Function at 0x418310
Capabilities:
Check os version
Query or enumerate registry value
Set registry value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55eec4
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x2b00
call fcn.00498a00
mov eax, dword [0x5b0514]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x287c], edx
mov dword [ebp - 0x2880], ecx
mov dword [ebp - 0x284c], 0
xor eax, eax
mov dword [ebp - 4], 0
push str.ntdll.dll
mov dword [ebp - 0x2b0c], eax
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
push str.RtlGetNtVersionNumbers
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
test eax, eax
je 0x4183ec
lea ecx, [ebp - 0x2874]
push ecx
lea ecx, [ebp - 0x284c]
push ecx
lea ecx, [ebp - 0x2878]
push ecx
call eax
cmp dword [ebp - 0x2878], 0xa
jne 0x4183be
cmp dword [ebp - 0x284c], 0
je 0x4183ec
lea eax, [ebp - 0x2ae8]
mov dword [ebp - 0x2ae8], 0x114
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExW]
test eax, eax
je 0x4183ec
cmp dword [ebp - 0x2ae4], 5
jne 0x4183ec
mov esi, 1
jmp 0x41991b
push 0x47
xor eax, eax
mov dword [ebp - 0x2918], 0
push str.SoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsShellBagMRU
lea ecx, [ebp - 0x2928]
mov dword [ebp - 0x2914], 7
mov word [ebp - 0x2928], ax
call fcn.00410900
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2910]
push 0x45
xor eax, eax
mov dword [ebp - 0x2900], 0
push str.SoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsShellBags
mov dword [ebp - 0x28fc], 7
mov word [ebp - 0x2910], ax
call fcn.00410900
push 0x30
lea eax, [ebp - 0x2970]
mov byte [ebp - 4], 2
push 0
push eax
call fcn.005219d0
add esp, 0xc
lea ecx, [ebp - 0x2970]
call fcn.00410bf0
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x296c]
mov edi, dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, 0x80000001
je 0x4184e5
cmp byte [ebp - 0x294c], 0
je 0x4184a0
push eax
call esi
mov byte [ebp - 0x294c], 0
mov eax, dword [ebp - 0x2970]
mov dword [ebp - 0x296c], SysReAllocString
test eax, eax
je 0x4184e5
cmp byte [ebp - 0x2968], 0
jne 0x4184c6
push eax
call edi
mov eax, dword [ebp - 0x2970]
push eax
call esi
push 0
push 0x58bc94
lea ecx, [ebp - 0x2964]
mov dword [ebp - 0x2970], 0
call fcn.00410900
cmp dword [ebp - 0x2914], 8
lea eax, [ebp - 0x2928]
push 0
cmovae eax, dword [ebp - 0x2928]
lea ecx, [ebp - 0x2970]
push eax
call fcn.00410ed0
test al, al
jne 0x418512
xor esi, esi
jmp 0x419890
push 0x30
lea eax, [ebp - 0x29d0]
push 0
push eax
call fcn.005219d0
add esp, 0xc
lea ecx, [ebp - 0x29d0]
call fcn.00410bf0
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x29cc]
cmp eax, 0x80000001
je 0x418599
cmp byte [ebp - 0x29ac], 0
je 0x418554
push eax
call esi
mov byte [ebp - 0x29ac], 0
mov eax, dword [ebp - 0x29d0]
mov dword [ebp - 0x29cc], SysReAllocString
test eax, eax
je 0x418599
cmp byte [ebp - 0x29c8], 0
jne 0x41857a
push eax
call edi
mov eax, dword [ebp - 0x29d0]
push eax
call esi
push 0
push 0x58bc94
lea ecx, [ebp - 0x29c4]
mov dword [ebp - 0x29d0], 0
call fcn.00410900
cmp dword [ebp - 0x28fc], 8
lea eax, [ebp - 0x2910]
push 0
cmovae eax, dword [ebp - 0x2910]
lea ecx, [ebp - 0x29d0]
push eax
call fcn.00410ed0
test al, al
jne 0x4185c6
xor esi, esi
jmp 0x419885
mov dword [ebp - 0x2aec], 0
mov esi, 0x14
nop word [eax + eax]
push esi
lea eax, [ebp - 0x2898]
push 0x58b64c
push eax
call fcn.00413710
add esp, 0xc
mov byte [ebp - 4], 5
lea eax, [ebp - 0x2898]
cmp dword [ebp - 0x2884], 8
lea ecx, [ebp - 0x2970]
cmovae eax, dword [ebp - 0x2898]
push eax
call fcn.00410e30
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x2884]
test al, al
je 0x418670
cmp edx, 8
jb 0x418661
mov ecx, dword [ebp - 0x2898]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x418657
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x419971
push edx
push ecx
call fcn.00497cc1
add esp, 8
inc esi
cmp esi, 0x4000
jb 0x4185e0
jmp 0x4186b0
mov dword [ebp - 0x2aec], esi
cmp edx, 8
jb 0x4186b0
mov ecx, dword [ebp - 0x2898]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4186a6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x419971
push edx
push ecx
call fcn.00497cc1
add esp, 8
mov dword [ebp - 0x2878], 0
mov esi, 0x14
nop
push esi
lea eax, [ebp - 0x2898]
push 0x58b64c
push eax
call fcn.00413710
add esp, 0xc
mov byte [ebp - 4], 6
lea eax, [ebp - 0x2898]
cmp dword [ebp - 0x2884], 8
lea ecx, [ebp - 0x29d0]
cmovae eax, dword [ebp - 0x2898]
push eax
call fcn.00410e30
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x2884]
test al, al
je 0x418750
cmp edx, 8
jb 0x418741
mov ecx, dword [ebp - 0x2898]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x418737
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x419971
push edx
push ecx
call fcn.00497cc1
add esp, 8
inc esi
cmp esi, 0x4000
jb 0x4186c0
jmp 0x418790
mov dword [ebp - 0x2878], esi
cmp edx, 8
jb 0x418790
mov ecx, dword [ebp - 0x2898]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x418786
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x419976
push edx
push ecx
call fcn.00497cc1
add esp, 8
push 0x2800
lea eax, [ebp - 0x2848]
push 0
push eax
call fcn.005219d0
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x18]
add esp, 0xc
mov dword [ebp - 0x284c], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x1c], xmm0
push eax
push 0
lea eax, [ebp - 0x284c]
push eax
push 0
push str.MRUListEx
push dword [ebp - 0x2970]
call edi
mov dword [ebp - 0x2944], eax
test eax, eax
jne 0x418837
mov eax, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
cmp eax, 5
je 0x4187f3
test eax, eax
jne 0x418837
cmp esi, 0x2800
jg 0x418837
lea eax, [ebp - 0x2854]
mov dword [ebp - 0x2854], esi
push eax
lea eax, [ebp - 0x2848]
mov dword [ebp - 0x2850], 0
push eax
lea eax, [ebp - 0x2850]
push eax
push 0
push str.MRUListEx
push dword [ebp - 0x2970]
call edi
mov dword [ebp - 0x2944], eax
jmp 0x418839
xor esi, esi
push esi
lea eax, [ebp - 0x2848]
mov dword [ebp - 0x28a0], 0
push eax
lea ecx, [ebp - 0x28b0]
mov dword [ebp - 0x289c], 0xf
mov byte [ebp - 0x28b0], 0
call fcn.00406610
lea eax, [ebp - 0x2ae9]
mov byte [ebp - 4], 7
xor edi, edi
mov dword [ebp - 0x2854], eax
nop dword [eax]
mov al, byte [eax]
lea ecx, [ebp - 0x28b0]
mov esi, dword [ebp - 0x289c]
cmp esi, 0x10
mov edx, dword [ebp - 0x28a0]
cmovae ecx, dword [ebp - 0x28b0]
mov byte [ebp - 0x284c], al
lea eax, [ebp - 0x28b0]
cmovae eax, dword [ebp - 0x28b0]
sub ecx, eax
cmp edx, ecx
jb 0x41997b
mov eax, esi
sub eax, edx
cmp eax, 1
jb 0x418906
lea eax, [edx + 1]
cmp esi, 0x10
mov dword [ebp - 0x28a0], eax
lea eax, [ebp - 0x28b0]
cmovae eax, dword [ebp - 0x28b0]
sub edx, ecx
inc edx
push edx
lea esi, [eax + ecx]
lea eax, [esi + 1]
push esi
push eax
call fcn.00521450
movsx ecx, byte [ebp - 0x284c]
add esp, 0xc
movzx eax, cl
shl cx, 8
or cx, ax
mov byte [esi], cl
jmp 0x418929
push dword [ebp - 0x284c]
mov byte [ebp - 0x2850], 0
push 1
push ecx
push dword [ebp - 0x2850]
lea ecx, [ebp - 0x28b0]
push 1
call fcn.0041e320
mov eax, dword [ebp - 0x2854]
inc edi
dec eax
mov dword [ebp - 0x2854], eax
cmp edi, 4
jb 0x418880
push dword [ebp - 0x28a0]
cmp dword [ebp - 0x289c], 0x10
lea eax, [ebp - 0x28b0]
cmovae eax, dword [ebp - 0x28b0]
push eax
push 3
push 0
push str.MRUListEx
push dword [ebp - 0x2970]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x2aec]
mov dword [ebp - 0x2944], eax
lea eax, [ebp - 0x28f8]
push 0x58b64c
push eax
call fcn.00413710
add esp, 0xc
xorps xmm0, xmm0
mov dword [ebp - 0x2864], 0
movq qword [ebp - 0x286c], xmm0
xor ecx, ecx
xor edx, edx
mov dword [ebp - 0x286c], 0
mov dword [ebp - 0x2868], ecx
mov dword [ebp - 0x2864], edx
movq qword [ebp - 0x2860], xmm0
xor edi, edi
xor eax, eax
mov dword [ebp - 0x2858], edx
mov dword [ebp - 0x2860], edx
mov dword [ebp - 0x285c], edi
mov dword [ebp - 0x2858], eax
mov byte [ebp - 4], 0xa
xor esi, esi
mov dword [ebp - 0x20], 0x35
mov dword [ebp - 0x1c], 0x4eda0000
mov dword [ebp - 0x18], 0x1014c6
mov dword [ebp - 0x48], 0x40008
mov dword [ebp - 0x44], 0x4edabeef
mov dword [ebp - 0x40], 0x4eda14c6
mov dword [ebp - 0x3c], 0x2a14c6
mov dword [ebp - 0x38], 0xb41e0000
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], 0xe
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
cmp edx, ecx
je 0x418a47
mov al, byte [ebp + esi - 0x20]
mov byte [ecx], al
inc ecx
mov dword [ebp - 0x2868], ecx
jmp 0x418a65
lea eax, [ebp - 0x20]
add eax, esi
push eax
push ecx
lea ecx, [ebp - 0x286c]
call fcn.0040b630
mov edx, dword [ebp - 0x2864]
mov ecx, dword [ebp - 0x2868]
inc esi
cmp esi, 0xc
jb 0x418a34
cmp dword [ebx + 0x20], 8
lea eax, [ebx + 0xc]
mov dword [ebp - 0x2854], edx
xorps xmm0, xmm0
cmovae eax, dword [ebx + 0xc]
xor edx, edx
push edx
push edx
push edx
push edx
mov dword [ebp - 0x2850], ecx
mov ecx, dword [ebx + 0x1c]
push ecx
push eax
push edx
movlpd qword [ebp - 0x1c], xmm0
push edx
mov dword [ebp - 0x2aec], ecx
mov dword [ebp - 0x2870], eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], edx
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
mov esi, eax
mov dword [ebp - 0x284c], esi
test esi, esi
jle 0x418ae0
inc esi
push esi
call fcn.00481079
add esp, 4
mov edx, eax
mov dword [ebp - 0x18], edx
push esi
push 0
push edx
call fcn.005219d0
mov esi, dword [ebp - 0x284c]
add esp, 0xc
mov edx, dword [ebp - 0x18]
xor ecx, ecx
test edx, edx
je 0x418b0d
push ecx
push ecx
push esi
push edx
push dword [ebp - 0x2aec]
mov dword [ebp - 0x1c], esi
push dword [ebp - 0x2870]
push ecx
push ecx
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
mov edx, dword [ebp - 0x18]
mov ecx, esi
mov byte [edx + esi], 0
xor eax, eax
mov byte [ebp - 4], 0xb
add ecx, edx
mov dword [ebp - 0x2930], eax
mov dword [ebp - 0x292c], 0xf
mov byte [ebp - 0x2940], al
cmp edx, ecx
je 0x418b44
sub ecx, edx
push ecx
push edx
lea ecx, [ebp - 0x2940]
call fcn.00406610
mov eax, dword [ebp - 0x2930]
xor edx, edx
mov byte [ebp - 4], 0xc
mov esi, dword [ebp - 0x2940]
mov dword [ebp - 0x2aec], edx
test eax, eax
je 0x418c0a
mov ecx, dword [ebp - 0x2854]
jmp 0x418b76
mov esi, dword [ebp - 0x2940]
cmp eax, edx
jbe 0x41997b
cmp dword [ebp - 0x292c], 0x10
lea eax, [ebp - 0x2940]
cmovae eax, esi
mov al, byte [eax + edx]
mov byte [ebp - 0x2aee], al
mov byte [ebp - 0x2aed], al
mov eax, dword [ebp - 0x2850]
cmp ecx, eax
je 0x418bc0
mov dl, byte [ebp - 0x2aee]
mov byte [eax], dl
inc eax
mov dword [ebp - 0x2850], eax
mov esi, eax
mov dword [ebp - 0x2868], eax
jmp 0x418bed
lea ecx, [ebp - 0x2aed]
push ecx
push eax
lea ecx, [ebp - 0x286c]
call fcn.0040b630
mov eax, dword [ebp - 0x2864]
mov ecx, eax
mov esi, dword [ebp - 0x2868]
mov dword [ebp - 0x2854], eax
mov dword [ebp - 0x2850], esi
mov edx, dword [ebp - 0x2aec]
mov eax, dword [ebp - 0x2930]
inc edx
mov dword [ebp - 0x2aec], edx
cmp edx, eax
jb 0x418b70
jmp 0x418c10
mov esi, dword [ebp - 0x2850]
mov byte [ebp - 0x2aed], 0
cmp dword [ebp - 0x2854], esi
je 0x418c2b
mov byte [esi], 0
inc esi
mov dword [ebp - 0x2868], esi
jmp 0x418c50
lea eax, [ebp - 0x2aed]
push eax
push esi
lea ecx, [ebp - 0x286c]
call fcn.0040b630
mov eax, dword [ebp - 0x2864]
mov esi, dword [ebp - 0x2868]
mov dword [ebp - 0x2854], eax
mov dword [ebp - 0x2850], esi
xor esi, esi
xor ecx, ecx
nop word [eax + eax]
cmp ecx, edi
je 0x418c73
mov al, byte [ebp + esi - 0x48]
mov byte [edi], al
inc edi
mov dword [ebp - 0x285c], edi
jmp 0x418c91
lea eax, [ebp - 0x48]
add eax, esi
lea ecx, [ebp - 0x2860]
push eax
push edi
call fcn.0040b630
mov ecx, dword [ebp - 0x2858]
mov edi, dword [ebp - 0x285c]
inc esi
cmp esi, 0x28
jb 0x418c60
cmp dword [ebx + 0x20], 8
lea eax, [ebx + 0xc]
mov esi, dword [ebp - 0x2850]
cmovae eax, dword [ebx + 0xc]
xor edx, edx
mov dword [ebp - 0x2870], eax
mov eax, dword [ebx + 0x1c]
mov dword [ebp - 0x284c], edx
add eax, eax
je 0x418d16
mov esi, dword [ebp - 0x2870]
mov al, byte [esi + edx]
mov byte [ebp - 0x2aed], al
cmp ecx, edi
je 0x418cdb
mov byte [edi], al
inc edi
mov dword [ebp - 0x285c], edi
jmp 0x418d00
lea eax, [ebp - 0x2aed]
push eax
push edi
lea ecx, [ebp - 0x2860]
call fcn.0040b630
mov ecx, dword [ebp - 0x2858]
mov edi, dword [ebp - 0x285c]
mov edx, dword [ebp - 0x284c]
mov eax, dword [ebx + 0x1c]
inc edx
add eax, eax
mov dword [ebp - 0x284c], edx
cmp edx, eax
jb 0x418cc3
mov esi, dword [ebp - 0x2850]
mov byte [ebp - 0x2aed], 0
cmp ecx, edi
je 0x418d2d
mov byte [edi], 0
inc edi
mov dword [ebp - 0x285c], edi
jmp 0x418d4c
lea eax, [ebp - 0x2aed]
push eax
push edi
lea ecx, [ebp - 0x2860]
call fcn.0040b630
mov ecx, dword [ebp - 0x2858]
mov edi, dword [ebp - 0x285c]
mov byte [ebp - 0x2aed], 0
cmp ecx, edi
je 0x418d63
mov byte [edi], 0
inc edi
mov dword [ebp - 0x285c], edi
jmp 0x418d82
lea eax, [ebp - 0x2aed]
push eax
push edi
lea ecx, [ebp - 0x2860]
call fcn.0040b630
mov ecx, dword [ebp - 0x2858]
mov edi, dword [ebp - 0x285c]
mov eax, esi
sub eax, dword [ebp - 0x286c]
add eax, 2
xor esi, esi
mov dword [ebp - 0x2870], eax
nop word [eax + eax]
mov al, byte [ebp + esi - 0x2870]
mov byte [ebp - 0x2aed], al
cmp ecx, edi
je 0x418dbc
mov byte [edi], al
inc edi
mov dword [ebp - 0x285c], edi
jmp 0x418ddb
lea eax, [ebp - 0x2aed]
push eax
push edi
lea ecx, [ebp - 0x2860]
call fcn.0040b630
mov ecx, dword [ebp - 0x2858]
mov edi, dword [ebp - 0x285c]
inc esi
cmp esi, 4
jb 0x418da0
mov esi, dword [ebp - 0x2860]
mov eax, edi
sub eax, esi
mov dword [ebp - 0x2aec], ecx
mov edx, eax
mov dword [ebp - 0x284c], eax
shr edx, 8
mov dword [ebp - 0x2870], edx
mov byte [ebp - 0x2aed], dl
cmp ecx, edi
je 0x418e59
cmp esi, edi
jne 0x418e1d
mov byte [edi], dl
lea edx, [edi + 1]
mov dword [ebp - 0x285c], edx
jmp 0x418e8a
mov al, byte [edi - 1]
lea ecx, [edi - 1]
sub ecx, esi
mov byte [edi], al
lea eax, [edi + 1]
sub edi, ecx
push ecx
push esi
push edi
mov dword [ebp - 0x2874], eax
mov dword [ebp - 0x285c], eax
call fcn.00521450
mov eax, dword [ebp - 0x2870]
add esp, 0xc
mov ecx, dword [ebp - 0x2aec]
mov edx, dword [ebp - 0x2874]
mov byte [esi], al
jmp 0x418e84
lea eax, [ebp - 0x2aed]
push eax
push esi
lea ecx, [ebp - 0x2860]
call fcn.0040b630
mov ecx, dword [ebp - 0x2858]
mov edx, dword [ebp - 0x285c]
mov esi, dword [ebp - 0x2860]
mov dword [ebp - 0x2aec], ecx
mov eax, dword [ebp - 0x284c]
mov byte [ebp - 0x2aed], al
cmp ecx, edx
je 0x418edb
cmp esi, edx
jne 0x418eab
lea edi, [edx + 1]
mov byte [edx], al
mov dword [ebp - 0x285c], edi
mov edi, dword [ebp - 0x2aec]
jmp 0x418efa
mov al, byte [edx - 1]
lea ecx, [edx - 1]
sub ecx, esi
mov byte [edx], al
push ecx
lea eax, [edx + 1]
sub edx, ecx
push esi
push edx
mov dword [ebp - 0x285c], eax
call fcn.00521450
mov eax, dword [ebp - 0x284c]
add esp, 0xc
mov edi, dword [ebp - 0x2aec]
mov byte [esi], al
jmp 0x418efa
lea eax, [ebp - 0x2aed]
push eax
push esi
lea ecx, [ebp - 0x2860]
call fcn.0040b630
mov edi, dword [ebp - 0x2858]
mov esi, dword [ebp - 0x2860]
cmp esi, dword [ebp - 0x285c]
je 0x418f5b
mov ecx, dword [ebp - 0x2850]
mov eax, dword [ebp - 0x2854]
mov edx, dword [ebp - 0x285c]
cmp eax, ecx
je 0x418f2b
mov al, byte [esi]
mov byte [ecx], al
inc ecx
mov eax, dword [ebp - 0x2854]
mov dword [ebp - 0x2868], ecx
jmp 0x418f50
push esi
push ecx
lea ecx, [ebp - 0x286c]
call fcn.0040b630
mov eax, dword [ebp - 0x2864]
mov ecx, dword [ebp - 0x2868]
mov edx, dword [ebp - 0x285c]
mov dword [ebp - 0x2854], eax
inc esi
cmp esi, edx
jne 0x418f14
mov dword [ebp - 0x2850], ecx
mov eax, dword [ebp - 0x2850]
mov ecx, dword [ebp - 0x286c]
sub eax, ecx
mov esi, dword [ebp - 0x2854]
mov edx, eax
shr edx, 8
mov dword [ebp - 0x284c], edx
mov byte [ebp - 0x2aed], dl
mov edx, dword [ebp - 0x2850]
mov dword [ebp - 0x2aec], eax
cmp esi, edx
je 0x418fe7
cmp ecx, edx
jne 0x418fa5
mov eax, dword [ebp - 0x284c]
mov byte [edx], al
inc edx
mov dword [ebp - 0x2868], edx
jmp 0x419012
mov al, byte [edx - 1]
lea ecx, [edx - 1]
mov byte [edx], al
lea eax, [edx + 1]
mov dword [ebp - 0x2874], eax
mov dword [ebp - 0x2868], eax
mov eax, dword [ebp - 0x286c]
sub ecx, eax
push ecx
push eax
sub edx, ecx
push edx
call fcn.00521450
mov ecx, dword [ebp - 0x286c]
add esp, 0xc
mov eax, dword [ebp - 0x284c]
mov edx, dword [ebp - 0x2874]
mov byte [ecx], al
jmp 0x419012
lea eax, [ebp - 0x2aed]
push eax
push ecx
lea ecx, [ebp - 0x286c]
call fcn.0040b630
mov esi, dword [ebp - 0x2864]
mov edx, dword [ebp - 0x2868]
mov ecx, dword [ebp - 0x286c]
mov dword [ebp - 0x2854], esi
mov eax, dword [ebp - 0x2aec]
mov byte [ebp - 0x2aed], al
cmp esi, edx
je 0x419060
lea esi, [edx + 1]
mov dword [ebp - 0x2868], esi
cmp ecx, edx
jne 0x419033
mov byte [edx], al
jmp 0x41908b
mov al, byte [edx - 1]
lea ecx, [edx - 1]
mov byte [edx], al
mov eax, dword [ebp - 0x286c]
sub ecx, eax
push ecx
push eax
sub edx, ecx
push edx
call fcn.00521450
mov ecx, dword [ebp - 0x286c]
add esp, 0xc
mov eax, dword [ebp - 0x2aec]
mov byte [ecx], al
jmp 0x41908b
lea eax, [ebp - 0x2aed]
push eax
push ecx
lea ecx, [ebp - 0x286c]
call fcn.0040b630
mov eax, dword [ebp - 0x2864]
mov esi, dword [ebp - 0x2868]
mov ecx, dword [ebp - 0x286c]
mov dword [ebp - 0x2854], eax
sub esi, ecx
lea eax, [ebp - 0x28f8]
cmp dword [ebp - 0x28e4], 8
push esi
cmovae eax, dword [ebp - 0x28f8]
push ecx
push 3
push 0
push eax
push dword [ebp - 0x2970]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x30
mov dword [ebp - 0x2944], eax
lea eax, [ebp - 0x28e0]
push 0
push eax
call fcn.005219d0
add esp, 0xc
lea ecx, [ebp - 0x28e0]
call fcn.00410bf0
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0x28dc]
cmp eax, 0x80000001
je 0x41914b
cmp byte [ebp - 0x28bc], 0
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x419102
push eax
call esi
mov byte [ebp - 0x28bc], 0
mov eax, dword [ebp - 0x28e0]
mov dword [ebp - 0x28dc], SysReAllocString
test eax, eax
je 0x41914b
cmp byte [ebp - 0x28d8], 0
jne 0x41912c
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov eax, dword [ebp - 0x28e0]
push eax
call esi
push 0
push 0x58bc94
lea ecx, [ebp - 0x28d4]
mov dword [ebp - 0x28e0], 0
call fcn.00410900
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x2b08]
mov esi, dword [ebp - 0x2918]
xor eax, eax
mov word [ebp - 0x2b08], ax
mov dword [ebp - 0x2af8], 0
mov dword [ebp - 0x2af4], 7
lea eax, [esi + 1]
mov dword [ebp - 0x284c], 3
push eax
call fcn.0040a130
cmp dword [ebp - 0x2914], 8
lea eax, [ebp - 0x2928]
push esi
cmovae eax, dword [ebp - 0x2928]
lea ecx, [ebp - 0x2b08]
push eax
call fcn.00411920
push 1
push 0x58bdf0
lea ecx, [ebp - 0x2b08]
call fcn.00411920
cmp dword [ebp - 0x28e4], 8
lea eax, [ebp - 0x28f8]
push dword [ebp - 0x28e8]
cmovae eax, dword [ebp - 0x28f8]
lea ecx, [ebp - 0x2b08]
push eax
call fcn.00411920
xor ecx, ecx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x38], xmm0
movq xmm0, qword [eax + 0x10]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
movq qword [ebp - 0x28], xmm0
mov word [eax], cx
mov byte [ebp - 4], 0x10
mov edx, dword [ebp - 0x2af4]
cmp edx, 8
jb 0x41924c
mov ecx, dword [ebp - 0x2b08]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x419242
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x419980
push edx
push ecx
call fcn.00497cc1
add esp, 8
xor eax, eax
mov dword [ebp - 0x2af8], 0
cmp dword [ebp - 0x24], 8
lea ecx, [ebp - 0x28e0]
mov word [ebp - 0x2b08], ax
lea eax, [ebp - 0x38]
cmovae eax, dword [ebp - 0x38]
push 1
push eax
mov dword [ebp - 0x2af4], 7
call fcn.00410ed0
test al, al
je 0x4196ce
mov eax, dword [ebp - 0x2878]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
mov dword [ebp - 0x2874], eax
lea eax, [ebp - 0x2874]
push eax
push 4
push 0
push str.NodeSlot
push dword [ebp - 0x28e0]
mov dword [ebp - 0x2aec], 0xffffffff
call esi
push 4
mov dword [ebp - 0x28b4], eax
lea eax, [ebp - 0x2aec]
push eax
push 3
push 0
push str.MRUListEx
push dword [ebp - 0x28e0]
call esi
mov dword [ebp - 0x28b4], eax
mov eax, dword [ebp - 0x28e0]
test eax, eax
je 0x419329
cmp byte [ebp - 0x28d8], 0
jne 0x419306
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov eax, dword [ebp - 0x28e0]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 0x58bc94
lea ecx, [ebp - 0x28d4]
mov dword [ebp - 0x28e0], 0
call fcn.00410900
push dword [ebp - 0x2878]
lea eax, [ebp - 0x29a0]
push 0x58b64c
push eax
call fcn.00413710
add esp, 0xc
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x2b08]
mov esi, dword [ebp - 0x2900]
xor eax, eax
mov word [ebp - 0x2b08], ax
mov dword [ebp - 0x2af8], 0
mov dword [ebp - 0x2af4], 7
lea eax, [esi + 1]
mov dword [ebp - 0x284c], 0xd
push eax
call fcn.0040a130
cmp dword [ebp - 0x28fc], 8
lea eax, [ebp - 0x2910]
push esi
cmovae eax, dword [ebp - 0x2910]
lea ecx, [ebp - 0x2b08]
push eax
call fcn.00411920
push 1
push 0x58bdf0
lea ecx, [ebp - 0x2b08]
call fcn.00411920
cmp dword [ebp - 0x298c], 8
lea eax, [ebp - 0x29a0]
push dword [ebp - 0x2990]
cmovae eax, dword [ebp - 0x29a0]
lea ecx, [ebp - 0x2b08]
push eax
call fcn.00411920
mov dword [ebp - 0x2888], 0
xor ecx, ecx
mov dword [ebp - 0x2884], 0
mov dword [ebp - 0x284c], 0x1d
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x2898], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x2888], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
push 0x2d
push str.Shell5C4F28B5_F869_4E84_8E60_F11DB97C5CC7
lea ecx, [ebp - 0x2898]
mov byte [ebp - 4], 0x13
call fcn.00411920
xor ecx, ecx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x2988], xmm0
movq xmm0, qword [eax + 0x10]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
movq qword [ebp - 0x2978], xmm0
mov word [eax], cx
mov byte [ebp - 4], 0x15
mov edx, dword [ebp - 0x2884]
cmp edx, 8
jb 0x4194a8
mov ecx, dword [ebp - 0x2898]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41949e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x419985
push edx
push ecx
call fcn.00497cc1
add esp, 8
xor eax, eax
mov dword [ebp - 0x2888], 0
mov dword [ebp - 0x2884], 7
mov word [ebp - 0x2898], ax
mov byte [ebp - 4], 0x16
mov edx, dword [ebp - 0x2af4]
cmp edx, 8
jb 0x419509
mov ecx, dword [ebp - 0x2b08]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4194ff
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41998a
push edx
push ecx
call fcn.00497cc1
add esp, 8
xor eax, eax
mov dword [ebp - 0x2af8], 0
cmp dword [ebp - 0x2974], 8
lea ecx, [ebp - 0x28e0]
mov word [ebp - 0x2b08], ax
lea eax, [ebp - 0x2988]
cmovae eax, dword [ebp - 0x2988]
push 1
push eax
mov dword [ebp - 0x2af4], 7
call fcn.00410ed0
test al, al
je 0x41964e
mov eax, dword [ebp - 0x287c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
mov dword [ebp - 0x287c], eax
lea eax, [ebp - 0x287c]
push eax
push 4
push 0
push str.IconSize
push dword [ebp - 0x28e0]
call esi
mov dword [ebp - 0x28b4], eax
mov eax, dword [ebx + 8]
push 4
mov dword [ebp - 0x287c], eax
lea eax, [ebp - 0x287c]
push eax
push 4
push 0
push str.LogicalViewMode
push dword [ebp - 0x28e0]
call esi
mov dword [ebp - 0x28b4], eax
mov eax, dword [ebp - 0x2880]
push 4
mov dword [ebp - 0x2880], eax
lea eax, [ebp - 0x2880]
push eax
push 4
push 0
push str.Mode
push dword [ebp - 0x28e0]
call esi
push 4
mov dword [ebp - 0x28b4], eax
lea eax, [ebp - 0x2880]
push eax
push 4
push 0
push str.GroupView
push dword [ebp - 0x28e0]
mov dword [ebp - 0x2880], 0
call esi
mov dword [ebp - 0x28b4], eax
mov eax, dword [ebp - 0x28e0]
test eax, eax
je 0x419644
cmp byte [ebp - 0x28d8], 0
jne 0x419621
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov eax, dword [ebp - 0x28e0]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 0x58bc94
lea ecx, [ebp - 0x28d4]
mov dword [ebp - 0x28e0], 0
call fcn.00410900
mov dword [ebp - 0x2b0c], 1
mov edx, dword [ebp - 0x2974]
cmp edx, 8
jb 0x41968e
mov ecx, dword [ebp - 0x2988]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x419684
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41998f
push edx
push ecx
call fcn.00497cc1
add esp, 8
mov edx, dword [ebp - 0x298c]
cmp edx, 8
jb 0x4196ce
mov ecx, dword [ebp - 0x29a0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4196c4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x419994
push edx
push ecx
call fcn.00497cc1
add esp, 8
mov edx, dword [ebp - 0x24]
cmp edx, 8
jb 0x419708
mov ecx, dword [ebp - 0x38]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4196fe
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x419999
push edx
push ecx
call fcn.00497cc1
add esp, 8
lea ecx, [ebp - 0x28e0]
call fcn.00411210
mov eax, dword [ebp - 0x292c]
cmp eax, 0x10
jb 0x41974f
mov edx, dword [ebp - 0x2940]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x419745
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41999e
push ecx
push edx
call fcn.00497cc1
add esp, 8
mov edx, dword [ebp - 0x18]
test edx, edx
je 0x41975f
push edx
call fcn.0041f3e0
add esp, 4
mov ecx, dword [ebp - 0x2860]
test ecx, ecx
je 0x419793
sub edi, ecx
mov eax, ecx
cmp edi, 0x1000
jb 0x419789
mov ecx, dword [ecx - 4]
add edi, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4199a3
push edi
push ecx
call fcn.00497cc1
add esp, 8
mov edx, dword [ebp - 0x286c]
test edx, edx
je 0x4197cd
mov ecx, dword [ebp - 0x2854]
mov eax, edx
sub ecx, edx
cmp ecx, 0x1000
jb 0x4197c3
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4199a8
push ecx
push edx
call fcn.00497cc1
add esp, 8
mov edx, dword [ebp - 0x28e4]
cmp edx, 8
jb 0x41980d
mov ecx, dword [ebp - 0x28f8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x419803
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4199ad
push edx
push ecx
call fcn.00497cc1
add esp, 8
mov edx, dword [ebp - 0x289c]
xor eax, eax
mov dword [ebp - 0x28e8], 0
mov dword [ebp - 0x28e4], 7
mov word [ebp - 0x28f8], ax
cmp edx, 0x10
jb 0x419864
mov ecx, dword [ebp - 0x28b0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x41985a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4199b2
push edx
push ecx
call fcn.00497cc1
add esp, 8
mov esi, dword [ebp - 0x2b0c]
mov dword [ebp - 0x28a0], 0
mov dword [ebp - 0x289c], 0xf
mov byte [ebp - 0x28b0], 0
lea ecx, [ebp - 0x29d0]
call fcn.00411210
lea ecx, [ebp - 0x2970]
call fcn.00411210
mov edx, dword [ebp - 0x28fc]
cmp edx, 8
jb 0x4198db
mov ecx, dword [ebp - 0x2910]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4198d1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4199b7
push edx
push ecx
call fcn.00497cc1
add esp, 8
mov edx, dword [ebp - 0x2914]
cmp edx, 8
jb 0x41991b
mov ecx, dword [ebp - 0x2928]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x419911
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4199bc
push edx
push ecx
call fcn.00497cc1
add esp, 8
mov edx, dword [ebx + 0x20]
cmp edx, 8
jb 0x419951
mov ecx, dword [ebx + 0xc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x419947
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4199c1
push edx
push ecx
call fcn.00497cc1
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00497cb0
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.00524999
call fcn.00524999
call fcn.00404db0
call fcn.00524999
call fcn.00524999
call fcn.00524999
call fcn.00524999
call fcn.00524999
call fcn.00524999
call fcn.00524999
call fcn.00524999
call fcn.00524999
call fcn.00524999
call fcn.00524999
call fcn.00524999
call fcn.00524999
call fcn.00524999
int3