Function at 0x422840
Capabilities:
Persist via run registry key
Query or enumerate registry value
Read .ini file

Disassembly:
sub esp, 0x410
push ebp
push esi
push edi
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
mov byte [esp + 0x31c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x31d]
mov ebp, dword [esp + 0x420]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
test ebp, ebp
mov dword [esp + 0xc], 0
stosb byte es:[edi], al
jne 0x42295d
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x21d]
mov byte [esp + 0x21c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x21c]
push 0x100
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x21c]
push 0x5c
push ecx
call fcn.00427f40
add esp, 8
test eax, eax
je 0x422980
lea edx, [esp + 0x21c]
push 0x5c
push edx
call fcn.00427f40
mov edx, eax
mov edi, str.NetConfig.ini
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x21c]
push ecx
push 0x100
push edx
push str.Rav.ini
push 0x435604
push str.SETTING
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0x18]
push 0x2e
push eax
call fcn.00427f40
add esp, 8
test eax, eax
je 0x422980
lea ecx, [esp + 0x18]
push 0x2e
push ecx
call fcn.00427f40
add esp, 8
mov byte [eax], 0
jmp 0x422980
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x18]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0xc]
push ecx
push 1
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4229dc
lea edx, [esp + 0x10]
lea eax, [esp + 0x31c]
push edx
lea ecx, [esp + 0x18]
push eax
mov eax, dword [esp + 0x14]
push ecx
lea edx, [esp + 0x24]
push 0
push edx
push eax
mov dword [esp + 0x2c], 1
mov dword [esp + 0x28], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x31c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x422a53
push 0xffffffffffffffff
lea eax, [esp + 0x10]
push 0x13a
push eax
call fcn.00422b30
mov ecx, dword [esp + 0x18]
push 0
push 0x40
push ecx
call fcn.00422db0
mov eax, dword [esp + 0x24]
mov ecx, dword [0x4350bc]
add esp, 0x18
lea edx, [eax - 0xc]
cmp edx, ecx
je 0x422b19
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x422b19
mov eax, dword [esp + 0xc]
add eax, 0xfffffff4
push eax
call fcn.00426ac0
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x410
ret
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x119]
mov byte [esp + 0x118], 0
rep stosd dword es:[edi], eax
mov ecx, dword [0x43b3b8]
push ebx
stosw word es:[edi], ax
push ecx
push ebp
lea edx, [esp + 0x124]
push str.GlobalRising_Setup__s__d
push edx
stosb byte es:[edi], al
call fcn.00426b7c
mov edi, dword [sym.imp.KERNEL32.dll_CreateMutexA]
add esp, 0x10
lea eax, [esp + 0x11c]
push eax
push 0
push 0
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call ebx
cmp eax, 3
jne 0x422ade
mov ecx, dword [0x43b3b8]
lea edx, [esp + 0x11c]
push ecx
push ebp
push str.Rising_Setup__s__d
push edx
call fcn.00426b7c
add esp, 0x10
lea eax, [esp + 0x11c]
push eax
push 0
push 0
call edi
mov esi, eax
call ebx
cmp eax, 0xb7
pop ebx
je 0x422af7
cmp eax, 5
je 0x422af7
mov eax, esi
pop edi
pop esi
pop ebp
add esp, 0x410
ret
push str.Rav.ini
push 0
push str.setupdlg
push str.HWND
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
je 0x422b19
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x410
ret