Function at 0x401825
Capabilities:
Delete registry key
Persist via windows service
Query or enumerate registry value
Set registry value
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x49b9fa
mov eax, dword fs:[0]
push eax
sub esp, 0x168
mov eax, dword [0x4bd450]
xor eax, esp
mov dword [esp + 0x160], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4bd450]
xor eax, esp
push eax
lea eax, [esp + 0x17c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x18c]
lea ecx, [esp + 0x24]
push ecx
mov edi, 1
xor ebp, ebp
push eax
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], ebp
mov dword [esp + 0x4c], edi
mov dword [esp + 0x48], ebp
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esi, eax
mov dword [esp + 0x28], esi
cmp esi, ebp
je 0x40279a
cmp dword [esp + 0x24], edi
jl 0x40279a
mov edx, dword [esi]
push str.install
push edx
call fcn.0047221c
add esp, 8
lea ebx, [edi + 5]
test eax, eax
jne 0x40177a
mov ebp, edi
call fcn.0040d320
call fcn.004011b0
test eax, eax
je 0x40279e
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x34], esp
push 0xa
xor edi, edi
xor eax, eax
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push str.installret
mov word [esi + 4], ax
call fcn.00402bd0
mov dword [esp + 0x1a0], edi
mov dword [esp + 0x1a0], 0xffffffff
lea edi, [esp + 0xac]
call fcn.0043aae0
mov dword [esp + 0x184], 1
lea eax, [ebp - 1]
cmp eax, ebx
ja case.default.0x401773
jmp dword [eax*4 + 0x4027f8]
mov eax, dword [esi]
push str.uninstall
push eax
call fcn.0047221c
add esp, 8
test eax, eax
jne 0x401796
lea ebp, [eax + 2]
jmp 0x40170b
mov ecx, dword [esi]
push str.restart
push ecx
call fcn.0047221c
add esp, 8
test eax, eax
jne 0x4017b2
lea ebp, [eax + 3]
jmp 0x40170b
mov edx, dword [esi]
push str.PopKtipWnd
push edx
call fcn.0047221c
add esp, 8
test eax, eax
jne 0x4017ce
lea ebp, [eax + 4]
jmp 0x40170b
mov eax, dword [esi]
push 0x4a58a0
push eax
call fcn.0047221c
add esp, 8
test eax, eax
jne 0x4017ea
lea ebp, [eax + 5]
jmp 0x40170b
mov ecx, dword [esi]
push str.BSOD
push ecx
call fcn.0047221c
add esp, 8
test eax, eax
jne 0x401805
mov ebp, ebx
jmp 0x40170b
mov edx, dword [esi]
push str.dump
push edx
call fcn.0047221c
add esp, 8
test eax, eax
jne 0x401706
lea ebp, [eax + 7]
jmp 0x40170b
cmp dword [esp + 0x24], 2
jl 0x401c42
sub esp, 0x1c
mov edx, str.startret
mov eax, esp
mov esi, 0x11
mov dword [esp + 0x34], esp
call fcn.004028a0
mov byte [esp + 0x1a0], 2
lea ecx, [esp + 0xac]
push ecx
mov byte [esp + 0x1a4], 1
mov ecx, esi
call fcn.0043b320
mov esi, dword [esp + 0x28]
mov eax, dword [esi + 4]
xor ebp, ebp
mov dword [esp + 0x3c], ebp
cmp eax, ebp
je 0x401a73
push str.protect
push eax
call fcn.0047221c
add esp, 8
test eax, eax
jne 0x401a73
push str.SYSTEMCurrentControlSetServices360bpsvcCache
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x50], ebp
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov esi, 1
mov dword [esp + 0x40], esi
call fcn.00409d40
test eax, eax
je 0x401995
call fcn.0041ff00
test eax, eax
jne 0x401995
call fcn.00409f80
test eax, eax
jne 0x401918
call fcn.0043a850
cmp eax, ebp
jne 0x401918
sub esp, 0x1c
mov edx, str.installret
mov eax, esp
lea esi, [ebp + 2]
mov dword [esp + 0x58], esp
call fcn.004028a0
mov byte [esp + 0x1a0], 3
lea edx, [esp + 0xac]
push edx
mov byte [esp + 0x1a4], 1
mov ecx, esi
call fcn.0043b320
lea edi, [ebp + 0x19]
jmp 0x401aaf
mov eax, 4
mov dword [esp + 0x2c], eax
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x54]
push ecx
lea edx, [esp + 0x34]
push edx
push str.bprot
push str.SYSTEMCurrentControlSetServices360bpsvc
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x68], ebp
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x401995
call fcn.00424ba0
test eax, eax
jne 0x401991
sub esp, 0x1c
lea esi, [eax + 0xa]
mov edx, str.installret
mov eax, esp
mov dword [esp + 0x30], esp
call fcn.004028a0
mov byte [esp + 0x1a0], 4
lea eax, [esp + 0xac]
push eax
mov byte [esp + 0x1a4], 1
mov ecx, esi
call fcn.0043b320
jmp 0x401995
mov dword [esp + 0x48], esi
lea ecx, [esp + 0x3c]
push ecx
call fcn.0043a470
add esp, 4
cmp eax, ebp
jne 0x4019ec
mov esi, dword [esp + 0x3c]
sub esp, 0x1c
mov edx, str.installret
mov eax, esp
add esi, 0x5b8d80
mov dword [esp + 0x30], esp
call fcn.004028a0
mov byte [esp + 0x1a0], 5
lea edx, [esp + 0xac]
push edx
mov byte [esp + 0x1a4], 1
mov ecx, esi
call fcn.0043b480
mov edi, 0x17
jmp 0x401aaf
push ebp
call fcn.004722af
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
add esp, 4
push 4
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
push eax
push 4
push 0x4a59c8
push str.SYSTEMCurrentControlSetServices360bpsvc
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push 4
lea ecx, [esp + 0x4c]
push ecx
push 4
push str.bprot
push str.SYSTEMCurrentControlSetServices360bpsvc
push reloc.OLEAUT32.dll_SysReAllocString
call esi
cmp dword [esp + 0x24], 3
mov edi, 0xd
jne 0x401aaf
mov edx, dword [esp + 0x28]
mov eax, dword [edx + 8]
push 0x4a59d0
push eax
call fcn.0047221c
add esp, 8
test eax, eax
jne 0x401aaf
call fcn.00432eb0
push 1
call fcn.0040ebd0
add esp, 4
push 1
call fcn.00432e10
add esp, 4
jmp 0x401aaf
call fcn.00409d40
test eax, eax
je 0x401bdc
mov eax, dword [esi + 4]
cmp eax, ebp
je 0x401bdc
push str.hookport
push eax
call fcn.0047221c
add esp, 8
test eax, eax
jne 0x401bdc
call fcn.0043a850
neg eax
sbb eax, eax
add eax, 2
mov edi, eax
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x30], esp
mov ebx, 7
push ebx
xor edx, edx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebp
push str.exitret
mov word [esi + 4], dx
call fcn.00402bd0
mov byte [esp + 0x1a0], 0x12
lea eax, [esp + 0xac]
push eax
mov byte [esp + 0x1a4], 1
mov ecx, edi
call fcn.0043b320
cmp dword [esp + 0x40], ebp
je 0x402742
xor ecx, ecx
mov dword [esp + 0xec], ebx
mov dword [esp + 0xe8], ebp
mov word [esp + 0xd8], cx
mov byte [esp + 0x184], 0x13
xor edx, edx
mov dword [esp + 0x8c], ebx
mov dword [esp + 0x88], ebp
mov word [esp + 0x78], dx
mov byte [esp + 0x184], 0x14
push 0x25
lea ecx, [esp + 0xd8]
call fcn.0040cda0
add esp, 4
test eax, eax
je 0x4024b0
mov dword [esp + 0x34], ebp
call fcn.00409f80
test eax, eax
je 0x401b83
lea eax, [esp + 0x2c]
push eax
call fcn.0040a010
test eax, eax
je 0x401b83
lea ecx, [esp + 0x38]
push ecx
call dword [esp + 0x30]
test eax, eax
je 0x401b83
mov dword [esp + 0x34], 1
mov byte [esp + 0x184], 0x15
push 8
push str.drivers
lea eax, [esp + 0xdc]
call fcn.004037d0
lea edx, [esp + 0x58]
push edx
mov edi, 0x4a5a68
lea ecx, [esp + 0xd8]
call fcn.00402db0
add esp, 4
mov byte [esp + 0x184], 0x16
call fcn.00409f80
test eax, eax
lea eax, [esp + 0x58]
je 0x4022ce
push 0xe
push 0x4a5a6c
jmp 0x4022d5
mov eax, dword [esi + 4]
cmp eax, ebp
je 0x401c0d
push str.service
push eax
call fcn.0047221c
add esp, 8
test eax, eax
jne 0x401c0d
lea ecx, [esp + 0x3c]
push ecx
call fcn.0043a470
add esp, 4
neg eax
sbb eax, eax
add eax, ebx
jmp 0x401aad
call fcn.00409d40
test eax, eax
je 0x401c44
mov eax, dword [esi + 4]
cmp eax, ebp
je 0x401c44
push str.360bprot
push eax
call fcn.0047221c
add esp, 8
test eax, eax
jne 0x401c44
call fcn.00424ba0
mov edi, eax
neg edi
sbb edi, edi
add edi, 0xa
jmp 0x401aaf
xor ebp, ebp
mov dword [esp + 0x1c], ebp
jmp 0x402742
cmp dword [esp + 0x24], 2
jne 0x401c42
call fcn.00401140
mov esi, eax
call fcn.0046b7d0
test eax, eax
je 0x401c70
call fcn.00401140
mov esi, eax
call fcn.0046bb40
mov esi, dword [esp + 0x28]
mov eax, dword [esi + 4]
xor ebp, ebp
cmp eax, ebp
je 0x402199
push str.protect
push eax
call fcn.0047221c
add esp, 8
test eax, eax
jne 0x402199
lea edx, [esp + 0x58]
push edx
mov dword [esp + 0x44], 1
call fcn.00402940
mov byte [esp + 0x184], bl
lea eax, [esp + 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.00401070
push eax
call fcn.00421e80
test eax, eax
je 0x40203b
mov ecx, dword [esp + 0x6c]
mov edx, dword [ecx]
mov eax, dword [esp + 0x58]
mov ebp, dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov dword [esp + 0x30], edx
mov dword [esp + 0x2c], eax
mov esi, dword [esp + 0x6c]
test eax, eax
je 0x401cf5
cmp eax, dword [esp + 0x58]
je 0x401cfa
call fcn.004726ec
cmp dword [esp + 0x30], esi
je 0x40203b
xor eax, eax
xor ecx, ecx
xor edx, edx
lea esi, [esp + 0x2c]
mov word [esp + 0x14c], ax
mov dword [esp + 0x14e], eax
mov dword [esp + 0x152], eax
mov dword [esp + 0x156], eax
mov dword [esp + 0x15a], eax
mov dword [esp + 0x15e], eax
mov dword [esp + 0x162], eax
mov dword [esp + 0x166], eax
mov dword [esp + 0x16a], eax
mov dword [esp + 0x16e], eax
mov word [esp + 0x172], ax
mov word [esp + 0x124], cx
mov dword [esp + 0x126], eax
mov dword [esp + 0x12a], eax
mov dword [esp + 0x12e], eax
mov dword [esp + 0x132], eax
mov dword [esp + 0x136], eax
mov dword [esp + 0x13a], eax
mov dword [esp + 0x13e], eax
mov dword [esp + 0x142], eax
mov dword [esp + 0x146], eax
mov word [esp + 0x14a], ax
mov word [esp + 0xfc], dx
mov dword [esp + 0xfe], eax
mov dword [esp + 0x102], eax
mov dword [esp + 0x106], eax
mov dword [esp + 0x10a], eax
mov dword [esp + 0x10e], eax
mov dword [esp + 0x112], eax
mov dword [esp + 0x116], eax
mov dword [esp + 0x11a], eax
mov dword [esp + 0x11e], eax
mov word [esp + 0x122], ax
mov word [esp + 0xd4], ax
mov dword [esp + 0xd6], eax
mov dword [esp + 0xda], eax
mov dword [esp + 0xde], eax
mov dword [esp + 0xe2], eax
mov dword [esp + 0xe6], eax
mov dword [esp + 0xea], eax
mov dword [esp + 0xee], eax
mov dword [esp + 0xf2], eax
mov dword [esp + 0xf6], eax
mov word [esp + 0xfa], ax
call fcn.00402a20
mov ecx, dword [eax]
push ecx
push str.pp_d
lea edx, [esp + 0x154]
push 0x14
push edx
call fcn.00472300
add esp, 0x10
call fcn.00402a20
mov eax, dword [eax]
push eax
push str.pn_d
lea ecx, [esp + 0x12c]
push 0x14
push ecx
call fcn.00472300
add esp, 0x10
call fcn.00402a20
mov edx, dword [eax]
push edx
push str.pc_d
lea eax, [esp + 0x104]
push 0x14
push eax
call fcn.00472300
add esp, 0x10
call fcn.00402a20
mov ecx, dword [eax]
push ecx
push str.pt_d
push 0x14
lea edx, [esp + 0xe0]
push edx
call fcn.00472300
add esp, 0x10
call fcn.00402a20
add eax, 8
cmp dword [eax + 0x18], 8
jb 0x401ed9
mov eax, dword [eax + 4]
jmp 0x401edc
add eax, 4
push eax
call ebp
lea esi, [esp + 0x2c]
mov edi, eax
call fcn.00402a20
sub esp, 0x1c
mov ecx, eax
add ecx, 8
mov esi, esp
mov dword [esp + 0x30], esp
call fcn.004028e0
mov byte [esp + 0x1a0], 7
sub esp, 0x1c
lea edx, [esp + 0x184]
mov eax, esp
mov dword [esp + 0x50], esp
call fcn.004028a0
mov byte [esp + 0x1bc], 8
mov byte [esp + 0x1bc], bl
lea ecx, [esp + 0xc8]
call fcn.0043b220
sub esp, 0x1c
mov edx, edi
mov eax, esp
mov dword [esp + 0x30], esp
call fcn.004028a0
mov byte [esp + 0x1a0], 9
sub esp, 0x1c
lea edx, [esp + 0x15c]
mov eax, esp
mov dword [esp + 0x50], esp
call fcn.004028a0
mov byte [esp + 0x1bc], 0xa
mov byte [esp + 0x1bc], bl
lea ecx, [esp + 0xc8]
call fcn.0043b220
lea esi, [esp + 0x2c]
call fcn.00402a20
sub esp, 0x1c
mov ecx, eax
add ecx, 0x24
mov esi, esp
mov dword [esp + 0x30], esp
call fcn.004028e0
mov byte [esp + 0x1a0], 0xb
sub esp, 0x1c
lea edx, [esp + 0x134]
mov eax, esp
mov dword [esp + 0x50], esp
call fcn.004028a0
mov byte [esp + 0x1bc], 0xc
mov byte [esp + 0x1bc], bl
lea ecx, [esp + 0xc8]
call fcn.0043b220
lea esi, [esp + 0x2c]
call fcn.00402a20
sub esp, 0x1c
mov ecx, eax
add ecx, 0x40
mov esi, esp
mov dword [esp + 0x30], esp
call fcn.004028e0
mov byte [esp + 0x1a0], 0xd
sub esp, 0x1c
lea edx, [esp + 0x10c]
mov eax, esp
mov dword [esp + 0x50], esp
call fcn.004028a0
mov byte [esp + 0x1bc], 0xe
mov byte [esp + 0x1bc], bl
lea ecx, [esp + 0xc8]
call fcn.0043b220
lea edi, [esp + 0x50]
lea esi, [esp + 0x2c]
call fcn.00402a50
mov eax, dword [esp + 0x2c]
jmp 0x401ce7
call fcn.00409d40
test eax, eax
je 0x40209d
call fcn.00424b20
test eax, eax
jne 0x40209d
sub esp, 0x1c
lea esi, [eax + 0xc]
mov edx, str.installret
mov eax, esp
mov dword [esp + 0x30], esp
call fcn.004028a0
mov byte [esp + 0x1a0], 0xf
lea eax, [esp + 0xac]
push eax
mov byte [esp + 0x1a4], bl
mov ecx, esi
call fcn.0043b320
lea edi, [esi + 4]
mov byte [esp + 0x184], 1
lea ecx, [esp + 0x58]
push ecx
call fcn.004029b0
xor ebp, ebp
jmp 0x401aaf
call fcn.00409d40
test eax, eax
je 0x402111
call fcn.00409f80
test eax, eax
jne 0x402111
call fcn.0041ff00
test eax, eax
jne 0x402111
call fcn.00439430
test eax, eax
jne 0x402111
sub esp, 0x1c
lea esi, [eax + 4]
mov edx, str.installret
mov eax, esp
mov dword [esp + 0x30], esp
call fcn.004028a0
mov byte [esp + 0x1a0], 0x10
lea edx, [esp + 0xac]
push edx
mov byte [esp + 0x1a4], bl
mov ecx, esi
call fcn.0043b320
lea edi, [esi + 0xc]
mov byte [esp + 0x184], 1
lea eax, [esp + 0x58]
push eax
call fcn.004029b0
xor ebp, ebp
jmp 0x401aaf
call fcn.00439550
test eax, eax
jne 0x40216a
sub esp, 0x1c
lea esi, [eax + 8]
mov edx, str.installret
mov eax, esp
mov dword [esp + 0x30], esp
call fcn.004028a0
mov byte [esp + 0x1a0], 0x11
lea ecx, [esp + 0xac]
push ecx
mov byte [esp + 0x1a4], bl
mov ecx, esi
call fcn.0043b320
lea edi, [esi + 8]
mov byte [esp + 0x184], 1
lea edx, [esp + 0x58]
push edx
call fcn.004029b0
xor ebp, ebp
jmp 0x401aaf
push str.SYSTEMCurrentControlSetServices360bpsvcCache
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push 0x4a59c8
push str.SYSTEMCurrentControlSetServices360bpsvc
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
mov edi, 0xf
jmp 0x4020f8
mov eax, dword [esi + 4]
cmp eax, ebp
je 0x4021c3
push str.hookport
push eax
call fcn.0047221c
add esp, 8
test eax, eax
jne 0x4021c3
call fcn.00439430
neg eax
sbb eax, eax
add eax, 4
jmp 0x401aad
mov eax, dword [esi + 4]
cmp eax, ebp
je 0x4021ed
push str.service
push eax
call fcn.0047221c
add esp, 8
test eax, eax
jne 0x4021ed
call fcn.00439550
neg eax
sbb eax, eax
add eax, 8
jmp 0x401aad
mov esi, dword [esi + 4]
cmp esi, ebp
je 0x401c44
push str.360bprot
push esi
call fcn.0047221c
add esp, 8
test eax, eax
jne 0x401c44
call fcn.00424b20
mov edi, eax
neg edi
sbb edi, edi
add edi, 0xc
jmp 0x401aaf
cmp dword [esp + 0x24], 2
jne 0x402742
mov ecx, dword [esp + 0x28]
mov eax, dword [ecx + 4]
test eax, eax
je 0x402742
push str.service
push eax
call fcn.0047221c
add esp, 8
test eax, eax
jne 0x402742
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.004391c0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 1
jmp 0x402742
call fcn.00420a00
mov dword [esp + 0x20], 1
jmp 0x402742
call fcn.00420d10
mov dword [esp + 0x44], eax
mov dword [esp + 0x20], 1
jmp 0x402742
mov edi, 1
call fcn.00421010
mov dword [esp + 0x20], edi
jmp 0x402742
xor edi, edi
call fcn.00421010
mov dword [esp + 0x20], 1
jmp 0x402742
mov dword [esp + 0x1c], 0
jmp 0x402742
push 0xc
push str.360bprot.sys
call fcn.004037d0
cmp dword [esp + 0x70], 8
mov edi, dword [esp + 0x5c]
jae 0x4022e9
lea edi, [esp + 0x5c]
lea ecx, [esp + 0x74]
call fcn.0040cae0
test eax, eax
jne 0x402305
push ebx
push str.0.0.0.0
lea esi, [esp + 0x7c]
call fcn.00402bd0
sub esp, 0x1c
mov eax, esp
mov dword [esp + 0x30], esp
push 0xffffffffffffffff
push ebp
lea edx, [esp + 0x98]
xor ecx, ecx
mov dword [eax + 0x18], ebx
mov dword [eax + 0x14], ebp
push edx
mov word [eax + 4], cx
call fcn.00402a90
mov byte [esp + 0x1a0], 0x17
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x50], esp
push 0xb
xor eax, eax
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebp
push str.360bprotver
mov word [esi + 4], ax
call fcn.00402bd0
mov byte [esp + 0x1bc], 0x18
mov byte [esp + 0x1bc], 0x16
lea ecx, [esp + 0xc8]
call fcn.0043b220
lea ecx, [esp + 0x14c]
push ecx
mov edi, 0x4a5ad0
lea ecx, [esp + 0xd8]
call fcn.00402db0
add esp, 4
mov byte [esp + 0x184], 0x19
cmp dword [esp + 0x164], 8
mov edi, dword [esp + 0x150]
jae 0x4023ab
lea edi, [esp + 0x150]
lea ecx, [esp + 0x74]
call fcn.0040cae0
test eax, eax
jne 0x4023c7
push ebx
push str.0.0.0.0
lea esi, [esp + 0x7c]
call fcn.00402bd0
sub esp, 0x1c
mov eax, esp
mov dword [esp + 0x30], esp
push 0xffffffffffffffff
push ebp
lea ecx, [esp + 0x98]
xor edx, edx
mov dword [eax + 0x18], ebx
mov dword [eax + 0x14], ebp
push ecx
mov word [eax + 4], dx
call fcn.00402a90
mov byte [esp + 0x1a0], 0x1a
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x50], esp
push 0xb
xor edx, edx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebp
push str.hookportver
mov word [esi + 4], dx
call fcn.00402bd0
mov byte [esp + 0x1bc], 0x1b
mov byte [esp + 0x1bc], 0x19
lea ecx, [esp + 0xc8]
call fcn.0043b220
mov byte [esp + 0x184], 0x16
mov esi, 8
cmp dword [esp + 0x164], esi
jb 0x402457
mov eax, dword [esp + 0x150]
push eax
call fcn.00471eaf
add esp, 4
xor ecx, ecx
mov dword [esp + 0x164], ebx
mov dword [esp + 0x160], ebp
mov word [esp + 0x150], cx
mov byte [esp + 0x184], 0x15
cmp dword [esp + 0x70], esi
jb 0x40248a
mov edx, dword [esp + 0x5c]
push edx
call fcn.00471eaf
add esp, 4
xor eax, eax
mov dword [esp + 0x70], ebx
mov dword [esp + 0x6c], ebp
mov word [esp + 0x5c], ax
mov byte [esp + 0x184], 0x14
cmp dword [esp + 0x34], ebp
je 0x4024b0
mov ecx, dword [esp + 0x38]
push ecx
call dword [esp + 0x34]
xor edx, edx
mov dword [esp + 0x13c], ebx
mov dword [esp + 0x138], ebp
mov word [esp + 0x128], dx
mov byte [esp + 0x184], 0x1c
xor eax, eax
mov dword [esp + 0xd0], ebx
mov dword [esp + 0xcc], ebp
mov word [esp + 0xbc], ax
mov byte [esp + 0x184], 0x1d
lea edi, [esp + 0xb8]
call fcn.0040e270
mov esi, 8
test eax, eax
je 0x40258c
mov edi, dword [esp + 0xbc]
cmp dword [esp + 0xd0], esi
jae 0x402520
lea edi, [esp + 0xbc]
lea ecx, [esp + 0x124]
call fcn.0040cae0
test eax, eax
je 0x40258c
sub esp, 0x1c
mov eax, esp
mov dword [esp + 0x30], esp
push 0xffffffffffffffff
push ebp
lea edx, [esp + 0x148]
xor ecx, ecx
mov dword [eax + 0x18], ebx
mov dword [eax + 0x14], ebp
push edx
mov word [eax + 4], cx
call fcn.00402a90
mov byte [esp + 0x1a0], 0x1e
sub esp, 0x1c
mov edx, str.brover
mov eax, esp
mov dword [esp + 0x50], esp
call fcn.004028a0
mov byte [esp + 0x1bc], 0x1f
mov byte [esp + 0x1bc], 0x1d
lea ecx, [esp + 0xc8]
call fcn.0043b220
xor eax, eax
mov dword [esp + 0x114], ebx
mov dword [esp + 0x110], ebp
mov word [esp + 0x100], ax
mov byte [esp + 0x184], 0x20
lea ecx, [esp + 0xfc]
call fcn.0040ef40
test eax, eax
je 0x40262b
sub esp, 0x1c
mov eax, esp
mov dword [esp + 0x30], esp
push 0xffffffffffffffff
push ebp
lea edx, [esp + 0x120]
xor ecx, ecx
mov dword [eax + 0x18], ebx
mov dword [eax + 0x14], ebp
push edx
mov word [eax + 4], cx
call fcn.00402a90
mov byte [esp + 0x1a0], 0x21
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x50], esp
push 3
xor eax, eax
mov dword [esi + 0x18], ebx
mov dword [esi + 0x14], ebp
push 0x4a5b14
mov word [esi + 4], ax
call fcn.00402bd0
mov byte [esp + 0x1bc], 0x22
mov byte [esp + 0x1bc], 0x20
lea ecx, [esp + 0xc8]
call fcn.0043b220
mov esi, 8
mov byte [esp + 0x184], 0x1d
cmp dword [esp + 0x114], esi
jb 0x40264c
mov ecx, dword [esp + 0x100]
push ecx
call fcn.00471eaf
add esp, 4
xor edx, edx
mov dword [esp + 0x114], ebx
mov dword [esp + 0x110], ebp
mov word [esp + 0x100], dx
mov byte [esp + 0x184], 0x1c
cmp dword [esp + 0xd0], esi
jb 0x402685
mov eax, dword [esp + 0xbc]
push eax
call fcn.00471eaf
add esp, 4
xor ecx, ecx
mov dword [esp + 0xd0], ebx
mov dword [esp + 0xcc], ebp
mov word [esp + 0xbc], cx
mov byte [esp + 0x184], 0x14
cmp dword [esp + 0x13c], esi
jb 0x4026be
mov edx, dword [esp + 0x128]
push edx
call fcn.00471eaf
add esp, 4
xor eax, eax
mov dword [esp + 0x13c], ebx
mov dword [esp + 0x138], ebp
mov word [esp + 0x128], ax
mov byte [esp + 0x184], 0x13
cmp dword [esp + 0x8c], esi
jb 0x4026f4
mov ecx, dword [esp + 0x78]
push ecx
call fcn.00471eaf
add esp, 4
xor edx, edx
mov dword [esp + 0x8c], ebx
mov dword [esp + 0x88], ebp
mov word [esp + 0x78], dx
mov byte [esp + 0x184], 1
cmp dword [esp + 0xec], esi
jb 0x40272a
mov eax, dword [esp + 0xd8]
push eax
call fcn.00471eaf
add esp, 4
xor ecx, ecx
mov dword [esp + 0xec], ebx
mov dword [esp + 0xe8], ebp
mov word [esp + 0xd8], cx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x30], esp
push 0
mov dword [ecx + 0x18], 0xf
mov dword [ecx + 0x14], 0
push 0x4a5b1c
mov byte [ecx + 4], 0
call fcn.00403290
mov byte [esp + 0x1a0], 0x23
mov byte [esp + 0x1a0], 1
lea esi, [esp + 0xac]
call fcn.0043acf0
mov dword [esp + 0x184], 0xffffffff
mov edx, esi
push edx
call fcn.0043ac50
jmp 0x40279e
mov dword [esp + 0x1c], ebp
mov eax, dword [esp + 0x28]
test eax, eax
je 0x4027ad
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [esp + 0x20], 0
je 0x4027cb
cmp dword [esp + 0x44], 0
je 0x4027c3
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x17c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x160]
xor ecx, esp
call fcn.00471eba
add esp, 0x174
ret