Function at 0x404110
Capabilities:
Delete registry key
Delete registry value
Extract resource via kernel32 functions
Terminate process

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x5080ae
push eax
mov eax, 0x1438
mov dword fs:[0], esp
call fcn.004c2760
mov eax, dword [0x5580a0]
push ebx
push ebp
push esi
push edi
mov ebp, ecx
mov dword [esp + 0x10], eax
mov ecx, 0xfa
xor eax, eax
lea edi, [esp + 0xa8]
lea edx, [esp + 0x490]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x30]
lea eax, [esp + 0xa8]
push ecx
push edx
push eax
mov ecx, ebp
mov dword [esp + 0x145c], 0
call fcn.004039b0
test eax, eax
jne 0x404405
mov al, byte [esp + 0xa8]
or edi, 0xffffffff
test al, al
je 0x4043ee
lea ecx, [esp + 0xa8]
lea edx, [esp + 0x20]
push ecx
push edx
mov dword [esp + 0x28], closesocket
call fcn.0040b9f0
add esp, 8
test ax, ax
je 0x404452
mov eax, dword [esp + 0x1458]
test eax, eax
je 0x4043ee
push str.http:__
lea ecx, [esp + 0x18]
call fcn.004dd17f
lea eax, [esp + 0x24]
push 0xa
mov ebx, 1
push eax
push 0x50
mov byte [esp + 0x145c], bl
call fcn.004c2547
add esp, 0xc
lea ecx, [esp + 0x18]
push str.www.globalscape.com_images_testconnect.gif
call fcn.004dd17f
push 0x5525ac
lea ecx, [esp + 0x1c]
mov byte [esp + 0x1454], 2
call fcn.004d3b06
mov esi, eax
cmp esi, edi
je 0x404248
push 0x5525a8
push esi
lea ecx, [esp + 0x20]
call fcn.004d3666
lea ecx, [esp + 0x24]
inc esi
push ecx
push esi
lea ecx, [esp + 0x20]
call fcn.004d3666
lea edx, [esp + 0x18]
lea ecx, [esp + 0x14]
push edx
call fcn.004dd529
jmp 0x404272
push str.www.globalscape.com_images_testconnect.gif
lea ecx, [esp + 0x18]
call fcn.004dd4ed
push 0x5525a8
lea ecx, [esp + 0x18]
call fcn.004dd4ed
lea eax, [esp + 0x24]
lea ecx, [esp + 0x14]
push eax
call fcn.004dd4ed
mov ecx, dword [esp + 0x14]
push ecx
call fcn.004addc0
add esp, 4
test eax, eax
je 0x404348
push 0
lea ecx, [esp + 0x38]
mov dword [ebp + 8], ebx
mov dword [ebp + 0xc], ebx
call fcn.00408cb0
lea edx, [esp + 0x878]
push 0
push edx
mov ecx, ebp
mov byte [esp + 0x1458], 3
call fcn.00403900
lea eax, [esp + 0x878]
lea ecx, [esp + 0x98]
push eax
call fcn.004dd29a
lea ecx, [esp + 0xa8]
push ecx
lea ecx, [esp + 0x98]
call fcn.004dd29a
lea ecx, [esp + 0x34]
call fcn.00408db0
cmp eax, ebx
jne 0x4042ee
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
cmp dword [esp + 0x90], ebx
jne 0x404380
lea ecx, [esp + 0x9c]
mov byte [esp + 0x1450], 6
call fcn.004dd111
lea ecx, [esp + 0x98]
mov byte [esp + 0x1450], 5
call fcn.004dd111
lea ecx, [esp + 0x94]
mov byte [esp + 0x1450], 4
call fcn.004dd111
lea ecx, [esp + 0x34]
mov byte [esp + 0x1450], 2
call fcn.004d8dd9
lea ecx, [esp + 0x18]
mov byte [esp + 0x1450], bl
call fcn.004dd111
lea ecx, [esp + 0x14]
mov byte [esp + 0x1450], 0
call fcn.004dd111
lea ecx, [esp + 0x10]
mov dword [esp + 0x1450], edi
call fcn.004dd111
mov eax, ebx
jmp 0x40454e
lea ecx, [esp + 0x9c]
mov byte [esp + 0x1450], 9
call fcn.004dd111
lea ecx, [esp + 0x98]
mov byte [esp + 0x1450], 8
call fcn.004dd111
lea ecx, [esp + 0x94]
mov byte [esp + 0x1450], 7
call fcn.004dd111
lea ecx, [esp + 0x34]
mov byte [esp + 0x1450], 2
call fcn.004d8dd9
lea ecx, [esp + 0x18]
mov byte [esp + 0x1450], bl
call fcn.004dd111
lea ecx, [esp + 0x14]
mov byte [esp + 0x1450], 0
call fcn.004dd111
lea ecx, [esp + 0x10]
mov dword [esp + 0x1450], edi
call fcn.004dd111
xor eax, eax
jmp 0x40454e
lea edx, [esp + 0x10]
mov ecx, ebp
push edx
call fcn.00403660
test eax, eax
jne 0x404430
lea ecx, [esp + 0x10]
mov dword [esp + 0x1450], 0xffffffff
call fcn.004dd111
xor eax, eax
jmp 0x40454e
lea eax, [esp + 0xa8]
lea ecx, [esp + 0x2c]
push eax
push ecx
mov dword [esp + 0x34], closesocket
call fcn.0040b9f0
add esp, 8
test ax, ax
jne 0x40447d
push str..DEFAULTSoftwareGlobalSCAPE_Inc.CuteFTP_5.0SlQ
push reloc.WSOCK32.dll_closesocket
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea ecx, [esp + 0x10]
mov dword [esp + 0x1450], 0xffffffff
call fcn.004dd111
xor eax, eax
jmp 0x40454e
lea edx, [esp + 0xc78]
lea eax, [esp + 0xa8]
push edx
push eax
call fcn.004ae1d0
mov edx, dword [esp + 0x18]
mov esi, eax
lea ecx, [esp + esi + 0xc80]
push ecx
push edx
call fcn.004ae1d0
add esp, 0x10
add esi, eax
call fcn.004f7db8
mov eax, dword [eax + 8]
push str.BINARY
push 0x170
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
lea eax, [esp + 0x494]
push eax
lea ecx, [esp + 0xc80]
push esi
push ecx
call fcn.00408880
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x404535
lea edx, [esp + 0x1c]
push edx
push 0x20006
push eax
push str..DEFAULTSoftwareGlobalSCAPE_Inc.CuteFTP_5.0SlQ
push reloc.WSOCK32.dll_closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x20], eax
je 0x40452a
mov eax, dword [esp + 0x1c]
push 0x552550
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x10]
mov dword [ebp + 0x20], esi
mov dword [esp + 0x1450], 0xffffffff
call fcn.004dd111
mov eax, esi
mov ecx, dword [esp + 0x1448]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1444
ret 4