Function at 0x41d580
Capabilities:
Check if file exists
Delete registry value
Get file attributes
Move file
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60d7f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x360
mov eax, dword [0x6ec738]
push ebx
push esi
xor ebx, ebx
push edi
cmp eax, ebx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x54], ecx
mov dword [ebp - 4], ebx
jne 0x41d5ba
mov eax, 0x6ec73c
push 0x6bd550
push eax
lea eax, [ebp - 0x36c]
push 0x6bd544
push eax
call fcn.005df06c
add esp, 0x10
lea ecx, [ebp - 0x36c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41ddc2
xor eax, eax
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x44], eax
mov word [ebp - 0x40], bx
mov esi, dword [0x6ec760]
mov byte [ebp - 4], 1
cmp esi, ebx
jne 0x41d609
mov esi, 0x6ec764
mov edx, 0x6be1f0
test edx, edx
je 0x41d711
cmp esi, ebx
je 0x41d711
mov ecx, 0x6bd100
test ecx, ecx
je 0x41d711
push edx
lea ecx, [ebp - 0x1c]
call fcn.00402350
push esi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.0040e020
push 0x6bd100
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 3
call fcn.0040e020
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 4
call fcn.00401070
mov edi, dword [ebp - 0x28]
cmp edi, ebx
jne 0x41d668
lea edi, [ebp - 0x24]
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x34]
call fcn.004023d0
push eax
call fcn.005de123
mov edx, eax
push edi
mov dword [ebp - 0x58], edx
call fcn.005de123
mov edx, dword [ebp - 0x58]
add esi, edx
lea esi, [eax + esi + 3]
lea edi, [esi + esi]
push edi
call fcn.005f6c5c
mov edx, eax
add esp, 0xc
cmp edx, ebx
mov dword [ebp - 0x44], edx
je 0x41d6ea
mov ecx, edi
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea ecx, [ebp - 0x34]
call fcn.004023d0
push eax
lea ecx, [ebp - 0x28]
call fcn.004023d0
push eax
lea ecx, [ebp - 0x1c]
call fcn.004023d0
push eax
mov eax, dword [ebp - 0x44]
push esi
push eax
call fcn.005de0b3
mov ecx, dword [ebp - 0x44]
push ecx
call fcn.005de123
add esp, 0x18
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 3
call fcn.00401070
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.00401070
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.00401070
mov eax, dword [ebp - 0x44]
cmp eax, ebx
jne 0x41d718
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41dab1
mov esi, dword [0x6ec760]
test esi, esi
jne 0x41d737
mov esi, 0x6ec764
mov edx, 0x6be1ac
test edx, edx
je 0x41d83c
test esi, esi
je 0x41d83c
mov eax, 0x6bd100
test eax, eax
je 0x41d83c
push edx
lea ecx, [ebp - 0x1c]
call fcn.00402350
push esi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 5
call fcn.0040e020
mov bl, 6
push 0x6bd100
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], bl
call fcn.0040e020
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 7
call fcn.00401070
mov edi, dword [ebp - 0x28]
test edi, edi
jne 0x41d797
lea edi, [ebp - 0x24]
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x34]
call fcn.004023d0
push eax
call fcn.005de123
mov edx, eax
push edi
mov dword [ebp - 0x58], edx
call fcn.005de123
mov ecx, dword [ebp - 0x58]
add esi, ecx
lea esi, [eax + esi + 3]
lea edi, [esi + esi]
push edi
call fcn.005f6c5c
mov edx, eax
add esp, 0xc
test edx, edx
mov dword [ebp - 0x44], edx
je 0x41d819
mov ecx, edi
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea ecx, [ebp - 0x34]
call fcn.004023d0
push eax
lea ecx, [ebp - 0x28]
call fcn.004023d0
push eax
lea ecx, [ebp - 0x1c]
call fcn.004023d0
push eax
mov eax, dword [ebp - 0x44]
push esi
push eax
call fcn.005de0b3
mov ecx, dword [ebp - 0x44]
push ecx
call fcn.005de123
add esp, 0x18
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], bl
call fcn.00401070
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 5
call fcn.00401070
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.00401070
mov eax, dword [ebp - 0x44]
test eax, eax
jne 0x41d846
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41dab1
mov esi, dword [0x6ec760]
test esi, esi
jne 0x41d865
mov esi, 0x6ec764
mov edx, 0x6be0ec
test edx, edx
je 0x41d965
test esi, esi
je 0x41d965
mov eax, 0x6bd100
test eax, eax
je 0x41d965
push edx
lea ecx, [ebp - 0x1c]
call fcn.00402350
push esi
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 8
call fcn.0040e020
mov bl, 9
push 0x6bd100
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.0040e020
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0xa
call fcn.00401070
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x28]
call fcn.004023d0
push eax
call fcn.005de123
add esp, 4
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.004023d0
push eax
call fcn.005de123
add esi, edi
lea esi, [eax + esi + 3]
lea edi, [esi + esi]
push edi
call fcn.005f6c5c
mov edx, eax
add esp, 8
test edx, edx
mov dword [ebp - 0x44], edx
je 0x41d942
mov ecx, edi
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea ecx, [ebp - 0x28]
call fcn.004023d0
push eax
lea ecx, [ebp - 0x34]
call fcn.004023d0
push eax
lea ecx, [ebp - 0x1c]
call fcn.004023d0
push eax
mov eax, dword [ebp - 0x44]
push esi
push eax
call fcn.005de0b3
mov ecx, dword [ebp - 0x44]
push ecx
call fcn.005de123
add esp, 0x18
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.00401070
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 8
call fcn.00401070
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.00401070
mov eax, dword [ebp - 0x44]
test eax, eax
jne 0x41d96f
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41dab1
mov esi, dword [0x6ec760]
test esi, esi
jne 0x41d98e
mov esi, 0x6ec764
mov edx, 0x6be9a4
test edx, edx
je 0x41da8e
test esi, esi
je 0x41da8e
mov eax, 0x6bd100
test eax, eax
je 0x41da8e
push edx
lea ecx, [ebp - 0x1c]
call fcn.00402350
push esi
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0xb
call fcn.0040e020
mov bl, 0xc
push 0x6bd100
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.0040e020
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0xd
call fcn.00401070
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x28]
call fcn.004023d0
push eax
call fcn.005de123
add esp, 4
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.004023d0
push eax
call fcn.005de123
add esi, edi
lea esi, [eax + esi + 3]
lea edi, [esi + esi]
push edi
call fcn.005f6c5c
mov edx, eax
add esp, 8
test edx, edx
mov dword [ebp - 0x44], edx
je 0x41da6b
mov ecx, edi
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea ecx, [ebp - 0x28]
call fcn.004023d0
push eax
lea ecx, [ebp - 0x34]
call fcn.004023d0
push eax
lea ecx, [ebp - 0x1c]
call fcn.004023d0
push eax
mov eax, dword [ebp - 0x44]
push esi
push eax
call fcn.005de0b3
mov ecx, dword [ebp - 0x44]
push ecx
call fcn.005de123
add esp, 0x18
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.00401070
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0xb
call fcn.00401070
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.00401070
mov eax, dword [ebp - 0x44]
test eax, eax
jne 0x41da98
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41dab1
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x41dd09
jmp 0x41dab4
mov ebx, dword [ebp + 8]
lea edx, [ebp - 0x36c]
mov dword [ebp + 8], 0
push edx
call fcn.005cbd10
mov esi, eax
add esp, 4
test esi, esi
je 0x41db1d
lea eax, [ebp - 0x60]
push eax
push esi
call fcn.005cc150
add esp, 8
xor edi, edi
cmp edi, dword [ebp - 0x60]
jae 0x41db14
mov edx, dword [ebp - 0x54]
lea ecx, [ebp + 8]
push ecx
push edx
push 0x6bd100
push ebx
push esi
call fcn.0041bde0
add esp, 0x14
test eax, eax
jne 0x41db14
mov eax, dword [ebp - 0x60]
inc edi
cmp edi, eax
jae 0x41db14
push esi
call fcn.005cc5a0
add esp, 4
test eax, eax
je 0x41dadf
push esi
call fcn.005cc110
add esp, 4
mov eax, dword [ebp + 8]
test eax, eax
je 0x41dbbe
test ebx, ebx
je 0x41dbbe
mov eax, dword [0x6ed13c]
mov ecx, dword [0x6ece2c]
push 0x50035
push eax
push ecx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 4
jne 0x41dbbe
lea edx, [ebp - 0x36c]
mov dword [ebp + 8], 0
push edx
call fcn.005cbd10
mov edi, eax
add esp, 4
test edi, edi
je 0x41dbbe
lea eax, [ebp - 0x60]
push eax
push edi
call fcn.005cc150
add esp, 8
test eax, eax
jne 0x41dbbe
xor esi, esi
cmp esi, dword [ebp - 0x60]
jae 0x41dbb8
mov edx, dword [ebp - 0x54]
lea ecx, [ebp + 8]
push ecx
push edx
push 0x6bd100
push ebx
push edi
call fcn.0041bde0
add esp, 0x14
test eax, eax
jne 0x41dbb8
mov eax, dword [ebp - 0x60]
inc esi
cmp esi, eax
jae 0x41dbb8
push edi
call fcn.005cc5a0
add esp, 4
test eax, eax
je 0x41db83
push edi
jmp 0x41db15
push 0x6bd100
call fcn.0041cce0
xor eax, eax
add esp, 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], eax
mov word [ebp - 0x18], ax
mov esi, dword [0x6ec760]
mov byte [ebp - 4], 0xe
cmp esi, eax
jne 0x41dbea
mov esi, 0x6ec764
mov ecx, 0x6bc11c
test ecx, ecx
je 0x41dced
test esi, esi
je 0x41dced
mov edx, 0x6bd100
test edx, edx
je 0x41dced
push ecx
lea ecx, [ebp - 0x64]
call fcn.00402350
push esi
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0xf
call fcn.0040e020
mov bl, 0x10
push 0x6bd100
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.0040e020
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x11
call fcn.00401070
mov esi, dword [ebp - 0x5c]
lea ecx, [ebp - 0x28]
call fcn.004023d0
push eax
call fcn.005de123
add esp, 4
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.004023d0
push eax
call fcn.005de123
add esi, edi
lea esi, [eax + esi + 3]
lea edi, [esi + esi]
push edi
call fcn.005f6c5c
mov edx, eax
add esp, 8
test edx, edx
mov dword [ebp - 0x1c], edx
je 0x41dcc7
mov ecx, edi
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea ecx, [ebp - 0x28]
call fcn.004023d0
push eax
lea ecx, [ebp - 0x34]
call fcn.004023d0
push eax
lea ecx, [ebp - 0x64]
call fcn.004023d0
push eax
mov eax, dword [ebp - 0x1c]
push esi
push eax
call fcn.005de0b3
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.005de123
add esp, 0x18
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.00401070
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0xf
call fcn.00401070
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0xe
call fcn.00401070
mov eax, dword [ebp - 0x1c]
test eax, eax
jne 0x41dcf4
lea eax, [ebp - 0x18]
push eax
call fcn.0041cc60
add esp, 4
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.00401070
mov eax, dword [ebp + 0xc]
xor ebx, ebx
cmp eax, ebx
jne 0x41dde3
lea edx, [ebp + 8]
push edx
push 0xf003f
push ebx
push 0x6bd14c
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x41ddd7
lea eax, [ebp + 8]
push ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push eax
push ebx
push 0xf003f
push ebx
push 0x6ec0c8
push ebx
push 0x6bd170
push reloc.WS2_32.dll_accept
call esi
test eax, eax
jne 0x41ddb6
mov ecx, dword [ebp + 8]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call edi
lea edx, [ebp + 8]
push ebx
push edx
push ebx
push 0xf003f
push ebx
push 0x6ec0c8
push ebx
push 0x6be8d8
push reloc.WS2_32.dll_accept
call esi
test eax, eax
jne 0x41ddb6
mov eax, dword [ebp + 8]
push eax
call edi
lea ecx, [ebp + 8]
push ebx
push ecx
push ebx
push 0xf003f
push ebx
push 0x6ec0c8
push ebx
push 0x6bd14c
push reloc.WS2_32.dll_accept
call esi
test eax, eax
je 0x41dddd
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0
call fcn.00401070
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp + 8]
push edx
call edi
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x48], ebx
mov word [ebp - 0x4c], bx
mov esi, dword [0x6ec760]
mov byte [ebp - 4], 0x12
cmp esi, ebx
jne 0x41de00
mov esi, 0x6ec764
mov eax, 0x6bc11c
test eax, eax
je 0x41df00
test esi, esi
je 0x41df00
mov ecx, 0x6bd100
test ecx, ecx
je 0x41df00
push eax
lea ecx, [ebp - 0x1c]
call fcn.00402350
push esi
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x13
call fcn.0040e020
mov bl, 0x14
push 0x6bd100
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.0040e020
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0x15
call fcn.00401070
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x28]
call fcn.004023d0
push eax
call fcn.005de123
add esp, 4
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.004023d0
push eax
call fcn.005de123
add esi, edi
lea esi, [eax + esi + 3]
lea edi, [esi + esi]
push edi
call fcn.005f6c5c
mov edx, eax
add esp, 8
test edx, edx
mov dword [ebp - 0x50], edx
je 0x41dedd
mov ecx, edi
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea ecx, [ebp - 0x28]
call fcn.004023d0
push eax
lea ecx, [ebp - 0x34]
call fcn.004023d0
push eax
lea ecx, [ebp - 0x1c]
call fcn.004023d0
push eax
mov eax, dword [ebp - 0x50]
push esi
push eax
call fcn.005de0b3
mov ecx, dword [ebp - 0x50]
push ecx
call fcn.005de123
add esp, 0x18
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.00401070
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x13
call fcn.00401070
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x12
call fcn.00401070
lea edx, [ebp - 0x100]
push 0x6bcdc4
push edx
call fcn.005de2e9
lea eax, [ebp - 0x100]
push eax
call fcn.005de123
add esp, 0xc
xor ecx, ecx
cmp ecx, eax
jge 0x41df43
mov dx, word [ebp + ecx*2 - 0x100]
xor dx, 0x4d
sub edx, 0xff
mov word [ebp + ecx*2 - 0x100], dx
inc ecx
jmp 0x41df22
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x41df53
mov dword [ebp - 0x58], 1
jmp 0x41df5b
call fcn.0040fe20
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x68]
xor esi, esi
push eax
push 0x20019
push esi
xor ebx, ebx
push 0x6be6f0
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x54], ebx
mov dword [ebp + 8], esi
mov dword [ebp + 0xc], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41e029
mov ecx, 0x19
lea edi, [ebp - 0x164]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x5c]
lea edx, [ebp - 0x164]
push ecx
push edx
push eax
push eax
mov eax, dword [ebp - 0x68]
push 0x6bd028
push eax
mov dword [ebp - 0x5c], 0x64
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41e01c
lea ecx, [ebp - 0x164]
mov ebx, 1
push 0x2e
push ecx
mov dword [ebp - 0x54], ebx
call fcn.005de150
mov esi, eax
add esp, 8
test esi, esi
je 0x41e01c
lea edx, [ebp - 0x164]
mov byte [esi], 0
push edx
call fcn.005de3d3
add esp, 4
test eax, eax
je 0x41dff6
mov dword [ebp + 8], eax
inc esi
push 0x6be9a0
push esi
call fcn.005df8a0
add esp, 8
test eax, eax
je 0x41e00c
mov byte [eax], 0
push esi
call fcn.005de3d3
add esp, 4
test eax, eax
je 0x41e01c
mov dword [ebp + 0xc], eax
mov eax, dword [ebp - 0x68]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x38]
push ecx
push 0xf003f
push 0
push 0x6be978
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x41e284
lea edx, [ebp - 0x38]
push 0
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push edx
push 0
push 0xf003f
push 0
push 0x6ec0c8
push 0
push 0x6be95c
push reloc.WS2_32.dll_accept
call esi
test eax, eax
jne 0x41e48c
mov eax, dword [ebp - 0x38]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x38]
push 0
push ecx
push 0
push 0xf003f
push 0
push 0x6ec0c8
push 0
push 0x6be978
push reloc.WS2_32.dll_accept
call esi
test eax, eax
jne 0x41e48c
mov eax, dword [ebp - 0x54]
test eax, eax
je 0x41e0da
mov eax, dword [ebp + 8]
cmp eax, 2
jg 0x41e0c7
jne 0x41e0da
cmp dword [ebp + 0xc], 0x26
jl 0x41e0da
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x100]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x41e10f
mov eax, dword [ebp - 0x50]
test eax, eax
jne 0x41e261
lea eax, [ebp - 0x4c]
lea esi, [ebp - 0x4c]
push eax
call fcn.005de123
add esp, 4
lea ecx, [eax + eax + 2]
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x100]
push ecx
push esi
push 1
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, dword [0x6ec738]
test esi, esi
jne 0x41e11e
mov esi, 0x6ec73c
mov ecx, 0x6bc11c
test ecx, ecx
je 0x41e21e
test esi, esi
je 0x41e21e
mov edx, 0x6bd114
test edx, edx
je 0x41e21e
push ecx
lea ecx, [ebp - 0x1c]
call fcn.00402350
push esi
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x16
call fcn.0040e020
mov bl, 0x17
push 0x6bd114
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.0040e020
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0x18
call fcn.00401070
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x28]
call fcn.004023d0
push eax
call fcn.005de123
add esp, 4
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.004023d0
push eax
call fcn.005de123
add esi, edi
lea esi, [eax + esi + 3]
lea edi, [esi + esi]
push edi
call fcn.005f6c5c
mov edx, eax
add esp, 8
test edx, edx
mov dword [ebp - 0x50], edx
je 0x41e1fb
mov ecx, edi
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea ecx, [ebp - 0x28]
call fcn.004023d0
push eax
lea ecx, [ebp - 0x34]
call fcn.004023d0
push eax
lea ecx, [ebp - 0x1c]
call fcn.004023d0
push eax
mov eax, dword [ebp - 0x50]
push esi
push eax
call fcn.005de0b3
mov ecx, dword [ebp - 0x50]
push ecx
call fcn.005de123
add esp, 0x18
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.00401070
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x16
call fcn.00401070
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x12
call fcn.00401070
lea edx, [ebp - 0x100]
push 0x6bce14
push edx
call fcn.005de2e9
lea eax, [ebp - 0x100]
push eax
call fcn.005de123
add esp, 0xc
xor ecx, ecx
cmp ecx, eax
jge 0x41e268
mov dx, word [ebp + ecx*2 - 0x100]
xor dx, 0x4d
sub edx, 0xff
mov word [ebp + ecx*2 - 0x100], dx
inc ecx
jmp 0x41e240
mov esi, eax
jmp 0x41e0eb
mov eax, dword [ebp - 0x54]
test eax, eax
je 0x41e44d
mov eax, dword [ebp + 8]
cmp eax, 2
jg 0x41e44d
jmp 0x41e445
test ebx, ebx
je 0x41e2a8
cmp esi, 2
jg 0x41e295
jne 0x41e2a8
cmp dword [ebp + 0xc], 0x26
jl 0x41e2a8
mov edx, dword [ebp - 0x38]
lea ecx, [ebp - 0x100]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x41e2dd
mov eax, dword [ebp - 0x50]
test eax, eax
jne 0x41e42f
lea eax, [ebp - 0x4c]
lea esi, [ebp - 0x4c]
push eax
call fcn.005de123
mov edx, dword [ebp - 0x38]
add esp, 4
lea eax, [eax + eax + 2]
lea ecx, [ebp - 0x100]
push eax
push esi
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, dword [0x6ec738]
test esi, esi
jne 0x41e2ec
mov esi, 0x6ec73c
mov eax, 0x6bc11c
test eax, eax
je 0x41e3ec
test esi, esi
je 0x41e3ec
mov ecx, 0x6bd114
test ecx, ecx
je 0x41e3ec
push eax
lea ecx, [ebp - 0x1c]
call fcn.00402350
push esi
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x19
call fcn.0040e020
mov bl, 0x1a
push 0x6bd114
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.0040e020
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 0x1b
call fcn.00401070
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x28]
call fcn.004023d0
push eax
call fcn.005de123
add esp, 4
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.004023d0
push eax
call fcn.005de123
add esi, edi
lea esi, [eax + esi + 3]
lea edi, [esi + esi]
push edi
call fcn.005f6c5c
mov edx, eax
add esp, 8
test edx, edx
mov dword [ebp - 0x50], edx
je 0x41e3c9
mov ecx, edi
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea ecx, [ebp - 0x28]
call fcn.004023d0
push eax
lea ecx, [ebp - 0x34]
call fcn.004023d0
push eax
lea ecx, [ebp - 0x1c]
call fcn.004023d0
push eax
mov eax, dword [ebp - 0x50]
push esi
push eax
call fcn.005de0b3
mov ecx, dword [ebp - 0x50]
push ecx
call fcn.005de123
add esp, 0x18
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], bl
call fcn.00401070
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x19
call fcn.00401070
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x12
call fcn.00401070
lea edx, [ebp - 0x100]
push 0x6bce14
push edx
call fcn.005de2e9
lea eax, [ebp - 0x100]
push eax
call fcn.005de123
add esp, 0xc
xor ecx, ecx
cmp ecx, eax
jge 0x41e436
mov dx, word [ebp + ecx*2 - 0x100]
xor dx, 0x4d
sub edx, 0xff
mov word [ebp + ecx*2 - 0x100], dx
inc ecx
jmp 0x41e40e
mov esi, eax
jmp 0x41e2b9
mov eax, dword [ebp - 0x54]
test eax, eax
je 0x41e44d
mov eax, dword [ebp + 8]
cmp eax, 2
jg 0x41e44d
jne 0x41e482
cmp dword [ebp + 0xc], 0x26
jl 0x41e482
mov eax, dword [ebp - 0x50]
test eax, eax
je 0x41e458
mov esi, eax
jmp 0x41e45e
lea eax, [ebp - 0x4c]
lea esi, [ebp - 0x4c]
push eax
call fcn.005de123
mov edx, dword [ebp - 0x38]
add esp, 4
lea eax, [eax + eax + 2]
lea ecx, [ebp - 0x100]
push eax
push esi
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x38]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0x58]
xor esi, esi
cmp ebx, esi
je 0x41e643
mov eax, dword [ebp - 0x50]
cmp eax, esi
jne 0x41e4a3
lea eax, [ebp - 0x4c]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push eax
call edi
cmp eax, 0xffffffff
je 0x41e643
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x2c], esi
mov word [ebp - 0x30], si
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x5c], esi
mov word [ebp - 0x60], si
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x14], esi
mov word [ebp - 0x18], si
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x20], esi
mov word [ebp - 0x24], si
lea ecx, [ebp - 0x74]
call fcn.0041c830
lea ecx, [ebp - 0x80]
call fcn.0041c830
mov ecx, 0x6ec760
mov byte [ebp - 4], 0x21
call fcn.004023d0
push eax
push 0x6be950
lea ecx, [ebp - 0x34]
call fcn.0041a640
mov ecx, 0x6ec760
call fcn.004023d0
push eax
push 0x6be944
lea ecx, [ebp - 0x64]
call fcn.0041a640
mov ecx, 0x6ec760
call fcn.004023d0
push eax
push 0x6be938
lea ecx, [ebp - 0x1c]
call fcn.0041a640
mov ecx, 0x6ec760
call fcn.004023d0
push eax
push 0x6be92c
lea ecx, [ebp - 0x28]
call fcn.0041a640
mov ecx, 0x6ec760
call fcn.004023d0
push eax
push 0x6be920
lea ecx, [ebp - 0x74]
call fcn.0041a640
mov ecx, 0x6ec760
call fcn.004023d0
push eax
push 0x6be914
lea ecx, [ebp - 0x80]
call fcn.0041a640
lea ecx, [ebp - 0x34]
call fcn.004023d0
push eax
call edi
cmp eax, 0xffffffff
je 0x41e5ad
lea ecx, [ebp - 0x28]
call fcn.004023d0
push eax
lea ecx, [ebp - 0x34]
call fcn.004023d0
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileW]
push eax
call esi
jmp 0x41e5b3
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileW]
lea ecx, [ebp - 0x64]
call fcn.004023d0
push eax
call edi
cmp eax, 0xffffffff
je 0x41e5d7
lea ecx, [ebp - 0x74]
call fcn.004023d0
push eax
lea ecx, [ebp - 0x64]
call fcn.004023d0
push eax
call esi
lea ecx, [ebp - 0x1c]
call fcn.004023d0
push eax
call edi
cmp eax, 0xffffffff
je 0x41e5fb
lea ecx, [ebp - 0x80]
call fcn.004023d0
push eax
lea ecx, [ebp - 0x1c]
call fcn.004023d0
push eax
call esi
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 0x20
call fcn.00401070
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 0x1f
call fcn.00401070
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x1e
call fcn.00401070
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x1d
call fcn.00401070
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 0x1c
call fcn.00401070
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 0x12
call fcn.00401070
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 1
call fcn.00401070
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0
call fcn.00401070
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, ebx
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8