Function at 0x403e99
Capabilities:
Contain obfuscated stackstrings
Get common file path
Get disk information
Inspect section memory permissions
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x28d8
call fcn.0040c5c0
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
mov edi, 0x413588
lea eax, [ebp - 0xdc4]
push edi
push eax
call esi
lea eax, [ebp - 0x11c8]
push edi
push eax
call esi
push dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push edi
call esi
push edi
call fcn.0040b692
cmp eax, edi
pop ecx
jbe 0x403ee0
and byte [eax - 1], 0
xor ebx, ebx
push ebx
push edi
call fcn.0040a8e7
pop ecx
pop ecx
push 0x41310c
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edi, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
push 0x413584
mov dword [ebp - 0x24], ebx
call edi
push 0x413580
mov dword [ebp - 0x1c], eax
call edi
push 0x10c
mov dword [ebp - 0x18], eax
call fcn.0040b7c4
mov edx, dword [0x416c48]
pop ecx
mov ecx, dword [0x4167c8]
push dword [ebp + 8]
mov dword [ecx + edx*4], eax
mov eax, dword [0x4167c8]
mov ecx, dword [0x416c48]
mov eax, dword [eax + ecx*4]
mov dword [eax + 0x104], ebx
mov eax, dword [0x4167c8]
mov ecx, dword [0x416c48]
mov eax, dword [eax + ecx*4]
mov word [eax + 0x108], bx
mov eax, dword [0x4167c8]
mov ecx, dword [0x416c48]
mov eax, dword [eax + ecx*4]
mov word [eax + 0x10a], 0x7fff
mov eax, dword [0x4167c8]
mov ecx, dword [0x416c48]
mov edi, dword [eax + ecx*4]
push edi
call esi
push 1
push edi
call fcn.0040a8e7
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
pop ecx
pop ecx
push edi
call ebx
lea eax, [eax + edi - 1]
cmp eax, edi
jbe 0x403fa8
cmp byte [eax], 0x5c
je 0x403fad
and byte [eax], 0
dec eax
jmp 0x403f99
cmp byte [eax], 0x5c
jne 0x403fb1
and byte [eax + 1], 0
push edi
call ebx
cmp eax, 3
jg 0x403fbc
and byte [edi], 0
and dword [ebp - 4], 0
mov ebx, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov dword [ebp - 8], 1
cmp dword [ebp - 4], 0
je 0x403fe7
lea eax, [ebp - 0x9c0]
push 0x100
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x403ff5
lea eax, [ebp - 0x9c0]
push 0x104
push eax
call ebx
lea eax, [ebp - 0x9c0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [ebp + eax - 0x9c1], 0x5c
je 0x40401e
lea eax, [ebp - 0x9c0]
push 0x41310c
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x9c0]
push eax
push edi
call fcn.00410550
add esp, 0xc
test eax, eax
jne 0x40403d
and dword [ebp - 8], eax
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x403fcd
lea eax, [ebp - 0x1cd8]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x17cc]
push 0x104
push eax
call ebx
lea eax, [ebp - 0x17cc]
push eax
lea eax, [ebp - 0x1ad0]
push eax
call esi
lea eax, [ebp - 0x1ad0]
push str.WIN32S
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp dword [0x416778], 1
jne 0x4040e0
push 0x104
push dword [0x416804]
call ebx
push dword [0x416804]
lea eax, [ebp - 0x1bd4]
push eax
call esi
lea eax, [ebp - 0x1bd4]
push 0x41310c
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x1bd4]
push eax
push edi
call fcn.00410550
add esp, 0xc
test eax, eax
jne 0x4040ef
and dword [ebp - 8], eax
jmp 0x4040ef
lea eax, [ebp - 0x17cc]
push eax
push dword [0x416804]
call esi
xor ebx, ebx
cmp dword [ebp - 8], ebx
je 0x404100
cmp byte [edi], bl
je 0x404100
inc dword [0x416c48]
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll__lopen]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
jne 0x404177
mov esi, 0x100
lea eax, [ebp - 0x9c0]
push esi
push eax
push 3
push dword [0x416b50]
call fcn.0040acf0
lea eax, [ebp - 0xbc0]
push esi
push eax
push 2
push dword [0x416b50]
call fcn.0040acf0
mov eax, dword [0x41675c]
add esp, 0x20
cmp eax, ebx
je 0x404154
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
lea eax, [ebp - 0xbc0]
push ebx
push eax
lea eax, [ebp - 0x9c0]
push eax
push dword [0x416760]
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
pop eax
jmp 0x406b1c
push ebx
push eax
mov edi, 0x800
lea eax, [ebp - 0x9c0]
push edi
push eax
call fcn.00406c12
add esp, 0x10
cmp byte [ebp - 0x9bc], 0x20
jne 0x4041a1
mov dword [0x4167dc], 1
movzx eax, word [0x416c54]
mov ecx, dword [0x41676c]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpA]
push str.
and dword [ecx + eax*4], 0
inc word [0x416c54]
movzx eax, word [0x416c54]
mov ecx, dword [0x41676c]
and dword [ecx + eax*4], 0
and byte [ebp - 0x9bc], 0
lea eax, [ebp - 0x9c0]
push eax
call ebx
test eax, eax
jne 0x4042a2
push 0
lea eax, [ebp - 0x9c0]
push dword [ebp + 8]
push edi
push eax
call fcn.00406c12
and byte [ebp - 0x9ba], 0
add esp, 0x10
lea eax, [ebp - 0x9c0]
push str.Title:
push eax
call ebx
test eax, eax
je 0x404224
cmp byte [ebp - 0x9c0], 0
jne 0x4041ed
cmp byte [ebp - 0x9c0], 0
je 0x4042a2
lea eax, [ebp - 0x9c0]
push eax
call fcn.0040bfbe
pop ecx
push 0
push dword [ebp + 8]
push edi
lea eax, [ebp - 0x9c0]
push eax
call fcn.00406c12
add esp, 0x10
cmp byte [ebp - 0x9c0], 0
je 0x406b0f
lea eax, [ebp - 0x9c0]
push str.Non_System_File:
push eax
mov dword [ebp - 0xc], 1
call fcn.00410600
pop ecx
test eax, eax
pop ecx
jne 0x404308
xor ebx, ebx
mov edi, 0x800
push ebx
lea eax, [ebp - 0x9c0]
push dword [ebp + 8]
mov dword [ebp - 0x10], 1
push edi
push eax
call fcn.00406c12
add esp, 0x10
jmp 0x404312
mov esi, 0x100
lea eax, [ebp - 0x9c0]
push esi
push eax
push 4
push dword [0x416b50]
call fcn.0040acf0
lea eax, [ebp - 0xbc0]
push esi
push eax
push 2
push dword [0x416b50]
call fcn.0040acf0
mov eax, dword [0x41675c]
add esp, 0x20
test eax, eax
je 0x4042e4
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
lea eax, [ebp - 0xbc0]
push 0
push eax
lea eax, [ebp - 0x9c0]
push eax
push dword [0x416760]
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
pop esi
jmp 0x406b11
xor ebx, ebx
mov edi, 0x800
mov dword [ebp - 0x10], ebx
lea eax, [ebp - 0x9c0]
push str.Shared_DLL_counter_ignored:
push eax
call fcn.00410600
pop ecx
test eax, eax
pop ecx
jne 0x404346
push ebx
lea eax, [ebp - 0x9c0]
push dword [ebp + 8]
mov dword [ebp - 4], 1
push edi
push eax
call fcn.00406c12
add esp, 0x10
jmp 0x404349
mov dword [ebp - 4], ebx
push 0xb
lea eax, [ebp - 0x9c0]
push str.File_Copy:
push eax
call fcn.00410550
add esp, 0xc
test eax, eax
je 0x405f62
push 0xc
lea eax, [ebp - 0x9c0]
push str.Shell_Link:
push eax
call fcn.00410550
add esp, 0xc
test eax, eax
je 0x405f62
push 0x10
lea eax, [ebp - 0x9c0]
push str.File_Overwrite:
push eax
call fcn.00410550
add esp, 0xc
test eax, eax
je 0x405f62
push 0xb
lea eax, [ebp - 0x9c0]
push str.RegDB_Key:
push eax
call fcn.00410550
add esp, 0xc
test eax, eax
jne 0x4048aa
lea eax, [ebp - 0x9b5]
push eax
lea eax, [ebp - 0xfc4]
push eax
call esi
push ebx
lea eax, [ebp - 0x9c0]
push dword [ebp + 8]
push edi
push eax
call fcn.00406c12
push 0xb
lea eax, [ebp - 0x9c0]
push str.RegDB_Val:
push eax
call fcn.00410550
add esp, 0x1c
test eax, eax
jne 0x40424f
lea eax, [ebp - 0x9b5]
push eax
lea eax, [ebp - 0x28d8]
push eax
call esi
push 0
lea eax, [ebp - 0x9c0]
push dword [ebp + 8]
push 0x800
push eax
call fcn.00406c12
push 0xb
lea eax, [ebp - 0x9c0]
push str.RegDB_Val:
push eax
call fcn.00410550
add esp, 0x1c
test eax, eax
je 0x404410
and byte [ebp - 0x19cc], 0
push 0xc
lea eax, [ebp - 0x9c0]
xor ebx, ebx
push str.RegDB_Name:
push eax
mov dword [ebp - 4], ebx
call fcn.00410550
add esp, 0xc
test eax, eax
jne 0x404491
lea eax, [ebp - 0x9b4]
push eax
lea eax, [ebp - 0x19cc]
push eax
call esi
push ebx
mov edi, 0x800
push dword [ebp + 8]
lea eax, [ebp - 0x9c0]
push edi
push eax
call fcn.00406c12
add esp, 0x10
jmp 0x404496
mov edi, 0x800
push 0xc
lea eax, [ebp - 0x9c0]
push str.RegDB_Type:
push eax
call fcn.00410550
add esp, 0xc
test eax, eax
jne 0x4044d4
lea eax, [ebp - 0x9b4]
push eax
call fcn.0040c5ae
push 0
mov dword [ebp - 4], eax
push dword [ebp + 8]
lea eax, [ebp - 0x9c0]
push edi
push eax
call fcn.00406c12
add esp, 0x14
push 0xc
lea eax, [ebp - 0x9c0]
push str.RegDB_Root:
push eax
call fcn.00410550
add esp, 0xc
test eax, eax
jne 0x404523
lea eax, [ebp - 0x9b4]
push eax
call fcn.0040c5ae
push 0
mov ebx, eax
push dword [ebp + 8]
lea eax, [ebp - 0x9c0]
push edi
push eax
call fcn.00406c12
add esp, 0x14
cmp ebx, 1
jne 0x404523
cmp dword [0x416850], 0
jne 0x40424f
push ebx
lea eax, [ebp - 0x34]
push 0x4134bc
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push 0x10
call fcn.0040b7c4
mov ecx, dword [0x416810]
mov edx, dword [0x416780]
add esp, 0x10
mov dword [ecx + edx*4], eax
mov eax, dword [0x416810]
mov ecx, dword [0x416780]
mov edi, dword [eax + ecx*4]
inc dword [0x416780]
lea eax, [ebp - 0x28d8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
call fcn.0040b7c4
pop ecx
mov dword [edi + 0xc], eax
lea ecx, [ebp - 0x28d8]
push ecx
push eax
call esi
and dword [edi], 0
and dword [edi + 8], 0
push 0xb
lea eax, [ebp - 0x9c0]
push str.RegDB_Old:
push eax
call fcn.00410550
add esp, 0xc
test eax, eax
jne 0x4047a5
lea eax, [ebp - 0x34]
mov dword [edi], 1
mov ecx, dword [0x416bbc]
push eax
lea eax, [ebp - 0x19cc]
push eax
lea eax, [ebp - 0xfc4]
push eax
mov eax, dword [0x416b44]
push ecx
push 0x1224
push dword [eax]
lea eax, [eax + ecx*4]
push eax
call fcn.0040b8e6
add esp, 0x1c
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x40472c
mov eax, dword [0x416b44]
mov ecx, dword [0x416bbc]
mov eax, dword [eax + ecx*4]
and dword [eax + 0x121c], 0
mov eax, dword [0x416b44]
mov ecx, dword [0x416bbc]
mov eax, dword [eax + ecx*4]
mov ecx, dword [ebp - 4]
mov dword [eax + 0x1218], ecx
mov eax, dword [0x416b44]
mov ecx, dword [0x416bbc]
mov eax, dword [eax + ecx*4]
mov dword [eax + 0x1214], ebx
mov eax, dword [0x416b44]
mov ecx, dword [0x416bbc]
mov eax, dword [eax + ecx*4]
mov cx, word [0x416c54]
mov word [eax + 0x1220], cx
mov ecx, dword [0x416bbc]
lea eax, [ebp - 0xfc4]
push eax
mov eax, dword [0x416b44]
mov eax, dword [eax + ecx*4]
add eax, 8
push eax
call esi
mov ecx, dword [0x416bbc]
lea eax, [ebp - 0x19cc]
push eax
mov eax, dword [0x416b44]
mov eax, dword [eax + ecx*4]
add eax, 0x108
push eax
call esi
mov ecx, dword [0x416bbc]
lea eax, [ebp - 0x34]
push eax
mov eax, dword [0x416b44]
mov eax, dword [eax + ecx*4]
add eax, 0x208
push eax
call esi
mov eax, dword [0x416bbc]
mov ecx, dword [0x416b44]
mov ebx, dword [ecx + eax*4]
add ebx, 0x214
lea eax, [ebp - 0x9b5]
push eax
push ebx
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push 0
lea ebx, [ebx + eax + 1]
push dword [ebp + 8]
lea eax, [ebp - 0x9c0]
push 0x800
push eax
call fcn.00406c12
push 0xb
lea eax, [ebp - 0x9c0]
push str.RegDB_Old:
push eax
call fcn.00410550
add esp, 0x1c
test eax, eax
je 0x4046ab
and byte [ebx], 0
mov eax, dword [0x416b44]
mov ecx, dword [0x416bbc]
mov eax, dword [eax + ecx*4]
lea ecx, [eax + 0x214]
add eax, 0xa14
push ecx
push eax
call esi
mov eax, dword [0x416bbc]
mov ecx, dword [0x416b44]
mov eax, dword [ecx + eax*4]
mov dword [edi + 8], eax
inc dword [0x416bbc]
jmp 0x40424f
lea ebx, [ebp - 0x20d8]
lea eax, [ebp - 0x9b5]
push eax
push ebx
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push 0
lea ebx, [ebx + eax + 1]
push dword [ebp + 8]
lea eax, [ebp - 0x9c0]
push 0x800
push eax
call fcn.00406c12
push 0xb
lea eax, [ebp - 0x9c0]
push str.RegDB_Old:
push eax
call fcn.00410550
add esp, 0x1c
test eax, eax
je 0x404732
and byte [ebx], 0
lea eax, [ebp - 0x20d8]
push eax
mov eax, dword [ebp - 0xc]
add eax, 0xa14
push eax
call esi
mov eax, dword [ebp - 0xc]
mov cx, word [0x416c54]
mov word [eax + 0x1220], cx
mov dword [edi + 8], eax
jmp 0x40424f
mov eax, dword [ebp - 4]
mov dword [edi + 4], eax
mov ecx, dword [0x416c5c]
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x19cc]
push eax
lea eax, [ebp - 0xfc4]
push eax
mov eax, dword [0x416794]
push ecx
push 0x224
push dword [eax]
lea eax, [eax + ecx*4]
push eax
call fcn.0040b8e6
add esp, 0x1c
test eax, eax
jne 0x404897
mov eax, dword [0x416794]
mov ecx, dword [0x416c5c]
mov eax, dword [eax + ecx*4]
and dword [eax + 0x21c], 0
mov eax, dword [0x416794]
mov ecx, dword [0x416c5c]
mov eax, dword [eax + ecx*4]
mov dword [eax + 0x218], ebx
mov eax, dword [0x416794]
mov ecx, dword [0x416c5c]
mov eax, dword [eax + ecx*4]
mov cx, word [0x416c54]
mov word [eax + 0x220], cx
mov ecx, dword [0x416c5c]
lea eax, [ebp - 0xfc4]
push eax
mov eax, dword [0x416794]
mov eax, dword [eax + ecx*4]
add eax, 8
push eax
call esi
mov ecx, dword [0x416c5c]
lea eax, [ebp - 0x19cc]
push eax
mov eax, dword [0x416794]
mov eax, dword [eax + ecx*4]
add eax, 0x10c
push eax
call esi
mov ecx, dword [0x416c5c]
lea eax, [ebp - 0x34]
push eax
mov eax, dword [0x416794]
mov eax, dword [eax + ecx*4]
add eax, 0x20c
push eax
call esi
mov eax, dword [0x416c5c]
mov ecx, dword [0x416794]
mov eax, dword [ecx + eax*4]
mov dword [edi + 8], eax
inc dword [0x416c5c]
jmp 0x40424f
mov cx, word [0x416c54]
mov word [eax + 0x220], cx
jmp 0x40479d
push 0xb
lea eax, [ebp - 0x9c0]
push str.File_Edit:
push eax
call fcn.00410550
add esp, 0xc
test eax, eax
jne 0x404acd
lea eax, [ebp - 0x9b5]
push eax
lea eax, [ebp - 0x10c4]
push eax
call esi
push ebx
lea eax, [ebp - 0x9c0]
push dword [ebp + 8]
push edi
push eax
call fcn.00406c12
and byte [ebp - 0x16c8], 0
push 0xd
lea eax, [ebp - 0x9c0]
push str.Backup_Copy:
push eax
call fcn.00410550
add esp, 0x1c
test eax, eax
jne 0x40491c
lea eax, [ebp - 0x9b3]
push eax
lea eax, [ebp - 0x16c8]
push eax
call esi
jmp 0x40491f
mov dword [ebp - 0xc], ebx
push 2
lea eax, [ebp - 0x10c4]
pop edi
push edi
push 0x413490
push eax
call fcn.00410550
add esp, 0xc
test eax, eax
jne 0x404944
cmp dword [ebp - 0x1c], edi
je 0x406a8c
push edi
lea eax, [ebp - 0x10c4]
push 0x41348c
push eax
call fcn.00410550
add esp, 0xc
test eax, eax
jne 0x404966
cmp dword [ebp - 0x18], edi
je 0x406a8c
cmp byte [ebp - 0x16c8], 0
je 0x406a8c
lea eax, [ebp - 0x10c4]
push 0
push eax
call fcn.0040aa86
pop ecx
test eax, eax
pop ecx
jne 0x406a8c
lea eax, [ebp - 0x10c4]
push eax
lea eax, [ebp - 0xbc0]
push eax
call esi
xor ebx, ebx
xor edi, edi
cmp dword [0x416b70], ebx
jle 0x4049d2
mov eax, dword [0x416768]
push dword [eax + edi*4]
lea eax, [ebp - 0x10c4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
mov eax, dword [0x416b70]
je 0x4049ca
inc edi
cmp edi, eax
jl 0x4049a7
cmp edi, eax
jl 0x404a97
push 0x20a
call fcn.0040b7c4
mov edx, dword [0x416768]
pop ecx
mov ecx, dword [0x416b70]
mov dword [edx + ecx*4], eax
cmp dword [0x4167dc], ebx
je 0x404a0d
mov ecx, dword [0x416768]
lea eax, [ebp - 0x10c4]
push eax
mov eax, dword [0x416b70]
push dword [ecx + eax*4]
call esi
jmp 0x404a28
mov eax, dword [0x416b70]
mov ecx, dword [0x416768]
push dword [ecx + eax*4]
lea eax, [ebp - 0x10c4]
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
cmp dword [0x4167dc], ebx
je 0x404a4f
mov ecx, dword [0x416768]
lea eax, [ebp - 0x16c8]
push eax
mov eax, dword [0x416b70]
mov eax, dword [ecx + eax*4]
add eax, 0x104
push eax
call esi
jmp 0x404a70
mov eax, dword [0x416b70]
mov ecx, dword [0x416768]
mov eax, dword [ecx + eax*4]
add eax, 0x104
push eax
lea eax, [ebp - 0x16c8]
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov eax, dword [0x416b70]
mov ecx, dword [0x416768]
mov eax, dword [ecx + eax*4]
mov cx, word [0x416c54]
mov word [eax + 0x208], cx
inc dword [0x416b70]
jmp 0x406a8c
mov ecx, dword [0x416768]
mov dx, word [0x416c54]
mov eax, edi
shl eax, 2
mov ecx, dword [eax + ecx]
mov word [ecx + 0x208], dx
lea ecx, [ebp - 0x16c8]
push ecx
mov ecx, dword [0x416768]
mov eax, dword [eax + ecx]
add eax, 0x104
jmp 0x4069dd
push 0x10
lea eax, [ebp - 0x9c0]
push str.Create_Service:
push eax
call fcn.00410550
add esp, 0xc
test eax, eax
jne 0x404ba3
xor edi, edi
cmp dword [0x416b40], ebx
jle 0x404b1c
mov eax, dword [0x416c58]
push dword [eax + edi*4]
lea eax, [ebp - 0x9b0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
mov eax, dword [0x416b40]
je 0x404b18
inc edi
cmp edi, eax
jl 0x404af5
cmp edi, eax
jl 0x404b88
push 0x10c
call fcn.0040b7c4
mov edx, dword [0x416b40]
pop ecx
mov ecx, dword [0x416c58]
mov dword [ecx + edx*4], eax
mov eax, dword [0x416c58]
mov ecx, dword [0x416b40]
mov eax, dword [eax + ecx*4]
mov dword [eax + 0x104], ebx
mov eax, dword [0x416c58]
mov ecx, dword [0x416b40]
mov eax, dword [eax + ecx*4]
mov cx, word [0x416c54]
mov word [eax + 0x108], cx
mov ecx, dword [0x416c58]
lea eax, [ebp - 0x9b0]
push eax
mov eax, dword [0x416b40]
push dword [ecx + eax*4]
call esi
inc dword [0x416b40]
jmp 0x406a96
mov eax, dword [0x416c58]
mov cx, word [0x416c54]
mov eax, dword [eax + edi*4]
mov word [eax + 0x108], cx
jmp 0x406a96
push 0xc
lea eax, [ebp - 0x9c0]
push str.Add_Device:
push eax
call fcn.00410550
add esp, 0xc
test eax, eax
jne 0x404c52
xor edi, edi
cmp dword [0x416b74], ebx
jle 0x404c07
lea eax, [ebp - 0x9b4]
push eax
mov eax, dword [0x4167b0]
mov eax, dword [eax + edi*4]
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x404bfe
mov eax, dword [0x4167b0]
mov cx, word [0x416c54]
mov eax, dword [eax + edi*4]
mov word [eax + 0x26e], cx
inc edi
cmp edi, dword [0x416b74]
jl 0x404bcb
xor edi, edi
cmp dword [0x416834], ebx
jle 0x406a96
lea eax, [ebp - 0x9b4]
push eax
mov eax, dword [0x416bd0]
push dword [eax + edi*4]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x404c44
mov eax, dword [0x416bd0]
mov cx, word [0x416c54]
mov eax, dword [eax + edi*4]
mov word [eax + 0x266], cx
inc edi
cmp edi, dword [0x416834]
jl 0x404c15
jmp 0x406a96
push 0xf
lea eax, [ebp - 0x9c0]
push str.Self_Register:
push eax
call fcn.00410550
add esp, 0xc
test eax, eax
jne 0x404d61
lea eax, [ebp - 0x9b1]
push eax
lea eax, [ebp - 0xbc0]
push eax
call esi
lea eax, [ebp - 0xbc0]
push 1
push eax
call fcn.0040a8e7
pop ecx
xor edi, edi
cmp dword [0x416b74], ebx
pop ecx
jle 0x404cf6
mov eax, dword [0x4167b0]
mov eax, dword [eax + edi*4]
add eax, 8
push eax
lea eax, [ebp - 0xfc4]
push eax
call esi
lea eax, [ebp - 0xfc4]
push 1
push eax
call fcn.0040a8e7
pop ecx
lea eax, [ebp - 0xbc0]
pop ecx
push eax
lea eax, [ebp - 0xfc4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x404ced
mov eax, dword [0x4167b0]
mov cx, word [0x416c54]
mov eax, dword [eax + edi*4]
mov word [eax + 0x26c], cx
inc edi
cmp edi, dword [0x416b74]
jl 0x404c9a
xor edi, edi
cmp dword [0x416834], ebx
jle 0x406a96
mov eax, dword [0x416bd0]
push dword [eax + edi*4]
lea eax, [ebp - 0xfc4]
push eax
call esi
lea eax, [ebp - 0xfc4]
push 1
push eax
call fcn.0040a8e7
pop ecx
lea eax, [ebp - 0xbc0]
pop ecx
push eax
lea eax, [ebp - 0xfc4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x404d53
mov eax, dword [0x416bd0]
mov cx, word [0x416c54]
mov eax, dword [eax + edi*4]
mov word [eax + 0x264], cx
inc edi
cmp edi, dword [0x416834]
jl 0x404d04
jmp 0x406a96
push 9
lea eax, [ebp - 0x9c0]
push str.INI_New:
push eax
call fcn.00410550
add esp, 0xc
test eax, eax
jne 0x404f36
push ebx
lea eax, [ebp - 0x9c0]
push dword [ebp + 8]
push edi
push eax
call fcn.00406c12
push 0xa
lea eax, [ebp - 0x9c0]
push str.INI_File:
push eax
call fcn.00410550
add esp, 0x1c
test eax, eax
jne 0x40424f
push 2
lea eax, [ebp - 0x9b6]
pop edi
push edi
push 0x413490
push eax
call fcn.00410550
add esp, 0xc
test eax, eax
jne 0x404dd3
cmp dword [ebp - 0x1c], edi
je 0x404ee7
push edi
lea eax, [ebp - 0x9b6]
push 0x41348c
push eax
call fcn.00410550
add esp, 0xc
test eax, eax
jne 0x404df5
cmp dword [ebp - 0x18], edi
je 0x404ee7
xor ebx, ebx
lea eax, [ebp - 0x9b6]
push ebx
push eax
call fcn.0040aa86
pop ecx
test eax, eax
pop ecx
jne 0x404ee7
xor edi, edi
cmp dword [0x416840], ebx
jle 0x404e43
mov eax, dword [0x416770]
push dword [eax + edi*4]
lea eax, [ebp - 0x9b6]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
mov eax, dword [0x416840]
je 0x404e3b
inc edi
cmp edi, eax
jl 0x404e18
cmp edi, eax
jl 0x404ed1
push 0x10c
call fcn.0040b7c4
mov edx, dword [0x416840]
pop ecx
mov ecx, dword [0x416770]
mov dword [ecx + edx*4], eax
mov eax, dword [0x416840]
mov ecx, dword [0x416770]
mov eax, dword [ecx + eax*4]
mov dword [eax + 0x104], ebx
cmp dword [0x4167dc], ebx
je 0x404e92
mov ecx, dword [0x416770]
lea eax, [ebp - 0x9b6]
push eax
mov eax, dword [0x416840]
push dword [ecx + eax*4]
call esi
jmp 0x404ead
mov eax, dword [0x416840]
mov ecx, dword [0x416770]
push dword [ecx + eax*4]
lea eax, [ebp - 0x9b6]
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov eax, dword [0x416840]
mov ecx, dword [0x416770]
mov eax, dword [ecx + eax*4]
mov cx, word [0x416c54]
mov word [eax + 0x108], cx
inc dword [0x416840]
jmp 0x404ee7
mov eax, dword [0x416770]
mov cx, word [0x416c54]
mov eax, dword [eax + edi*4]
mov word [eax + 0x108], cx
push 0
lea eax, [ebp - 0x9c0]
push dword [ebp + 8]
push 0x800
push eax
call fcn.00406c12
push 4
lea eax, [ebp - 0x9c0]
push str.INI
push eax
call fcn.00410550
add esp, 0x1c
test eax, eax
jne 0x40424f
cmp byte [ebp - 0x9bc], 0x46
je 0x40424f
cmp byte [ebp - 0x9bc], 0x4e
jne 0x404ee7
jmp 0x40424f
push 0xa
lea eax, [ebp - 0x9c0]
push str.INI_File:
push eax
call fcn.00410550
add esp, 0xc
test eax, eax
jne 0x4051e4
push 2
lea eax, [ebp - 0x9b6]
push 0x413490
push eax
call fcn.00410550
add esp, 0xc
test eax, eax
jne 0x404f74
cmp dword [ebp - 0x1c], 2
je 0x404f94
push 2
lea eax, [ebp - 0x9b6]
push 0x41348c
push eax
call fcn.00410550
add esp, 0xc
test eax, eax
jne 0x404f99
cmp dword [ebp - 0x18], 2
jne 0x404f99
mov dword [ebp - 0xc], ebx
jmp 0x404fa0
mov dword [ebp - 0xc], 1
cmp dword [0x4167dc], ebx
je 0x404fba
lea eax, [ebp - 0x9b6]
push eax
lea eax, [ebp - 0x19cc]
push eax
call esi
jmp 0x404fce
lea eax, [ebp - 0x19cc]
push eax
lea eax, [ebp - 0x9b6]
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
push ebx
lea eax, [ebp - 0x9c0]
push dword [ebp + 8]
push edi
push eax
call fcn.00406c12
add esp, 0x10
cmp dword [ebp - 0xc], ebx
je 0x406a96
and dword [ebp - 0xc], 0
push 0xa
lea eax, [ebp - 0x9c0]
push str.INI_Sect:
push eax
call fcn.00410550
add esp, 0xc
test eax, eax
jne 0x40424f
lea eax, [ebp - 0x9b6]
push eax
lea eax, [ebp - 0xbc0]
push eax
call esi
push 0
lea eax, [ebp - 0x9c0]
push dword [ebp + 8]
push 0x800
push eax
call fcn.00406c12
push 0xa
lea eax, [ebp - 0x9c0]
push str.INI_Item:
push eax
call fcn.00410550
add esp, 0x1c
test eax, eax
jne 0x40424f
lea eax, [ebp - 0x9b6]
push eax
lea eax, [ebp - 0xfc4]
push eax
call esi
push 0
lea eax, [ebp - 0x9c0]
push dword [ebp + 8]
push 0x800
push eax
call fcn.00406c12
push 9
lea eax, [ebp - 0x9c0]
push str.INI_Val:
push eax
call fcn.00410550
add esp, 0x1c
test eax, eax
jne 0x40424f
push eax
lea eax, [ebp - 0x9c0]
push dword [ebp + 8]
push 0x800
push eax
call fcn.00406c12
push 9
lea eax, [ebp - 0x9c0]
push str.INI_Old:
push eax
call fcn.00410550
add esp, 0x1c
test eax, eax
jne 0x4050d3
mov dword [ebp - 0xc], 1
lea edi, [ebp - 0x9b7]
jmp 0x4050d8
mov edi, 0x416590
mov ecx, dword [0x4167ec]
lea eax, [ebp - 0xfc4]
push eax
lea eax, [ebp - 0xbc0]
push eax
lea eax, [ebp - 0x19cc]
push eax
mov eax, dword [0x416874]
push ecx
push 0x714
push dword [eax]
lea eax, [eax + ecx*4]
push eax
call fcn.0040b8e6
add esp, 0x1c
test eax, eax
jne 0x4051d9
mov eax, dword [0x416874]
mov ecx, dword [0x4167ec]
mov eax, dword [eax + ecx*4]
and dword [eax + 0x70c], 0
mov eax, dword [0x416874]
mov ecx, dword [0x4167ec]
mov eax, dword [eax + ecx*4]
mov cx, word [0x416c54]
mov word [eax + 0x710], cx
mov ecx, dword [0x4167ec]
lea eax, [ebp - 0x19cc]
push eax
mov eax, dword [0x416874]
mov eax, dword [eax + ecx*4]
add eax, 8
push eax
call esi
mov ecx, dword [0x4167ec]
lea eax, [ebp - 0xbc0]
push eax
mov eax, dword [0x416874]
mov eax, dword [eax + ecx*4]
add eax, 0x10c
push eax
call esi
mov ecx, dword [0x4167ec]
lea eax, [ebp - 0xfc4]
push eax
mov eax, dword [0x416874]
mov eax, dword [eax + ecx*4]
add eax, 0x20c
push eax
call esi
mov eax, dword [0x416874]
mov ecx, dword [0x4167ec]
push edi
mov eax, dword [eax + ecx*4]
add eax, 0x30c
push eax
call esi
mov eax, dword [0x4167ec]
mov ecx, dword [0x416874]
mov eax, dword [ecx + eax*4]
lea ecx, [eax + 0x30c]
add eax, 0x50c
push ecx
push eax
call esi
inc dword [0x4167ec]
jmp 0x406a8c
push edi
add eax, 0x50c
jmp 0x4069dd
push 0xe
lea eax, [ebp - 0x9c0]
push str.Execute_Path:
push eax
call fcn.00410550
add esp, 0xc
test eax, eax
je 0x405e1c
push 0x11
lea eax, [ebp - 0x9c0]
push str.Execute_Program:
push eax
call fcn.00410550
add esp, 0xc
test eax, eax
je 0x405e1c
push 0xc
lea eax, [ebp - 0x9c0]
push str.Icon_Group:
push eax
call fcn.00410550
add esp, 0xc
test eax, eax
jne 0x4053d7
lea eax, [ebp - 0x9b4]
push eax
lea eax, [ebp - 0xbc0]
push eax
call esi
push ebx
lea eax, [ebp - 0x9c0]
push dword [ebp + 8]
push edi
push eax
call fcn.00406c12
push 0xb
lea eax, [ebp - 0x9c0]
push str.Icon_Name:
push eax
call fcn.00410550
add esp, 0x1c
test eax, eax
jne 0x40424f
lea eax, [ebp - 0x9b5]
push eax
lea eax, [ebp - 0xfc4]
push eax
call esi
push 0
lea eax, [ebp - 0x9c0]
push dword [ebp + 8]
push 0x800
push eax
call fcn.00406c12
push 0xa
lea eax, [ebp - 0x9c0]
push str.Icon_Cmd:
push eax
call fcn.00410550
add esp, 0x1c
test eax, eax
jne 0x40424f
xor edi, edi
cmp dword [0x416790], edi
jle 0x405316
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea eax, [ebp - 0xbc0]
push eax
mov eax, dword [0x416800]
push dword [eax + edi*4]
call ebx
test eax, eax
jne 0x405301
lea eax, [ebp - 0xfc4]
push eax
mov eax, dword [0x416800]
mov eax, dword [eax + edi*4]
add eax, 0x100
push eax
call ebx
test eax, eax
je 0x40530a
inc edi
cmp edi, dword [0x416790]
jl 0x4052d1
cmp edi, dword [0x416790]
jl 0x4053bd
push 0x308
call fcn.0040b7c4
mov edx, dword [0x416790]
pop ecx
mov ecx, dword [0x416800]
mov dword [ecx + edx*4], eax
mov eax, dword [0x416800]
mov ecx, dword [0x416790]
mov eax, dword [eax + ecx*4]
and dword [eax + 0x300], 0
mov eax, dword [0x416800]
mov ecx, dword [0x416790]
mov eax, dword [eax + ecx*4]
mov cx, word [0x416c54]
mov word [eax + 0x304], cx
mov ecx, dword [0x416790]
lea eax, [ebp - 0xfc4]
push eax
mov eax, dword [0x416800]
mov eax, dword [eax + ecx*4]
add eax, 0x100
push eax
call esi
mov ecx, dword [0x416790]
lea eax, [ebp - 0xbc0]
push eax
mov eax, dword [0x416800]
push dword [eax + ecx*4]
call esi
mov ecx, dword [0x416800]
lea eax, [ebp - 0x9b6]
push eax
mov eax, dword [0x416790]
mov eax, dword [ecx + eax*4]
add eax, 0x200
push eax
call esi
inc dword [0x416790]
jmp 0x406a96
lea eax, [ebp - 0x9b6]
push eax
mov eax, dword [0x416800]
mov eax, dword [eax + edi*4]
add eax, 0x200
push eax
jmp 0x405b5f
push 0xc
lea eax, [ebp - 0x9c0]
push str.SubSystem:_B
push eax
call fcn.00410550
add esp, 0xc
test eax, eax
jne 0x405420
lea eax, [ebp - 0x9b5]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
call fcn.0040b7c4
pop ecx
mov dword [0x416868], eax
lea ecx, [ebp - 0x9b5]
push ecx
push eax
call esi
mov dword [0x416798], ebx
jmp 0x406a96
push 0xa
lea eax, [ebp - 0x9c0]
push str.Made_Dir:
push eax
call fcn.00410550
add esp, 0xc
test eax, eax
jne 0x405658
lea eax, [ebp - 0x9c0]
push 0x41310c
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x9b6]
push eax
lea eax, [ebp - 0xbc0]
push eax
call esi
lea eax, [ebp - 0xbc0]
push 0
push eax
call fcn.0040a8e7
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
pop ecx
pop ecx
lea eax, [ebp - 0xbc0]
push eax
call ebx
mov edi, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0xbc0]
push edi
push eax
call fcn.00410550
add esp, 0xc
test eax, eax
jne 0x4054a4
lea eax, [ebp - 0xbc0]
push eax
call ebx
and byte [eax + edi], 0
lea eax, [ebp - 0x9b6]
push eax
call ebx
cmp eax, 3
mov dword [ebp - 4], eax
jle 0x406a96
cmp byte [ebp - 0x9b6], 0x5c
jne 0x4054cb
cmp byte [ebp - 0x9b5], 0x5c
je 0x405522
cmp dword [0x4141ac], 1
jle 0x4054ea
movsx eax, byte [ebp - 0x9b6]
push 0x103
push eax
call fcn.0040c4ae
pop ecx
pop ecx
jmp 0x405500
movsx eax, byte [ebp - 0x9b6]
mov ecx, dword [str.________________________________H]
mov ax, word [ecx + eax*2]
and eax, 0x103
test eax, eax
je 0x406a96
cmp byte [ebp - 0x9b5], 0x3a
jne 0x406a96
cmp byte [ebp - 0x9b4], 0x5c
jne 0x406a96
xor edi, edi
cmp dword [0x416c48], edi
jle 0x405578
mov eax, dword [0x4167c8]
push dword [eax + edi*4]
call ebx
cmp dword [ebp - 4], eax
jge 0x405540
mov eax, dword [ebp - 4]
jmp 0x40554a
mov eax, dword [0x4167c8]
push dword [eax + edi*4]
call ebx
push eax
mov eax, dword [0x4167c8]
push dword [eax + edi*4]
lea eax, [ebp - 0x9b6]
push eax
call fcn.00410550
add esp, 0xc
test eax, eax
mov eax, dword [0x416c48]
je 0x405570
inc edi
cmp edi, eax
jl 0x40552c
cmp edi, eax
jl 0x40561d
push 0x10c
call fcn.0040b7c4
mov edx, dword [0x416c48]
pop ecx
mov ecx, dword [0x4167c8]
mov dword [ecx + edx*4], eax
mov eax, dword [0x4167c8]
mov ecx, dword [0x416c48]
mov ecx, dword [eax + ecx*4]
xor eax, eax
mov dword [ecx + 0x104], eax
mov ecx, dword [0x4167c8]
mov edx, dword [0x416c48]
mov ecx, dword [ecx + edx*4]
mov word [ecx + 0x108], ax
mov ecx, dword [0x4167c8]
mov edx, dword [0x416c48]
mov ecx, dword [ecx + edx*4]
mov dx, word [0x416c54]
mov word [ecx + 0x10a], dx
cmp dword [0x4167dc], eax
je 0x4055fd
mov ecx, dword [0x416c48]
lea eax, [ebp - 0x9b6]
push eax
mov eax, dword [0x4167c8]
push dword [eax + ecx*4]
jmp 0x405804
mov eax, dword [0x4167c8]
mov ecx, dword [0x416c48]
push dword [eax + ecx*4]
lea eax, [ebp - 0x9b6]
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
jmp 0x405806
mov eax, dword [0x4167c8]
shl edi, 2
push dword [edi + eax]
call ebx
cmp dword [ebp - 4], eax
jge 0x405634
mov eax, dword [ebp - 4]
jmp 0x40563e
mov eax, dword [0x4167c8]
push dword [edi + eax]
call ebx
mov ecx, dword [0x4167c8]
mov ecx, dword [edi + ecx]
and byte [ecx + eax], 0
mov eax, dword [0x4167c8]
mov eax, dword [edi + eax]
jmp 0x405836
push 0xb
lea eax, [ebp - 0x9c0]
push str.File_Tree:
push eax
call fcn.00410550
add esp, 0xc
test eax, eax
jne 0x405849
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp - 0x9b5]
push eax
call ebx
lea edi, [ebp + eax - 0x9b9]
push str..
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x40569e
and byte [edi], al
lea eax, [ebp - 0x9c0]
push 0x2a
push eax
call fcn.0040bf9f
pop ecx
test eax, eax
pop ecx
jne 0x4056d8
lea eax, [ebp - 0x9c0]
push 0x3f
push eax
call fcn.0040bf9f
pop ecx
test eax, eax
pop ecx
jne 0x4056d8
lea eax, [ebp - 0x9c0]
push 0x41310c
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x9b5]
push eax
call ebx
cmp eax, 3
jle 0x406a96
cmp byte [ebp - 0x9b5], 0x5c
jne 0x4056fc
cmp byte [ebp - 0x9b4], 0x5c
je 0x405753
cmp dword [0x4141ac], 1
jle 0x40571b
movsx eax, byte [ebp - 0x9b5]
push 0x103
push eax
call fcn.0040c4ae
pop ecx
pop ecx
jmp 0x405731
movsx eax, byte [ebp - 0x9b5]
mov ecx, dword [str.________________________________H]
mov ax, word [ecx + eax*2]
and eax, 0x103
test eax, eax
je 0x406a96
cmp byte [ebp - 0x9b4], 0x3a
jne 0x406a96
cmp byte [ebp - 0x9b3], 0x5c
jne 0x406a96
xor edi, edi
cmp dword [0x416c48], edi
jle 0x405788
mov eax, dword [0x4167c8]
push dword [eax + edi*4]
lea eax, [ebp - 0x9b5]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
mov eax, dword [0x416c48]
je 0x405780
inc edi
cmp edi, eax
jl 0x40575d
cmp edi, eax
jl 0x405811
push 0x10c
call fcn.0040b7c4
mov edx, dword [0x416c48]
pop ecx
mov ecx, dword [0x4167c8]
mov dword [ecx + edx*4], eax
mov eax, dword [0x4167c8]
mov ecx, dword [0x416c48]
mov eax, dword [eax + ecx*4]
and dword [eax + 0x104], 0
mov eax, dword [0x4167c8]
mov ecx, dword [0x416c48]
mov eax, dword [eax + ecx*4]
mov cx, word [0x416c54]
mov word [eax + 0x108], cx
mov eax, dword [0x4167c8]
mov ecx, dword [0x416c48]
mov eax, dword [eax + ecx*4]
mov cx, word [0x416c54]
mov word [eax + 0x10a], cx
mov ecx, dword [0x4167c8]
lea eax, [ebp - 0x9b5]
push eax
mov eax, dword [0x416c48]
push dword [ecx + eax*4]
call esi
inc dword [0x416c48]
jmp 0x406a96
mov ecx, dword [0x4167c8]
mov dx, word [0x416c54]
mov eax, edi
shl eax, 2
mov ecx, dword [eax + ecx]
mov word [ecx + 0x108], dx
mov ecx, dword [0x4167c8]
mov eax, dword [eax + ecx]
mov cx, word [0x416c54]
mov word [eax + 0x10a], cx
jmp 0x406a96
push 0xc
lea eax, [ebp - 0x9c0]
push str.RegDB_Tree:
push eax
call fcn.00410550
add esp, 0xc
test eax, eax
jne 0x4059ac
lea eax, [ebp - 0x9b4]
push eax
lea eax, [ebp - 0xfc4]
push eax
call esi
push ebx
lea eax, [ebp - 0x9c0]
push dword [ebp + 8]
push edi
push eax
call fcn.00406c12
push 0xc
lea eax, [ebp - 0x9c0]
push str.RegDB_Root:
push eax
mov dword [ebp - 4], ebx
call fcn.00410550
add esp, 0x1c
test eax, eax
jne 0x4058c8
lea eax, [ebp - 0x9b4]
push eax
call fcn.0040c5ae
push ebx
mov dword [ebp - 4], eax
push dword [ebp + 8]
lea eax, [ebp - 0x9c0]
push edi
push eax
call fcn.00406c12
add esp, 0x14
xor edi, edi
cmp dword [0x416bc8], ebx
jle 0x405913
mov eax, dword [0x416888]
push dword [eax + edi*4]
lea eax, [ebp - 0xfc4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
mov eax, dword [0x416888]
jne 0x4058fe
mov ecx, dword [eax + edi*4]
mov edx, dword [ebp - 4]
cmp edx, dword [ecx + 0x100]
je 0x405907
inc edi
cmp edi, dword [0x416bc8]
jl 0x4058d7
cmp edi, dword [0x416bc8]
jl 0x405996
push 0x10c
call fcn.0040b7c4
mov edx, dword [0x416bc8]
pop ecx
mov ecx, dword [0x416888]
mov dword [ecx + edx*4], eax
mov eax, dword [0x416888]
mov ecx, dword [0x416bc8]
mov eax, dword [eax + ecx*4]
mov dword [eax + 0x104], ebx
mov eax, dword [0x416888]
mov ecx, dword [0x416bc8]
mov eax, dword [eax + ecx*4]
mov ecx, dword [ebp - 4]
mov dword [eax + 0x100], ecx
mov eax, dword [0x416888]
mov ecx, dword [0x416bc8]
mov eax, dword [eax + ecx*4]
mov cx, word [0x416c54]
mov word [eax + 0x108], cx
mov ecx, dword [0x416888]
lea eax, [ebp - 0xfc4]
push eax
mov eax, dword [0x416bc8]
push dword [ecx + eax*4]
call esi
inc dword [0x416bc8]
jmp 0x40424f
mov eax, dword [eax + edi*4]
mov cx, word [0x416c54]
mov word [eax + 0x108], cx
jmp 0x40424f
push 4
lea eax, [ebp - 0x9c0]
push str.
push eax
call fcn.00410550
add esp, 0xc
test eax, eax
jne 0x405a17
lea eax, [ebp - 0x9c0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [0x416858]
mov edx, dword [0x416838]
add edx, ecx
mov ecx, dword [0x41676c]
sub edx, eax
dec edx
inc word [0x416c54]
movzx eax, word [0x416c54]
mov dword [0x416860], edx
mov dword [ecx + eax*4], ebx
xor eax, eax
cmp byte [ebp - 0x9bc], 0x20
sete al
mov dword [0x4167dc], eax
jmp 0x406a96
push 8
lea eax, [ebp - 0x9c0]
push str.Source:
push eax
call fcn.00410550
add esp, 0xc
test eax, eax
jne 0x405a96
lea eax, [ebp - 0x9b8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
call fcn.0040b7c4
mov edx, dword [0x41676c]
pop ecx
movzx ecx, word [0x416c54]
mov dword [edx + ecx*4], eax
mov ecx, dword [0x41676c]
lea eax, [ebp - 0x9b8]
push eax
movzx eax, word [0x416c54]
push dword [ecx + eax*4]
call esi
lea eax, [ebp - 0x9c0]
push 0x7c
push eax
call fcn.0040bf9f
pop ecx
test eax, eax
pop ecx
je 0x406a96
mov dword [0x4167f8], 1
jmp 0x406a96
push 0xf
lea eax, [ebp - 0x9c0]
push str.Uninstall_MIF:
push eax
call fcn.00410550
add esp, 0xc
test eax, eax
jne 0x405ac1
lea eax, [ebp - 0x9b1]
push eax
push 0x4168a0
jmp 0x405b5f
push 0xe
lea eax, [ebp - 0x9c0]
push str.Manufacturer:
push eax
call fcn.00410550
add esp, 0xc
test eax, eax
jne 0x405ae9
lea eax, [ebp - 0x9b2]
push eax
push 0x416920
jmp 0x405b5f
push 9
lea eax, [ebp - 0x9c0]
push str.Product:
push eax
call fcn.00410550
add esp, 0xc
test eax, eax
jne 0x405b11
lea eax, [ebp - 0x9b7]
push eax
push 0x4169a0
jmp 0x405b5f
push 0x10
lea eax, [ebp - 0x9c0]
push str.Version_Number:
push eax
call fcn.00410550
add esp, 0xc
test eax, eax
jne 0x405b39
lea eax, [ebp - 0x9b0]
push eax
push 0x416a20
jmp 0x405b5f
push 0xf
lea eax, [ebp - 0x9c0]
push str.Serial_Number:
push eax
call fcn.00410550
add esp, 0xc
test eax, eax
jne 0x405b66
lea eax, [ebp - 0x9b1]
push eax
push 0x416aa0
call esi
jmp 0x406a96
lea eax, [ebp - 0x9c0]
push str.User_Rights:_Admin
push eax
call fcn.00410600
pop ecx
test eax, eax
pop ecx
jne 0x405bbc
cmp dword [ebp - 0x24], ebx
jne 0x406a96
cmp dword [0x416778], 1
jne 0x406a96
push 1
xor ebx, ebx
pop edi
push 0xe0000000
push ebx
push ebx
mov dword [ebp - 0x24], edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
cmp eax, ebx
je 0x406aa5
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x406a96
push 0xd
lea eax, [ebp - 0x9c0]
push str.Per_User_ID:
push eax
call fcn.00410550
add esp, 0xc
test eax, eax
jne 0x405d57
mov edi, 0x100
push edi
call fcn.0040b7c4
pop ecx
mov dword [0x416850], eax
lea ecx, [ebp - 0x9b3]
push ecx
push eax
call esi
cmp dword [0x4167b8], ebx
je 0x406a96
lea eax, [ebp - 0x14]
push eax
push 0x13
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405cb4
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], edi
push eax
lea eax, [ebp - 0xbc0]
push eax
lea eax, [ebp - 0x38]
push eax
push 0
push str.Start_Menu
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x405cab
cmp byte [ebp - 0xbc0], al
je 0x405cab
lea eax, [ebp - 0xbc0]
push eax
lea eax, [ebp - 0xdc4]
push eax
call esi
lea eax, [ebp - 0xdc4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp + eax - 0xdc4]
lea ecx, [ebp - 0xdc4]
cmp eax, ecx
jbe 0x405ca7
cmp byte [eax], 0x5c
je 0x405c8d
dec eax
lea ecx, [ebp - 0xdc4]
cmp eax, ecx
ja 0x405c7d
lea ecx, [ebp - 0xdc4]
cmp eax, ecx
jbe 0x405ca7
dec eax
lea ecx, [ebp - 0xdc4]
cmp eax, ecx
jbe 0x405ca7
cmp byte [eax], 0x5c
jne 0x405c97
and byte [eax + 1], 0
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x416778], 1
jne 0x406a96
lea eax, [ebp - 0x14]
push eax
push 0x13
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x406a96
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], edi
push eax
lea eax, [ebp - 0xbc0]
push eax
lea eax, [ebp - 0x3c]
push eax
push 0
push str.Common_Start_Menu
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x405d49
cmp byte [ebp - 0xbc0], al
je 0x405d49
lea eax, [ebp - 0xbc0]
push eax
lea eax, [ebp - 0x11c8]
push eax
call esi
lea eax, [ebp - 0x11c8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp + eax - 0x11c8]
lea ecx, [ebp - 0x11c8]
cmp eax, ecx
jbe 0x405d45
cmp byte [eax], 0x5c
je 0x405d45
dec eax
jmp 0x405d33
and byte [eax + 1], 0
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x406a96
push 0x15
lea eax, [ebp - 0x9c0]
push str.Delete_in_use_files:
push eax
call fcn.00410550
add esp, 0xc
test eax, eax
jne 0x405dc3
push 2
lea eax, [ebp - 0x9ab]
push 0x41327c
push eax
call fcn.00410550
add esp, 0xc
test eax, eax
jne 0x405d9a
mov dword [0x416864], 1
jmp 0x406a96
push 2
lea eax, [ebp - 0x9ab]
push 0x413278
push eax
call fcn.00410550
add esp, 0xc
test eax, eax
jne 0x406a96
and dword [0x416864], eax
jmp 0x406a96
push 0x17
lea eax, [ebp - 0x9c0]
push str.System_Restore:_Enabled
push eax
call fcn.00410550
add esp, 0xc
test eax, eax
jne 0x405dec
mov dword [0x4167b4], 1
jmp 0x406a96
push 7
lea eax, [ebp - 0x9c0]
push 0x413258
push eax
call fcn.00410550
add esp, 0xc
test eax, eax
jne 0x406a96
lea eax, [ebp - 0x9c0]
push eax
call fcn.0040bfbe
pop ecx
jmp 0x406a96
xor eax, eax
cmp byte [ebp - 0x9b7], 0x72
mov dword [ebp - 8], ebx
setne al
dec eax
and eax, 3
add eax, 0xe
cmp dword [0x416b60], ebx
mov dword [ebp - 4], eax
jle 0x405e75
mov eax, dword [0x416814]
mov ecx, dword [ebp - 8]
push dword [eax + ecx*4]
mov eax, dword [ebp - 4]
lea eax, [ebp + eax - 0x9c0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
mov eax, dword [0x416b60]
je 0x405e6a
inc dword [ebp - 8]
cmp dword [ebp - 8], eax
jl 0x405e3d
mov ecx, dword [ebp - 8]
cmp ecx, eax
jl 0x405f47
push 0x20c
call fcn.0040b7c4
mov edx, dword [0x416b60]
pop ecx
mov ecx, dword [0x416814]
mov dword [ecx + edx*4], eax
mov eax, dword [0x416814]
mov ecx, dword [0x416b60]
mov eax, dword [eax + ecx*4]
mov dword [eax + 0x204], ebx
mov eax, dword [0x416814]
mov ecx, dword [0x416b60]
mov eax, dword [eax + ecx*4]
mov cx, word [0x416c54]
mov word [eax + 0x208], cx
mov eax, dword [ebp - 4]
mov ecx, dword [0x416b60]
lea eax, [ebp + eax - 0x9c0]
push eax
mov eax, dword [0x416814]
push dword [eax + ecx*4]
call esi
mov eax, dword [0x416b60]
mov ecx, dword [0x416814]
push ebx
mov eax, dword [ecx + eax*4]
push dword [ebp + 8]
and byte [eax + 0x104], 0
lea eax, [ebp - 0x9c0]
push edi
push eax
call fcn.00406c12
push 0xe
lea eax, [ebp - 0x9c0]
push str.Execute_Name:
push eax
call fcn.00410550
add esp, 0x1c
test eax, eax
jne 0x405f39
mov ecx, dword [0x416814]
lea eax, [ebp - 0x9b2]
push eax
mov eax, dword [0x416b60]
mov eax, dword [ecx + eax*4]
add eax, 0x104
push eax
call esi
jmp 0x405f3c
mov dword [ebp - 0xc], ebx
inc dword [0x416b60]
jmp 0x406a8c
mov eax, dword [0x416814]
mov eax, dword [eax + ecx*4]
mov cx, word [0x416c54]
mov word [eax + 0x208], cx
jmp 0x406a8c
and dword [ebp - 8], 0
and byte [ebp - 0x15c8], 0
and byte [ebp - 0xc0], 0
lea eax, [ebp - 0x9c0]
push 0x7c
push eax
call fcn.0040bf9f
mov ebx, eax
pop ecx
test ebx, ebx
pop ecx
je 0x405fa6
lea eax, [ebx + 1]
push eax
lea eax, [ebp - 0xc0]
push eax
call esi
cmp byte [ebx - 1], 0x20
jne 0x405fa3
and byte [ebx - 1], 0
jmp 0x405fa6
and byte [ebx], 0
cmp byte [ebp - 0x9c0], 0x53
jne 0x40602e
lea eax, [ebp - 0x9b4]
push eax
lea eax, [ebp - 0x1c0]
push eax
call esi
cmp dword [0x416850], 0
je 0x4060be
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp - 0xdc4]
push eax
call ebx
push eax
lea eax, [ebp - 0xdc4]
push eax
lea eax, [ebp - 0x1c0]
push eax
call fcn.00410550
add esp, 0xc
test eax, eax
jne 0x4060be
lea eax, [ebp - 0x11c8]
push eax
call ebx
push eax
lea eax, [ebp - 0x11c8]
push eax
lea eax, [ebp - 0x1c0]
push eax
call fcn.00410550
add esp, 0xc
test eax, eax
je 0x4060be
and byte [ebp - 0x1c0], 0
jmp 0x4060be
cmp byte [ebp - 0x9bb], 0x43
jne 0x406049
lea eax, [ebp - 0x9b5]
push eax
lea eax, [ebp - 0x1c0]
push eax
call esi
jmp 0x4060be
lea eax, [ebp - 0x9b0]
push eax
lea eax, [ebp - 0x1c0]
push eax
call esi
cmp dword [0x4167b8], 0
mov dword [ebp - 8], 1
je 0x4060be
lea eax, [ebp - 0x20]
push eax
push 0x1f
push 0
push dword [0x413058]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4060be
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0x100
push eax
lea eax, [ebp - 0x1bd0]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x1c0]
push 0
push eax
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4060b5
and dword [ebp - 8], eax
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
lea eax, [ebp - 0x9c0]
push ebx
push dword [ebp + 8]
push edi
push eax
call fcn.00406c12
and byte [ebp - 0xcc0], bl
push 0xb
lea eax, [ebp - 0x9c0]
push str.Link_Info:
push eax
call fcn.00410550
add esp, 0x1c
test eax, eax
jne 0x406115
lea eax, [ebp - 0x9b5]
push eax
lea eax, [ebp - 0x15c8]
push eax
call esi
push ebx
lea eax, [ebp - 0x9c0]
push dword [ebp + 8]
push edi
push eax
call fcn.00406c12
add esp, 0x10
push 0xd
lea eax, [ebp - 0x9c0]
push str.Backup_Copy:
push eax
call fcn.00410550
add esp, 0xc
test eax, eax
jne 0x40614b
lea eax, [ebp - 0x9b3]
push eax
lea eax, [ebp - 0xcc0]
push eax
call esi
mov dword [0x416b58], 1
jmp 0x40614e
mov dword [ebp - 0xc], ebx
push 2
lea eax, [ebp - 0x1c0]
pop edi
push edi
push 0x413490
push eax
call fcn.00410550
add esp, 0xc
test eax, eax
jne 0x406173
cmp dword [ebp - 0x1c], edi
je 0x4068e6
push edi
lea eax, [ebp - 0x1c0]
push 0x41348c
push eax
call fcn.00410550
add esp, 0xc
test eax, eax
jne 0x406195
cmp dword [ebp - 0x18], edi
je 0x4068e6
cmp dword [ebp - 8], ebx
je 0x4061a7
cmp byte [ebp - 0xcc0], 0
je 0x4068e6
cmp byte [ebp - 0x1c0], 0
je 0x4068e6
lea eax, [ebp - 0x1c0]
push ebx
push eax
call fcn.0040aa86
pop ecx
test eax, eax
pop ecx
jne 0x406821
lea eax, [ebp - 0x1c0]
push eax
lea eax, [ebp - 0xbc0]
push eax
call esi
lea eax, [ebp - 0xbc0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp + eax - 0xbc1]
lea ecx, [ebp - 0xbc0]
cmp eax, ecx
jbe 0x406204
cmp byte [eax], 0x5c
je 0x406209
and byte [eax], 0
dec eax
jmp 0x4061ef
cmp byte [eax], 0x5c
jne 0x40620c
and byte [eax], 0
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea eax, [ebp - 0x1cd8]
push eax
lea eax, [ebp - 0xbc0]
push eax
call ebx
test eax, eax
je 0x406528
lea eax, [ebp - 0x17cc]
push eax
lea eax, [ebp - 0xbc0]
push eax
call ebx
test eax, eax
je 0x406528
push dword [0x416804]
lea eax, [ebp - 0xbc0]
push eax
call ebx
test eax, eax
je 0x406528
lea eax, [ebp - 0x1ad0]
push eax
lea eax, [ebp - 0xbc0]
push eax
call ebx
test eax, eax
je 0x406528
mov ecx, dword [0x416b74]
xor ebx, ebx
push ebx
lea eax, [ebp - 0x1c0]
push ebx
push eax
mov eax, dword [0x4167b0]
push ecx
push 0x27c
push dword [eax]
lea eax, [eax + ecx*4]
push eax
call fcn.0040b8e6
mov edi, eax
add esp, 0x1c
cmp edi, ebx
jne 0x4064d4
mov eax, dword [0x4167b0]
mov ecx, dword [0x416b74]
mov eax, dword [eax + ecx*4]
mov word [eax + 0x274], bx
mov eax, dword [0x416b74]
mov ecx, dword [0x4167b0]
mov eax, dword [ecx + eax*4]
mov dword [eax + 0x264], ebx
cmp dword [0x4167dc], ebx
je 0x4062f3
mov ecx, dword [0x4167b0]
lea eax, [ebp - 0x1c0]
push eax
mov eax, dword [0x416b74]
mov eax, dword [ecx + eax*4]
add eax, 8
push eax
call esi
jmp 0x406312
mov eax, dword [0x416b74]
mov ecx, dword [0x4167b0]
mov eax, dword [ecx + eax*4]
add eax, 8
push eax
lea eax, [ebp - 0x1c0]
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
cmp dword [0x4167dc], ebx
je 0x406339
mov ecx, dword [0x4167b0]
lea eax, [ebp - 0xcc0]
push eax
mov eax, dword [0x416b74]
mov eax, dword [ecx + eax*4]
add eax, 0x10c
push eax
call esi
jmp 0x40635a
mov eax, dword [0x416b74]
mov ecx, dword [0x4167b0]
mov eax, dword [ecx + eax*4]
add eax, 0x10c
push eax
lea eax, [ebp - 0xcc0]
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov eax, dword [0x4167b0]
mov ecx, dword [0x416b74]
cmp dword [ebp - 4], ebx
mov eax, dword [eax + ecx*4]
mov word [eax + 0x26e], bx
mov eax, dword [0x4167b0]
mov ecx, dword [0x416b74]
mov eax, dword [eax + ecx*4]
mov word [eax + 0x26c], bx
mov eax, dword [0x4167b0]
mov ecx, dword [0x416b74]
mov eax, dword [eax + ecx*4]
mov cx, word [0x416c54]
mov word [eax + 0x270], cx
mov eax, dword [0x416b74]
mov ecx, dword [0x4167b0]
mov eax, dword [ecx + eax*4]
mov cx, word [0x416c54]
mov word [eax + 0x272], cx
jne 0x4063f7
mov eax, dword [0x4167b0]
invalid
invalid
je 0x406435
inc ecx