Function at 0x40f160
Capabilities:
Check if file exists
Delete registry value
Get file attributes
Persist via run registry key
Query environment variable
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47dd6d
mov eax, dword fs:[0]
push eax
sub esp, 0x440
mov eax, dword [0x4ac084]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x440], edx
mov edi, ecx
mov dword [ebp - 0x44c], edi
call fcn.0040f0c0
test eax, eax
je 0x40f79e
call fcn.00403450
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x40f1c5
push 0x80004005
call fcn.004039a0
mov eax, dword [ecx]
call dword [eax + 0xc]
lea ebx, [eax + 0x10]
mov dword [ebp - 0x420], ebx
or esi, 0xffffffff
mov dword [ebp - 4], 0
test edi, edi
je 0x40f2ad
lea edx, [ebp - 0x420]
mov ecx, str.29650533_2E1B_4517_9D0C_B7243F12DF94
call fcn.00446db0
test eax, eax
jne 0x40f209
lea edx, [ebp - 0x420]
mov ecx, str.299FFF17_0FDF_47F4_A894_1DADF0D98007
call fcn.00446db0
mov ebx, dword [ebp - 0x420]
cmp dword [ebx - 0xc], 0
je 0x40f2a3
lea eax, [ebp - 0x420]
mov edx, 0x491ea8
push eax
lea ecx, [ebp - 0x42c]
call fcn.0040fae0
push str.PCKeeper.exe___autorun
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x430]
call fcn.00409520
add esp, 8
push eax
lea ecx, [ebp - 0x420]
mov byte [ebp - 4], 2
call fcn.00402e10
mov byte [ebp - 4], 1
mov eax, esi
mov edx, dword [ebp - 0x430]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40f27a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov eax, esi
mov edx, dword [ebp - 0x42c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40f29b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, dword [ebp - 0x420]
jmp 0x40f2ad
mov dword [ebp - 0x44c], 0
call fcn.00403450
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x40f2c9
push 0x80004005
call fcn.004039a0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x424], edi
cmp dword [ebp - 0x440], 0
mov byte [ebp - 4], 3
je 0x40f3b2
lea edx, [ebp - 0x424]
mov ecx, str.6D62ECA7_CC77_47AF_AA5C_FE6B72350139
call fcn.00446db0
test eax, eax
jne 0x40f30e
lea edx, [ebp - 0x424]
mov ecx, str.FE88A67B_BBC2_49A8_B12F_3504144E1044
call fcn.00446db0
mov edi, dword [ebp - 0x424]
cmp dword [edi - 0xc], 0
je 0x40f3a8
lea eax, [ebp - 0x424]
mov edx, 0x491ea8
push eax
lea ecx, [ebp - 0x42c]
call fcn.0040fae0
push str.PCKAV.exe___autorun
mov edx, eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x430]
call fcn.00409520
add esp, 8
push eax
lea ecx, [ebp - 0x424]
mov byte [ebp - 4], 5
call fcn.00402e10
mov byte [ebp - 4], 4
mov eax, esi
mov edx, dword [ebp - 0x430]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40f37f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 3
mov eax, esi
mov edx, dword [ebp - 0x42c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40f3a0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x424]
jmp 0x40f3b2
mov dword [ebp - 0x440], 0
lea eax, [ebp - 0x438]
mov dword [ebp - 0x438], 0
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 0x20119
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionProfileList
push reloc.OLEAUT32.dll_SysReAllocString
call eax
test eax, eax
jne 0x40f767
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x444]
mov dword [ebp - 0x444], 0xff
push eax
lea eax, [ebp - 0x210]
mov dword [ebp - 0x430], 1
push eax
push 1
push dword [ebp - 0x438]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x40f767
nop
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40f430
sub ecx, edx
sar ecx, 1
cmp ecx, 9
jb 0x40f722
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x434]
push eax
push 0x20119
push 0
lea eax, [ebp - 0x210]
mov dword [ebp - 0x434], 0
push eax
push SysStringLen
call esi
test eax, eax
je 0x40f648
lea eax, [ebp - 0x43c]
mov dword [ebp - 0x43c], 0
push eax
push 0x20119
push 0
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x438]
call esi
test eax, eax
jne 0x40f648
mov dword [ebp - 0x42c], eax
call fcn.00403450
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x40f1bb
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x428], esi
lea eax, [ebp - 0x448]
mov byte [ebp - 4], 6
push eax
lea eax, [ebp - 0x418]
mov dword [ebp - 0x448], 0x208
push eax
lea eax, [ebp - 0x42c]
push eax
push 0
push str.ProfileImagePath
push dword [ebp - 0x43c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40f5b0
mov eax, dword [ebp - 0x448]
cmp eax, 0x206
jae 0x40f5b0
and eax, 0xfffffffe
cmp eax, 0x208
jae 0x40f7ba
xor ecx, ecx
mov word [ebp + eax - 0x418], cx
mov eax, dword [ebp - 0x42c]
cmp eax, 2
jne 0x40f593
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x104
or eax, ecx
jge 0x40f571
push 0x104
lea ecx, [ebp - 0x428]
call fcn.00403880
mov esi, dword [ebp - 0x428]
push 0x104
push esi
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x428]
call fcn.00402dc0
jmp 0x40f5b0
cmp eax, 1
jne 0x40f5b0
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x428]
call fcn.00403a70
mov esi, dword [ebp - 0x428]
cmp dword [esi - 0xc], 0
je 0x40f61a
push str.NTUSER.DAT
lea ecx, [ebp - 0x428]
call fcn.00409600
mov esi, dword [ebp - 0x428]
push esi
mov dword [ebp - 0x434], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40f61a
push esi
lea eax, [ebp - 0x210]
push eax
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
test eax, eax
jne 0x40f61a
lea eax, [ebp - 0x434]
push eax
push 0x20119
push 0
lea eax, [ebp - 0x210]
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push SysStringLen
call eax
push dword [ebp - 0x43c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 3
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40f642
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov eax, dword [ebp - 0x434]
test eax, eax
je 0x40f722
lea ecx, [ebp - 0x41c]
mov dword [ebp - 0x41c], 0
push ecx
push 0x10102
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push eax
call esi
test eax, eax
jne 0x40f716
mov ecx, dword [ebp - 0x41c]
test ecx, ecx
je 0x40f716
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp dword [ebp - 0x44c], eax
je 0x40f6d9
push str.PCKeeper2
push ecx
call esi
cmp dword [ebp + 8], 0
je 0x40f6c6
mov eax, dword [ebx - 0xc]
add eax, eax
push eax
push ebx
push 1
push 0
push str.PCKeeperLive
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x40f6d3
push str.PCKeeperLive
push dword [ebp - 0x41c]
call esi
mov ecx, dword [ebp - 0x41c]
cmp dword [ebp - 0x440], 0
je 0x40f70f
cmp dword [ebp + 0xc], 0
je 0x40f701
mov eax, dword [edi - 0xc]
add eax, eax
push eax
push edi
push 1
push 0
push 0x4920b4
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x40f709
push 0x4920b4
push ecx
call esi
mov ecx, dword [ebp - 0x41c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x434]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x430]
lea ecx, [ebp - 0x444]
push 0
push 0
push 0
push 0
push ecx
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x444], 0xff
inc eax
push ecx
push eax
push dword [ebp - 0x438]
mov dword [ebp - 0x430], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x40f420
or esi, 0xffffffff
mov eax, esi
mov byte [ebp - 4], 0
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x40f782
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
add ebx, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lock xadd dword [ebx + 0xc], esi
dec esi
test esi, esi
jg 0x40f79e
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00458d41
mov esp, ebp
pop ebp
ret
call fcn.004593b0
int3