Function at 0x493440
Capabilities:
Get system information on windows
Identify system language via api
Persist via run registry key
Persist via winlogon helper dll registry key

Disassembly:
push 0xffffffffffffffff
push 0x5484a7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x134
mov eax, dword [0x5ab980]
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x54]
mov dword [esp + 0x14c], 0
call fcn.00443890
lea ecx, [esp + 0xcc]
call fcn.004861d0
lea ecx, [esp + 0x7c]
mov byte [esp + 0x14c], 1
call fcn.004861d0
lea ecx, [esp + 0x30]
mov byte [esp + 0x14c], 2
call fcn.0042bb20
mov ecx, esi
mov byte [esp + 0x14c], 3
call fcn.004926e0
lea ecx, [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, esi
call fcn.004931d0
mov edi, eax
test edi, edi
jl 0x494563
push 0xffffffffffffff9b
push str.Load_HLKM_Software
call fcn.004227e0
add esp, 8
lea edx, [esp + 0x2c]
lea ebp, [esi + 0xdc]
lea eax, [esp + 0x14]
push edx
push str.System32Config_software
push ebp
push eax
call fcn.00512b79
lea ecx, [esp + 0x1c]
lea ebx, [esi + 0x8e4]
push eax
push ecx
mov ecx, ebx
mov byte [esp + 0x158], 4
call fcn.0042ba10
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Disk_HLKM_SOFTWARE
mov byte [esp + 0x15c], 5
call fcn.00512952
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0xdc]
call fcn.00486310
lea ecx, [esp + 0x18]
mov edi, eax
mov byte [esp + 0x14c], 4
call fcn.005128e4
lea ecx, [esp + 0x14]
mov byte [esp + 0x14c], 3
call fcn.005128e4
test edi, edi
jle 0x494563
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.HKEY_LOCAL_MACHINESoftware
call fcn.00512952
push ecx
mov byte [esp + 0x158], 6
mov ecx, esp
mov dword [esp + 0x24], esp
push str.HKEY_LOCAL_MACHINEDisk_HLKM_SOFTWARE
call fcn.00512952
lea ecx, [esp + 0x3c]
mov byte [esp + 0x158], 3
call fcn.0042b7c0
push 0xffffffffffffff9b
push str.Load_HLKM_System
call fcn.004227e0
add esp, 8
lea edx, [esp + 0x2c]
lea eax, [esp + 0x14]
push edx
push str.System32Config_system
push ebp
push eax
call fcn.00512b79
lea ecx, [esp + 0x1c]
push eax
push ecx
mov ecx, ebx
mov byte [esp + 0x158], 7
call fcn.0042ba10
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push str.Disk_HLKM_SYSTEM
mov byte [esp + 0x15c], 8
call fcn.00512952
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x8c]
call fcn.00486310
lea ecx, [esp + 0x18]
mov edi, eax
mov byte [esp + 0x14c], 7
call fcn.005128e4
lea ecx, [esp + 0x14]
mov byte [esp + 0x14c], 3
call fcn.005128e4
test edi, edi
jg 0x49368c
lea ecx, [esp + 0x30]
mov byte [esp + 0x14c], 2
call fcn.0042bb60
lea ecx, [esp + 0x7c]
mov byte [esp + 0x14c], 1
call fcn.00486260
lea ecx, [esp + 0xcc]
mov byte [esp + 0x14c], 0
call fcn.00486260
lea ecx, [esp + 0x10]
mov dword [esp + 0x14c], 0xffffffff
call fcn.005128e4
mov eax, edi
jmp 0x4947b0
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.HKEY_LOCAL_MACHINESystem
call fcn.00512952
push ecx
mov byte [esp + 0x158], 9
mov ecx, esp
mov dword [esp + 0x24], esp
push str.HKEY_LOCAL_MACHINEDisk_HLKM_SYSTEM
call fcn.00512952
lea ecx, [esp + 0x3c]
mov byte [esp + 0x158], 3
call fcn.0042b7c0
push str.HKEY_LOCAL_MACHINEDisk_HLKM_SYSTEMControlSet001
lea ecx, [esp + 0x14]
call fcn.00512a6d
lea edx, [esp + 0x18]
push edx
push str.Current
push str.HKEY_LOCAL_MACHINESystem_select
call fcn.0041f120
add esp, 0xc
test eax, eax
jle 0x49370e
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push eax
push str.HKEY_LOCAL_MACHINEDisk_HLKM_SYSTEM
push str._sControlSet_03d
push ecx
call fcn.0050e6c7
add esp, 0x10
push 1
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.HKEY_LOCAL_MACHINESystemCurrentControlSet
call fcn.00512952
push ecx
lea edx, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
mov byte [esp + 0x15c], 0xa
call fcn.00512659
lea ecx, [esp + 0x3c]
mov byte [esp + 0x158], 3
call fcn.0042b7c0
push 0xffffffffffffff9a
push str.Determine_System_Info
call fcn.004227e0
push 0xffffffffffffff9a
push str.GetVersionEx
call fcn.004227e0
add esp, 0x10
lea edi, [esi + 0x28]
push edi
mov dword [edi], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x494763
lea eax, [esp + 0x10]
push 0
push eax
push str.CurrentVersion
push str.HKEY_LOCAL_MACHINESoftwareMicrosoftWindows_NTCurrentVersion
mov dword [edi], 0x94
call fcn.0041efa0
add esp, 0x10
test eax, eax
jle 0x4937ca
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x20]
push ecx
push edx
call fcn.00422fb0
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
add esp, 8
shr eax, 0x10
and ecx, 0xffff
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], ecx
lea edx, [esp + 0x10]
push 0
push edx
push str.CurrentBuildNumber
push str.HKEY_LOCAL_MACHINESoftwareMicrosoftWindows_NTCurrentVersion
call fcn.0041efa0
add esp, 0x10
test eax, eax
jle 0x4937f7
mov eax, dword [esp + 0x10]
push eax
call fcn.004f9af8
add esp, 4
mov dword [esi + 0x34], eax
lea ecx, [esp + 0x10]
push 0
push ecx
mov edi, 2
push str.CSDVersion
push str.HKEY_LOCAL_MACHINESoftwareMicrosoftWindows_NTCurrentVersion
mov dword [esi + 0x38], edi
call fcn.0041efa0
add esp, 0x10
test eax, eax
jle 0x493836
mov edx, dword [esp + 0x10]
push 0x7f
lea eax, [esi + 0x3c]
push edx
push eax
call fcn.004f9fa0
add esp, 0xc
mov byte [esi + 0xbb], 0
mov edx, dword [esi + 0x38]
xor ecx, ecx
cmp edx, edi
sete cl
mov edi, ecx
mov dword [esp + 0x18], edi
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov word [esi + 0xc6], ax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
lea edx, [esp + 0x10]
push 0
push edx
push str.ComputerName
push str.HKEY_LOCAL_MACHINESystemCurrentControlSetControlComputerNameComputerName
mov word [esi + 0xc4], ax
call fcn.0041efa0
add esp, 0x10
test eax, eax
jle 0x49388d
lea eax, [esp + 0x10]
lea ecx, [esi + 0xcc]
push eax
call fcn.00512a1d
lea ecx, [esi + 0xc8]
call fcn.0051286f
push 0xffffffffffffff9a
push str.GetWindowsDirectory
call fcn.004227e0
lea ecx, [esp + 0x18]
push 0
push ecx
push str.SystemRoot
push str.HKEY_LOCAL_MACHINESoftwareMicrosoftWindows_NTCurrentVersion
call fcn.0041efa0
add esp, 0x18
test eax, eax
jle 0x494763
lea edx, [esp + 0x10]
mov ecx, ebp
push edx
call fcn.00512a1d
push ebp
call fcn.0041f9c0
add esp, 4
test edi, edi
je 0x493912
push str.System32_
lea eax, [esp + 0x18]
push ebp
push eax
call fcn.00512b79
lea edi, [esi + 0xe4]
push eax
mov ecx, edi
mov byte [esp + 0x150], 0xb
call fcn.00512a1d
mov byte [esp + 0x14c], 3
lea ecx, [esp + 0x14]
jmp 0x493944
push str.System_
lea ecx, [esp + 0x18]
push ebp
push ecx
call fcn.00512b79
lea edi, [esi + 0xe4]
push eax
mov ecx, edi
mov byte [esp + 0x150], 0xc
call fcn.00512a1d
mov byte [esp + 0x14c], 3
lea ecx, [esp + 0x14]
call fcn.005128e4
push str.TEMP_
lea edx, [esp + 0x18]
push ebp
push edx
call fcn.00512b79
push eax
lea ecx, [esi + 0xe0]
mov byte [esp + 0x150], 0xd
call fcn.00512a1d
lea ecx, [esp + 0x14]
mov byte [esp + 0x14c], 3
call fcn.005128e4
mov eax, dword [0x5ab980]
mov dword [esp + 0x14], eax
push str.KERNEL32.DLL
lea ecx, [esp + 0x24]
push edi
push ecx
mov byte [esp + 0x158], 0xe
call fcn.00512b79
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x150], 0xf
call fcn.00512a1d
lea ecx, [esp + 0x20]
mov byte [esp + 0x14c], 0xe
call fcn.005128e4
lea edx, [esp + 0x14]
mov ecx, ebx
push edx
call fcn.0042b970
mov eax, dword [esp + 0x14]
push 0
push 0x80
push 3
push 0
push 3
push bind
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4939fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x2c], eax
jmp 0x493a25
lea ecx, [esi + 0xbc]
push ecx
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
jne 0x493a1e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x2c], eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x14]
mov byte [esp + 0x14c], 3
call fcn.005128e4
mov edi, dword [esp + 0x18]
test edi, edi
jne 0x493a67
lea edx, [esp + 0x20]
mov dword [esi + 0x764], edi
push edx
push str.UserProfiles
push str.HKEY_LOCAL_MACHINENetworkLogon
call fcn.0041f120
add esp, 0xc
test eax, eax
jle 0x493a71
mov eax, dword [esp + 0x20]
test eax, eax
jbe 0x493a71
mov dword [esi + 0x764], 1
lea ecx, [esi + 0xd0]
call fcn.0051286f
test edi, edi
lea edi, [esi + 0xd8]
push 1
push edi
je 0x493a95
push str.DefaultDomainName
push str.HKEY_LOCAL_MACHINESoftwareMicrosoftWindows_NTCurrentVersionWinlogon
jmp 0x493abd
push str.AuthenticatingAgent
push str.HKEY_LOCAL_MACHINESystemCurrentControlSetServicesMSNP32NetworkProvider
call fcn.0041efa0
mov eax, dword [edi]
add esp, 0x10
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x493ac5
push 1
push edi
push str.Container
push str.HKEY_LOCAL_MACHINESoftwareSecurityProvider
call fcn.0041efa0
add esp, 0x10
mov ecx, edi
call fcn.0050e8af
mov ecx, edi
call fcn.0050e7b8
lea ecx, [esi + 0x768]
push 0
push ecx
lea ecx, [esp + 0x5c]
call fcn.004438a0
lea ecx, [esi + 0x788]
call fcn.0051286f
mov eax, dword [0x5ab980]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x18]
mov bl, 0x11
test eax, eax
mov byte [esp + 0x14c], bl
je 0x493b29
lea edx, [esp + 0x1c]
push 0
push edx
push str.ProfilesDirectory
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersionProfileList
call fcn.0041efa0
add esp, 0x10
jmp 0x493b5b
push str.Profiles_
lea eax, [esp + 0x24]
push ebp
push eax
call fcn.00512b79
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x150], 0x12
call fcn.00512a1d
lea ecx, [esp + 0x20]
mov byte [esp + 0x14c], bl
call fcn.005128e4
push 0xffffffffffffff96
push str.Retrieve_Profile_Directory
call fcn.004227e0
mov ecx, dword [esp + 0x24]
add esp, 8
mov eax, dword [ecx - 8]
test eax, eax
je 0x494741
lea edx, [esp + 0x1c]
push edx
call fcn.0041f9c0
add esp, 4
lea ecx, [esp + 0x14]
push str.ProfilesDir
call fcn.00512952
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x14]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x154], 0x13
call fcn.00495bd0
lea ecx, [esp + 0x14]
mov byte [esp + 0x14c], bl
call fcn.005128e4
mov ecx, esi
call fcn.00496000
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x10]
push edx
call fcn.00512a1d
push 0xffffffffffffff96
push str.ExpandEnv_Retrieve_Profile_Directory
call fcn.004227e0
add esp, 8
lea eax, [esp + 0x10]
mov ecx, esi
push eax
call fcn.00495d30
test eax, eax
jl 0x494741
push str.ProfilesDirEx
lea ecx, [esp + 0x18]
call fcn.00512952
lea ecx, [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
push edx
mov ecx, esi
mov byte [esp + 0x154], 0x14
call fcn.00495bd0
lea ecx, [esp + 0x14]
mov byte [esp + 0x14c], bl
call fcn.005128e4
push str.ProfilesExDirDOS
lea ecx, [esp + 0x18]
call fcn.00512952
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x154], 0x15
call fcn.00493000
lea ecx, [esp + 0x14]
mov byte [esp + 0x14c], bl
call fcn.005128e4
mov eax, dword [esp + 0x18]
test eax, eax
je 0x493f51
push 0xffffffffffffff95
push str.Retrieve_target_DefaultUserProfile_Directory
call fcn.004227e0
mov eax, dword [esi + 0x2c]
mov edi, 5
add esp, 8
cmp eax, edi
jae 0x493cc2
lea edx, [esp + 0x1c]
push str.Default_User_
lea eax, [esp + 0x24]
push edx
push eax
call fcn.00512b79
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x150], 0x16
call fcn.00512a1d
lea ecx, [esp + 0x20]
mov byte [esp + 0x14c], bl
call fcn.005128e4
jmp 0x493cff
lea ecx, [esp + 0x28]
push 0
push ecx
push str.DefaultUserProfile
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersionProfileList
call fcn.0041efa0
add esp, 0x10
test eax, eax
jle 0x494741
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
push edx
push eax
lea ecx, [esp + 0x18]
push str._s_s_
push ecx
call fcn.0050e6c7
add esp, 0x10
push str.DefUsersDir
lea ecx, [esp + 0x18]
call fcn.00512952
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x154], 0x17
call fcn.00495bd0
lea ecx, [esp + 0x14]
mov byte [esp + 0x14c], bl
call fcn.005128e4
push 0xffffffffffffff93
push str.ExpandEnv_DefaultUserProfile_Directory
call fcn.004227e0
add esp, 8
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call fcn.00495d30
test eax, eax
jl 0x494741
push str.DefUsersDirEx
lea ecx, [esp + 0x18]
call fcn.00512952
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x154], 0x18
call fcn.00495bd0
lea ecx, [esp + 0x14]
mov byte [esp + 0x14c], bl
call fcn.005128e4
push str.DefUsersDirDOS
lea ecx, [esp + 0x18]
call fcn.00512952
lea ecx, [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
push edx
mov ecx, esi
mov byte [esp + 0x154], 0x19
call fcn.00493000
lea ecx, [esp + 0x14]
mov byte [esp + 0x14c], bl
call fcn.005128e4
push 0xffffffffffffff94
push str.Retrieve_target_AllUsersProfile_Directory
call fcn.004227e0
mov eax, dword [esi + 0x2c]
add esp, 8
cmp eax, edi
jae 0x493e15
lea eax, [esp + 0x1c]
push str.All_Users_
lea ecx, [esp + 0x24]
push eax
push ecx
call fcn.00512b79
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x150], 0x1a
call fcn.00512a1d
lea ecx, [esp + 0x20]
mov byte [esp + 0x14c], bl
call fcn.005128e4
jmp 0x493e52
lea edx, [esp + 0x28]
push 0
push edx
push str.AllUsersProfile
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows_NTCurrentVersionProfileList
call fcn.0041efa0
add esp, 0x10
test eax, eax
jle 0x494741
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x1c]
push eax
push ecx
lea edx, [esp + 0x18]
push str._s_s_
push edx
call fcn.0050e6c7
add esp, 0x10
push str.AllUsersDir
lea ecx, [esp + 0x18]
call fcn.00512952
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x154], 0x1b
call fcn.00495bd0
lea ecx, [esp + 0x14]
mov byte [esp + 0x14c], bl
call fcn.005128e4
push 0xffffffffffffff93
push str.ExpandEnv_AllUsersProfile_Directory
call fcn.004227e0
add esp, 8
lea edx, [esp + 0x10]
mov ecx, esi
push edx
call fcn.00495d30
test eax, eax
jl 0x494741
push str.AllUsersDirEx
lea ecx, [esp + 0x18]
call fcn.00512952
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x154], 0x1c
call fcn.00495bd0
lea ecx, [esp + 0x14]
mov byte [esp + 0x14c], bl
call fcn.005128e4
push str._ALLUSERSPROFILE_
lea ecx, [esp + 0x18]
call fcn.00512952
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x154], 0x1d
call fcn.00495bd0
lea ecx, [esp + 0x14]
mov byte [esp + 0x14c], bl
call fcn.005128e4
push str.AllUsersDirDOS
lea ecx, [esp + 0x18]
call fcn.00512952
lea ecx, [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
push edx
mov ecx, esi
mov byte [esp + 0x154], 0x1e
call fcn.00493000
lea ecx, [esp + 0x14]
mov byte [esp + 0x14c], bl
call fcn.005128e4
lea eax, [esp + 0x10]
push 1
push eax
push str.Common_Start_Menu
push str.HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionexplorerShell_Folders
call fcn.0041efa0
mov ecx, dword [esp + 0x20]
add esp, 0x10
mov eax, dword [ecx - 8]
test eax, eax
jne 0x494028
push str.AllUsersDirEx
lea ecx, [esp + 0x18]
call fcn.00512952
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x154], 0x1f
call fcn.00495ca0
lea ecx, [esp + 0x14]
mov byte [esp + 0x14c], bl
call fcn.005128e4
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx - 8]
test eax, eax
je 0x493fee
lea edx, [esp + 0x10]
push str.Start_Menu
lea eax, [esp + 0x24]
push edx
push eax
call fcn.00512b79
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x150], 0x20
call fcn.00512a1d
mov byte [esp + 0x14c], bl
lea ecx, [esp + 0x20]
jmp 0x494023
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x494028
push str.Start_Menu
lea ecx, [esp + 0x24]
push ebp
push ecx
call fcn.00512b79
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x150], 0x21
call fcn.00512a1d
mov byte [esp + 0x14c], bl
lea ecx, [esp + 0x20]
call fcn.005128e4
lea edx, [esp + 0x10]
push edx
call fcn.0041f9c0
add esp, 4
lea ecx, [esp + 0x18]
push str.CommonStartMenuEx
call fcn.00512952
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x154], 0x22
call fcn.00495bd0
lea ecx, [esp + 0x18]
mov byte [esp + 0x14c], bl
call fcn.005128e4
lea edx, [esp + 0x10]
push 1
push edx
push str.CommonFilesDir
push str.HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersion
call fcn.0041efa0
mov eax, dword [esp + 0x20]
add esp, 0x10
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x49409e
push str.C:Program_FilesCommon_Files_
lea ecx, [esp + 0x14]
call fcn.00512a6d
lea ecx, [esp + 0x10]
push ecx
call fcn.0041f9c0
add esp, 4
lea ecx, [esp + 0x18]
push str.CommonFilesDirEx
call fcn.00512952
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x154], 0x23
call fcn.00495bd0
lea ecx, [esp + 0x18]
mov byte [esp + 0x14c], bl
call fcn.005128e4
push str._CommonProgramFiles_
lea ecx, [esp + 0x1c]
call fcn.00512952
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
push edx
mov ecx, esi
mov byte [esp + 0x154], 0x24
call fcn.00495bd0
lea ecx, [esp + 0x18]
mov byte [esp + 0x14c], bl
call fcn.005128e4
push str.CommonFilesDirDOS
lea ecx, [esp + 0x1c]
call fcn.00512952
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x154], 0x25
call fcn.00493000
lea ecx, [esp + 0x18]
mov byte [esp + 0x14c], bl
call fcn.005128e4
lea edx, [esp + 0x10]
push 1
push edx
push str.ProgramFilesDir
push str.HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersion
call fcn.0041efa0
mov eax, dword [esp + 0x20]
add esp, 0x10
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x494182
push str.C:Program_Files_
lea ecx, [esp + 0x14]
call fcn.00512a6d
lea ecx, [esp + 0x10]
push ecx
call fcn.0041f9c0
add esp, 4
lea ecx, [esp + 0x18]
push str.ProgramFilesDirEx
call fcn.00512952
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x154], 0x26
call fcn.00495bd0
lea ecx, [esp + 0x18]
mov byte [esp + 0x14c], bl
call fcn.005128e4
push str._ProgramFiles_
lea ecx, [esp + 0x1c]
call fcn.00512952
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
push edx
mov ecx, esi
mov byte [esp + 0x154], 0x27
call fcn.00495bd0
lea ecx, [esp + 0x18]
mov byte [esp + 0x14c], bl
call fcn.005128e4
push str.ProgramFilesDirDOS
lea ecx, [esp + 0x1c]
call fcn.00512952
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x154], 0x28
call fcn.00493000
lea ecx, [esp + 0x18]
mov byte [esp + 0x14c], bl
call fcn.005128e4
lea edx, [esp + 0x54]
mov ecx, esi
push edx
call fcn.0044b8b0
mov ecx, esi
call fcn.00496000
push 0x48
call fcn.00516a15
add esp, 4
mov dword [esp + 0x20], eax
test eax, eax
mov byte [esp + 0x14c], 0x29
je 0x49426a
mov ecx, eax
call fcn.0048f870
jmp 0x49426c
xor eax, eax
lea edi, [esi + 0x7e0]
push eax
mov ecx, edi
mov byte [esp + 0x150], bl
call fcn.0048bae0
push 0x38
call fcn.00516a15
add esp, 4
mov dword [esp + 0x20], eax
test eax, eax
mov byte [esp + 0x14c], 0x2a
je 0x4942a4
mov ecx, eax
call fcn.0048d970
jmp 0x4942a6
xor eax, eax
push eax
mov ecx, edi
mov byte [esp + 0x150], bl
call fcn.0048bae0
push 1
push esi
push ecx
mov ecx, esp
mov dword [esp + 0x2c], esp
push 0x5b0738
call fcn.00512952
lea ecx, [esi + 0xe8]
call fcn.004c4c00
push 1
push esi
lea ecx, [esi + 0x744]
call fcn.004c5740
mov eax, dword [esi + 0x760]
push str.msi.dll
mov dword [esi + 0x764], eax
lea eax, [esi + 0xe4]
lea ecx, [esp + 0x1c]
push eax
push ecx
call fcn.00512b79
lea edx, [esp + 0x20]
push eax
push edx
lea ecx, [esi + 0x8e4]
mov byte [esp + 0x154], 0x2b
call fcn.0042ba10
mov eax, dword [eax]
mov byte [esp + 0x14c], 0x2c
push eax
call fcn.00421e30
add esp, 4
mov dword [esi + 0x838], eax
lea ecx, [esp + 0x20]
mov dword [esi + 0x83c], edx
mov byte [esp + 0x14c], 0x2b
call fcn.005128e4
lea ecx, [esp + 0x18]
mov byte [esp + 0x14c], bl
call fcn.005128e4
lea ebp, [esi + 0x85c]
mov ecx, esi
push ebp
push str.IEXPLORE.EXE
call fcn.00448560
push str.IEXPLORE.EXE
mov ecx, ebp
call fcn.00444d30
mov edi, eax
test edi, edi
jne 0x494394
push str.IEXPLORE.EXE
mov ecx, ebp
call fcn.00444cd0
mov edi, eax
test edi, edi
je 0x494405
mov eax, dword [0x5ab980]
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x18]
push 0
push ecx
push str.Version
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet_Explorer
mov byte [esp + 0x15c], 0x2d
call fcn.0041efa0
add esp, 0x10
test eax, eax
jle 0x4943f5
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x20]
push edx
push eax
call fcn.00422fb0
add esp, 8
cmp eax, 2
jne 0x4943f5
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
test eax, eax
ja 0x4943e9
test ecx, ecx
jbe 0x4943f5
mov dword [edi + 0x28], ecx
mov dword [edi + 0x30], ecx
mov dword [edi + 0x2c], eax
mov dword [edi + 0x34], eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x14c], bl
call fcn.005128e4
mov eax, dword [esp + 0x158]
test eax, eax
jne 0x4945c4
lea ecx, [esp + 0x64]
call fcn.00466340
mov ecx, dword [0x5b0ab8]
mov byte [esp + 0x14c], 0x2e
test ecx, ecx
mov dword [esp + 0x18], 0
je 0x49445a
mov edx, dword [ecx]
lea eax, [esp + 0x64]
push eax
push str.Auto.ScanMode
call dword [edx]
test eax, eax
jle 0x49445a
mov eax, dword [esp + 0x74]
cmp eax, 0x14
mov dword [esp + 0x18], eax
jge 0x4945b4
push 0xfffffed3
push 0x4f52
call fcn.00422800
mov edi, dword [esp + 0x15c]
add esp, 8
mov ecx, esi
push edi
push ebp
call fcn.00448300
mov ebp, eax
test ebp, ebp
jg 0x494509
lea ecx, [esp + 0x64]
mov byte [esp + 0x14c], bl
call fcn.004663b0
lea ecx, [esp + 0x28]
mov byte [esp + 0x14c], 0x10
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x14c], 3
call fcn.005128e4
lea ecx, [esp + 0x30]
mov byte [esp + 0x14c], 2
call fcn.0042bb60
lea ecx, [esp + 0x7c]
mov byte [esp + 0x14c], 1
call fcn.00486260
lea ecx, [esp + 0xcc]
mov byte [esp + 0x14c], 0
call fcn.00486260
lea ecx, [esp + 0x10]
mov dword [esp + 0x14c], 0xffffffff
call fcn.005128e4
mov eax, ebp
jmp 0x4947b0
mov ecx, dword [esp + 0x18]
push ecx
push edi
mov ecx, esi
call fcn.00449850
mov edi, eax
test edi, edi
jge 0x4945b4
cmp edi, 0xfffffc19
jne 0x494531
push eax
call fcn.004227c0
add esp, 4
lea ecx, [esp + 0x64]
mov byte [esp + 0x14c], bl
call fcn.004663b0
lea ecx, [esp + 0x28]
mov byte [esp + 0x14c], 0x10
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x14c], 3
call fcn.005128e4
lea ecx, [esp + 0x30]
mov byte [esp + 0x14c], 2
call fcn.0042bb60
lea ecx, [esp + 0x7c]
mov byte [esp + 0x14c], 1
call fcn.00486260
lea ecx, [esp + 0xcc]
mov byte [esp + 0x14c], 0
call fcn.00486260
lea ecx, [esp + 0x10]
mov dword [esp + 0x14c], 0xffffffff
call fcn.005128e4
mov eax, edi
jmp 0x4947b0
lea ecx, [esp + 0x64]
mov byte [esp + 0x14c], bl
call fcn.004663b0
push 0xfffffec0
push 0x4f58
call fcn.00422800
mov edi, dword [esi + 0x7e4]
add esp, 8
test edi, edi
je 0x49461e
mov eax, edi
mov edi, dword [edi]
push str.HKEY_LOCAL_MACHINE
lea ecx, [esp + 0x1c]
mov ebp, dword [eax + 8]
call fcn.00512952
mov edx, dword [ebp]
lea eax, [esp + 0x18]
push eax
mov ecx, ebp
mov byte [esp + 0x150], 0x2f
call dword [edx + 0x14]
lea ecx, [esp + 0x18]
mov byte [esp + 0x14c], bl
call fcn.005128e4
test edi, edi
jne 0x4945e0
lea ecx, [esp + 0x11c]
call fcn.004436d0
mov ecx, dword [0x5ab980]
mov dword [esp + 0x50], ecx
push 0
lea edx, [esp + 0x30]
push 0
lea eax, [esp + 0x124]
push edx
push eax
push str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionSharedDLLs
lea ecx, [esp + 0x68]
mov byte [esp + 0x160], 0x31
call fcn.00444400
mov edi, dword [esp + 0x120]
test edi, edi
je 0x49468c
mov eax, edi
mov edi, dword [edi]
mov eax, dword [eax + 8]
cmp byte [eax + 4], 1
jne 0x494688
cmp dword [eax + 0x10], 1
jbe 0x494688
add eax, 8
lea ecx, [esi + 0x7fc]
push eax
call fcn.00510fd7
test edi, edi
jne 0x494666
push 0
lea ecx, [esp + 0x30]
push 0
add esi, 0x878
push ecx
push esi
push str.HKEY_LOCAL_MACHINESystemCurrentControlSetControlVMM32Files
lea ecx, [esp + 0x68]
call fcn.00444400
lea ecx, [esp + 0x50]
mov byte [esp + 0x14c], 0x30
call fcn.005128e4
lea ecx, [esp + 0x11c]
mov byte [esp + 0x14c], bl
call fcn.00443720
lea ecx, [esp + 0x28]
mov byte [esp + 0x14c], 0x10
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x14c], 3
call fcn.005128e4
lea ecx, [esp + 0x30]
mov byte [esp + 0x14c], 2
call fcn.0042bb60
lea ecx, [esp + 0x7c]
mov byte [esp + 0x14c], 1
call fcn.00486260
lea ecx, [esp + 0xcc]
mov byte [esp + 0x14c], 0
call fcn.00486260
lea ecx, [esp + 0x10]
mov dword [esp + 0x14c], 0xffffffff
call fcn.005128e4
mov eax, 1
jmp 0x4947b0
lea ecx, [esp + 0x28]
mov byte [esp + 0x14c], 0x10
call fcn.005128e4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x14c], 3
call fcn.005128e4
lea ecx, [esp + 0x30]
mov byte [esp + 0x14c], 2
call fcn.0042bb60
lea ecx, [esp + 0x7c]
mov byte [esp + 0x14c], 1
call fcn.00486260
lea ecx, [esp + 0xcc]
mov byte [esp + 0x14c], 0
call fcn.00486260
lea ecx, [esp + 0x10]
mov dword [esp + 0x14c], 0xffffffff
call fcn.005128e4
or eax, 0xffffffff
mov ecx, dword [esp + 0x144]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x140
ret 8