Function at 0x4817e0
Capabilities:
Compare security identifiers
Create directory
Create process on windows
Delete registry key
Delete registry value
Get common file path
Get disk size
Query or enumerate registry value
Resume thread
Set current directory
Set file attributes
Terminate thread

Disassembly:
push ecx
mov eax, dword [0x518f9c]
mov edx, dword [esp]
or edx, eax
push 0
push 0
mov dword [esp + 8], edx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp]
or ecx, eax
push ecx
push 0
mov dword [esp + 8], ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, eax
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtect]
or ecx, eax
mov eax, dword [esp]
or eax, ecx
push eax
push 0
mov dword [esp + 8], eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [esp]
push 0
or ecx, eax
mov eax, dword [0x4f8b40]
push 0
push ecx
push eax
push eax
push eax
mov dword [esp + 0x18], ecx
call dword [sym.imp.KERNEL32.dll_SearchPathA]
mov ecx, dword [esp]
or ecx, eax
push ecx
push 0
push ecx
mov dword [esp + 0xc], ecx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edx, dword [esp]
push 0
or edx, eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, dword [0x4f8b40]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [esp]
or ecx, eax
mov eax, dword [0x4f8b40]
push ecx
push eax
mov dword [esp + 8], ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov ecx, dword [esp]
push 0
push 0
push 0
push 0
push 0
or ecx, eax
push 0
push 0
mov dword [esp + 0x1c], ecx
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [esp]
push 0
or ecx, eax
push 0
mov dword [esp + 8], ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edx, dword [esp]
mov ecx, dword [0x4f8b40]
or edx, eax
push 0
push ecx
mov dword [esp + 8], edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov edx, dword [sym.imp.KERNEL32.dll_FindResourceA]
dec ebp
add byte [ebx + 0x4d317c0d], cl
add byte [ebx], cl
ret 0x548b
and al, 0
or eax, ecx
or edx, eax
mov dword [esp], edx
lea edx, [esp]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
mov edx, dword [esp]
push 0
push 0
push 0
or edx, eax
push 0
push 0
mov dword [esp + 0x14], edx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
mov edx, dword [esp]
push 0
or edx, eax
push 0
mov dword [esp + 8], edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov edx, dword [esp]
push 0
or edx, eax
push 0
mov dword [esp + 8], edx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov edx, dword [esp]
push 0
or edx, eax
push 0
push 0
mov dword [esp + 0xc], edx
call dword [sym.imp.ADVAPI32.dll_InitializeSid]
mov ecx, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeDisplayNameW]
mov edx, dword [esp]
or eax, ecx
push 0
or edx, eax
push 0
push 0
mov dword [esp + 0xc], edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov ecx, dword [esp]
push 0
push 0
push 0
push 0
or ecx, eax
push 0
push 0
mov dword [esp + 0x18], ecx
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
mov ecx, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeNameA]
mov edx, dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
or eax, ecx
mov ecx, dword [esp]
or eax, edx
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
mov edx, dword [esp]
push 0
push 0
push 0
push 0
or edx, eax
push 0
push 0
mov dword [esp + 0x18], edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp]
push 0
or ecx, eax
push 0
mov dword [esp + 8], ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, dword [esp]
push 0
or ecx, eax
push 0
mov dword [esp + 8], ecx
call dword [sym.imp.GDI32.dll_RestoreDC]
mov ecx, dword [sym.imp.GDI32.dll_SetViewportExtEx]
mov edx, dword [esp]
or eax, ecx
push 0
or edx, eax
push 0
mov dword [esp + 8], edx
call dword [sym.imp.GDI32.dll_SetBkColor]
mov ecx, dword [esp]
or ecx, eax
push ecx
mov dword [esp + 4], ecx
call dword [sym.imp.GDI32.dll_GetStockObject]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov edx, dword [sym.imp.GDI32.dll_SetMapMode]
mov ecx, dword [sym.imp.GDI32.dll_DeleteObject]
or eax, edx
mov edx, dword [esp]
or eax, ecx
push 0
or edx, eax
push 0
mov dword [esp + 8], edx
call dword [sym.imp.GDI32.dll_SelectObject]
mov edx, dword [esp]
push 0
or edx, eax
push 0
push 0
mov dword [esp + 0xc], edx
call dword [sym.imp.GDI32.dll_PtVisible]
mov ecx, dword [sym.imp.GDI32.dll_GetWindowExtEx]
mov edx, dword [esp]
push 0
push 0
or eax, ecx
push 0
push 0
or edx, eax
push 0
push 0
mov dword [esp + 0x18], edx
call dword [sym.imp.GDI32.dll_ScaleWindowExtEx]
mov ecx, dword [esp]
or ecx, eax
push 0
push 0
mov dword [esp + 8], ecx
call dword [sym.imp.GDI32.dll_SetBkMode]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.GDI32.dll_SaveDC]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov edx, dword [esp]
push 0
or edx, eax
push 0
mov dword [esp + 8], edx
call dword [sym.imp.GDI32.dll_GetRgnBox]
mov edx, dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov ecx, dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
or eax, edx
mov edx, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
or eax, ecx
mov ecx, dword [esp]
push 0
or eax, edx
push 0
push 0
or ecx, eax
push 0
push 0
mov dword [esp + 0x14], ecx
call dword [sym.imp.SETUPAPI.dll_SetupGetFileCompressionInfoW]
mov ecx, eax
mov eax, dword [sym.imp.SETUPAPI.dll_SetupDecompressOrCopyFileW]
or ecx, eax
mov eax, dword [esp]
push 0
or eax, ecx
push 0
push 0
push eax
push 0
mov dword [esp + 0x14], eax
call dword [sym.imp.SETUPAPI.dll_SetupGetBinaryField]
mov ecx, dword [esp]
push 0
push 0
push 0
or ecx, eax
push 0
push 0
mov dword [esp + 0x14], ecx
call dword [sym.imp.SETUPAPI.dll_SetupGetFileCompressionInfoA]
or dword [esp], eax
call dword [sym.imp.USER32.dll_GetMessagePos]
mov edx, dword [esp]
push 0
or edx, eax
push 0
push 0
mov dword [esp + 0xc], edx
call dword [sym.imp.USER32.dll_GetClassInfoExW]
mov ecx, dword [esp]
push 0
or ecx, eax
push 0
mov dword [esp + 8], ecx
call dword [sym.imp.USER32.dll_EndPaint]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov ecx, dword [esp]
or ecx, eax
mov dword [esp], ecx
push ecx
call dword [sym.imp.USER32.dll_GetSysColor]
mov ecx, dword [esp]
push 0
or ecx, eax
push ecx
push ecx
push 0
mov dword [esp + 0x10], ecx
call dword [sym.imp.USER32.dll_AppendMenuW]
mov edx, dword [esp]
push 0
or edx, eax
push 0
mov dword [esp + 8], edx
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov edx, dword [esp]
push 0
or edx, eax
push 0
mov dword [esp + 8], edx
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [esp]
or eax, edx
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.USER32.dll_GetParent]
mov edx, dword [esp]
push 0
push 0
push 0
push 0
or edx, eax
push 0
push 0
mov dword [esp + 0x18], edx
call dword [sym.imp.USER32.dll_TrackPopupMenuEx]
mov ecx, dword [esp]
push 0
push 0
push 0
push 0
or ecx, eax
push 0
push 0
mov dword [esp + 0x18], ecx
call dword [sym.imp.USER32.dll_MoveWindow]
mov edx, dword [esp]
push 0
or edx, eax
push 0
push 0
mov dword [esp + 0xc], edx
call dword [sym.imp.USER32.dll_SetClassLongW]
mov ecx, dword [esp]
push 0
or ecx, eax
push 0
mov dword [esp + 8], ecx
call dword [sym.imp.USER32.dll_LoadMenuW]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.USER32.dll_SetCursor]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.USER32.dll_IsWindowEnabled]
mov edx, dword [esp]
push 0
or edx, eax
push 0
mov dword [esp + 8], edx
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, dword [esp]
or ecx, eax
mov dword [esp], ecx
push ecx
push 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, dword [esp]
push 0
push 0
or ecx, eax
push 0
push 0
mov dword [esp + 0x10], ecx
call dword [sym.imp.USER32.dll_DefWindowProcW]
mov edx, dword [esp]
push 0
or edx, eax
mov dword [esp + 4], edx
call dword [sym.imp.USER32.dll_CharNextW]
mov edx, eax
mov eax, dword [sym.imp.USER32.dll_BeginPaint]
or edx, eax
mov eax, dword [esp]
or eax, edx
push 1
push 0
push eax
push 0
mov dword [esp + 0x10], eax
call dword [sym.imp.USER32.dll_LoadStringW]
mov edx, dword [esp]
push 0
or edx, eax
push 0
push 0
mov dword [esp + 0xc], edx
call dword [sym.imp.USER32.dll_GetClassNameW]
mov ecx, dword [esp]
push 0
or ecx, eax
mov dword [esp + 4], ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
mov edx, dword [esp]
push 0
or edx, eax
mov dword [esp + 4], edx
call dword [sym.imp.USER32.dll_DestroyMenu]
mov ecx, eax
mov eax, dword [sym.imp.USER32.dll_CheckDlgButton]
or ecx, eax
mov eax, dword [esp]
or eax, ecx
push eax
push 0
mov dword [esp + 8], eax
call dword [sym.imp.USER32.dll_CharLowerBuffW]
mov edx, dword [esp]
push 0
push 0
push 0
or edx, eax
push 0
push 0
mov dword [esp + 0x14], edx
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
mov edx, dword [sym.imp.SHELL32.dll_SHFileOperationA]
mov ecx, dword [esp]
push 0
push 0
or eax, edx
push 0
push 0
or ecx, eax
push 0
push 0
mov dword [esp + 0x18], ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov eax, dword [esp]
pop ecx
ret