Function at 0x40f95f
Capabilities:
Check if file exists
Create directory
Create process on windows
Delete file
Move file
Query or enumerate registry value
Set registry value
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3a20
call fcn.00419430
push ebx
push esi
push edi
mov esi, ecx
push 0x10
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x264]
mov dword [ebp - 0x268], ebx
rep stosd dword es:[edi], eax
mov edi, 0x41b414
push ebx
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x24], esi
mov dword [ebp - 8], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x2c], 0x41b40c
call fcn.00402096
push ebx
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x40], 0x41b408
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x48], 0x41b40c
call fcn.00402096
lea eax, [ebp - 0x40]
lea ecx, [ebp - 0x20]
push eax
mov dword [ebp - 0x5c], 0x41b408
call fcn.00414b09
lea eax, [ebp - 0x5c]
lea ecx, [ebp - 0x1c]
push eax
call fcn.00414b09
lea edi, [esi + 0xec]
push 0x40
lea eax, [ebp - 0x120]
push edi
push eax
mov dword [ebp - 0xe0], esi
call fcn.00419570
add esp, 0xc
add esi, 0x134
push str.D:is6Code_62xXTiSetupSetup.cpp
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebx
push edi
call fcn.00419aa4
mov esi, eax
pop ecx
cmp esi, ebx
pop ecx
jne 0x410088
lea eax, [ebp - 8]
push 0x38a
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x268], 0x44
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, dword [ebp - 0x24]
push eax
mov ecx, esi
call fcn.00410b78
lea eax, [ebp - 0x18]
push 0x38b
push eax
lea eax, [ebp - 0x224]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
push ebx
push ebx
push str.CommonFilesDir
mov dword [ebp - 0x18], 0x104
push dword [ebp - 8]
call edi
push eax
mov ecx, esi
call fcn.00410b78
cmp byte [ebp - 0x224], bl
jne 0x40faf1
lea eax, [ebp - 0x18]
push 0x38f
push eax
lea eax, [ebp - 0x224]
push eax
push ebx
push ebx
push str.ProgramFilesDir
push dword [ebp - 8]
mov dword [ebp - 0x18], 0x104
call edi
push eax
mov ecx, esi
call fcn.00410b78
lea eax, [ebp - 0x224]
push str.common_files
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edi, dword [ebp - 8]
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x224]
push eax
push 1
push ebx
push str.CommonFilesDir
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea eax, [ebp - 0x224]
push str.InstallShieldengine6Intel_32iKernel.exe
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp byte [ebp - 0x224], bl
lea eax, [ebp - 0x224]
mov dword [ebp - 0xc], eax
je 0x40fb6f
mov edx, dword [ebp - 0xc]
cmp byte [edx], 0x5c
jne 0x40fb5f
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x5a3]
mov byte [ebp - 0x5a4], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x224]
sub edx, eax
lea eax, [ebp - 0x224]
inc edx
inc edx
push edx
push eax
lea eax, [ebp - 0x5a4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea eax, [ebp - 0x5a4]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_CharNextA]
cmp byte [eax], bl
mov dword [ebp - 0xc], eax
jne 0x40fb14
mov eax, dword [esi + 0x258]
mov ecx, dword [esi + 0x260]
mov dx, word [eax + 0x30]
mov word [eax + 0x34], cx
mov word [eax + 0x32], dx
mov ecx, dword [esi + 0x48]
call fcn.0040c9c0
test al, al
je 0x40ffcb
mov ecx, dword [esi + 0x48]
lea eax, [ebp - 0xdc]
push eax
call fcn.0040c8f5
lea ecx, [ebp - 0x3c0]
mov byte [ebp - 1], bl
call fcn.0040429e
lea ecx, [ebp - 0x4a0]
call fcn.0040429e
mov ecx, 0x208
xor eax, eax
lea edi, [ebp - 0x130f]
mov byte [ebp - 0x1310], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x224]
push ebx
push eax
lea ecx, [ebp - 0xc0]
mov dword [ebp - 0xb4], 0x41b414
mov dword [ebp - 0xac], 0x41b40c
call fcn.00401833
lea eax, [ebp - 0xc0]
lea ecx, [ebp - 0x40]
push eax
mov dword [ebp - 0xc0], 0x41b408
call fcn.0041191d
lea ecx, [ebp - 0xc0]
call fcn.00401925
push ebx
lea edi, [esi + 8]
push str.http:__
push 7
push ebx
mov ecx, edi
call fcn.00401fa3
test eax, eax
je 0x40fc4d
push ebx
push str.ftp:__
push 6
push ebx
mov ecx, edi
call fcn.00401fa3
test eax, eax
jne 0x40fc6c
mov ecx, edi
call fcn.004024bf
push dword [edi + 4]
lea eax, [ebp - 0x1310]
push str.Referer:__s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x2b8]
push str..cab
push eax
lea ecx, [ebp - 0xdc]
call fcn.00411896
mov ecx, eax
call fcn.00410c6e
lea ecx, [ebp - 0x2b8]
mov byte [ebp - 0xd], al
call fcn.00401925
cmp byte [ebp - 0xd], bl
je 0x40fca1
mov byte [ebp - 1], 1
lea eax, [ebp - 0x1310]
push eax
lea eax, [ebp - 0xdc]
sub esp, 0x1c
mov ecx, esp
push 1
push eax
call fcn.00406822
lea ecx, [ebp - 0x3c0]
call fcn.004042f3
lea ecx, [ebp - 0x3c0]
call fcn.004043df
sub esp, 0x1c
mov dword [ebp - 0xc], eax
mov edi, esp
lea eax, [ebp - 0x40]
push ebx
push eax
mov ecx, edi
mov dword [edi + 0xc], 0x41b414
mov dword [edi + 0x14], 0x41b40c
call fcn.00402214
lea ecx, [ebp - 0x4a0]
mov dword [edi], 0x41b408
call fcn.0040e32e
cmp eax, ebx
jne 0x40fd1b
push 0x3be
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call fcn.00410b78
mov eax, dword [esi + 0x258]
push ebx
push 0x64
push ebx
push dword [ebp - 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x78]
lea eax, [ebp - 0x3a20]
push 0x2710
push eax
lea ecx, [ebp - 0x3c0]
call fcn.0040c114
mov edi, eax
cmp edi, ebx
je 0x40fdc1
cmp edi, 0xffffffff
jne 0x40fd63
push 0x3c5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call fcn.00410b78
lea eax, [ebp - 0x14]
push ebx
push eax
lea eax, [ebp - 0x3a20]
push edi
push eax
push dword [ebp - 0x3e0]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40fd85
mov eax, dword [ebp - 0x14]
jmp 0x40fd88
or eax, 0xffffffff
cmp eax, ebx
jne 0x40fd9f
push 0x3c8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call fcn.00410b78
mov eax, dword [esi + 0x258]
push 0x3ca
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x84]
push eax
mov ecx, esi
call fcn.00410b78
jmp 0x40fd2e
lea ecx, [ebp - 0x4a0]
call fcn.0040e3d4
cmp byte [ebp - 1], bl
je 0x40ff3a
push 0x3d2
mov ecx, esi
call fcn.0040f6fe
push eax
mov ecx, esi
call fcn.00410b78
lea eax, [ebp - 0x224]
mov edi, 0x41b414
push ebx
push eax
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0x98], edi
mov dword [ebp - 0x90], 0x41b40c
call fcn.00401833
lea eax, [ebp - 0xa4]
lea ecx, [ebp - 0x5c]
push eax
mov dword [ebp - 0xa4], 0x41b408
call fcn.0041191d
lea ecx, [ebp - 0xa4]
call fcn.00401925
lea ecx, [ebp - 0xaec]
call fcn.00411155
lea eax, [ebp - 0x290]
lea ecx, [ebp - 0x40]
push eax
call fcn.00401b38
mov ecx, eax
mov dword [ebp - 0x14], ecx
call fcn.004024bf
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x40]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x2e0]
push eax
call fcn.00401af4
mov ecx, eax
mov dword [ebp - 0x14], ecx
call fcn.004024bf
mov eax, dword [ebp - 0x14]
push 0x3d9
push dword [ebp - 0xc]
lea ecx, [ebp - 0xaec]
mov eax, dword [eax + 4]
push eax
call fcn.004111cd
push eax
mov ecx, esi
call fcn.00410b78
lea ecx, [ebp - 0x2e0]
call fcn.00401925
lea ecx, [ebp - 0x290]
call fcn.00401925
lea ecx, [ebp - 0x5c]
call fcn.004024bf
push 0x3da
push ebx
push dword [ebp - 0x58]
lea ecx, [ebp - 0xaec]
push str.iKernel.exe
call fcn.00411242
push eax
mov ecx, esi
call fcn.00410b78
lea eax, [ebp - 0x224]
push ebx
push eax
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x74], 0x41b40c
call fcn.00401833
lea eax, [ebp - 0x88]
push 0x3dd
push eax
lea eax, [ebp - 0x5c]
push eax
mov ecx, esi
mov dword [ebp - 0x88], 0x41b408
call fcn.0040f20f
push eax
mov ecx, esi
call fcn.00410b78
lea ecx, [ebp - 0x88]
call fcn.00401925
lea ecx, [ebp - 0xaec]
call fcn.00410d18
jmp 0x40ffaa
lea eax, [ebp - 0x40]
push 0x3e2
push eax
mov ecx, esi
call fcn.0040f245
push eax
mov ecx, esi
call fcn.00410b78
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40ff7b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x40ff7b
push 0x3ea
push eax
mov ecx, esi
call fcn.00410b78
lea ecx, [ebp - 0x40]
call fcn.004024bf
lea eax, [ebp - 0x224]
push eax
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x40ffaa
push 0x3ef
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call fcn.00410b78
lea ecx, [ebp - 0x4a0]
call fcn.00404415
lea ecx, [ebp - 0x3c0]
call fcn.00404415
lea ecx, [ebp - 0xdc]
call fcn.00401925
lea eax, [ebp - 0x6b8]
push 0x41ea10
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x6b8]
push eax
call esi
lea eax, [ebp - 0x6b8]
push str.___RegServer
push eax
call esi
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x268]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x6b8]
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0x2710
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x120]
push 0x40
push eax
mov eax, dword [ebp - 0xe0]
add eax, 0xec
push eax
call fcn.00419570
add esp, 0xc
lea ecx, [ebp - 0x1c]
call fcn.004100df
lea ecx, [ebp - 0x20]
call fcn.004100df
lea ecx, [ebp - 0x5c]
call fcn.00401925
lea ecx, [ebp - 0x40]
call fcn.00401925
lea ecx, [ebp - 0x6c]
call fcn.0040e3ff
cmp dword [ebp - 8], ebx
je 0x410081
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
lea eax, [ebp - 0x120]
push 0x40
push eax
mov eax, dword [ebp - 0xe0]
add eax, 0xec
push eax
call fcn.00419570
add esp, 0xc
lea ecx, [ebp - 0x1c]
call fcn.004100df
lea ecx, [ebp - 0x20]
call fcn.004100df
lea ecx, [ebp - 0x5c]
call fcn.00401925
lea ecx, [ebp - 0x40]
call fcn.00401925
lea ecx, [ebp - 0x6c]
call fcn.0040e3ff
cmp dword [ebp - 8], ebx
je 0x4100db
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x410083