Function at 0x454921
Capabilities:
Create process on windows
Delete file

Disassembly:
push 0x3c8
mov eax, 0x4a88cb
call fcn.0049cbc1
mov edi, ecx
push 2
lea eax, [edi + 0x50]
call fcn.0041faf5
test eax, eax
je 0x454c7a
mov ecx, dword [edi + 0x918]
mov eax, dword [ecx]
call dword [eax + 0x34]
mov ebx, eax
mov eax, dword [ebp + 8]
sub eax, 0x2328
lea esi, [ebx + 8]
mov dword [ebp - 0x238], esi
je 0x454c6c
dec eax
je 0x454b79
dec eax
je 0x454b3d
dec eax
je 0x45499d
dec eax
je 0x45498f
dec eax
jne 0x45509c
push esi
call fcn.0044c740
pop ecx
jmp 0x45509c
mov edx, ebx
mov ecx, edi
call fcn.004552bd
jmp 0x45509c
mov eax, dword [0x4dff94]
mov ecx, 0x4dff94
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x244], eax
lea eax, [ebp - 0x244]
push 0x4b90d4
push eax
mov dword [ebp - 4], 4
call fcn.00408085
xor ebx, ebx
pop ecx
pop ecx
mov dword [ebp - 0x240], ebx
mov dword [ebp - 0x23c], ebx
lea eax, [ebp - 0x238]
push eax
push 0x2001f
push ebx
push 0x4b4c8c
mov byte [ebp - 4], 5
push SysReAllocStringLen
mov dword [ebp - 0x238], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x454a12
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x23c], eax
lea eax, [ebp - 0x240]
push eax
mov esi, str.kxetray_bDeleteFile
push esi
lea eax, [ebp - 0x23c]
push eax
call fcn.00401744
push dword [ebp - 0x240]
mov eax, 0x4ab8a8
push 0x4b9110
push ebx
push 0x13
push eax
push ebx
push eax
push dword [ebp - 0x244]
push dword [edi + 4]
call fcn.00409091
add esp, 0x24
test al, 1
jne 0x454a75
cmp dword [ebp - 0x23c], ebx
je 0x454a6a
push dword [ebp - 0x23c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x244]
jmp 0x454ea1
movsx eax, al
and eax, 0x10
shr eax, 4
push eax
mov dword [ebp - 0x240], eax
push esi
lea eax, [ebp - 0x23c]
push eax
call fcn.00401713
mov ecx, dword [edi + 0x918]
mov eax, dword [ecx]
call dword [eax + 0x34]
cmp dword [ebp - 0x240], ebx
mov dword [ebp - 0x238], eax
je 0x454afd
lea ebx, [eax + 8]
cmp dword [ebx + 0x250], 1
jne 0x454af6
lea eax, [ebx + 0x258]
push eax
lea esi, [ebp - 0x3d4]
call fcn.00427e99
mov byte [ebp - 4], 6
push dword [eax]
push ebx
call fcn.004547b1
lea eax, [ebp - 0x3d0]
mov byte [ebp - 4], 5
cmp dword [ebp - 0x3d4], eax
je 0x454afd
push dword [ebp - 0x3d4]
call dword [sym.imp.MSVCR80.dll_free]
pop ecx
jmp 0x454afd
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [edi + 0x918]
lea ebx, [edi + 0x3bc]
call fcn.00465113
push dword [ebp - 0x238]
lea esi, [edi + 0x91c]
mov eax, esi
call fcn.00467759
push eax
push esi
call fcn.00467792
push 1
mov esi, edi
call fcn.00455382
cmp dword [ebp - 0x23c], 0
jmp 0x454a5c
mov eax, dword [0x4dff94]
mov ecx, 0x4dff94
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x238], eax
push esi
push str._select_
lea eax, [ebp - 0x238]
push str._s__s
push eax
mov dword [ebp - 4], 3
call fcn.00408085
add esp, 0x10
jmp 0x454f19
lea eax, [ebx + 0x2c0]
mov dword [ebp - 0x240], eax
lea eax, [ebp - 0x234]
push eax
call fcn.0044f7ee
and dword [ebp - 4], 0
lea esi, [ebp - 0x234]
call fcn.0045457a
push 0x584
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0x244], eax
test eax, eax
mov byte [ebp - 4], 1
je 0x454bc1
push eax
call fcn.00450b7a
jmp 0x454bc3
xor eax, eax
mov byte [ebp - 4], 0
mov ebx, dword [ebp - 0x238]
mov dword [edi + 0x86c], eax
lea eax, [ebx + 0x258]
push eax
lea esi, [ebp - 0x128]
call fcn.00427e99
mov byte [ebp - 4], 2
push dword [eax]
mov ecx, dword [edi + 0x86c]
push dword [ebp - 0x22c]
lea eax, [ebx + 0x208]
push 0x4ab8a8
push eax
push dword [ebx + 0x294]
mov eax, dword [ebp - 0x240]
push ebx
call fcn.00463831
lea eax, [ebp - 0x124]
mov byte [ebp - 4], 0
cmp dword [ebp - 0x128], eax
je 0x454c34
push dword [ebp - 0x128]
call dword [sym.imp.MSVCR80.dll_free]
pop ecx
mov eax, dword [edi + 0x86c]
call fcn.004558be
mov ecx, dword [edi + 0x86c]
test ecx, ecx
je 0x454c50
mov eax, dword [ecx]
push 1
call dword [eax + 4]
and dword [edi + 0x86c], 0
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x234]
push eax
call fcn.00452ed9
jmp 0x45509c
mov ecx, ebx
mov edx, edi
call fcn.00455210
jmp 0x45509c
mov eax, dword [ebp + 8]
sub eax, 0x2329
je 0x454f3f
dec eax
je 0x454ea9
dec eax
je 0x454d06
dec eax
je 0x454cd9
dec eax
jne 0x45509c
lea eax, [ebp - 0x27c]
push eax
mov eax, dword [edi + 0x914]
add eax, 0xa0
call fcn.004389b1
cmp dword [eax + 0x18], 8
jb 0x454cbe
mov eax, dword [eax + 4]
jmp 0x454cc1
add eax, 4
push eax
call fcn.0044c740
pop ecx
lea ecx, [ebp - 0x27c]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
jmp 0x45509c
mov eax, dword [edi + 0x914]
test eax, eax
je 0x454cea
add eax, 0xa0
jmp 0x454cec
xor eax, eax
lea ebx, [edi + 0x870]
push eax
call fcn.0046b0a9
mov ecx, eax
mov edx, ebx
call fcn.0046b3be
jmp 0x45509c
mov eax, dword [0x4dff94]
mov ecx, 0x4dff94
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x240], eax
lea eax, [ebp - 0x240]
push 0x4b90d4
push eax
mov dword [ebp - 4], 0xc
call fcn.00408085
xor ebx, ebx
pop ecx
pop ecx
mov dword [ebp - 0x244], ebx
mov dword [ebp - 0x23c], ebx
lea eax, [ebp - 0x238]
push eax
push 0x2001f
push ebx
push 0x4b4c8c
mov byte [ebp - 4], 0xd
push SysReAllocStringLen
mov dword [ebp - 0x238], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x454d7b
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x23c], eax
lea eax, [ebp - 0x244]
push eax
mov esi, str.kxetray_bDeleteFile
push esi
lea eax, [ebp - 0x23c]
push eax
call fcn.00401744
push dword [ebp - 0x244]
mov eax, 0x4ab8a8
push 0x4b9110
push ebx
push 0x13
push eax
push ebx
push eax
push dword [ebp - 0x240]
push dword [edi + 4]
call fcn.00409091
add esp, 0x24
test al, 1
je 0x454e87
movsx eax, al
and eax, 0x10
shr eax, 4
push eax
mov dword [ebp - 0x244], eax
push esi
lea eax, [ebp - 0x23c]
push eax
call fcn.00401713
cmp dword [ebp - 0x244], ebx
je 0x454e73
mov eax, dword [edi + 0x914]
cmp dword [eax + 0x458], 3
jne 0x454e41
lea ecx, [ebp - 0x260]
push ecx
add eax, 0xa0
call fcn.004389b1
mov byte [ebp - 4], 0xe
cmp dword [eax + 0x18], 8
jb 0x454e1b
mov ecx, dword [eax + 4]
jmp 0x454e1e
lea ecx, [eax + 4]
mov eax, dword [edi + 0x914]
add eax, 0xa0
call fcn.00469934
push eax
push ecx
call fcn.004547b1
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x260]
jmp 0x454e6d
lea ecx, [ebp - 0x2b4]
push ecx
add eax, 0xa0
call fcn.004389b1
cmp dword [eax + 0x18], 8
jb 0x454e5d
mov eax, dword [eax + 4]
jmp 0x454e60
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x2b4]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
push dword [edi + 0x914]
call fcn.00453bba
push 2
mov esi, edi
call fcn.00455382
cmp dword [ebp - 0x23c], ebx
je 0x454e9b
push dword [ebp - 0x23c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x240]
add eax, 0xfffffff0
jmp 0x454f35
mov eax, dword [0x4dff94]
mov ecx, 0x4dff94
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x238], eax
lea eax, [ebp - 0x298]
push eax
mov dword [ebp - 4], 0xa
mov eax, dword [edi + 0x914]
add eax, 0xa0
call fcn.004389b1
mov byte [ebp - 4], 0xb
cmp dword [eax + 0x18], 8
jb 0x454eec
mov eax, dword [eax + 4]
jmp 0x454eef
add eax, 4
push eax
push str._select_
lea eax, [ebp - 0x238]
push str._s__s
push eax
call fcn.00408085
add esp, 0x10
lea ecx, [ebp - 0x298]
mov byte [ebp - 4], 0xa
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov esi, dword [ebp - 0x238]
push 5
xor eax, eax
push eax
push esi
push str.explorer.exe
push eax
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea eax, [esi - 0x10]
call fcn.00401291
jmp 0x45509c
mov esi, dword [edi + 0x914]
lea eax, [ebp - 0x1a4]
push eax
add esi, 0x35c
call fcn.00436207
mov dword [ebp - 4], 7
mov eax, dword [edi + 0x914]
add eax, 0x408
push eax
lea ebx, [ebp - 0x1a4]
call fcn.00436627
push 0x584
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0x238], eax
test eax, eax
mov byte [ebp - 4], 8
je 0x454f96
push eax
call fcn.00450b7a
jmp 0x454f98
xor eax, eax
mov byte [ebp - 4], 7
sub esp, 0x1c
cmp dword [ebp - 0x110], 0
mov dword [edi + 0x86c], eax
lea ebx, [ebp - 0x24]
mov ecx, esp
mov dword [ebp - 0x238], esp
lea eax, [ebp - 0x124]
jne 0x454fc5
lea eax, [ebp - 0x90]
push eax
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
mov ecx, ebx
call fcn.004588bd
movzx eax, byte [ebp - 0x2c]
mov ecx, dword [edi + 0x86c]
mov dword [ecx + 0x3f8], eax
add esp, 0x1c
lea eax, [ebp - 0x2d0]
push eax
mov eax, dword [edi + 0x914]
add eax, 0xa0
call fcn.004389b1
mov byte [ebp - 4], 9
cmp dword [ebp - 0x34], 8
mov ecx, dword [ebp - 0x48]
jae 0x45500d
lea ecx, [ebp - 0x48]
cmp dword [eax + 0x18], 8
mov dword [ebp - 0x238], ecx
jb 0x45501e
mov ebx, dword [eax + 4]
jmp 0x455021
lea ebx, [eax + 4]
mov eax, dword [edi + 0x914]
lea edx, [eax + 0xa0]
mov eax, edx
call fcn.00469934
push eax
call fcn.0046989d
mov ecx, dword [edi + 0x86c]
push eax
push dword [ebp - 0x238]
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0xfc]
mov eax, esi
push ebx
call fcn.00463831
lea ecx, [ebp - 0x2d0]
mov byte [ebp - 4], 7
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov eax, dword [edi + 0x86c]
call fcn.004558be
mov ecx, dword [edi + 0x86c]
test ecx, ecx
je 0x455085
mov eax, dword [ecx]
push 1
call dword [eax + 4]
and dword [edi + 0x86c], 0
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x1a4]
push eax
call fcn.0043628b
call fcn.0049cc44
ret 4