Function at 0x424c70
Capabilities:
Check if file exists
Create process on windows
Delete file
Delete registry key
Get disk information
Get disk size
Get file attributes
Get file size
Query or enumerate registry key
Query or enumerate registry value
Set registry value
Write and execute a file
Write file on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43d4eb
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x950
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x4574c8]
xorps xmm0, xmm0
mov esi, dword [0x4574c0]
push 0x44
mov dword [ebp - 0x7bc], eax
lea eax, [ebp - 0x960]
push 0
push eax
mov dword [ebp - 0x788], esi
mov dword [ebp - 0x8dc], 0x44d8d8
mov dword [ebp - 0x8d8], str..ntia64.reg
mov dword [ebp - 0x8d4], 0xb0015
mov dword [ebp - 0x8d0], str.DefaultInstall.ntamd64
mov dword [ebp - 0x8cc], str..ntamd64.reg
mov dword [ebp - 0x8c8], 0xc0016
mov dword [ebp - 0x8c4], str.DefaultInstall.ntx86
mov dword [ebp - 0x8c0], str..ntx86.reg
mov dword [ebp - 0x8bc], 0xa0014
mov dword [ebp - 0x8b8], str.DefaultInstall.nt
mov dword [ebp - 0x8b4], str..nt.reg
mov dword [ebp - 0x8b0], 0x70011
mov dword [ebp - 0x8ac], str.DefaultInstall
mov dword [ebp - 0x8a8], str..reg
mov dword [ebp - 0x8a4], 0x4000e
movups xmmword [ebp - 0x8a0], xmm0
mov dword [ebp - 0x88c], 0
mov dword [ebp - 0x800], 0x14
mov dword [ebp - 0x790], 0
movups xmmword [ebp - 0x908], xmm0
mov dword [ebp - 0x8e8], 0
movups xmmword [ebp - 0x8f8], xmm0
call fcn.0042a4e0
add esp, 0xc
lea eax, [ebp - 0x7f0]
push 0x30
push 0
push eax
call fcn.0042a4e0
movzx eax, word [0x4574e0]
add esp, 0xc
mov word [ebp - 0x1c], ax
xorps xmm0, xmm0
xor eax, eax
mov dword [ebp - 0x7fc], 0
mov word [ebp - 0x16], ax
mov eax, 0x5f
push 0x206
mov word [ebp - 0x738], ax
lea eax, [ebp - 0x736]
push 0
push eax
movups xmmword [ebp - 0x750], xmm0
mov dword [ebp - 0x7f8], 0
movq qword [ebp - 0x740], xmm0
mov dword [ebp - 0x7ac], 0
mov dword [ebp - 0x79c], 0
mov dword [ebp - 0x7b0], 0
mov dword [ebp - 0x7a4], 0
mov dword [ebp - 0x1a], 0x5c003a
call fcn.0042a4e0
add esp, 0xc
lea eax, [ebp - 0x68]
push 0x42
push 0
push eax
call fcn.0042a4e0
add esp, 0xc
lea eax, [ebp - 0x530]
push 0x230
push 0
push eax
call fcn.0042a4e0
movups xmm0, xmmword [str.REG.exe_EXPORT__HKCU..Override..___]
add esp, 0xc
movups xmmword [ebp - 0x300], xmm0
movups xmm0, xmmword [0x44d790]
movups xmmword [ebp - 0x2f0], xmm0
movups xmm0, xmmword [0x44d7a0]
movups xmmword [ebp - 0x2e0], xmm0
movups xmm0, xmmword [0x44d7b0]
movups xmmword [ebp - 0x2d0], xmm0
movzx eax, word [0x44d7c8]
movq xmm0, qword [0x44d7c0]
push 0x24a
mov word [ebp - 0x2b8], ax
lea eax, [ebp - 0x2b6]
push 0
push eax
movq qword [ebp - 0x2c0], xmm0
call fcn.0042a4e0
add esp, 0xc
mov byte [ebp - 0x781], 0
xorps xmm0, xmm0
xor edi, edi
movq qword [ebp - 0x8e4], xmm0
movups xmmword [ebp - 0x778], xmm0
push 0x10212
push edi
push dword [0x45764c]
movups xmmword [ebp - 0x768], xmm0
mov dword [ebp - 0x798], edi
movq qword [ebp - 0x758], xmm0
movq qword [ebp - 0x880], xmm0
movq qword [ebp - 0x918], xmm0
movq qword [ebp - 0x910], xmm0
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x780], eax
mov dword [ebp - 0x78c], eax
test eax, eax
je 0x424f88
push 0x300
push edi
push dword [0x45764c]
mov dword [ebp - 0x7d0], 0x20
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x7d8], eax
mov dword [ebp - 0x7c8], eax
test eax, eax
jne 0x424f99
mov ecx, dword [ebp - 0x780]
push ecx
push eax
push dword [0x45764c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [0x45771c], 8
xor al, al
jmp 0x426414
xor eax, eax
mov dword [ebp - 0x960], 0x44
mov word [ebp - 0x930], ax
lea eax, [ebp - 0x888]
push eax
push 0x104
push 0x457720
push 0x400
push 0
push dword [0x45631c]
mov dword [ebp - 0x934], 1
push 0x2400
mov dword [ebp - 0x888], str.Inf2Reg
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
sub esp, 8
lea ecx, [ebp - 0x878]
push 0x457720
push dword [0x45633c]
sub esp, 8
push 0x457720
call fcn.00402d80
lea ecx, [ebp - 0x878]
mov dword [ebp - 4], 0
call fcn.00402fd0
push 0x4037c0
push 0xfa
push 0x65
push dword [ebp - 0x870]
lea eax, [ebp - 0x878]
mov dword [0x45754c], eax
call dword [sym.imp.USER32.dll_SetTimer]
movzx ecx, byte [ebp - 0x83a]
test eax, eax
lea eax, [ebp - 0x7f4]
mov dword [ebp - 0x7f4], 0
mov edx, 1
mov dword [ebp - 0x804], 0
push eax
cmovne ecx, edx
push 0x2000e
mov byte [ebp - 0x83a], cl
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4250ae
lea eax, [ebp - 0x804]
push eax
push 2
push dword [ebp - 0x7f4]
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
push dword [ebp - 0x7f4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x804]
mov dword [ebp - 0x7d4], eax
mov eax, 1
mov dword [ebp - 0x7e0], 0xffffffff
mov dword [ebp - 0x7dc], 0xffffffff
mov dword [0x45771c], 0
mov dword [ebp - 0x7a0], eax
cmp esi, eax
jbe 0x4256b8
nop word [eax + eax]
mov ecx, dword [ebp - 0x7bc]
mov esi, dword [ecx + eax*4]
mov eax, dword [ebp - 0x874]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
jne 0x425677
mov eax, dword [ebp - 0x7d0]
cmp dword [ebp - 0x7cc], eax
jne 0x425164
add eax, eax
mov dword [ebp - 0x7d0], eax
lea eax, [eax + eax*2]
shl eax, 3
push eax
push dword [ebp - 0x7d8]
push 0
push dword [0x45764c]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov dword [ebp - 0x7c8], eax
test eax, eax
je 0x4256b8
mov ecx, dword [ebp - 0x7cc]
mov dword [ebp - 0x7d8], eax
lea ecx, [ecx + ecx*2]
lea eax, [eax + ecx*8]
mov dword [ebp - 0x7c8], eax
cmp word [esi], 0x2f
jne 0x4251d7
movzx eax, word [esi + 2]
cmp eax, 0x49
je 0x425178
cmp eax, 0x69
jne 0x42519f
movzx ecx, word [esi + 4]
cmp ecx, 0x4e
je 0x425186
cmp ecx, 0x6e
jne 0x42519f
movzx ecx, word [esi + 6]
cmp ecx, 0x52
je 0x425194
cmp ecx, 0x72
jne 0x42519f
cmp word [esi + 8], 0
je 0x42561a
cmp eax, 0x41
je 0x4251ad
cmp eax, 0x61
jne 0x425266
movzx ecx, word [esi + 4]
cmp ecx, 0x52
je 0x4251bf
cmp ecx, 0x72
jne 0x425266
cmp word [esi + 6], 0
jne 0x425266
cmp dword [0x4574d4], 0
je 0x4264b7
push ecx
lea eax, [ebp - 0x7a4]
mov ecx, esi
push eax
lea edx, [ebp - 0x78c]
call fcn.00404830
add esp, 8
test al, al
je 0x42561a
mov ecx, dword [ebp - 0x7c8]
mov ax, word [0x457638]
mov edx, dword [ebp - 0x780]
push 0
push 0x2000080
push 3
mov word [ecx + 4], ax
mov ecx, dword [ebp - 0x7a4]
mov eax, dword [ebp - 0x7c8]
sub ecx, edx
push 0
push 7
push 0x120089
sar ecx, 1
push edx
mov word [eax + 6], cx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x425413
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x42561a
cmp dword [0x4574d4], 0
je 0x4264b7
jmp 0x42561a
cmp eax, 0x41
je 0x425274
cmp eax, 0x61
jne 0x4251d7
cmp word [esi + 4], 0x3d
jne 0x4251d7
lea edi, [esi + 6]
mov byte [ebp - 0x779], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x7b8], xmm0
test edi, edi
je 0x4253fe
movzx eax, word [edi]
test ax, ax
je 0x4253fe
nop dword [eax + eax]
cmp ax, 9
je 0x42535c
cmp ax, 0x20
je 0x42535c
cmp ax, 0xd
je 0x42535c
cmp ax, 0xa
je 0x42535c
mov ecx, 0xa0
cmp ax, cx
je 0x42535c
cmp ax, 0xc
je 0x42535c
cmp ax, 0xb
je 0x42535c
mov ecx, 0x85
cmp ax, cx
je 0x42535c
mov ecx, 0x2028
cmp ax, cx
je 0x42535c
mov ecx, 0x2029
cmp ax, cx
je 0x42535c
mov ecx, 0x202f
cmp ax, cx
je 0x42535c
mov ecx, 0x1680
cmp ax, cx
je 0x42535c
mov ecx, 0x180e
cmp ax, cx
je 0x42535c
mov ecx, 0x1fff
cmp ax, cx
jbe 0x42533e
mov ecx, 0x200c
cmp ax, cx
jb 0x42535c
mov ecx, 0x3000
cmp ax, cx
je 0x42535c
mov ecx, 0xfeff
cmp ax, cx
je 0x42535c
mov ecx, 0x205f
cmp ax, cx
jne 0x425368
movzx eax, word [edi + 2]
add edi, 2
jmp 0x4252b0
cmp ax, 0x2b
je 0x42537e
movzx ecx, ax
cmp ax, 0x2d
jne 0x425385
mov byte [ebp - 0x779], 1
movzx ecx, word [edi + 2]
add edi, 2
mov esi, dword [ebp - 0x7b8]
cmp cx, 0x30
jb 0x4253e5
movzx edx, cx
mov ecx, dword [ebp - 0x7b4]
nop word [eax + eax]
cmp dx, 0x39
ja 0x4253e5
mov eax, esi
mov dword [ebp - 0x794], ecx
shld ecx, eax, 2
shl eax, 2
add esi, eax
movzx eax, dx
cdq
adc dword [ebp - 0x794], ecx
mov ecx, dword [ebp - 0x794]
shld ecx, esi, 1
add esi, esi
add esi, eax
movzx eax, word [edi + 2]
adc ecx, edx
sub esi, 0x30
mov edx, eax
sbb ecx, 0
add edi, 2
cmp eax, 0x30
jae 0x4253a0
mov eax, esi
neg eax
cmp byte [ebp - 0x779], 0
cmove eax, esi
or dword [ebp - 0x7f8], eax
jmp 0x42561a
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
or dword [ebp - 0x7f8], eax
jmp 0x42561a
mov eax, dword [ebp - 0x7c8]
push 0x23
mov dword [ebp - 0x880], 0
push 8
and dword [eax], 0x7fffffff
lea eax, [ebp - 0x880]
push eax
lea eax, [ebp - 0x8e4]
push eax
push esi
call dword [0x4576d0]
test eax, eax
jns 0x4254a3
push 4
push 0x28
lea eax, [ebp - 0x778]
push eax
lea eax, [ebp - 0x8e4]
push eax
push esi
call dword [0x4576d0]
test eax, eax
js 0x425613
mov ecx, dword [ebp - 0x780]
mov eax, dword [ebp - 0x758]
mov dword [ebp - 0x880], eax
mov ax, word [ecx + 8]
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
je 0x4254b3
cmp eax, 2
je 0x4254b3
mov eax, dword [ebp - 0x7c8]
or dword [eax], 0x80000000
jmp 0x4254b3
test dword [ebp - 0x880], 0x410
jne 0x425613
test edi, edi
jne 0x42551d
mov eax, dword [ebp - 0x7c8]
cmp dword [eax], edi
jge 0x4254ca
movzx eax, word [0x4574e0]
jmp 0x4254d4
mov eax, dword [ebp - 0x780]
movzx eax, word [eax + 8]
mov word [ebp - 0x1c], ax
lea eax, [ebp - 0x910]
push eax
lea eax, [ebp - 0x918]
push eax
lea eax, [ebp - 0x7e0]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x425515
mov eax, dword [ebp - 0x7e0]
or eax, dword [ebp - 0x7dc]
je 0x425515
mov dword [ebp - 0x798], 1
jmp 0x42551d
xor eax, eax
mov dword [ebp - 0x798], eax
mov eax, dword [ebp - 0x7c8]
mov edi, dword [ebp - 0x780]
cmp dword [eax], 0
jl 0x42555f
cmp dword [0x4574d4], 0
jne 0x42555f
movzx eax, word [eax + 6]
mov edx, edi
mov ecx, dword [ebp - 0x7d4]
push 0x120156
push eax
call fcn.00403fc0
add esp, 8
test al, al
je 0x42563e
mov eax, dword [ebp - 0x7c8]
add eax, 8
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov edx, dword [ebp - 0x7c8]
mov ecx, dword [ebp - 0x828]
mov eax, dword [ebp - 0x824]
add ecx, dword [edx + 8]
mov dword [ebp - 0x828], ecx
adc eax, dword [edx + 0xc]
mov dword [ebp - 0x824], eax
cmp eax, dword [ebp - 0x7dc]
ja 0x425661
jb 0x4255a8
cmp ecx, dword [ebp - 0x7e0]
ja 0x425661
movzx eax, word [edx + 4]
lea eax, [eax*2 + 2]
push eax
push 0
push dword [0x45764c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp - 0x7c8]
mov dword [ecx + 0x10], eax
mov eax, dword [ebp - 0x7c8]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x426432
movzx eax, word [eax + 4]
lea eax, [eax*2 + 2]
push eax
push edi
push ecx
call fcn.0043c9e0
add esp, 0xc
add dword [ebp - 0x818], 1
adc dword [ebp - 0x814], 0
inc dword [ebp - 0x7ec]
add dword [ebp - 0x7c8], 0x18
inc dword [ebp - 0x7cc]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x7a0]
inc eax
mov dword [ebp - 0x7a0], eax
cmp eax, dword [ebp - 0x788]
jae 0x4256b8
mov edi, dword [ebp - 0x798]
jmp 0x4250f0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x4574d4], 0
je 0x4264bd
mov dword [0x45771c], 5
jmp 0x42643c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x45771c], 1
jmp 0x42643c
push 0x65
push dword [ebp - 0x870]
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [ebp - 0x874]
push 0
push 0
push 0x44413c
mov byte [ebp - 0x83a], 0
mov ecx, dword [eax]
push 2
push eax
call dword [ecx + 0x28]
mov eax, dword [ebp - 0x874]
push 0
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x30]
jmp 0x4263c5
cmp dword [ebp - 0x818], 0
je 0x4263c5
mov ecx, dword [ebp - 0x824]
mov eax, dword [ebp - 0x828]
test ecx, ecx
jne 0x4256e6
cmp eax, 0x63
ja 0x4256e6
mov dword [ebp - 0x810], 1
jmp 0x4256f7
push 0
push 0x64
push ecx
push eax
call fcn.0043d1d0
mov dword [ebp - 0x810], eax
push 0x65
push dword [ebp - 0x870]
mov dword [ebp - 0x838], 1
mov dword [ebp - 0x834], 0
mov byte [ebp - 0x839], 1
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [ebp - 0x874]
push 0
push 0
push 0x44413c
mov byte [ebp - 0x83a], 0
mov ecx, dword [eax]
push 2
push eax
call dword [ecx + 0x28]
mov eax, dword [ebp - 0x874]
push 0
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x30]
cmp byte [ebp - 0x83f], 0
je 0x42578b
mov eax, dword [ebp - 0x86c]
mov byte [ebp - 0x83f], 0
test eax, eax
je 0x42578b
push 0
push 0
push 0x40a
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x50000000
push 0xfffffffffffffff0
push dword [ebp - 0x86c]
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov esi, dword [0x45754c]
mov ecx, dword [esi + 0x60]
call fcn.00428880
push 0x14
push 0x457550
mov dword [ebp - 0x7b8], eax
push dword [esi + 0x54]
push dword [esi + 0x50]
call dword [sym.imp.SHLWAPI.dll_StrFormatByteSizeW]
movups xmm0, xmmword [str.Inf2Reg:]
mov dword [ebp - 0x7b4], eax
movzx eax, word [0x44da20]
mov word [0x457730], ax
lea eax, [ebp - 0x7b8]
push eax
push 0xfb
push 0x457732
push 0x400
push 0
push dword [0x4563bc]
movups xmmword [0x457720], xmm0
push 0x2400
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
mov eax, dword [ebp - 0x874]
push 0
push 0
push 0x457720
mov ecx, dword [eax]
push 1
push eax
call dword [ecx + 0x28]
mov dword [ebp - 0x878], eax
mov eax, dword [ebp - 0x874]
push 0
mov byte [ebp - 0x839], 1
push 1
mov ecx, dword [eax]
push eax
call dword [ecx + 0x30]
mov esi, dword [0x4576bc]
mov dword [ebp - 0x878], eax
lea eax, [esi*2 - 8]
push eax
mov eax, dword [0x4574cc]
add eax, 8
push eax
lea eax, [ebp - 0x530]
push eax
call fcn.0043c9e0
movups xmm0, xmmword [str.__ROPK_.reg]
lea eax, [esi - 4]
add esp, 0xc
movzx ecx, ax
mov eax, ecx
add ecx, 0xb
movzx esi, cx
add esi, esi
push esi
movups xmmword [ebp + eax*2 - 0x530], xmm0
movq xmm0, qword [0x44d830]
movq qword [ebp + eax*2 - 0x520], xmm0
lea eax, [ebp - 0x530]
push eax
lea eax, [ebp - 0x2b8]
push eax
call fcn.0043c9e0
movq xmm0, qword [str.___y]
add esp, 0xc
movzx eax, word [0x44d840]
movq qword [ebp + esi - 0x2b8], xmm0
mov word [ebp + esi - 0x2b0], ax
push 0xf0
push 0
push dword [0x45764c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, eax
mov dword [ebp - 0x7a8], ecx
test ecx, ecx
je 0x426432
movups xmm0, xmmword [ebp - 0x8dc]
mov eax, dword [ebp - 0x8a4]
movups xmmword [ecx], xmm0
movups xmm0, xmmword [ebp - 0x8cc]
movups xmmword [ecx + 0x10], xmm0
movups xmm0, xmmword [ebp - 0x8bc]
movups xmmword [ecx + 0x20], xmm0
movq xmm0, qword [ebp - 0x8ac]
movq qword [ecx + 0x30], xmm0
mov dword [ecx + 0x38], eax
mov ecx, dword [ebp - 0x818]
mov eax, dword [ebp - 0x7d8]
mov dword [ebp - 0x7a4], ecx
mov dword [ebp - 0x7c8], eax
test ecx, ecx
je 0x426336
nop dword [eax]
mov eax, dword [ebp - 0x874]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
jne 0x426336
mov eax, dword [ebp - 0x7c8]
push 0
push 1
movzx ecx, word [eax + 6]
mov eax, dword [eax + 0x10]
lea eax, [eax + ecx*2]
mov ecx, dword [ebp - 0x874]
push eax
push 2
push ecx
mov edx, dword [ecx]
call dword [edx + 0x28]
mov dword [ebp - 0x878], eax
lea eax, [ebp - 0x88c]
push eax
mov eax, dword [ebp - 0x7c8]
push 3
push 0
mov dword [0x45771c], 0
push dword [eax + 0x10]
call dword [sym.imp.SETUPAPI.dll_SetupOpenInfFileW]
mov dword [ebp - 0x794], eax
cmp eax, 0xffffffff
jne 0x4259bf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [0x45771c], esi
jmp 0x426279
push str.Optional_Components
mov edi, 5
push eax
mov dword [ebp - 0x798], edi
call dword [sym.imp.SETUPAPI.dll_SetupGetLineCountW]
mov esi, eax
test esi, esi
je 0x425b51
lea eax, [ebp - 0x8a0]
push eax
push 0
push str.Optional_Components
push dword [ebp - 0x794]
call dword [sym.imp.SETUPAPI.dll_SetupFindFirstLineW]
test eax, eax
je 0x425b51
add esi, edi
cmp esi, dword [ebp - 0x800]
jb 0x425a41
lea eax, [esi + 1]
mov esi, dword [ebp - 0x7a8]
mov dword [ebp - 0x800], eax
lea eax, [eax + eax*2]
shl eax, 2
push eax
push esi
push 0
push dword [0x45764c]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
test esi, esi
je 0x426432
mov dword [ebp - 0x7a8], eax
jmp 0x425a47
mov eax, dword [ebp - 0x7a8]
lea esi, [eax + 0x3c]
nop word [eax + eax]
lea eax, [ebp - 0x8a0]
push eax
call dword [sym.imp.SETUPAPI.dll_SetupGetFieldCount]
cmp eax, 1
jne 0x425b3b
lea eax, [ebp - 0x790]
push eax
push 0x100
lea eax, [ebp - 0x736]
push eax
push 1
lea eax, [ebp - 0x8a0]
push eax
call dword [sym.imp.SETUPAPI.dll_SetupGetStringFieldW]
test eax, eax
je 0x425b3b
mov eax, dword [ebp - 0x790]
lea eax, [eax*4 + 0xc]
push eax
push 0
push dword [0x45764c]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esi], eax
test eax, eax
je 0x426432
mov ecx, dword [ebp - 0x790]
add ecx, ecx
push ecx
lea ecx, [ebp - 0x736]
push ecx
push eax
call fcn.0043c9e0
mov eax, dword [ebp - 0x790]
add esp, 0xc
mov ecx, dword [esi]
dec eax
mov word [esi + 8], ax
mov eax, dword [ebp - 0x790]
lea ecx, [ecx + eax*2]
mov dword [esi + 4], ecx
mov eax, dword [ebp - 0x790]
add eax, eax
push eax
lea eax, [ebp - 0x738]
push eax
push ecx
call fcn.0043c9e0
mov eax, dword [ebp - 0x790]
add esp, 0xc
mov ecx, dword [esi + 4]
movq xmm0, qword [str..reg]
movq qword [ecx + eax*2], xmm0
lea ecx, [ecx + eax*2]
mov ax, word [0x44d87c]
mov word [ecx + 8], ax
mov eax, dword [ebp - 0x790]
add eax, 4
mov word [esi + 0xa], ax
add esi, 0xc
inc edi
mov dword [ebp - 0x798], edi
lea eax, [ebp - 0x8a0]
push eax
push eax
call dword [sym.imp.SETUPAPI.dll_SetupFindNextLine]
test eax, eax
jne 0x425a50
mov eax, dword [ebp - 0x798]
mov edi, dword [ebp - 0x7a8]
mov dword [ebp - 0x7bc], 0
mov dword [ebp - 0x7a0], edi
test eax, eax
je 0x42622f
nop word [eax + eax]
lea eax, [ebp - 0x8a0]
push eax
push str.AddReg
push dword [edi]
push dword [ebp - 0x794]
call dword [sym.imp.SETUPAPI.dll_SetupFindFirstLineW]
test eax, eax
je 0x426207
mov edx, dword [ebp - 0x7c8]
mov edi, 1
movzx eax, word [edx + 4]
movzx esi, word [edx + 6]
movzx ecx, ax
mov dword [ebp - 0x788], eax
movzx eax, si
mov dword [ebp - 0x78c], esi
mov esi, ecx
sub esi, eax
lea eax, [ecx + ecx]
mov ecx, dword [edx + 0x10]
mov dword [ebp - 0x884], eax
mov dword [ebp - 0x7b4], ecx
lea edx, [eax + ecx]
je 0x425bfe
movzx eax, word [edx - 2]
sub edx, 2
cmp eax, 0x2e
je 0x425bfe
cmp eax, 0x5c
je 0x425bfe
cmp eax, 0x2f
je 0x425bfe
inc edi
sub esi, 1
jne 0x425be2
xor ecx, ecx
movzx eax, di
cmp word [edx], 0x2e
cmove ecx, eax
mov eax, dword [ebp - 0x7c8]
movzx esi, cx
mov dword [ebp - 0x890], esi
cmp dword [eax], 0
jge 0x425c91
mov edi, dword [0x4576b4]
mov eax, dword [ebp - 0x788]
sub eax, dword [ebp - 0x78c]
movzx esi, di
add esi, esi
mov dword [ebp - 0x788], eax
push esi
push dword [0x4574d0]
push dword [ebp - 0x780]
call fcn.0043c9e0
mov ecx, dword [ebp - 0x788]
add esp, 0xc
movzx eax, cx
add eax, eax
push eax
mov eax, dword [ebp - 0x7c8]
movzx ecx, word [eax + 6]
mov eax, dword [eax + 0x10]
lea eax, [eax + ecx*2]
push eax
mov eax, dword [ebp - 0x780]
add eax, esi
push eax
call fcn.0043c9e0
mov ecx, dword [ebp - 0x788]
add esp, 0xc
movzx eax, cx
sub eax, dword [ebp - 0x890]
add eax, edi
jmp 0x425cb8
push dword [ebp - 0x884]
push dword [ebp - 0x7b4]
push dword [ebp - 0x780]
call fcn.0043c9e0
mov eax, dword [ebp - 0x7c8]
add esp, 0xc
mov ax, word [eax + 4]
sub ax, si
cmp byte [ebp - 0x781], 0
movzx eax, ax
mov dword [ebp - 0x788], eax
jne 0x425de7
push 0
lea eax, [ebp - 0x7fc]
push eax
push 0
push 0xf003f
push 4
push 0
push 0
push str...Override..
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [0x45771c], eax
test eax, eax
jne 0x42643c
lea eax, [ebp - 0x74c]
mov edi, 0x20
mov dword [ebp - 0x78c], eax
cmp edi, 0xc0
jae 0x425de0
mov esi, dword [edi + 0x456760]
test esi, esi
je 0x425d45
push 0x457630
mov edx, 0x7fff
mov ecx, esi
call fcn.00402470
test eax, eax
js 0x425d4a
mov ecx, dword [0x457630]
jmp 0x425d52
mov eax, 0x80070057
xor ecx, ecx
mov dword [0x457630], ecx
test eax, eax
js 0x425d5b
movzx eax, cx
jmp 0x425d6e
test esi, esi
je 0x425d6c
cmp word [esi], 0
je 0x425d6c
mov eax, 0x7fff
jmp 0x425d6e
xor eax, eax
inc eax
mov dword [ebp - 0x79c], eax
add eax, eax
push eax
lea eax, [ebp - 0x68]
push esi
push eax
call fcn.0043c9e0
mov esi, dword [ebp - 0x78c]
lea eax, [ebp - 0x68]
add esp, 0xc
push 0
push esi
push 0
push 0xf003f
push 4
push 0
push 0
push eax
push dword [ebp - 0x7fc]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [0x45771c], eax
test eax, eax
jne 0x425dc7
push dword [esi]
push dword [edi + 0x456750]
call dword [sym.imp.ADVAPI32.dll_RegOverridePredefKey]
mov dword [0x45771c], eax
add esi, 4
add edi, 0x20
mov dword [ebp - 0x78c], esi
test eax, eax
je 0x425d12
jmp 0x42643c
mov byte [ebp - 0x781], 1
mov edi, dword [ebp - 0x7a0]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 6
push dword [edi]
push dword [ebp - 0x794]
push 0
call dword [sym.imp.SETUPAPI.dll_SetupInstallFromInfSectionW]
test eax, eax
je 0x4261fc
mov esi, 1
nop word [eax + eax]
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x79c]
mov dword [ebp - 0x79c], 0x20
push eax
lea eax, [ebp - 0x68]
push eax
push 0
push dword [ebp + esi*4 - 0x750]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
jne 0x425e8e
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x79c]
mov dword [ebp - 0x79c], 0x20
push eax
lea eax, [ebp - 0x68]
push eax
push 0
push dword [ebp + esi*4 - 0x750]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
jne 0x425e8e
inc esi
cmp esi, 6
jb 0x425e20
jmp 0x425ee1
lea eax, [ebp - 0x908]
push eax
lea eax, [ebp - 0x960]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x300]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x425ee1
push 0xffffffffffffffff
push dword [ebp - 0x908]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x908]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x904]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 6
je 0x4261b5
push ecx
push 0x457638
sub esp, 8
lea edx, [ebp - 0x7b0]
lea ecx, [ebp - 0x530]
call fcn.00403a60
add esp, 0x10
test eax, eax
je 0x4261ab
mov edx, dword [ebp - 0x7b0]
lea ecx, [ebp - 0x8f8]
push 0x1f
push eax
call fcn.00416cd0
add esp, 8
test al, al
je 0x4261ab
mov eax, dword [ebp - 0x8f4]
mov dword [ebp - 0x78c], eax
cmp eax, 7
jb 0x4261ab
movzx eax, word [edi + 0xa]
mov esi, dword [ebp - 0x788]
mov ecx, dword [ebp - 0x780]
lea eax, [eax*2 + 2]
push eax
push dword [edi + 4]
movzx eax, si
lea eax, [ecx + eax*2]
push eax
call fcn.0043c9e0
add esp, 0xc
test byte [ebp - 0x7f8], 2
jne 0x425fa9
push dword [ebp - 0x780]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x425fa9
movzx edx, word [edi + 0xa]
mov ecx, dword [ebp - 0x780]
add dx, si
push 0x80e8
call fcn.00404280
add esp, 4
mov dword [ebp - 0x780], eax
jmp 0x425faf
mov eax, dword [ebp - 0x780]
push 0
push 0xa000080
push 2
push 0
push 1
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x788], esi
cmp esi, 0xffffffff
jne 0x425fe5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x45771c], eax
jmp 0x4261b5
push 0
lea eax, [ebp - 0x7ac]
push eax
push 2
push 0x44e5a7
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0x7ac]
push eax
push 0x50
push str.Windows_Registry_Editor_Version_5.00_r_n_r_n
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 0x78c]
test ecx, ecx
je 0x4261a2
mov edi, dword [ebp - 0x8f8]
add edi, 0x12
nop word [eax + eax]
movzx eax, byte [edi - 1]
mov esi, dword [edi - 0xe]
cmp esi, eax
je 0x426180
test byte [edi], 2
jne 0x4260db
cmp ecx, 1
jbe 0x4260db
sub esi, eax
mov dword [ebp - 0x79c], esi
mov eax, dword [edi + 2]
movzx ecx, byte [edi + 0x13]
lea edx, [eax + ecx*2]
mov al, byte [edi - 2]
cmp al, byte [edi + 0x12]
jne 0x4260db
mov eax, dword [edi + 6]
sub eax, ecx
cmp esi, eax
ja 0x4260db
movzx eax, word [edx + esi*2]
cmp eax, 0x5c
je 0x426082
cmp eax, 0x5d
jne 0x4260db
movzx ecx, byte [edi - 1]
add esi, esi
mov eax, dword [edi - 0x12]
cmp esi, 0xfffe
mov dword [0x45641c], edx
lea eax, [eax + ecx*2]
mov ecx, 0xfffe
mov dword [0x456414], eax
movzx eax, si
cmova eax, ecx
movzx eax, ax
mov word [0x456410], ax
mov word [0x456418], ax
cmp ax, cx
jae 0x426120
push 1
push 0x456410
push 0x456418
call dword [0x457674]
movzx eax, al
test eax, eax
jne 0x426180
mov esi, dword [ebp - 0x788]
lea eax, [ebp - 0x7ac]
push 0
push eax
push 2
push 0x44d8d4
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0x7ac]
push eax
mov eax, dword [edi - 0xa]
lea eax, [eax*2 - 2]
push eax
push dword [edi - 0x12]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x426186
push 1
push 0x456410
push 0x456418
call dword [0x457674]
test al, al
je 0x4260db
movzx edx, word [0x456418]
mov eax, dword [0x45641c]
mov ecx, edx
shr ecx, 1
sub esi, edx
lea eax, [eax + ecx*2]
movzx ecx, word [0x456410]
mov dword [0x45641c], eax
mov eax, dword [0x456414]
shr ecx, 1
lea eax, [eax + ecx*2]
mov dword [0x456414], eax
cmp esi, 0xfffe
jae 0x42617c
mov word [0x456410], si
mov word [0x456418], si
test esi, esi
jne 0x426120
mov esi, dword [ebp - 0x788]
add edi, 0x14
sub dword [ebp - 0x78c], 1
mov ecx, dword [ebp - 0x78c]
jne 0x426030
mov edi, dword [ebp - 0x7a0]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4261b5
mov dword [0x45771c], 0xd
push dword [ebp - 0x7b0]
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
push 0
push dword [0x45764c]
call esi
push dword [ebp - 0x8f8]
mov dword [ebp - 0x7b0], 0
push 0
push dword [0x45764c]
call esi
lea ecx, [ebp - 0x750]
mov dword [ebp - 0x8f8], 0
call fcn.004235b0
jmp 0x426207
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x45771c], eax
mov eax, dword [ebp - 0x7bc]
add edi, 0xc
inc eax
mov dword [ebp - 0x7a0], edi
mov dword [ebp - 0x7bc], eax
cmp eax, dword [ebp - 0x798]
jb 0x425b80
mov eax, dword [ebp - 0x798]
mov esi, dword [ebp - 0x7a8]
add esi, 0x3c
cmp eax, 5
jbe 0x426267
lea edi, [eax - 5]
push dword [esi]
push 0
push dword [0x45764c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
lea esi, [esi + 0xc]
xorps xmm0, xmm0
movq qword [esi - 0xc], xmm0
mov dword [esi - 4], 0
sub edi, 1
jne 0x426240
push dword [ebp - 0x794]
call dword [sym.imp.SETUPAPI.dll_SetupCloseInfFile]
mov esi, dword [0x45771c]
mov edi, dword [ebp - 0x7c8]
mov ecx, dword [ebp - 0x820]
mov eax, dword [ebp - 0x81c]
push 0
add ecx, dword [edi + 8]
push dword [ebp - 0x810]
mov dword [ebp - 0x820], ecx
adc eax, dword [edi + 0xc]
push eax
push ecx
mov dword [ebp - 0x81c], eax
call fcn.0043d1d0
mov dword [ebp - 0x830], eax
mov dword [ebp - 0x82c], edx
cmp edx, dword [ebp - 0x834]
jb 0x4262e1
ja 0x4262ca
cmp eax, dword [ebp - 0x838]
jbe 0x4262e1
lea ecx, [ebp - 0x878]
call fcn.004031a0
mov esi, dword [0x45771c]
mov edi, dword [ebp - 0x7c8]
add dword [ebp - 0x818], 0xffffffff
adc dword [ebp - 0x814], 0xffffffff
test esi, esi
je 0x426318
cmp dword [ebp - 0x7a4], 1
lea ecx, [ebp - 0x878]
sete al
movzx eax, al
push eax
push esi
push 0x3e8
call fcn.00403330
mov edi, dword [ebp - 0x7c8]
mov esi, dword [ebp - 0x7a4]
add edi, 0x18
dec esi
mov dword [ebp - 0x7c8], edi
mov dword [ebp - 0x7a4], esi
test esi, esi
jne 0x425940
lea eax, [ebp - 0x530]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp byte [ebp - 0x781], 0
je 0x4263a8
lea esi, [ebp - 0x74c]
mov edi, 0x20
push dword [esi]
call dword [0x457718]
mov dword [0x45771c], eax
test eax, eax
je 0x426374
push eax
call dword [0x457640]
mov dword [0x45771c], eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push dword [edi + 0x456750]
call dword [sym.imp.ADVAPI32.dll_RegOverridePredefKey]
add edi, 0x20
add esi, 4
cmp edi, 0xc0
jb 0x426357
push str...Override..
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea ecx, [ebp - 0x878]
mov byte [ebp - 0x830], 0x64
call fcn.004031a0
push 0x258
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp - 0x780]
push 0
push dword [0x45764c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
sub esp, 8
lea ecx, [ebp - 0x7f0]
call fcn.00403870
add esp, 8
lea ecx, [ebp - 0x878]
call fcn.00403270
cmp dword [0x45771c], 0
lea ecx, [ebp - 0x878]
sete byte [ebp - 0x779]
call fcn.00402f30
mov al, byte [ebp - 0x779]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00428cd6
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
mov dword [0x45771c], 8
cmp byte [ebp - 0x83a], 0
je 0x426481
push 0x65
push dword [ebp - 0x870]
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [ebp - 0x874]
push 0
push 0
push 0x44413c
mov byte [ebp - 0x83a], 0
mov ecx, dword [eax]
push 2
push eax
call dword [ecx + 0x28]
mov eax, dword [ebp - 0x874]
push 0
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x30]
sub esp, 8
lea ecx, [ebp - 0x878]
call fcn.00403080
push 0x320
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push dword [0x45771c]
lea ecx, [ebp - 0x878]
push 0x5dc
call fcn.00403330
jmp 0x4263c5
mov edi, dword [ebp - 0x780]
push edi
push 0
push dword [0x45764c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
sub esp, 0xc
lea edx, [ebp - 0x7f0]
lea ecx, [ebp - 0x878]
call fcn.00403910
int3