Function at 0x40b2e0
Capabilities:
Check if file exists
Copy file
Create directory
Delete file
Get common file path
Get installed programs
Get startup folder
Persist via lnk shortcut
Query or enumerate registry value
Set registry value
Write file to startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x417535
mov eax, dword fs:[0]
push eax
sub esp, 0xf68
mov eax, dword [0x424d98]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0x14]
lea edx, [ebp - 0xc50]
push edx
xor edi, edi
push 0x20119
push edi
mov dword [ebp - 0xc48], edi
push str.SoftwareConexant
xor ecx, ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc60], eax
mov word [eax], cx
mov dword [ebp - 4], edi
lea esi, [edi + 1]
mov dword [ebp - 0xc64], 0xff
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40b3aa
mov edx, dword [ebp - 0xc50]
lea eax, [ebp - 0xc5c]
push eax
lea ecx, [ebp - 0xc64]
push ecx
push edi
push edi
push str.SetCOMMBranding
push edx
mov dword [ebp - 0xc5c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40b395
mov eax, dword [ebp - 0xc64]
cmp eax, dword [ebp + 0xc]
jne 0x40b395
xor esi, esi
mov ecx, dword [ebp - 0xc50]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, edi
je 0x40d0a4
call fcn.00408ed0
cmp eax, 1
jne 0x40d0a4
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [str.SAConfig.HP.Slice.xml]
mov eax, dword [0x41e42c]
mov dword [ebp - 0x320], edx
mov edx, dword [0x41e434]
mov ecx, 6
mov esi, str.SAConfig.BandO.Slice.xml
lea edi, [ebp - 0x62c]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x41e430]
mov dword [ebp - 0x314], edx
lea edx, [ebp - 0xc50]
push edx
push 0x20119
push 0
mov dword [ebp - 0x31c], eax
mov eax, dword [0x41e438]
mov dword [ebp - 0x318], ecx
mov cx, word [0x41e43c]
push str.SOFTWAREConexantSA3
push reloc.OLEAUT32.dll_SysReAllocString
movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x310], eax
mov word [ebp - 0x30c], cx
xor bl, bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40b4c0
mov edx, dword [ebp - 0xc50]
mov dword [ebp - 0xc58], eax
lea eax, [ebp - 0xc5c]
push eax
lea ecx, [ebp - 0xc58]
push ecx
push 0
push 0
push str.FeatureByteBrandingStatus
push edx
mov dword [ebp - 0xc5c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40b4ab
cmp dword [ebp - 0xc58], eax
je 0x40b4ab
mov ecx, 7
mov esi, str.SAConfig.BandO.FeatureByte.xml
lea edi, [ebp - 0x62c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 7
mov esi, str.SAConfig.HP.FeatureByte.xml
lea edi, [ebp - 0x320]
rep movsd dword es:[edi], dword [esi]
mov bl, 1
mov eax, dword [ebp - 0xc50]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
jne 0x40b556
lea ecx, [ebp - 0xc50]
push ecx
push 0x20119
push 0
push str.SOFTWAREConexantSA3HP_NB_AIO
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40b556
mov ecx, dword [ebp - 0xc50]
lea edx, [ebp - 0xc5c]
push edx
mov dword [ebp - 0xc58], eax
lea eax, [ebp - 0xc58]
push eax
push 0
push 0
push str.FeatureByteBrandingStatus
push ecx
mov dword [ebp - 0xc5c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40b549
cmp dword [ebp - 0xc58], eax
je 0x40b549
mov ecx, 7
mov esi, str.SAConfig.BandO.FeatureByte.xml
lea edi, [ebp - 0x62c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 7
mov esi, str.SAConfig.HP.FeatureByte.xml
lea edi, [ebp - 0x320]
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp - 0xc50]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0xc]
cmp eax, 4
ja case.default.0x40b562
jmp dword [eax*4 + 0x40d0cc]
mov eax, dword [str.BandOPlay.ico]
mov ecx, 8
mov esi, str.Bang__Olufsen_Audio_Control_Panel
lea edi, [ebp - 0x424]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x41e370]
mov edx, dword [0x41e374]
movsw word es:[edi], word [esi]
mov dword [ebp - 0xe6c], ecx
movzx ecx, byte [0x41e347]
movsb byte es:[edi], byte [esi]
mov byte [ebp - 0x528], cl
mov ecx, 9
mov esi, str.Bang__Olufsen_Audio_Control_Panel.lnk
lea edi, [ebp - 0xf74]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x41e314]
mov dword [ebp - 0xe70], eax
movzx eax, word [0x41e378]
mov dword [ebp - 0xe68], edx
mov edx, dword [str.Audio_Controls.lnk]
mov word [ebp - 0xe64], ax
mov eax, dword [0x41e310]
mov dword [ebp - 0xd64], ecx
movzx ecx, byte [0x41e31e]
movsw word es:[edi], word [esi]
mov dword [ebp - 0xd6c], edx
mov edx, dword [0x41e318]
mov dword [ebp - 0xd68], eax
movzx eax, word [0x41e31c]
mov dword [ebp - 0xd60], edx
mov byte [ebp - 0xd5a], cl
movsb byte es:[edi], byte [esi]
mov word [ebp - 0xd5c], ax
lea ecx, [ebp - 0x62c]
lea edx, [ebp - 0x834]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40b627
lea ecx, [ebp - 0x320]
lea edx, [ebp - 0x938]
lea ecx, [ecx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40b640
jmp case.default.0x40b562
mov cl, byte [0x41e308]
mov byte [ebp - 0x41c], cl
mov ecx, dword [0x41e374]
mov edx, dword [str.BO_Play]
mov dword [ebp - 0xe68], ecx
mov eax, dword [0x41e304]
mov ecx, 7
mov esi, str.BO_Play_Control_Audio_Panel
lea edi, [ebp - 0x528]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 9
mov esi, str.Bang__Olufsen_Audio_Control_Panel.lnk
lea edi, [ebp - 0xf74]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x41e310]
mov dword [ebp - 0x424], edx
mov edx, dword [str.BandOPlay.ico]
mov dword [ebp - 0xe70], edx
mov dx, word [0x41e378]
mov dword [ebp - 0x420], eax
mov eax, dword [0x41e370]
mov word [ebp - 0xe64], dx
mov edx, dword [0x41e314]
mov dword [ebp - 0xe6c], eax
mov eax, dword [str.Audio_Controls.lnk]
movsw word es:[edi], word [esi]
mov dword [ebp - 0xd68], ecx
mov cx, word [0x41e31c]
mov dword [ebp - 0xd64], edx
mov dl, byte [0x41e31e]
mov dword [ebp - 0xd6c], eax
mov eax, dword [0x41e318]
mov word [ebp - 0xd5c], cx
mov byte [ebp - 0xd5a], dl
movsb byte es:[edi], byte [esi]
mov dword [ebp - 0xd60], eax
lea ecx, [ebp - 0x62c]
lea edx, [ebp - 0x834]
nop
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40b720
lea ecx, [ebp - 0x320]
lea edx, [ebp - 0x938]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40b736
jmp case.default.0x40b562
mov eax, dword [str.BandOPlay.ico]
mov ecx, 8
mov esi, str.Bang__Olufsen_Audio_Control_Panel
lea edi, [ebp - 0x424]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x41e370]
mov edx, dword [0x41e374]
movsw word es:[edi], word [esi]
mov dword [ebp - 0xe6c], ecx
movzx ecx, byte [0x41e347]
movsb byte es:[edi], byte [esi]
mov byte [ebp - 0x528], cl
mov ecx, 9
mov esi, str.Bang__Olufsen_Audio_Control_Panel.lnk
lea edi, [ebp - 0xf74]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x41e314]
mov dword [ebp - 0xe70], eax
movzx eax, word [0x41e378]
mov dword [ebp - 0xe68], edx
mov edx, dword [str.Audio_Controls.lnk]
mov word [ebp - 0xe64], ax
mov eax, dword [0x41e310]
mov dword [ebp - 0xd64], ecx
movzx ecx, byte [0x41e31e]
movsw word es:[edi], word [esi]
mov dword [ebp - 0xd6c], edx
mov edx, dword [0x41e318]
mov dword [ebp - 0xd68], eax
movzx eax, word [0x41e31c]
mov dword [ebp - 0xd60], edx
mov byte [ebp - 0xd5a], cl
movsb byte es:[edi], byte [esi]
mov word [ebp - 0xd5c], ax
lea ecx, [ebp - 0x62c]
lea edx, [ebp - 0x834]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40b803
lea ecx, [ebp - 0x320]
lea edx, [ebp - 0x938]
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40b820
jmp case.default.0x40b562
mov ecx, dword [0x41e2cc]
mov esi, dword [0x41e2d4]
mov edi, dword [0x41e2d8]
mov edx, dword [0x41e2d0]
mov ebx, dword [0x41e2dc]
mov eax, dword [str.DTS_Audio_Control_Panel]
mov dword [ebp - 0x420], ecx
mov dword [ebp - 0x524], ecx
mov ecx, dword [0x41e310]
mov dword [ebp - 0xf70], ecx
mov cx, word [0x41e31c]
mov dword [ebp - 0x418], esi
mov dword [ebp - 0x414], edi
mov dword [ebp - 0x51c], esi
mov dword [ebp - 0x518], edi
mov word [ebp - 0xf64], cx
mov ecx, 9
mov esi, str.Bang__Olufsen_Audio_Control_Panel.lnk
lea edi, [ebp - 0xd6c]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x41c], edx
mov dword [ebp - 0x520], edx
mov edx, dword [0x41e2dc]
mov dword [ebp - 0x410], ebx
mov ebx, dword [str.HPAudio.ico]
mov dword [ebp - 0x514], edx
mov edx, dword [0x41e314]
mov dword [ebp - 0x424], eax
mov dword [ebp - 0xe70], ebx
mov ebx, dword [0x41e2c0]
mov dword [ebp - 0x528], eax
mov eax, dword [str.Audio_Controls.lnk]
mov dword [ebp - 0xf6c], edx
mov dl, byte [0x41e31e]
movsw word es:[edi], word [esi]
mov dword [ebp - 0xe6c], ebx
mov ebx, dword [0x41e2c4]
mov dword [ebp - 0xf74], eax
mov eax, dword [0x41e318]
mov byte [ebp - 0xf62], dl
mov dword [ebp - 0xe68], ebx
mov dword [ebp - 0xf68], eax
movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x320]
lea edx, [ebp - 0x834]
lea ecx, [ecx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40b930
lea ecx, [ebp - 0x62c]
lea edx, [ebp - 0x938]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40b946
jmp case.default.0x40b562
mov ecx, dword [0x41e2b0]
mov eax, dword [str.Audio_Controls]
mov dword [ebp - 0x420], ecx
movzx ecx, byte [0x41e2ba]
mov edx, dword [0x41e2b4]
mov byte [ebp - 0x416], cl
mov ecx, dword [0x41e2c4]
mov dword [ebp - 0xe68], ecx
mov ecx, dword [0x41e29c]
mov dword [ebp - 0x520], ecx
movzx ecx, byte [0x41e2a8]
mov byte [ebp - 0x514], cl
mov ecx, dword [0x41e314]
mov dword [ebp - 0xf6c], ecx
movzx ecx, byte [0x41e31e]
mov dword [ebp - 0x424], eax
movzx eax, word [0x41e2b8]
mov byte [ebp - 0xf62], cl
mov dword [ebp - 0x41c], edx
mov edx, dword [str.HPAudio.ico]
mov word [ebp - 0x418], ax
mov eax, dword [0x41e2c0]
mov ecx, 9
mov esi, str.Bang__Olufsen_Audio_Control_Panel.lnk
lea edi, [ebp - 0xd6c]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xe70], edx
mov edx, dword [str.Audio_Controls_Panel]
mov dword [ebp - 0xe6c], eax
mov eax, dword [0x41e298]
mov dword [ebp - 0x528], edx
mov edx, dword [0x41e2a0]
mov dword [ebp - 0x524], eax
mov eax, dword [0x41e2a4]
mov dword [ebp - 0x51c], edx
mov edx, dword [str.Audio_Controls.lnk]
mov dword [ebp - 0x518], eax
mov eax, dword [0x41e310]
mov dword [ebp - 0xf74], edx
mov edx, dword [0x41e318]
mov dword [ebp - 0xf70], eax
movzx eax, word [0x41e31c]
movsw word es:[edi], word [esi]
mov dword [ebp - 0xf68], edx
mov word [ebp - 0xf64], ax
movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x320]
lea edx, [ebp - 0x834]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40ba68
lea ecx, [ebp - 0x62c]
lea edx, [ebp - 0x938]
mov edi, edi
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40ba80
mov eax, dword [ebp - 0xc60]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [ebp - 0xc50]
push ecx
push 0x20119
push 0
push str.SoftwareMicrosoftWindowsCurrentVersion
or edx, 0xffffffff
push reloc.OLEAUT32.dll_SysReAllocString
mov word [eax], dx
call ebx
test eax, eax
jne 0x40d09f
mov ecx, dword [ebp - 0xc50]
lea edx, [ebp - 0xc5c]
push edx
lea eax, [ebp - 0xa3c]
push eax
push 0
push 0
push str.ProgramFilesDir
push ecx
mov dword [ebp - 0xc5c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40d09f
lea ecx, [ebp - 0xa3c]
lea edx, [ebp - 0x62c]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40bb00
lea edi, [ebp - 0x62c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40bb11
lea edx, [ebp - 0xb40]
push edx
push 0
push 0
push 0x17
mov ecx, 7
mov esi, str.CONEXANTSA3HP_NB_AIOUX_
push 0
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea ecx, [ebp - 0xb40]
lea edx, [ebp - 0x320]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40bb46
lea edi, [ebp - 0x320]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40bb57
mov ax, word [0x41debc]
mov word [edi], ax
lea ecx, [ebp - 0xb40]
lea edx, [ebp - 0x730]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40bb74
lea edi, [ebp - 0x730]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40bb85
mov ecx, 6
mov esi, str.Music__Photos_and_Videos_
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0xc50]
push ecx
push 0x20106
push 0
movsw word es:[edi], word [esi]
push str.CLSIDD3CD8822_6943_4214_90EE_12F40BEA126F
push SysReAllocString
movsb byte es:[edi], byte [esi]
call ebx
test eax, eax
jne 0x40bc24
lea eax, [ebp - 0x424]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40bbc3
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
sub eax, edx
push eax
mov eax, dword [ebp - 0xc50]
lea edx, [ebp - 0x424]
push edx
push 1
push 0
push 0
push eax
call ebx
lea eax, [ebp - 0x528]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40bbf2
sub eax, edx
mov edx, dword [ebp - 0xc50]
push eax
lea ecx, [ebp - 0x528]
push ecx
push 1
push 0
push str.InfoTip
push edx
call ebx
mov eax, dword [ebp - 0xc50]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40bc2a
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [ebp - 0xc50]
push ecx
push 0x20106
push 0
push str.CLSIDD3CD8822_6943_4214_90EE_12F40BEA126FDefaultIcon
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40bcd0
lea ecx, [ebp - 0x62c]
lea edx, [ebp - 0x21c]
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40bc60
lea eax, [ebp - 0xe70]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40bc72
lea edi, [ebp - 0x21c]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40bc82
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x21c]
rep movsb byte es:[edi], byte [esi]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40bca3
sub eax, edx
push eax
mov eax, dword [ebp - 0xc50]
lea edx, [ebp - 0x21c]
push edx
push 1
push 0
push 0
push eax
call ebx
mov ecx, dword [ebp - 0xc50]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0xc50]
push edx
push 0x20106
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallCNXT_AUDIO_HDA
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40bd75
lea ecx, [ebp - 0x62c]
lea edx, [ebp - 0x21c]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40bd02
lea eax, [ebp - 0xe70]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40bd14
lea edi, [ebp - 0x21c]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40bd24
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x21c]
rep movsb byte es:[edi], byte [esi]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40bd45
mov ecx, dword [ebp - 0xc50]
sub eax, edx
push eax
lea eax, [ebp - 0x21c]
push eax
push 1
push 0
push str.DisplayIcon
push ecx
call ebx
mov edx, dword [ebp - 0xc50]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp + 0x10]
lea ecx, [ebp - 0x730]
test ebx, ebx
jne 0x40bd88
lea ecx, [ebp - 0x320]
lea edx, [ebp - 0xc44]
mov edi, edi
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40bd90
lea eax, [ebp - 0xd6c]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40bda2
lea edi, [ebp - 0xc44]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40bdb2
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0xc44]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x40c56c
test ebx, ebx
je 0x40bf0f
mov edx, dword [0x424d7c]
mov eax, dword [edx + 0xc]
mov ecx, 0x424d7c
call eax
lea edi, [eax + 0x10]
mov dword [ebp - 0xc4c], edi
lea ecx, [ebp - 0x730]
mov byte [ebp - 4], 1
push 0
test ecx, 0xffff0000
jne 0x40be42
mov edx, ecx
movzx esi, dx
push esi
call fcn.00408d20
add esp, 8
test eax, eax
je 0x40bef9
push esi
push eax
lea ecx, [ebp - 0xc4c]
call fcn.0040a5a0
mov edi, dword [ebp - 0xc4c]
jmp 0x40bef9
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x730]
push eax
push 0
push 3
call ebx
lea esi, [eax - 1]
test esi, esi
jle 0x40bea4
mov eax, dword [edi - 8]
mov ecx, 1
sub ecx, dword [edi - 4]
sub eax, esi
or eax, ecx
jge 0x40be83
push esi
lea ecx, [ebp - 0xc4c]
call fcn.00409420
mov edi, dword [ebp - 0xc4c]
push esi
push edi
push 0xffffffffffffffff
lea ecx, [ebp - 0x730]
push ecx
push 0
push 3
call ebx
cmp esi, dword [edi - 8]
jg 0x40bebf
xor edx, edx
mov dword [edi - 0xc], esi
mov word [edi + esi*2], dx
jmp 0x40bef9
cmp dword [edi - 0xc], 0
mov esi, dword [edi - 0x10]
lea eax, [edi - 0x10]
je 0x40bef9
cmp dword [eax + 0xc], 0
lea ecx, [eax + 0xc]
jge 0x40bed7
cmp dword [edi - 8], 0
jge 0x40bec9
push 0x80070057
call fcn.00401270
xor eax, eax
mov dword [edi - 0xc], 0
mov word [edi], ax
jmp 0x40bef9
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40beed
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0xc]
mov ecx, esi
call eax
lea edi, [eax + 0x10]
or dword [ebp - 0xc48], 1
push 0
push edi
mov byte [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x40bf15
mov edi, dword [ebp - 0xc4c]
test byte [ebp - 0xc48], 1
je 0x40bf3a
add edi, 0xfffffff0
lea ecx, [edi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40bf3a
mov ecx, dword [edi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push edi
call edx
lea ecx, [ebp - 0x320]
lea edx, [ebp - 0x118]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40bf46
lea eax, [ebp - 0xd6c]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40bf58
lea edi, [ebp - 0x118]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40bf68
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [0x424d7c]
mov edx, dword [eax + 0xc]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x424d7c
call edx
lea edi, [eax + 0x10]
mov dword [ebp - 0xc4c], edi
lea eax, [ebp - 0x118]
mov byte [ebp - 4], 2
push 0
test eax, 0xffff0000
jne 0x40bfd9
mov ecx, eax
movzx esi, cx
push esi
call fcn.00408d20
add esp, 8
test eax, eax
je 0x40c094
push esi
push eax
lea ecx, [ebp - 0xc4c]
call fcn.0040a5a0
mov edi, dword [ebp - 0xc4c]
jmp 0x40c094
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0xffffffffffffffff
lea edx, [ebp - 0x118]
push edx
push 0
push 3
call ebx
lea esi, [eax - 1]
test esi, esi
jle 0x40c03f
mov eax, dword [edi - 8]
mov ecx, 1
sub ecx, dword [edi - 4]
sub eax, esi
or eax, ecx
jge 0x40c01a
push esi
lea ecx, [ebp - 0xc4c]
call fcn.00409420
mov edi, dword [ebp - 0xc4c]
push esi
push edi
push 0xffffffffffffffff
lea eax, [ebp - 0x118]
push eax
push 0
push 3
call ebx
cmp esi, dword [edi - 8]
jg 0x40bebf
xor ecx, ecx
mov dword [edi - 0xc], esi
mov word [edi + esi*2], cx
jmp 0x40c094
cmp dword [edi - 0xc], 0
mov esi, dword [edi - 0x10]
lea eax, [edi - 0x10]
je 0x40c094
cmp dword [eax + 0xc], 0
lea ecx, [eax + 0xc]
jge 0x40c072
cmp dword [edi - 8], 0
jge 0x40c064
push 0x80070057
call fcn.00401270
xor edx, edx
mov dword [edi - 0xc], 0
mov word [edi], dx
jmp 0x40c094
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c088
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0xc]
mov ecx, esi
call eax
lea edi, [eax + 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
mov byte [ebp - 4], 0
call ebx
add edi, 0xfffffff0
lea ecx, [edi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c0bd
mov ecx, dword [edi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push edi
call edx
cmp dword [ebp + 0x10], 0
je 0x40c246
lea ecx, [ebp - 0x730]
lea edx, [ebp - 0x118]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40c0d3
lea eax, [ebp - 0xd6c]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c0e5
lea edi, [ebp - 0x118]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40c0f5
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [0x424d7c]
mov edx, dword [eax + 0xc]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x424d7c
call edx
lea esi, [eax + 0x10]
mov dword [ebp - 0xc4c], esi
lea eax, [ebp - 0x118]
mov byte [ebp - 4], 3
push 0
test eax, 0xffff0000
jne 0x40c166
mov ecx, eax
movzx edi, cx
push edi
call fcn.00408d20
add esp, 8
test eax, eax
je 0x40c223
push edi
push eax
lea ecx, [ebp - 0xc4c]
call fcn.0040a5a0
mov esi, dword [ebp - 0xc4c]
jmp 0x40c223
push 0
push 0xffffffffffffffff
lea edx, [ebp - 0x118]
push edx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea edi, [eax - 1]
test edi, edi
jle 0x40c1ce
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x40c1a5
push edi
lea ecx, [ebp - 0xc4c]
call fcn.00409420
mov esi, dword [ebp - 0xc4c]
push edi
push esi
push 0xffffffffffffffff
lea eax, [ebp - 0x118]
push eax
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp edi, dword [esi - 8]
jg 0x40bebf
xor ecx, ecx
mov dword [esi - 0xc], edi
mov word [esi + edi*2], cx
jmp 0x40c223
cmp dword [esi - 0xc], 0
mov edi, dword [esi - 0x10]
lea eax, [esi - 0x10]
je 0x40c223
cmp dword [eax + 0xc], 0
lea ecx, [eax + 0xc]
jge 0x40c201
cmp dword [esi - 8], 0
jge 0x40c1f3
push 0x80070057
call fcn.00401270
xor edx, edx
mov dword [esi - 0xc], 0
mov word [esi], dx
jmp 0x40c223
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c217
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [edi]
mov eax, dword [edx + 0xc]
mov ecx, edi
call eax
lea esi, [eax + 0x10]
push esi
mov byte [ebp - 4], 0
call ebx
add esi, 0xfffffff0
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c246
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
lea ecx, [ebp - 0x62c]
lea edx, [ebp - 0x21c]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40c252
lea eax, [ebp - 0xf74]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c264
lea edi, [ebp - 0x21c]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40c274
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
cmp dword [ebp + 0x10], 0
rep movsb byte es:[edi], byte [esi]
lea edx, [ebp - 0x118]
je 0x40c2ac
lea ecx, [ebp - 0x730]
mov edi, edi
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40c2a0
jmp 0x40c2bc
lea ecx, [ebp - 0x320]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40c2b2
lea eax, [ebp - 0xf74]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c2c4
lea edi, [ebp - 0x118]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40c2d4
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [0x424d7c]
mov edx, dword [eax + 0xc]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x424d7c
call edx
lea ebx, [eax + 0x10]
mov dword [ebp - 0xc4c], ebx
lea eax, [ebp - 0x118]
mov byte [ebp - 4], 4
push 0
test eax, 0xffff0000
jne 0x40c345
mov ecx, eax
movzx esi, cx
push esi
call fcn.00408d20
add esp, 8
test eax, eax
je 0x40c406
push esi
push eax
lea ecx, [ebp - 0xc4c]
call fcn.0040a5a0
mov ebx, dword [ebp - 0xc4c]
jmp 0x40c406
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0xffffffffffffffff
lea edx, [ebp - 0x118]
push edx
push 0
push 3
call edi
lea esi, [eax - 1]
test esi, esi
jle 0x40c3ab
mov eax, dword [ebx - 8]
mov ecx, 1
sub ecx, dword [ebx - 4]
sub eax, esi
or eax, ecx
jge 0x40c386
push esi
lea ecx, [ebp - 0xc4c]
call fcn.00409420
mov ebx, dword [ebp - 0xc4c]
push esi
push ebx
push 0xffffffffffffffff
lea eax, [ebp - 0x118]
push eax
push 0
push 3
call edi
cmp esi, dword [ebx - 8]
jg 0x40bebf
xor ecx, ecx
mov dword [ebx - 0xc], esi
mov word [ebx + esi*2], cx
jmp 0x40c406
cmp dword [ebx - 0xc], 0
mov esi, dword [ebx - 0x10]
lea eax, [ebx - 0x10]
je 0x40c406
cmp dword [eax + 0xc], 0
lea ecx, [eax + 0xc]
jge 0x40c3de
cmp dword [ebx - 8], 0
jge 0x40c3d0
push 0x80070057
call fcn.00401270
xor edx, edx
mov dword [ebx - 0xc], 0
mov word [ebx], dx
jmp 0x40c406
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c3f4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0xc]
mov ecx, esi
call eax
lea ebx, [eax + 0x10]
mov dword [ebp - 0xc4c], ebx
mov edx, dword [0x424d7c]
mov eax, dword [edx + 0xc]
mov ecx, 0x424d7c
mov byte [ebp - 4], 5
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0xc48], esi
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 6
push 0
test ecx, 0xffff0000
jne 0x40c465
mov edx, ecx
movzx edi, dx
push edi
call fcn.00408d20
add esp, 8
test eax, eax
je 0x40c522
push edi
push eax
lea ecx, [ebp - 0xc48]
call fcn.0040a5a0
mov esi, dword [ebp - 0xc48]
jmp 0x40c522
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x21c]
push eax
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea edi, [eax - 1]
test edi, edi
jle 0x40c4cd
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x40c4a4
push edi
lea ecx, [ebp - 0xc48]
call fcn.00409420
mov esi, dword [ebp - 0xc48]
push edi
push esi
push 0xffffffffffffffff
lea ecx, [ebp - 0x21c]
push ecx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp edi, dword [esi - 8]
jg 0x40bebf
xor edx, edx
mov dword [esi - 0xc], edi
mov word [esi + edi*2], dx
jmp 0x40c522
cmp dword [esi - 0xc], 0
mov edi, dword [esi - 0x10]
lea eax, [esi - 0x10]
je 0x40c522
cmp dword [eax + 0xc], 0
lea ecx, [eax + 0xc]
jge 0x40c500
cmp dword [esi - 8], 0
jge 0x40c4f2
push 0x80070057
call fcn.00401270
xor eax, eax
mov dword [esi - 0xc], 0
mov word [esi], ax
jmp 0x40c522
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c516
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [edi]
mov eax, dword [edx + 0xc]
mov ecx, edi
call eax
lea esi, [eax + 0x10]
push 1
push ebx
push esi
mov byte [ebp - 4], 5
call dword [sym.imp.KERNEL32.dll_CopyFileW]
add esi, 0xfffffff0
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c54c
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
add ebx, 0xfffffff0
mov byte [ebp - 4], 0
lea eax, [ebx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40c56c
mov ecx, dword [ebx]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push ebx
call eax
lea ecx, [ebp - 0xa3c]
lea edx, [ebp - 0x320]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40c578
lea edi, [ebp - 0x320]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40c590
mov ecx, 6
mov esi, str.CONEXANTSA3HP_NB_AIO_
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x320]
lea edx, [ebp - 0x118]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40c5b1
lea eax, [ebp - 0x938]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c5c3
lea edi, [ebp - 0x118]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40c5d3
mov ecx, eax
shr ecx, 2
mov esi, edx
mov edx, dword [0x424d7c]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [edx + 0xc]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x424d7c
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0xc48], esi
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 7
push 0
test ecx, 0xffff0000
jne 0x40c771
mov edx, ecx
movzx edi, dx
push edi
call fcn.00408d20
add esp, 8
test eax, eax
je 0x40c641
push edi
push eax
lea ecx, [ebp - 0xc48]
call fcn.0040a5a0
mov esi, dword [ebp - 0xc48]
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push esi
mov byte [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esi, 0xfffffff0
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c66e
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
mov dword [ebp - 0xc60], 1
lea ecx, [ebp - 0x62c]
lea edx, [ebp - 0x21c]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40c684
lea eax, [ebp - 0x834]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c696
lea edi, [ebp - 0x21c]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40c6a6
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x320]
lea edx, [ebp - 0x118]
lea ebx, [ebx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40c6d0
lea eax, [ebp - 0x834]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c6e2
lea edi, [ebp - 0x118]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40c6f2
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [0x424d7c]
mov edx, dword [eax + 0xc]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x424d7c
call edx
lea esi, [eax + 0x10]
mov dword [ebp - 0xc48], esi
lea eax, [ebp - 0x118]
shr eax, 0x10
mov byte [ebp - 4], 8
mov dword [ebp - 0xc58], eax
push 0
test eax, eax
jne 0x40c83b
lea eax, [ebp - 0x118]
movzx edi, ax
push edi
call fcn.00408d20
add esp, 8
test eax, eax
je 0x40c8f0
push edi
push eax
lea ecx, [ebp - 0xc48]
call fcn.0040a5a0
mov esi, dword [ebp - 0xc48]
jmp 0x40c8f0
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x118]
push eax
push 0
push 3
call ebx
lea edi, [eax - 1]
test edi, edi
jle 0x40c7da
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x40c7b2
push edi
lea ecx, [ebp - 0xc48]
call fcn.00409420
mov esi, dword [ebp - 0xc48]
push edi
push esi
push 0xffffffffffffffff
lea ecx, [ebp - 0x118]
push ecx
push 0
push 3
call ebx
cmp edi, dword [esi - 8]
jg 0x40bebf
xor edx, edx
mov dword [esi - 0xc], edi
mov word [esi + edi*2], dx
jmp 0x40c647
cmp dword [esi - 0xc], 0
mov edi, dword [esi - 0x10]
lea eax, [esi - 0x10]
je 0x40c647
cmp dword [eax + 0xc], 0
lea ecx, [eax + 0xc]
jge 0x40c814
cmp dword [esi - 8], 0
jge 0x40c803
push 0x80070057
call fcn.00401270
xor eax, eax
mov dword [esi - 0xc], 0
mov word [esi], ax
jmp 0x40c647
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c82a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [edi]
mov eax, dword [edx + 0xc]
mov ecx, edi
call eax
lea esi, [eax + 0x10]
jmp 0x40c647
push 0
push 0xffffffffffffffff
lea ecx, [ebp - 0x118]
push ecx
push 0
push 3
call ebx
lea edi, [eax - 1]
test edi, edi
jle 0x40c89b
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x40c876
push edi
lea ecx, [ebp - 0xc48]
call fcn.00409420
mov esi, dword [ebp - 0xc48]
push edi
push esi
push 0xffffffffffffffff
lea edx, [ebp - 0x118]
push edx
push 0
push 3
call ebx
cmp edi, dword [esi - 8]
jg 0x40bebf
xor eax, eax
mov dword [esi - 0xc], edi
mov word [esi + edi*2], ax
jmp 0x40c8f0
cmp dword [esi - 0xc], 0
mov edi, dword [esi - 0x10]
lea eax, [esi - 0x10]
je 0x40c8f0
cmp dword [eax + 0xc], 0
lea ecx, [eax + 0xc]
jge 0x40c8ce
cmp dword [esi - 8], 0
jge 0x40c8c0
push 0x80070057
call fcn.00401270
xor ecx, ecx
mov dword [esi - 0xc], 0
mov word [esi], cx
jmp 0x40c8f0
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c8e4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [edi]
mov eax, dword [edx + 0xc]
mov ecx, edi
call eax
lea esi, [eax + 0x10]
push esi
mov byte [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esi, 0xfffffff0
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c917
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
mov eax, dword [0x424d7c]
mov edx, dword [eax + 0xc]
mov ecx, 0x424d7c
call edx
lea ebx, [eax + 0x10]
mov dword [ebp - 0xc4c], ebx
cmp dword [ebp - 0xc58], 0
mov byte [ebp - 4], 9
push 0
jne 0x40c970
lea eax, [ebp - 0x118]
movzx esi, ax
push esi
call fcn.00408d20
add esp, 8
test eax, eax
je 0x40ca31
push esi
push eax
lea ecx, [ebp - 0xc4c]
call fcn.0040a5a0
mov ebx, dword [ebp - 0xc4c]
jmp 0x40ca31
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0xffffffffffffffff
lea ecx, [ebp - 0x118]
push ecx
push 0
push 3
call edi
lea esi, [eax - 1]
test esi, esi
jle 0x40c9d6
mov eax, dword [ebx - 8]
mov ecx, 1
sub ecx, dword [ebx - 4]
sub eax, esi
or eax, ecx
jge 0x40c9b1
push esi
lea ecx, [ebp - 0xc4c]
call fcn.00409420
mov ebx, dword [ebp - 0xc4c]
push esi
push ebx
push 0xffffffffffffffff
lea edx, [ebp - 0x118]
push edx
push 0
push 3
call edi
cmp esi, dword [ebx - 8]
jg 0x40bebf
xor eax, eax
mov dword [ebx - 0xc], esi
mov word [ebx + esi*2], ax
jmp 0x40ca31
cmp dword [ebx - 0xc], 0
mov esi, dword [ebx - 0x10]
lea eax, [ebx - 0x10]
je 0x40ca31
cmp dword [eax + 0xc], 0
lea ecx, [eax + 0xc]
jge 0x40ca09
cmp dword [ebx - 8], 0
jge 0x40c9fb
push 0x80070057
call fcn.00401270
xor ecx, ecx
mov dword [ebx - 0xc], 0
mov word [ebx], cx
jmp 0x40ca31
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ca1f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0xc]
mov ecx, esi
call eax
lea ebx, [eax + 0x10]
mov dword [ebp - 0xc4c], ebx
mov edx, dword [0x424d7c]
mov eax, dword [edx + 0xc]
mov ecx, 0x424d7c
mov byte [ebp - 4], 0xa
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0xc48], esi
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 0xb
push 0
test ecx, 0xffff0000
jne 0x40ca90
mov edx, ecx
movzx edi, dx
push edi
call fcn.00408d20
add esp, 8
test eax, eax
je 0x40cb4d
push edi
push eax
lea ecx, [ebp - 0xc48]
call fcn.0040a5a0
mov esi, dword [ebp - 0xc48]
jmp 0x40cb4d
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x21c]
push eax
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea edi, [eax - 1]
test edi, edi
jle 0x40caf8
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x40cacf
push edi
lea ecx, [ebp - 0xc48]
call fcn.00409420
mov esi, dword [ebp - 0xc48]
push edi
push esi
push 0xffffffffffffffff
lea ecx, [ebp - 0x21c]
push ecx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp edi, dword [esi - 8]
jg 0x40bebf
xor edx, edx
mov dword [esi - 0xc], edi
mov word [esi + edi*2], dx
jmp 0x40cb4d
cmp dword [esi - 0xc], 0
mov edi, dword [esi - 0x10]
lea eax, [esi - 0x10]
je 0x40cb4d
cmp dword [eax + 0xc], 0
lea ecx, [eax + 0xc]
jge 0x40cb2b
cmp dword [esi - 8], 0
jge 0x40cb1d
push 0x80070057
call fcn.00401270
xor eax, eax
mov dword [esi - 0xc], 0
mov word [esi], ax
jmp 0x40cb4d
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40cb41
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [edi]
mov eax, dword [edx + 0xc]
mov ecx, edi
call eax
lea esi, [eax + 0x10]
push 1
push ebx
push esi
mov byte [ebp - 4], 0xa
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
sete byte [ebp - 0xc51]
add esi, 0xfffffff0
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40cb80
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
add ebx, 0xfffffff0
mov byte [ebp - 4], 0
lea eax, [ebx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40cba0
mov ecx, dword [ebx]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push ebx
call eax
cmp byte [ebp - 0xc51], 0
je 0x40cbb3
mov dword [ebp - 0xc60], 0
mov dword [ebp - 0xc68], 1
lea ecx, [ebp - 0x62c]
lea edx, [ebp - 0x21c]
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40cbd0
lea eax, [ebp - 0xe70]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40cbe2
lea edi, [ebp - 0x21c]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40cbf2
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x320]
lea edx, [ebp - 0x118]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40cc16
lea eax, [ebp - 0x118]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x40cc27
mov ecx, dword [str.SADefaultIcon.ico]
mov edx, dword [0x41e12c]
mov dword [eax], ecx
mov ecx, dword [0x41e130]
mov dword [eax + 4], edx
mov edx, dword [0x41e134]
mov dword [eax + 8], ecx
mov cx, word [0x41e138]
mov dword [eax + 0xc], edx
mov edx, dword [0x424d7c]
mov word [eax + 0x10], cx
mov eax, dword [edx + 0xc]
mov ecx, 0x424d7c
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0xc48], esi
lea eax, [ebp - 0x118]
shr eax, 0x10
mov byte [ebp - 4], 0xc
mov dword [ebp - 0xc58], eax
push 0
test eax, eax
jne 0x40ccc1
lea ecx, [ebp - 0x118]
movzx edi, cx
push edi
call fcn.00408d20
add esp, 8
test eax, eax
je 0x40cd7c
push edi
push eax
lea ecx, [ebp - 0xc48]
call fcn.0040a5a0
mov esi, dword [ebp - 0xc48]
jmp 0x40cd7c
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0xffffffffffffffff
lea edx, [ebp - 0x118]
push edx
push 0
push 3
call ebx
lea edi, [eax - 1]
test edi, edi
jle 0x40cd27
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x40cd02
push edi
lea ecx, [ebp - 0xc48]
call fcn.00409420
mov esi, dword [ebp - 0xc48]
push edi
push esi
push 0xffffffffffffffff
lea eax, [ebp - 0x118]
push eax
push 0
push 3
call ebx
cmp edi, dword [esi - 8]
jg 0x40bebf
xor ecx, ecx
mov dword [esi - 0xc], edi
mov word [esi + edi*2], cx
jmp 0x40cd7c
cmp dword [esi - 0xc], 0
mov edi, dword [esi - 0x10]
lea eax, [esi - 0x10]
je 0x40cd7c
cmp dword [eax + 0xc], 0
lea ecx, [eax + 0xc]
jge 0x40cd5a
cmp dword [esi - 8], 0
jge 0x40cd4c
push 0x80070057
call fcn.00401270
xor edx, edx
mov dword [esi - 0xc], 0
mov word [esi], dx
jmp 0x40cd7c
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40cd70
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [edi]
mov eax, dword [edx + 0xc]
mov ecx, edi
call eax
lea esi, [eax + 0x10]
push esi
mov byte [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esi, 0xfffffff0
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40cda3
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
mov eax, dword [0x424d7c]
mov edx, dword [eax + 0xc]
mov ecx, 0x424d7c
call edx
lea ebx, [eax + 0x10]
mov dword [ebp - 0xc4c], ebx
cmp dword [ebp - 0xc58], 0
mov byte [ebp - 4], 0xd
push 0
jne 0x40cdfc
lea eax, [ebp - 0x118]
movzx esi, ax
push esi
call fcn.00408d20
add esp, 8
test eax, eax
je 0x40cebd
push esi
push eax
lea ecx, [ebp - 0xc4c]
call fcn.0040a5a0
mov ebx, dword [ebp - 0xc4c]
jmp 0x40cebd
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0xffffffffffffffff
lea ecx, [ebp - 0x118]
push ecx
push 0
push 3
call edi
lea esi, [eax - 1]
test esi, esi
jle 0x40ce62
mov eax, dword [ebx - 8]
mov ecx, 1
sub ecx, dword [ebx - 4]
sub eax, esi
or eax, ecx
jge 0x40ce3d
push esi
lea ecx, [ebp - 0xc4c]
call fcn.00409420
mov ebx, dword [ebp - 0xc4c]
push esi
push ebx
push 0xffffffffffffffff
lea edx, [ebp - 0x118]
push edx
push 0
push 3
call edi
cmp esi, dword [ebx - 8]
jg 0x40bebf
xor eax, eax
mov dword [ebx - 0xc], esi
mov word [ebx + esi*2], ax
jmp 0x40cebd
cmp dword [ebx - 0xc], 0
mov esi, dword [ebx - 0x10]
lea eax, [ebx - 0x10]
je 0x40cebd
cmp dword [eax + 0xc], 0
lea ecx, [eax + 0xc]
jge 0x40ce95
cmp dword [ebx - 8], 0
jge 0x40ce87
push 0x80070057
call fcn.00401270
xor ecx, ecx
mov dword [ebx - 0xc], 0
mov word [ebx], cx
jmp 0x40cebd
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ceab
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0xc]
mov ecx, esi
call eax
lea ebx, [eax + 0x10]
mov dword [ebp - 0xc4c], ebx
mov edx, dword [0x424d7c]
mov eax, dword [edx + 0xc]
mov ecx, 0x424d7c
mov byte [ebp - 4], 0xe
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0xc48], esi
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 0xf
push 0
test ecx, 0xffff0000
jne 0x40cf1c
mov edx, ecx
movzx edi, dx
push edi
call fcn.00408d20
add esp, 8
test eax, eax
je 0x40cfd9
push edi
push eax
lea ecx, [ebp - 0xc48]
call fcn.0040a5a0
mov esi, dword [ebp - 0xc48]
jmp 0x40cfd9
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x21c]
push eax
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea edi, [eax - 1]
test edi, edi
jle 0x40cf84
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x40cf5b
push edi
lea ecx, [ebp - 0xc48]
call fcn.00409420
mov esi, dword [ebp - 0xc48]
push edi
push esi
push 0xffffffffffffffff
lea ecx, [ebp - 0x21c]
push ecx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp edi, dword [esi - 8]
jg 0x40bebf
xor edx, edx
mov dword [esi - 0xc], edi
mov word [esi + edi*2], dx
jmp 0x40cfd9
cmp dword [esi - 0xc], 0
mov edi, dword [esi - 0x10]
lea eax, [esi - 0x10]
je 0x40cfd9
cmp dword [eax + 0xc], 0
lea ecx, [eax + 0xc]
jge 0x40cfb7
cmp dword [esi - 8], 0
jge 0x40cfa9
push 0x80070057
call fcn.00401270
xor eax, eax
mov dword [esi - 0xc], 0
mov word [esi], ax
jmp 0x40cfd9
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40cfcd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [edi]
mov eax, dword [edx + 0xc]
mov ecx, edi
call eax
lea esi, [eax + 0x10]
push 1
push ebx
push esi
mov byte [ebp - 4], 0xe
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
sete byte [ebp - 0xc51]
add esi, 0xfffffff0
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40d00c
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
add ebx, 0xfffffff0
mov byte [ebp - 4], 0
lea eax, [ebx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40d02c
mov ecx, dword [ebx]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push ebx
call eax
cmp byte [ebp - 0xc51], 0
je 0x40d039
xor eax, eax
jmp 0x40d03f
mov eax, dword [ebp - 0xc68]
cmp dword [ebp - 0xc60], 1
jne 0x40d09f
cmp eax, 1
jne 0x40d09f
push 0
lea ecx, [ebp - 0xc50]
push ecx
push 0
push 0x20106
push 0
push 0
push 0
push str.SoftwareConexant
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40d09f
push 4
lea edx, [ebp + 0xc]
push edx
push 4
push eax
mov eax, dword [ebp - 0xc50]
push str.SetCOMMBranding
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0xc50]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00408fb0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040d820
mov esp, ebp
pop ebp
ret 0x10