Function at 0x401000
Capabilities:
Delete file
Get common file path
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2ab8
call fcn.00401d20
mov eax, dword [0x40d320]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x45c], 0
mov dword [ebp - 0x1484], 0
mov dword [ebp - 0x27a4], 0
mov dword [ebp - 0x354], 0x20006
mov dword [ebp - 0x460], 0
mov dword [ebp - 0x28b4], 0
mov dword [ebp - 0x110], 1
mov dword [ebp - 0x27b0], 0x200
mov dword [ebp - 0x27ac], 0
mov dword [ebp - 0x269c], 0
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0x27a8], 0
push section..data
lea eax, [ebp - 0x1070]
push eax
call fcn.00401b50
add esp, 8
push 0x40d02c
lea ecx, [ebp - 0xa60]
push ecx
call fcn.00401b50
add esp, 8
push 0x40d04c
lea edx, [ebp - 0x860]
push edx
call fcn.00401b50
add esp, 8
push 0x40d058
lea eax, [ebp - 0x660]
push eax
call fcn.00401b50
add esp, 8
push 0x40d094
lea ecx, [ebp - 0x2598]
push ecx
call fcn.00401b50
add esp, 8
push 0x40d0a0
lea edx, [ebp - 0x1490]
push edx
call fcn.00401b50
add esp, 8
push 0x40d0a4
lea eax, [ebp - 0x2498]
push eax
call fcn.00401b50
add esp, 8
push 0x40d0bc
lea ecx, [ebp - 0x1590]
push ecx
call fcn.00401b50
add esp, 8
push 0x40d0c4
lea edx, [ebp - 0x458]
push edx
call fcn.00401b50
add esp, 8
push 0x40d0d0
lea eax, [ebp - 0xe6c]
push eax
call fcn.00401b50
add esp, 8
push 0x40d0d4
lea ecx, [ebp - 0x28b0]
push ecx
call fcn.00401b50
add esp, 8
lea edx, [ebp - 0x1380]
push edx
mov eax, dword [ebp - 0x27b0]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 0x27ac], eax
cmp dword [ebp - 0x27ac], 0
jne 0x40119b
push 0x40d0dc
call fcn.00401c48
add esp, 4
lea ecx, [ebp - 0x1380]
push ecx
lea edx, [ebp - 0x2398]
push edx
call fcn.00401b50
add esp, 8
push 0x40d118
lea eax, [ebp - 0x2398]
push eax
call fcn.00401b60
add esp, 8
push 0x40d128
lea ecx, [ebp - 0x27a0]
push ecx
call fcn.00401b50
add esp, 8
push 0x40d138
lea edx, [ebp - 0x1180]
push edx
call fcn.00401b50
add esp, 8
push 0x40d140
lea eax, [ebp - 0x2698]
push eax
call fcn.00401b50
add esp, 8
push 0x40d14c
lea ecx, [ebp - 0x1994]
push ecx
call fcn.00401b50
add esp, 8
push 0x40d150
lea edx, [ebp - 0x1480]
push edx
call fcn.00401b50
add esp, 8
lea eax, [ebp - 0x1380]
push eax
lea ecx, [ebp - 0x108]
push ecx
call fcn.00401b50
add esp, 8
push 0x40d158
lea edx, [ebp - 0x108]
push edx
call fcn.00401b60
add esp, 8
push 0x40d168
lea eax, [ebp - 0x210]
push eax
call fcn.00401b50
add esp, 8
push 0x40d174
lea ecx, [ebp - 0x107c]
push ecx
call fcn.00401b50
add esp, 8
lea edx, [ebp - 0x1380]
push edx
lea eax, [ebp - 0x2198]
push eax
call fcn.00401b50
add esp, 8
push 0x40d178
lea ecx, [ebp - 0x2198]
push ecx
call fcn.00401b60
add esp, 8
lea edx, [ebp - 0x1380]
push edx
lea eax, [ebp - 0x1f98]
push eax
call fcn.00401b50
add esp, 8
push 0x40d184
lea ecx, [ebp - 0x1f98]
push ecx
call fcn.00401b60
add esp, 8
lea edx, [ebp - 0x1380]
push edx
lea eax, [ebp - 0x2ab8]
push eax
call fcn.00401b50
add esp, 8
push 0x40d198
lea ecx, [ebp - 0x2ab8]
push ecx
call fcn.00401b60
add esp, 8
lea edx, [ebp - 0x350]
push edx
lea eax, [ebp - 0x2198]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x28b8], eax
cmp dword [ebp - 0x28b8], 0xffffffff
jne 0x40133e
push 0x40d1ac
call fcn.00401c48
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x269c], eax
xor eax, eax
jmp 0x401966
mov ecx, dword [ebp - 0x28b8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0x28b8], 0
lea edx, [ebp - 0x350]
push edx
lea eax, [ebp - 0x1f98]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x4013a9
lea ecx, [ebp - 0x350]
push ecx
lea edx, [ebp - 0x2ab8]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x4013a9
push 0x40d1e8
call fcn.00401c48
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x269c], eax
xor eax, eax
jmp 0x401966
mov eax, dword [ebp - 0x28b8]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0x28b8], 0
lea ecx, [ebp - 0x460]
push ecx
lea edx, [ebp - 0x45c]
push edx
mov eax, dword [ebp - 0x28b4]
push eax
mov ecx, dword [ebp - 0x354]
push ecx
mov edx, dword [ebp - 0x27a4]
push edx
push 0
push 0
lea eax, [ebp - 0x660]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 0x269c], eax
cmp dword [ebp - 0x269c], 0
je 0x401412
mov dword [ebp - 0x27a8], 1
cmp dword [ebp - 0x460], 2
jne 0x40142f
push 0x40d224
call fcn.00401c48
add esp, 4
xor eax, eax
jmp 0x401966
cmp dword [ebp - 0x460], 1
jne 0x40168a
cmp dword [ebp - 0x27a8], 0
jne 0x401484
push 0xa
lea ecx, [ebp - 0x1490]
push ecx
mov edx, dword [ebp - 0x110]
push edx
push 0
lea eax, [ebp - 0x2598]
push eax
mov ecx, dword [ebp - 0x45c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x269c], eax
cmp dword [ebp - 0x269c], 0
je 0x401484
mov dword [ebp - 0x27a8], 1
cmp dword [ebp - 0x27a8], 0
jne 0x4014cf
push 0x100
lea edx, [ebp - 0x1590]
push edx
mov eax, dword [ebp - 0x110]
push eax
push 0
lea ecx, [ebp - 0x2498]
push ecx
mov edx, dword [ebp - 0x45c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x269c], eax
cmp dword [ebp - 0x269c], 0
je 0x4014cf
mov dword [ebp - 0x27a8], 1
cmp dword [ebp - 0x27a8], 0
jne 0x401517
push 0xa
lea eax, [ebp - 0xe6c]
push eax
mov ecx, dword [ebp - 0x110]
push ecx
push 0
lea edx, [ebp - 0x458]
push edx
mov eax, dword [ebp - 0x45c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x269c], eax
cmp dword [ebp - 0x269c], 0
je 0x401517
mov dword [ebp - 0x27a8], 1
cmp dword [ebp - 0x27a8], 0
jne 0x401562
push 0x200
lea ecx, [ebp - 0x2398]
push ecx
mov edx, dword [ebp - 0x110]
push edx
push 0
lea eax, [ebp - 0x28b0]
push eax
mov ecx, dword [ebp - 0x45c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x269c], eax
cmp dword [ebp - 0x269c], 0
je 0x401562
mov dword [ebp - 0x27a8], 1
cmp dword [ebp - 0x27a8], 0
jne 0x4015ad
push 0x100
lea edx, [ebp - 0x1180]
push edx
mov eax, dword [ebp - 0x110]
push eax
push 0
lea ecx, [ebp - 0x27a0]
push ecx
mov edx, dword [ebp - 0x45c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x269c], eax
cmp dword [ebp - 0x269c], 0
je 0x4015ad
mov dword [ebp - 0x27a8], 1
cmp dword [ebp - 0x27a8], 0
jne 0x4015f5
push 2
lea eax, [ebp - 0x1994]
push eax
mov ecx, dword [ebp - 0x110]
push ecx
push 0
lea edx, [ebp - 0x2698]
push edx
mov eax, dword [ebp - 0x45c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x269c], eax
cmp dword [ebp - 0x269c], 0
je 0x4015f5
mov dword [ebp - 0x27a8], 1
cmp dword [ebp - 0x27a8], 0
jne 0x401640
push 0x100
lea ecx, [ebp - 0x108]
push ecx
mov edx, dword [ebp - 0x110]
push edx
push 0
lea eax, [ebp - 0x1480]
push eax
mov ecx, dword [ebp - 0x45c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x269c], eax
cmp dword [ebp - 0x269c], 0
je 0x401640
mov dword [ebp - 0x27a8], 1
cmp dword [ebp - 0x27a8], 0
jne 0x401688
push 0xa
lea edx, [ebp - 0x107c]
push edx
mov eax, dword [ebp - 0x110]
push eax
push 0
lea ecx, [ebp - 0x210]
push ecx
mov edx, dword [ebp - 0x45c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x269c], eax
cmp dword [ebp - 0x269c], 0
je 0x401688
mov dword [ebp - 0x27a8], 1
jmp 0x40169d
cmp dword [ebp - 0x269c], 0
je 0x40169d
mov dword [ebp - 0x27a8], 1
lea eax, [ebp - 0x460]
push eax
lea ecx, [ebp - 0x1484]
push ecx
mov edx, dword [ebp - 0x28b4]
push edx
mov eax, dword [ebp - 0x354]
push eax
mov ecx, dword [ebp - 0x27a4]
push ecx
push 0
push 0
lea edx, [ebp - 0x1070]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 0x269c], eax
cmp dword [ebp - 0x269c], 0
je 0x4016ef
mov dword [ebp - 0x27a8], 1
push 0x200
lea eax, [ebp - 0x860]
push eax
mov ecx, dword [ebp - 0x110]
push ecx
push 0
lea edx, [ebp - 0xa60]
push edx
mov eax, dword [ebp - 0x1484]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x269c], eax
cmp dword [ebp - 0x269c], 0
je 0x401731
mov dword [ebp - 0x27a8], 1
cmp dword [ebp - 0x269c], 0
je 0x401744
mov dword [ebp - 0x27a8], 1
cmp dword [ebp - 0x27a8], 1
jne 0x40179f
cmp dword [ebp - 0x45c], 0
je 0x40176d
mov ecx, dword [ebp - 0x45c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x45c], 0
cmp dword [ebp - 0x1484], 0
je 0x40178d
mov edx, dword [ebp - 0x1484]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x45c], 0
push 0x40d258
call fcn.00401c48
add esp, 4
jmp 0x401964
cmp dword [ebp - 0x45c], 0
je 0x4017bf
mov eax, dword [ebp - 0x45c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x45c], 0
cmp dword [ebp - 0x1484], 0
je 0x4017df
mov ecx, dword [ebp - 0x1484]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x45c], 0
push 0x40d284
call fcn.00401c48
add esp, 4
mov edx, dword [ebp + 0xc]
cmp dword [edx + 4], 0
je 0x4018bf
push 0x40d2b4
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
push ecx
call fcn.00401afe
add esp, 8
test eax, eax
jne 0x4018bf
lea edx, [ebp - 0x1380]
push edx
lea eax, [ebp - 0xe60]
push eax
call fcn.00401b50
add esp, 8
push 0x40d2b8
lea ecx, [ebp - 0xe60]
push ecx
call fcn.00401b60
add esp, 8
lea edx, [ebp - 0x1380]
push edx
lea eax, [ebp - 0xc60]
push eax
call fcn.00401b50
add esp, 8
push 0x40d2c8
lea ecx, [ebp - 0xc60]
push ecx
call fcn.00401b60
add esp, 8
lea edx, [ebp - 0x1380]
push edx
lea eax, [ebp - 0x1d98]
push eax
call fcn.00401b50
add esp, 8
push 0x40d2d4
lea ecx, [ebp - 0x1d98]
push ecx
call fcn.00401b60
add esp, 8
lea edx, [ebp - 0xe60]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0xc60]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x1d98]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x401964
lea edx, [ebp - 0x1380]
push edx
lea eax, [ebp - 0x1990]
push eax
call fcn.00401b50
add esp, 8
push 0x40d2e8
lea ecx, [ebp - 0x1990]
push ecx
call fcn.00401b60
add esp, 8
lea edx, [ebp - 0x1380]
push edx
lea eax, [ebp - 0x1790]
push eax
call fcn.00401b50
add esp, 8
push 0x40d2f8
lea ecx, [ebp - 0x1790]
push ecx
call fcn.00401b60
add esp, 8
lea edx, [ebp - 0x1380]
push edx
lea eax, [ebp - 0x1b98]
push eax
call fcn.00401b50
add esp, 8
push 0x40d308
lea ecx, [ebp - 0x1b98]
push ecx
call fcn.00401b60
add esp, 8
lea edx, [ebp - 0x1990]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x1790]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x1b98]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401d0d
mov esp, ebp
pop ebp
ret