Function at 0x428250
Capabilities:
Contain obfuscated stackstrings
Delete directory
Delete registry value
Get common file path
Persist via run registry key
Query or enumerate registry key
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4598ce
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x7e4
mov eax, dword [0x471df4]
push ebx
push ebp
mov ebx, ecx
push esi
push edi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x40], eax
mov dword [esp + 0x7fc], 0
mov dword [esp + 0x3c], eax
mov ebp, 0x104
lea eax, [esp + 0x3e4]
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 0x5ec]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov eax, dword [0x471df4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x44], eax
mov edx, dword [ebx + 0xc]
mov byte [esp + 0x7fc], 3
not edx
test dl, 4
je 0x4285ee
push str.DISK1
lea ecx, [esp + 0x18]
call fcn.0044a442
mov esi, eax
push str.OPTIONSCABS
lea ecx, [esp + 0x1c]
mov byte [esp + 0x800], 4
call fcn.0044a442
mov edi, eax
lea eax, [esp + 0x3e4]
lea ecx, [esp + 0x1c]
push eax
mov byte [esp + 0x800], 5
call fcn.0044a442
push edi
lea ecx, [esp + 0x34]
push eax
push ecx
mov byte [esp + 0x808], 6
call fcn.0044a5b7
push esi
lea edx, [esp + 0x24]
mov bl, 7
push eax
push edx
mov byte [esp + 0x808], bl
call fcn.0044a5b7
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x800], 8
call fcn.0044a4c1
lea ecx, [esp + 0x20]
mov byte [esp + 0x7fc], bl
call fcn.0044a3d4
lea ecx, [esp + 0x30]
mov byte [esp + 0x7fc], 6
call fcn.0044a3d4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x7fc], 5
call fcn.0044a3d4
lea ecx, [esp + 0x18]
mov byte [esp + 0x7fc], 4
call fcn.0044a3d4
lea ecx, [esp + 0x14]
mov byte [esp + 0x7fc], 3
call fcn.0044a3d4
mov eax, dword [esp + 0x10]
push eax
call fcn.0042cc40
add esp, 4
lea ecx, [esp + 0x20]
push str.DISK1
call fcn.0044a442
mov esi, eax
push str.OPTIONSINSTALL
lea ecx, [esp + 0x34]
mov byte [esp + 0x800], 9
call fcn.0044a442
mov edi, eax
lea ecx, [esp + 0x3e4]
mov byte [esp + 0x7fc], 0xa
push ecx
lea ecx, [esp + 0x20]
call fcn.0044a442
push edi
lea edx, [esp + 0x1c]
push eax
push edx
mov byte [esp + 0x808], 0xb
call fcn.0044a5b7
mov bl, 0xc
mov byte [esp + 0x7fc], bl
push esi
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.0044a5b7
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x800], 0xd
call fcn.0044a4c1
lea ecx, [esp + 0x14]
mov byte [esp + 0x7fc], bl
call fcn.0044a3d4
lea ecx, [esp + 0x18]
mov byte [esp + 0x7fc], 0xb
call fcn.0044a3d4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x7fc], 0xa
call fcn.0044a3d4
lea ecx, [esp + 0x30]
mov byte [esp + 0x7fc], 9
call fcn.0044a3d4
lea ecx, [esp + 0x20]
mov byte [esp + 0x7fc], 3
call fcn.0044a3d4
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0042cc40
lea edx, [esp + 0x6f4]
push ebp
push edx
push str.CabsFlag
push str.SoftwareUIUCABSFLAG
push 0x80000002
call fcn.00430370
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
add esp, 0x18
test eax, eax
jne 0x42859d
lea eax, [esp + 0x3e4]
lea ecx, [esp + 0x18]
push eax
call fcn.0044a442
push str.OPTIONSCABS
lea ecx, [esp + 0x18]
mov bl, 0xe
push eax
push ecx
mov byte [esp + 0x808], bl
call fcn.0044a61d
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x800], 0xf
call fcn.0044a4c1
lea ecx, [esp + 0x14]
mov byte [esp + 0x7fc], bl
call fcn.0044a3d4
lea ecx, [esp + 0x18]
mov byte [esp + 0x7fc], 3
call fcn.0044a3d4
mov edx, dword [esp + 0x10]
push edx
call esi
cmp eax, 1
jne 0x428587
lea eax, [esp + 0x3e4]
lea ecx, [esp + 0x18]
push eax
call fcn.0044a442
push str.OPTIONS
lea ecx, [esp + 0x18]
mov bl, 0x10
push eax
push ecx
mov byte [esp + 0x808], bl
call fcn.0044a61d
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x800], 0x11
call fcn.0044a4c1
lea ecx, [esp + 0x14]
mov byte [esp + 0x7fc], bl
call fcn.0044a3d4
lea ecx, [esp + 0x18]
mov byte [esp + 0x7fc], 3
call fcn.0044a3d4
mov edx, dword [esp + 0x10]
push edx
call esi
jmp 0x42858b
test eax, eax
je 0x42859d
push str.SoftwareUIUCABSFLAG
push 0x80000002
call fcn.00430ab0
add esp, 8
mov eax, dword [esp + 0x24]
mov ecx, dword [eax + 0x10]
test ecx, ecx
jne 0x4285ea
mov ecx, eax
push str.SETUP
add ecx, 0x1d4
lea edx, [esp + 0x18]
push ecx
push edx
call fcn.0044a61d
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x800], 0x12
call fcn.0044a4c1
lea ecx, [esp + 0x14]
mov byte [esp + 0x7fc], 3
call fcn.0044a3d4
mov eax, dword [esp + 0x10]
push eax
call esi
mov ebx, dword [esp + 0x24]
lea ecx, [esp + 0x28]
push ecx
push 0xf003f
push 0
push str.SOFTWAREUIUUIU_RESET_V92_PARMSMODEMNUMS
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x428707
lea edx, [esp + 0x2c]
lea eax, [esp + 0x2e0]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
push edx
lea ecx, [esp + 0x4c]
push eax
push ecx
mov ecx, dword [esp + 0x34]
lea edx, [esp + 0x40]
push 0
lea eax, [esp + 0x4f8]
push edx
push eax
push 0
push ecx
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x54], ebp
mov esi, 1
call edi
test eax, eax
jne 0x4286be
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
lea edx, [esp + 0x2e0]
push edx
push 0x80000002
call fcn.004310b0
add esp, 8
test eax, eax
jne 0x428682
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x4e8]
push eax
push ecx
call ebx
dec esi
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x2e0]
push edx
lea edx, [esp + 0x4c]
push ecx
push edx
lea ecx, [esp + 0x40]
push 0
lea edx, [esp + 0x4f8]
mov eax, esi
push ecx
push edx
push eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esp + 0x4c], ebp
mov dword [esp + 0x54], ebp
inc esi
call edi
test eax, eax
je 0x428659
mov ebx, dword [esp + 0x24]
push 0
push 0
mov edx, dword [esp + 0x30]
push 0
lea ecx, [esp + 0x44]
push 0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov eax, dword [esp + 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x38]
test eax, eax
jne 0x428707
push str.SoftwareUIUUIU_RESET_V92_PARMS
push 0x80000002
call fcn.00430ab0
add esp, 8
mov eax, dword [ebx + 0xc]
test eax, 0x18000
je 0x42875c
push 0xa
lea ecx, [esp + 0x50]
call fcn.00449a9b
push str.CARPSERV
lea ecx, [esp + 0x50]
mov byte [esp + 0x800], 0x13
call fcn.00449c01
lea ecx, [esp + 0x4c]
push ecx
push 1
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000002
call fcn.00430700
add esp, 0x10
lea ecx, [esp + 0x4c]
mov byte [esp + 0x7fc], 3
call fcn.00449b0f
test byte [ebx + 0xc], 2
je 0x4287a7
push str.SOFTWAREUIUUIU_UNINST
lea ecx, [esp + 0x18]
call fcn.0044a442
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x800], 0x14
call fcn.0044a4c1
lea ecx, [esp + 0x14]
mov byte [esp + 0x7fc], 3
call fcn.0044a3d4
mov edx, dword [esp + 0x10]
push edx
push 0x80000002
call fcn.00430ab0
add esp, 8
jmp 0x4287dd
mov edi, dword [ebx + 0x2b0]
mov esi, dword [ebx + 0x2a8]
test edi, edi
jbe 0x4287dd
mov eax, esi
mov esi, dword [esi]
add eax, 8
lea ecx, [esp + 0x10]
push eax
call fcn.0044a4c1
mov eax, dword [esp + 0x10]
push eax
push 0x80000002
call fcn.00430ab0
add esp, 8
dec edi
jne 0x4287b7
mov eax, dword [ebx + 0x2c0]
test eax, eax
je 0x428832
push 0xa
lea ecx, [esp + 0x50]
call fcn.00449a9b
push str._Z_RESET_ACF
lea ecx, [esp + 0x50]
mov byte [esp + 0x800], 0x15
call fcn.00449c01
lea ecx, [esp + 0x4c]
push ecx
push 1
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000002
call fcn.00430700
add esp, 0x10
lea ecx, [esp + 0x4c]
mov byte [esp + 0x7fc], 3
call fcn.00449b0f
test byte [ebx + 0xc], 2
je 0x428d50
mov edx, dword [0x471df4]
mov dword [esp + 0x20], edx
mov eax, dword [esp + 0x24]
mov bl, 0x16
mov byte [esp + 0x7fc], bl
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x42890a
lea ecx, [esp + 0x68]
push ebp
push ecx
push str.SourcePath
push str.SoftwareUIUUIU_CLEAN_UP
push 0x80000002
call fcn.00430370
add esp, 0x14
test eax, eax
jne 0x42889c
lea edx, [esp + 0x68]
push eax
push edx
push str.SourcePath
push str.SoftwareMicrosoftWindowsCurrentVersionSetup
push 0x80000002
call fcn.004301e0
add esp, 0x14
lea eax, [esp + 0x68]
push ebp
push eax
push str.SearchLocation
push str.SoftwareUIUUIU_CLEAN_UP
push 0x80000002
call fcn.00430370
add esp, 0x14
test eax, eax
jne 0x42890a
lea ecx, [esp + 0x68]
push ecx
lea ecx, [esp + 0x24]
call fcn.0044a511
mov edx, dword [esp + 0x20]
push str.EMPTY
push edx
call fcn.0043a540
add esp, 8
test eax, eax
je 0x42890a
mov eax, dword [esp + 0x20]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x42890a
lea ecx, [esp + 0x68]
push 0
push ecx
push str.SearchLocation
push str.SoftwareMicrosoftWindowsCurrentVersionSysDM
push 0x80000002
call fcn.004301e0
add esp, 0x14
lea edx, [esp + 0x68]
push ebp
push edx
push str.Win98SEQFEFilePath
push str.SoftwareUIUUIU_CLEAN_UP
push 0x80000002
call fcn.00430370
add esp, 0x14
test eax, eax
jne 0x428938
lea eax, [esp + 0x68]
push eax
call fcn.0042cc40
add esp, 4
push str.SoftwareUIUUIU_CLEAN_UP
push 0x80000002
call fcn.00430ab0
add esp, 8
lea ecx, [esp + 0x1dc]
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push str.CONEXANT_INSTALL.LOG
lea ecx, [esp + 0x20]
call fcn.0044a442
mov esi, eax
lea edx, [esp + 0x1dc]
lea ecx, [esp + 0x18]
push edx
mov byte [esp + 0x800], 0x17
call fcn.0044a442
push esi
push eax
lea eax, [esp + 0x1c]
mov byte [esp + 0x804], 0x18
push eax
call fcn.0044a5b7
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x800], 0x19
call fcn.0044a4c1
lea ecx, [esp + 0x14]
mov byte [esp + 0x7fc], 0x18
call fcn.0044a3d4
lea ecx, [esp + 0x18]
mov byte [esp + 0x7fc], 0x17
call fcn.0044a3d4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x7fc], bl
call fcn.0044a3d4
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0042cc40
add esp, 4
lea ecx, [esp + 0x1c]
push str.CONEXANT_RESET_ACF.LOG
call fcn.0044a442
mov esi, eax
lea edx, [esp + 0x1dc]
lea ecx, [esp + 0x18]
push edx
mov byte [esp + 0x800], 0x1a
call fcn.0044a442
push esi
push eax
lea eax, [esp + 0x1c]
mov byte [esp + 0x804], 0x1b
push eax
call fcn.0044a5b7
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x800], 0x1c
call fcn.0044a4c1
lea ecx, [esp + 0x14]
mov byte [esp + 0x7fc], 0x1b
call fcn.0044a3d4
lea ecx, [esp + 0x18]
mov byte [esp + 0x7fc], 0x1a
call fcn.0044a3d4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x7fc], bl
call fcn.0044a3d4
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0042cc40
add esp, 4
lea ecx, [esp + 0x1c]
push str.CONEXANT_CLEAN_UP.LOG
call fcn.0044a442
mov esi, eax
lea edx, [esp + 0x1dc]
lea ecx, [esp + 0x18]
push edx
mov byte [esp + 0x800], 0x1d
call fcn.0044a442
push esi
push eax
lea eax, [esp + 0x1c]
mov byte [esp + 0x804], 0x1e
push eax
call fcn.0044a5b7
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x800], 0x1f
call fcn.0044a4c1
lea ecx, [esp + 0x14]
mov byte [esp + 0x7fc], 0x1e
call fcn.0044a3d4
lea ecx, [esp + 0x18]
mov byte [esp + 0x7fc], 0x1d
call fcn.0044a3d4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x7fc], bl
call fcn.0044a3d4
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0042cc40
add esp, 4
lea ecx, [esp + 0x1c]
push str.CONEXANT_UNINSTALL_SDEL.LOG
call fcn.0044a442
mov esi, eax
lea edx, [esp + 0x1dc]
lea ecx, [esp + 0x18]
push edx
mov byte [esp + 0x800], 0x20
call fcn.0044a442
push esi
push eax
lea eax, [esp + 0x1c]
mov byte [esp + 0x804], 0x21
push eax
call fcn.0044a5b7
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x800], 0x22
call fcn.0044a4c1
lea ecx, [esp + 0x14]
mov byte [esp + 0x7fc], 0x21
call fcn.0044a3d4
lea ecx, [esp + 0x18]
mov byte [esp + 0x7fc], 0x20
call fcn.0044a3d4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x7fc], bl
call fcn.0044a3d4
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0042cc40
add esp, 4
lea ecx, [esp + 0x1c]
push str.UIUCU.EXE
call fcn.0044a442
mov esi, eax
lea edx, [esp + 0x1dc]
lea ecx, [esp + 0x18]
push edx
mov byte [esp + 0x800], 0x23
call fcn.0044a442
push esi
mov byte [esp + 0x800], 0x24
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.0044a5b7
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x800], 0x25
call fcn.0044a4c1
lea ecx, [esp + 0x14]
mov byte [esp + 0x7fc], 0x24
call fcn.0044a3d4
lea ecx, [esp + 0x18]
mov byte [esp + 0x7fc], 0x23
call fcn.0044a3d4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x7fc], bl
call fcn.0044a3d4
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0042cc40
add esp, 4
lea ecx, [esp + 0x1c]
push str.HXFSETUP.EXE
call fcn.0044a442
mov esi, eax
lea edx, [esp + 0x1dc]
lea ecx, [esp + 0x18]
push edx
mov byte [esp + 0x800], 0x26
call fcn.0044a442
push esi
push eax
lea eax, [esp + 0x1c]
mov byte [esp + 0x804], 0x27
push eax
call fcn.0044a5b7
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x800], 0x28
call fcn.0044a4c1
lea ecx, [esp + 0x14]
mov byte [esp + 0x7fc], 0x27
call fcn.0044a3d4
lea ecx, [esp + 0x18]
mov byte [esp + 0x7fc], 0x26
call fcn.0044a3d4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x7fc], bl
call fcn.0044a3d4
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0042cc40
add esp, 4
lea ecx, [esp + 0x1c]
push str.UIUSETUP.EXE
call fcn.0044a442
mov esi, eax
lea edx, [esp + 0x1dc]
lea ecx, [esp + 0x18]
push edx
mov byte [esp + 0x800], 0x29
call fcn.0044a442
push esi
push eax
lea eax, [esp + 0x1c]
mov byte [esp + 0x804], 0x2a
push eax
call fcn.0044a5b7
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x800], 0x2b
call fcn.0044a4c1
lea ecx, [esp + 0x14]
mov byte [esp + 0x7fc], 0x2a
call fcn.0044a3d4
lea ecx, [esp + 0x18]
mov byte [esp + 0x7fc], 0x29
call fcn.0044a3d4
lea ecx, [esp + 0x1c]
mov byte [esp + 0x7fc], bl
call fcn.0044a3d4
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0042cc40
add esp, 4
lea ecx, [esp + 0x20]
mov byte [esp + 0x7fc], 3
call fcn.0044a3d4
mov ebx, dword [esp + 0x24]
lea edx, [esp + 0x2e0]
push ebp
push edx
push str.FileName
push str.SoftwareUIUUIU_IS_LOG_FILE
push 0x80000002
call fcn.00430370
add esp, 0x14
test eax, eax
jne 0x428e05
lea eax, [esp + 0x2e0]
lea ecx, [esp + 0x10]
push eax
call fcn.0044a511
lea ecx, [esp + 0x2e0]
push ecx
call fcn.0042cc40
push str.SoftwareUIUUIU_IS_LOG_FILE
push 0x80000002
call fcn.00430ab0
add esp, 0xc
lea ecx, [esp + 0x10]
push 0x5c
call fcn.00449442
cmp eax, 0xffffffff
je 0x428dea
lea edx, [esp + 0x14]
push eax
push edx
lea ecx, [esp + 0x18]
call fcn.004493ca
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x800], 0x2c
call fcn.0044a4c1
lea ecx, [esp + 0x14]
mov byte [esp + 0x7fc], 3
call fcn.0044a3d4
push 2
push ecx
lea eax, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.0044a149
call fcn.0042cb60
add esp, 8
test byte [ebx + 0xc], 2
je 0x428f2b
lea ecx, [esp + 0x68]
call fcn.00437d60
push 0
push ecx
mov bl, 0x2d
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.SYSTEM
mov byte [esp + 0x808], bl
call fcn.0044a442
push ecx
mov byte [esp + 0x808], 0x2e
mov ecx, esp
mov dword [esp + 0x24], esp
push str.UIUSYS
call fcn.0044a442
lea ecx, [esp + 0x74]
mov byte [esp + 0x808], bl
call fcn.00439260
lea ecx, [esp + 0x1d0]
mov byte [esp + 0x7fc], 0x35
call fcn.00421bc0
lea ecx, [esp + 0x84]
mov dword [esp + 0x14], ecx
push fcn.00449b0f
push 0xa
lea edx, [esp + 0xbc]
push 0x1c
push edx
mov byte [esp + 0x80c], 0x37
call fcn.0043abc0
lea ecx, [esp + 0x94]
mov byte [esp + 0x7fc], 0x36
call fcn.00449b0f
lea ecx, [esp + 0x90]
mov byte [esp + 0x7fc], 0x34
call fcn.0044a3d4
lea ecx, [esp + 0x80]
mov byte [esp + 0x7fc], 0x33
call fcn.0044a3d4
lea ecx, [esp + 0x7c]
mov byte [esp + 0x7fc], 0x32
call fcn.0044a3d4
lea ecx, [esp + 0x78]
mov byte [esp + 0x7fc], 0x31
call fcn.0044a3d4
lea ecx, [esp + 0x74]
mov byte [esp + 0x7fc], 0x30
call fcn.0044a3d4
lea ecx, [esp + 0x70]
mov byte [esp + 0x7fc], 0x2f
call fcn.0044a3d4
lea ecx, [esp + 0x6c]
mov byte [esp + 0x7fc], 3
call fcn.0044a3d4
lea ecx, [esp + 0x44]
mov byte [esp + 0x7fc], 2
call fcn.0044a3d4
lea ecx, [esp + 0x10]
mov byte [esp + 0x7fc], 1
call fcn.0044a3d4
lea ecx, [esp + 0x3c]
mov byte [esp + 0x7fc], 0
call fcn.0044a3d4
lea ecx, [esp + 0x40]
mov dword [esp + 0x7fc], 0xffffffff
call fcn.0044a3d4
mov ecx, dword [esp + 0x7f4]
pop edi
pop esi
pop ebp
mov eax, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0x7f0
ret