Function at 0x4079b0
Capabilities:
Create directory
Create process on windows
Identify system language via api
Query or enumerate registry value
Schedule task via at
Set current directory
Set registry value

Disassembly:
sub esp, 0x2cc
mov eax, dword [esp + 0x2d0]
push ebx
push ebp
push esi
push edi
mov dword [0x415ee4], eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea ecx, [esp + 0x24]
push ecx
mov esi, eax
push str.SoftwareRZTHZHBCDPlugIn
push 0x80000002
mov dword [esp + 0x34], esi
call ebp
test eax, eax
je 0x407a10
lea edx, [esp + 0x24]
push edx
push str.SoftwareRZTHZHBCDPlugIn
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x407a10
mov dword [esp + 0x18], 0
jmp 0x407a5f
mov eax, dword [esp + 0x18]
test eax, eax
je 0x407a5f
cmp si, 0x804
je 0x407a3c
cmp si, 0x404
je 0x407a3c
cmp si, 0xc04
je 0x407a3c
cmp si, 0x1004
mov dword [esp + 0x18], 1
jne 0x407a44
mov dword [esp + 0x18], 0
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x18]
push 4
push eax
push 4
push 0
push str.LanguageType
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0
push str.C:Program_FilesLaserHost_
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0xd4]
push str.C:Program_FilesLaserHost_
push edx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0xd4]
push str.ZHBGraph2DKernel.dll
push eax
call edi
lea ecx, [esp + 0xd4]
push ecx
push 0x6a
call fcn.004078d0
add esp, 8
lea edx, [esp + 0xd4]
push str.C:Program_FilesLaserHost_
push edx
call esi
lea eax, [esp + 0xd4]
push str.ZHBPanelComm.dll
push eax
call edi
lea ecx, [esp + 0xd4]
push ecx
push 0x6b
call fcn.004078d0
add esp, 8
lea edx, [esp + 0xd4]
push str.C:Program_FilesLaserHost_
push edx
call esi
lea eax, [esp + 0xd4]
push str.ZHBCDPlugInResRPC.dll
push eax
call edi
lea ecx, [esp + 0xd4]
push ecx
push 0x70
call fcn.004078d0
add esp, 8
lea edx, [esp + 0xd4]
push str.C:Program_FilesLaserHost_
push edx
call esi
lea eax, [esp + 0xd4]
push str.ZHBCDPlugInResEng.dll
push eax
call edi
lea ecx, [esp + 0xd4]
push ecx
push 0x72
call fcn.004078d0
add esp, 8
lea edx, [esp + 0xd4]
push str.C:Program_FilesLaserHost_
push edx
call esi
lea eax, [esp + 0xd4]
push str.ZHBCDPlugInResTrd.dll
push eax
call edi
lea ecx, [esp + 0xd4]
push ecx
push 0x79
call fcn.004078d0
add esp, 8
lea edx, [esp + 0xd4]
push str.C:Program_FilesLaserHost_
push edx
call esi
lea eax, [esp + 0xd4]
push str.MFC42.dll
push eax
call edi
lea ecx, [esp + 0xd4]
push ecx
push 0x6c
call fcn.004078d0
add esp, 8
lea edx, [esp + 0xd4]
push str.C:Program_FilesLaserHost_
push edx
call esi
lea eax, [esp + 0xd4]
push str.MSVCRT.dll
push eax
call edi
lea ecx, [esp + 0xd4]
push ecx
push 0x6d
call fcn.004078d0
add esp, 8
lea edx, [esp + 0xd4]
push str.C:Program_FilesLaserHost_
push edx
call esi
lea eax, [esp + 0xd4]
push str.regsvr32.exe
push eax
call edi
lea ecx, [esp + 0xd4]
push ecx
push 0x6f
call fcn.004078d0
add esp, 8
lea edx, [esp + 0xd4]
push str.C:Program_FilesLaserHost_
push edx
call esi
lea eax, [esp + 0xd4]
push str.ZHBCDPlugIn.ocx
push eax
call edi
lea ecx, [esp + 0xd4]
push ecx
push 0x69
call fcn.004078d0
add esp, 8
push str.C:Program_FilesLaserHost_
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push 0
push str.regsvr32__s_ZHBCDPlugIn.ocx
call dword [sym.imp.KERNEL32.dll_WinExec]
lea edx, [esp + 0x14]
mov dword [esp + 0x20], 1
push edx
push str.SoftwareCorelCorelDraw
push 0x80000002
mov dword [esp + 0x28], 0x80
call ebp
test eax, eax
je 0x407c98
mov ecx, dword [0x415ee4]
mov ebx, dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [esp + 0x54]
push 0x80
push eax
push 2
push ecx
call ebx
mov ebp, dword [sym.imp.USER32.dll_MessageBoxA]
push 0
lea edx, [esp + 0x58]
push 0
push edx
push 0
call ebp
jmp 0x407eba
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
push str.13.0
push ecx
xor ebx, ebx
call ebp
test eax, eax
jne 0x407d7e
lea edx, [esp + 0x1c]
lea eax, [esp + 0xd4]
push edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x24]
push eax
push ecx
push ebx
push str.ConfigDir
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x407d25
mov ecx, dword [0x415ee4]
lea eax, [esp + 0x54]
push 0x80
push eax
push 4
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x10]
push edx
call esi
mov eax, dword [esp + 0x14]
push eax
call esi
push ebx
lea ecx, [esp + 0x58]
push ebx
push ecx
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x2cc
ret 0x10
lea edx, [esp + 0xd4]
push 0x5c
push edx
call fcn.00408b06
add esp, 8
inc eax
push str.DrawGMSzhb.gms
push eax
mov byte [eax], 0
call esi
lea eax, [esp + 0xd4]
push eax
push 0x6e
call fcn.004078d0
add esp, 8
test eax, eax
jne 0x407d6a
lea ecx, [esp + 0x54]
push 0x80
push ecx
push 5
jmp 0x4080f8
mov ecx, dword [esp + 0x10]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
mov ebx, 1
call ebp
jmp 0x407d84
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x10]
push edx
push str.12.0
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x407e5b
lea ecx, [esp + 0x1c]
lea edx, [esp + 0xd4]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x24]
push edx
push eax
push 0
push str.ConfigDir
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x407ded
mov eax, dword [0x415ee4]
lea edx, [esp + 0x54]
push 0x80
push edx
push 4
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
mov ecx, dword [esp + 0x10]
push ecx
call ebp
jmp 0x407e78
lea ecx, [esp + 0xd4]
push 0x5c
push ecx
call fcn.00408b06
add esp, 8
inc eax
push str.DrawGMSzhb.gms
push eax
mov byte [eax], 0
call esi
lea edx, [esp + 0xd4]
push edx
push 0x6e
call fcn.004078d0
add esp, 8
test eax, eax
jne 0x407ea0
mov ecx, dword [0x415ee4]
lea eax, [esp + 0x54]
push 0x80
push eax
push 5
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
push 0
lea edx, [esp + 0x58]
push 0
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x2cc
ret 0x10
test ebx, ebx
jne 0x407ea0
mov ecx, dword [0x415ee4]
lea eax, [esp + 0x54]
push 0x80
push eax
push 3
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
mov edx, dword [esp + 0x14]
push edx
call ebp
push 0
lea eax, [esp + 0x58]
push 0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x2cc
ret 0x10
mov ecx, dword [esp + 0x10]
push ecx
call ebp
mov edx, dword [esp + 0x14]
push edx
call ebp
mov ebp, dword [sym.imp.USER32.dll_MessageBoxA]
mov ebx, dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [esp + 0x14]
push eax
push str.SoftwareAutodeskAutoCAD
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x407f51
mov edx, dword [0x415ee4]
lea ecx, [esp + 0x54]
push 0x80
push ecx
push 0xa
push edx
call ebx
push 0
lea eax, [esp + 0x58]
push 0
push eax
push 0
call ebp
mov eax, dword [esp + 0x28]
cmp ax, 0x804
je 0x408126
cmp ax, 0x404
je 0x408126
cmp ax, 0xc04
je 0x408126
cmp ax, 0x1004
je 0x408126
mov edx, dword [0x415ee4]
lea ecx, [esp + 0x54]
push 0x80
push ecx
push 9
push edx
call ebx
mov ecx, dword [0x415ee4]
lea eax, [esp + 0xd4]
push 0x104
push eax
push 8
push ecx
jmp 0x408150
push 4
push 0x41337c
push 0x413364
push 0
call ebp
cmp eax, 6
jne 0x407ef5
mov dword [esp + 0x2c], str.R15.0ACAD_301:409
mov dword [esp + 0x30], str.R15.0ACAD_301:804
mov dword [esp + 0x34], str.R16.0ACAD_201:409
mov dword [esp + 0x38], str.R16.0ACAD_201:804
mov dword [esp + 0x3c], str.R16.1ACAD_301:409
mov dword [esp + 0x40], str.R16.1ACAD_301:804
mov dword [esp + 0x44], str.R16.2ACAD_4001:409
mov dword [esp + 0x48], str.R16.2ACAD_4001:804
mov dword [esp + 0x4c], str.R17.0ACAD_5001:409
mov dword [esp + 0x50], str.R17.0ACAD_5001:804
xor ebx, ebx
lea ebp, [esp + 0x2c]
mov edx, dword [ebp]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x10]
push ecx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x408081
lea ecx, [esp + 0x1c]
lea edx, [esp + 0xd4]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x24]
push edx
push eax
push 0
push str.AcadLocation
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40809f
lea edx, [esp + 0xd4]
lea eax, [esp + 0x1d8]
push edx
push eax
call esi
lea ecx, [esp + 0x1d8]
push str.Support_acad.dvb
push ecx
call edi
lea edx, [esp + 0x1d8]
push edx
push 0x77
call fcn.004078d0
add esp, 8
test eax, eax
je 0x4080ec
lea eax, [esp + 0xd4]
lea ecx, [esp + 0x1d8]
push eax
push ecx
call esi
lea edx, [esp + 0x1d8]
push str.Support_acaddoc.lsp
push edx
call edi
lea eax, [esp + 0x1d8]
push eax
push 0x78
call fcn.004078d0
add esp, 8
test eax, eax
je 0x4080ec
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc ebx
add ebp, 4
cmp ebx, 0xa
jb 0x407fbc
mov ebp, dword [sym.imp.USER32.dll_MessageBoxA]
mov ebx, dword [sym.imp.USER32.dll_LoadStringA]
jmp 0x407ef5
mov eax, dword [0x415ee4]
lea edx, [esp + 0x54]
push 0x80
push edx
push 0xb
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x10]
push ecx
call esi
mov edx, dword [esp + 0x14]
push edx
call esi
push 0
lea eax, [esp + 0x58]
push 0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x2cc
ret 0x10
lea ecx, [esp + 0x54]
push 0x80
push ecx
push 0xc
mov edx, dword [0x415ee4]
push edx
call dword [sym.imp.USER32.dll_LoadStringA]
push 0
lea eax, [esp + 0x58]
push 0
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x2cc
ret 0x10
mov eax, dword [0x415ee4]
lea edx, [esp + 0x54]
push 0x80
push edx
push 6
push eax
call ebx
mov edx, dword [0x415ee4]
lea ecx, [esp + 0xd4]
push 0x104
push ecx
push 7
push edx
call ebx
lea eax, [esp + 0xd4]
push 0
lea ecx, [esp + 0x58]
push eax
push ecx
push 0
call ebp
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2cc
ret 0x10