Function at 0x437c20
Capabilities:
Check for time delay via gettickcount
Get common file path
Link many functions at runtime
Print debug messages
Query or enumerate registry value
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ab6c7
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x4e42d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp byte [0x4e5790], 0
mov esi, ecx
mov dword [ebp - 0x42c], esi
je 0x437c6a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4ea674], eax
lea eax, [esi + 0xa0]
push eax
lea eax, [ebp - 0x428]
push eax
mov ebx, 0x4c2c0c
call fcn.00404f20
add esp, 8
mov dword [ebp - 4], 0
mov edi, dword [ebp - 0x428]
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
mov esi, dword [sym.imp.ole32.dll_OleUninitialize]
test eax, eax
jns 0x437ca8
xor bl, bl
jmp 0x437d02
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 8
push 0
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
cmp edi, 0x20
jae 0x437cc8
call esi
xor bl, bl
jmp 0x437d02
push str.DllRegisterServer
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x437ce5
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call esi
xor bl, bl
jmp 0x437d02
call eax
push edi
test eax, eax
jns 0x437cf8
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call esi
xor bl, bl
jmp 0x437d02
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call esi
mov bl, 1
cmp byte [0x4e5790], 0
je 0x437d6c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4ea678], eax
sub eax, dword [0x4ea674]
mov edi, 0x4ea704
push eax
push 0x4c2c20
push 0x4bd194
call fcn.00402d60
mov ecx, dword [0x4ea704]
add esp, 0xc
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [0x4ea67c]
test eax, eax
je 0x437d6c
mov ecx, dword [0x4ea704]
mov edx, dword [ecx - 0xc]
push eax
push edx
push 2
push ecx
call fcn.00492295
mov edx, dword [0x4ea67c]
push edx
call fcn.00492a51
add esp, 0x14
test bl, bl
jne 0x437d91
mov edi, dword [ebp - 0x42c]
add edi, 0xa4
lea eax, [ebp - 0x424]
mov dword [ebp - 0x424], 0xfa1
call fcn.00407ec0
cmp byte [0x4e5790], 0
je 0x437da5
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4ea674], eax
mov eax, dword [ebp - 0x42c]
add eax, 0xa0
push eax
lea eax, [ebp - 0x424]
push eax
mov ebx, 0x4c2c40
call fcn.00404f20
add esp, 8
mov ebx, 1
lea edi, [ebp - 0x428]
mov byte [ebp - 4], bl
call fcn.00405000
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x424]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x437dfe
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebp - 0x428]
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
test eax, eax
jns 0x437e14
xor bl, bl
jmp 0x437e6b
push ebx
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 8
push 0
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
cmp edi, 0x20
jae 0x437e33
call esi
xor bl, bl
jmp 0x437e6b
push str.DllRegisterServer
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x437e50
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call esi
xor bl, bl
jmp 0x437e6b
call eax
push edi
test eax, eax
jns 0x437e63
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call esi
xor bl, bl
jmp 0x437e6b
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call esi
cmp byte [0x4e5790], 0
je 0x437ed5
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4ea678], eax
sub eax, dword [0x4ea674]
mov edi, 0x4ea704
push eax
push 0x4c2c5c
push 0x4bd194
call fcn.00402d60
mov ecx, dword [0x4ea704]
add esp, 0xc
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [0x4ea67c]
test eax, eax
je 0x437ed5
mov ecx, dword [0x4ea704]
mov edx, dword [ecx - 0xc]
push eax
push edx
push 2
push ecx
call fcn.00492295
mov edx, dword [0x4ea67c]
push edx
call fcn.00492a51
add esp, 0x14
test bl, bl
jne 0x437efa
mov edi, dword [ebp - 0x42c]
add edi, 0xa4
lea eax, [ebp - 0x424]
mov dword [ebp - 0x424], 0xfa5
call fcn.00407ec0
cmp byte [0x4e5790], 0
je 0x437f0e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4ea674], eax
mov eax, dword [ebp - 0x42c]
add eax, 0xa0
push eax
lea eax, [ebp - 0x424]
push eax
mov ebx, 0x4c2c84
call fcn.00404f20
add esp, 8
lea edi, [ebp - 0x428]
mov byte [ebp - 4], 2
call fcn.00405000
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x424]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x437f63
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebp - 0x428]
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
test eax, eax
jns 0x437f79
xor bl, bl
jmp 0x437fd3
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 8
push 0
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
cmp edi, 0x20
jae 0x437f99
call esi
xor bl, bl
jmp 0x437fd3
push str.DllRegisterServer
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x437fb6
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call esi
xor bl, bl
jmp 0x437fd3
call eax
push edi
test eax, eax
jns 0x437fc9
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call esi
xor bl, bl
jmp 0x437fd3
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call esi
mov bl, 1
cmp byte [0x4e5790], 0
je 0x43803d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4ea678], eax
sub eax, dword [0x4ea674]
mov edi, 0x4ea704
push eax
push 0x4c2ca0
push 0x4bd194
call fcn.00402d60
mov ecx, dword [0x4ea704]
add esp, 0xc
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [0x4ea67c]
test eax, eax
je 0x43803d
mov ecx, dword [0x4ea704]
mov edx, dword [ecx - 0xc]
push eax
push edx
push 2
push ecx
call fcn.00492295
mov edx, dword [0x4ea67c]
push edx
call fcn.00492a51
add esp, 0x14
test bl, bl
jne 0x438062
mov edi, dword [ebp - 0x42c]
add edi, 0xa4
lea eax, [ebp - 0x424]
mov dword [ebp - 0x424], 0xfa6
call fcn.00407ec0
cmp byte [0x4e5790], 0
je 0x438076
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4ea674], eax
mov eax, dword [ebp - 0x42c]
add eax, 0xa0
push eax
lea eax, [ebp - 0x424]
push eax
mov ebx, 0x4c2cc8
call fcn.00404f20
add esp, 8
lea edi, [ebp - 0x428]
mov byte [ebp - 4], 3
call fcn.00405000
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x424]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4380cb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebp - 0x428]
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
test eax, eax
jns 0x4380e1
xor bl, bl
jmp 0x43813b
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 8
push 0
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
cmp edi, 0x20
jae 0x438101
call esi
xor bl, bl
jmp 0x43813b
push str.DllRegisterServer
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x43811e
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call esi
xor bl, bl
jmp 0x43813b
call eax
push edi
test eax, eax
jns 0x438131
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call esi
xor bl, bl
jmp 0x43813b
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call esi
mov bl, 1
cmp byte [0x4e5790], 0
je 0x4381a5
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4ea678], eax
sub eax, dword [0x4ea674]
mov edi, 0x4ea704
push eax
push 0x4c2cf8
push 0x4bd194
call fcn.00402d60
mov ecx, dword [0x4ea704]
add esp, 0xc
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [0x4ea67c]
test eax, eax
je 0x4381a5
mov ecx, dword [0x4ea704]
mov edx, dword [ecx - 0xc]
push eax
push edx
push 2
push ecx
call fcn.00492295
mov edx, dword [0x4ea67c]
push edx
call fcn.00492a51
add esp, 0x14
test bl, bl
jne 0x4381ca
mov edi, dword [ebp - 0x42c]
add edi, 0xa4
lea eax, [ebp - 0x424]
mov dword [ebp - 0x424], 0xfa7
call fcn.00407ec0
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x216]
push ecx
mov word [ebp - 0x218], ax
call fcn.00493520
add esp, 0xc
lea edx, [ebp - 0x424]
push edx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x430]
push ecx
push str.ThreadingModel
push str.CLSIDF6D90F11_9C73_11D3_B32E_00C04F990BB4InProcServer32
push SysReAllocString
mov dword [ebp - 0x424], 0x102
mov dword [ebp - 0x430], 1
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x4383a2
push 1
push 0x25
lea edx, [ebp - 0x420]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp byte [0x4e5790], 0
je 0x438255
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4ea674], eax
lea eax, [ebp - 0x424]
push eax
lea ecx, [ebp - 0x420]
call fcn.00402b20
push 0xb
push 0x4c2dc8
lea ebx, [ebp - 0x424]
mov byte [ebp - 4], 4
call fcn.00409bd0
mov edi, dword [ebp - 0x424]
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
test eax, eax
jns 0x438293
xor bl, bl
jmp 0x4382ed
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 8
push 0
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
cmp edi, 0x20
jae 0x4382b3
call esi
xor bl, bl
jmp 0x4382ed
push str.DllRegisterServer
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x4382d0
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call esi
xor bl, bl
jmp 0x4382ed
call eax
push edi
test eax, eax
jns 0x4382e3
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call esi
xor bl, bl
jmp 0x4382ed
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call esi
mov bl, 1
cmp byte [0x4e5790], 0
je 0x438357
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x4ea678], eax
sub eax, dword [0x4ea674]
mov edi, 0x4ea704
push eax
push 0x4c2de0
push 0x4bd194
call fcn.00402d60
mov ecx, dword [0x4ea704]
add esp, 0xc
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [0x4ea67c]
test eax, eax
je 0x438357
mov ecx, dword [0x4ea704]
mov edx, dword [ecx - 0xc]
push eax
push edx
push 2
push ecx
call fcn.00492295
mov edx, dword [0x4ea67c]
push edx
call fcn.00492a51
add esp, 0x14
test bl, bl
jne 0x43837c
mov edi, dword [ebp - 0x42c]
add edi, 0xa4
lea eax, [ebp - 0x430]
mov dword [ebp - 0x430], 0xfa9
call fcn.00407ec0
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x424]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4383a2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x428]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4383cb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048f6cb
mov esp, ebp
pop ebp
ret