Function at 0x418990
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
jmp 0x418990
mov eax, 0x147c
call fcn.0041be90
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0x1478], eax
push esi
push edi
xor edi, edi
push 0x200
lea eax, [esp + 0x24c]
push edi
mov esi, 1
push eax
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], 0x104
call fcn.0041be10
push 0x208
lea ecx, [esp + 0x458]
push edi
push ecx
call fcn.0041be10
push 0x208
lea edx, [esp + 0x5c]
push edi
push edx
call fcn.0041be10
xor eax, eax
push 0x200
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov word [esp + 0x64], ax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov word [esp + 0x50], ax
lea eax, [esp + 0x678]
push edi
push eax
call fcn.0041be10
push 0x410
lea ecx, [esp + 0x10a4]
push edi
push ecx
call fcn.0041be10
push 0x410
lea edx, [esp + 0xca0]
push edi
push edx
call fcn.0041be10
add esp, 0x48
push 0x410
lea eax, [esp + 0x854]
push edi
push eax
call fcn.0041be10
add esp, 0xc
cmp dword [0x44fe24], 3
lea ecx, [esp + 8]
push ecx
push 0x20019
push edi
push 0x435660
jl 0x418aec
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x418ad3
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x44c]
push eax
lea ecx, [esp + 0x18]
push ecx
push edi
push str.Common_Programs
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x418b15
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x1478]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x147c
ret
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x418ad3
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x44c]
push eax
lea ecx, [esp + 0x18]
push ecx
push edi
push str.Programs
jmp 0x418ab9
mov ecx, dword [esp + 8]
push ebp
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x10]
push edx
push str.setup.ini
call fcn.004010e1
mov ebp, eax
add esp, 8
cmp ebp, edi
jne 0x418b53
pop ebp
pop edi
mov eax, esi
pop esi
mov ecx, dword [esp + 0x1478]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x147c
ret
cmp dword [0x45167c], esi
jne 0x418baf
mov eax, dword [esp + 0x10]
push str.GSCFolderName
push eax
push ebp
call fcn.0040120d
add esp, 0xc
cmp eax, edi
je 0x418baf
push 0x200
lea ecx, [esp + 0x250]
push ecx
push eax
call fcn.004011fe
add esp, 0xc
test eax, eax
jne 0x418baf
push ebp
call fcn.004012bc
add esp, 4
pop ebp
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x1478]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x147c
ret
cmp dword [esp + 0x10], edi
mov esi, ebp
jbe 0x418e02
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpW]
jmp 0x418bc6
xor edi, edi
cmp word [esi], 0x47
jne 0x418dee
push 8
push esi
lea edx, [esp + 0x3c]
push 9
push edx
call fcn.0041c29b
add esp, 0x10
lea eax, [esp + 0x34]
push eax
push str.GSCInfo
mov word [esp + 0x4c], di
call ebx
test eax, eax
jne 0x418dee
push 0x200
lea ecx, [esp + 0x65c]
push ecx
add esi, 0x10
push esi
call fcn.004011fe
push 0x410
lea edx, [esp + 0x1088]
push edx
push eax
call fcn.004011fe
mov esi, eax
lea eax, [esp + 0x1090]
push eax
call fcn.0040115e
push 0x410
lea ecx, [esp + 0xc88]
push ecx
push esi
call fcn.004011fe
lea edx, [esp + 0xc90]
push edx
mov esi, eax
call fcn.0040115e
push 0x410
lea eax, [esp + 0x888]
push eax
push esi
call fcn.004011fe
lea ecx, [esp + 0x890]
push ecx
mov esi, eax
call fcn.0040115e
xor eax, eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], eax
mov word [esp + 0x6c], ax
mov eax, esi
sub eax, ebp
mov edx, eax
sar edx, 1
add esp, 0x3c
cmp edx, dword [esp + 0x14]
jae 0x418d12
mov edi, eax
cmp word [esi], 0x49
jne 0x418ce9
push 8
push esi
lea eax, [esp + 0x28]
push 9
push eax
call fcn.0041c29b
add esp, 0x10
push str.INST_MAX
lea ecx, [esp + 0x24]
push ecx
call ebx
test eax, eax
je 0x418cfb
push str.INST_MIN
lea edx, [esp + 0x24]
push edx
call ebx
test eax, eax
je 0x418d05
push 0x434c40
lea eax, [esp + 0x24]
push eax
call ebx
test eax, eax
je 0x418d0f
add edi, 2
mov ecx, edi
sar ecx, 1
add esi, 2
cmp ecx, dword [esp + 0x14]
jb 0x418ca1
jmp 0x418d12
add esi, 0x10
mov edi, 3
jmp 0x418d17
add esi, 0x10
mov edi, 7
jmp 0x418d17
add esi, 0x10
mov edi, 1
push 0x208
lea edx, [esp + 0x4c]
push 0
push edx
call fcn.0041be10
add esp, 0xc
lea eax, [esp + 0x450]
push eax
lea ecx, [esp + 0x4c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea edx, [esp + 0x250]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x418d73
push 0x435bfc
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea ecx, [esp + 0x250]
push ecx
lea edx, [esp + 0x4c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [esp + 0x48]
push eax
call fcn.004012df
add esp, 4
push 0x435bfc
lea ecx, [esp + 0x4c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea edx, [esp + 0x658]
push edx
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x436500
lea ecx, [esp + 0x4c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push edi
lea edx, [esp + 0x85c]
push edx
lea eax, [esp + 0xc70]
push eax
lea ecx, [esp + 0x54]
push ecx
lea edx, [esp + 0x1088]
push edx
call fcn.00401037
add esp, 0x14
test eax, eax
je 0x418df1
lea eax, [esp + 0x48]
push 0
push eax
call fcn.0040114a
add esp, 8
jmp 0x418df1
add esi, 2
mov ecx, esi
sub ecx, ebp
sar ecx, 1
cmp ecx, dword [esp + 0x14]
jb 0x418bc4
pop ebx
push ebp
call fcn.004012bc
mov ecx, dword [esp + 0x1488]
add esp, 4
pop ebp
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.0041bdf4
add esp, 0x147c
ret