Function at 0x432450
Capabilities:
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x1ac
mov eax, dword [0x4b445c]
xor eax, esp
mov dword [esp + 0x1a8], eax
push ebx
push ebp
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push esi
mov ebp, dword [esp + 0x1c0]
mov esi, dword [esp + 0x1c4]
push edi
mov edi, dword [esp + 0x1c0]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0x20019
push 0
push 0
push 0
push str.SoftwareRTS
push 0x80000001
mov dword [esp + 0x48], edi
call ebx
test eax, eax
je 0x4324e1
push str.2052
push str.Cant_open_registry_
lea edx, [esp + 0x3c]
push edx
push str.CanNotOpenReg
mov ecx, edi
call fcn.00423240
push 0x1000
push ebp
lea eax, [esp + 0x3c]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x43279b
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
push 0
push 0x2001f
push 0
push 0
push 0
push str.RTSClient
push eax
call ebx
test eax, eax
jne 0x43260c
push 0x104
mov ecx, edi
call fcn.00423230
push eax
mov eax, dword [esp + 0x18]
push 3
push 0
push str.RTSClientPath
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x43254a
push str.2052
push str.Cant_write_path_to_registry_
lea ecx, [esp + 0x3c]
push ecx
push str.CanNotWriteReg
jmp 0x432620
mov eax, dword [esp + 0x10]
test eax, eax
je 0x432559
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x432568
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00432310
add eax, 0xfffffff6
cmp eax, 0xb
ja case.0x432580.12
movzx eax, byte [eax + 0x4327c4]
jmp dword [eax*4 + 0x4327b4]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
push 0
push 0x2001f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push 0x80000001
call ebx
test eax, eax
je case.0x432580.12
push str.2052
push str.Cant_open_registry_
lea eax, [esp + 0x3c]
push eax
push str.CanNotOpenReg
mov ecx, edi
call fcn.00423240
push 0x1000
push ebp
lea ecx, [esp + 0x3c]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x43279b
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnceExRTS
push 0x80000001
call ebx
test eax, eax
je case.0x432580.12
push str.2052
push str.Cant_open_registry_
lea ecx, [esp + 0x3c]
push ecx
push str.CanNotOpenReg
mov ecx, edi
call fcn.00423240
push 0x1000
push ebp
lea edx, [esp + 0x3c]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x43279b
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnceRTS
push 0x80000001
call ebx
test eax, eax
jne 0x4324ae
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x48a0f8
push esi
or ebx, 0xffffffff
mov dword [esp + 0x24], 3
mov dword [esp + 0x28], 0x104
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.AutoRemoveRTSClient
push esi
call ebp
push 0xa
lea ecx, [esp + 0x2c]
push ecx
add ebx, 1
push ebx
call fcn.0045fae7
add esp, 0xc
lea edx, [esp + 0x28]
push edx
push esi
call edi
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x20]
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
push 0
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x432691
push 0x103
lea eax, [esp + 0xb9]
push 0
push eax
mov byte [esp + 0xc0], 0
call fcn.0045eb50
add esp, 0xc
call fcn.00432310
add eax, 0xfffffff6
cmp eax, 0xb
ja case.0x432705.12
movzx ecx, byte [eax + 0x4327e0]
jmp dword [ecx*4 + 0x4327d0]
push str.command__c_deltree__y
lea edx, [esp + 0xb8]
push edx
jmp 0x432737
push str.start__m_command__c_deltree__y
lea eax, [esp + 0xb8]
push eax
jmp 0x432737
push str.cmd__c_rd__s__q
lea ecx, [esp + 0xb8]
push ecx
call edi
push 0x48bc58
lea edx, [esp + 0xb8]
push edx
call edi
mov ecx, dword [esp + 0x24]
call fcn.00423230
push eax
lea eax, [esp + 0xb8]
push eax
call edi
push 0x48bc58
lea ecx, [esp + 0xb8]
push ecx
call edi
mov eax, dword [esp + 0x10]
push 0x104
lea edx, [esp + 0xb8]
push edx
push 1
push 0
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x43279b
mov eax, dword [esp + 0x10]
test eax, eax
je 0x43279b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x1b8]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0045e17e
add esp, 0x1ac
ret