Function at 0x41d6a8
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ebp
sub esp, 0x270
lea ebp, [esp - 4]
mov eax, dword [0x4d6080]
xor eax, ebp
mov dword [ebp + 0x270], eax
push 0x3c0
mov eax, 0x4a0e11
call fcn.004646e0
mov eax, dword [ebp + 0x280]
mov esi, dword [ebp + 0x27c]
xor edi, edi
inc edi
push edi
lea ecx, [ebp - 0xd]
push ecx
xor ebx, ebx
push eax
lea ecx, [ebp + 0x34]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x24], ebx
call fcn.004096ba
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x14]
movzx eax, word [eax]
add eax, 0xffffffbf
cmp eax, 0x39
ja case.0x41d710.71
movzx eax, byte [eax + 0x41e398]
jmp dword [eax*4 + 0x41e33c]
push 0x4acdbc
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x41d74e
push ebx
lea edi, [esi + 0x294]
mov eax, dword [edi]
push ebx
push str._auto
mov ecx, esi
mov byte [eax + 2], 1
call fcn.0043a451
mov eax, dword [edi]
mov byte [eax + 2], 1
jmp 0x41e2f0
cmp dword [esi + 0x24], ebx
jne case.0x41d710.71
mov ecx, esi
call fcn.004364c4
test eax, eax
je 0x41d79d
push edi
lea eax, [ebp - 0xd]
push eax
push str._This_setup_was_created_with_an_EVALUATION_VERSION_of__s__which_does_not_support_extraction_of_the_internal_MSI_file._The_full_version_of_InstallShield_supports_this_functionality.
lea ecx, [ebp - 0x364]
call fcn.004096ba
mov byte [ebp - 4], 1
push eax
push 0x86d
push esi
call fcn.0041d617
add esp, 0xc
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x364]
call fcn.004016d0
jmp 0x41e308
fldz
lea eax, [ebp - 0x1c]
push eax
fstp qword [ebp - 0x1c]
mov ecx, esi
call fcn.0043948c
test eax, eax
je 0x41d7dc
fld qword [ebp - 0x1c]
push ecx
push ecx
fstp qword [esp]
push 0x86f
push esi
call fcn.0041d65e
add esp, 0x10
xor edi, edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x34]
call fcn.004016d0
mov eax, edi
jmp 0x41e316
push ebx
push ebx
push 0x4adf44
mov ecx, esi
mov dword [esi + 0x24], edi
call fcn.0043a451
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_CharNextW]
push edi
lea ecx, [ebp - 0xd]
push ecx
push eax
lea ecx, [ebp - 0x2c8]
call fcn.004096ba
mov byte [ebp - 4], 2
push ebx
lea eax, [ebp - 0x2c8]
push eax
push 0xe
mov ecx, esi
call fcn.004111a1
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x2c8]
call fcn.004016d0
jmp 0x41e2f0
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_CharNextW]
push edi
lea ecx, [ebp - 0xd]
push ecx
push eax
lea ecx, [ebp - 0x2fc]
call fcn.004096ba
mov byte [ebp - 4], 3
push ebx
lea eax, [ebp - 0x2fc]
push eax
push 0xc
mov ecx, esi
call fcn.004111a1
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x2fc]
jmp 0x41d825
push edi
mov ecx, esi
call fcn.00435f32
mov dword [esi + 0x70], edi
jmp 0x41e2f0
push edi
lea eax, [ebp - 0xd]
push eax
push str.debuglog
lea ecx, [ebp - 0xc0]
call fcn.004096ba
mov byte [ebp - 4], 4
push ebx
lea eax, [ebp - 0xbc]
push eax
lea ecx, [ebp + 0x38]
call fcn.00406e36
neg eax
sbb al, al
inc al
mov byte [ebp - 0xd], al
mov byte [ebp - 4], bl
lea ecx, [ebp - 0xc0]
call fcn.004016d0
cmp byte [ebp - 0xd], bl
jne 0x41d7c9
push edi
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_CharNextW]
push eax
push 0x4adf28
jmp 0x41e2e9
push edi
lea eax, [ebp - 0xd]
push eax
push 0x4adf18
lea ecx, [ebp - 0x128]
call fcn.004096ba
mov byte [ebp - 4], 5
push ebx
lea eax, [ebp - 0x124]
push eax
lea ecx, [ebp + 0x38]
mov dword [ebp - 0x24], edi
call fcn.00406e36
test eax, eax
jne 0x41d941
push edi
lea eax, [ebp - 0xd]
push eax
push 0x4adf14
lea ecx, [ebp - 0x260]
call fcn.004096ba
mov dword [ebp - 4], 6
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp + 0x34]
mov dword [ebp - 0x24], 3
call fcn.0041c568
mov byte [ebp - 0xd], 1
test al, al
jne 0x41d944
mov byte [ebp - 0xd], bl
mov dword [ebp - 4], 5
test byte [ebp - 0x24], 2
je 0x41d960
and dword [ebp - 0x24], 0xfffffffd
lea ecx, [ebp - 0x260]
call fcn.004016d0
mov dword [ebp - 4], ebx
test byte [ebp - 0x24], 1
je 0x41d978
and dword [ebp - 0x24], 0xfffffffe
lea ecx, [ebp - 0x128]
call fcn.004016d0
cmp byte [ebp - 0xd], bl
je 0x41d9ad
push 0xffffffffffffffff
push 5
lea eax, [ebp - 0x3cc]
push eax
lea ecx, [ebp + 0x34]
call fcn.004092af
mov byte [ebp - 4], 7
push ebx
push eax
push 0x10
mov ecx, esi
call fcn.004111a1
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x3cc]
jmp 0x41d825
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_CharNextW]
push str._IS_E_
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x41d9dc
push dword [ebp - 0x14]
push 0x4daed0
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x41da63
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov byte [ebp - 4], 8
push 0x2001f
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x1c]
call fcn.004014e0
test eax, eax
jne 0x41db2f
push 0x206
mov word [ebp + 0x68], ax
lea eax, [ebp + 0x6a]
push ebx
push eax
call fcn.00465a70
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp + 0x68]
push eax
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x20], 0x104
call fcn.004015b0
lea eax, [ebp + 0x68]
push eax
push 0x4daed0
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [ebp - 0x14]
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea ecx, [ebp - 0x1c]
call fcn.00401490
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x1c]
call fcn.00401490
push 0x4daed0
call fcn.0044166c
mov dword [esi + 0x70], edi
cmp dword [0x4dadb0], 8
mov eax, dword [0x4dad9c]
jae 0x41da83
mov eax, 0x4dad9c
push eax
push 0x4daed0
push 0x4d9d28
call fcn.00441d63
push edi
lea eax, [ebp - 0xd]
push eax
push 0x4bdf40
lea ecx, [ebp - 0x330]
call fcn.004018b0
mov byte [ebp - 4], 9
push edi
lea eax, [ebp - 0xd]
push eax
push dword [0x4acb8c]
lea ecx, [ebp - 0x190]
call fcn.004018b0
mov byte [ebp - 4], 0xa
push edi
lea eax, [ebp - 0xd]
push eax
push dword [0x4acb84]
lea ecx, [ebp - 0x58]
call fcn.004018b0
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x330]
push eax
lea eax, [ebp - 0x190]
push eax
lea eax, [ebp - 0x58]
push eax
push 5
mov ecx, esi
call fcn.00411211
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x58]
call fcn.00401670
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x190]
call fcn.00401670
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x330]
call fcn.00401670
push 2
mov ecx, esi
call fcn.00435f54
jmp 0x41e2f0
push esi
call fcn.0041cfc1
pop ecx
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x1c]
call fcn.00401490
jmp 0x41d7c7
push dword [ebp - 0x14]
mov edi, dword [sym.imp.USER32.dll_CharNextW]
call edi
movzx eax, word [eax]
sub eax, 0x31
je 0x41dba0
dec eax
je 0x41db8c
dec eax
je 0x41db70
push ebx
push dword [ebp - 0x14]
call edi
push eax
push 0x4adea8
jmp 0x41e2e9
push dword [ebp - 0x14]
mov byte [esi + 0x290], 1
call edi
push eax
call edi
push eax
mov ecx, esi
call fcn.004377b6
jmp 0x41e2f0
push ebx
push dword [ebp - 0x14]
call edi
push eax
call edi
push eax
push 0x4adea0
jmp 0x41e2e9
push ebx
push dword [ebp - 0x14]
call edi
push eax
call edi
push eax
push 0x4ade98
mov ecx, esi
call fcn.0043a451
mov dword [esi + 0x74], 1
jmp 0x41e2f0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str.hide_progress
push dword [ebp - 0x14]
call edi
test eax, eax
jne 0x41dbdd
mov byte [esi + 0x28a], 1
push str.hide_splash
push dword [ebp - 0x14]
call edi
test eax, eax
jne 0x41e2f0
mov byte [esi + 0x28b], 1
jmp 0x41e2f0
push edi
lea eax, [ebp - 0xd]
push eax
push str.instance
lea ecx, [ebp - 0x1f8]
call fcn.004096ba
mov byte [ebp - 4], 0xc
push ebx
lea eax, [ebp - 0x1f4]
push eax
lea ecx, [ebp + 0x38]
call fcn.00406e36
neg eax
sbb al, al
inc al
mov byte [ebp - 0xd], al
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x1f8]
call fcn.004016d0
cmp byte [ebp - 0xd], bl
je 0x41e2f0
push 0xfffffffffffffffd
pop edi
push 0xffffffffffffffff
push 9
lea eax, [ebp]
add esi, 0x28c
push eax
lea ecx, [ebp + 0x34]
mov dword [esi], edi
call fcn.004092af
mov byte [ebp - 4], 0xd
push str.default
lea ecx, [ebp + 4]
call fcn.0040e918
test eax, eax
jne 0x41dc79
or dword [esi], 0xffffffff
jmp 0x41dc8a
push 0xa
push esi
lea ecx, [ebp]
call fcn.0041c467
test al, al
jne 0x41dc8a
mov dword [esi], edi
mov byte [ebp - 4], bl
lea ecx, [ebp]
jmp 0x41d825
cmp dword [esi + 0x24], ebx
je 0x41dca6
push esi
call fcn.0041cfc1
pop ecx
jmp 0x41d7c7
push dword [ebp - 0x14]
mov dword [esi + 0x24], 3
call dword [sym.imp.USER32.dll_CharNextW]
push edi
lea ecx, [ebp - 0xd]
push ecx
push eax
lea ecx, [ebp - 0x294]
mov dword [ebp - 0x14], eax
call fcn.004096ba
mov byte [ebp - 4], 0xe
push ebx
lea eax, [ebp - 0x294]
push eax
push 8
mov ecx, esi
call fcn.004111a1
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x294]
call fcn.004016d0
push ebx
push dword [ebp - 0x14]
push 0x4ade6c
jmp 0x41e2e9
push esi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x14]
mov dword [ebp - 0x20], ebx
call dword [sym.imp.USER32.dll_CharNextW]
push eax
call fcn.0041c386
add esp, 0xc
test eax, eax
je 0x41dc9a
mov eax, dword [esi + 0x294]
mov cx, word [ebp - 0x20]
mov word [eax + 0x52], cx
jmp 0x41e2f0
push dword [ebp - 0x14]
mov edi, dword [sym.imp.USER32.dll_CharNextW]
call edi
movzx ecx, word [eax]
sub ecx, 0x31
push ebx
push eax
je 0x41dd5b
dec ecx
je 0x41dd4e
push 0x4ade64
jmp 0x41e2e9
call edi
push eax
push 0x4ade5c
jmp 0x41e2e9
call edi
push eax
push 0x4ade54
jmp 0x41e2e9
push str.noscript_uninst
push dword [ebp - 0x14]
call fcn.00466b76
pop ecx
pop ecx
test eax, eax
jne 0x41dd87
push ebx
push ebx
push str._noscript_uninst
jmp 0x41e2e9
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_CharNextW]
push edi
lea ecx, [ebp - 0xd]
push ecx
push eax
lea ecx, [ebp - 0x8c]
call fcn.004096ba
mov byte [ebp - 4], 0xf
push ebx
lea eax, [ebp - 0x8c]
push eax
push 5
mov ecx, esi
call fcn.004111a1
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x8c]
call fcn.004016d0
push 2
mov ecx, esi
call fcn.00435f54
jmp 0x41d871
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_CharNextW]
push eax
push 0x4d7938
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x41e2f0
mov byte [esi + 0x291], 1
jmp 0x41e2f0
mov edi, dword [ebp - 0x14]
push str.removeonly
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x41de17
push ebx
push ebx
push str._removeonly
jmp 0x41e2e9
push str.runas
push edi
call fcn.00466b76
pop ecx
pop ecx
test eax, eax
je 0x41e2f0
push 0x4acbc4
push edi
call fcn.00466b76
pop ecx
pop ecx
test eax, eax
je 0x41e2f0
push 6
push str.reboot
push edi
call fcn.0046570f
add esp, 0xc
test eax, eax
je 0x41e2f0
push str.removeasmajorupgrade
push edi
call fcn.00466b76
pop ecx
pop ecx
test eax, eax
je 0x41e2f0
push ebx
push ebx
push 0x4adda0
jmp 0x41e2e9
mov edi, dword [ebp - 0x14]
push 0x4add98
push edi
call fcn.00466b76
pop ecx
pop ecx
test eax, eax
jne 0x41de9a
push ebx
push ebx
push str._SMS
jmp 0x41e2e9
push str.show_eval_msg
push edi
call fcn.00466b76
pop ecx
pop ecx
test eax, eax
jne 0x41deba
mov eax, dword [esi + 0x294]
mov byte [eax + 0x17], 1
jmp 0x41e2f0
push str.show_beta_msg
push edi
call fcn.00466b76
pop ecx
pop ecx
test eax, eax
jne 0x41deda
mov eax, dword [esi + 0x294]
mov byte [eax + 0x18], 1
jmp 0x41e2f0
push str.show_reboot_msg
push edi
call fcn.00466b76
pop ecx
pop ecx
test eax, eax
jne 0x41defa
mov eax, dword [esi + 0x294]
mov byte [eax + 0x1c], 1
jmp 0x41e2f0
push ebx
lea edi, [esi + 0x294]
mov eax, dword [edi]
push ebx
push 0x4add64
mov ecx, esi
mov byte [eax + 1], 1
call fcn.0043a451
mov eax, dword [edi]
mov byte [eax + 1], 1
jmp 0x41e2f0
push ebx
push str.tempdisk1folder
lea ecx, [ebp + 0x38]
call fcn.00407126
test eax, eax
je 0x41e2f0
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_CharNextW]
push str._IS_T_
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x41df60
push dword [ebp - 0x14]
mov ecx, esi
call fcn.004381da
jmp 0x41dfec
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov byte [ebp - 4], 0x10
push 0x2001f
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x1c]
call fcn.004014e0
test eax, eax
jne 0x41db2f
push 0x206
mov word [ebp + 0x68], ax
lea eax, [ebp + 0x6a]
push ebx
push eax
call fcn.00465a70
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp + 0x68]
push eax
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x20], 0x104
call fcn.004015b0
lea eax, [ebp + 0x68]
push eax
call fcn.0044166c
lea eax, [ebp + 0x68]
push eax
mov ecx, esi
call fcn.004381da
push dword [ebp - 0x14]
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea ecx, [ebp - 0x1c]
call fcn.00401490
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x1c]
call fcn.00401490
push 3
jmp 0x41ddc6
push dword [ebp - 0x14]
mov edi, dword [sym.imp.USER32.dll_CharNextW]
call edi
movzx eax, word [eax]
cmp eax, 0x41
je 0x41e0c4
cmp eax, 0x4d
je 0x41e087
cmp eax, 0x57
je 0x41e04a
cmp eax, 0x61
je 0x41e0c4
cmp eax, 0x6d
je 0x41e087
cmp eax, 0x77
je 0x41e04a
push str.uninst
push dword [ebp - 0x14]
call fcn.00466b76
pop ecx
pop ecx
test eax, eax
jne 0x41e2f0
push ebx
push ebx
push str._uninst
jmp 0x41e2e9
push dword [ebp - 0x14]
call edi
push eax
call edi
push 1
lea ecx, [ebp - 0xd]
push ecx
push eax
lea ecx, [ebp - 0xf4]
call fcn.004096ba
mov byte [ebp - 4], 0x12
push ebx
lea eax, [ebp - 0xf4]
push eax
push 0xa
mov ecx, esi
call fcn.004111a1
mov byte [ebp - 4], bl
lea ecx, [ebp - 0xf4]
jmp 0x41d825
push dword [ebp - 0x14]
call edi
push eax
call edi
push 1
lea ecx, [ebp - 0xd]
push ecx
push eax
lea ecx, [ebp - 0x15c]
call fcn.004096ba
mov byte [ebp - 4], 0x13
push ebx
lea eax, [ebp - 0x15c]
push eax
push 0xb
mov ecx, esi
call fcn.004111a1
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x15c]
jmp 0x41d825
push dword [ebp - 0x14]
call edi
push eax
call edi
push 1
lea ecx, [ebp - 0xd]
push ecx
push eax
lea ecx, [ebp - 0x1c4]
call fcn.004096ba
mov byte [ebp - 4], 0x11
push ebx
lea eax, [ebp - 0x1c4]
push eax
push 9
mov ecx, esi
call fcn.004111a1
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x1c4]
jmp 0x41d825
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov byte [ebp - 4], 0x14
push 0x2001f
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x1c]
call fcn.004014e0
test eax, eax
jne 0x41e13c
push str.ISSetup
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea ecx, [ebp - 0x1c]
call fcn.00401490
push 7
push str.verbose
push dword [ebp - 0x14]
call fcn.0046570f
add esp, 0xc
test eax, eax
je 0x41e284
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_CharNextW]
push str._IS_V_
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x41e1da
lea eax, [ebp - 0x20]
push eax
lea ecx, [esi + 4]
mov dword [ebp - 0x20], 7
call fcn.00410c1b
mov dword [ebp - 0x20], eax
cmp dword [eax + 0x18], ebx
je 0x41e19c
mov ecx, eax
push 0x4acbc0
add ecx, 4
call fcn.00415b3a
push edi
lea eax, [ebp - 0xd]
push eax
push dword [ebp - 0x14]
lea ecx, [ebp - 0x398]
call fcn.004096ba
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x20]
push eax
call fcn.0040f04f
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x398]
call fcn.004016d0
mov eax, dword [ebp - 0x14]
push edi
push eax
push 0x4ad154
jmp 0x41e291
push 0x2001f
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x1c]
call fcn.004014e0
test eax, eax
jne 0x41db2f
push 0x206
mov word [ebp + 0x68], ax
lea eax, [ebp + 0x6a]
push ebx
push eax
call fcn.00465a70
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp + 0x68]
push eax
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x20], 0x104
call fcn.004015b0
push dword [ebp - 0x14]
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea ecx, [ebp - 0x1c]
call fcn.00401490
push edi
lea eax, [ebp - 0xd]
push eax
lea eax, [ebp + 0x68]
push eax
lea ecx, [ebp - 0x22c]
call fcn.004096ba
mov byte [ebp - 4], 0x16
push ebx
lea eax, [ebp - 0x22c]
push eax
push 7
mov ecx, esi
call fcn.004111a1
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x22c]
call fcn.004016d0
lea eax, [ebp + 0x68]
push edi
push eax
mov dword [ebp - 0x14], eax
push 0x4ad154
jmp 0x41e294
mov eax, dword [ebp - 0x14]
push edi
add eax, 0xe
push eax
push str._verbose
mov dword [ebp - 0x14], eax
mov ecx, esi
call fcn.0043a451
cmp dword [ebp - 0x14], ebx
je 0x41e2b5
push dword [ebp - 0x14]
mov byte [0x4d9a04], 1
push 0x4d7a00
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x1c]
call fcn.00401490
jmp 0x41e2f0
mov dword [esi + 0x68], edi
jmp 0x41e2f0
cmp dword [esi + 0x24], ebx
jne 0x41dc9a
mov dword [esi + 0x24], 4
jmp 0x41e2f0
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_CharNextW]
push eax
push 0x4adc6c
mov ecx, esi
call fcn.0043a451
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x34]
call fcn.004016d0
xor eax, eax
inc eax
jmp 0x41e316
push esi
call fcn.0041cfc1
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x34]
call fcn.004016d0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x270]
xor ecx, ebp
call fcn.004646d1
add ebp, 0x274
leave
ret