Function at 0x42f700
Capabilities:
Check if file exists
Delete registry key
Get file attributes
Set environment variable
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x526166
mov eax, dword fs:[0]
push eax
sub esp, 0xc0
mov eax, dword [0x58e5a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x9c], edi
mov dword [ebp - 0x24], eax
call fcn.00410080
mov ecx, eax
test ecx, ecx
je 0x430064
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
push str.System32_ntdll.dll
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0
call fcn.0040c680
test al, al
jne 0x42f77e
push 0x13
push str.System32_ntdll.dll
lea ecx, [ebp - 0x14]
call fcn.0040d3a0
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 1
push eax
lea eax, [ebp - 0x98]
push edi
push eax
call fcn.00415af0
add esp, 0xc
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edx, dword [ebp - 0x98]
cmp eax, 0xffffffff
sete bl
or esi, 0xffffffff
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42f7c7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x42f7e8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test bl, bl
je 0x42f7f6
mov eax, 0x57
jmp 0x430048
push 1
push str.SeRestorePrivilege
call fcn.00436ee0
add esp, 8
test al, al
jne 0x42f814
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x430048
push 1
push str.SeBackupPrivilege
call fcn.00436ee0
add esp, 8
test al, al
je 0x42f809
push str._system32config_system
lea ecx, [ebp - 0x14]
call fcn.0040c130
push eax
lea eax, [ebp - 0x98]
mov dword [ebp - 4], 2
push edi
push eax
call fcn.00415af0
add esp, 0xc
push dword [eax]
push str.autoruns.system
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
mov edx, dword [ebp - 0x98]
mov edi, eax
add edx, 0xfffffff0
mov ecx, esi
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x42f87d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x42f89c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test edi, edi
je 0x42f8a7
mov eax, edi
jmp 0x430048
xorps xmm0, xmm0
mov dword [ebp - 0x50], 0
movq qword [ebp - 0x58], xmm0
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0
push 0xf003f
push str.autoruns.system
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x58]
mov dword [ebp - 4], 3
call fcn.0041d0c0
mov edi, dword [ebp - 0x58]
mov esi, eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x43003f
push str._system32config_software
lea ecx, [ebp - 0x14]
call fcn.0040c130
push eax
push dword [ebp - 0x9c]
lea eax, [ebp - 0x98]
mov byte [ebp - 4], 4
push eax
call fcn.00415af0
add esp, 0xc
push dword [eax]
push str.autoruns.software
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
lea ecx, [ebp - 0x98]
mov esi, eax
call fcn.0040c110
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.0040c110
test esi, esi
jne 0x43003f
xorps xmm0, xmm0
mov dword [ebp - 0x5c], esi
movq qword [ebp - 0x64], xmm0
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x5c], esi
push 0xf003f
push str.autoruns.software
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 5
call fcn.0041d0c0
mov esi, eax
test esi, esi
jne 0x430035
push str._ntuser.dat
lea ecx, [ebp - 0x14]
call fcn.0040c130
push eax
mov byte [ebp - 4], 6
lea eax, [ebp - 0x98]
push dword [ebp - 0x24]
push eax
call fcn.00415af0
add esp, 0xc
push dword [eax]
push str.autoruns.user
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
lea ecx, [ebp - 0x98]
mov esi, eax
call fcn.0040c110
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 5
call fcn.0040c110
test esi, esi
jne 0x430035
xorps xmm0, xmm0
mov dword [ebp - 0x40], esi
movq qword [ebp - 0x48], xmm0
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x40], esi
push 0xf003f
push str.autoruns.user
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 7
call fcn.0041d0c0
mov esi, eax
mov eax, dword [ebp - 0x48]
test esi, esi
jne 0x43002e
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
movq qword [ebp - 0x20], xmm0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
push 0x2001f
push str.MicrosoftWindowsCurrentVersion
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x20]
push dword [ebp - 0x64]
call fcn.0041d0c0
mov esi, eax
test esi, esi
je 0x42fa6d
mov edi, dword [ebp - 0x20]
jmp 0x430021
push str.ProgramFilesDir
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.0042e130
add esp, 0xc
lea eax, [ebp - 0x7c]
mov byte [ebp - 4], 9
push eax
lea ecx, [ebp - 0x3c]
call fcn.0041b5a0
lea eax, [ebp - 0x3c]
mov ecx, 0x58f1a8
push eax
call fcn.0040bfb0
mov edx, dword [ebp - 0x28]
cmp edx, 8
jb 0x42fada
mov ecx, dword [ebp - 0x3c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42fad0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43006e
push edx
push ecx
call fcn.004d24a7
add esp, 8
push str.ProgramFilesDir__x86_
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x94]
push eax
call fcn.0042e130
add esp, 0xc
mov byte [ebp - 4], 0xa
cmp dword [ebp - 0x84], 0
jne 0x42fb0e
lea eax, [ebp - 0x7c]
push eax
lea ecx, [ebp - 0x94]
call fcn.0040bf80
lea eax, [ebp - 0x94]
push eax
lea ecx, [ebp - 0x3c]
call fcn.0041b5a0
lea eax, [ebp - 0x3c]
mov ecx, 0x58f1c0
push eax
call fcn.0040bfb0
mov edx, dword [ebp - 0x28]
cmp edx, 8
jb 0x42fb65
mov ecx, dword [ebp - 0x3c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42fb5b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x430073
push edx
push ecx
call fcn.004d24a7
add esp, 8
call fcn.00410620
cmp dword [eax + 0x14], 8
jb 0x42fb72
mov eax, dword [eax]
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push eax
push str.PROGRAMFILES
call esi
call fcn.00410620
cmp dword [eax + 0x14], 8
jb 0x42fb8d
mov eax, dword [eax]
push eax
push str.ProgramW6432
call esi
call fcn.004106c0
cmp dword [eax + 0x14], 8
jb 0x42fba2
mov eax, dword [eax]
push eax
push str.PROGRAMFILES_X86_
call esi
push str.CommonFilesDir
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.0042e130
add esp, 0xc
lea ecx, [ebp - 0x7c]
push eax
call fcn.0040bfb0
lea ecx, [ebp - 0x3c]
call fcn.00409020
cmp dword [ebp - 0x68], 8
lea eax, [ebp - 0x7c]
cmovae eax, dword [ebp - 0x7c]
push eax
push str.CommonProgramFiles
call esi
push str.CommonFilesDir__x86_
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.0042e130
add esp, 0xc
lea ecx, [ebp - 0x7c]
push eax
call fcn.0040bfb0
lea ecx, [ebp - 0x3c]
call fcn.00409020
cmp dword [ebp - 0x68], 8
lea eax, [ebp - 0x7c]
cmovae eax, dword [ebp - 0x7c]
push eax
push str.CommonProgramFiles_x86_
call esi
push str.Common6432Dir
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.0042e130
add esp, 0xc
lea ecx, [ebp - 0x7c]
push eax
call fcn.0040bfb0
lea ecx, [ebp - 0x3c]
call fcn.00409020
cmp dword [ebp - 0x68], 8
lea eax, [ebp - 0x7c]
cmovae eax, dword [ebp - 0x7c]
push eax
push str.CommonProgramW6432
call esi
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x42fc66
push eax
call ebx
mov dword [ebp - 0x20], 0
push 0x2001f
push str.MicrosoftWindows_NTCurrentVersion
push dword [ebp - 0x64]
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x1c], 0
call fcn.0041d0c0
push str.SystemRoot
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.0042e130
add esp, 0xc
lea eax, [ebp - 0x3c]
mov ecx, 0x58f160
push eax
call fcn.0040bfb0
mov edx, dword [ebp - 0x28]
cmp edx, 8
jb 0x42fcdf
mov ecx, dword [ebp - 0x3c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42fcd5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x430078
push edx
push ecx
call fcn.004d24a7
add esp, 8
call fcn.00410340
cmp dword [eax + 0x14], 8
jb 0x42fcec
mov eax, dword [eax]
push eax
push str.SystemRoot
call esi
call fcn.00410340
cmp dword [eax + 0x14], 8
jb 0x42fd01
mov eax, dword [eax]
push eax
push str.WinDir
call esi
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x42fd1a
push eax
call ebx
mov dword [ebp - 0x20], 0
push 0x560fa0
mov dword [ebp - 0x1c], 0
call fcn.00410340
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.00410940
add esp, 0xc
lea eax, [ebp - 0x3c]
mov ecx, 0x58f178
push eax
call fcn.0040bfb0
mov edx, dword [ebp - 0x28]
cmp edx, 8
jb 0x42fd80
mov ecx, dword [ebp - 0x3c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42fd76
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x43007d
push edx
push ecx
call fcn.004d24a7
add esp, 8
sub esp, 0x18
mov esi, esp
push str.Syswow64
call fcn.00410340
push eax
push esi
call fcn.00410940
add esp, 0xc
call fcn.00410800
add esp, 0x18
call fcn.00410490
cmp dword [eax + 0x14], 8
jb 0x42fdae
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x42fdd4
sub esp, 0x18
mov esi, esp
call fcn.004103b0
push eax
mov ecx, esi
call fcn.0041b5a0
call fcn.00410800
add esp, 0x18
push 0x2001f
push str.Select
push edi
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x4c], 0xffffffff
call fcn.0041d0c0
lea eax, [ebp - 0x4c]
push eax
push 0x5660ec
lea ecx, [ebp - 0x20]
call fcn.0041d1d0
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 0
call fcn.0041a480
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x14]
push dword [ebp - 0x4c]
push str.RegistryMachine_autoruns.systemControlSet_03d
push eax
call fcn.00431d90
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x98]
push eax
push 0
push 0xf003f
push 3
push 0
push 0
push str.CurrentControlSet
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x42fe97
mov eax, dword [ebp - 0x14]
mov edx, eax
lea esi, [edx + 2]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x42fe56
sub edx, esi
sar edx, 1
lea ecx, [edx + edx]
push ecx
push eax
push 6
push 0
push str.SymbolicLinkValue
push dword [ebp - 0x98]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x42fe8f
push str.CurrentControlSet
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 0x98]
call ebx
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x42fea8
push eax
call ebx
mov dword [ebp - 0x20], 0
push 0x2001f
push str.CurrentControlSetControlSession_ManagerEnvironment
push edi
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x1c], 0
call fcn.0041d0c0
mov edi, dword [ebp - 0x20]
test edi, edi
je 0x42ffb5
push str.Path
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.0042e130
add esp, 0xc
mov byte [ebp - 4], 0xc
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x42fef7
push eax
call ebx
mov dword [ebp - 0x20], 0
push 0x2001f
push str.Environment
push dword [ebp - 0x48]
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x1c], 0
call fcn.0041d0c0
mov edi, dword [ebp - 0x20]
test edi, edi
je 0x42ff7d
push str.Path
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0xb4]
push eax
call fcn.0042e130
push eax
mov edx, 0x5610f4
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0xcc]
call fcn.0040d940
add esp, 0x10
mov byte [ebp - 4], 0xe
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x42ff56
mov eax, dword [eax]
push ecx
push eax
lea ecx, [ebp - 0x3c]
call fcn.0040e5d0
lea ecx, [ebp - 0xcc]
call fcn.00409020
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 0xc
call fcn.00409020
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x3c]
push eax
call fcn.00436910
add esp, 4
lea ecx, [ebp - 0x3c]
push eax
call fcn.0040bf80
cmp dword [ebp - 0x28], 8
lea eax, [ebp - 0x3c]
cmovae eax, dword [ebp - 0x3c]
push eax
push str.Path
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0xb
call fcn.00409020
push dword [ebp - 0x9c]
mov ecx, 0x58f120
mov byte [0x598248], 1
call fcn.004082b0
push 0xffffffffffffffff
push 0x5c
mov ecx, 0x58f120
call fcn.00425710
push eax
push 0
lea eax, [ebp - 0xb4]
mov ecx, 0x58f120
push eax
call fcn.00412e20
push eax
mov ecx, 0x58f120
call fcn.0040bfb0
lea ecx, [ebp - 0xb4]
call fcn.00409020
lea ecx, [ebp - 0x14]
xor esi, esi
call fcn.0040c110
lea ecx, [ebp - 0x94]
call fcn.00409020
lea ecx, [ebp - 0x7c]
call fcn.00409020
test edi, edi
je 0x430028
push edi
call ebx
mov eax, dword [ebp - 0x48]
mov edi, dword [ebp - 0x58]
test eax, eax
je 0x430035
push eax
call ebx
mov eax, dword [ebp - 0x64]
test eax, eax
je 0x43003f
push eax
call ebx
test edi, edi
je 0x430046
push edi
call ebx
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d2a60
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.0040fbc0
call fcn.004e0791
call fcn.004e0791
call fcn.004e0791
call fcn.004e0791
int3