Function at 0x4243f0
Capabilities:
Copy file
Delete file
Delete registry value
Get common file path
Persist via run registry key
Resolve function by parsing pe exports
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x443b91
mov eax, dword fs:[0]
push eax
sub esp, 0xaec
mov eax, dword [0x451050]
xor eax, esp
mov dword [esp + 0xae8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x451050]
xor eax, esp
push eax
lea eax, [esp + 0xb00]
mov dword fs:[0], eax
lea eax, [esp + 0x14]
push eax
push 0x20006
xor esi, esi
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42450f
test dword [0x452498], 0x200
je 0x4244f4
mov eax, dword [0x459f78]
push 0x3fe
lea edx, [esp + 0x302]
push edx
mov ecx, 0x22
push eax
mov word [esp + 0x308], cx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, 0x400
lea eax, [esp + 0x2fc]
cmp word [eax], si
je 0x4244a1
add eax, 2
sub ecx, 1
jne 0x424492
jmp 0x4244c4
cmp ecx, esi
je 0x4244c4
mov eax, 0x400
sub eax, ecx
mov ecx, 0x400
sub ecx, eax
lea edx, [esp + eax*2 + 0x2fc]
mov eax, str.___startup
call fcn.0040d850
lea ecx, [esp + 0x2fc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [esp + 0x14]
lea edx, [eax + eax + 2]
push edx
lea eax, [esp + 0x300]
push eax
push 1
push esi
push 0x447ce8
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x424504
mov edx, dword [esp + 0x14]
push 0x447ce8
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
mov dword [esp + 0x70], 7
mov dword [esp + 0x6c], esi
mov word [esp + 0x5c], cx
lea edx, [esp + 0x2fc]
push edx
push 0x400
mov dword [esp + 0xb10], esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, 0x400
jae 0x425058
cmp eax, esi
je 0x425058
lea eax, [esp + 0xf4]
push eax
push esi
push 0x449044
lea ecx, [esp + 0x308]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
cmp eax, esi
jne 0x424584
cmp dword [esp + 0x70], 8
jb 0x42506c
mov edx, dword [esp + 0x5c]
push edx
jmp 0x425064
lea eax, [esp + 0xf4]
push eax
lea ecx, [esp + 0x40]
push ecx
call fcn.00406d20
mov byte [esp + 0xb08], 1
xor eax, eax
xor edx, edx
mov ebx, 8
mov word [esp + 0x2fe], ax
mov eax, dword [esp + 0x40]
mov word [esp + 0x2fc], dx
cmp dword [esp + 0x54], ebx
jae 0x4245c5
lea eax, [esp + 0x40]
mov ebp, dword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionW]
push eax
lea ecx, [esp + 0x300]
push ecx
push str.General
call ebp
mov ecx, dword [0x4586e8]
cmp dword [0x4586fc], ebx
jae 0x4245ee
mov ecx, 0x4586e8
mov eax, dword [esp + 0x40]
cmp dword [esp + 0x54], ebx
jae 0x4245fc
lea eax, [esp + 0x40]
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push eax
push ecx
push 0x4487b8
push str.General
call esi
push 0x12c
push str.Version
mov edi, str.General
lea ecx, [esp + 0x44]
call fcn.00407090
mov edx, dword [0x452498]
push edx
push str.Flags
lea ecx, [esp + 0x44]
call fcn.00407010
mov eax, dword [0x45249c]
push eax
push str.Defaults
lea ecx, [esp + 0x44]
call fcn.00407010
mov ecx, dword [0x4524a0]
push ecx
push str.Effects
lea ecx, [esp + 0x44]
call fcn.00407010
mov edx, dword [0x4524a4]
push edx
push str.Delay
lea ecx, [esp + 0x44]
call fcn.00407090
mov eax, dword [0x459f94]
push eax
mov edi, str.ShColor
lea ecx, [esp + 0x40]
call fcn.00407110
mov ecx, dword [0x4524b0]
push ecx
push str.ShAngle
mov edi, str.General
lea ecx, [esp + 0x44]
call fcn.00407090
mov edx, dword [0x4524b4]
push edx
push str.ShDistance
lea ecx, [esp + 0x44]
call fcn.00407090
mov eax, dword [0x4524b8]
push eax
push str.ShSize
lea ecx, [esp + 0x44]
call fcn.00407090
mov ecx, dword [0x4524bc]
push ecx
push str.ShOpacity
lea ecx, [esp + 0x44]
call fcn.00407090
mov edx, dword [0x4524d0]
push edx
push str.ReflPixels
lea ecx, [esp + 0x44]
call fcn.00407090
mov eax, dword [0x4524d4]
push eax
push str.ReflPercent
lea ecx, [esp + 0x44]
call fcn.00407090
mov ecx, dword [0x459f98]
push ecx
push str.ReflOffset
lea ecx, [esp + 0x44]
call fcn.00407090
mov edx, dword [0x4524d8]
push edx
push str.ReflOpacity
lea ecx, [esp + 0x44]
call fcn.00407090
mov eax, dword [0x4524ac]
push eax
mov edi, str.OutColor
lea ecx, [esp + 0x40]
call fcn.00407110
mov ecx, dword [0x4524c0]
push ecx
push str.Outline
mov edi, str.General
lea ecx, [esp + 0x44]
call fcn.00407090
mov edx, dword [0x4524a8]
push edx
mov edi, str.BgColor
lea ecx, [esp + 0x40]
call fcn.00407110
mov eax, dword [0x4524c4]
push eax
push str.Rotate
mov edi, str.General
lea ecx, [esp + 0x44]
call fcn.00407090
mov ecx, dword [0x4524c8]
push ecx
push str.Scale
lea ecx, [esp + 0x44]
call fcn.00407090
mov edx, dword [0x4524cc]
push edx
push str.ScaleFit
lea ecx, [esp + 0x44]
call fcn.00407010
mov eax, dword [0x4524e4]
push eax
push str.StFlags
lea ecx, [esp + 0x44]
call fcn.00407010
mov ecx, dword [0x4524e8]
push ecx
push str.StOpacity
lea ecx, [esp + 0x44]
call fcn.00407090
mov edx, dword [0x4524ec]
push edx
push str.StPosition1
lea ecx, [esp + 0x44]
call fcn.00407010
mov eax, dword [0x4524f0]
push eax
push str.StPosition2
lea ecx, [esp + 0x44]
call fcn.00407010
mov edi, dword [0x458774]
cmp dword [0x458788], ebx
jae 0x424825
mov edi, 0x458774
lea ecx, [esp + 0x3c]
push ecx
mov edx, str.Stamp
mov ecx, str.General
call fcn.00407450
mov ecx, dword [0x45881c]
cmp dword [0x458830], ebx
jae 0x42484c
mov ecx, 0x45881c
mov eax, dword [esp + 0x40]
cmp dword [esp + 0x54], ebx
jae 0x42485a
lea eax, [esp + 0x40]
push eax
push ecx
push str.StText
push str.General
call esi
mov ecx, dword [0x458838]
cmp dword [0x45884c], ebx
jae 0x42487b
mov ecx, 0x458838
mov eax, dword [esp + 0x40]
cmp dword [esp + 0x54], ebx
jae 0x424889
lea eax, [esp + 0x40]
push eax
push ecx
push str.StTextFont
push str.General
call esi
mov edx, dword [0x4524f8]
push edx
push str.StTextStyle
mov edi, str.General
lea ecx, [esp + 0x44]
call fcn.00407010
mov eax, dword [0x4524f4]
push eax
push str.StTextColor
lea ecx, [esp + 0x44]
call fcn.00407010
mov ecx, dword [0x4524dc]
push ecx
push str.AutoFormat
lea ecx, [esp + 0x44]
call fcn.00407090
mov edx, dword [0x4524e0]
push edx
push str.AutoFlags
lea ecx, [esp + 0x44]
call fcn.00407010
mov edi, dword [0x458790]
cmp dword [0x4587a4], ebx
jae 0x424902
mov edi, 0x458790
lea eax, [esp + 0x3c]
push eax
mov edx, str.AutoDir
mov ecx, str.General
call fcn.00407450
mov ecx, dword [0x4587ac]
cmp dword [0x4587c0], ebx
jae 0x424929
mov ecx, 0x4587ac
mov eax, dword [esp + 0x40]
cmp dword [esp + 0x54], ebx
jae 0x424937
lea eax, [esp + 0x40]
push eax
push ecx
push str.AutoName
push str.General
call esi
mov ecx, dword [0x458800]
cmp dword [0x458814], ebx
jae 0x424958
mov ecx, 0x458800
mov eax, dword [esp + 0x40]
cmp dword [esp + 0x54], ebx
jae 0x424966
lea eax, [esp + 0x40]
push eax
push ecx
push str.RunOnSave
push str.General
call esi
mov ecx, dword [0x45a258]
push ecx
push str.RcFlags
mov edi, str.General
lea ecx, [esp + 0x44]
call fcn.00407010
mov edx, dword [0x452434]
push edx
push str.RcPosX
lea ecx, [esp + 0x44]
call fcn.00407090
mov eax, dword [0x452438]
push eax
push str.RcPosY
lea ecx, [esp + 0x44]
call fcn.00407090
mov ecx, dword [0x45a24c]
push ecx
push str.RcSizeX
lea ecx, [esp + 0x44]
call fcn.00407090
mov edx, dword [0x45a250]
push edx
push str.RcSizeY
lea ecx, [esp + 0x44]
call fcn.00407090
mov eax, dword [0x452484]
push eax
push str.ObjFlags
lea ecx, [esp + 0x44]
call fcn.00407010
movzx ecx, word [0x458400]
push ecx
push str.CurModeHK
lea ecx, [esp + 0x44]
call fcn.00407010
movzx edx, word [0x458404]
push edx
push str.FullScreenHK
lea ecx, [esp + 0x44]
call fcn.00407010
movzx eax, word [0x458408]
push eax
push str.ApplicationHK
lea ecx, [esp + 0x44]
call fcn.00407010
movzx ecx, word [0x45840c]
push ecx
push str.WindowHK
lea ecx, [esp + 0x44]
call fcn.00407010
movzx edx, word [0x458410]
push edx
push str.ObjectHK
lea ecx, [esp + 0x44]
call fcn.00407010
movzx eax, word [0x458414]
push eax
push str.RegionHK
lea ecx, [esp + 0x44]
call fcn.00407010
mov ecx, dword [0x45a1ac]
push ecx
push str.PrintFlags
lea ecx, [esp + 0x44]
call fcn.00407010
mov edx, dword [0x452444]
push edx
push str.PrintMarginLeft
lea ecx, [esp + 0x44]
call fcn.00407090
mov eax, dword [0x452448]
push eax
push str.PrintMarginTop
lea ecx, [esp + 0x44]
call fcn.00407090
mov ecx, dword [0x45244c]
push ecx
push str.PrintMarginRight
lea ecx, [esp + 0x44]
call fcn.00407090
mov edx, dword [0x452450]
push edx
push str.PrintMarginBottom
lea ecx, [esp + 0x44]
call fcn.00407090
mov eax, dword [0x45868c]
push eax
push str.FlagsCap
lea ecx, [esp + 0x44]
call fcn.00407010
mov ecx, dword [0x458690]
push ecx
push str.FixLeft
lea ecx, [esp + 0x44]
call fcn.00407090
mov edx, dword [0x458694]
push edx
push str.FixTop
lea ecx, [esp + 0x44]
call fcn.00407090
mov eax, dword [0x458698]
push eax
push str.FixRight
lea ecx, [esp + 0x44]
call fcn.00407090
mov ecx, dword [0x45869c]
push ecx
push str.FixBottom
lea ecx, [esp + 0x44]
call fcn.00407090
mov edx, dword [0x4586a0]
push edx
push str.FixDlgLeft
lea ecx, [esp + 0x44]
call fcn.00407090
mov eax, dword [0x4586a4]
push eax
push str.FixDlgTop
lea ecx, [esp + 0x44]
call fcn.00407090
mov ecx, dword [0x4586a8]
push ecx
push str.FixDlgRight
lea ecx, [esp + 0x44]
call fcn.00407090
mov edx, dword [0x4586ac]
push edx
push str.FixDlgBottom
lea ecx, [esp + 0x44]
call fcn.00407090
mov eax, dword [0x4586b0]
push eax
push str.FixRoundX
lea ecx, [esp + 0x44]
call fcn.00407090
mov ecx, dword [0x4586b4]
push ecx
push str.FixRoundY
lea ecx, [esp + 0x44]
call fcn.00407090
mov edx, dword [0x45a2f8]
push edx
push str.AdvTemplate
lea ecx, [esp + 0x44]
call fcn.00407090
mov eax, dword [0x4523bc]
push eax
push str.ConfigPage
lea ecx, [esp + 0x44]
call fcn.00407090
mov ecx, dword [0x45250c]
push ecx
push str.MainPosX
lea ecx, [esp + 0x44]
call fcn.00407090
mov edx, dword [0x452510]
push edx
push str.MainPosY
lea ecx, [esp + 0x44]
call fcn.00407090
mov eax, dword [0x459fa8]
push eax
push str.MainWidth
lea ecx, [esp + 0x44]
call fcn.00407090
mov ecx, dword [0x459fac]
push ecx
push str.MainHeight
lea ecx, [esp + 0x44]
call fcn.00407090
mov edx, dword [0x45251c]
push edx
push str.MainActions
lea ecx, [esp + 0x44]
call fcn.00407010
mov eax, dword [0x459fb8]
push eax
push str.PaneWidth
lea ecx, [esp + 0x44]
call fcn.00407090
mov eax, dword [esp + 0x40]
xor ecx, ecx
xor edx, edx
mov word [esp + 0x2fc], cx
mov word [esp + 0x2fe], dx
cmp dword [esp + 0x54], ebx
jae 0x424c8b
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x300]
push eax
push str.Tools
call ebp
mov ecx, dword [0x45a44c]
sub ecx, dword [0x45a448]
mov eax, 0xb60b60b7
imul ecx
add edx, ecx
sar edx, 7
mov esi, edx
shr esi, 0x1f
add esi, edx
push esi
push str.Count
mov edi, str.Tools
lea ecx, [esp + 0x44]
mov dword [esp + 0x24], esi
call fcn.00407090
xor ebp, ebp
test esi, esi
jle 0x424f30
mov dword [esp + 0x18], ebp
mov ecx, dword [0x45a44c]
sub ecx, dword [0x45a448]
mov eax, 0xb60b60b7
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp ebp, ecx
jb 0x424d08
call fcn.004344ed
mov edx, dword [esp + 0x18]
mov eax, dword [0x45a448]
push ebp
push str.Title_u
mov ecx, 0x40
lea ebx, [esp + 0x7c]
lea esi, [edx + eax]
call fcn.00401250
mov edi, 8
add esp, 8
cmp dword [esi + 0x24], edi
jb 0x424d3a
mov eax, dword [esi + 0x10]
jmp 0x424d3d
lea eax, [esi + 0x10]
mov ecx, dword [esp + 0x40]
cmp dword [esp + 0x54], edi
jae 0x424d4b
lea ecx, [esp + 0x40]
push ecx
push eax
lea ecx, [esp + 0x7c]
push ecx
push str.Tools
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push ebp
push str.ExePath_u
mov ecx, 0x40
lea ebx, [esp + 0x7c]
call fcn.00401250
add esp, 8
cmp dword [esi + 0x40], edi
jb 0x424d7e
mov edi, dword [esi + 0x2c]
jmp 0x424d81
lea edi, [esi + 0x2c]
lea edx, [esp + 0x3c]
push edx
lea edx, [esp + 0x78]
mov ecx, str.Tools
call fcn.00407450
push ebp
push str.Param_u
mov ecx, 0x40
lea ebx, [esp + 0x7c]
call fcn.00401250
add esp, 8
cmp dword [esi + 0x5c], 8
jb 0x424db6
mov eax, dword [esi + 0x48]
jmp 0x424db9
lea eax, [esi + 0x48]
mov ecx, dword [esp + 0x40]
mov edi, 8
cmp dword [esp + 0x54], edi
jae 0x424dcc
lea ecx, [esp + 0x40]
push ecx
push eax
lea eax, [esp + 0x7c]
push eax
push str.Tools
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push ebp
push str.Icon_u
mov ecx, 0x40
lea ebx, [esp + 0x7c]
call fcn.00401250
add esp, 8
cmp dword [esi + 0x78], edi
jb 0x424dff
mov edi, dword [esi + 0x64]
jmp 0x424e02
lea edi, [esi + 0x64]
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0x78]
mov ecx, str.Tools
call fcn.00407450
push ebp
push str.SaveDir_u
mov ecx, 0x40
lea ebx, [esp + 0x7c]
call fcn.00401250
add esp, 8
cmp dword [esi + 0x94], 8
jb 0x424e3d
mov edi, dword [esi + 0x80]
jmp 0x424e43
lea edi, [esi + 0x80]
lea edx, [esp + 0x3c]
push edx
lea edx, [esp + 0x78]
mov ecx, str.Tools
call fcn.00407450
push ebp
push str.SaveName_u
mov ecx, 0x40
lea ebx, [esp + 0x7c]
call fcn.00401250
add esp, 8
cmp dword [esi + 0xb0], 8
jb 0x424e7e
mov eax, dword [esi + 0x9c]
jmp 0x424e84
lea eax, [esi + 0x9c]
cmp dword [esp + 0x54], 8
mov ecx, dword [esp + 0x40]
jae 0x424e93
lea ecx, [esp + 0x40]
push ecx
push eax
lea eax, [esp + 0x7c]
push eax
push str.Tools
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push ebp
push str.SaveFormat_u
mov ecx, 0x40
lea ebx, [esp + 0x7c]
call fcn.00401250
mov ecx, dword [esi + 4]
add esp, 8
push ecx
mov edx, ebx
push edx
mov edi, str.Tools
lea ecx, [esp + 0x44]
call fcn.00407090
push ebp
push str.SaveAlpha_u
mov ecx, 0x40
call fcn.00401250
or dword [esi + 8], 0x80000000
mov eax, dword [esi + 8]
add esp, 8
push eax
mov eax, ebx
push eax
lea ecx, [esp + 0x44]
call fcn.00407010
push ebp
push str.Flags_u
mov ecx, 0x40
call fcn.00401250
mov ecx, dword [esi]
add esp, 8
push ecx
mov edx, ebx
push edx
lea ecx, [esp + 0x44]
call fcn.00407010
add dword [esp + 0x18], 0xb4
inc ebp
cmp ebp, dword [esp + 0x1c]
jl 0x424ce0
mov eax, dword [0x459cd0]
xor ebp, ebp
cmp eax, ebp
je 0x424f3f
cmp dword [eax], ebp
jne 0x424f6d
mov eax, dword [0x45a298]
push eax
push str.LowDateTime
mov edi, str.Setup
lea ecx, [esp + 0x44]
call fcn.00407010
mov ecx, dword [0x45a29c]
push ecx
push str.HighDateTime
lea ecx, [esp + 0x44]
call fcn.00407010
mov ebx, str.WinSnap.ini
lea esi, [esp + 0x20]
call fcn.00403ca0
push 0xffffffffffffffff
push ebp
lea ecx, [esp + 0x60]
mov byte [esp + 0xb10], 2
call fcn.004038b0
mov esi, 8
cmp dword [esp + 0x38], esi
jb 0x424fa7
mov edx, dword [esp + 0x24]
push edx
call fcn.00434772
add esp, 4
mov eax, dword [esp + 0x5c]
cmp dword [esp + 0x70], esi
jae 0x424fb5
lea eax, [esp + 0x5c]
push ebp
push eax
lea eax, [esp + 0xfc]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x42500a
lea ecx, [esp + 0xf4]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [esp + 0x54], esi
jb 0x424fea
mov edx, dword [esp + 0x40]
push edx
call fcn.00434772
add esp, 4
xor eax, eax
mov dword [esp + 0x54], 7
mov dword [esp + 0x50], ebp
mov word [esp + 0x40], ax
cmp dword [esp + 0x70], esi
jb 0x42506c
mov ecx, dword [esp + 0x5c]
push ecx
jmp 0x425064
lea edx, [esp + 0xf4]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [esp + 0x54], esi
jb 0x42502b
mov eax, dword [esp + 0x40]
push eax
call fcn.00434772
add esp, 4
xor ecx, ecx
mov dword [esp + 0x54], 7
mov dword [esp + 0x50], ebp
mov word [esp + 0x40], cx
cmp dword [esp + 0x70], esi
jb 0x425051
mov edx, dword [esp + 0x5c]
push edx
call fcn.00434772
add esp, 4
mov eax, 1
jmp 0x42506e
cmp dword [esp + 0x70], 8
jb 0x42506c
mov eax, dword [esp + 0x5c]
push eax
call fcn.00434772
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0xb00]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xae8]
xor ecx, esp
call fcn.00433c32
add esp, 0xaf8
ret