Function at 0x41acb1
Capabilities:
Copy file
Persist via run registry key
Set file attributes
Set registry value

Disassembly:
mov eax, 0x4643fa
call fcn.004341ac
mov eax, 0x129c
call fcn.004349d0
push ebx
push esi
push edi
mov dword [ebp - 0x20], ecx
call fcn.00401083
mov dword [ebp - 0x10], eax
xor ebx, ebx
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x6a7]
mov byte [ebp - 0x6a8], bl
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 0x10]
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.00428f10
test eax, eax
jne 0x41ae4a
lea ecx, [ebp - 0xc8]
call fcn.00401d2c
mov ecx, 0x485b70
mov dword [ebp - 4], ebx
call fcn.00401c5e
push eax
lea eax, [ebp - 0x6a8]
push 0x485fc8
push eax
call fcn.004301d9
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileA]
lea eax, [ebp - 0x6a8]
push ebx
push eax
push 0x484ec0
call esi
lea eax, [ebp - 0x6a8]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x6a8]
lea ecx, [ebp - 0xc8]
push eax
call fcn.0040219d
xor eax, eax
lea edi, [ebp - 0xdb]
mov byte [ebp - 0xdc], bl
push dword [0x4854e0]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0xdc]
push str._04x
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0xea8]
push eax
lea eax, [ebp - 0x12a8]
push eax
push 0x484ec0
call fcn.0042ff93
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0x12a8]
push eax
lea eax, [ebp - 0xea8]
push eax
call fcn.004301d9
lea eax, [ebp - 0xea8]
push str..ini
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0xaa7]
mov byte [ebp - 0xaa8], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0xaa8]
push 0x485fc8
push eax
call fcn.004301d9
lea eax, [ebp - 0xaa8]
push str..ini
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0xaa8]
push ebx
push eax
lea eax, [ebp - 0xea8]
push eax
call esi
lea eax, [ebp - 0xaa8]
push eax
lea ecx, [ebp - 0xc8]
call fcn.0040219d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc8]
call fcn.00401d59
jmp 0x41ae5c
lea eax, [ebp - 0x6a8]
push 0x484ec0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 1
lea eax, [ebp - 0x2a]
pop esi
lea ecx, [ebp - 0x168]
push esi
push eax
push dword [0x469704]
call fcn.00401a6d
lea eax, [ebp - 0x29]
push esi
push eax
lea ecx, [ebp - 0x140]
push dword [0x4696d0]
mov dword [ebp - 4], esi
call fcn.00401a6d
mov ecx, dword [ebp - 0x10]
push 0xa
lea eax, [ebp - 0x168]
push ebx
push eax
lea eax, [ebp - 0x140]
push eax
mov byte [ebp - 4], 2
call fcn.0042a7bc
lea ecx, [ebp - 0x140]
mov dword [ebp - 0x34], eax
mov byte [ebp - 4], 1
call fcn.00401306
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x168]
call fcn.00401306
lea eax, [ebp - 0x29]
mov esi, 0x469580
mov edi, 0x469578
push ebx
push eax
lea ecx, [ebp - 0x118]
mov dword [ebp - 0x118], esi
mov dword [ebp - 0xf8], edi
call fcn.00402c39
mov dword [ebp - 4], 3
mov dword [ebp - 0x18], ebx
lea eax, [ebp - 0x29]
push ebx
push eax
lea ecx, [ebp - 0x1b8]
mov byte [ebp - 4], 4
mov dword [ebp - 0x1b8], esi
mov dword [ebp - 0x198], edi
call fcn.00402c39
mov eax, dword [ebp - 0x34]
mov byte [ebp - 4], 5
sub eax, ebx
je 0x41afa6
dec eax
je 0x41af69
dec eax
jne 0x41afe1
lea eax, [ebp - 0x2a]
push 1
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionRun
lea ecx, [ebp - 0x140]
call fcn.00402dbc
lea eax, [ebp - 0x140]
lea ecx, [ebp - 0x1b8]
push eax
mov byte [ebp - 4], 8
call fcn.0040211c
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x140]
jmp 0x41af9f
lea eax, [ebp - 0x2b]
push 1
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnceEx
lea ecx, [ebp - 0x168]
call fcn.00402dbc
lea eax, [ebp - 0x168]
lea ecx, [ebp - 0x1b8]
push eax
mov byte [ebp - 4], 7
call fcn.0040211c
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x168]
call fcn.004020a2
jmp 0x41afeb
lea eax, [ebp - 0x2c]
push 1
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
lea ecx, [ebp - 0x190]
call fcn.00402dbc
lea eax, [ebp - 0x190]
lea ecx, [ebp - 0x1b8]
push eax
mov byte [ebp - 4], 6
call fcn.0040211c
lea ecx, [ebp - 0x190]
mov byte [ebp - 4], 5
call fcn.004020a2
cmp dword [ebp - 0x34], 3
je 0x41b739
lea ecx, [ebp - 0x1b8]
call fcn.0040316b
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], ebx
push ecx
push 0xf003f
push ebx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x41b739
lea ecx, [ebp - 0x18]
call fcn.0040d832
mov ecx, dword [ebp - 0x1c]
cmp eax, ebx
mov dword [ebp - 0x18], ecx
jne 0x41b739
lea eax, [ebp + 0xb]
push 1
push eax
lea ecx, [ebp - 0x190]
push dword [ebp + 8]
call fcn.00402dbc
cmp dword [ebp + 0xc], ebx
mov byte [ebp - 4], 9
je 0x41b066
push str._AFTERREBOOT1
call fcn.00433d95
pop ecx
push eax
push str._AFTERREBOOT1
lea ecx, [ebp - 0x18c]
call fcn.00412bc8
lea eax, [ebp + 0xf]
push ebx
push eax
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x40], edi
call fcn.00402c39
mov eax, dword [ebp - 0x10]
mov byte [ebp - 4], 0xa
mov eax, dword [eax + 0x14]
dec eax
je 0x41b157
dec eax
je 0x41b105
dec eax
je 0x41b0ae
dec eax
je 0x41b0a4
dec eax
jne 0x41b170
mov eax, 0x47ce14
jmp 0x41b15c
mov eax, 0x47ce0c
jmp 0x41b15c
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x2a8]
push 9
push eax
call fcn.004085a4
push eax
lea eax, [ebp - 0x94]
push 0x47ce04
push eax
mov byte [ebp - 4], 0xd
call fcn.00421b59
add esp, 0xc
push eax
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 0xe
call fcn.0040211c
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 0xd
call fcn.004020a2
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x2a8]
call fcn.004020a2
jmp 0x41b170
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0xbc]
push 9
push eax
call fcn.004085a4
push eax
lea eax, [ebp - 0x258]
push 0x47cdfc
push eax
mov byte [ebp - 4], 0xb
call fcn.00421b59
add esp, 0xc
push eax
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 0xc
call fcn.0040211c
lea ecx, [ebp - 0x258]
mov byte [ebp - 4], 0xb
call fcn.004020a2
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xbc]
jmp 0x41b0fe
mov eax, 0x47cdf4
mov ecx, eax
test ecx, ecx
jne 0x41b167
mov eax, 0x483918
push eax
lea ecx, [ebp - 0x60]
call fcn.00404094
mov ecx, dword [ebp - 0x10]
call fcn.00428f10
test eax, eax
mov eax, 0x47cdec
jne 0x41b186
mov eax, 0x483918
cmp eax, ebx
mov dword [ebp - 0x208], esi
mov dword [ebp - 0x1e8], edi
jne 0x41b19b
mov eax, 0x483918
lea ecx, [ebp - 0x2c]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x208]
call fcn.00403fe2
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x2b]
push 1
push eax
mov byte [ebp - 4], 0xf
call fcn.004272af
push eax
lea ecx, [ebp - 0x230]
call fcn.00402dbc
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x2a]
push 1
push eax
mov byte [ebp - 4], 0x10
call fcn.0042746b
push eax
lea ecx, [ebp - 0x140]
call fcn.00402dbc
lea eax, [ebp - 0x37]
push 1
push eax
push 0x485fc8
lea ecx, [ebp - 0x168]
mov byte [ebp - 4], 0x11
call fcn.00402dbc
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 0x12
call fcn.00428f10
test eax, eax
je 0x41b28b
mov eax, dword [ebp - 0x20]
cmp dword [eax + 0x38], ebx
jne 0x41b28b
mov edx, dword [ebp - 0x200]
mov eax, 0x46959c
cmp edx, ebx
jne 0x41b22b
mov edx, eax
mov ecx, dword [ebp - 0x188]
mov dword [ebp - 0x1c], eax
cmp ecx, ebx
je 0x41b23b
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x160]
mov dword [ebp - 0x30], eax
cmp ecx, ebx
je 0x41b24b
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x138]
mov dword [ebp - 0x20], eax
cmp ecx, ebx
je 0x41b25b
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x58]
cmp ecx, ebx
jne 0x41b264
mov ecx, eax
cmp dword [ebp - 0x228], ebx
je 0x41b272
mov eax, dword [ebp - 0x228]
push edx
push dword [ebp - 0x1c]
push dword [ebp - 0x30]
push dword [ebp - 0x20]
push dword [0x4854e0]
push ecx
push eax
push str.__s___k__s__l_d__t__s___e__s___w__v__s___s
jmp 0x41b2fa
mov edx, dword [ebp - 0x200]
mov eax, 0x46959c
cmp edx, ebx
jne 0x41b29c
mov edx, eax
mov ecx, dword [ebp - 0x188]
mov dword [ebp - 0x20], eax
cmp ecx, ebx
je 0x41b2ac
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x160]
mov dword [ebp - 0x30], eax
cmp ecx, ebx
je 0x41b2bc
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x138]
mov dword [ebp - 0x1c], eax
cmp ecx, ebx
je 0x41b2cc
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x58]
cmp ecx, ebx
jne 0x41b2d5
mov ecx, eax
cmp dword [ebp - 0x228], ebx
je 0x41b2e3
mov eax, dword [ebp - 0x228]
push edx
push dword [ebp - 0x20]
push dword [ebp - 0x30]
push dword [ebp - 0x1c]
push dword [0x4854e0]
push ecx
push eax
push str.__s___s__l_d__t__s___e__s___v__s___s
lea eax, [ebp - 0x118]
push eax
call fcn.004206cd
mov eax, dword [ebp - 0x10]
add esp, 0x24
cmp dword [eax + 0x69c], ebx
je 0x41b38f
add eax, 0x690
push eax
lea eax, [ebp - 0x258]
push str.__debuglog_
push eax
call fcn.00421abe
push 0x47be30
push eax
lea eax, [ebp - 0xbc]
mov byte [ebp - 4], 0x13
push eax
call fcn.00421bf4
add esp, 0x18
mov eax, dword [eax + 8]
mov byte [ebp - 4], 0x14
cmp eax, ebx
mov dword [ebp - 0x1c], 0x469558
je 0x41b359
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x1c]
call fcn.00433d95
pop ecx
push eax
lea ecx, [ebp - 0x114]
push dword [ebp - 0x1c]
call fcn.00412bc8
lea ecx, [ebp - 0xbc]
mov byte [ebp - 4], 0x13
call fcn.00401306
lea ecx, [ebp - 0x258]
mov byte [ebp - 4], 0x12
call fcn.00401306
cmp dword [ebp - 0x34], 1
jne 0x41b3cb
lea eax, [ebp - 0x30]
mov dword [ebp - 0x20], ebx
push eax
lea eax, [ebp - 0x20]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.0001
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x41b3cb
lea ecx, [ebp - 0x18]
call fcn.0040d832
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x190]
push ebx
push eax
lea ecx, [ebp - 0xf0]
mov dword [ebp - 0xf0], esi
mov dword [ebp - 0xd0], edi
call fcn.00403f4f
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x36]
push 1
push eax
mov byte [ebp - 4], 0x15
call fcn.0042746b
push eax
lea ecx, [ebp - 0x280]
call fcn.00402dbc
lea eax, [ebp - 0x35]
push 1
push eax
push 0x485fc8
lea ecx, [ebp - 0x1e0]
mov byte [ebp - 4], 0x16
call fcn.00402dbc
cmp dword [ebp - 0x274], ebx
mov byte [ebp - 4], 0x17
je 0x41b44c
lea eax, [ebp - 0xbc]
push ebx
push eax
lea ecx, [ebp - 0x280]
call fcn.00412aa7
lea ecx, [ebp - 0xbc]
call fcn.004020a2
cmp dword [ebp - 0x1d4], ebx
je 0x41b472
lea eax, [ebp - 0xbc]
push ebx
push eax
lea ecx, [ebp - 0x1e0]
call fcn.00412aa7
lea ecx, [ebp - 0xbc]
call fcn.004020a2
mov esi, dword [ebp - 0x110]
cmp esi, ebx
jne 0x41b481
mov esi, 0x46959c
lea eax, [ebp - 0x11]
push 1
push eax
push str.C:CodeBasesisdev_srcRuntimeMSISharedSetupmsiaction.cpp
lea ecx, [ebp - 0xbc]
call fcn.00401a6d
mov eax, dword [eax + 8]
mov byte [ebp - 4], 0x18
cmp eax, ebx
jne 0x41b4a7
mov eax, 0x469558
mov dword [ebp - 0x24], eax
push esi
lea eax, [ebp - 0x24]
push str.MsiAction::Reboot_command_line__s
push eax
mov dword [ebp - 0x20], 0x6f7
call fcn.004086b0
add esp, 0xc
lea ecx, [ebp - 0xbc]
mov byte [ebp - 4], 0x17
call fcn.00401306
mov dword [ebp - 0x28], ebx
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 0x19
push eax
push 0xf003f
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
mov dword [ebp - 0x20], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, ebx
jne 0x41b670
lea ecx, [ebp - 0x28]
call fcn.0040d832
mov ecx, dword [ebp - 0x20]
cmp eax, ebx
mov dword [ebp - 0x28], ecx
jne 0x41b670
lea ecx, [ebp - 0x280]
call fcn.0040316b
push eax
mov dword [ebp - 0x20], eax
call esi
inc eax
push eax
push dword [ebp - 0x20]
push 1
push ebx
push str._IS_T_
push dword [ebp - 0x28]
call edi
lea ecx, [ebp - 0x1e0]
call fcn.0040316b
push eax
mov dword [ebp - 0x20], eax
call esi
inc eax
push eax
push dword [ebp - 0x20]
push 1
push ebx
push str._IS_E_
push dword [ebp - 0x28]
call edi
cmp dword [ebp - 0xe4], ebx
je 0x41b591
lea ecx, [ebp - 0xf0]
call fcn.0040316b
push eax
mov dword [ebp - 0x20], eax
call esi
inc eax
push eax
push dword [ebp - 0x20]
push 1
push ebx
push str._IS_V_
push dword [ebp - 0x28]
call edi
cmp dword [ebp - 0x28], ebx
je 0x41b5a2
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x28], ebx
lea eax, [ebp - 0x11]
push 1
push eax
push str._IS_T_
lea ecx, [ebp - 0x94]
call fcn.0040250b
lea eax, [ebp - 0x94]
lea ecx, [ebp - 0x118]
push eax
lea eax, [ebp - 0x280]
push eax
mov byte [ebp - 4], 0x1a
call fcn.004040bd
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 0x19
call fcn.004020a2
lea eax, [ebp - 0x11]
push 1
push eax
push str._IS_E_
lea ecx, [ebp - 0x94]
call fcn.0040250b
lea eax, [ebp - 0x94]
lea ecx, [ebp - 0x118]
push eax
lea eax, [ebp - 0x1e0]
push eax
mov byte [ebp - 4], 0x1b
call fcn.004040bd
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 0x19
call fcn.004020a2
cmp dword [ebp - 0xe4], ebx
je 0x41b670
lea eax, [ebp - 0x11]
push 1
push eax
push str._IS_V_
lea ecx, [ebp - 0x94]
call fcn.0040250b
lea eax, [ebp - 0x94]
lea ecx, [ebp - 0x118]
push eax
lea eax, [ebp - 0xf0]
push eax
mov byte [ebp - 4], 0x1c
call fcn.004040bd
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 0x19
call fcn.004020a2
lea ecx, [ebp - 0x118]
call fcn.0040316b
push eax
mov dword [ebp - 0x20], eax
call esi
inc eax
push eax
push dword [ebp - 0x20]
push 1
push ebx
push str.ISSetup
push dword [ebp - 0x18]
call edi
cmp dword [ebp - 0x18], ebx
je 0x41b6a4
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x28], ebx
je 0x41b6b5
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x28], ebx
lea ecx, [ebp - 0x1e0]
mov byte [ebp - 4], 0x16
call fcn.004020a2
lea ecx, [ebp - 0x280]
mov byte [ebp - 4], 0x15
call fcn.004020a2
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], 0x12
call fcn.004020a2
lea ecx, [ebp - 0x168]
mov byte [ebp - 4], 0x11
call fcn.004020a2
lea ecx, [ebp - 0x140]
mov byte [ebp - 4], 0x10
call fcn.004020a2
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 0xf
call fcn.004020a2
lea ecx, [ebp - 0x208]
mov byte [ebp - 4], 0xa
call fcn.004020a2
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 9
call fcn.004020a2
lea ecx, [ebp - 0x190]
mov byte [ebp - 4], 5
call fcn.004020a2
xor eax, eax
lea edi, [ebp - 0x6b]
mov byte [ebp - 0x6c], bl
push 1
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp + 0xb]
lea ecx, [ebp - 0x94]
push eax
push dword [0x4696e0]
call fcn.00401a6d
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x258]
push 6
push eax
mov byte [ebp - 4], 0x1d
call fcn.004085a4
lea ecx, [ebp - 0xbc]
mov byte [ebp - 4], 0x1e
push ecx
mov ecx, eax
call fcn.004204fe
push 0xa
lea ecx, [ebp - 0x94]
push ebx
push ecx
mov ecx, dword [ebp - 0x10]
push eax
mov byte [ebp - 4], 0x1f
call fcn.0042a7bc
lea ecx, [ebp - 0xbc]
mov esi, eax
mov byte [ebp - 4], 0x1e
call fcn.00401306
lea ecx, [ebp - 0x258]
mov byte [ebp - 4], 0x1d
call fcn.004020a2
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 5
call fcn.00401306
mov ecx, dword [ebp - 0x10]
push 0xc
call fcn.0040857f
test al, al
jne 0x41b7e4
cmp esi, 1
je 0x41b7e4
cmp esi, 2
jne 0x41b873
push 4
lea eax, [ebp - 0x6c]
push 0x47cce0
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [ebp - 0x58]
call fcn.0040277e
lea eax, [ebp - 0x6a8]
lea ecx, [ebp - 0x58]
push eax
mov byte [ebp - 4], 0x20
call fcn.004027c6
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0xbc]
push 6
push eax
call fcn.004085a4
mov ecx, eax
mov byte [ebp - 4], 0x21
call fcn.0040316b
lea ecx, [ebp - 0x6c]
push ecx
lea ecx, [ebp - 0x58]
push dword [0x4696e0]
push eax
call fcn.00402805
lea ecx, [ebp - 0xbc]
mov byte [ebp - 4], 0x20
call fcn.004020a2
lea ecx, [ebp - 0x58]
call fcn.004027f2
push 1
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x22
call fcn.00402bfd
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 5
call fcn.00403bed
cmp dword [ebp - 0x34], 3
je 0x41b893
cmp dword [0x4863d0], ebx
je 0x41b888
call fcn.004308f1
jmp 0x41b893
push 0x453
call fcn.0042f864
pop ecx
lea ecx, [ebp - 0x1b8]
mov byte [ebp - 4], 4
call fcn.004020a2
cmp dword [ebp - 0x18], ebx
je 0x41b8b3
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x18], ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x118]
call fcn.004020a2
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8