Function at 0x401000
Capabilities:
Accept command line arguments
Create directory
Create process on windows
Delete registry key
Get common file path
Persist via app paths registry key
Persist via default file association registry key
Query or enumerate registry value
Self delete
Set file attributes
Set registry value
Terminate process
Write and execute a file
Write file on windows

Disassembly:
sub rsp, 8
sub rsp, 0x20
jmp 0x40101f
lea rcx, [0x0040100a]
mov rdx, 0
call qword [sym.imp.USER32.DLL_FindWindowA]
add rsp, 0x20
or eax, eax
jne 0x40d7b8
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x401070
lea rdx, [0x0040104f]
jmp 0x401085
lea r8, [0x00401079]
mov r9, 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
call qword [sym.imp.SHLWAPI.DLL_SHGetValueA]
add rsp, 0x30
test eax, eax
jne 0x40d7b8
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x4010e8
lea rdx, [0x004010c7]
jmp 0x4010fd
lea r8, [0x004010f1]
mov r9, 0
mov qword [rsp + 0x20], section..data_1
mov qword [rsp + 0x28], 0x40f618
call qword [sym.imp.SHLWAPI.DLL_SHGetValueA]
add rsp, 0x30
sub rsp, 0x20
mov rcx, section..data_1
jmp 0x40113b
lea rdx, [0x00401134]
call qword [sym.imp.SHLWAPI.DLL_PathAppendA]
add rsp, 0x20
sub rsp, 0x20
mov rcx, section..data_1
mov rdx, 0x40f628
call qword [sym.imp.KERNEL32.DLL_GetBinaryTypeA]
add rsp, 0x20
cmp eax, 0
je 0x40d7b8
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_GetCommandLineA]
add rsp, 0x20
mov ebx, eax
cmp byte [ebx], 0
je 0x40a96d
cmp byte [ebx], 0x20
je 0x401195
inc ebx
jmp 0x401181
inc ebx
cmp byte [ebx], 0x20
je 0x401195
cmp byte [ebx], 0x2a
jne 0x40a96d
sub rsp, 0x20
movabs rcx, 0x80000001
jmp 0x4011cd
lea rdx, [0x004011b7]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000001
jmp 0x401204
lea rdx, [0x004011ee]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000001
jmp 0x40123b
lea rdx, [0x00401225]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000001
jmp 0x401272
lea rdx, [0x0040125c]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000001
jmp 0x4012a9
lea rdx, [0x00401293]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000001
jmp 0x4012e0
lea rdx, [0x004012ca]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000001
jmp 0x401322
lea rdx, [0x00401301]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000001
jmp 0x401366
lea rdx, [0x00401343]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000001
jmp 0x4013aa
lea rdx, [0x00401387]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000001
jmp 0x4013e4
lea rdx, [0x004013cb]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000001
jmp 0x40141d
lea rdx, [0x00401405]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000001
jmp 0x401462
lea rdx, [0x0040143e]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000001
jmp 0x4014be
lea rdx, [0x00401483]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000001
jmp 0x401520
lea rdx, [0x004014df]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000001
jmp 0x401582
lea rdx, [0x00401541]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000001
jmp 0x4015e4
lea rdx, [0x004015a3]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000002
jmp 0x40161b
lea rdx, [0x00401605]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000002
jmp 0x401652
lea rdx, [0x0040163c]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000002
jmp 0x401689
lea rdx, [0x00401673]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000002
jmp 0x4016c2
lea rdx, [0x004016aa]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000002
jmp 0x4016fc
lea rdx, [0x004016e3]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000002
jmp 0x401738
lea rdx, [0x0040171d]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000002
jmp 0x40178f
lea rdx, [0x00401759]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000002
jmp 0x4017c4
lea rdx, [0x004017b0]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000002
jmp 0x401805
lea rdx, [0x004017e5]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000002
jmp 0x401856
lea rdx, [0x00401826]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000002
jmp 0x4018b2
lea rdx, [0x00401877]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x4018f9
lea rdx, [0x004018d3]
jmp 0x401910
lea r8, [0x00401902]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x401970
lea rdx, [0x0040194a]
jmp 0x401984
lea r8, [0x00401979]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x4019e4
lea rdx, [0x004019be]
jmp 0x4019fd
lea r8, [0x004019ed]
mov r9, 4
mov qword [rsp + 0x20], 0x40e004
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x401a5d
lea rdx, [0x00401a37]
jmp 0x401a7a
lea r8, [0x00401a66]
mov r9, 4
mov qword [rsp + 0x20], 0x40e004
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x401ada
lea rdx, [0x00401ab4]
jmp 0x401af2
lea r8, [0x00401ae3]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x401b52
lea rdx, [0x00401b2c]
jmp 0x401b69
lea r8, [0x00401b5b]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x401bc9
lea rdx, [0x00401ba3]
jmp 0x401be2
lea r8, [0x00401bd2]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x401c42
lea rdx, [0x00401c1c]
jmp 0x401c5a
lea r8, [0x00401c4b]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x401cba
lea rdx, [0x00401c94]
jmp 0x401cd8
lea r8, [0x00401cc3]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x401d55
lea rdx, [0x00401d12]
jmp 0x401d6d
lea r8, [0x00401d5e]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x401dea
lea rdx, [0x00401da7]
jmp 0x401e03
lea r8, [0x00401df3]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x401e81
lea rdx, [0x00401e3d]
jmp 0x401e99
lea r8, [0x00401e8a]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x401f17
lea rdx, [0x00401ed3]
jmp 0x401f30
lea r8, [0x00401f20]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x401fb1
lea rdx, [0x00401f6a]
jmp 0x401fc9
lea r8, [0x00401fba]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40204a
lea rdx, [0x00402003]
jmp 0x402063
lea r8, [0x00402053]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x4020e3
lea rdx, [0x0040209d]
jmp 0x4020fb
lea r8, [0x004020ec]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40217b
lea rdx, [0x00402135]
jmp 0x402194
lea r8, [0x00402184]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x402212
lea rdx, [0x004021ce]
jmp 0x40222a
lea r8, [0x0040221b]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x4022a8
lea rdx, [0x00402264]
jmp 0x4022c1
lea r8, [0x004022b1]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x402340
lea rdx, [0x004022fb]
jmp 0x402358
lea r8, [0x00402349]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x4023d7
lea rdx, [0x00402392]
jmp 0x4023f0
lea r8, [0x004023e0]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x402444
lea rdx, [0x0040242a]
jmp 0x402461
lea r8, [0x0040244d]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x4024b5
lea rdx, [0x0040249b]
jmp 0x4024ce
lea r8, [0x004024be]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x402521
lea rdx, [0x00402508]
jmp 0x40253e
lea r8, [0x0040252a]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x402591
lea rdx, [0x00402578]
jmp 0x4025ad
lea r8, [0x0040259a]
mov r9, 4
mov qword [rsp + 0x20], 0x40e004
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40260a
lea rdx, [0x004025e7]
jmp 0x402623
lea r8, [0x00402613]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x402675
lea rdx, [0x0040265d]
jmp 0x402692
lea r8, [0x0040267e]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x4026f0
lea rdx, [0x004026cc]
jmp 0x402706
lea r8, [0x004026f9]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x402764
lea rdx, [0x00402740]
jmp 0x402787
lea r8, [0x0040276d]
mov r9, 4
mov qword [rsp + 0x20], 0x40e004
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x4027e5
lea rdx, [0x004027c1]
jmp 0x4027fd
lea r8, [0x004027ee]
mov r9, 4
mov qword [rsp + 0x20], 0x40e00c
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40285b
lea rdx, [0x00402837]
jmp 0x402889
lea r8, [0x00402864]
mov r9, 4
mov qword [rsp + 0x20], 0x40e004
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x4028e7
lea rdx, [0x004028c3]
jmp 0x402901
lea r8, [0x004028f0]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40295f
lea rdx, [0x0040293b]
jmp 0x40297b
lea r8, [0x00402968]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x4029d9
lea rdx, [0x004029b5]
jmp 0x4029f6
lea r8, [0x004029e2]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x402a54
lea rdx, [0x00402a30]
jmp 0x402a6b
lea r8, [0x00402a5d]
mov r9, 4
mov qword [rsp + 0x20], 0x40e010
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x402ac9
lea rdx, [0x00402aa5]
jmp 0x402ae8
lea r8, [0x00402ad2]
mov r9, 4
mov qword [rsp + 0x20], 0x40e004
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x402b46
lea rdx, [0x00402b22]
jmp 0x402b5d
lea r8, [0x00402b4f]
mov r9, 4
mov qword [rsp + 0x20], 0x40e024
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x402bbb
lea rdx, [0x00402b97]
jmp 0x402bd9
lea r8, [0x00402bc4]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x402c37
lea rdx, [0x00402c13]
jmp 0x402c4c
lea r8, [0x00402c40]
mov r9, 4
mov qword [rsp + 0x20], 0x40e008
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x402caa
lea rdx, [0x00402c86]
jmp 0x402cd3
lea r8, [0x00402cb3]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x402d31
lea rdx, [0x00402d0d]
jmp 0x402d50
lea r8, [0x00402d3a]
mov r9, 4
mov qword [rsp + 0x20], 0x40e004
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x402dae
lea rdx, [0x00402d8a]
jmp 0x402dd2
lea r8, [0x00402db7]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x402e30
lea rdx, [0x00402e0c]
jmp 0x402e56
lea r8, [0x00402e39]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x402eb4
lea rdx, [0x00402e90]
jmp 0x402ed4
lea r8, [0x00402ebd]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x402f32
sub rsp, 0x20
movabs rcx, 0x80000001
jmp 0x40a99d
lea rdx, [0x0040a97d]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40a9e7
lea rdx, [0x0040a9be]
jmp 0x40aa0b
lea r8, [0x0040a9f0]
mov r9, 1
jmp 0x40aa1d
lea rax, [0x0040aa1b]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 1
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40aa75
lea rdx, [0x0040aa4c]
jmp 0x40aa90
lea r8, [0x0040aa7e]
mov r9, 1
jmp 0x40aaa2
lea rax, [0x0040aaa0]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 1
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40aafa
lea rdx, [0x0040aad1]
jmp 0x40ab0f
lea r8, [0x0040ab03]
mov r9, 1
jmp 0x40ab21
lea rax, [0x0040ab1f]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 1
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40ab82
lea rdx, [0x0040ab50]
jmp 0x40ab94
lea r8, [0x0040ab8b]
mov r9, 1
jmp 0x40aba6
lea rax, [0x0040aba4]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 1
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40ac09
lea rdx, [0x0040abd5]
jmp 0x40ac18
lea r8, [0x0040ac12]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40ac76
lea rdx, [0x0040ac52]
jmp 0x40ac99
lea r8, [0x0040ac7f]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40acf7
lea rdx, [0x0040acd3]
jmp 0x40ad1d
lea r8, [0x0040ad00]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40ad7b
lea rdx, [0x0040ad57]
jmp 0x40ada0
lea r8, [0x0040ad84]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40adfe
lea rdx, [0x0040adda]
jmp 0x40ae1b
lea r8, [0x0040ae07]
mov r9, 4
mov qword [rsp + 0x20], 0x40e014
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40ae79
lea rdx, [0x0040ae55]
jmp 0x40ae92
lea r8, [0x0040ae82]
mov r9, 4
mov qword [rsp + 0x20], 0x40e004
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40aef0
lea rdx, [0x0040aecc]
jmp 0x40af09
lea r8, [0x0040aef9]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40af67
lea rdx, [0x0040af43]
jmp 0x40af7e
lea r8, [0x0040af70]
mov r9, 4
mov qword [rsp + 0x20], 0x40e004
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40afdc
lea rdx, [0x0040afb8]
jmp 0x40aff6
lea r8, [0x0040afe5]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40b054
lea rdx, [0x0040b030]
jmp 0x40b069
lea r8, [0x0040b05d]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40b0c7
lea rdx, [0x0040b0a3]
jmp 0x40b0e6
lea r8, [0x0040b0d0]
mov r9, 4
mov qword [rsp + 0x20], 0x40e018
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40b144
lea rdx, [0x0040b120]
jmp 0x40b161
lea r8, [0x0040b14d]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40b1bf
lea rdx, [0x0040b19b]
jmp 0x40b1d2
lea r8, [0x0040b1c8]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40b224
lea rdx, [0x0040b20c]
jmp 0x40b24f
lea r8, [0x0040b22d]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40b2a1
lea rdx, [0x0040b289]
jmp 0x40b2c9
lea r8, [0x0040b2aa]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40b31b
lea rdx, [0x0040b303]
jmp 0x40b342
lea r8, [0x0040b324]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40b394
lea rdx, [0x0040b37c]
jmp 0x40b3be
lea r8, [0x0040b39d]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40b410
lea rdx, [0x0040b3f8]
jmp 0x40b43d
lea r8, [0x0040b419]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40b48f
lea rdx, [0x0040b477]
jmp 0x40b4b6
lea r8, [0x0040b498]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40b50c
lea rdx, [0x0040b4f0]
jmp 0x40b526
lea r8, [0x0040b515]
mov r9, 4
mov qword [rsp + 0x20], 0x40e01c
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40b57c
lea rdx, [0x0040b560]
jmp 0x40b595
lea r8, [0x0040b585]
mov r9, 4
mov qword [rsp + 0x20], 0x40e020
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40b5eb
lea rdx, [0x0040b5cf]
jmp 0x40b606
lea r8, [0x0040b5f4]
mov r9, 4
mov qword [rsp + 0x20], 0x40e004
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40b65c
lea rdx, [0x0040b640]
jmp 0x40b678
lea r8, [0x0040b665]
mov r9, 4
mov qword [rsp + 0x20], 0x40e004
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40b6c9
lea rdx, [0x0040b6b2]
jmp 0x40b6d5
lea r8, [0x0040b6d2]
mov r9, 1
jmp 0x40b6ff
lea rax, [0x0040b6e5]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x19
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x20
mov rcx, 0
call qword [sym.imp.USER32.DLL_GetSystemMetrics]
add rsp, 0x20
mov dword [0x0040f620], eax
sub rsp, 0x20
mov rcx, 1
call qword [sym.imp.USER32.DLL_GetSystemMetrics]
add rsp, 0x20
mov dword [0x0040f624], eax
sub rsp, 0x20
mov rcx, 0x40f104
jmp 0x40b7a3
lea rdx, [0x0040b761]
mov r8d, dword [0x0040f620]
mov r9d, dword [0x0040f624]
call qword [sym.imp.USER32.DLL_wsprintfA]
add rsp, 0x20
sub dword [0x0040f624], 0x35
sub rsp, 0x20
mov rcx, 0x40f410
jmp 0x40b7d9
lea rdx, [0x0040b7d6]
mov r8d, dword [0x0040f624]
call qword [sym.imp.USER32.DLL_wsprintfA]
add rsp, 0x20
sub rsp, 0x20
mov rcx, 0x40f410
call qword [sym.imp.KERNEL32.DLL_lstrlenA]
add rsp, 0x20
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x40f104
jmp 0x40b824
lea r8, [0x0040b81d]
mov r9, 1
mov qword [rsp + 0x20], 0x40f410
mov dword [rsp + 0x28], eax
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x40f104
jmp 0x40b865
lea r8, [0x0040b860]
mov r9, 1
jmp 0x40b877
lea rax, [0x0040b875]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 1
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x40f104
jmp 0x40b8b3
lea r8, [0x0040b8ad]
mov r9, 1
jmp 0x40b8c5
lea rax, [0x0040b8c3]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 1
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x40f104
jmp 0x40b8ff
lea r8, [0x0040b8fb]
mov r9, 1
jmp 0x40b912
lea rax, [0x0040b90f]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 2
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x20
mov rcx, 0x40f514
jmp 0x40b941
lea rdx, [0x0040b93e]
mov r8d, dword [0x0040f620]
call qword [sym.imp.USER32.DLL_wsprintfA]
add rsp, 0x20
sub rsp, 0x20
mov rcx, 0x40f514
call qword [sym.imp.KERNEL32.DLL_lstrlenA]
add rsp, 0x20
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x40f104
jmp 0x40b98b
lea r8, [0x0040b985]
mov r9, 1
mov qword [rsp + 0x20], 0x40f514
mov dword [rsp + 0x28], eax
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
add dword [0x0040f624], 0x35
sub rsp, 0x20
mov rcx, 0x40f104
jmp 0x40ba09
lea rdx, [0x0040b9c4]
mov r8d, dword [0x0040f620]
mov r9d, dword [0x0040f624]
call qword [sym.imp.USER32.DLL_wsprintfA]
add rsp, 0x20
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x40f104
jmp 0x40ba45
lea r8, [0x0040ba3f]
mov r9, 1
jmp 0x40ba57
lea rax, [0x0040ba55]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 1
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x20
mov rcx, 0x40f104
jmp 0x40babb
lea rdx, [0x0040ba83]
mov r8d, dword [0x0040f620]
mov r9d, dword [0x0040f624]
call qword [sym.imp.USER32.DLL_wsprintfA]
add rsp, 0x20
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x40f104
jmp 0x40baf8
lea r8, [0x0040baf1]
mov r9, 1
jmp 0x40bb0c
lea rax, [0x0040bb08]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 3
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x40f104
jmp 0x40bb47
lea r8, [0x0040bb42]
mov r9, 1
jmp 0x40bb5b
lea rax, [0x0040bb57]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 3
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x40f104
jmp 0x40bb95
lea r8, [0x0040bb91]
mov r9, 1
jmp 0x40bba7
lea rax, [0x0040bba5]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 1
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x40f104
jmp 0x40bbe5
lea r8, [0x0040bbdd]
mov r9, 1
jmp 0x40bbf7
lea rax, [0x0040bbf5]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 1
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x40f104
jmp 0x40bc33
lea r8, [0x0040bc2d]
mov r9, 1
jmp 0x40bc47
lea rax, [0x0040bc43]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 3
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x20
mov rcx, 0x40f104
jmp 0x40bcab
lea rdx, [0x0040bc73]
mov r8d, dword [0x0040f620]
mov r9d, dword [0x0040f624]
call qword [sym.imp.USER32.DLL_wsprintfA]
add rsp, 0x20
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x40f104
jmp 0x40bce8
lea r8, [0x0040bce1]
mov r9, 1
jmp 0x40bcfc
lea rax, [0x0040bcf8]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 3
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x40f104
jmp 0x40bd37
lea r8, [0x0040bd32]
mov r9, 1
jmp 0x40bd49
lea rax, [0x0040bd47]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 1
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x40f104
jmp 0x40bd83
lea r8, [0x0040bd7f]
mov r9, 1
jmp 0x40bd95
lea rax, [0x0040bd93]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 1
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x40f104
jmp 0x40bdd3
lea r8, [0x0040bdcb]
mov r9, 1
jmp 0x40bde5
lea rax, [0x0040bde3]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 1
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x40f104
jmp 0x40be21
lea r8, [0x0040be1b]
mov r9, 1
jmp 0x40be36
lea rax, [0x0040be31]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x20
mov rcx, 0x40f104
jmp 0x40bea5
lea rdx, [0x0040be62]
mov r8d, dword [0x0040f620]
mov r9d, dword [0x0040f624]
call qword [sym.imp.USER32.DLL_wsprintfA]
add rsp, 0x20
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x40f104
jmp 0x40bee2
lea r8, [0x0040bedb]
mov r9, 1
jmp 0x40bef6
lea rax, [0x0040bef2]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 3
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x40f104
jmp 0x40bf31
lea r8, [0x0040bf2c]
mov r9, 1
jmp 0x40bf45
lea rax, [0x0040bf41]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 3
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x40f104
jmp 0x40bf81
lea r8, [0x0040bf7b]
mov r9, 1
jmp 0x40bf93
lea rax, [0x0040bf91]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 1
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x40f104
jmp 0x40bfcd
lea r8, [0x0040bfc9]
mov r9, 1
jmp 0x40bfe1
lea rax, [0x0040bfdd]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 3
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x40f104
jmp 0x40c01d
lea r8, [0x0040c017]
mov r9, 1
jmp 0x40c031
lea rax, [0x0040c02d]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 3
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x20
mov rcx, 0x40f104
jmp 0x40c095
lea rdx, [0x0040c05d]
mov r8d, dword [0x0040f620]
mov r9d, dword [0x0040f624]
call qword [sym.imp.USER32.DLL_wsprintfA]
add rsp, 0x20
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x40f104
jmp 0x40c0d2
lea r8, [0x0040c0cb]
mov r9, 1
jmp 0x40c0e6
lea rax, [0x0040c0e2]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 3
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x40f104
jmp 0x40c121
lea r8, [0x0040c11c]
mov r9, 1
jmp 0x40c133
lea rax, [0x0040c131]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 1
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x40f104
jmp 0x40c16d
lea r8, [0x0040c169]
mov r9, 1
jmp 0x40c17f
lea rax, [0x0040c17d]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 1
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x40f104
jmp 0x40c1bb
lea r8, [0x0040c1b5]
mov r9, 1
jmp 0x40c1d0
lea rax, [0x0040c1cb]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x20
mov rcx, 0x40f104
jmp 0x40c23c
sub rsp, 0x20
mov rcx, 0
call qword [sym.imp.KERNEL32.DLL_ExitProcess]