Function at 0x40a690
Capabilities:
Contain obfuscated stackstrings
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dd4f9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1b0
push esi
push edi
mov ecx, 0x510279
mov dword [ebp - 4], 2
call fcn.004b781d
lea eax, [ebp + 0x20]
push eax
lea ecx, [ebp - 0x1bc]
call fcn.00403da0
lea eax, [ebp + 0x20]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x1a4]
call fcn.00403da0
lea eax, [ebp + 0x20]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x18c]
call fcn.00403da0
xor eax, eax
mov byte [ebp - 4], 5
mov word [ebp - 0x1c], ax
lea ecx, [ebp - 0x1a]
lea eax, [ebp - 0xd]
mov dword [ebp - 0x44], 0
push eax
push ecx
lea edx, [ebp - 0x34]
mov dword [ebp - 0x34], 0x41005c
push edx
lea ecx, [ebp - 0x98]
mov dword [ebp - 0x30], 0x700070
mov dword [ebp - 0x2c], 0x69006c
mov dword [ebp - 0x28], 0x610063
mov dword [ebp - 0x24], 0x690074
mov dword [ebp - 0x20], 0x6e006f
call fcn.00403ee0
push dword [eax]
lea ecx, [ebp - 0x1bc]
mov byte [ebp - 4], 6
call fcn.0040c580
cmp dword [eax + 0x14], 8
jb 0x40a761
mov eax, dword [eax]
lea ecx, [ebp - 0x88]
push ecx
lea ecx, [ebp - 0x44]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 5
mov esi, eax
call fcn.0040c330
test esi, esi
jne 0x40b4aa
xor eax, eax
mov dword [ebp - 0xc4], 0x410020
mov word [ebp - 0xb4], ax
lea ecx, [ebp - 0xb2]
mov word [ebp - 0xdc], ax
lea edx, [ebp - 0xc4]
mov word [ebp - 0x90], ax
lea eax, [ebp - 0xd]
push eax
push ecx
push edx
lea ecx, [ebp - 0x174]
mov dword [ebp - 0xc0], 0x740075
mov dword [ebp - 0xbc], 0x6f0068
mov dword [ebp - 0xb8], 0x730072
mov dword [ebp - 0xf0], 0x500047
mov dword [ebp - 0xec], 0x200054
mov dword [ebp - 0xe8], 0x680043
mov dword [ebp - 0xe4], 0x6f0072
mov dword [ebp - 0xe0], 0x65006d
mov dword [ebp - 0x98], 0x680054
mov dword [ebp - 0x94], 0x200065
call fcn.00403ee0
mov edi, eax
lea eax, [ebp - 0xd]
mov byte [ebp - 4], 7
push eax
lea ecx, [ebp - 0xda]
push ecx
lea edx, [ebp - 0xf0]
push edx
lea ecx, [ebp - 0x168]
call fcn.00403ee0
mov esi, dword [eax]
mov byte [ebp - 4], 8
call fcn.004058f0
mov ecx, eax
test ecx, ecx
je 0x40b4f3
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x14], eax
push esi
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 9
call fcn.004048a0
test al, al
jne 0x40a8bc
test esi, esi
jne 0x40a89e
xor ecx, ecx
jmp 0x40a8b2
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40a8a3
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x14]
call fcn.00406c70
lea eax, [ebp - 0xd]
mov byte [ebp - 4], 0xa
push eax
lea ecx, [ebp - 0x8e]
push ecx
lea edx, [ebp - 0x98]
push edx
lea ecx, [ebp - 0x15c]
call fcn.00403ee0
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0xb
push ecx
push dword [eax]
lea eax, [ebp - 0x124]
push eax
call fcn.00404460
push dword [edi]
mov byte [ebp - 4], 0xc
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.00404390
add esp, 0x18
mov edx, dword [ebp - 0x124]
or edi, 0xffffffff
mov byte [ebp - 4], 0xe
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40a92d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x15c]
call fcn.0040c330
mov edx, dword [ebp - 0x14]
mov eax, edi
mov byte [ebp - 4], 0x10
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40a956
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x168]
call fcn.0040c330
lea ecx, [ebp - 0x174]
mov byte [ebp - 4], 0x12
call fcn.0040c330
xor eax, eax
mov dword [ebp - 0x40], 0x700041
mov word [ebp - 0x1c], ax
lea ecx, [ebp - 0x1a]
lea eax, [ebp - 0xd]
mov dword [ebp - 0x3c], 0x6c0070
push eax
push ecx
lea edx, [ebp - 0x40]
mov dword [ebp - 0x38], 0x630069
push edx
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0x34], 0x740061
mov dword [ebp - 0x30], 0x6f0069
mov dword [ebp - 0x2c], 0x43006e
mov dword [ebp - 0x28], 0x6d006f
mov dword [ebp - 0x24], 0x610070
mov dword [ebp - 0x20], 0x79006e
call fcn.00403ee0
mov esi, dword [eax]
mov byte [ebp - 4], 0x13
call fcn.004058f0
mov ecx, eax
test ecx, ecx
je 0x40b4fd
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x14], eax
push esi
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x14
call fcn.004048a0
test al, al
jne 0x40aa29
test esi, esi
jne 0x40aa07
xor ecx, ecx
jmp 0x40aa1f
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40aa10
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x14]
call fcn.00406c70
mov eax, dword [ebp - 0x84]
mov esi, dword [ebp - 0x14]
mov byte [ebp - 4], 0x13
mov ecx, dword [eax - 0xc]
lea ecx, [ecx*2 + 2]
push ecx
push eax
push 1
push 0
push esi
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40aa67
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 0x12
call fcn.0040c330
call fcn.004058f0
mov ecx, eax
test ecx, ecx
je 0x40b507
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x14], eax
push 0x4e4930
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x15
call fcn.004048a0
test al, al
jne 0x40aab6
push 5
push 0x4e4930
lea ecx, [ebp - 0x14]
call fcn.00406c70
xor eax, eax
mov byte [ebp - 4], 0x16
mov word [ebp - 0x54], ax
lea ecx, [ebp - 0x52]
lea eax, [ebp - 0xd]
mov dword [ebp - 0x80], 0x700041
push eax
push ecx
lea edx, [ebp - 0x80]
mov dword [ebp - 0x7c], 0x6c0070
push edx
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0x78], 0x630069
mov dword [ebp - 0x74], 0x740061
mov dword [ebp - 0x70], 0x6f0069
mov dword [ebp - 0x6c], 0x44006e
mov dword [ebp - 0x68], 0x730065
mov dword [ebp - 0x64], 0x720063
mov dword [ebp - 0x60], 0x700069
mov dword [ebp - 0x5c], 0x690074
mov dword [ebp - 0x58], 0x6e006f
call fcn.00403ee0
mov esi, dword [eax]
mov byte [ebp - 4], 0x17
call fcn.004058f0
mov ecx, eax
test ecx, ecx
je 0x40b511
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x18], eax
push esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x18
call fcn.004048a0
test al, al
jne 0x40ab7d
test esi, esi
jne 0x40ab5f
xor ecx, ecx
jmp 0x40ab73
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40ab64
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x18]
call fcn.00406c70
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
mov byte [ebp - 4], 0x17
mov ecx, dword [eax - 0xc]
lea ecx, [ecx*2 + 2]
push ecx
push eax
push 1
push 0
push esi
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40abb8
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 0x16
call fcn.0040c330
cmp dword [ebp + 0x1c], 8
lea esi, [ebp + 8]
cmovae esi, dword [ebp + 8]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x40abd5
sub esi, ecx
mov dword [ebp - 0x38], 0x700041
lea eax, [ebp - 0xd]
sar esi, 1
push eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x34], 0x6c0070
push ecx
lea edx, [ebp - 0x38]
mov dword [ebp - 0x30], 0x630069
push edx
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0x2c], 0x740061
mov dword [ebp - 0x28], 0x6f0069
mov dword [ebp - 0x24], 0x49006e
mov dword [ebp - 0x20], 0x6f0063
mov dword [ebp - 0x1c], 0x6e
call fcn.00403ee0
mov eax, dword [eax]
mov byte [ebp - 4], 0x19
mov dword [ebp - 0x48], eax
call fcn.004058f0
mov ecx, eax
test ecx, ecx
je 0x40b51b
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x18], eax
push dword [ebp - 0x48]
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x1a
call fcn.004048a0
test al, al
jne 0x40ac9a
mov edx, dword [ebp - 0x48]
test edx, edx
jne 0x40ac76
xor ecx, ecx
jmp 0x40ac90
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x50], eax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40ac80
sub ecx, dword [ebp - 0x50]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x18]
call fcn.00406c70
cmp dword [ebp + 0x1c], 8
lea eax, [esi*2 + 2]
mov esi, dword [ebp - 0x18]
lea ecx, [ebp + 8]
cmovae ecx, dword [ebp + 8]
push eax
push ecx
push 1
push 0
push esi
push dword [ebp - 0x44]
mov byte [ebp - 4], 0x19
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40acda
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 0x16
call fcn.0040c330
xor eax, eax
mov dword [ebp - 0x108], 0x500047
mov word [ebp - 0xf4], ax
lea ecx, [ebp - 0xf2]
lea eax, [ebp - 0xd]
mov dword [ebp - 0x104], 0x200054
push eax
push ecx
lea edx, [ebp - 0x108]
mov dword [ebp - 0x100], 0x680043
push edx
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0xfc], 0x6f0072
mov dword [ebp - 0xf8], 0x65006d
call fcn.00403ee0
mov esi, dword [eax]
mov byte [ebp - 4], 0x1b
call fcn.004058f0
mov ecx, eax
test ecx, ecx
je 0x40b525
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x18], eax
push esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x1c
call fcn.004048a0
test al, al
jne 0x40ad9a
test esi, esi
jne 0x40ad7c
xor ecx, ecx
jmp 0x40ad90
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40ad81
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x18]
call fcn.00406c70
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 0x1e
call fcn.0040c330
lea eax, [ebp - 0xd]
mov dword [ebp - 0x38], 0x700041
push eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x34], 0x6c0070
push ecx
lea edx, [ebp - 0x38]
mov dword [ebp - 0x30], 0x630069
push edx
lea ecx, [ebp - 0x138]
mov dword [ebp - 0x2c], 0x740061
mov dword [ebp - 0x28], 0x6f0069
mov dword [ebp - 0x24], 0x4e006e
mov dword [ebp - 0x20], 0x6d0061
mov dword [ebp - 0x1c], 0x65
call fcn.00403ee0
mov esi, dword [eax]
mov byte [ebp - 4], 0x1f
call fcn.004058f0
mov ecx, eax
test ecx, ecx
je 0x40b52f
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x4c], eax
push esi
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0x20
call fcn.004048a0
test al, al
jne 0x40ae59
test esi, esi
jne 0x40ae33
xor ecx, ecx
jmp 0x40ae4f
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40ae40
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x4c]
call fcn.00406c70
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x4c]
mov byte [ebp - 4], 0x1f
mov ecx, dword [eax - 0xc]
lea ecx, [ecx*2 + 2]
push ecx
push eax
push 1
push 0
push esi
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40ae94
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x138]
mov byte [ebp - 4], 0x1e
call fcn.0040c330
lea eax, [ebp - 0xd]
mov dword [ebp - 0xd8], 0x530054
push eax
lea ecx, [ebp - 0xc4]
mov dword [ebp - 0xd4], 0x720042
push ecx
lea edx, [ebp - 0xd8]
mov dword [ebp - 0xd0], 0x77006f
push edx
lea ecx, [ebp - 0x138]
mov dword [ebp - 0xcc], 0x650073
mov dword [ebp - 0xc8], 0x72
call fcn.00403ee0
mov esi, dword [eax]
mov byte [ebp - 4], 0x21
call fcn.004058f0
mov ecx, eax
test ecx, ecx
je 0x40b539
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x4c], eax
push esi
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0x22
call fcn.004048a0
test al, al
jne 0x40af4b
test esi, esi
jne 0x40af2d
xor ecx, ecx
jmp 0x40af41
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40af32
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x4c]
call fcn.00406c70
lea ecx, [ebp - 0x138]
mov byte [ebp - 4], 0x24
call fcn.0040c330
xor eax, eax
mov dword [ebp - 0x38], 0x700041
mov word [ebp - 0x1c], ax
lea ecx, [ebp - 0x1a]
lea eax, [ebp - 0xd]
mov dword [ebp - 0x34], 0x550070
push eax
push ecx
lea edx, [ebp - 0x38]
mov dword [ebp - 0x30], 0x650073
push edx
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x2c], 0x4d0072
mov dword [ebp - 0x28], 0x64006f
mov dword [ebp - 0x24], 0x6c0065
mov dword [ebp - 0x20], 0x640049
call fcn.00403ee0
mov esi, dword [eax]
mov byte [ebp - 4], 0x25
call fcn.004058f0
mov ecx, eax
test ecx, ecx
je 0x40b543
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x48], eax
push esi
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x26
call fcn.004048a0
test al, al
jne 0x40b009
test esi, esi
jne 0x40afe3
xor ecx, ecx
jmp 0x40afff
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40aff0
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x48]
call fcn.00406c70
mov edi, dword [ebp - 0x4c]
mov esi, dword [ebp - 0x48]
mov byte [ebp - 4], 0x25
mov eax, dword [edi - 0xc]
lea eax, [eax*2 + 2]
push eax
push edi
push 1
push 0
push esi
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40b045
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0x24
call fcn.0040c330
xor eax, eax
mov dword [ebp - 0x34], 0x44005c
mov word [ebp - 0x1c], ax
lea ecx, [ebp - 0x1a]
lea eax, [ebp - 0xd]
mov dword [ebp - 0x30], 0x660065
push eax
push ecx
lea edx, [ebp - 0x34]
mov dword [ebp - 0x2c], 0x750061
push edx
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x28], 0x74006c
mov dword [ebp - 0x24], 0x630049
mov dword [ebp - 0x20], 0x6e006f
call fcn.00403ee0
push dword [eax]
lea ecx, [ebp - 0x1a4]
mov byte [ebp - 4], 0x27
call fcn.0040c580
cmp dword [eax + 0x14], 8
jb 0x40b0b4
mov eax, dword [eax]
lea ecx, [ebp - 0x88]
push ecx
lea ecx, [ebp - 0x44]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0x24
mov esi, eax
call fcn.0040c330
test esi, esi
jne 0x40b431
mov esi, dword [ebp + 0x1c]
lea edx, [ebp + 8]
cmp esi, 8
cmovae edx, dword [ebp + 8]
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x40b101
sub edx, ecx
lea ecx, [ebp + 8]
sar edx, 1
cmp esi, 8
cmovae ecx, dword [ebp + 8]
lea eax, [edx*2 + 2]
push eax
push ecx
push 1
push 0
push 0x4e4830
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [ebp - 0xd]
mov dword [ebp - 0x40], 0x73005c
push eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x3c], 0x650068
push ecx
lea edx, [ebp - 0x40]
mov dword [ebp - 0x38], 0x6c006c
push edx
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x34], 0x6f005c
mov dword [ebp - 0x30], 0x650070
mov dword [ebp - 0x2c], 0x5c006e
mov dword [ebp - 0x28], 0x6f0063
mov dword [ebp - 0x24], 0x6d006d
mov dword [ebp - 0x20], 0x6e0061
mov dword [ebp - 0x1c], 0x64
call fcn.00403ee0
push dword [eax]
lea ecx, [ebp - 0x18c]
mov byte [ebp - 4], 0x28
call fcn.0040c580
cmp dword [eax + 0x14], 8
jb 0x40b1ab
mov eax, dword [eax]
lea ecx, [ebp - 0x88]
push ecx
lea ecx, [ebp - 0x44]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0x24
mov esi, eax
call fcn.0040c330
test esi, esi
jne 0x40b431
lea eax, [ebp - 0xd]
mov dword [ebp - 0x80], 0x2d0020
push eax
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x7c], 0x73002d
push ecx
lea edx, [ebp - 0x80]
mov dword [ebp - 0x78], 0x6e0069
push edx
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x74], 0x6c0067
mov dword [ebp - 0x70], 0x2d0065
mov dword [ebp - 0x6c], 0x720061
mov dword [ebp - 0x68], 0x750067
mov dword [ebp - 0x64], 0x65006d
mov dword [ebp - 0x60], 0x74006e
mov dword [ebp - 0x5c], 0x250020
mov dword [ebp - 0x58], 0x31
call fcn.00403ee0
mov dword [ebp - 0x8c], eax
mov edx, dword [ebp + 0x48]
mov ecx, SysReAllocString
sub ecx, edx
mov byte [ebp - 4], 0x29
mov dword [ebp - 0x50], edx
cmp ecx, 1
jb 0x40b54d
cmp dword [ebp + 0x4c], 8
lea eax, [ebp + 0x38]
mov dword [ebp - 0x110], esi
lea ecx, [edx + 1]
cmovae eax, dword [ebp + 0x38]
xorps xmm0, xmm0
mov dword [ebp - 0x10c], esi
mov esi, 7
mov dword [ebp - 0x12c], eax
lea eax, [ebp - 0x120]
mov dword [ebp - 0x128], ecx
mov dword [ebp - 0x48], eax
movups xmmword [ebp - 0x120], xmm0
cmp ecx, esi
jbe 0x40b2ed
mov esi, ecx
or esi, 7
cmp esi, 0x7ffffffe
jbe 0x40b2c2
mov esi, SysReAllocString
jmp 0x40b2cc
mov eax, 0xa
cmp esi, eax
cmovb esi, eax
lea eax, [esi + 1]
push eax
lea ecx, [ebp - 0x120]
call fcn.00403670
mov ecx, dword [ebp - 0x128]
mov edx, dword [ebp - 0x50]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x110], ecx
mov ecx, 0x22
mov dword [ebp - 0x10c], esi
mov word [eax], cx
lea ecx, [eax + 2]
lea eax, [edx + edx]
push eax
push dword [ebp - 0x12c]
push ecx
call fcn.004ba300
mov eax, dword [ebp - 0x48]
xor edx, edx
mov ecx, dword [ebp - 0x50]
mov word [eax + ecx*2 + 2], dx
push 0x4e4904
lea eax, [ebp - 0x120]
mov byte [ebp - 4], 0x2a
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.00403730
mov ecx, dword [ebp - 0x8c]
mov byte [ebp - 4], 0x2b
push dword [ecx]
push eax
lea eax, [ebp - 0x150]
push eax
call fcn.00403730
add esp, 0x24
lea ecx, [ebp - 0x30]
call fcn.00403120
mov ecx, dword [ebp - 0x10c]
mov byte [ebp - 4], 0x29
cmp ecx, 8
jb 0x40b3a2
mov edx, dword [ebp - 0x120]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40b398
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40b552
push ecx
push edx
call fcn.004b780f
add esp, 8
xor eax, eax
mov dword [ebp - 0x110], 0
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x10c], 7
mov word [ebp - 0x120], ax
call fcn.0040c330
mov esi, dword [ebp - 0x13c]
lea edx, [ebp - 0x150]
cmp esi, 8
cmovae edx, dword [ebp - 0x150]
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x40b3e3
sub edx, ecx
lea ecx, [ebp - 0x150]
sar edx, 1
cmp esi, 8
cmovae ecx, dword [ebp - 0x150]
lea eax, [edx*2 + 2]
push eax
push ecx
push 1
push 0
push 0x4e4830
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x150]
call fcn.00403120
or esi, 0xffffffff
mov byte [ebp - 4], 0x1e
mov eax, esi
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x40b44f
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x18]
mov eax, esi
add edx, 0xfffffff0
mov byte [ebp - 4], 0x16
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40b46d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x14]
mov eax, esi
add edx, 0xfffffff0
mov byte [ebp - 4], 0x12
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40b48b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x84]
add edx, 0xfffffff0
mov byte [ebp - 4], 5
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x40b4aa
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x18c]
call fcn.00403120
lea ecx, [ebp - 0x1a4]
call fcn.00403120
lea ecx, [ebp - 0x1bc]
call fcn.00403120
lea ecx, [ebp + 8]
call fcn.00403120
lea ecx, [ebp + 0x20]
call fcn.00403120
lea ecx, [ebp + 0x38]
call fcn.00403120
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00404870
push 0x80004005
call fcn.00404870
push 0x80004005
call fcn.00404870
push 0x80004005
call fcn.00404870
push 0x80004005
call fcn.00404870
push 0x80004005
call fcn.00404870
push 0x80004005
call fcn.00404870
push 0x80004005
call fcn.00404870
push 0x80004005
call fcn.00404870
call fcn.00402980
call fcn.004be73f
int3