Function at 0x4074b0
Capabilities:
Delete file
Delete registry value
Get common file path
Persist via run registry key
Read .ini file
Set file attributes

Disassembly:
push 0xffffffffffffffff
mov eax, dword fs:[0]
push 0x42e156
push eax
mov eax, 0x174e4
mov dword fs:[0], esp
call fcn.00413140
mov dl, byte [0x440950]
push ebx
push ebp
push esi
mov dword [esp + 0x10], ecx
push edi
mov ecx, 0x1fff
xor eax, eax
lea edi, [esp + 0x451]
mov byte [esp + 0x450], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x1fff
xor eax, eax
lea edi, [esp + 0xf4f5]
mov byte [esp + 0xf4f4], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x249]
mov byte [esp + 0x248], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x145]
mov byte [esp + 0x144], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x34d]
mov byte [esp + 0x34c], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x34c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 0x34c]
lea edx, [esp + 0x144]
push ecx
push 0x43c54c
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [esp + 0x17510]
add esp, 0xc
lea eax, [esp + 0x248]
push 0x104
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea edx, [esp + 0x144]
lea eax, [esp + 0x450]
push edx
push 0x7fff
push eax
push 0x43c564
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
mov al, byte [esp + 0x450]
lea esi, [esp + 0x450]
test al, al
lea ebx, [esp + 0xf4f4]
je 0x407666
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenA]
push 0x43c548
call ebp
mov edi, dword [0x44093c]
push eax
push 0x43c548
push esi
call edi
test eax, eax
je 0x40761a
push 0x43c6b8
call ebp
push eax
push 0x43c548
push esi
call edi
test eax, eax
jne 0x407651
push 0x43c6b4
push esi
call dword [0x440938]
lea ecx, [esp + 0x248]
mov edi, eax
push ecx
dec edi
call ebp
test eax, eax
jle 0x407651
lea edx, [esp + 0x248]
push eax
push edx
push edi
call dword [0x44093c]
test eax, eax
jne 0x407651
push esi
call ebp
inc eax
jmp 0x40765f
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
call ebp
inc eax
add ebx, eax
add esi, eax
cmp byte [esi], 0
jne 0x4075ec
lea eax, [esp + 0x144]
lea ecx, [esp + 0xf4f4]
push eax
push ecx
push 0x43c564
mov byte [ebx], 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionA]
lea edx, [esp + 0x144]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x10]
push ecx
lea esi, [eax + 0xd0]
mov ecx, esi
call fcn.00403bb0
mov eax, dword [eax]
mov ebp, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x20
push eax
call ebp
lea ecx, [esp + 0x10]
call fcn.00422a0b
lea edx, [esp + 0x10]
mov ecx, esi
push edx
call fcn.00403bb0
mov eax, dword [eax]
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push eax
call ebx
lea ecx, [esp + 0x10]
call fcn.00422a0b
mov al, byte [0x440950]
mov ecx, 0x40
mov byte [esp + 0x40], al
xor eax, eax
lea edi, [esp + 0x41]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
stosb byte es:[edi], al
call fcn.00403b90
mov edx, dword [eax]
lea eax, [esp + 0x40]
push edx
push 0x43c6a4
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [esp + 0x10]
call fcn.00422a0b
lea ecx, [esp + 0x24]
call fcn.0040ad1b
lea ecx, [esp + 0x40]
push 0
push ecx
lea ecx, [esp + 0x2c]
mov dword [esp + 0x17504], 0
call fcn.0040adde
lea ecx, [esp + 0x24]
mov edi, eax
call fcn.0040ad94
test edi, edi
je 0x407871
lea ecx, [esp + 0x8450]
call fcn.004017a0
lea edx, [esp + 0x40]
lea ecx, [esp + 0x8450]
push edx
mov byte [esp + 0x17500], 1
call fcn.00401880
lea eax, [esp + 0x20]
lea ecx, [esp + 0x18]
push eax
push ecx
push 0x43c3e8
push 0x43c3d0
lea ecx, [esp + 0x8460]
call fcn.00401920
xor edi, edi
cmp eax, edi
je 0x4077f6
mov eax, dword [esp + 0x18]
mov dword [esp + 0x10], edi
cmp dword [eax], edi
jle 0x4077e9
mov edx, dword [edi + eax + 0x18c]
push 0x20
push edx
call ebp
mov eax, dword [esp + 0x18]
mov ecx, dword [edi + eax + 0x18c]
push ecx
call ebx
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
inc ecx
add edi, 0x30c
mov edx, dword [eax]
mov dword [esp + 0x10], ecx
cmp ecx, edx
jl 0x4077b6
push eax
lea ecx, [esp + 0x8454]
call fcn.00401ca0
lea ecx, [esp + 0x8450]
call fcn.004018e0
lea edx, [esp + 0x40]
push 0x20
push edx
call ebp
lea eax, [esp + 0x40]
push eax
call ebx
lea ecx, [esp + 0x14]
push ecx
push 2
push 0
push 0x43c5b8
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40785d
lea edx, [esp + 0x1c]
mov ecx, esi
push edx
call fcn.00403ae0
mov eax, dword [eax]
push eax
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
lea ecx, [esp + 0x1c]
call fcn.00422a0b
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x8450]
mov byte [esp + 0x174fc], 0
call fcn.00401820
lea ecx, [esp + 0x24]
mov dword [esp + 0x174fc], 0xffffffff
call fcn.0040ad58
mov ecx, dword [esp + 0x174f4]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x174f0
ret 4