0x4a7a9a
mov edx, dword [ebp - 0x228]
add edx, 1
mov dword [ebp - 0x228], edx
mov eax, dword [ebp - 0x228]
cmp eax, dword [ebp - 0x11c]
jge 0x4a869c
push 0
mov ecx, dword [ebp - 0x228]
push ecx
lea edx, [ebp - 0x5d0]
push edx
mov ecx, dword [ebp - 0x5d4]
add ecx, 0x1dec
call fcn.004e2ce1
mov dword [ebp - 0x5d8], eax
mov eax, dword [ebp - 0x5d8]
mov dword [ebp - 0x5dc], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x5dc]
push ecx
lea ecx, [ebp - 0x114]
call fcn.004e8265
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x5d0]
call fcn.004e812c
push 0x53e27c
lea edx, [ebp - 0x114]
push edx
call fcn.00422f00
and eax, 0xff
test eax, eax
je 0x4a8697
lea ecx, [ebp - 0x444]
call fcn.00401900
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x22c]
push eax
push 0x531f20
lea ecx, [ebp - 0x444]
push ecx
call fcn.004e1baf
add esp, 0xc
mov edx, dword [ebp - 0x5d4]
add edx, 0x21c
push edx
lea ecx, [ebp - 0x114]
call fcn.00401920
push eax
lea ecx, [ebp - 0x444]
call fcn.00401920
push eax
push 0x531f24
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push 0x531f2c
lea ecx, [ebp - 0x444]
call fcn.004e8508
push 0x531f34
lea ecx, [ebp - 0x114]
call fcn.00401920
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4a7d39
mov dword [ebp - 0x334], 0x100
push 0x531f44
lea ecx, [ebp - 0x338]
call fcn.004e82b5
lea eax, [ebp - 0x33c]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x338]
call fcn.00401920
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4a7c51
mov ecx, dword [ebp - 0x334]
push ecx
lea edx, [ebp - 0x330]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x531f84
lea eax, [ebp - 0x330]
push eax
call fcn.004cf9c0
add esp, 8
xor ecx, ecx
mov cx, word [0x539af6]
test ecx, ecx
je 0x4a7c4c
lea edx, [ebp - 0x330]
push edx
push 0x531f94
lea eax, [ebp - 0x4c4]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [ebp - 0x4c4]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x4a7cfd
lea edx, [ebp - 0x334]
push edx
lea eax, [ebp - 0x330]
push eax
lea ecx, [ebp - 0x120]
push ecx
push 0
push 0
mov edx, dword [ebp - 0x33c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4a7cc7
xor eax, eax
mov ax, word [0x539af6]
test eax, eax
je 0x4a7c92
push 0x531fb0
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x444]
call fcn.004e812c
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x338]
call fcn.004e812c
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x114]
call fcn.004e812c
jmp 0x4a86bd
xor ecx, ecx
mov cx, word [0x539af6]
test ecx, ecx
je 0x4a7cfd
lea edx, [ebp - 0x330]
push edx
push 0x531fcc
lea eax, [ebp - 0x544]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [ebp - 0x544]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x33c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x5d4]
add eax, 0x21c
push eax
lea ecx, [ebp - 0x330]
push ecx
lea ecx, [ebp - 0x444]
call fcn.00401920
push eax
push 0x531fe8
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
jmp 0x4a8679
push 0x531ff0
lea ecx, [ebp - 0x114]
call fcn.00401920
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4a7d82
mov edx, dword [ebp - 0x5d4]
add edx, 0x21c
push edx
push 0x531ff8
lea ecx, [ebp - 0x444]
call fcn.00401920
push eax
push 0x532008
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
jmp 0x4a8679
push 0x532010
lea ecx, [ebp - 0x114]
call fcn.00401920
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4a804b
mov dword [ebp - 0x334], 0x100
push 0x532020
lea ecx, [ebp - 0x338]
call fcn.004e82b5
lea eax, [ebp - 0x33c]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x338]
call fcn.00401920
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4a7e15
xor ecx, ecx
mov cx, word [0x539af6]
test ecx, ecx
je 0x4a7dfc
push 0x532064
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x53e280
lea edx, [ebp - 0x440]
push edx
call fcn.004cf9b0
add esp, 8
jmp 0x4a801b
mov ecx, dword [ebp - 0x5d4]
call fcn.004aa70c
cmp eax, 7
jne 0x4a7f25
lea eax, [ebp - 0x334]
push eax
lea ecx, [ebp - 0x440]
push ecx
lea edx, [ebp - 0x120]
push edx
push 0
push 0x532080
mov eax, dword [ebp - 0x33c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4a7e87
xor ecx, ecx
mov cx, word [0x539af6]
test ecx, ecx
je 0x4a7e6e
push 0x53208c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x53e284
lea edx, [ebp - 0x440]
push edx
call fcn.004cf9b0
add esp, 8
jmp 0x4a7f13
push 0x5320a8
lea eax, [ebp - 0x440]
push eax
call fcn.004cf9c0
add esp, 8
mov ecx, 0x539838
call fcn.00408660
mov esi, eax
lea ecx, [ebp - 0x440]
push ecx
call fcn.004cf430
add esp, 4
mov edx, 0x104
sub edx, eax
cmp esi, edx
jae 0x4a7ed3
mov ecx, 0x539838
call fcn.00408660
mov dword [ebp - 0x5e0], eax
jmp 0x4a7ef2
lea eax, [ebp - 0x440]
push eax
call fcn.004cf430
add esp, 4
mov ecx, 0x104
sub ecx, eax
sub ecx, 1
mov dword [ebp - 0x5e0], ecx
mov edx, dword [ebp - 0x5e0]
push edx
mov ecx, 0x539838
call fcn.00401920
push eax
lea eax, [ebp - 0x440]
push eax
call fcn.004d0fc0
add esp, 0xc
mov ecx, dword [ebp - 0x33c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4a801b
lea edx, [ebp - 0x334]
push edx
lea eax, [ebp - 0x440]
push eax
lea ecx, [ebp - 0x120]
push ecx
push 0
push 0x5320ac
mov edx, dword [ebp - 0x33c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4a7f82
xor eax, eax
mov ax, word [0x539af6]
test eax, eax
je 0x4a7f69
push 0x5320b8
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x53e288
lea ecx, [ebp - 0x440]
push ecx
call fcn.004cf9b0
add esp, 8
jmp 0x4a800e
push 0x5320d4
lea edx, [ebp - 0x440]
push edx
call fcn.004cf9c0
add esp, 8
mov ecx, 0x539838
call fcn.00408660
mov esi, eax
lea eax, [ebp - 0x440]
push eax
call fcn.004cf430
add esp, 4
mov ecx, 0x104
sub ecx, eax
cmp esi, ecx
jae 0x4a7fce
mov ecx, 0x539838
call fcn.00408660
mov dword [ebp - 0x5e4], eax
jmp 0x4a7fed
lea edx, [ebp - 0x440]
push edx
call fcn.004cf430
add esp, 4
mov ecx, 0x104
sub ecx, eax
sub ecx, 1
mov dword [ebp - 0x5e4], ecx
mov edx, dword [ebp - 0x5e4]
push edx
mov ecx, 0x539838
call fcn.00401920
push eax
lea eax, [ebp - 0x440]
push eax
call fcn.004d0fc0
add esp, 0xc
mov ecx, dword [ebp - 0x33c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x5d4]
add edx, 0x21c
push edx
lea eax, [ebp - 0x440]
push eax
lea ecx, [ebp - 0x444]
call fcn.00401920
push eax
push 0x5320e4
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
jmp 0x4a8679
push 0x5320ec
lea ecx, [ebp - 0x114]
call fcn.00401920
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x4a80a3
push 0x5320f8
lea ecx, [ebp - 0x114]
call fcn.00401920
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4a8181
push 0x5320fc
mov ecx, 0x53999c
call fcn.00401920
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4a8181
mov dword [ebp - 0x334], 0x100
push 0x532108
lea ecx, [ebp - 0x338]
call fcn.004e82b5
lea ecx, [ebp - 0x33c]
push ecx
push 0x20019
push 0
lea ecx, [ebp - 0x338]
call fcn.00401920
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4a813e
lea edx, [ebp - 0x334]
push edx
lea eax, [ebp - 0x440]
push eax
lea ecx, [ebp - 0x120]
push ecx
push 0
push 0
mov edx, dword [ebp - 0x33c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
je 0x4a812f
push 0x53214c
lea eax, [ebp - 0x440]
push eax
call fcn.004cf9b0
add esp, 8
mov ecx, dword [ebp - 0x33c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4a8152
push 0x53215c
lea edx, [ebp - 0x440]
push edx
call fcn.004cf9b0
add esp, 8
mov eax, dword [ebp - 0x5d4]
add eax, 0x21c
push eax
lea ecx, [ebp - 0x440]
push ecx
lea ecx, [ebp - 0x444]
call fcn.00401920
push eax
push 0x53216c
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
jmp 0x4a8679
push 0x532174
lea ecx, [ebp - 0x114]
call fcn.00401920
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x4a81d9
push 0x532184
lea ecx, [ebp - 0x114]
call fcn.00401920
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4a82b8
push 0x532188
mov ecx, 0x53999c
call fcn.00401920
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4a82b8
mov dword [ebp - 0x334], 0x100
push 0x532198
lea ecx, [ebp - 0x338]
call fcn.004e82b5
lea edx, [ebp - 0x33c]
push edx
push 0x20019
push 0
lea ecx, [ebp - 0x338]
call fcn.00401920
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4a8274
lea eax, [ebp - 0x334]
push eax
lea ecx, [ebp - 0x440]
push ecx
lea edx, [ebp - 0x120]
push edx
push 0
push 0
mov eax, dword [ebp - 0x33c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
je 0x4a8265
push 0x5321e0
lea ecx, [ebp - 0x440]
push ecx
call fcn.004cf9b0
add esp, 8
mov edx, dword [ebp - 0x33c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4a8288
push str.SmarThru_office.exe
lea eax, [ebp - 0x440]
push eax
call fcn.004cf9b0
add esp, 8
mov ecx, dword [ebp - 0x5d4]
add ecx, 0x21c
push ecx
lea edx, [ebp - 0x440]
push edx
lea ecx, [ebp - 0x444]
call fcn.00401920
push eax
push 0x532204
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
jmp 0x4a8679
push 0x53220c
lea ecx, [ebp - 0x114]
call fcn.00401920
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x4a8310
push 0x532218
lea ecx, [ebp - 0x114]
call fcn.00401920
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4a8405
push 0x53221c
mov ecx, 0x53999c
call fcn.00401920
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4a8405
mov dword [ebp - 0x334], 0x100
push 0x532228
lea ecx, [ebp - 0x338]
call fcn.004e82b5
lea eax, [ebp - 0x33c]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x338]
call fcn.00401920
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4a83c2
lea ecx, [ebp - 0x334]
push ecx
lea edx, [ebp - 0x440]
push edx
lea eax, [ebp - 0x120]
push eax
push 0
push 0x53226c
mov ecx, dword [ebp - 0x33c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
je 0x4a839f
push 0x532274
lea edx, [ebp - 0x440]
push edx
call fcn.004cf9b0
add esp, 8
mov eax, dword [ebp - 0x33c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x532284
lea ecx, [ebp - 0x440]
push ecx
call fcn.004cf9c0
add esp, 8
jmp 0x4a83d6
push 0x532294
lea edx, [ebp - 0x440]
push edx
call fcn.004cf9b0
add esp, 8
mov eax, dword [ebp - 0x5d4]
add eax, 0x21c
push eax
lea ecx, [ebp - 0x440]
push ecx
lea ecx, [ebp - 0x444]
call fcn.00401920
push eax
push 0x5322a4
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
jmp 0x4a8679
mov dword [ebp - 0x334], 0x100
push 0x104
push 0
lea edx, [ebp - 0x224]
push edx
call fcn.004cf390
add esp, 0xc
mov eax, dword [ebp - 0x5d4]
add eax, 0x21c
push eax
push 0x1e
lea ecx, [ebp - 0x110]
push ecx
push 0
lea ecx, [ebp - 0x114]
call fcn.00401920
push eax
push 0x5322ac
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov edx, dword [ebp - 0x5d4]
add edx, 0x21c
push edx
push 0x104
lea eax, [ebp - 0x224]
push eax
push 0
lea ecx, [ebp - 0x110]
push ecx
push 0x5322b0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [ebp - 0x224]
push edx
lea ecx, [ebp - 0x548]
call fcn.004e819a
mov byte [ebp - 4], 4
push 0x53e28c
lea eax, [ebp - 0x548]
push eax
call fcn.00422f00
and eax, 0xff
test eax, eax
je 0x4a84e0
mov ecx, dword [ebp - 0x5d4]
add ecx, 0x21c
push ecx
lea edx, [ebp - 0x224]
push edx
lea ecx, [ebp - 0x444]
call fcn.00401920
push eax
push 0x5322b8
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
jmp 0x4a866a
push 0x5322c0
lea ecx, [ebp - 0x338]
call fcn.004e82b5
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x338]
call fcn.004e8508
lea ecx, [ebp - 0x33c]
push ecx
push 0x20019
push 0
lea ecx, [ebp - 0x338]
call fcn.00401920
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4a8548
xor edx, edx
mov dx, word [0x539af6]
test edx, edx
je 0x4a8543
push str._RCP__All_app_reg_open_error
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x4a8632
push 0x104
push 0
lea eax, [ebp - 0x440]
push eax
call fcn.004cf390
add esp, 0xc
lea ecx, [ebp - 0x334]
push ecx
lea edx, [ebp - 0x440]
push edx
lea eax, [ebp - 0x120]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x33c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
je 0x4a8632
xor edx, edx
mov dx, word [0x539af6]
test edx, edx
je 0x4a85af
push str._RCP__Other_app_reg_exe_error
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea ecx, [ebp - 0x54c]
call fcn.00401900
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x118]
push eax
push 0x532338
lea ecx, [ebp - 0x54c]
push ecx
call fcn.004e1baf
add esp, 0xc
xor edx, edx
mov dx, word [0x539af6]
test edx, edx
je 0x4a860f
mov eax, dword [ebp - 0x54c]
push eax
push str._RCP__lRet_:__s
lea ecx, [ebp - 0x5cc]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [ebp - 0x5cc]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.Error
lea eax, [ebp - 0x440]
push eax
call fcn.004cf9b0
add esp, 8
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x54c]
call fcn.004e812c
mov ecx, dword [ebp - 0x5d4]
add ecx, 0x21c
push ecx
lea edx, [ebp - 0x440]
push edx
lea ecx, [ebp - 0x444]
call fcn.00401920
push eax
push 0x532358
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov eax, dword [ebp - 0x33c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x548]
call fcn.004e812c
mov ecx, dword [ebp - 0x22c]
add ecx, 1
mov dword [ebp - 0x22c], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x444]
call fcn.004e812c
jmp 0x4a7a8b
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x338]
call fcn.004e812c
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x114]
call fcn.004e812c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret