Function at 0x417c4c
Capabilities:
Contain obfuscated stackstrings
Delete file
Move file
Print debug messages
Set file attributes

Disassembly:
mov eax, 0x44eec4
call fcn.00429dec
sub esp, 0x128
push ebx
push esi
mov esi, ecx
push edi
push 1
mov dword [ebp - 0x24], esi
mov eax, dword [esi + 0x88]
pop ebx
test eax, eax
je 0x417da0
mov eax, dword [esi + 0x84]
mov edi, dword [eax]
cmp edi, eax
je 0x417da0
mov al, byte [ebp - 0x19]
push 0
lea ecx, [ebp - 0x34]
mov byte [ebp - 0x34], al
call fcn.00404e15
mov eax, dword [edi + 8]
and dword [ebp - 4], 0
cmp eax, ebx
jne 0x417cfe
lea eax, [edi + 0xc]
push eax
lea eax, [ebp - 0x114]
push str.regsvr32.exe__s__
push eax
call fcn.00406797
push 0x4629c0
push eax
lea eax, [ebp - 0xe4]
mov byte [ebp - 4], bl
push eax
call fcn.00406636
add esp, 0x18
push dword [0x45164c]
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 2
push 0
push eax
call fcn.00404c92
push ebx
lea ecx, [ebp - 0xe4]
mov byte [ebp - 4], bl
call fcn.00404e15
and byte [ebp - 4], 0
push ebx
lea ecx, [ebp - 0x114]
jmp 0x417d61
cmp eax, 2
jne 0x417d66
lea eax, [edi + 0xc]
push eax
lea eax, [ebp - 0x84]
push str.regsvr32.exe__s__u__
push eax
call fcn.00406797
push 0x4629c0
push eax
lea eax, [ebp - 0x134]
mov byte [ebp - 4], 3
push eax
call fcn.00406636
add esp, 0x18
push dword [0x45164c]
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 4
push 0
push eax
call fcn.00404c92
push ebx
lea ecx, [ebp - 0x134]
mov byte [ebp - 4], 3
call fcn.00404e15
and byte [ebp - 4], 0
push ebx
lea ecx, [ebp - 0x84]
call fcn.00404e15
cmp dword [ebp - 0x2c], 0
je 0x417d85
mov eax, dword [ebp - 0x30]
test eax, eax
jne 0x417d78
mov eax, 0x451648
push 0xffffffffffffffff
push 0
push eax
call fcn.00401993
add esp, 0xc
or dword [ebp - 4], 0xffffffff
push ebx
lea ecx, [ebp - 0x34]
call fcn.00404e15
mov edi, dword [edi]
cmp edi, dword [esi + 0x84]
jne 0x417c85
cmp dword [esi + 0x94], 0
je 0x417db7
lea eax, [esi + 0x8c]
mov ecx, esi
push eax
call fcn.00417b5e
mov eax, dword [esi + 0x7c]
mov edi, 0x4622d0
test eax, eax
je 0x418203
mov ecx, dword [esi + 0x78]
mov eax, dword [ecx]
cmp eax, ecx
mov dword [ebp - 0x10], eax
je 0x418203
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x417de2
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 8]
cmp ecx, ebx
jne 0x417e16
mov eax, dword [eax + 0x10]
test eax, eax
jne 0x417df5
mov eax, 0x451648
push 0x4628d8
push eax
call fcn.0042a53a
pop ecx
test eax, eax
pop ecx
je 0x4181ed
push eax
call fcn.0042a48c
pop ecx
jmp 0x4181ed
cmp ecx, 2
jne 0x4181f0
add eax, 0xc
mov eax, dword [eax + 4]
test eax, eax
jne 0x417e2e
mov eax, 0x451648
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [ebp - 0x10]
add eax, 0xc
mov eax, dword [eax + 4]
test eax, eax
jne 0x417e4c
mov eax, 0x451648
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4181ed
mov eax, dword [ebp - 0x10]
add eax, 0xc
mov eax, dword [eax + 4]
test eax, eax
jne 0x417e6d
mov eax, 0x451648
push eax
lea ecx, [ebp - 0x14]
call fcn.00440eeb
push 0x46c4e8
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 5
call fcn.00440eeb
push dword [ebp - 0x14]
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 6
push str._s_d
push eax
call fcn.0043f76e
mov eax, dword [ebp - 0x18]
add esp, 0xc
lea ecx, [ebp - 0x18]
push dword [eax - 8]
call fcn.004412ad
mov dword [ebp - 0x20], eax
mov al, byte [ebp - 0x19]
push 0
lea ecx, [ebp - 0x34]
mov byte [ebp - 0x34], al
call fcn.00404e15
push dword [ebp - 0x20]
call fcn.00429e10
pop ecx
push eax
lea ecx, [ebp - 0x34]
push dword [ebp - 0x20]
call fcn.004055e7
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 7
call fcn.004412fc
push dword [ebp - 0x18]
push dword [ebp - 0x14]
call fcn.0042bd35
pop ecx
test eax, eax
pop ecx
je 0x41806b
push str._Rename_successful_old_file_name__r_n
call esi
push dword [ebp - 0x14]
call esi
push str._Rename_successful_new_file_name__r_n
call esi
push dword [ebp - 0x18]
call esi
lea eax, [ebp - 0xe4]
push eax
call fcn.004010e3
mov dword [esp], str.Rename_successful_old_file_name
push eax
lea eax, [ebp - 0x114]
mov byte [ebp - 4], 8
push eax
call fcn.00406636
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 9
add ecx, 0xc
push ecx
push eax
lea eax, [ebp - 0x134]
push eax
call fcn.00406711
push edi
push eax
lea eax, [ebp - 0x84]
mov byte [ebp - 4], 0xa
push eax
call fcn.00406636
push eax
mov byte [ebp - 4], 0xb
push dword [0x46c4c4]
call fcn.004010b0
add esp, 0x2c
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 0xa
push ebx
call fcn.00404e15
push ebx
lea ecx, [ebp - 0x134]
mov byte [ebp - 4], 9
call fcn.00404e15
push ebx
lea ecx, [ebp - 0x114]
mov byte [ebp - 4], 8
call fcn.00404e15
push ebx
lea ecx, [ebp - 0xe4]
mov byte [ebp - 4], 7
call fcn.00404e15
lea eax, [ebp - 0xc4]
push eax
call fcn.004010e3
mov dword [esp], str.Rename_successful_new_file_name
push eax
lea eax, [ebp - 0x124]
mov byte [ebp - 4], 0xc
push eax
call fcn.00406636
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0xd
push ecx
push eax
lea eax, [ebp - 0xa4]
push eax
call fcn.00406711
push edi
push eax
lea eax, [ebp - 0x64]
mov byte [ebp - 4], 0xe
push eax
call fcn.00406636
push eax
mov byte [ebp - 4], 0xf
push dword [0x46c4c4]
call fcn.004010b0
add esp, 0x2c
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0xe
push ebx
call fcn.00404e15
push ebx
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 0xd
call fcn.00404e15
push ebx
lea ecx, [ebp - 0x124]
mov byte [ebp - 4], 0xc
call fcn.00404e15
push ebx
lea ecx, [ebp - 0xc4]
mov byte [ebp - 4], 7
call fcn.00404e15
push 4
push 0
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
cmp eax, ebx
jne 0x4181c8
push str._Rename_successful_reboot_delete__r_n
jmp 0x4181c6
push str._Rename_failed_old_file_name__r_n
call esi
push dword [ebp - 0x14]
call esi
push str._Rename_failed_new_file_name__r_n
call esi
push dword [ebp - 0x18]
call esi
lea eax, [ebp - 0xb4]
push eax
call fcn.004010e3
mov dword [esp], str.Rename_failed_old_file_name
push eax
lea eax, [ebp - 0x94]
mov byte [ebp - 4], 0x10
push eax
call fcn.00406636
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 0x11
add ecx, 0xc
push ecx
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.00406711
push edi
push eax
lea eax, [ebp - 0x104]
mov byte [ebp - 4], 0x12
push eax
call fcn.00406636
push eax
mov byte [ebp - 4], 0x13
push dword [0x46c4c4]
call fcn.004010b0
add esp, 0x2c
lea ecx, [ebp - 0x104]
mov byte [ebp - 4], 0x12
push ebx
call fcn.00404e15
push ebx
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 0x11
call fcn.00404e15
push ebx
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 0x10
call fcn.00404e15
push ebx
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 7
call fcn.00404e15
lea eax, [ebp - 0x44]
push eax
call fcn.004010e3
mov dword [esp], str.Rename_failed_new_file_name
push eax
lea eax, [ebp - 0x54]
mov byte [ebp - 4], 0x14
push eax
call fcn.00406636
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x15
push ecx
push eax
lea eax, [ebp - 0xf4]
push eax
call fcn.00406711
push edi
push eax
lea eax, [ebp - 0xd4]
mov byte [ebp - 4], 0x16
push eax
call fcn.00406636
push eax
mov byte [ebp - 4], 0x17
push dword [0x46c4c4]
call fcn.004010b0
add esp, 0x2c
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 0x16
push ebx
call fcn.00404e15
push ebx
lea ecx, [ebp - 0xf4]
mov byte [ebp - 4], 0x15
call fcn.00404e15
push ebx
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0x14
call fcn.00404e15
push ebx
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 7
call fcn.00404e15
push 4
push 0
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
cmp eax, ebx
jne 0x4181c8
push str._Rename_failed_reboot_delete__r_n
call esi
push ebx
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 6
call fcn.00404e15
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 5
call fcn.00440e7d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00440e7d
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
cmp eax, dword [ecx + 0x78]
jne 0x417ddf
mov esi, ecx
lea eax, [ebp - 0x54]
push eax
call fcn.004010e3
mov dword [esp], 0x464840
push eax
lea eax, [ebp - 0x44]
mov dword [ebp - 4], 0x18
push eax
call fcn.00406636
push eax
mov byte [ebp - 4], 0x19
push dword [0x46c4c4]
call fcn.004010b0
add esp, 0x14
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x18
push ebx
call fcn.00404e15
or dword [ebp - 4], 0xffffffff
push ebx
lea ecx, [ebp - 0x54]
call fcn.00404e15
cmp dword [esi + 0xa0], 0
je 0x418438
mov eax, dword [esi + 0x9c]
mov esi, dword [eax]
cmp esi, eax
je 0x418438
mov eax, dword [esi + 0xc]
test eax, eax
jne 0x41827f
mov edx, 0x451648
mov dword [ebp - 0x20], edx
jmp 0x418287
mov dword [ebp - 0x20], eax
mov edx, 0x451648
mov eax, dword [esi + 0x3c]
mov dword [ebp - 0x14], edx
test eax, eax
je 0x418294
mov dword [ebp - 0x14], eax
mov ecx, dword [esi + 0x2c]
test ecx, ecx
jne 0x41829d
mov ecx, edx
mov eax, dword [esi + 0x1c]
test eax, eax
jne 0x4182a6
mov eax, edx
push dword [ebp - 0x20]
push dword [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea eax, [ebp - 0x124]
push eax
call fcn.004010e3
mov dword [esp], str._Key:
push eax
lea eax, [ebp - 0xc4]
mov dword [ebp - 4], 0x1a
push eax
call fcn.00406636
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 0x1b
push ecx
push eax
lea eax, [ebp - 0x104]
push eax
call fcn.00406711
push str._Name:
push eax
lea eax, [ebp - 0x74]
mov byte [ebp - 4], 0x1c
push eax
call fcn.00406636
lea ecx, [esi + 0x28]
mov byte [ebp - 4], 0x1d
push ecx
push eax
lea eax, [ebp - 0x94]
push eax
call fcn.00406711
push str._Value:
push eax
lea eax, [ebp - 0xb4]
mov byte [ebp - 4], 0x1e
push eax
call fcn.00406636
lea ecx, [esi + 0x38]
mov byte [ebp - 4], 0x1f
push ecx
push eax
lea eax, [ebp - 0xd4]
push eax
call fcn.00406711
add esp, 0x48
push str._File:
push eax
lea eax, [ebp - 0xf4]
mov byte [ebp - 4], 0x20
push eax
call fcn.00406636
lea ecx, [esi + 8]
mov byte [ebp - 4], 0x21
push ecx
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.00406711
push edi
push eax
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 0x22
push eax
call fcn.00406636
push eax
mov byte [ebp - 4], 0x23
push dword [0x46c4c4]
call fcn.004010b0
add esp, 0x2c
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0x22
push ebx
call fcn.00404e15
push ebx
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0x21
call fcn.00404e15
push ebx
lea ecx, [ebp - 0xf4]
mov byte [ebp - 4], 0x20
call fcn.00404e15
push ebx
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 0x1f
call fcn.00404e15
push ebx
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 0x1e
call fcn.00404e15
push ebx
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 0x1d
call fcn.00404e15
push ebx
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 0x1c
call fcn.00404e15
push ebx
lea ecx, [ebp - 0x104]
mov byte [ebp - 4], 0x1b
call fcn.00404e15
push ebx
lea ecx, [ebp - 0xc4]
mov byte [ebp - 4], 0x1a
call fcn.00404e15
or dword [ebp - 4], 0xffffffff
push ebx
lea ecx, [ebp - 0x124]
call fcn.00404e15
mov eax, dword [ebp - 0x24]
mov esi, dword [esi]
cmp esi, dword [eax + 0x9c]
jne 0x41826e
lea eax, [ebp - 0x64]
push eax
call fcn.004010e3
mov dword [esp], 0x46480c
push eax
lea eax, [ebp - 0xa4]
mov dword [ebp - 4], 0x24
push eax
call fcn.00406636
push eax
mov byte [ebp - 4], 0x25
push dword [0x46c4c4]
call fcn.004010b0
add esp, 0x14
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 0x24
push ebx
call fcn.00404e15
or dword [ebp - 4], 0xffffffff
push ebx
lea ecx, [ebp - 0x64]
call fcn.00404e15
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret