Function at 0x4a99c2
Capabilities:
Get common file path
Persist via run registry key
Print debug messages
Query or enumerate registry value
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fa43e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x330
push esi
mov dword [ebp - 0x32c], ecx
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x118]
call fcn.00401900
mov byte [ebp - 4], 1
mov dword [ebp - 0x114], 1
cmp dword [0x524028], 0
jne 0x4a9a1a
mov dword [0x524028], 0x1e
push 0x104
push 0
lea eax, [ebp - 0x110]
push eax
call fcn.004cf390
add esp, 0xc
push 0x80
lea ecx, [ebp + 8]
call fcn.00401920
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x1e
push 0x20
push 0x53a2a8
call fcn.004cf390
add esp, 0xc
lea ecx, [ebp + 8]
call fcn.00401920
push eax
push 0
push 0
push 0x53274c
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
cmp dword [0x539998], 0
je 0x4a9a97
mov dword [0x53a2a8], 1
push 0x532754
push 0x53a2ac
call fcn.004cf9b0
add esp, 8
jmp 0x4a9b5b
mov dword [0x53a2a8], 1
push 0x532764
push 0x53a2ac
call fcn.004cf9b0
add esp, 8
mov dword [0x53a2cc], 2
push 0x532774
push 0x53a2d0
call fcn.004cf9b0
add esp, 8
mov dword [0x53a2f0], 3
push 0x53277c
push 0x53a2f4
call fcn.004cf9b0
add esp, 8
mov dword [0x53a314], 4
mov ecx, 0x53999c
call fcn.00408660
cmp eax, 0x1e
jae 0x4a9b16
mov ecx, 0x53999c
call fcn.00408660
mov dword [ebp - 0x330], eax
jmp 0x4a9b20
mov dword [ebp - 0x330], 0x1d
mov ecx, dword [ebp - 0x330]
push ecx
mov ecx, 0x53999c
call fcn.00401920
push eax
push 0x53a318
call fcn.004cfc80
add esp, 0xc
mov dword [0x53a338], 5
push 0x53278c
push 0x53a33c
call fcn.004cf9b0
add esp, 8
lea ecx, [ebp + 8]
call fcn.00401920
push eax
push 0
push 0
push 0x532790
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
cmp dword [0x539998], 0
je 0x4a9dee
lea ecx, [ebp + 8]
call fcn.00401920
push eax
push 0x532798
push 0x5327a8
push 0x5327ac
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov dword [ebp - 0x11c], 0x100
push 0x5327b4
lea ecx, [ebp - 0x118]
call fcn.004e82b5
lea edx, [ebp - 0x224]
push edx
push 0x20019
push 0
lea ecx, [ebp - 0x118]
call fcn.00401920
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4a9c4f
xor eax, eax
mov ax, word [0x539af6]
test eax, eax
je 0x4a9bf8
push 0x5327f8
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x532814
lea ecx, [ebp - 0x110]
push ecx
call fcn.004cf9b0
add esp, 8
lea ecx, [ebp + 8]
call fcn.00401920
push eax
lea edx, [ebp - 0x110]
push edx
push 0x532824
push 0x53282c
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x118]
call fcn.004e812c
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004e812c
jmp 0x4aa6fb
mov ecx, dword [ebp - 0x32c]
call fcn.004aa70c
cmp eax, 7
jne 0x4a9cc9
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x110]
push ecx
lea edx, [ebp - 0x114]
push edx
push 0
push 0x532834
mov eax, dword [ebp - 0x224]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4a9cc7
xor ecx, ecx
mov cx, word [0x539af6]
test ecx, ecx
je 0x4a9ca4
push 0x532840
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x118]
call fcn.004e812c
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004e812c
jmp 0x4aa6fb
jmp 0x4a9d44
lea edx, [ebp - 0x11c]
push edx
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x114]
push ecx
push 0
push 0x53285c
mov edx, dword [ebp - 0x224]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4a9d30
xor eax, eax
mov ax, word [0x539af6]
test eax, eax
je 0x4a9d0d
push 0x532868
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x118]
call fcn.004e812c
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004e812c
jmp 0x4aa6fb
push 0x532884
lea ecx, [ebp - 0x110]
push ecx
call fcn.004cf9c0
add esp, 8
mov ecx, 0x539854
call fcn.00408660
mov esi, eax
lea edx, [ebp - 0x110]
push edx
call fcn.004cf430
add esp, 4
mov ecx, 0x104
sub ecx, eax
cmp esi, ecx
jae 0x4a9d7c
mov ecx, 0x539854
call fcn.00408660
mov dword [ebp - 0x334], eax
jmp 0x4a9d9b
lea edx, [ebp - 0x110]
push edx
call fcn.004cf430
add esp, 4
mov ecx, 0x104
sub ecx, eax
sub ecx, 1
mov dword [ebp - 0x334], ecx
mov edx, dword [ebp - 0x334]
push edx
mov ecx, 0x539854
call fcn.00401920
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.004d0fc0
add esp, 0xc
lea ecx, [ebp + 8]
call fcn.00401920
push eax
lea ecx, [ebp - 0x110]
push ecx
push 0x532894
push 0x53289c
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov edx, dword [ebp - 0x224]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4aa6c5
lea ecx, [ebp + 8]
call fcn.00401920
push eax
push 0x5328a4
push 0x5328b4
push 0x5328b8
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov dword [ebp - 0x11c], 0x100
push 0x5328c0
lea ecx, [ebp - 0x118]
call fcn.004e82b5
lea eax, [ebp - 0x224]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x118]
call fcn.00401920
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4a9eb2
mov ecx, dword [ebp - 0x11c]
push ecx
lea edx, [ebp - 0x220]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x532900
lea eax, [ebp - 0x220]
push eax
call fcn.004cf9c0
add esp, 8
xor ecx, ecx
mov cx, word [0x539af6]
test ecx, ecx
je 0x4a9ead
lea edx, [ebp - 0x220]
push edx
push 0x532910
lea eax, [ebp - 0x2a4]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [ebp - 0x2a4]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x4a9f4c
lea edx, [ebp - 0x11c]
push edx
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x114]
push ecx
push 0
push 0
mov edx, dword [ebp - 0x224]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4a9f16
xor eax, eax
mov ax, word [0x539af6]
test eax, eax
je 0x4a9ef3
push 0x53292c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x118]
call fcn.004e812c
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004e812c
jmp 0x4aa6fb
xor ecx, ecx
mov cx, word [0x539af6]
test ecx, ecx
je 0x4a9f4c
lea edx, [ebp - 0x220]
push edx
push str._RCP__Scan2PC:_sysPath___s
lea eax, [ebp - 0x324]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [ebp - 0x324]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp - 0x224]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 8]
call fcn.00401920
push eax
lea eax, [ebp - 0x220]
push eax
push str.1.path
push 0x53296c
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
cmp dword [0x524028], 1
jle 0x4aa6c5
lea ecx, [ebp + 8]
call fcn.00401920
push eax
push 0x532974
push 0x53297c
push 0x532980
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea ecx, [ebp + 8]
call fcn.00401920
push eax
push str.c:Email.exe
push str.2.path
push 0x5329a0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
cmp dword [0x524028], 2
jle 0x4aa6c5
lea ecx, [ebp + 8]
call fcn.00401920
push eax
push 0x5329a8
push 0x5329b8
push 0x5329bc
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov dword [ebp - 0x11c], 0x100
push 0x5329c4
lea ecx, [ebp - 0x118]
call fcn.004e82b5
lea ecx, [ebp - 0x224]
push ecx
push 0x20019
push 0
lea ecx, [ebp - 0x118]
call fcn.00401920
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4aa061
xor edx, edx
mov dx, word [0x539af6]
test edx, edx
je 0x4aa048
push 0x532a08
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x53e290
lea eax, [ebp - 0x110]
push eax
call fcn.004cf9b0
add esp, 8
jmp 0x4aa267
mov ecx, dword [ebp - 0x32c]
call fcn.004aa70c
cmp eax, 7
jne 0x4aa171
lea ecx, [ebp - 0x11c]
push ecx
lea edx, [ebp - 0x110]
push edx
lea eax, [ebp - 0x114]
push eax
push 0
push 0x532a24
mov ecx, dword [ebp - 0x224]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4aa0d3
xor edx, edx
mov dx, word [0x539af6]
test edx, edx
je 0x4aa0ba
push 0x532a30
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x53e294
lea eax, [ebp - 0x110]
push eax
call fcn.004cf9b0
add esp, 8
jmp 0x4aa15f
push 0x532a4c
lea ecx, [ebp - 0x110]
push ecx
call fcn.004cf9c0
add esp, 8
mov ecx, 0x539838
call fcn.00408660
mov esi, eax
lea edx, [ebp - 0x110]
push edx
call fcn.004cf430
add esp, 4
mov ecx, 0x104
sub ecx, eax
cmp esi, ecx
jae 0x4aa11f
mov ecx, 0x539838
call fcn.00408660
mov dword [ebp - 0x338], eax
jmp 0x4aa13e
lea edx, [ebp - 0x110]
push edx
call fcn.004cf430
add esp, 4
mov ecx, 0x104
sub ecx, eax
sub ecx, 1
mov dword [ebp - 0x338], ecx
mov edx, dword [ebp - 0x338]
push edx
mov ecx, 0x539838
call fcn.00401920
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.004d0fc0
add esp, 0xc
mov ecx, dword [ebp - 0x224]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4aa267
lea edx, [ebp - 0x11c]
push edx
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x114]
push ecx
push 0
push 0x532a50
mov edx, dword [ebp - 0x224]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4aa1ce
xor eax, eax
mov ax, word [0x539af6]
test eax, eax
je 0x4aa1b5
push 0x532a5c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x53e298
lea ecx, [ebp - 0x110]
push ecx
call fcn.004cf9b0
add esp, 8
jmp 0x4aa25a
push 0x532a78
lea edx, [ebp - 0x110]
push edx
call fcn.004cf9c0
add esp, 8
mov ecx, 0x539838
call fcn.00408660
mov esi, eax
lea eax, [ebp - 0x110]
push eax
call fcn.004cf430
add esp, 4
mov ecx, 0x104
sub ecx, eax
cmp esi, ecx
jae 0x4aa21a
mov ecx, 0x539838
call fcn.00408660
mov dword [ebp - 0x33c], eax
jmp 0x4aa239
lea edx, [ebp - 0x110]
push edx
call fcn.004cf430
add esp, 4
mov ecx, 0x104
sub ecx, eax
sub ecx, 1
mov dword [ebp - 0x33c], ecx
mov edx, dword [ebp - 0x33c]
push edx
mov ecx, 0x539838
call fcn.00401920
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.004d0fc0
add esp, 0xc
mov ecx, dword [ebp - 0x224]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 8]
call fcn.00401920
push eax
lea edx, [ebp - 0x110]
push edx
push str.3.path
push 0x532a90
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
cmp dword [0x524028], 3
jle 0x4aa6c5
push 0x532a98
mov ecx, 0x53999c
call fcn.00401920
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4aa3e0
lea ecx, [ebp + 8]
call fcn.00401920
push eax
push 0x532aa4
push 0x532ab0
push 0x532ab4
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov dword [ebp - 0x11c], 0x100
push 0x532abc
lea ecx, [ebp - 0x118]
call fcn.004e82b5
lea eax, [ebp - 0x224]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x118]
call fcn.00401920
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4aa360
lea ecx, [ebp - 0x11c]
push ecx
lea edx, [ebp - 0x110]
push edx
lea eax, [ebp - 0x114]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x224]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4aa351
push 0x532b00
lea edx, [ebp - 0x110]
push edx
call fcn.004cf9b0
add esp, 8
mov eax, dword [ebp - 0x224]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4aa374
push str.SmarThru.exe
lea ecx, [ebp - 0x110]
push ecx
call fcn.004cf9b0
add esp, 8
lea ecx, [ebp + 8]
call fcn.00401920
push eax
lea edx, [ebp - 0x110]
push edx
push 0x532b20
push 0x532b28
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
cmp dword [0x524028], 4
jle 0x4aa3db
lea ecx, [ebp + 8]
call fcn.00401920
push eax
push 0x532b30
push 0x532b34
push 0x532b38
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea ecx, [ebp + 8]
call fcn.00401920
push eax
lea eax, [ebp - 0x110]
push eax
push 0x532b40
push 0x532b48
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
jmp 0x4aa6c5
push 0x532b50
mov ecx, 0x53999c
call fcn.00401920
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4aa52c
lea ecx, [ebp + 8]
call fcn.00401920
push eax
push 0x532b60
push 0x532b70
push 0x532b74
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov dword [ebp - 0x11c], 0x100
push 0x532b7c
lea ecx, [ebp - 0x118]
call fcn.004e82b5
lea ecx, [ebp - 0x224]
push ecx
push 0x20019
push 0
lea ecx, [ebp - 0x118]
call fcn.00401920
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4aa4ac
lea edx, [ebp - 0x11c]
push edx
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x114]
push ecx
push 0
push 0
mov edx, dword [ebp - 0x224]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4aa49d
push 0x532bc4
lea eax, [ebp - 0x110]
push eax
call fcn.004cf9b0
add esp, 8
mov ecx, dword [ebp - 0x224]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4aa4c0
push str.SmarThru_Office.exe
lea edx, [ebp - 0x110]
push edx
call fcn.004cf9b0
add esp, 8
lea ecx, [ebp + 8]
call fcn.00401920
push eax
lea eax, [ebp - 0x110]
push eax
push 0x532bec
push 0x532bf4
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
cmp dword [0x524028], 4
jle 0x4aa527
lea ecx, [ebp + 8]
call fcn.00401920
push eax
push 0x532bfc
push 0x532c00
push 0x532c04
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea ecx, [ebp + 8]
call fcn.00401920
push eax
lea ecx, [ebp - 0x110]
push ecx
push 0x532c0c
push 0x532c14
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
jmp 0x4aa6c5
mov dword [ebp - 0x328], 0
mov dword [ebp - 0x11c], 0x100
push 0x532c1c
lea ecx, [ebp - 0x118]
call fcn.004e82b5
lea edx, [ebp - 0x224]
push edx
push 0x20019
push 0
lea ecx, [ebp - 0x118]
call fcn.00401920
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4aa629
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x110]
push ecx
lea edx, [ebp - 0x114]
push edx
push 0
push 0x532c60
mov eax, dword [ebp - 0x224]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4aa5be
push 0x532c68
lea ecx, [ebp - 0x110]
push ecx
call fcn.004cf9b0
add esp, 8
mov edx, dword [ebp - 0x224]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x532c78
lea eax, [ebp - 0x110]
push eax
call fcn.004cf9c0
add esp, 8
mov dword [ebp - 0x328], 1
lea ecx, [ebp + 8]
call fcn.00401920
push eax
push 0x532c88
push 0x532c94
push 0x532c98
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea ecx, [ebp + 8]
call fcn.00401920
push eax
lea ecx, [ebp - 0x110]
push ecx
push str.4.path
push 0x532ca8
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
jmp 0x4aa658
mov dword [0x53a314], 0
push 0x1e
push 0
push 0x53a318
call fcn.004cf390
add esp, 0xc
push 0x532cb0
lea edx, [ebp - 0x110]
push edx
call fcn.004cf9b0
add esp, 8
cmp dword [0x524028], 4
jle 0x4aa6c5
cmp dword [ebp - 0x328], 0
je 0x4aa6aa
lea ecx, [ebp + 8]
call fcn.00401920
push eax
push 0x532cc0
push 0x532cc4
push 0x532cc8
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea ecx, [ebp + 8]
call fcn.00401920
push eax
lea eax, [ebp - 0x110]
push eax
push str.5.path
push 0x532cd8
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
jmp 0x4aa6c5
mov dword [0x53a338], 0
push 0x1e
push 0
push 0x53a33c
call fcn.004cf390
add esp, 0xc
xor ecx, ecx
mov cx, word [0x539af6]
test ecx, ecx
je 0x4aa6dd
push str._RCP__Sync_ini_file___completed
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x118]
call fcn.004e812c
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004e812c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4