Function at 0x470222
Capabilities:
Persist via run registry key
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c4
mov eax, dword [0x53f270]
xor eax, esp
mov dword [esp + 0x1c0], eax
push ebx
push esi
xor esi, esi
mov ebx, ecx
push edi
mov dword [esp + 0x14], ebx
mov dword [esp + 0xc], esi
cmp dword [ebp + 8], esi
je 0x470255
call fcn.00472902
mov dword [esp + 0x44], esi
xor ecx, ecx
mov dl, 0x25
mov esi, ebx
mov dword [esp + 0x10], 1
call fcn.0046840e
cmp eax, 0xffffffff
jle 0x470d28
jmp 0x470279
mov ebx, esi
cmp dword [esp + 0x44], 5
jge 0x470d28
cmp dword [esp + 0x10], 0
je 0x470d28
mov edi, str._windows_
push edi
xor ecx, ecx
mov esi, ebx
call fcn.004ea618
cmp eax, 0xffffffff
je 0x4702b8
push 0x104
lea eax, [esp + 0xc4]
push eax
call dword [0x4fe2a0]
jmp 0x4702df
mov edi, str._system_
push edi
xor ecx, ecx
mov esi, ebx
call fcn.004ea618
cmp eax, 0xffffffff
je 0x470302
push 0x104
lea eax, [esp + 0xc4]
push eax
call dword [0x4fe2a4]
test eax, eax
jbe 0x470d0e
lea eax, [esp + 0xc0]
push eax
push edi
push dword [esp + 0x1c]
call fcn.004eb702
mov dword [esp + 0x10], eax
jmp 0x470d0e
mov edi, str._temp_
push edi
xor ecx, ecx
mov esi, ebx
call fcn.004ea618
cmp eax, 0xffffffff
je 0x470333
lea esi, [esp + 0x64]
call fcn.0046572f
push dword [eax]
push edi
push ebx
call fcn.004eb702
mov dword [esp + 0x10], eax
mov ecx, esi
jmp 0x470d09
mov edi, str._programfiles_
push edi
xor ecx, ecx
mov esi, ebx
call fcn.004ea618
cmp eax, 0xffffffff
je 0x47041d
push str.SoftwareMicrosoftWindowsCurrentVersion
lea eax, [esp + 0x64]
push eax
call fcn.004e839f
lea ecx, [esp + 0x24]
call fcn.004e9f40
xor esi, esi
push esi
push 0x26
lea eax, [esp + 0xc8]
push eax
push esi
call dword [0x4fe378]
test eax, eax
je 0x470387
lea eax, [esp + 0xc0]
push eax
push edi
push ebx
jmp 0x470402
or dword [esp + 0xc], 1
push ecx
mov eax, esp
push str.ProgramFilesDir
push eax
call fcn.004e839f
push ecx
push 1
push esi
push ecx
mov eax, esp
lea ecx, [esp + 0x74]
push ecx
push eax
call fcn.004ea069
xor ebx, ebx
mov esi, 0x80000002
lea eax, [esp + 0x8c]
call fcn.004739d7
mov ecx, eax
add esp, 4
lea eax, [esp + 0x28]
call fcn.004742e3
test eax, eax
je 0x4703de
mov eax, dword [esp + 0x24]
cmp dword [eax - 0xc], ebx
je 0x4703de
mov bl, 1
jmp 0x4703e0
xor bl, bl
test byte [esp + 0xc], 1
je 0x4703f5
and dword [esp + 0xc], 0xfffffffe
lea ecx, [esp + 0x78]
call fcn.00473a9f
test bl, bl
je 0x47040b
push dword [esp + 0x24]
push edi
push dword [esp + 0x1c]
call fcn.004eb702
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x24]
call fcn.004e8425
lea ecx, [esp + 0x60]
jmp 0x470d09
mov edi, str._programfiles64_
push edi
xor ecx, ecx
mov esi, ebx
call fcn.004ea618
cmp eax, 0xffffffff
je 0x4704ea
push str.SoftwareMicrosoftWindowsCurrentVersion
lea eax, [esp + 0x60]
push eax
call fcn.004e839f
lea ecx, [esp + 0x2c]
call fcn.004e9f40
or dword [esp + 0xc], 2
push ecx
mov eax, esp
push str.ProgramFilesDir
push eax
call fcn.004e839f
push ecx
call fcn.004701ad
push 0
push 0
push ecx
mov ebx, eax
mov eax, esp
lea ecx, [esp + 0x70]
push ecx
push eax
call fcn.004ea069
mov esi, 0x80000002
lea eax, [esp + 0x8c]
call fcn.004739d7
mov ecx, eax
add esp, 4
lea eax, [esp + 0x30]
call fcn.004742e3
test eax, eax
je 0x4704ab
mov eax, dword [esp + 0x2c]
cmp dword [eax - 0xc], 0
je 0x4704ab
mov bl, 1
jmp 0x4704ad
xor bl, bl
test byte [esp + 0xc], 2
je 0x4704c2
and dword [esp + 0xc], 0xfffffffd
lea ecx, [esp + 0x78]
call fcn.00473a9f
test bl, bl
je 0x4704d8
push dword [esp + 0x2c]
push edi
push dword [esp + 0x1c]
call fcn.004eb702
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x2c]
call fcn.004e8425
lea ecx, [esp + 0x5c]
jmp 0x470d09
mov edi, str._local_appdata_
push edi
xor ecx, ecx
mov esi, ebx
call fcn.004ea618
cmp eax, 0xffffffff
jne 0x470be9
push str._localappdata_
xor ecx, ecx
call fcn.004ea618
cmp eax, 0xffffffff
jne 0x470be9
mov esi, dword [esp + 0x14]
mov edi, str._appdata_
push edi
xor ecx, ecx
call fcn.004ea618
cmp eax, 0xffffffff
je 0x470604
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea eax, [esp + 0x58]
push eax
call fcn.004e839f
lea ecx, [esp + 0x3c]
call fcn.004e9f40
push 0
push 0x1a
lea eax, [esp + 0xc8]
push eax
push 0
call dword [0x4fe378]
test eax, eax
je 0x47056d
lea eax, [esp + 0xc0]
push eax
push edi
push esi
jmp 0x4705e9
or dword [esp + 0xc], 8
push ecx
mov eax, esp
push str.AppData
push eax
call fcn.004e839f
push ecx
push 1
push 0
push ecx
mov eax, esp
lea ecx, [esp + 0x68]
push ecx
push eax
call fcn.004ea069
xor ebx, ebx
mov esi, 0x80000001
lea eax, [esp + 0x8c]
call fcn.004739d7
mov ecx, eax
add esp, 4
lea eax, [esp + 0x40]
call fcn.004742e3
test eax, eax
je 0x4705c5
mov eax, dword [esp + 0x3c]
cmp dword [eax - 0xc], ebx
je 0x4705c5
mov bl, 1
jmp 0x4705c7
xor bl, bl
test byte [esp + 0xc], 8
je 0x4705dc
and dword [esp + 0xc], 0xfffffff7
lea ecx, [esp + 0x78]
call fcn.00473a9f
test bl, bl
je 0x4705f2
push dword [esp + 0x3c]
push edi
push dword [esp + 0x1c]
call fcn.004eb702
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x3c]
call fcn.004e8425
lea ecx, [esp + 0x54]
jmp 0x470d09
mov ebx, str._programdata_
push ebx
xor ecx, ecx
call fcn.004ea618
cmp eax, 0xffffffff
je 0x4706f4
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea eax, [esp + 0x50]
push eax
call fcn.004e839f
lea ecx, [esp + 0x34]
call fcn.004e9f40
push 0
push 0x23
lea eax, [esp + 0xc8]
push eax
push 0
call dword [0x4fe378]
test eax, eax
je 0x470659
lea eax, [esp + 0xc0]
push eax
push ebx
push esi
jmp 0x4706d9
or dword [esp + 0xc], 0x10
push ecx
mov eax, esp
push str.Common_AppData
push eax
call fcn.004e839f
push ecx
push 1
push 0
push ecx
mov eax, esp
lea ecx, [esp + 0x60]
push ecx
push eax
call fcn.004ea069
xor ebx, ebx
mov esi, 0x80000002
lea eax, [esp + 0x8c]
call fcn.004739d7
mov ecx, eax
add esp, 4
lea eax, [esp + 0x38]
call fcn.004742e3
test eax, eax
je 0x4706b1
mov eax, dword [esp + 0x34]
cmp dword [eax - 0xc], ebx
je 0x4706b1
mov bl, 1
jmp 0x4706b3
xor bl, bl
test byte [esp + 0xc], 0x10
je 0x4706c8
and dword [esp + 0xc], 0xffffffef
lea ecx, [esp + 0x78]
call fcn.00473a9f
test bl, bl
je 0x4706e2
push dword [esp + 0x34]
push str._programdata_
push dword [esp + 0x1c]
call fcn.004eb702
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x34]
call fcn.004e8425
lea ecx, [esp + 0x4c]
jmp 0x470d09
mov ebx, str._mydocuments_
push ebx
xor ecx, ecx
call fcn.004ea618
cmp eax, 0xffffffff
je 0x4707dd
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea eax, [esp + 0x54]
push eax
call fcn.004e839f
lea ecx, [esp + 0x28]
call fcn.004e9f40
push 0
push 5
lea eax, [esp + 0xc8]
push eax
push 0
call dword [0x4fe378]
test eax, eax
je 0x470746
lea eax, [esp + 0xc0]
push eax
push ebx
push esi
jmp 0x4707c2
or dword [esp + 0xc], 0x20
push ecx
mov eax, esp
push str.Personal
push eax
call fcn.004e839f
push ecx
push 1
push 0
push ecx
mov eax, esp
lea ecx, [esp + 0x64]
push ecx
push eax
call fcn.004ea069
xor ebx, ebx
mov esi, 0x80000001
lea eax, [esp + 0x8c]
call fcn.004739d7
mov ecx, eax
add esp, 4
lea eax, [esp + 0x2c]
call fcn.004742e3
test eax, eax
je 0x47079e
mov eax, dword [esp + 0x28]
cmp dword [eax - 0xc], ebx
je 0x47079e
mov bl, 1
jmp 0x4707a0
xor bl, bl
test byte [esp + 0xc], 0x20
je 0x4707b5
and dword [esp + 0xc], 0xffffffdf
lea ecx, [esp + 0x78]
call fcn.00473a9f
test bl, bl
je 0x4707cb
push dword [esp + 0x28]
push edi
push dword [esp + 0x1c]
call fcn.004eb702
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x28]
call fcn.004e8425
lea ecx, [esp + 0x50]
jmp 0x470d09
mov ebx, str._desktop_
push ebx
xor ecx, ecx
call fcn.004ea618
mov edi, str._desktopdir_
cmp eax, 0xffffffff
jne 0x470ad8
push edi
xor ecx, ecx
call fcn.004ea618
cmp eax, 0xffffffff
jne 0x470ad8
mov ebx, str._userprofile_
push ebx
xor ecx, ecx
call fcn.004ea618
cmp eax, 0xffffffff
je 0x4708bc
mov edi, 0x501c70
push edi
lea eax, [esp + 0x20]
push eax
call fcn.004e839f
cmp dword [ebp + 8], 0
je 0x470869
call fcn.0046f78b
cmp eax, 6
jl 0x470869
push ecx
mov eax, esp
push ebx
push eax
call fcn.004e839f
lea esi, [esp + 0x78]
call fcn.00471f0f
pop ecx
lea edi, [esp + 0x1c]
call fcn.004e9792
mov ecx, esi
call fcn.004e8425
mov esi, dword [esp + 0x14]
jmp 0x470896
push 0x104
lea eax, [esp + 0xc4]
push eax
push ebx
call dword [0x4fe2a8]
test eax, eax
jne 0x470884
push edi
jmp 0x47088c
lea eax, [esp + 0xc0]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.004e8373
mov eax, dword [esp + 0x1c]
cmp dword [eax - 0xc], 0
jne 0x4708a7
and dword [esp + 0x10], 0
jmp 0x4708b3
push eax
push ebx
push esi
call fcn.004eb702
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x1c]
jmp 0x470d09
mov edi, str._reg:
push edi
xor ecx, ecx
call fcn.004ea618
xor ecx, ecx
cmp eax, 0xffffffff
je 0x470a97
push edi
call fcn.004ea618
mov edi, eax
lea ebx, [edi + 5]
push 0x5099a4
mov ecx, ebx
call fcn.004ea618
mov dword [esp + 0x10], eax
test eax, eax
jge 0x47092f
push ecx
mov eax, esp
push str.CCoreSystem::ReplaceSystemVars
push eax
call fcn.004e839f
push 0x2e9
push ecx
mov eax, esp
push str.CoreSystem.cpp
push eax
call fcn.004e839f
push ecx
mov eax, esp
push str.Ending___not_found_
push eax
call fcn.004e839f
xor eax, eax
inc eax
call fcn.00467615
jmp 0x470ace
lea ecx, [esp + 0x40]
call fcn.004e9f40
lea ecx, [esp + 0x38]
call fcn.004e9f40
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x74]
push eax
sub ecx, ebx
push ecx
push esp
push esi
mov edx, ebx
call fcn.004e9baa
lea eax, [esp + 0x44]
call fcn.004736cc
add esp, 0xc
lea ecx, [esp + 0x30]
call fcn.004e9f40
push 1
push 0
push ecx
mov eax, esp
lea ecx, [esp + 0x4c]
push ecx
push eax
call fcn.004ea069
mov esi, dword [esp + 0x7c]
xor ebx, ebx
lea eax, [esp + 0x84]
call fcn.004739d7
cmp dword [esp + 0xa8], ebx
je 0x4709f1
push ecx
mov eax, esp
lea ecx, [esp + 0x3c]
push ecx
push eax
call fcn.004ea069
lea eax, [esp + 0x34]
lea ecx, [esp + 0x7c]
call fcn.004742e3
test eax, eax
je 0x4709f1
mov eax, dword [esp + 0x30]
cmp dword [eax - 0xc], ebx
je 0x4709f1
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
sub eax, edi
inc eax
push edi
call fcn.00468308
push dword [esp + 0x30]
push edi
push dword [esp + 0x1c]
call fcn.0046838a
mov dword [esp + 0x10], 1
jmp 0x470a73
push ecx
mov eax, esp
push str.CCoreSystem::ReplaceSystemVars
push eax
call fcn.004e839f
push 0x2fd
push ecx
mov eax, esp
push str.CoreSystem.cpp
push eax
call fcn.004e839f
push ecx
mov edi, esp
lea eax, [esp + 0x48]
push eax
push 0x5099dc
lea eax, [esp + 0x84]
push str.Failed_to_read_value_from
push eax
lea ecx, [esp + 0x60]
call fcn.004e9a57
pop ecx
pop ecx
lea ecx, [esp + 0x80]
push ecx
mov esi, eax
call fcn.004e99f2
pop ecx
pop ecx
push edi
mov esi, eax
call fcn.004e99a0
pop ecx
pop ecx
call dword [0x4fe0fc]
call fcn.00467615
lea ecx, [esp + 0x68]
call fcn.004e8425
lea ecx, [esp + 0x6c]
call fcn.004e8425
mov dword [esp + 0x10], ebx
lea ecx, [esp + 0x78]
call fcn.00473a9f
lea ecx, [esp + 0x30]
call fcn.004e8425
lea ecx, [esp + 0x38]
call fcn.004e8425
lea ecx, [esp + 0x40]
jmp 0x470d09
push str._firefoxprofiles_
call fcn.004ea618
test eax, eax
jge 0x470ace
push str._itunesbackups_
xor ecx, ecx
call fcn.004ea618
test eax, eax
jge 0x470ace
push ecx
mov eax, esp
push str.Invalid_string_replacement_in_path:
push eax
mov ecx, esi
call fcn.004e9a57
pop ecx
pop ecx
push 1
call fcn.00465347
and dword [esp + 0x10], 0
jmp 0x470d0e
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea eax, [esp + 0x5c]
push eax
call fcn.004e839f
lea ecx, [esp + 0x18]
call fcn.004e9f40
push 0
push 0x10
lea eax, [esp + 0xc8]
push eax
push 0
call dword [0x4fe378]
test eax, eax
je 0x470b2e
lea eax, [esp + 0xc0]
push eax
push edi
push esi
call fcn.004eb702
test eax, eax
jne 0x470bcf
lea eax, [esp + 0xc0]
push eax
push ebx
push esi
jmp 0x470bc0
or dword [esp + 0xc], 0x40
push ecx
mov eax, esp
push str.Desktop
push eax
call fcn.004e839f
push ecx
push 1
push 0
push ecx
mov eax, esp
lea ecx, [esp + 0x6c]
push ecx
push eax
call fcn.004ea069
xor ebx, ebx
mov esi, 0x80000001
lea eax, [esp + 0x8c]
call fcn.004739d7
mov ecx, eax
add esp, 4
lea eax, [esp + 0x1c]
call fcn.004742e3
test eax, eax
je 0x470b86
mov eax, dword [esp + 0x18]
cmp dword [eax - 0xc], ebx
je 0x470b86
mov bl, 1
jmp 0x470b88
xor bl, bl
test byte [esp + 0xc], 0x40
je 0x470b9d
and dword [esp + 0xc], 0xffffffbf
lea ecx, [esp + 0x78]
call fcn.00473a9f
test bl, bl
je 0x470bd7
push dword [esp + 0x18]
push edi
push dword [esp + 0x1c]
call fcn.004eb702
test eax, eax
jne 0x470bcf
push dword [esp + 0x18]
push str._desktop_
push dword [esp + 0x1c]
call fcn.004eb702
test eax, eax
jne 0x470bcf
and dword [esp + 0x10], eax
jmp 0x470bd7
mov dword [esp + 0x10], 1
lea ecx, [esp + 0x18]
call fcn.004e8425
lea ecx, [esp + 0x58]
jmp 0x470d09
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea eax, [esp + 0x4c]
push eax
call fcn.004e839f
lea ecx, [esp + 0x20]
call fcn.004e9f40
xor esi, esi
push esi
push 0x1c
lea eax, [esp + 0xc8]
push eax
push esi
call dword [0x4fe378]
test eax, eax
je 0x470c54
lea eax, [esp + 0xc0]
push eax
push edi
push ebx
call fcn.004eb702
test eax, eax
jne 0x470cf4
lea eax, [esp + 0xc0]
push eax
push str._localappdata_
push ebx
call fcn.004eb702
test eax, eax
jne 0x470cf4
mov dword [esp + 0x10], esi
jmp 0x470cfc
or dword [esp + 0xc], 4
push ecx
mov eax, esp
push str.Local_AppData
push eax
call fcn.004e839f
push ecx
push 1
push esi
push ecx
mov eax, esp
lea ecx, [esp + 0x5c]
push ecx
push eax
call fcn.004ea069
xor ebx, ebx
mov esi, 0x80000001
lea eax, [esp + 0x8c]
call fcn.004739d7
mov ecx, eax
add esp, 4
lea eax, [esp + 0x24]
call fcn.004742e3
test eax, eax
je 0x470cab
mov eax, dword [esp + 0x20]
cmp dword [eax - 0xc], ebx
je 0x470cab
mov bl, 1
jmp 0x470cad
xor bl, bl
test byte [esp + 0xc], 4
je 0x470cc2
and dword [esp + 0xc], 0xfffffffb
lea ecx, [esp + 0x78]
call fcn.00473a9f
test bl, bl
je 0x470cfc
push dword [esp + 0x20]
push edi
push dword [esp + 0x1c]
call fcn.004eb702
test eax, eax
jne 0x470cf4
push dword [esp + 0x20]
push str._localappdata_
push dword [esp + 0x1c]
call fcn.004eb702
test eax, eax
jne 0x470cf4
and dword [esp + 0x10], eax
jmp 0x470cfc
mov dword [esp + 0x10], 1
lea ecx, [esp + 0x20]
call fcn.004e8425
lea ecx, [esp + 0x48]
call fcn.004e8425
mov esi, dword [esp + 0x14]
inc dword [esp + 0x44]
xor ecx, ecx
mov dl, 0x25
call fcn.0046840e
cmp eax, 0xffffffff
jg 0x470277
cmp dword [ebp + 8], 0
je 0x470d33
call fcn.00462911
mov ecx, dword [esp + 0x1cc]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00440531
mov esp, ebp
pop ebp
ret