Function at 0x42c770
Capabilities:
Create process on windows
Query or enumerate registry value
Read .ini file
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4921e9
mov eax, dword fs:[0]
push eax
sub esp, 0x4ac
mov eax, dword [0x4b9430]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x49c]
push eax
lea ecx, [ebp - 0x494]
push ecx
lea edx, [ebp - 0x490]
push edx
push str.checkupdate
push str.SoftwareAdbyby
mov edi, 4
xor ebx, ebx
push reloc.WS2_32.dll_accept
mov dword [ebp - 0x490], edi
mov dword [ebp - 0x494], ebx
mov dword [ebp - 0x49c], edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
cmp eax, ebx
je 0x42c7e9
xor esi, esi
jmp 0x42c7ef
mov esi, dword [ebp - 0x494]
push ebx
call fcn.0045ec8e
mov ecx, eax
sub eax, esi
cdq
xor eax, edx
sub eax, edx
add esp, 4
cmp eax, 0x2a30
jl 0x42c993
push edi
lea eax, [ebp - 0x49c]
push eax
push edi
push str.checkupdate
push str.SoftwareAdbyby
push reloc.WS2_32.dll_accept
mov dword [ebp - 0x49c], ecx
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
push 0x104
lea ecx, [ebp - 0x117]
push ebx
push ecx
mov dword [ebp - 0x490], ebx
mov byte [ebp - 0x118], bl
call fcn.00463ac0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x118]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x118]
push 0x5c
push eax
call fcn.0045e830
mov byte [eax], bl
mov edi, 0xf
lea eax, [ebp - 0x118]
add esp, 8
mov dword [ebp - 0x45c], edi
mov dword [ebp - 0x460], ebx
mov byte [ebp - 0x470], bl
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x42c897
sub eax, esi
push eax
lea ecx, [ebp - 0x118]
push ecx
lea ecx, [ebp - 0x470]
call fcn.00405560
lea eax, [ebp - 0x118]
mov dword [ebp - 4], ebx
dec eax
lea ecx, [ecx]
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x42c8c0
mov edx, dword [str._adhook.ini]
mov ecx, dword [0x4ab8f8]
mov dword [eax], edx
mov edx, dword [0x4ab8fc]
mov dword [eax + 4], ecx
push 0x105
mov dword [eax + 8], edx
lea eax, [ebp - 0x288]
push ebx
push eax
call fcn.00463ac0
add esp, 0xc
lea ecx, [ebp - 0x118]
push ecx
push 0x104
lea edx, [ebp - 0x288]
push edx
push str.lazy_video
push str.rule
push str.update
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebp - 0x424], edi
mov dword [ebp - 0x428], ebx
mov byte [ebp - 0x438], bl
lea edx, [ebp - 0x438]
mov ecx, str.http:__update.adbyby.com_update3.js
mov byte [ebp - 4], 1
call fcn.0042c030
cmp dword [ebp - 0x428], 0xa
jae 0x42c99a
mov esi, 0x10
cmp dword [ebp - 0x424], esi
jb 0x42c96a
mov eax, dword [ebp - 0x438]
push eax
call fcn.0045d63f
add esp, 4
mov dword [ebp - 0x424], edi
mov dword [ebp - 0x428], ebx
mov byte [ebp - 0x438], bl
cmp dword [ebp - 0x45c], esi
jb 0x42c993
mov ecx, dword [ebp - 0x470]
push ecx
call fcn.0045d63f
add esp, 4
xor eax, eax
jmp 0x42d159
call fcn.0042c2d0
test eax, eax
je 0x42c9ad
mov dword [ebp - 0x490], 1
mov dword [ebp - 0x49c], ebx
mov edi, 0xf
mov dword [ebp - 0x3b4], edi
mov dword [ebp - 0x3b8], ebx
mov byte [ebp - 0x3c8], bl
mov dword [ebp - 0x4b0], ebx
mov dword [ebp - 0x4ac], ebx
mov dword [ebp - 0x4a8], ebx
sub esp, 0x1c
mov ecx, esp
mov byte [ebp - 4], 3
mov dword [ebp - 0x494], esp
push 0xffffffffffffffff
push ebx
lea edx, [ebp - 0x438]
mov dword [ecx + 0x14], edi
mov dword [ecx + 0x10], ebx
push edx
lea esi, [ebp - 0x3c8]
mov byte [ecx], bl
call fcn.00405470
mov ecx, dword [ebp - 0x49c]
call fcn.0042d190
add esp, 0x1c
mov dword [ebp - 0x49c], eax
cmp eax, 0xffffffff
je 0x42d0f7
cmp eax, dword [ebp - 0x428]
ja 0x42d0f7
cmp dword [ebp - 0x3b8], 5
jae 0x42ca5b
cmp dword [ebp - 0x3b4], 0x10
jb 0x42c9b3
mov eax, dword [ebp - 0x3c8]
push eax
call fcn.0045d63f
add esp, 4
jmp 0x42c9b3
mov ecx, dword [ebp - 0x3b4]
mov edx, dword [ebp - 0x3c8]
mov eax, edx
cmp ecx, 0x10
jae 0x42ca74
lea eax, [ebp - 0x3c8]
cmp byte [eax], 0x21
jne 0x42ca90
cmp ecx, 0x10
jb 0x42c9b3
push edx
call fcn.0045d63f
add esp, 4
jmp 0x42c9b3
lea ecx, [ebp - 0x3c8]
push 9
push ecx
lea ecx, [ebp - 0x4b0]
call fcn.0042b800
mov edi, dword [ebp - 0x4ac]
mov esi, dword [ebp - 0x4b0]
mov ecx, edi
sub ecx, esi
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
add esp, 8
cmp eax, 6
je 0x42caec
cmp esi, ebx
je 0x42d0d6
mov eax, esi
call fcn.00405a10
push esi
call fcn.0045d63f
add esp, 4
jmp 0x42d0d6
push 0xffffffffffffffff
push ebx
mov edi, 0xf
push esi
lea ecx, [ebp - 0x400]
mov dword [ebp - 0x3ec], edi
mov dword [ebp - 0x3f0], ebx
mov byte [ebp - 0x400], bl
call fcn.00405470
push 0xffffffffffffffff
mov byte [ebp - 4], 4
lea eax, [esi + 0x1c]
push ebx
push eax
lea ecx, [ebp - 0x41c]
mov dword [ebp - 0x408], edi
mov dword [ebp - 0x40c], ebx
mov byte [ebp - 0x41c], bl
call fcn.00405470
push 0xffffffffffffffff
mov byte [ebp - 4], 5
lea eax, [esi + 0x8c]
push ebx
push eax
lea ecx, [ebp - 0x454]
mov dword [ebp - 0x440], edi
mov dword [ebp - 0x444], ebx
mov byte [ebp - 0x454], bl
call fcn.00405470
lea eax, [esi + 0x38]
mov byte [ebp - 4], 6
cmp dword [eax + 0x14], 0x10
jb 0x42cb74
mov eax, dword [eax]
push eax
call fcn.0045d634
add esp, 4
push 0xffffffffffffffff
push ebx
lea edx, [ebp - 0x470]
push edx
lea ecx, [ebp - 0x3ac]
mov dword [ebp - 0x494], eax
mov dword [ebp - 0x398], edi
mov dword [ebp - 0x39c], ebx
mov byte [ebp - 0x3ac], bl
call fcn.00405470
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x41c]
push eax
lea ecx, [ebp - 0x3ac]
mov byte [ebp - 4], 7
call fcn.00405b60
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x4a0], esp
push 0xffffffffffffffff
push ebx
lea edx, [ebp - 0x3ac]
mov dword [ecx + 0x14], edi
mov dword [ecx + 0x10], ebx
push edx
mov byte [ecx], bl
call fcn.00405470
call fcn.0042d360
mov eax, dword [ebp - 0x3ac]
add esp, 0x1c
cmp dword [ebp - 0x398], 0x10
jae 0x42cc02
lea eax, [ebp - 0x3ac]
push str..txt
push eax
call fcn.0045d4c0
add esp, 8
neg eax
sbb eax, eax
neg eax
je 0x42cce7
lea eax, [ebp - 0x288]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x42cc25
sub eax, edx
je 0x42cce7
cmp dword [ebp - 0x398], 0x10
mov eax, dword [ebp - 0x3ac]
jae 0x42cc49
lea eax, [ebp - 0x3ac]
push 0x5c
push eax
call fcn.0045e830
add esp, 8
cmp eax, ebx
je 0x42cce7
inc eax
lea edx, [ebp - 0x390]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x42cc65
lea eax, [ebp - 0x390]
push 0x2e
push eax
call fcn.0045d560
add esp, 8
cmp eax, ebx
jne 0x42cccb
lea ecx, [ebp - 0x3ac]
call fcn.00405290
lea ecx, [ebp - 0x454]
call fcn.00405290
lea ecx, [ebp - 0x41c]
call fcn.00405290
lea ecx, [ebp - 0x400]
call fcn.00405290
lea esi, [ebp - 0x4b0]
call fcn.00405300
lea ecx, [ebp - 0x3c8]
call fcn.00405290
jmp 0x42c9b3
lea ecx, [ebp - 0x390]
push ecx
lea edx, [ebp - 0x288]
push edx
mov byte [eax], bl
call fcn.0045d4c0
add esp, 8
test eax, eax
je 0x42cc84
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x3ac]
push eax
lea ecx, [ebp - 0x3e4]
mov dword [ebp - 0x3d0], edi
mov dword [ebp - 0x3d4], ebx
mov byte [ebp - 0x3e4], bl
call fcn.00405470
mov byte [ebp - 4], 8
cmp dword [ebp - 0x494], ebx
jne 0x42cd47
lea ecx, [ebp - 0x400]
push ecx
lea ecx, [ebp - 0x3ac]
call fcn.0042c180
add esp, 4
test eax, eax
jne 0x42cf0c
lea ecx, [ebp - 0x3e4]
call fcn.00405290
jmp 0x42cc84
mov eax, dword [ebp - 0x3ac]
mov edi, 0x10
cmp dword [ebp - 0x398], edi
jae 0x42cd60
lea eax, [ebp - 0x3ac]
push str..exe
push eax
call fcn.0045d4c0
add esp, 8
test eax, eax
jne 0x42cd98
mov eax, dword [ebp - 0x3ac]
cmp dword [ebp - 0x398], edi
jae 0x42cd86
lea eax, [ebp - 0x3ac]
push 0x4b25f8
push eax
call fcn.0045d4c0
add esp, 8
test eax, eax
je 0x42cdf1
mov ecx, dword [ebp - 0x3ac]
cmp dword [ebp - 0x398], edi
jae 0x42cdac
lea ecx, [ebp - 0x3ac]
lea esi, [ebp - 0x48c]
call fcn.00434f20
mov ecx, eax
lea eax, [ebp - 0x454]
mov byte [ebp - 4], 9
call fcn.0042daf0
mov ecx, esi
mov byte [ebp - 0x495], al
mov byte [ebp - 4], 8
call fcn.00405290
cmp byte [ebp - 0x495], bl
je 0x42ce22
lea ecx, [ebp - 0x3e4]
call fcn.00405290
jmp 0x42cc84
mov eax, dword [ebp - 0x3ac]
cmp dword [ebp - 0x398], edi
jae 0x42ce05
lea eax, [ebp - 0x3ac]
call fcn.004357e0
cmp eax, dword [ebp - 0x494]
jne 0x42ce22
lea ecx, [ebp - 0x3e4]
call fcn.00405290
jmp 0x42cc84
push 4
push str..bak
lea ecx, [ebp - 0x3e4]
call fcn.004057b0
mov eax, dword [ebp - 0x3e4]
push ebx
cmp dword [ebp - 0x3d0], edi
jae 0x42ce49
lea eax, [ebp - 0x3e4]
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x4a0], esp
push eax
call fcn.00405250
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0x400]
cmp dword [ebp - 0x3ec], edi
jae 0x42ce72
lea eax, [ebp - 0x400]
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x4b4], esp
push eax
call fcn.00405250
mov byte [ebp - 4], 8
call fcn.0042be90
add esp, 0x3c
cmp eax, ebx
jne 0x42cea3
lea ecx, [ebp - 0x3e4]
call fcn.00405290
jmp 0x42cc84
mov eax, dword [ebp - 0x3e4]
cmp dword [ebp - 0x3d0], edi
jae 0x42ceb7
lea eax, [ebp - 0x3e4]
call fcn.004357e0
cmp eax, dword [ebp - 0x494]
je 0x42ced4
lea ecx, [ebp - 0x3e4]
call fcn.00405290
jmp 0x42cc84
mov esi, dword [ebp - 0x3ac]
cmp dword [ebp - 0x398], edi
jae 0x42cee8
lea esi, [ebp - 0x3ac]
cmp dword [ebp - 0x3d0], edi
mov edi, dword [ebp - 0x3e4]
jae 0x42cefc
lea edi, [ebp - 0x3e4]
call fcn.0042d2b0
mov esi, dword [ebp - 0x4b0]
mov edi, 0xf
add esi, 0x54
mov eax, esi
call fcn.0042db50
test al, al
je case.default.0x42cf39
mov ecx, 0x10
cmp dword [esi + 0x14], ecx
jb 0x42cf2a
mov esi, dword [esi]
movsx eax, byte [esi]
add eax, 0xffffffcf
cmp eax, 4
ja case.default.0x42cf39
jmp dword [eax*4 + 0x42d178]
mov esi, str.restime
call fcn.0042c5f0
test eax, eax
je case.default.0x42cf39
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea edx, [ebp - 0x180]
push str.__waitpid_d
push edx
call fcn.0045fdbb
mov eax, dword [ebp - 0x3ac]
add esp, 0xc
cmp dword [ebp - 0x398], 0x10
jae 0x42cf82
lea eax, [ebp - 0x3ac]
push 5
push 0x4ab595
lea ecx, [ebp - 0x180]
push ecx
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push ebx
call fcn.0046039b
mov eax, dword [ebp - 0x3ac]
cmp dword [ebp - 0x398], ecx
jae 0x42cfb7
lea eax, [ebp - 0x3ac]
push 5
push 0x4ab595
push 0x4ab595
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp case.default.0x42cf39
mov eax, dword [ebp - 0x3ac]
cmp dword [ebp - 0x398], ecx
jae 0x42cfe6
lea eax, [ebp - 0x3ac]
push ebx
jmp 0x42cfb9
or dword [ebp - 0x490], 1
jmp case.default.0x42cf39
or dword [ebp - 0x490], 2
cmp dword [ebp - 0x3d0], 0x10
jb 0x42d011
mov edx, dword [ebp - 0x3e4]
push edx
call fcn.0045d63f
add esp, 4
cmp dword [ebp - 0x398], 0x10
mov dword [ebp - 0x3d0], edi
mov dword [ebp - 0x3d4], ebx
mov byte [ebp - 0x3e4], bl
jb 0x42d03b
mov eax, dword [ebp - 0x3ac]
push eax
call fcn.0045d63f
add esp, 4
cmp dword [ebp - 0x440], 0x10
mov dword [ebp - 0x398], edi
mov dword [ebp - 0x39c], ebx
mov byte [ebp - 0x3ac], bl
jb 0x42d065
mov ecx, dword [ebp - 0x454]
push ecx
call fcn.0045d63f
add esp, 4
cmp dword [ebp - 0x408], 0x10
mov dword [ebp - 0x440], edi
mov dword [ebp - 0x444], ebx
mov byte [ebp - 0x454], bl
jb 0x42d08f
mov edx, dword [ebp - 0x41c]
push edx
call fcn.0045d63f
add esp, 4
cmp dword [ebp - 0x3ec], 0x10
mov dword [ebp - 0x408], edi
mov dword [ebp - 0x40c], ebx
mov byte [ebp - 0x41c], bl
jb 0x42d0b9
mov eax, dword [ebp - 0x400]
push eax
call fcn.0045d63f
add esp, 4
lea esi, [ebp - 0x4b0]
mov dword [ebp - 0x3ec], edi
mov dword [ebp - 0x3f0], ebx
mov byte [ebp - 0x400], bl
call fcn.00405300
cmp dword [ebp - 0x3b4], 0x10
jb 0x42c9b3
mov ecx, dword [ebp - 0x3c8]
push ecx
call fcn.0045d63f
add esp, 4
jmp 0x42c9b3
mov esi, 0x10
cmp dword [ebp - 0x3b4], esi
jb 0x42d113
mov edx, dword [ebp - 0x3c8]
push edx
call fcn.0045d63f
add esp, 4
cmp dword [ebp - 0x424], esi
jb 0x42d12a
mov eax, dword [ebp - 0x438]
push eax
call fcn.0045d63f
add esp, 4
mov dword [ebp - 0x424], edi
mov dword [ebp - 0x428], ebx
mov byte [ebp - 0x438], bl
cmp dword [ebp - 0x45c], esi
jb 0x42d153
mov ecx, dword [ebp - 0x470]
push ecx
call fcn.0045d63f
add esp, 4
mov eax, dword [ebp - 0x490]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045d3b4
mov esp, ebp
pop ebp
ret