Function at 0x415db0
Capabilities:
Create process on windows
Delete registry key
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18c
mov eax, dword [0x463444]
xor eax, ebp
mov dword [ebp - 0x20], eax
push edi
mov dword [ebp - 0x17c], ecx
mov eax, dword [ebp - 0x17c]
mov dword [eax + 0xa4], 0
mov ecx, dword [ebp - 0x17c]
mov dword [ecx + 0xa8], 0
mov edx, dword [ebp - 0x17c]
mov dword [edx + 0xb4], 0
mov eax, dword [ebp - 0x17c]
mov dword [eax + 0x9c], 0
mov dword [ebp - 0x12c], 0
lea ecx, [ebp - 4]
push ecx
push 0xf003f
push 0
push 0x453ca8
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
jne 0x415e58
push str.SYSTEMCurrentControlSetControlClass4D36E965_E325_11CE_BFC1_08002BE10318UpperFilters
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x17c]
mov dword [eax + 0xb0], 0
mov ecx, dword [ebp - 0x17c]
cmp dword [ecx + 0xa0], 0
je 0x415e9a
mov edx, dword [ebp - 0x17c]
mov eax, dword [edx + 0xa0]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 0x17c]
mov dword [ecx + 0xa0], 0
mov ecx, dword [ebp - 0x17c]
call fcn.00419930
test eax, eax
jne 0x415f3b
mov ecx, dword [ebp - 0x17c]
call fcn.004199a0
test eax, eax
jne 0x415f3b
mov ecx, dword [ebp - 0x17c]
add ecx, 0x7c
call fcn.004023b0
push str.UKEY_NO_KEY
mov ecx, dword [ebp - 0x17c]
add ecx, 0x7c
call fcn.0041a560
push 0x453d70
mov ecx, dword [ebp - 0x17c]
add ecx, 0x7c
call fcn.0041a560
push 0
push 0
push 0xbba
mov ecx, dword [ebp - 0x17c]
call fcn.0041a5f0
mov edx, dword [ebp - 0x17c]
mov dword [edx + 0x74], 0
mov eax, dword [ebp - 0x17c]
mov dword [eax + 0x98], 1
mov ecx, dword [ebp - 0x17c]
mov dword [ecx + 0x9c], 0
mov eax, 1
jmp 0x416776
lea edx, [ebp - 4]
push edx
push 0xf003f
push 0
push 0x453d80
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
jne 0x415f7f
push str.SoftwareMicrosoftWindowsCurrentVersionExtSettings20A2D8D1_5A6E_4B46_B3C1_3415678028F0
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0040b7b0
test eax, eax
je 0x415fd5
lea ecx, [ebp - 4]
push ecx
push 0xf013f
push 0
push 0x453e40
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
jne 0x415fd5
push 0
push pe_nt_image_headers32
push str.SoftwareMicrosoftWindowsCurrentVersionExtSettingsDCCF988E_4A53_48D2_98DD_BD03BD8FBE05
push SysReAllocStringLen
call fcn.0040b750
add esp, 0x10
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push 0x453f00
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
jne 0x416019
push 0x453f60
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0040b7b0
test eax, eax
je 0x41606f
lea edx, [ebp - 4]
push edx
push 0xf013f
push 0
push 0x453fc0
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
jne 0x41606f
push 0
push pe_nt_image_headers32
push str.SoftwareMicrosoftWindowsCurrentVersionExtSettings390C7648_5CF1_49FF_A911_B2325536EE61
push SysReAllocStringLen
call fcn.0040b750
add esp, 0x10
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 4]
push ecx
push 0xf003f
push 0
push 0x454080
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
jne 0x4160b3
push 0x4540e0
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0040b7b0
test eax, eax
je 0x416109
lea eax, [ebp - 4]
push eax
push 0xf013f
push 0
push 0x454140
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
jne 0x416109
push 0
push pe_nt_image_headers32
push str.SoftwareMicrosoftWindowsCurrentVersionExtSettingsAE92D029_FE4E_4CEA_AB17_5E4895B6981F
push SysReAllocStringLen
call fcn.0040b750
add esp, 0x10
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 0x128], 0
push 0x103
push 0
lea edx, [ebp - 0x127]
push edx
call fcn.0043b290
add esp, 0xc
lea eax, [ebp - 0x128]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [ebp - 0x128]
add ecx, 0xffffffff
mov dword [ebp - 0x180], ecx
mov edx, dword [ebp - 0x180]
mov al, byte [edx + 1]
mov byte [ebp - 0x181], al
add dword [ebp - 0x180], 1
cmp byte [ebp - 0x181], 0
jne 0x416147
mov edi, dword [ebp - 0x180]
mov ecx, dword [str.CTRL.EXE]
mov dword [edi], ecx
mov edx, dword [0x453d78]
mov dword [edi + 4], edx
mov ax, word [0x453d7c]
mov word [edi + 8], ax
lea ecx, [ebp - 0x128]
push ecx
push 0x454200
push 0xc1
mov ecx, dword [ebp - 0x17c]
call fcn.00418e70
movzx edx, al
test edx, edx
je 0x41621f
push 0x44
push 0
lea eax, [ebp - 0x178]
push eax
call fcn.0043b290
add esp, 0xc
mov dword [ebp - 0x178], 0x44
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x178]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x128]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x41621f
push 0xffffffffffffffff
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 0x128]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x128]
add eax, 0xffffffff
mov dword [ebp - 0x188], eax
mov ecx, dword [ebp - 0x188]
mov dl, byte [ecx + 1]
mov byte [ebp - 0x189], dl
add dword [ebp - 0x188], 1
cmp byte [ebp - 0x189], 0
jne 0x416240
mov edi, dword [ebp - 0x188]
mov eax, dword [str.CTRL1.EXE]
mov dword [edi], eax
mov ecx, dword [0x454208]
mov dword [edi + 4], ecx
mov dx, word [0x45420c]
mov word [edi + 8], dx
mov al, byte [0x45420e]
mov byte [edi + 0xa], al
mov ecx, dword [ebp - 0x17c]
call fcn.00419cd0
test eax, eax
jne 0x416333
lea ecx, [ebp - 0x128]
push ecx
push 0x454210
push 0xc2
mov ecx, dword [ebp - 0x17c]
call fcn.00418e70
movzx edx, al
test edx, edx
je 0x416333
push 0x44
push 0
lea eax, [ebp - 0x178]
push eax
call fcn.0043b290
add esp, 0xc
mov dword [ebp - 0x178], 0x44
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x178]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x128]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x416333
push 0xffffffffffffffff
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x1c], 0
mov ecx, dword [ebp - 0x17c]
call fcn.00418cc0
test eax, eax
jne 0x416359
mov edx, dword [ebp - 0x17c]
mov dword [edx + 0xa4], 1
push 0x454214
mov ecx, dword [ebp - 0x17c]
call fcn.004174c0
mov ecx, dword [ebp - 0x17c]
call fcn.00418d30
test eax, eax
je 0x41638a
mov ecx, dword [ebp - 0x17c]
call fcn.00419020
movzx eax, al
test eax, eax
jne 0x41639a
mov ecx, dword [ebp - 0x17c]
mov dword [ecx + 0xa4], 1
push 0x454218
mov ecx, dword [ebp - 0x17c]
call fcn.004174c0
mov ecx, dword [ebp - 0x17c]
call fcn.004179d0
mov ecx, dword [ebp - 0x17c]
call fcn.00417910
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jle 0x4163d9
mov edx, dword [ebp - 0x17c]
mov dword [edx + 0xa4], 1
push 0x45421c
mov ecx, dword [ebp - 0x17c]
call fcn.004174c0
mov ecx, dword [ebp - 0x17c]
call fcn.00416790
test eax, eax
jne 0x4163ff
xor eax, eax
jmp 0x416776
push 0x454220
mov ecx, dword [ebp - 0x17c]
call fcn.004174c0
mov ecx, dword [ebp - 0x17c]
call fcn.004169d0
test eax, eax
jne 0x416425
xor eax, eax
jmp 0x416776
mov ecx, dword [ebp - 0x17c]
call fcn.00418cc0
test eax, eax
jne 0x4164a3
mov ecx, dword [ebp - 0x17c]
add ecx, 0x7c
call fcn.004023b0
push str.CHECK0
mov ecx, dword [ebp - 0x17c]
add ecx, 0x7c
call fcn.0041a560
push 0x45422c
mov ecx, dword [ebp - 0x17c]
add ecx, 0x7c
call fcn.0041a560
push 0
push 0
push 0xbba
mov ecx, dword [ebp - 0x17c]
call fcn.0041a5f0
mov eax, dword [ebp - 0x17c]
mov dword [eax + 0x98], 1
mov ecx, dword [ebp - 0x17c]
mov dword [ecx + 0x9c], 0
xor eax, eax
jmp 0x416776
mov ecx, dword [ebp - 0x17c]
call fcn.00418d30
test eax, eax
je 0x4164c4
mov ecx, dword [ebp - 0x17c]
call fcn.00419020
movzx edx, al
test edx, edx
jne 0x416533
mov ecx, dword [ebp - 0x17c]
add ecx, 0x7c
call fcn.004023b0
push str.CHECK1
mov ecx, dword [ebp - 0x17c]
add ecx, 0x7c
call fcn.0041a560
push 0x454238
mov ecx, dword [ebp - 0x17c]
add ecx, 0x7c
call fcn.0041a560
push 0
push 0
push 0xbba
mov ecx, dword [ebp - 0x17c]
call fcn.0041a5f0
mov eax, dword [ebp - 0x17c]
mov dword [eax + 0x98], 1
mov ecx, dword [ebp - 0x17c]
mov dword [ecx + 0x9c], 0
xor eax, eax
jmp 0x416776
push 0x45423c
mov ecx, dword [ebp - 0x17c]
call fcn.004174c0
mov ecx, dword [ebp - 0x17c]
call fcn.004179d0
mov ecx, dword [ebp - 0x17c]
call fcn.00417a50
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jle 0x4165d1
mov ecx, dword [ebp - 0x17c]
add ecx, 0x7c
call fcn.004023b0
push str.CHECK2
mov ecx, dword [ebp - 0x17c]
add ecx, 0x7c
call fcn.0041a560
push 0x454248
mov ecx, dword [ebp - 0x17c]
add ecx, 0x7c
call fcn.0041a560
push 0
push 0
push 0xbba
mov ecx, dword [ebp - 0x17c]
call fcn.0041a5f0
mov edx, dword [ebp - 0x17c]
mov dword [edx + 0x98], 1
mov eax, dword [ebp - 0x17c]
mov dword [eax + 0x9c], 0
xor eax, eax
jmp 0x416776
mov ecx, dword [ebp - 0x17c]
call fcn.00417910
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jle 0x416654
mov ecx, dword [ebp - 0x17c]
add ecx, 0x7c
call fcn.004023b0
push str.CHECK3
mov ecx, dword [ebp - 0x17c]
add ecx, 0x7c
call fcn.0041a560
push 0x454254
mov ecx, dword [ebp - 0x17c]
add ecx, 0x7c
call fcn.0041a560
push 0
push 0
push 0xbba
mov ecx, dword [ebp - 0x17c]
call fcn.0041a5f0
mov ecx, dword [ebp - 0x17c]
mov dword [ecx + 0x98], 1
mov edx, dword [ebp - 0x17c]
mov dword [edx + 0x9c], 0
xor eax, eax
jmp 0x416776
push 0x454258
mov ecx, dword [ebp - 0x17c]
call fcn.004174c0
mov ecx, dword [ebp - 0x17c]
call fcn.00416790
test eax, eax
jne 0x41667a
xor eax, eax
jmp 0x416776
mov eax, dword [ebp - 0x17c]
cmp dword [eax + 0xa8], 0
je 0x4166fe
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x17c]
add ecx, 0x7c
call fcn.004023b0
push 0x45425c
mov ecx, dword [ebp - 0x17c]
add ecx, 0x7c
call fcn.0041a560
push 0x454264
mov ecx, dword [ebp - 0x17c]
add ecx, 0x7c
call fcn.0041a560
push 0
push 0
push 0xbba
mov ecx, dword [ebp - 0x17c]
call fcn.0041a5f0
mov ecx, dword [ebp - 0x17c]
mov dword [ecx + 0x98], 3
mov edx, dword [ebp - 0x17c]
mov dword [edx + 0x9c], 0
jmp 0x416771
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x17c]
add ecx, 0x7c
call fcn.004023b0
push str.CHECK_OK
mov ecx, dword [ebp - 0x17c]
add ecx, 0x7c
call fcn.0041a560
push 0x454274
mov ecx, dword [ebp - 0x17c]
add ecx, 0x7c
call fcn.0041a560
push 0
push 0
push 0xbba
mov ecx, dword [ebp - 0x17c]
call fcn.0041a5f0
mov eax, dword [ebp - 0x17c]
mov dword [eax + 0x98], 2
mov ecx, dword [ebp - 0x17c]
mov dword [ecx + 0x9c], 0
mov eax, 1
pop edi
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.004381fb
mov esp, ebp
pop ebp
ret