Function at 0x402910
Capabilities:
Delete file
Delete registry key
Get common file path
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x688
mov eax, dword [0x45602c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
push 0x44331c
push 0x470320
mov dword [0x456a04], 0
call esi
push 0x470320
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.Earthquake3D.exe
lea eax, [ebp - 0x218]
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
jne 0x40298d
inc dword [0x456a04]
push 0x470320
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.Big_Quakes.csv
lea eax, [ebp - 0x218]
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
jne 0x4029c0
inc dword [0x456a04]
push 0x470320
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.Earthquake3D.pdf
lea eax, [ebp - 0x218]
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
jne 0x4029f3
inc dword [0x456a04]
push 0x470320
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.profiles.txt
lea eax, [ebp - 0x218]
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call edi
push 0x470320
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x4452dc
lea eax, [ebp - 0x218]
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
jne 0x402a4f
inc dword [0x456a04]
push 0x470320
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.quake0.wav
lea eax, [ebp - 0x218]
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
jne 0x402a82
inc dword [0x456a04]
push 0x470320
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.quake1.wav
lea eax, [ebp - 0x218]
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
jne 0x402ab5
inc dword [0x456a04]
push 0x470320
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.quake2.wav
lea eax, [ebp - 0x218]
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
jne 0x402ae8
inc dword [0x456a04]
push 0x470320
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.quake3.wav
lea eax, [ebp - 0x218]
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
jne 0x402b1b
inc dword [0x456a04]
push 0x470320
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.quake4.wav
lea eax, [ebp - 0x218]
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
jne 0x402b4e
inc dword [0x456a04]
push 0x470320
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.quake5.wav
lea eax, [ebp - 0x218]
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
jne 0x402b81
inc dword [0x456a04]
push 0x470320
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.quake6.wav
lea eax, [ebp - 0x218]
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
jne 0x402bb4
inc dword [0x456a04]
push 0x470320
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.quake7.wav
lea eax, [ebp - 0x218]
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
jne 0x402be7
inc dword [0x456a04]
push 0x470320
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.quake8.wav
lea eax, [ebp - 0x218]
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
jne 0x402c1a
inc dword [0x456a04]
push 0x470320
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.quake9.wav
lea eax, [ebp - 0x218]
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
jne 0x402c4d
inc dword [0x456a04]
push 0x470320
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.eq3d0.mp3
lea eax, [ebp - 0x218]
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
jne 0x402c80
inc dword [0x456a04]
push 0x470320
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.eq3d1.mp3
lea eax, [ebp - 0x218]
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
jne 0x402cb3
inc dword [0x456a04]
push 0x470320
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.eq3d2.mp3
lea eax, [ebp - 0x218]
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
jne 0x402ce6
inc dword [0x456a04]
push 0x470320
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.eq3d3.mp3
lea eax, [ebp - 0x218]
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
jne 0x402d19
inc dword [0x456a04]
push 0x470320
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.eq3d4.mp3
lea eax, [ebp - 0x218]
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
jne 0x402d4c
inc dword [0x456a04]
push 0x470320
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.eq3d5.mp3
lea eax, [ebp - 0x218]
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
jne 0x402d7f
inc dword [0x456a04]
push 0x470320
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.eq3d6.mp3
lea eax, [ebp - 0x218]
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
jne 0x402db2
inc dword [0x456a04]
push 0x470320
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.eq3d7.mp3
lea eax, [ebp - 0x218]
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
jne 0x402de5
inc dword [0x456a04]
push 0x470320
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.eq3d8.mp3
lea eax, [ebp - 0x218]
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
jne 0x402e18
inc dword [0x456a04]
push 0x470320
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.eq3d9.mp3
lea eax, [ebp - 0x218]
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
jne 0x402e4b
inc dword [0x456a04]
push 0x470320
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.Cloudy_Earth.tga
lea eax, [ebp - 0x218]
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
jne 0x402e7e
inc dword [0x456a04]
push 0x470320
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.Night_Earth.tga
lea eax, [ebp - 0x218]
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
jne 0x402eb1
inc dword [0x456a04]
push 0x457de0
lea eax, [ebp - 0x678]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.Earthquake3D_
lea eax, [ebp - 0x678]
push eax
call esi
lea eax, [ebp - 0x678]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.EQ3D.htm
lea eax, [ebp - 0x218]
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call edi
lea eax, [ebp - 0x678]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.profiles.txt
lea eax, [ebp - 0x218]
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
jne 0x402f31
inc dword [0x456a04]
lea eax, [ebp - 0x678]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.Earthquake3D.ini
lea eax, [ebp - 0x218]
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call edi
test eax, eax
jne 0x402f66
inc dword [0x456a04]
push 0xff
lea eax, [ebp - 0x448]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.Earthquake3D.scr
lea eax, [ebp - 0x448]
push eax
call esi
lea eax, [ebp - 0x448]
push eax
call edi
lea eax, [ebp - 0x67c]
mov dword [ebp - 0x680], 0x200
push eax
push 1
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x403005
lea eax, [ebp - 0x680]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x684]
push eax
push 0
push str.Programs
push dword [ebp - 0x67c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x67c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.Earthquake3D.lnk
lea eax, [ebp - 0x218]
push eax
call esi
lea eax, [ebp - 0x218]
push eax
call edi
jmp 0x40300b
inc dword [0x456a04]
movups xmm0, xmmword [str.SoftwareMicrosoftWindowsCurrentVersionUninstall]
mov eax, dword [0x4453c0]
mov dword [ebp - 0x230], eax
mov eax, dword [0x444790]
movups xmmword [ebp - 0x260], xmm0
mov dword [ebp - 0xc], eax
movups xmm0, xmmword [0x4453a0]
mov ax, word [0x444794]
mov word [ebp - 8], ax
lea eax, [ebp - 0x260]
movups xmmword [ebp - 0x250], xmm0
push eax
movups xmm0, xmmword [0x4453b0]
lea eax, [ebp - 0x2e0]
push eax
movups xmmword [ebp - 0x240], xmm0
movq xmm0, qword [0x444788]
movq qword [ebp - 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x67c]
push eax
lea eax, [ebp - 0x2e0]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x4030a9
mov eax, dword [0x456a04]
inc eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403615
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x67c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push dword [ebp - 0x67c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [0x456a04]
xor ecx, ebp
pop edi
pop esi
call fcn.00403615
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret