Function at 0x41b4f0
Capabilities:
Persist via default file association registry key
Persist via filter handlers registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46c50e
mov eax, dword fs:[0]
push eax
sub esp, 0x484
mov eax, dword [0x496d50]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x47c], edi
mov dword [ebp - 0x428], 7
mov dword [ebp - 0x42c], ebx
mov word [ebp - 0x43c], ax
lea ecx, [ebp - 0x478]
push ecx
push 0x20019
push ebx
push 0x478d98
push 0x80000002
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edx, dword [ebp - 0x478]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x41b5de
push 1
push 0x473064
mov esi, 0x478dc4
mov ecx, 0x478d98
call fcn.00419a40
push 0x478dd8
push edi
call fcn.00414730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 0x10
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x41b5bf
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x41b5bf
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x41b5de
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x41b5d7
or eax, 4
push ebx
push eax
call fcn.00402d10
push 1
push 0x473064
mov esi, 0x478e60
mov ecx, 0x478eb0
call fcn.00419a40
push 1
push 0x478f34
mov esi, 0x478f00
mov ecx, 0x478d98
call fcn.00419a40
add esp, 0x10
mov ecx, 0x473064
mov ebx, 0x478d98
mov edx, 0x80000002
lea esi, [ebp - 0x458]
call fcn.00419920
push eax
lea ecx, [ebp - 0x43c]
mov byte [ebp - 4], 1
call fcn.00401560
xor ebx, ebx
mov byte [ebp - 4], bl
cmp dword [ebp - 0x444], 8
jb 0x41b654
mov edx, dword [ebp - 0x458]
push edx
call fcn.0044e60d
add esp, 4
push 1
push 0x478d98
mov edi, 0x478dc4
mov esi, 0x473064
call fcn.004197e0
add esp, 8
test eax, eax
je 0x41b749
push 0x478f50
push ecx
lea eax, [ebp - 0x43c]
push eax
push ecx
mov ecx, dword [ebp - 0x47c]
push 0x478f58
push ecx
call fcn.00414730
add esp, 0xc
push eax
call fcn.004149f0
add esp, 0xc
push eax
call fcn.00415080
mov esi, eax
mov edx, dword [esi]
mov eax, dword [edx + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x41b6d0
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x41b6d0
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x41b6ef
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x41b6e8
or eax, 4
push ebx
push eax
call fcn.00402d10
mov edx, dword [ebp - 0x47c]
push 0x478fc8
push edx
call fcn.00414730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x41b72a
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x41b72a
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x41b749
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x41b742
or eax, 4
push ebx
push eax
call fcn.00402d10
mov edx, 0x479044
lea ecx, [ebp - 0x420]
call fcn.00419630
lea edx, [ebp - 0x420]
push edx
push 0x80000002
call fcn.00419680
add esp, 8
test eax, eax
je 0x41b7cb
mov eax, dword [ebp - 0x47c]
push 0x479080
push eax
call fcn.00414730
mov esi, eax
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x41b7ac
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x41b7ac
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x41b7cb
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x41b7c4
or eax, 4
push ebx
push eax
call fcn.00402d10
mov edx, 0x4790f8
lea ecx, [ebp - 0x420]
call fcn.00419630
lea edx, [ebp - 0x420]
push edx
push 0x80000002
call fcn.00419680
add esp, 8
test eax, eax
je 0x41b84d
mov eax, dword [ebp - 0x47c]
push 0x479140
push eax
call fcn.00414730
mov esi, eax
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x41b82e
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x41b82e
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x41b84d
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x41b846
or eax, 4
push ebx
push eax
call fcn.00402d10
lea edx, [ebp - 0x478]
push edx
push 0x20019
push ebx
push 0x4791c4
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov eax, dword [ebp - 0x478]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x41b924
push 1
push 0x473064
mov esi, 0x4791f8
mov ecx, 0x479208
call fcn.00419a40
push 1
push 0x479768
mov ecx, 0x479208
call fcn.00419a40
push 1
push 0x473064
mov ecx, 0x479260
call fcn.00419a40
push 1
push 0x479768
mov ecx, 0x479260
call fcn.00419a40
mov ecx, dword [ebp - 0x47c]
push 0x4792c0
push ecx
call fcn.00414730
mov esi, eax
mov edx, dword [esi]
mov eax, dword [edx + 4]
add esp, 0x28
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x41b905
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x41b905
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x41b924
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x41b91d
or eax, 4
push ebx
push eax
call fcn.00402d10
push 1
push 0x473064
mov esi, 0x479350
mov ecx, 0x4791c4
call fcn.00419a40
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
add esp, 8
push ebx
lea edx, [ebp - 0x478]
push edx
push ebx
push 0xf013f
push ebx
push ebx
push ebx
push 0x4791c4
push 0x80000002
mov dword [ebp - 0x488], 0x738
mov dword [ebp - 0x490], ebx
call esi
cmp eax, ebx
jne 0x41b9a5
mov ecx, dword [ebp - 0x478]
push 4
lea eax, [ebp - 0x488]
push eax
push 3
push ebx
push 0x479368
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x41b9b4
mov edx, dword [ebp - 0x478]
push edx
jmp 0x41b9b2
mov eax, dword [ebp - 0x478]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call edi
push ebx
lea ecx, [ebp - 0x478]
push ecx
push ebx
push 0xf013f
push ebx
push ebx
push ebx
push 0x479380
push 0x80000002
call esi
cmp eax, ebx
jne 0x41ba00
mov eax, dword [ebp - 0x478]
push 4
lea edx, [ebp - 0x490]
push edx
push 3
push ebx
push 0x479368
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x41ba09
mov ecx, dword [ebp - 0x478]
push ecx
jmp 0x41ba07
mov edx, dword [ebp - 0x478]
push edx
call edi
push 1
push 0x473064
mov esi, 0x4793c8
mov ecx, 0x4793d0
call fcn.00419a40
push 2
push 0x47aaf4
mov esi, 0x47aaa0
mov ecx, 0x4791c4
call fcn.00419a40
push 1
push 0x473064
mov esi, 0x479508
mov ecx, 0x479558
call fcn.00419a40
push 1
push 0x473064
mov esi, 0x479678
mov ecx, 0x4796c8
call fcn.00419a40
push 1
push 0x479208
mov edi, 0x4791f8
mov esi, 0x473064
call fcn.004197e0
add esp, 0x28
test eax, eax
je 0x41bad8
mov eax, dword [ebp - 0x47c]
push 0x479788
push eax
call fcn.00414730
mov esi, eax
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x41bab9
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x41bab9
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x41bad8
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x41bad1
or eax, 4
push ebx
push eax
call fcn.00402d10
push 1
push 0x479208
mov edi, 0x4791f8
mov esi, 0x479768
call fcn.004197e0
add esp, 8
test eax, eax
je 0x41bb4f
mov edx, dword [ebp - 0x47c]
push 0x47ab18
push edx
call fcn.00414730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x41bb30
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x41bb30
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x41bb4f
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x41bb48
or eax, 4
push ebx
push eax
call fcn.00402d10
push 1
push 0x479260
mov edi, 0x4791f8
mov esi, 0x473064
call fcn.004197e0
add esp, 8
test eax, eax
je 0x41bbc6
mov edx, dword [ebp - 0x47c]
push 0x479850
push edx
call fcn.00414730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x41bba7
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x41bba7
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x41bbc6
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x41bbbf
or eax, 4
push ebx
push eax
call fcn.00402d10
push 1
push 0x479260
mov edi, 0x4791f8
mov esi, 0x479768
call fcn.004197e0
add esp, 8
test eax, eax
je 0x41bc3d
mov edx, dword [ebp - 0x47c]
push 0x47abf8
push edx
call fcn.00414730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x41bc1e
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x41bc1e
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x41bc3d
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x41bc36
or eax, 4
push ebx
push eax
call fcn.00402d10
lea edx, [ebp - 0x478]
push edx
push 0x20019
push ebx
push 0x479918
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov eax, dword [ebp - 0x478]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
jne 0x41bee4
cmp dword [ebp - 0x428], 8
mov eax, dword [ebp - 0x43c]
mov dword [ebp - 0x42c], ebx
jae 0x41bc8c
lea eax, [ebp - 0x43c]
xor ecx, ecx
mov word [eax], cx
mov ecx, 0x473064
mov ebx, 0x479918
mov edx, 0x80000001
lea esi, [ebp - 0x474]
call fcn.00419920
push eax
lea ecx, [ebp - 0x43c]
mov byte [ebp - 4], 2
call fcn.00401560
mov byte [ebp - 4], 0
cmp dword [ebp - 0x460], 8
jb 0x41bcd7
mov edx, dword [ebp - 0x474]
push edx
call fcn.0044e60d
add esp, 4
mov ebx, dword [ebp - 0x47c]
push 0x478f50
push ecx
lea eax, [ebp - 0x43c]
push eax
push ecx
push 0x479948
push ebx
call fcn.00414730
add esp, 0xc
push eax
call fcn.004149f0
add esp, 0xc
push eax
call fcn.00415080
mov esi, eax
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x41bd32
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x41bd32
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0x41bd53
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], 0
jne 0x41bd4b
or eax, 4
push 0
push eax
call fcn.00402d10
mov edx, 0x479918
lea ecx, [ebp - 0x420]
call fcn.00419630
lea edx, [ebp - 0x420]
push edx
push 0x80000001
call fcn.00419680
add esp, 8
test eax, eax
je 0x41bdd1
push 0x4799c0
push ebx
call fcn.00414730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x41bdb0
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x41bdb0
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0x41bdd1
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], 0
jne 0x41bdc9
or eax, 4
push 0
push eax
call fcn.00402d10
push 0x11
xor edx, edx
push 0x479a28
lea ecx, [ebp - 0x458]
mov dword [ebp - 0x444], 7
mov dword [ebp - 0x448], 0
mov word [ebp - 0x458], dx
call fcn.00401740
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x43c]
push eax
lea ecx, [ebp - 0x458]
mov byte [ebp - 4], 3
call fcn.00411f30
cmp dword [ebp - 0x444], 8
mov edx, dword [ebp - 0x458]
jae 0x41be2f
lea edx, [ebp - 0x458]
lea ecx, [ebp - 0x420]
call fcn.00419630
lea ecx, [ebp - 0x420]
push ecx
push 0x80000001
call fcn.00419680
add esp, 8
test eax, eax
je 0x41bec6
push 0x479a4c
push ecx
lea edx, [ebp - 0x43c]
push edx
push ecx
push 0x479a7c
push ebx
call fcn.00414730
add esp, 0xc
push eax
call fcn.004149f0
add esp, 0xc
push eax
call fcn.00414730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x41bea7
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x41bea7
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0x41bec6
or edi, dword [ecx + 0xc]
cmp dword [ecx + 0x38], 0
jne 0x41bebe
or edi, 4
push 0
push edi
call fcn.00402d10
mov byte [ebp - 4], 0
cmp dword [ebp - 0x444], 8
jb 0x41bee2
mov edx, dword [ebp - 0x458]
push edx
call fcn.0044e60d
add esp, 4
xor ebx, ebx
lea eax, [ebp - 0x478]
push eax
push 0x20019
push ebx
push 0x479ab4
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [ebp - 0x478]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x41bf84
push 1
push 0x473064
mov esi, 0x479ae0
mov ecx, 0x479ab4
call fcn.00419a40
mov edx, dword [ebp - 0x47c]
push 0x479af0
push edx
call fcn.00414730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 0x10
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x41bf65
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x41bf65
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x41bf84
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x41bf7d
or eax, 4
push ebx
push eax
call fcn.00402d10
cmp dword [ebp - 0x428], 8
mov eax, dword [ebp - 0x43c]
mov dword [ebp - 0x42c], ebx
jae 0x41bf9f
lea eax, [ebp - 0x43c]
xor edx, edx
mov word [eax], dx
mov ecx, 0x473064
mov ebx, 0x479ab4
mov edx, 0x80000002
lea esi, [ebp - 0x474]
call fcn.00419920
push eax
lea ecx, [ebp - 0x43c]
mov byte [ebp - 4], 4
call fcn.00401560
xor ebx, ebx
mov byte [ebp - 4], bl
cmp dword [ebp - 0x460], 8
jb 0x41bfeb
mov eax, dword [ebp - 0x474]
push eax
call fcn.0044e60d
add esp, 4
push 1
push 0x479ab4
mov edi, 0x479ae0
mov esi, 0x473064
call fcn.004197e0
add esp, 8
test eax, eax
je 0x41c0e0
mov edx, dword [ebp - 0x47c]
push 0x478f50
push ecx
lea ecx, [ebp - 0x43c]
push ecx
push ecx
push 0x479b78
push edx
call fcn.00414730
add esp, 0xc
push eax
call fcn.004149f0
add esp, 0xc
push eax
call fcn.00415080
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x41c067
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x41c067
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x41c086
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x41c07f
or eax, 4
push ebx
push eax
call fcn.00402d10
mov edx, dword [ebp - 0x47c]
push 0x479be0
push edx
call fcn.00414730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x41c0c1
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x41c0c1
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x41c0e0
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x41c0d9
or eax, 4
push ebx
push eax
call fcn.00402d10
push 1
push 0x473064
mov esi, 0x479c60
mov ecx, 0x479cb0
call fcn.00419a40
add esp, 8
lea edx, [ebp - 0x478]
push edx
push 0x20019
push ebx
push 0x479d04
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov eax, dword [ebp - 0x478]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x41c1df
push 2
push 0x473064
mov esi, 0x479d38
mov ecx, 0x479d88
call fcn.00419a40
push 1
push 0x473064
mov esi, 0x4791f8
mov ecx, 0x479de0
call fcn.00419a40
push 2
push 0x473064
mov esi, 0x479e38
mov ecx, 0x479e88
call fcn.00419a40
push 2
push 0x473064
mov esi, 0x47ace0
mov ecx, 0x47ad38
call fcn.00419a40
mov ecx, dword [ebp - 0x47c]
push 0x479af0
push ecx
call fcn.00414730
mov esi, eax
mov edx, dword [esi]
mov eax, dword [edx + 4]
add esp, 0x28
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x41c1c0
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x41c1c0
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x41c1df
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x41c1d8
or eax, 4
push ebx
push eax
call fcn.00402d10
push 1
push 0x473064
mov esi, 0x479ee4
mov ecx, 0x479d04
call fcn.00419a40
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
add esp, 8
push ebx
lea edx, [ebp - 0x478]
push edx
push ebx
push 0xf013f
push ebx
push ebx
push ebx
push 0x479d04
push 0x80000002
mov dword [ebp - 0x48c], 0x430
mov dword [ebp - 0x484], ebx
call esi
cmp eax, ebx
jne 0x41c260
mov ecx, dword [ebp - 0x478]
push 4
lea eax, [ebp - 0x48c]
push eax
push 3
push ebx
push 0x479368
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x41c26f
mov edx, dword [ebp - 0x478]
push edx
jmp 0x41c26d
mov eax, dword [ebp - 0x478]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call edi
push ebx
lea ecx, [ebp - 0x478]
push ecx
push ebx
push 0xf013f
push ebx
push ebx
push ebx
push 0x479f30
push 0x80000002
call esi
cmp eax, ebx
jne 0x41c2bb
mov eax, dword [ebp - 0x478]
push 4
lea edx, [ebp - 0x484]
push edx
push 3
push ebx
push 0x479368
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x41c2c4
mov ecx, dword [ebp - 0x478]
push ecx
jmp 0x41c2c2
mov edx, dword [ebp - 0x478]
push edx
call edi
push 2
push 0x479d88
mov edi, 0x479d38
mov esi, 0x473064
call fcn.004197e0
add esp, 8
test eax, eax
je 0x41c33b
mov eax, dword [ebp - 0x47c]
push 0x479f78
push eax
call fcn.00414730
mov esi, eax
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x41c31c
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x41c31c
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x41c33b
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x41c334
or eax, 4
push ebx
push eax
call fcn.00402d10
push 1
push 0x479de0
mov edi, 0x4791f8
mov esi, 0x473064
call fcn.004197e0
add esp, 8
test eax, eax
je 0x41c3b2
mov edx, dword [ebp - 0x47c]
push 0x47a028
push edx
call fcn.00414730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x41c393
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x41c393
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x41c3b2
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x41c3ab
or eax, 4
push ebx
push eax
call fcn.00402d10
push 2
push 0x479e88
mov edi, 0x479e38
mov esi, 0x473064
call fcn.004197e0
add esp, 8
test eax, eax
je 0x41c429
mov edx, dword [ebp - 0x47c]
push 0x47a0d8
push edx
call fcn.00414730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x41c40a
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x41c40a
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x41c429
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x41c422
or eax, 4
push ebx
push eax
call fcn.00402d10
push 2
push 0x47ad38
mov edi, 0x47ace0
mov esi, 0x473064
call fcn.004197e0
add esp, 8
test eax, eax
je 0x41c4a0
mov edx, dword [ebp - 0x47c]
push 0x47a0d8
push edx
call fcn.00414730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x41c481
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x41c481
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x41c4a0
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x41c499
or eax, 4
push ebx
push eax
call fcn.00402d10
push 1
push 0x473064
mov esi, 0x473064
mov ecx, 0x47ad98
call fcn.00419a40
push 2
push 0x47aaf4
mov esi, 0x47ade8
mov ecx, 0x479d04
call fcn.00419a40
push 2
push 0x473064
mov esi, 0x47ae40
mov ecx, 0x47a1d8
call fcn.00419a40
push 1
push 0x473064
mov esi, 0x479508
mov ecx, 0x47a228
call fcn.00419a40
push 1
push 0x473064
mov esi, 0x479678
mov ecx, 0x47a288
call fcn.00419a40
add esp, 0x28
lea edx, [ebp - 0x478]
push edx
push 0x20019
push ebx
push 0x47a328
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov eax, dword [ebp - 0x478]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
jne 0x41c7ba
cmp dword [ebp - 0x428], 8
mov eax, dword [ebp - 0x43c]
mov dword [ebp - 0x42c], ebx
jae 0x41c560
lea eax, [ebp - 0x43c]
xor ecx, ecx
mov word [eax], cx
mov ecx, 0x473064
mov ebx, 0x47a328
mov edx, 0x80000001
lea esi, [ebp - 0x474]
call fcn.00419920
push eax
lea ecx, [ebp - 0x43c]
mov byte [ebp - 4], 5
call fcn.00401560
mov byte [ebp - 4], 0
cmp dword [ebp - 0x460], 8
jb 0x41c5ab
mov edx, dword [ebp - 0x474]
push edx
call fcn.0044e60d
add esp, 4
mov ebx, dword [ebp - 0x47c]
push 0x478f50
push ecx
lea eax, [ebp - 0x43c]
push eax
push ecx
push 0x47a358
push ebx
call fcn.00414730
add esp, 0xc
push eax
call fcn.004149f0
add esp, 0xc
push eax
call fcn.00415080
mov esi, eax
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x41c606
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x41c606
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0x41c627
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], 0
jne 0x41c61f
or eax, 4
push 0
push eax
call fcn.00402d10
mov edx, 0x47a328
lea ecx, [ebp - 0x420]
call fcn.00419630
lea edx, [ebp - 0x420]
push edx
push 0x80000001
call fcn.00419680
add esp, 8
test eax, eax
je 0x41c6a5
push 0x47a3d0
push ebx
call fcn.00414730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x41c684
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x41c684
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0x41c6a5
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], 0
jne 0x41c69d
or eax, 4
push 0
push eax
call fcn.00402d10
push 0x11
xor edx, edx
push 0x479a28
lea ecx, [ebp - 0x458]
mov dword [ebp - 0x444], 7
mov dword [ebp - 0x448], 0
mov word [ebp - 0x458], dx
call fcn.00401740
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x43c]
push eax
lea ecx, [ebp - 0x458]
mov byte [ebp - 4], 6
call fcn.00411f30
cmp dword [ebp - 0x444], 8
mov edx, dword [ebp - 0x458]
jae 0x41c703
lea edx, [ebp - 0x458]
lea ecx, [ebp - 0x420]
call fcn.00419630
lea ecx, [ebp - 0x420]
push ecx
push 0x80000001
call fcn.00419680
add esp, 8
test eax, eax
je 0x41c79c
push 0x479a4c
push ecx
lea edx, [ebp - 0x43c]
push edx
push ecx
push 0x479a7c
push ebx
call fcn.00414730
add esp, 0xc
push eax
call fcn.004149f0
add esp, 0xc
push eax
call fcn.00414730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x41c77b
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x41c77b
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0x41c79c
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], 0
jne 0x41c794
or eax, 4
push 0
push eax
call fcn.00402d10
mov byte [ebp - 4], 0
cmp dword [ebp - 0x444], 8
jb 0x41c7b8
mov edx, dword [ebp - 0x458]
push edx
call fcn.0044e60d
add esp, 4
xor ebx, ebx
lea eax, [ebp - 0x478]
push eax
push 0x20019
push ebx
push 0x47a438
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [ebp - 0x478]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x41c85a
push 1
push 0x473064
mov esi, 0x47a464
mov ecx, 0x47a438
call fcn.00419a40
mov edx, dword [ebp - 0x47c]
push 0x47a478
push edx
call fcn.00414730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 0x10
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x41c83b
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x41c83b
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x41c85a
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x41c853
or eax, 4
push ebx
push eax
call fcn.00402d10
cmp dword [ebp - 0x428], 8
mov eax, dword [ebp - 0x43c]
mov dword [ebp - 0x42c], ebx
jae 0x41c875
lea eax, [ebp - 0x43c]
xor edx, edx
mov word [eax], dx
mov ecx, 0x473064
mov ebx, 0x47a438
mov edx, 0x80000002
lea esi, [ebp - 0x474]
call fcn.00419920
push eax
lea ecx, [ebp - 0x43c]
mov byte [ebp - 4], 7
call fcn.00401560
mov byte [ebp - 4], 0
cmp dword [ebp - 0x460], 8
jb 0x41c8c0
mov eax, dword [ebp - 0x474]
push eax
call fcn.0044e60d
add esp, 4
push 1
push 0x47a438
mov edi, 0x47a464
mov esi, 0x473064
call fcn.004197e0
add esp, 8
test eax, eax
je 0x41c9b3
mov ebx, dword [ebp - 0x47c]
push 0x478f50
push ecx
lea ecx, [ebp - 0x43c]
push ecx
push ecx
push 0x47a500
push ebx
call fcn.00414730
add esp, 0xc
push eax
call fcn.004149f0
add esp, 0xc
push eax
call fcn.00415080
mov esi, eax
mov edx, dword [esi]
mov eax, dword [edx + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x41c93c
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x41c93c
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0x41c95d
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], 0
jne 0x41c955
or eax, 4
push 0
push eax
call fcn.00402d10
push 0x47ae90
push ebx
call fcn.00414730
mov esi, eax
mov edx, dword [esi]
mov eax, dword [edx + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x41c992
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x41c992
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0x41c9b3
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], 0
jne 0x41c9ab
or eax, 4
push 0
push eax
call fcn.00402d10
push 1
push 0x473064
mov esi, 0x478e60
mov ecx, 0x47a5e8
call fcn.00419a40
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
add esp, 8
lea edx, [ebp - 0x478]
push edx
push 0x20019
push 0
push 0x47a63c
push 0x80000002
call ebx
mov esi, eax
mov eax, dword [ebp - 0x478]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x41ca2f
push 1
push 0x473064
mov esi, 0x4791f8
mov ecx, 0x47a670
call fcn.00419a40
mov ecx, dword [ebp - 0x47c]
push 0x47a6c8
push ecx
call fcn.00414730
push eax
call fcn.00403070
add esp, 0x14
push 1
push 0x473064
mov esi, 0x47a758
mov ecx, 0x47a63c
call fcn.00419a40
lea edx, [ebp - 0x480]
push edx
mov ecx, 0x47a63c
mov dword [ebp - 0x480], 0x30
call fcn.00419b30
add esp, 0xc
push 2
push 0x47aaf4
mov esi, 0x47af10
mov ecx, 0x47a63c
call fcn.00419a40
push 0x479368
mov ecx, 0x47a780
mov edx, 0x80000002
call fcn.00419ac0
add esp, 0xc
push 2
push 0x473064
mov esi, 0x47a7c8
mov ecx, 0x47a810
call fcn.00419a40
push 1
push 0x473064
mov esi, 0x479508
mov ecx, 0x47a860
call fcn.00419a40
push 1
push 0x47a670
mov edi, 0x4791f8
mov esi, 0x473064
call fcn.004197e0
add esp, 0x18
test eax, eax
je 0x41caf3
mov eax, dword [ebp - 0x47c]
push 0x47a8c0
push eax
call fcn.00414730
push eax
call fcn.00403070
add esp, 0xc
lea ecx, [ebp - 0x478]
push ecx
push 0x20019
push 0
push 0x47a990
push 0x80000001
call ebx
mov edx, dword [ebp - 0x478]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x41ccce
cmp dword [ebp - 0x428], 8
mov eax, dword [ebp - 0x43c]
mov dword [ebp - 0x42c], esi
jae 0x41cb3f
lea eax, [ebp - 0x43c]
xor ecx, ecx
mov word [eax], cx
mov ecx, 0x473064
mov ebx, 0x47a990
mov edx, 0x80000001
lea esi, [ebp - 0x474]
call fcn.00419920
mov ebx, 8
push eax
lea ecx, [ebp - 0x43c]
mov byte [ebp - 4], bl
call fcn.00401560
mov byte [ebp - 4], 0
cmp dword [ebp - 0x460], ebx
jb 0x41cb8d
mov edx, dword [ebp - 0x474]
push edx
call fcn.0044e60d
add esp, 4
mov esi, dword [ebp - 0x47c]
push 0x478f50
push ecx
lea eax, [ebp - 0x43c]
push eax
push ecx
push 0x47a9c0
push esi
call fcn.00414730
add esp, 0xc
push eax
call fcn.004149f0
add esp, 0xc
push eax
call fcn.00415080
push eax
call fcn.00403070
add esp, 0xc
mov edx, 0x47a990
lea ecx, [ebp - 0x420]
call fcn.00419630
lea ecx, [ebp - 0x420]
push ecx
push 0x80000001
call fcn.00419680
add esp, 8
test eax, eax
je 0x41cc03
push 0x47aa38
push esi
call fcn.00414730
push eax
call fcn.00403070
add esp, 0xc
push 0x11
xor edx, edx
push 0x479a28
lea ecx, [ebp - 0x458]
mov dword [ebp - 0x444], 7
mov dword [ebp - 0x448], 0
mov word [ebp - 0x458], dx
call fcn.00401740
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x43c]
push eax
lea ecx, [ebp - 0x458]
mov byte [ebp - 4], 9
call fcn.00411f30
mov edx, dword [ebp - 0x458]
cmp dword [ebp - 0x444], ebx
jae 0x41cc60
lea edx, [ebp - 0x458]
lea ecx, [ebp - 0x420]
call fcn.00419630
lea ecx, [ebp - 0x420]
push ecx
push 0x80000001
call fcn.00419680
add esp, 8
test eax, eax
je 0x41ccb7
push 0x479a4c
push ecx
lea edx, [ebp - 0x43c]
push edx
push ecx
push 0x479a7c
push esi
call fcn.00414730
add esp, 0xc
push eax
call fcn.004149f0
add esp, 0xc
push eax
call fcn.00414730
push eax
call fcn.00403070
add esp, 0xc
cmp dword [ebp - 0x444], ebx
jb 0x41ccce
mov eax, dword [ebp - 0x458]
push eax
call fcn.0044e60d
add esp, 4
cmp dword [ebp - 0x428], 8
jb 0x41cce6
mov ecx, dword [ebp - 0x43c]
push ecx
call fcn.0044e60d
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044e488
mov esp, ebp
pop ebp
ret