Function at 0x41b0ec
Capabilities:
Copy file
Persist via run registry key
Set file attributes
Set registry value

Disassembly:
mov eax, 0x4662cd
call fcn.0043540c
mov eax, 0x22ac
call fcn.00435c30
push ebx
push esi
push edi
mov dword [ebp - 0x28], ecx
call fcn.00401083
mov dword [ebp - 0x1c], eax
xor esi, esi
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0xab6]
mov word [ebp - 0xab8], si
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 0x1c]
stosw word es:[edi], ax
call fcn.00429782
test eax, eax
jne 0x41b27b
lea ecx, [ebp - 0xc4]
call fcn.00401d31
mov eax, dword [0x48a6e0]
mov dword [ebp - 4], esi
cmp eax, esi
jne 0x41b154
mov eax, 0x46b598
push eax
lea eax, [ebp - 0xab8]
push 0x48af30
push eax
call fcn.00430edb
mov ebx, dword [sym.imp.KERNEL32.dll_CopyFileW]
lea eax, [ebp - 0xab8]
push esi
push eax
push 0x489020
call ebx
lea eax, [ebp - 0xab8]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0xab8]
lea ecx, [ebp - 0xc4]
push eax
call fcn.00402174
push 9
xor eax, eax
pop ecx
lea edi, [ebp - 0x66]
push dword [0x489c48]
mov word [ebp - 0x68], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x68]
push str._04x
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x1ab8]
push eax
lea eax, [ebp - 0x22b8]
push eax
push 0x489020
call fcn.00430c85
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x22b8]
push eax
lea eax, [ebp - 0x1ab8]
push eax
call fcn.00430edb
lea eax, [ebp - 0x1ab8]
push str..ini
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x12b6]
mov word [ebp - 0x12b8], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x12b8]
push 0x48af30
push eax
call fcn.00430edb
lea eax, [ebp - 0x12b8]
push str..ini
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x12b8]
push esi
push eax
lea eax, [ebp - 0x1ab8]
push eax
call ebx
lea eax, [ebp - 0x12b8]
lea ecx, [ebp - 0xc4]
push eax
call fcn.00402174
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc4]
call fcn.00401d5e
jmp 0x41b28d
lea eax, [ebp - 0xab8]
push 0x489020
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [str.NoSuppressRebootKey]
mov ebx, 0x46b57c
mov edi, 0x46b574
cmp eax, esi
mov dword [ebp - 0x114], ebx
mov dword [ebp - 0xf4], edi
jne 0x41b2b1
mov eax, 0x486618
lea ecx, [ebp - 0x2d]
push esi
push ecx
push eax
lea ecx, [ebp - 0x114]
call fcn.004010c6
mov eax, dword [str.Startup]
mov dword [ebp - 4], 1
cmp eax, esi
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x48], edi
jne 0x41b2dd
mov eax, 0x486618
lea ecx, [ebp - 0x1d]
push esi
push ecx
push eax
lea ecx, [ebp - 0x68]
call fcn.004010c6
mov ecx, dword [ebp - 0x1c]
push 0xa
lea eax, [ebp - 0x114]
push esi
push eax
lea eax, [ebp - 0x68]
push eax
mov byte [ebp - 4], 2
call fcn.0042b198
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x38], eax
mov byte [ebp - 4], 1
call fcn.00401306
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x114]
call fcn.00401306
lea eax, [ebp - 0x1d]
mov ebx, 0x46b5c0
mov edi, 0x46b5b8
push esi
push eax
lea ecx, [ebp - 0xec]
mov dword [ebp - 0xec], ebx
mov dword [ebp - 0xcc], edi
call fcn.00402b02
mov dword [ebp - 4], 3
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x1d]
push esi
push eax
lea ecx, [ebp - 0x164]
mov byte [ebp - 4], 4
mov dword [ebp - 0x164], ebx
mov dword [ebp - 0x144], edi
call fcn.00402b02
mov eax, dword [ebp - 0x38]
mov byte [ebp - 4], 5
sub eax, esi
je 0x41b3a9
dec eax
je 0x41b38b
dec eax
jne 0x41b3c5
mov eax, str.SoftwareMicrosoftWindowsCurrentVersionRun
jmp 0x41b390
mov eax, str.SoftwareMicrosoftWindowsCurrentVersionRunOnceEx
mov ecx, eax
test ecx, ecx
jne 0x41b39b
mov eax, 0x486618
push eax
lea ecx, [ebp - 0x164]
call fcn.00403db6
jmp 0x41b3cf
mov eax, str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
mov ecx, eax
test ecx, ecx
jne 0x41b3b9
mov eax, 0x486618
push eax
lea ecx, [ebp - 0x164]
call fcn.00403db6
cmp dword [ebp - 0x38], 3
je 0x41bbc9
mov eax, dword [ebp - 0x15c]
cmp eax, esi
jne 0x41b3de
mov eax, 0x46b5e8
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push ecx
push 0xf003f
push esi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x41bbc9
lea ecx, [ebp - 0x18]
call fcn.0040d420
mov ecx, dword [ebp - 0x10]
cmp eax, esi
mov dword [ebp - 0x18], ecx
jne 0x41bbc9
mov eax, dword [ebp + 8]
mov dword [ebp - 0x240], ebx
cmp eax, esi
mov dword [ebp - 0x220], edi
jne 0x41b42d
mov eax, 0x486618
lea ecx, [ebp + 0xb]
push esi
push ecx
push eax
lea ecx, [ebp - 0x240]
call fcn.00403d1a
cmp dword [ebp + 0xc], esi
mov byte [ebp - 4], 6
je 0x41b463
push str._AFTERREBOOT1
call fcn.00434ff7
pop ecx
push eax
push str._AFTERREBOOT1
lea ecx, [ebp - 0x23c]
call fcn.004129c3
lea eax, [ebp + 0xf]
push esi
push eax
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x70], edi
call fcn.00402b02
mov eax, dword [ebp - 0x1c]
mov byte [ebp - 4], 7
mov eax, dword [eax + 0x14]
dec eax
je 0x41b560
dec eax
je 0x41b50b
dec eax
je 0x41b4b1
dec eax
je 0x41b4a7
dec eax
jne 0x41b57c
mov eax, 0x47f4dc
jmp 0x41b565
mov eax, 0x47f4d4
jmp 0x41b565
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x2b8]
push 9
push eax
call fcn.00408562
push eax
lea eax, [ebp - 0x13c]
push 0x47df84
push eax
mov byte [ebp - 4], 0xa
call fcn.004223b9
add esp, 0xc
push eax
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 0xb
call fcn.004020f3
lea ecx, [ebp - 0x13c]
mov byte [ebp - 4], 0xa
call fcn.00402079
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x2b8]
call fcn.00402079
jmp 0x41b57c
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0xb8]
push 9
push eax
call fcn.00408562
push eax
lea eax, [ebp - 0x290]
push 0x47dfec
push eax
mov byte [ebp - 4], 8
call fcn.004223b9
add esp, 0xc
push eax
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 9
call fcn.004020f3
lea ecx, [ebp - 0x290]
mov byte [ebp - 4], 8
call fcn.00402079
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xb8]
jmp 0x41b504
mov eax, 0x47e088
mov ecx, eax
test ecx, ecx
jne 0x41b570
mov eax, 0x486618
push eax
lea ecx, [ebp - 0x90]
call fcn.00403db6
mov ecx, dword [ebp - 0x1c]
call fcn.00429782
test eax, eax
mov eax, 0x47f4cc
jne 0x41b592
mov eax, 0x486618
cmp eax, esi
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x48], edi
jne 0x41b5a1
mov eax, 0x486618
lea ecx, [ebp - 0x2d]
push esi
push ecx
push eax
lea ecx, [ebp - 0x68]
call fcn.00403d1a
mov ecx, dword [ebp - 0x1c]
mov byte [ebp - 4], 0xc
call fcn.00427983
cmp eax, esi
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x1f8], edi
jne 0x41b5d0
mov eax, 0x486618
lea ecx, [ebp - 0x3a]
push esi
push ecx
push eax
lea ecx, [ebp - 0x218]
call fcn.00403d1a
mov ecx, dword [ebp - 0x1c]
mov byte [ebp - 4], 0xd
call fcn.00427b98
cmp eax, esi
mov dword [ebp - 0x114], ebx
mov dword [ebp - 0xf4], edi
jne 0x41b602
mov eax, 0x486618
lea ecx, [ebp - 0x39]
push esi
push ecx
push eax
lea ecx, [ebp - 0x114]
call fcn.00403d1a
mov eax, 0x48af30
mov byte [ebp - 4], 0xe
test eax, eax
mov dword [ebp - 0x268], ebx
mov dword [ebp - 0x248], edi
jne 0x41b631
mov eax, 0x486618
lea ecx, [ebp - 0x3c]
push esi
push ecx
push eax
lea ecx, [ebp - 0x268]
call fcn.00403d1a
mov ecx, dword [ebp - 0x1c]
mov byte [ebp - 4], 0xf
call fcn.00429782
test eax, eax
je 0x41b6cb
mov eax, dword [ebp - 0x28]
cmp dword [eax + 0x54], esi
jne 0x41b6cb
mov edx, dword [ebp - 0x60]
mov eax, 0x46b5e8
cmp edx, esi
jne 0x41b668
mov edx, eax
mov ecx, dword [ebp - 0x238]
mov dword [ebp - 0x10], eax
cmp ecx, esi
je 0x41b678
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x260]
mov dword [ebp - 0x34], eax
cmp ecx, esi
je 0x41b688
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x10c]
mov dword [ebp - 0x28], eax
cmp ecx, esi
je 0x41b698
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x88]
cmp ecx, esi
jne 0x41b6a4
mov ecx, eax
cmp dword [ebp - 0x210], esi
je 0x41b6b2
mov eax, dword [ebp - 0x210]
push edx
push dword [ebp - 0x10]
push dword [ebp - 0x34]
push dword [ebp - 0x28]
push dword [0x489c48]
push ecx
push eax
push str.__s___k__s__l_d__t__s___e__s___w__v__s___s
jmp 0x41b73a
mov edx, dword [ebp - 0x60]
mov eax, 0x46b5e8
cmp edx, esi
jne 0x41b6d9
mov edx, eax
mov ecx, dword [ebp - 0x238]
mov dword [ebp - 0x28], eax
cmp ecx, esi
je 0x41b6e9
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x260]
mov dword [ebp - 0x34], eax
cmp ecx, esi
je 0x41b6f9
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x10c]
mov dword [ebp - 0x10], eax
cmp ecx, esi
je 0x41b709
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x88]
cmp ecx, esi
jne 0x41b715
mov ecx, eax
cmp dword [ebp - 0x210], esi
je 0x41b723
mov eax, dword [ebp - 0x210]
push edx
push dword [ebp - 0x28]
push dword [ebp - 0x34]
push dword [ebp - 0x10]
push dword [0x489c48]
push ecx
push eax
push str.__s___s__l_d__t__s___e__s___v__s___s
lea eax, [ebp - 0xec]
push eax
call fcn.00420f06
mov eax, dword [ebp - 0x1c]
add esp, 0x24
cmp dword [eax + 0xc04], esi
je 0x41b7cf
add eax, 0xbf8
push eax
lea eax, [ebp - 0x290]
push str.__debuglog_
push eax
call fcn.0042231e
push 0x47e324
push eax
lea eax, [ebp - 0xb8]
mov byte [ebp - 4], 0x10
push eax
call fcn.00422454
add esp, 0x18
mov eax, dword [eax + 8]
mov byte [ebp - 4], 0x11
cmp eax, esi
mov dword [ebp - 0x10], 0x46b598
je 0x41b799
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
call fcn.00434ff7
pop ecx
push eax
lea ecx, [ebp - 0xe8]
push dword [ebp - 0x10]
call fcn.004129c3
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0x10
call fcn.00401306
lea ecx, [ebp - 0x290]
mov byte [ebp - 4], 0xf
call fcn.00401306
cmp dword [ebp - 0x38], 1
jne 0x41b80b
lea eax, [ebp - 0x34]
mov dword [ebp - 0x28], esi
push eax
lea eax, [ebp - 0x28]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push str.0001
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, esi
jne 0x41b80b
lea ecx, [ebp - 0x18]
call fcn.0040d420
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x240]
push esi
push eax
lea ecx, [ebp - 0x1f0]
mov dword [ebp - 0x1f0], ebx
mov dword [ebp - 0x1d0], edi
call fcn.00403c87
mov ecx, dword [ebp - 0x1c]
mov byte [ebp - 4], 0x12
call fcn.00427b98
cmp eax, esi
mov dword [ebp - 0x18c], ebx
mov dword [ebp - 0x16c], edi
jne 0x41b84b
mov eax, 0x486618
lea ecx, [ebp - 0x3d]
push esi
push ecx
push eax
lea ecx, [ebp - 0x18c]
call fcn.00403d1a
mov eax, 0x48af30
mov byte [ebp - 4], 0x13
test eax, eax
mov dword [ebp - 0x1c8], ebx
mov dword [ebp - 0x1a8], edi
jne 0x41b87a
mov eax, 0x486618
lea ecx, [ebp - 0x3b]
push esi
push ecx
push eax
lea ecx, [ebp - 0x1c8]
call fcn.00403d1a
cmp dword [ebp - 0x180], esi
mov byte [ebp - 4], 0x14
je 0x41b8b5
lea eax, [ebp - 0xb8]
push esi
push eax
lea ecx, [ebp - 0x18c]
call fcn.004126ef
lea ecx, [ebp - 0xb8]
call fcn.00402079
cmp dword [ebp - 0x1bc], esi
je 0x41b8db
lea eax, [ebp - 0xb8]
push esi
push eax
lea ecx, [ebp - 0x1c8]
call fcn.004126ef
lea ecx, [ebp - 0xb8]
call fcn.00402079
mov edi, dword [ebp - 0xe4]
cmp edi, esi
jne 0x41b8ea
mov edi, 0x46b5e8
lea eax, [ebp - 0x11]
push 1
push eax
push str.C:CodeBasesisdev_srcRuntimeMSISharedSetupmsiaction.cpp
lea ecx, [ebp - 0xb8]
call fcn.00401a72
mov eax, dword [eax + 8]
mov byte [ebp - 4], 0x15
cmp eax, esi
jne 0x41b910
mov eax, 0x46b598
mov dword [ebp - 0x2c], eax
push edi
lea eax, [ebp - 0x2c]
push str.MsiAction::Reboot_command_line__s
push eax
mov dword [ebp - 0x28], 0x6f7
call fcn.0040866e
add esp, 0xc
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0x14
call fcn.00401306
mov dword [ebp - 0x24], esi
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x16
push eax
push 0xf003f
push esi
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x28], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, esi
jne 0x41bafa
lea ecx, [ebp - 0x24]
call fcn.0040d420
mov ecx, dword [ebp - 0x28]
cmp eax, esi
mov dword [ebp - 0x24], ecx
jne 0x41bafa
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0x10], 0x46b5e8
cmp eax, esi
je 0x41b99d
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
call ebx
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0x10]
push 1
push esi
push str._IS_T_
push dword [ebp - 0x24]
call edi
mov eax, dword [ebp - 0x1c0]
mov dword [ebp - 0x10], 0x46b5e8
cmp eax, esi
je 0x41b9cb
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
call ebx
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0x10]
push 1
push esi
push str._IS_E_
push dword [ebp - 0x24]
call edi
cmp dword [ebp - 0x1e4], esi
je 0x41ba1b
mov eax, dword [ebp - 0x1e8]
mov dword [ebp - 0x10], 0x46b5e8
cmp eax, esi
je 0x41ba01
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
call ebx
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0x10]
push 1
push esi
push 0x47dd98
push dword [ebp - 0x24]
call edi
cmp dword [ebp - 0x24], esi
je 0x41ba2c
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x24], esi
lea eax, [ebp - 0x11]
push 1
push eax
push str._IS_T_
lea ecx, [ebp - 0x13c]
call fcn.00403d1a
lea eax, [ebp - 0x13c]
lea ecx, [ebp - 0xec]
push eax
lea eax, [ebp - 0x18c]
push eax
mov byte [ebp - 4], 0x17
call fcn.00403ddf
lea ecx, [ebp - 0x13c]
mov byte [ebp - 4], 0x16
call fcn.00402079
lea eax, [ebp - 0x11]
push 1
push eax
push str._IS_E_
lea ecx, [ebp - 0x13c]
call fcn.00403d1a
lea eax, [ebp - 0x13c]
lea ecx, [ebp - 0xec]
push eax
lea eax, [ebp - 0x1c8]
push eax
mov byte [ebp - 4], 0x18
call fcn.00403ddf
lea ecx, [ebp - 0x13c]
mov byte [ebp - 4], 0x16
call fcn.00402079
cmp dword [ebp - 0x1e4], esi
je 0x41bafa
lea eax, [ebp - 0x11]
push 1
push eax
push 0x47dd98
lea ecx, [ebp - 0x13c]
call fcn.00403d1a
lea eax, [ebp - 0x13c]
lea ecx, [ebp - 0xec]
push eax
lea eax, [ebp - 0x1f0]
push eax
mov byte [ebp - 4], 0x19
call fcn.00403ddf
lea ecx, [ebp - 0x13c]
mov byte [ebp - 4], 0x16
call fcn.00402079
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x10], 0x46b5e8
cmp eax, esi
je 0x41bb0e
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
call ebx
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0x10]
push 1
push esi
push str.ISSetup
push dword [ebp - 0x18]
call edi
cmp dword [ebp - 0x18], esi
je 0x41bb39
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x14
call fcn.0040d420
lea ecx, [ebp - 0x1c8]
mov byte [ebp - 4], 0x13
call fcn.00402079
lea ecx, [ebp - 0x18c]
mov byte [ebp - 4], 0x12
call fcn.00402079
lea ecx, [ebp - 0x1f0]
mov byte [ebp - 4], 0xf
call fcn.00402079
lea ecx, [ebp - 0x268]
mov byte [ebp - 4], 0xe
call fcn.00402079
lea ecx, [ebp - 0x114]
mov byte [ebp - 4], 0xd
call fcn.00402079
lea ecx, [ebp - 0x218]
mov byte [ebp - 4], 0xc
call fcn.00402079
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 7
call fcn.00402079
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 6
call fcn.00402079
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 5
call fcn.00402079
xor eax, eax
lea edi, [ebp - 0x19e]
mov word [ebp - 0x1a0], si
mov dword [ebp - 0x68], 0x46b57c
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [str.Type]
mov dword [ebp - 0x48], 0x46b574
cmp eax, esi
jne 0x41bbfa
mov eax, 0x486618
lea ecx, [ebp + 0xb]
push esi
push ecx
push eax
lea ecx, [ebp - 0x68]
call fcn.004010c6
mov edi, dword [ebp - 0x1c]
lea eax, [ebp - 0x290]
push 6
push eax
mov ecx, edi
mov byte [ebp - 4], 0x1a
call fcn.00408562
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0x1b
push ecx
mov ecx, eax
call fcn.00420d37
push 0xa
lea ecx, [ebp - 0x68]
push esi
push ecx
push eax
mov ecx, edi
mov byte [ebp - 4], 0x1c
call fcn.0042b198
lea ecx, [ebp - 0xb8]
mov ebx, eax
mov byte [ebp - 4], 0x1b
call fcn.00401306
lea ecx, [ebp - 0x290]
mov byte [ebp - 4], 0x1a
call fcn.00402079
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 5
call fcn.00401306
push 0xc
mov ecx, edi
call fcn.0040853d
test al, al
jne 0x41bc8b
cmp ebx, 1
je 0x41bc8b
cmp ebx, 2
jne 0x41bd33
push 4
lea eax, [ebp - 0x1a0]
push 0x47f3b8
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [ebp - 0x88]
call fcn.00402676
lea eax, [ebp - 0xab8]
lea ecx, [ebp - 0x88]
push eax
mov byte [ebp - 4], 0x1d
call fcn.004026be
lea eax, [ebp - 0xb8]
push 6
push eax
mov ecx, edi
call fcn.00408562
mov eax, dword [eax + 8]
mov byte [ebp - 4], 0x1e
cmp eax, esi
jne 0x41bce3
mov eax, 0x46b5e8
lea ecx, [ebp - 0x1a0]
push ecx
lea ecx, [ebp - 0x88]
push dword [0x46b720]
push eax
call fcn.004026fd
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0x1d
call fcn.00402079
lea ecx, [ebp - 0x88]
call fcn.004026ea
push 1
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 0x1f
call fcn.0040303f
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 5
call fcn.00403a96
cmp dword [ebp - 0x38], 3
je 0x41bd53
cmp dword [0x48b738], esi
je 0x41bd48
call fcn.00431652
jmp 0x41bd53
push 0x453
call fcn.00430543
pop ecx
lea ecx, [ebp - 0x164]
mov byte [ebp - 4], 4
call fcn.00402079
cmp dword [ebp - 0x18], esi
je 0x41bd73
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x18], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xec]
call fcn.00402079
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8