Function at 0x449d70
Capabilities:
Check if file exists
Delete file
Get common file path
Get file attributes
Get session user name
Persist via run registry key
Query or enumerate registry value
Set file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x1dc]
sub esp, 0x1dc
push 0xffffffffffffffff
push 0x648110
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x758898]
xor eax, ebp
mov dword [ebp + 0x1d8], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [0x75dc28], ebx
jne 0x44a160
mov esi, 1
mov dword [0x75dc28], esi
lea eax, [ebp - 0x28]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x449e0b
lea ecx, [ebp - 0x38]
push ecx
push str.SeBackupPrivilege
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x30], 2
push ebx
push ebx
push ebx
lea edx, [ebp - 0x3c]
push edx
push ebx
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov dword [ebp - 0x20], ebx
lea ecx, [ebp - 0x14]
call fcn.00402510
mov byte [ebp - 4], 1
push 0x94
push ebx
lea ecx, [ebp]
push ecx
call fcn.00620920
add esp, 0xc
mov dword [ebp], 0x94
lea edx, [ebp]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x449fd0
cmp dword [ebp + 0x10], 2
jne 0x449fd0
push 0x67b490
call fcn.004476d0
add esp, 4
mov edi, eax
test edi, edi
je 0x449f16
push str.SHGetFolderPathA
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x449f02
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp + 0xd4]
push eax
push 0
push 0
push 0x1a
push 0
call esi
test eax, eax
jne 0x449efc
lea eax, [ebp + 0xd4]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x449ea2
sub eax, edx
dec eax
mov dword [ebp - 0x1c], eax
cmp byte [ebp + eax + 0xd4], 0x5c
mov eax, 0x67997c
je 0x449ec3
mov eax, 0x67d038
push eax
lea ecx, [ebp + 0xd4]
push ecx
push str._s_sDMCache
lea edx, [ebp - 0x14]
push edx
call fcn.00402f80
mov eax, dword [ebp - 0x14]
push eax
call fcn.00624a4a
add esp, 0x14
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x449efc
mov ebx, 1
mov dword [ebp - 0x20], ebx
call dword [sym.imp.ole32.dll_CoUninitialize]
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test ebx, ebx
jne 0x44a0c2
mov esi, 1
lea edx, [ebp - 0x24]
push edx
push esi
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x449fd0
mov dword [ebp - 0x1c], 0x104
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp + 0xd4]
push ecx
push 0
push 0
push 0x682f64
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x449fbe
lea eax, [ebp + 0xd4]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x449f67
sub eax, edx
dec eax
mov dword [ebp - 0x1c], eax
cmp byte [ebp + eax + 0xd4], 0x5c
mov eax, 0x67997c
je 0x449f88
mov eax, 0x67d038
push eax
lea eax, [ebp + 0xd4]
push eax
push str._s_sDMCache
lea ecx, [ebp - 0x14]
push ecx
call fcn.00402f80
mov edx, dword [ebp - 0x14]
push edx
call fcn.00624a4a
add esp, 0x14
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x449fbe
mov ebx, esi
mov dword [ebp - 0x20], ebx
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x44a0c2
push 0x104
lea edx, [ebp + 0xd4]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x44a185
lea eax, [ebp + 0xd4]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x449ff3
sub eax, edx
dec eax
mov dword [ebp - 0x1c], eax
cmp byte [ebp + eax + 0xd4], 0x5c
mov eax, 0x67997c
je 0x44a014
mov eax, 0x67d038
push eax
lea eax, [ebp + 0xd4]
push eax
push str._s_sDMCache
lea ecx, [ebp - 0x14]
push ecx
call fcn.00402f80
mov edx, dword [ebp - 0x14]
push edx
call fcn.00624a4a
add esp, 0x14
cmp dword [ebp + 0x10], 2
jne 0x44a0ac
mov dword [ebp - 0x2c], 0x40
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp + 0x94]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x44a06c
push 0x682f54
lea edx, [ebp + 0x94]
push edx
call fcn.0062311b
add esp, 8
mov eax, dword [ebp - 0x1c]
cmp byte [ebp + eax + 0xd4], 0x5c
mov eax, 0x67997c
je 0x44a083
mov eax, 0x67d038
lea ecx, [ebp + 0x94]
push ecx
push eax
lea edx, [ebp + 0xd4]
push edx
push str._s_sDMCache_s
lea eax, [ebp - 0x14]
push eax
call fcn.00402f80
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.00624a4a
add esp, 0x18
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x44a185
mov dword [ebp - 0x20], esi
lea ecx, [ebp - 0x18]
call fcn.00402510
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x14]
push eax
push str._s_settings.bak
lea ecx, [ebp - 0x18]
push ecx
call fcn.00402f80
add esp, 0xc
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x44a10b
push 0x80
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [ebp - 0x18]
push edx
call fcn.00447d10
add esp, 4
test eax, eax
jne 0x44a12d
push eax
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [0x75dbe4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSaveKeyA]
mov dword [0x75dc28], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.00402580
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00402580
mov dword [ebp - 4], 0xffffffff
mov dword [0x75dc28], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1d8]
xor ecx, ebp
call fcn.0062023e
add ebp, 0x1dc
mov esp, ebp
pop ebp
ret
mov dword [0x75dc28], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00402580
jmp 0x44a160