Function at 0x40baea
Capabilities:
Create process on windows
Delete registry key
Get file size
Read file on windows

Disassembly:
push 0x1a4
mov eax, 0x451470
call fcn.0044d453
mov eax, dword [ebp + 8]
mov dword [ebp - 0xd4], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
fldz
fstp qword [ebp - 0x100]
mov dword [ebp - 0xf8], ebx
mov byte [ebp - 4], 1
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
mov dword [ebp - 0xc8], ebx
call fcn.00406215
add eax, 0x10
mov dword [ebp - 0xec], eax
mov byte [ebp - 4], 2
mov eax, dword [eax - 0xc]
cmp eax, ebx
jne 0x40bb6a
lea esi, [ebp - 0xcc]
call fcn.004192a0
lea edi, [ebp - 0xec]
mov byte [ebp - 4], 3
call fcn.004081c8
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0xcc]
add eax, 0xfffffff0
call fcn.00402c12
push ebx
push 0x80
push 3
push ebx
push 1
push connect
push dword [ebp - 0xec]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0xc4], esi
cmp esi, 0xffffffff
je 0x40bccc
push ebx
push esi
mov dword [ebp - 0xbc], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0xcc], eax
xor eax, eax
push 0x3e
mov word [ebp - 0x50], ax
lea eax, [ebp - 0x4e]
push ebx
push eax
call fcn.00438e30
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
add esp, 0xc
push ebx
lea eax, [ebp - 0xbc]
push eax
push 0x40
lea eax, [ebp - 0x50]
push eax
push esi
call edi
test eax, eax
je 0x40bcb8
mov eax, dword [ebp - 0x14]
push ebx
push ebx
add eax, 0xfffffffc
push eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0xd0], ebx
call esi
push ebx
lea eax, [ebp - 0xbc]
push eax
push 4
lea eax, [ebp - 0xd0]
push eax
push dword [ebp - 0xc4]
call edi
test eax, eax
je 0x40bcb8
mov eax, dword [ebp - 0xd0]
cmp eax, ebx
jbe 0x40bcb8
cmp eax, dword [ebp - 0xcc]
jae 0x40bcb8
push ebx
push ebx
push eax
push dword [ebp - 0xc4]
call esi
push ebx
lea eax, [ebp - 0xbc]
push eax
push 4
lea eax, [ebp - 0xc0]
push eax
push dword [ebp - 0xc4]
mov dword [ebp - 0xc0], ebx
call edi
test eax, eax
je 0x40bcb8
mov eax, dword [ebp - 0xcc]
sub eax, dword [ebp - 0xd0]
cmp dword [ebp - 0xc0], eax
jae 0x40bcb8
push dword [ebp - 0xc0]
call fcn.00438db9
pop ecx
push ebx
mov esi, eax
lea eax, [ebp - 0xbc]
push eax
push dword [ebp - 0xc0]
push esi
push dword [ebp - 0xc4]
call edi
test eax, eax
je 0x40bcb8
mov ecx, esi
lea edi, [ebp - 0x100]
call fcn.0041acb0
test al, al
je 0x40bcb8
mov dword [ebp - 0xc8], 1
push dword [ebp - 0xc4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0xc8], ebx
jne 0x40bcfd
mov eax, dword [ebp - 0xec]
add eax, 0xfffffff0
call fcn.00402c12
lea ecx, [ebp - 0x100]
mov byte [ebp - 4], bl
call fcn.0041a0c0
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
call fcn.00402c12
xor eax, eax
call fcn.0044d4d6
ret 8
mov dword [ebp - 0x138], ebx
mov dword [ebp - 0x134], ebx
mov dword [ebp - 0x130], ebx
mov dword [ebp - 0x128], ebx
mov dword [ebp - 0x124], ebx
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov edx, str.setup
lea ecx, [ebp - 0x100]
mov byte [ebp - 4], 5
call fcn.0041a620
mov edx, str.root
mov ecx, eax
call fcn.0041a620
call fcn.00419f40
lea ecx, [ebp - 0x30]
call fcn.00420710
mov edi, 0xfde9
push edi
lea ecx, [ebp - 0x138]
push ecx
mov ebx, eax
call fcn.004186b0
lea ecx, [ebp - 0xe8]
push ecx
mov ecx, eax
call fcn.004061b9
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0xe8]
xor ebx, ebx
cmp dword [eax - 0xc], ebx
jne 0x40bdde
add eax, 0xfffffff0
call fcn.00402c12
lea esi, [ebp - 0x30]
call fcn.004203d0
lea esi, [ebp - 0x138]
call fcn.004185c0
mov eax, dword [ebp - 0xec]
add eax, 0xfffffff0
call fcn.00402c12
xor esi, esi
lea ecx, [ebp - 0x100]
mov byte [ebp - 4], bl
call fcn.0041a0c0
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
call fcn.00402c12
mov eax, esi
jmp 0x40bcf5
lea esi, [ebp - 0x148]
call fcn.004050fc
lea eax, [ebp - 0xc8]
push 0x458a9c
push eax
lea ecx, [ebp - 0xe8]
mov byte [ebp - 4], 7
call fcn.00404e82
mov byte [ebp - 4], 8
mov eax, dword [eax]
mov ecx, esi
push ecx
mov ecx, eax
call fcn.00421010
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0xc8]
add esp, 0xc
add eax, 0xfffffff0
call fcn.00402c12
lea eax, [ebp - 0xc8]
push eax
mov ecx, str.PrivateBuild
call fcn.004061b9
mov eax, esi
push eax
lea ecx, [ebp - 0xc8]
mov byte [ebp - 4], 9
call fcn.00405127
push dword [eax]
call fcn.0043b31f
pop ecx
mov ecx, dword [ebp - 0xd4]
mov dword [ecx + 0x12d4], eax
mov eax, dword [ebp - 0xc8]
add eax, 0xfffffff0
call fcn.00402c12
mov dword [ebp - 0xe4], ebx
mov dword [ebp - 0xe0], ebx
mov dword [ebp - 0xdc], ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstalliToolsAVM
mov esi, 0x20019
push connect
mov eax, esi
lea ebx, [ebp - 0xe4]
mov byte [ebp - 4], 0xa
call fcn.00408629
test eax, eax
jne 0x40bee1
and dword [ebp - 0xc8], eax
lea eax, [ebp - 0xc8]
push eax
push str.Version
mov eax, ebx
push eax
call fcn.00408525
test eax, eax
jne 0x40bee1
mov ecx, dword [ebp - 0xc8]
test ecx, ecx
je 0x40bee1
mov eax, dword [ebp - 0xd4]
cmp dword [eax + 0x12d4], 0
jne 0x40bee1
mov dword [eax + 0x12d4], ecx
push str.SOFTWAREThinkSkyiToolsAVM
push connect
mov eax, esi
lea ebx, [ebp - 0xe4]
call fcn.00408629
test eax, eax
jne 0x40bf30
and dword [ebp - 0xc8], eax
lea eax, [ebp - 0xc8]
push eax
push str.Channel
mov eax, ebx
push eax
call fcn.00408525
test eax, eax
jne 0x40bf30
mov eax, dword [ebp - 0xc8]
test eax, eax
je 0x40bf30
mov ecx, dword [ebp - 0xd4]
mov dword [ecx + 0x12d8], eax
push ecx
mov eax, esp
mov dword [ebp - 0xf0], esp
push eax
mov ecx, str.ck_WxS
call fcn.004061b9
mov esi, dword [ebp - 0xd4]
push esi
call fcn.0040d845
mov ebx, str.uninstrun
mov edx, ebx
lea ecx, [ebp - 0x100]
call fcn.0041a890
test al, al
je 0x40c0e6
cmp dword [esi + 0x454], 0
jne 0x40c0e6
mov edx, ebx
lea ecx, [ebp - 0x100]
call fcn.0041a620
cmp dword [eax + 8], 4
jne 0x40c0e6
and dword [ebp - 0xc0], 0
mov edx, ebx
lea ecx, [ebp - 0x100]
call fcn.0041a620
call fcn.0041a410
test eax, eax
je 0x40c0e6
jmp 0x40bfb6
mov ebx, str.uninstrun
mov eax, dword [section..data]
mov ecx, section..data
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xc4], eax
mov byte [ebp - 4], 0xb
push dword [ebp - 0xc0]
mov edx, ebx
lea ecx, [ebp - 0x100]
call fcn.0041a620
push eax
call fcn.0041a460
call fcn.00419f40
push edi
lea ecx, [ebp - 0x138]
push ecx
mov ebx, eax
call fcn.004186b0
push eax
push dword [ebp - 0xe8]
lea eax, [ebp - 0xc4]
push str._s_s
push eax
call fcn.004058ae
push 0x44
xor esi, esi
lea eax, [ebp - 0x1b0]
push esi
push eax
call fcn.00438e30
add esp, 0x1c
push 0x10
lea eax, [ebp - 0x118]
push esi
push eax
call fcn.00438e30
mov ebx, dword [ebp - 0xc4]
add esp, 0xc
cmp dword [ebx - 4], 1
jle 0x40c05c
push dword [ebx - 0xc]
lea eax, [ebp - 0xc4]
push eax
call fcn.004029db
mov ebx, dword [ebp - 0xc4]
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x1b0]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40c092
push dword [ebp - 0x118]
mov edi, dword [ebp - 0xd4]
call fcn.0040d2aa
mov edi, 0xfde9
lea esi, [ebp - 0xc4]
call fcn.00408697
push dword [ebp - 0x118]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x114]
call esi
lea eax, [ebx - 0x10]
mov byte [ebp - 4], 0xa
call fcn.00402c12
inc dword [ebp - 0xc0]
mov edx, str.uninstrun
lea ecx, [ebp - 0x100]
call fcn.0041a620
call fcn.0041a410
cmp dword [ebp - 0xc0], eax
jb 0x40bfb1
mov eax, dword [section..data]
mov esi, section..data
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xc8], eax
lea eax, [ebp - 0xc8]
push 0x458c04
push eax
mov byte [ebp - 4], 0xc
call fcn.004058ae
mov eax, dword [ebp - 0xc8]
pop ecx
add eax, 0xfffffff0
mov dword [ebp - 0xf0], esp
mov ebx, esp
mov dword [ebp - 0xf0], eax
call fcn.00406215
push dword [ebp - 0xd4]
add eax, 0x10
mov dword [ebx], eax
call fcn.0040d845
mov edx, str.setup
lea ecx, [ebp - 0x100]
call fcn.0041a620
mov edx, str.shortcut
mov ecx, eax
call fcn.0041a620
mov edx, str.desktop
mov ecx, eax
call fcn.0041a620
and dword [ebp - 0xbc], 0
mov dword [ebp - 0xc4], eax
call fcn.0041a410
test eax, eax
je 0x40c256
push dword [ebp - 0xbc]
push dword [ebp - 0xc4]
call fcn.0041a460
mov edx, str.name
mov ecx, eax
call fcn.0041a620
call fcn.00419f40
push edi
lea ecx, [ebp - 0x138]
push ecx
mov ebx, eax
call fcn.004186b0
lea ecx, [ebp - 0xcc]
push ecx
mov ecx, eax
call fcn.004061b9
mov byte [ebp - 4], 0xd
push dword [ebp - 0xbc]
push dword [ebp - 0xc4]
call fcn.0041a460
mov edx, str.file
mov ecx, eax
call fcn.0041a620
call fcn.00419f40
push edi
lea ecx, [ebp - 0x138]
push ecx
mov ebx, eax
call fcn.004186b0
lea ecx, [ebp - 0xd0]
push ecx
mov ecx, eax
call fcn.004061b9
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0xcc]
cmp dword [ecx - 0xc], 0
je 0x40c219
call fcn.004214b0
mov eax, dword [ebp - 0xd0]
add eax, 0xfffffff0
call fcn.00402c12
mov byte [ebp - 4], 0xc
mov eax, dword [ebp - 0xcc]
add eax, 0xfffffff0
call fcn.00402c12
mov eax, dword [ebp - 0xc4]
inc dword [ebp - 0xbc]
call fcn.0041a410
cmp dword [ebp - 0xbc], eax
jb 0x40c182
mov edx, str.setup
lea ecx, [ebp - 0x100]
call fcn.0041a620
mov edx, str.shortcut
mov ecx, eax
call fcn.0041a620
mov edx, str.taskbar
mov ecx, eax
call fcn.0041a620
and dword [ebp - 0xbc], 0
mov dword [ebp - 0xcc], eax
call fcn.0041a410
test eax, eax
je 0x40c3fa
push dword [ebp - 0xbc]
push dword [ebp - 0xcc]
call fcn.0041a460
mov edx, str.name
mov ecx, eax
call fcn.0041a620
call fcn.00419f40
push edi
lea ecx, [ebp - 0x138]
push ecx
mov ebx, eax
call fcn.004186b0
lea ecx, [ebp - 0xc0]
push ecx
mov ecx, eax
call fcn.004061b9
mov byte [ebp - 4], 0xf
push dword [ebp - 0xbc]
push dword [ebp - 0xcc]
call fcn.0041a460
mov edx, str.file
mov ecx, eax
call fcn.0041a620
call fcn.00419f40
push edi
lea ecx, [ebp - 0x138]
push ecx
mov ebx, eax
call fcn.004186b0
lea ecx, [ebp - 0xd8]
push ecx
mov ecx, eax
call fcn.004061b9
mov byte [ebp - 4], 0x10
mov eax, dword [ebp - 0xc0]
xor ebx, ebx
cmp dword [eax - 0xc], ebx
je 0x40c3bd
call fcn.0040c822
test eax, eax
je 0x40c3b1
mov eax, dword [section..data]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xd0], eax
lea eax, [ebp - 0x108]
push eax
mov byte [ebp - 4], 0x11
call fcn.00419b30
pop ecx
mov byte [ebp - 4], 0x12
push dword [ebp - 0xc0]
push dword [eax]
lea eax, [ebp - 0xd0]
push str._s_s.lnk
push eax
call fcn.004058ae
mov eax, dword [ebp - 0x108]
add esp, 0x10
add eax, 0xfffffff0
call fcn.00402c12
push ebx
push ebx
push ebx
push dword [ebp - 0xd0]
push str.taskbarunpin
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov byte [ebp - 4], 0x10
mov eax, dword [ebp - 0xd0]
add eax, 0xfffffff0
call fcn.00402c12
push dword [ebp - 0xc0]
call fcn.004215d0
pop ecx
mov eax, dword [ebp - 0xd8]
add eax, 0xfffffff0
call fcn.00402c12
mov byte [ebp - 4], 0xc
mov eax, dword [ebp - 0xc0]
add eax, 0xfffffff0
call fcn.00402c12
mov eax, dword [ebp - 0xcc]
inc dword [ebp - 0xbc]
call fcn.0041a410
cmp dword [ebp - 0xbc], eax
jb 0x40c298
mov eax, dword [section..data]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xbc], eax
mov byte [ebp - 4], 0x13
mov eax, dword [ebp - 0xc4]
and dword [ebp - 0xc0], 0
call fcn.0041a410
test eax, eax
je 0x40c47e
push dword [ebp - 0xc0]
push dword [ebp - 0xc4]
call fcn.0041a460
mov edx, str.file
mov ecx, eax
call fcn.0041a620
call fcn.00419f40
push edi
lea ecx, [ebp - 0x138]
push ecx
mov ebx, eax
call fcn.004186b0
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.00402b88
mov eax, dword [ebp - 0xc4]
inc dword [ebp - 0xc0]
call fcn.0041a410
cmp dword [ebp - 0xc0], eax
jb 0x40c427
mov eax, dword [section..data]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xd0], eax
mov eax, dword [ebp - 0xd4]
mov byte [ebp - 4], 0x14
push dword [ebp - 0xbc]
push dword [eax + 0x478]
lea eax, [ebp - 0xd0]
push str._s_s
push eax
call fcn.004058ae
add esp, 0x10
push 0x458884
push 0x458888
lea eax, [ebp - 0xd0]
push eax
call fcn.0040db21
lea esi, [ebp - 0x104]
call fcn.00419bb0
mov byte [ebp - 4], 0x15
mov eax, dword [section..data]
mov ecx, section..data
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xcc], eax
push 0x4572b0
mov byte [ebp - 4], 0x16
push dword [ebp - 0x104]
lea eax, [ebp - 0xcc]
push str._sThinkSky_s
push eax
call fcn.004058ae
mov ecx, dword [ebp - 0xcc]
call fcn.00418e90
add esp, 0xc
mov eax, esp
mov dword [ebp - 0xd8], esp
push eax
mov ecx, 0x458c38
call fcn.004061b9
push dword [ebp - 0xd4]
call fcn.0040d845
call fcn.0040b9b7
push ecx
mov eax, esp
mov dword [ebp - 0xd8], esp
push eax
mov ecx, str.ck_W_Rd
call fcn.004061b9
push dword [ebp - 0xd4]
call fcn.0040d845
lea esi, [ebp - 0xb8]
call fcn.00418060
mov byte [ebp - 4], 0x17
mov eax, dword [ebp - 0xe8]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0xd8], esp
mov esi, esp
call fcn.00406215
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x100]
push eax
push dword [ebp - 0xd4]
lea eax, [ebp - 0x168]
push eax
call fcn.0040e15f
push ecx
push ecx
mov dword [ebp - 0xd8], esp
mov edi, esp
mov byte [ebp - 4], 0x18
lea eax, [ebp - 0x168]
lea ebx, [ebp - 0x158]
call fcn.0040e238
mov eax, ebx
lea ebx, [ebp - 0x118]
mov byte [ebp - 4], 0x19
call fcn.0040e238
mov byte [ebp - 4], 0x1a
call fcn.0040e74b
mov esi, eax
mov dword [ebp - 0xd8], esi
test esi, esi
je 0x40c607
mov byte [ebp - 4], 0x1e
lea ebx, [esi + 4]
lea eax, [ebp - 0x118]
mov dword [esi], 0x458f84
call fcn.0040e238
mov eax, dword [ebp - 0x10c]
add eax, 0xfffffff0
mov dword [edi + 0x10], esi
call fcn.00402c12
mov eax, dword [ebp - 0x14c]
add eax, 0xfffffff0
call fcn.00402c12
mov byte [ebp - 4], 0x17
mov eax, dword [ebp - 0x15c]
add eax, 0xfffffff0
call fcn.00402c12
lea edi, [ebp - 0xb8]
call fcn.00418290
mov eax, edi
call fcn.00418420
push ecx
mov eax, esp
mov dword [ebp - 0xd8], esp
push eax
mov ecx, str.ck_W
call fcn.004061b9
push dword [ebp - 0xd4]
call fcn.0040d845
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push connect
mov eax, 0x2001f
lea ebx, [ebp - 0xe4]
call fcn.00408629
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x40c756
mov esi, dword [ebp - 0xdc]
xor ebx, ebx
cmp esi, ebx
je 0x40c708
cmp dword [esi], ebx
je 0x40c6d4
push 0x458308
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, ebx
je 0x40c6ea
push str.RegDeleteKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x40c6ea
push ebx
push dword [esi]
push ebx
push ebx
push str.iToolsAVM
push dword [ebp - 0xe4]
call eax
jmp 0x40c6ea
cmp dword [esi + 4], ebx
je 0x40c6ea
push str.iToolsAVM
push dword [ebp - 0xe4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp dword [ebp - 0xe4], ebx
je 0x40c700
push dword [ebp - 0xe4]
call edi
mov dword [ebp - 0xe4], ebx
mov dword [ebp - 0xe0], ebx
jmp 0x40c758
cmp byte [0x466d5c], bl
jne 0x40c737
push 0x458308
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, ebx
je 0x40c730
push str.RegDeleteKeyExW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x466d60], eax
mov byte [0x466d5c], 1
mov eax, dword [0x466d60]
cmp eax, ebx
je 0x40c6d9
push ebx
push dword [ebp - 0xe0]
push str.iToolsAVM
push dword [ebp - 0xe4]
call eax
jmp 0x40c6ea
xor ebx, ebx
mov eax, dword [ebp + 0xc]
cmp dword [eax - 0xc], ebx
jne 0x40c76b
mov eax, dword [ebp - 0xd4]
call fcn.00408e91
lea eax, [ebp - 0xb8]
push eax
mov byte [ebp - 4], 0x16
call fcn.004180e0
mov eax, dword [ebp - 0xcc]
add eax, 0xfffffff0
call fcn.00402c12
mov eax, dword [ebp - 0x104]
add eax, 0xfffffff0
call fcn.00402c12
mov eax, dword [ebp - 0xd0]
add eax, 0xfffffff0
call fcn.00402c12
mov eax, dword [ebp - 0xbc]
add eax, 0xfffffff0
call fcn.00402c12
mov eax, dword [ebp - 0xf0]
call fcn.00402c12
cmp dword [ebp - 0xe4], ebx
je 0x40c7ce
push dword [ebp - 0xe4]
call edi
lea eax, [ebp - 0x148]
push eax
mov byte [ebp - 4], 6
call fcn.00403565
mov eax, dword [ebp - 0xe8]
add eax, 0xfffffff0
call fcn.00402c12
lea esi, [ebp - 0x30]
call fcn.004203d0
lea esi, [ebp - 0x138]
call fcn.004185c0
mov eax, dword [ebp - 0xec]
add eax, 0xfffffff0
call fcn.00402c12
xor esi, esi
inc esi
xor ebx, ebx
jmp 0x40bdbe