Function at 0x42611f
Capabilities:
Delete file
Move file

Disassembly:
push ebp
push ebx
mov edx, 0xc
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x426126
call fcn.0045e790
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push 0x10000
call fcn.0044f2b0
lea eax, [esp + 0x20]
push eax
call fcn.0045e660
push edx
call fcn.0045e620
pop edx
push eax
push 0
mov ebp, dword [esp + 0x44]
push ebp
mov eax, dword [esp + 0x4c]
imul eax, eax, 0x24
pop ebp
add ebp, eax
mov edx, dword [ebp + 4]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
mov edx, str.System32configSAM
push edx
call fcn.0045e6f0
call fcn.0044e2d2
add dword [esp], edx
call fcn.00434e1c
call fcn.0044e2f0
mov dword [esp], eax
push 9
push 0x172
push 0x208
push 0xa
call fcn.00407903
cmp dword [esp], 0
je 0x4268aa
mov eax, str.SAMDomainsAccountUsersNames
push eax
push dword [esp + 4]
call fcn.0040dfc2
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
je 0x426312
mov dword [esp + 8], 0
jmp 0x4261f4
mov eax, 0x64
cmp eax, dword [esp + 8]
jl 0x4262fa
mov dword [esp + 0xc], 0x10000
push 0
push 0
push 0
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x2c]
push eax
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call sub.Toolsx86offreg.dll_OREnumKey
mov ebx, eax
and ebx, ebx
jne 0x4262f0
push edx
call fcn.0045e620
pop edx
push eax
mov eax, str.UserDontShowInLogonUI
push eax
push edx
call fcn.0045e620
pop edx
push eax
mov edx, str.SAMDomainsAccountUsers_
push edx
call fcn.0045e6f0
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
mov eax, 0x461b62
push eax
push 8
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push 5
mov eax, 0x46105e
push eax
push dword [esp + 0x48]
push dword [esp + 0x34]
call fcn.0041c8eb
cdq
push edx
push eax
call fcn.0044f460
call fcn.0044e2d2
add dword [esp], edx
call fcn.00450210
pop eax
call fcn.0045e850
push dword [esp + 0xc]
call fcn.0044e2d2
add dword [esp + 4], edx
call fcn.00417d57
call fcn.0044e2f0
mov ebx, eax
cmp ebx, 1
je 0x4262f0
push 0
push dword [esp + 0x20]
push 0xffffffff
push 0x9f
call fcn.004515af
inc dword [esp + 8]
jno 0x4261f4
push 0
push 0x9f
call fcn.00451614
push dword [esp + 4]
call sub.Toolsx86offreg.dll_ORCloseKey
cmp dword [esp], 0
je 0x426320
push dword [esp]
call sub.Toolsx86offreg.dll_ORCloseHive
call fcn.0045872d
mov dword [esp + 0x10], eax
push dword [esp + 0x10]
mov ebx, 0x332c
cmp ebx, dword [esp]
jne 0x426899
call fcn.0045ccf9
push eax
mov ebx, 0xa5
cmp ebx, dword [esp]
jne 0x426898
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push 0xa0
call fcn.004514fc
lea eax, [esp + 0x30]
push eax
call fcn.0045e660
push dword [esp + 0x2c]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push 0xa1
call fcn.004514fc
call fcn.0044e340
mov edx, eax
pop ecx
call fcn.0044e300
je 0x426877
push dword [esp + 0x2c]
call fcn.0044f9d0
mov ebx, eax
cmp ebx, 0xe
jle 0x4263da
push 0
mov ebp, dword [0x893880]
push dword [ebp + 0x44c]
push dword [ebp + 0x100]
push 0
call fcn.0040e5f6
jmp 0x426875
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
push 0x9f
call fcn.004514fc
lea eax, [esp + 0x2c]
push eax
call fcn.0045e660
mov ebp, dword [esp + 0x44]
push ebp
mov eax, dword [esp + 0x4c]
imul eax, eax, 0x24
pop ebp
add ebp, eax
cmp dword [ebp + 0x24], 0
je 0x426433
push 0x46105e
push 0
push 0xa
mov eax, str.Pwdserv64
push eax
call fcn.0040c276
mov dword [esp + 0x1c], eax
jmp 0x426451
push 0x46105e
push 0
push 0xa
mov eax, str.Pwdserv
push eax
call fcn.0040c276
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], 0
je 0x42682a
push edx
call fcn.0045e620
pop edx
push eax
mov ebp, dword [esp + 0x48]
push ebp
mov eax, dword [esp + 0x50]
imul eax, eax, 0x24
pop ebp
add ebp, eax
mov edx, dword [ebp + 4]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
mov edx, str.System32Pwdserv.exe
push edx
call fcn.0045e6f0
call fcn.0045e850
push 0xffffffff
call fcn.0044e2d2
add dword [esp + 4], edx
call fcn.0045b860
call fcn.0044e2f0
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x426821
push dword [esp + 0x1c]
call fcn.0045ac60
push eax
push dword [esp + 0x20]
push dword [esp + 0x10]
call fcn.0045bc30
push dword [esp + 8]
call fcn.0045b500
mov ebp, dword [esp + 0x44]
push ebp
mov eax, dword [esp + 0x4c]
imul eax, eax, 0x24
pop ebp
add ebp, eax
mov edx, dword [ebp + 4]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
mov edx, str.System32config_
push edx
call fcn.0045e6f0
lea eax, [esp + 0x34]
push eax
call fcn.0045e660
push edx
call fcn.0045e620
pop edx
push eax
push 0
mov edx, dword [esp + 0x38]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
mov edx, str.system
push edx
call fcn.0045e6f0
call fcn.0044e2d2
add dword [esp], edx
call fcn.00434e1c
call fcn.0044e2f0
mov dword [esp + 8], eax
cmp dword [esp + 8], 0
je 0x426821
push edx
call fcn.0045e620
pop edx
push eax
mov edx, str.ControlSet
push edx
call fcn.0045e6f0
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e620
pop edx
push eax
mov eax, 0x461b62
push eax
push 3
push edx
call fcn.0045e620
pop edx
push eax
mov eax, str.Current
push eax
mov eax, str.Select
push eax
push dword [esp + 0x28]
call fcn.00415330
call fcn.0044e2d2
add dword [esp], edx
call fcn.00450210
pop eax
lea eax, [esp + 0x38]
push eax
call fcn.0045e660
push dword [esp + 0x34]
push dword [esp + 0xc]
call fcn.0041a675
and eax, eax
je 0x426818
mov edx, dword [esp + 0x34]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
mov edx, str._servicespassword
push edx
call fcn.0045e6f0
lea eax, [esp + 0x38]
push eax
call fcn.0045e660
push 1
mov eax, str.ErrorControl
push eax
push dword [esp + 0x3c]
push dword [esp + 0x14]
call fcn.0042b738
push 2
mov eax, str.Start
push eax
push dword [esp + 0x3c]
push dword [esp + 0x14]
call fcn.0042b738
push 0x10
mov eax, str.Type
push eax
push dword [esp + 0x3c]
push dword [esp + 0x14]
call fcn.0042b738
push 0
mov eax, str.Base
push eax
push 1
mov eax, str.Group
push eax
push dword [esp + 0x44]
push dword [esp + 0x1c]
call fcn.00425ee8
push 0
mov eax, str.System32PwdServ.exe
push eax
push 2
mov eax, str.ImagePath
push eax
push dword [esp + 0x44]
push dword [esp + 0x1c]
call fcn.00425ee8
push 0
mov eax, str.LocalSystem
push eax
push 1
mov eax, str.ObjectName
push eax
push dword [esp + 0x44]
push dword [esp + 0x1c]
call fcn.00425ee8
mov edx, dword [esp + 0x34]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
mov edx, str.Parameters
push edx
call fcn.0045e6f0
lea eax, [esp + 0x38]
push eax
call fcn.0045e660
push 0
mov eax, dword [esp + 0x2c]
push eax
push 1
mov eax, 0x46dad8
push eax
push dword [esp + 0x44]
push dword [esp + 0x1c]
call fcn.00425ee8
push 0
mov eax, dword [esp + 0x30]
push eax
push 1
mov eax, 0x465942
push eax
push dword [esp + 0x44]
push dword [esp + 0x1c]
call fcn.00425ee8
push edx
call fcn.0045e620
pop edx
push eax
push 1
push 5
mov edx, dword [esp + 0x3c]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
mov edx, str.system_new
push edx
call fcn.0045e6f0
call fcn.0045e850
push dword [esp + 0x18]
call fcn.0044e2d2
add dword [esp + 4], edx
call fcn.0042fc3f
call fcn.0044e2f0
mov ebx, eax
and ebx, ebx
jne 0x426818
push edx
call fcn.0045e620
pop edx
push eax
mov edx, dword [esp + 0x34]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
mov edx, str.system
push edx
call fcn.0045e6f0
call fcn.0044e2d2
add dword [esp], edx
call sub.kernel32.dll_DeleteFileW
call fcn.0044e2f0
and eax, eax
je 0x426818
push edx
call fcn.0045e620
pop edx
push eax
mov edx, dword [esp + 0x34]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
mov edx, str.system
push edx
call fcn.0045e6f0
call fcn.0045e850
mov edx, dword [esp + 0x38]
push edx
call fcn.0045e620
pop edx
push eax
push edx
call fcn.0045e6f0
mov edx, str.system_new
push edx
call fcn.0045e6f0
call fcn.0044e2d2
add dword [esp], edx
call fcn.0044e2d2
add dword [esp + 4], edx
call sub.kernel32.dll_MoveFileW
call fcn.0044e2f0
mov dword [esp + 0x20], 1
mov dword [esp + 0x18], 0x333c
push dword [esp + 8]
call sub.Toolsx86offreg.dll_ORCloseHive
push dword [esp + 0x1c]
call fcn.0045ac40
cmp dword [esp + 0x20], 0
je 0x426854
push 0
mov ebp, dword [0x893880]
push dword [ebp + 0x450]
mov eax, str.Success_
push eax
push 0
call fcn.0040e5f6
jmp 0x426875
push 0
mov ebp, dword [0x893880]
push dword [ebp + 0x458]
push dword [ebp + 0x100]
push 0
call fcn.0040e5f6
jmp 0x426898
push 0
mov ebp, dword [0x893880]
push dword [ebp + 0x454]
push dword [ebp + 0x100]
push 0
call fcn.0040e5f6
pop eax
pop eax
mov ebx, dword [esp + 0x10]
cmp ebx, 0x333c
jne 0x426320
xor eax, eax
push dword [esp + 0x28]
call fcn.0045e7f0
push dword [esp + 0x24]
call fcn.0045e7f0
push dword [esp + 0x1c]
call fcn.0045e7f0
push dword [esp + 0x20]
call fcn.0045e7f0
push dword [esp + 0x2c]
call fcn.0045e7f0
add esp, 0x30
pop ebx
pop ebp
ret 8