Function at 0x43f7b0
Capabilities:
Get common file path
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5625b5
push eax
mov dword fs:[0], esp
lea eax, [ebp - 0x268]
sub esp, 0x260
push ebx
push esi
push edi
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
sub esp, 0x18
mov ecx, esp
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
test eax, eax
je 0x43fde9
push 0x15
push str.PCAppStoreAutoUpdater
call fcn.00424490
lea ecx, [ebp - 0x3c]
call fcn.00437680
mov ecx, esp
mov dword [ebp - 4], 0
push 0x18
push str.__wsAutoUpdater.exe___i
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.00424490
lea ecx, [ebp - 0x40]
call fcn.00437680
mov ecx, esp
mov byte [ebp - 4], 1
push 0x2d
push str.SoftwareMicrosoftWindowsCurrentVersionRun
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.00424490
lea ecx, [ebp - 0x14]
call fcn.00437680
add esp, 0x18
mov byte [ebp - 4], 2
mov edx, dword [eax]
mov ecx, edx
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
lea esi, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x43f8a0
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x60]
call fcn.00424490
mov edx, dword [ebp - 0x14]
or ebx, 0xffffffff
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43f8d6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 5
call fcn.00424e20
mov ecx, eax
test ecx, ecx
je 0x440021
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x24], eax
sub esp, 0x18
mov byte [ebp - 4], 6
mov ecx, esp
push 5
push str.PT18H
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.00424490
lea ecx, [ebp - 0x48]
call fcn.00437680
add esp, 0x18
lea eax, [ebp - 0x268]
mov byte [ebp - 4], 7
push eax
push ecx
mov esi, esp
mov dword [ebp - 0x10], esi
mov ecx, dword [ebp - 0x40]
lea ecx, [ecx - 0x10]
call fcn.00425550
add eax, 0x10
lea ecx, [ebp - 0x14]
mov dword [esi], eax
call fcn.00437b50
add esp, 4
mov byte [ebp - 4], 8
push dword [eax]
lea eax, [ebp - 0x24]
push eax
call fcn.0041a6d0
mov byte [ebp - 4], 7
add esp, 0xc
mov edx, dword [ebp - 0x14]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43f984
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push ecx
mov esi, esp
mov dword [ebp - 0x10], esi
mov ecx, dword [ebp - 0x48]
lea ecx, [ecx - 0x10]
call fcn.00425550
add eax, 0x10
lea ecx, [ebp - 0x30]
mov dword [esi], eax
call fcn.00437b50
mov edi, eax
mov byte [ebp - 4], 9
mov dword [ebp - 0x10], esi
mov ecx, dword [ebp - 0x3c]
add ecx, 0xfffffff0
call fcn.00425550
add eax, 0x10
lea ecx, [ebp - 0x14]
mov dword [esi], eax
call fcn.00437b50
add esp, 4
push edi
lea edx, [ebp - 0x24]
mov byte [ebp - 4], 0xa
mov ecx, eax
call fcn.0043e710
mov edx, dword [ebp - 0x14]
add esp, 4
mov byte [ebp - 0x15], al
add edx, 0xfffffff0
mov ecx, ebx
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x43f9f5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 7
mov eax, ebx
mov edx, dword [ebp - 0x30]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43fa13
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push ecx
mov dword [ebp - 0x10], esp
lea eax, [ebp - 0x60]
mov esi, esp
sub esp, 0x18
mov ecx, esp
push eax
call fcn.00424b70
mov ecx, esi
call fcn.00437900
add esp, 0x14
mov byte [ebp - 4], 0xb
mov esi, esp
mov dword [ebp - 0x34], esp
mov dword [ebp - 0x14], esi
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.00425550
add eax, 0x10
mov dword [esi], eax
push ecx
mov edi, esp
mov byte [ebp - 4], 0xc
push ecx
mov esi, esp
mov dword [ebp - 0x14], esi
mov ecx, dword [ebp - 0x3c]
lea ecx, [ecx - 0x10]
call fcn.00425550
add eax, 0x10
mov ecx, edi
mov dword [esi], eax
call fcn.00437b50
add esp, 4
mov byte [ebp - 4], 7
mov ecx, SysReAllocString
call fcn.00439880
add esp, 0xc
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x15], 0
je 0x43fa96
test al, al
jne 0x43fd59
sub esp, 0x18
mov ecx, esp
push 7
push str.product
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.00424490
lea ecx, [ebp - 0x14]
call fcn.00437680
mov ecx, esp
mov byte [ebp - 4], 0xd
push 0x14
push str.task_creation_failed
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.00424490
lea ecx, [ebp - 0x30]
call fcn.00437680
mov ecx, esp
mov byte [ebp - 4], 0xe
push 0x27
push str.tsh_creation_res_dautorun_creation_d
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.00424490
lea ecx, [ebp - 0x44]
call fcn.00437680
add esp, 0x18
mov byte [ebp - 4], 0x10
call fcn.00424e20
mov ecx, eax
test ecx, ecx
je 0x44002b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x38], eax
xor eax, eax
mov byte [ebp - 4], 0x11
cmp byte [ebp - 0x29], al
setne al
push eax
xor eax, eax
cmp byte [ebp - 0x15], al
setne al
push eax
push ecx
mov esi, esp
mov dword [ebp - 0x10], esi
mov ecx, dword [ebp - 0x44]
lea ecx, [ecx - 0x10]
call fcn.00425550
add eax, 0x10
lea ecx, [ebp - 0x1c]
mov dword [esi], eax
call fcn.00437b50
add esp, 4
mov byte [ebp - 4], 0x12
push dword [eax]
lea eax, [ebp - 0x38]
push eax
call fcn.0041a6d0
mov byte [ebp - 4], 0x11
add esp, 0x10
mov edx, dword [ebp - 0x1c]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43fba7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.00424e20
mov ecx, eax
test ecx, ecx
je 0x440035
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1c], eax
push 0x57ece0
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x13
call fcn.00425090
test al, al
jne 0x43fbe5
push 0
push 0x57ece0
lea ecx, [ebp - 0x1c]
call fcn.00425360
mov byte [ebp - 4], 0x14
call fcn.00424e20
mov ecx, eax
test ecx, ecx
je 0x44003f
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x20], eax
push 0x57ece0
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x15
call fcn.00425090
test al, al
jne 0x43fc27
push 0
push 0x57ece0
lea ecx, [ebp - 0x20]
call fcn.00425360
push ecx
mov byte [ebp - 4], 0x16
mov esi, esp
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x28], esi
lea ecx, [ecx - 0x10]
call fcn.00425550
add eax, 0x10
lea ecx, [ebp - 0x10]
mov dword [esi], eax
call fcn.00437b50
mov edi, eax
mov byte [ebp - 4], 0x17
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov dword [ebp - 0x28], esi
call fcn.00425550
add eax, 0x10
lea ecx, [ebp - 0x34]
mov dword [esi], eax
call fcn.00437b50
add esp, 4
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x18
push ecx
lea ecx, [ebp - 0x20]
mov edx, edi
push ecx
lea ecx, [ebp - 0x38]
push ecx
mov ecx, eax
call fcn.004470d0
mov edx, dword [ebp - 0x34]
add esp, 0xc
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43fca3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x10]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43fcbd
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x20]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43fcd7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x1c]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43fcf1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x38]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43fd0b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x44]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43fd25
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x30]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43fd3f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x14]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43fd59
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x48]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43fd73
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x24]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43fd8d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x4c]
cmp ecx, 8
jb 0x43fdc7
mov edx, dword [ebp - 0x60]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x43fdbd
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x440049
push ecx
push edx
call fcn.00532241
add esp, 8
mov edx, dword [ebp - 0x40]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43fde1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x3c]
jmp 0x43fffb
push 7
push str.product
call fcn.00424490
lea ecx, [ebp - 0x30]
call fcn.00437680
mov ecx, esp
mov dword [ebp - 4], 0x19
push 0x1a
push str.GetCurrentDirectory_failed
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0
call fcn.00424490
lea ecx, [ebp - 0x14]
call fcn.00437680
add esp, 0x18
mov byte [ebp - 4], 0x1a
call fcn.00424e20
mov ecx, eax
test ecx, ecx
je 0x44004e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x20], eax
push 0x57ece0
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x1b
call fcn.00425090
test al, al
jne 0x43fe73
push 0
push 0x57ece0
lea ecx, [ebp - 0x20]
call fcn.00425360
mov byte [ebp - 4], 0x1c
call fcn.00424e20
mov ecx, eax
test ecx, ecx
je 0x440058
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1c], eax
push 0x57ece0
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x1d
call fcn.00425090
test al, al
jne 0x43feb5
push 0
push 0x57ece0
lea ecx, [ebp - 0x1c]
call fcn.00425360
mov byte [ebp - 4], 0x1e
call fcn.00424e20
mov ecx, eax
test ecx, ecx
je 0x440062
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x24], eax
push 0x57ece0
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x1f
call fcn.00425090
test al, al
jne 0x43fef7
push 0
push 0x57ece0
lea ecx, [ebp - 0x24]
call fcn.00425360
push ecx
mov byte [ebp - 4], 0x20
mov esi, esp
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x28], esi
lea ecx, [ecx - 0x10]
call fcn.00425550
add eax, 0x10
lea ecx, [ebp - 0x34]
mov dword [esi], eax
call fcn.00437b50
mov edi, eax
mov byte [ebp - 4], 0x21
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffffff0
mov dword [ebp - 0x28], esi
call fcn.00425550
add eax, 0x10
lea ecx, [ebp - 0x10]
mov dword [esi], eax
call fcn.00437b50
add esp, 4
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0x22
push ecx
lea ecx, [ebp - 0x1c]
mov edx, edi
push ecx
lea ecx, [ebp - 0x24]
push ecx
mov ecx, eax
call fcn.004470d0
mov edx, dword [ebp - 0x10]
or ebx, 0xffffffff
add esp, 0xc
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43ff76
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x34]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43ff90
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x24]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43ffaa
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x1c]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43ffc4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x20]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43ffde
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x14]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x43fff8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x30]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x440010
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00425520
push 0x80004005
call fcn.00425520
push 0x80004005
call fcn.00425520
push 0x80004005
call fcn.00425520
call fcn.005370ef
push 0x80004005
call fcn.00425520
push 0x80004005
call fcn.00425520
push 0x80004005
call fcn.00425520
int3