Function at 0x40d98b
Capabilities:
Create directory
Enumerate files on windows
Query or enumerate registry value

Disassembly:
mov eax, 0x4232a4
call fcn.00417f9c
sub esp, 0x4c0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], ecx
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
push 1
push 0x42f3c8
mov dword [0x42f3c8], ebx
mov dword [0x42f3cc], ebx
call fcn.0040ea6b
pop ecx
mov dword [0x42f3cc], eax
pop ecx
push 0x42bc28
lea ecx, [ebp - 0x18]
call fcn.004017af
mov eax, dword [eax]
cmp eax, ebx
je 0x40d9e3
mov eax, dword [eax]
jmp 0x40d9e5
xor eax, eax
lea ecx, [ebp - 0x8c]
push ecx
push eax
call dword [sym.imp.ole32.dll_CLSIDFromProgID]
lea ecx, [ebp - 0x18]
mov esi, eax
call fcn.00406e16
cmp esi, ebx
jne 0x40da2e
push 0xc
lea eax, [ebp - 0x5c]
push ebx
push eax
call fcn.00417ae0
add esp, 0xc
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x5c], 0x4256f8
push eax
push 1
push ebx
push 0x17
lea eax, [ebp - 0x8c]
push ebx
push eax
call dword [sym.imp.ole32.dll_CoCreateInstanceEx]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ecx + 0x1a4], eax
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ebx
push 1
push ebx
lea ecx, [ebp - 0x50]
mov dword [ebp - 4], ebx
call fcn.00413661
push ebx
push ebx
push ebx
push 3
push 4
push ebx
push ebx
push 0xffffffffffffffff
push dword [ebp - 0x50]
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
mov esi, dword [sym.imp.ATL.DLL_AtlModuleRegisterClassObjects]
push 1
mov edi, 0x42f190
push 0x14
push edi
call esi
push 1
push 0x14
push edi
call esi
mov dword [ebp - 0x34], ebx
mov eax, dword [ebp - 0x28]
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], ebx
lea esi, [eax + 0x230]
lea eax, [ebp - 0x14]
push eax
push 0xf003f
push ebx
push 0x42bc04
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esi], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x40daec
lea ecx, [ebp - 0x34]
call fcn.0040ed08
mov ecx, dword [ebp - 0x14]
cmp eax, ebx
mov dword [ebp - 0x34], ecx
jne 0x40daec
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], ebx
push eax
lea eax, [ebp - 0x20]
push esi
push eax
push ebx
push 0x42bbf8
push ecx
mov dword [ebp - 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [0x42f3c8]
mov ecx, dword [0x42f194]
lea edx, [ebp - 0x38c]
mov byte [ebp - 0x38c], bl
test edx, edx
je 0x40db29
cmp eax, ebx
jne 0x40db11
mov eax, ecx
cmp eax, ebx
je 0x40db29
lea ecx, [ebp - 0x38c]
push 0xff
push ecx
push 0xda
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [ebp - 0x18]
push eax
call fcn.00415058
mov esi, eax
mov eax, dword [ebp - 0x28]
pop ecx
lea edi, [eax + 0x228]
mov eax, dword [esi]
cmp eax, ebx
je 0x40db4e
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov ecx, edi
call fcn.00406e16
mov eax, dword [esi]
lea ecx, [ebp - 0x18]
mov dword [edi], eax
call fcn.00406e16
mov eax, dword [ebp - 0x28]
push 0x17
push ebx
push 0x42bbe8
lea esi, [eax + 0x200]
mov ecx, esi
call fcn.0041104b
cmp dword [esi], ebx
jne 0x40dc6c
push ecx
mov ecx, esp
mov dword [ebp - 0x30], esp
push 0x42bbb4
call fcn.004017af
push ecx
mov byte [ebp - 4], 2
mov ecx, esp
mov dword [ebp - 0x38], esp
push 0x42b554
call fcn.004017af
push ecx
mov byte [ebp - 4], 3
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x42bba8
call fcn.004017af
push ecx
mov byte [ebp - 4], 4
mov ecx, esp
mov dword [ebp - 0x20], esp
push 0x42b070
call fcn.004017af
push ebx
mov byte [ebp - 4], 1
call fcn.0040f439
mov esi, dword [0x42f3c8]
lea eax, [ebp - 0x18c]
add esp, 0x14
mov byte [ebp - 0x18c], bl
test eax, eax
mov byte [ebp - 0x28c], bl
je 0x40dc1d
cmp esi, ebx
mov eax, esi
jne 0x40dc01
mov eax, dword [0x42f194]
cmp eax, ebx
je 0x40dc1d
lea ecx, [ebp - 0x18c]
push 0xff
push ecx
push 0xe8
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [ebp - 0x28c]
test eax, eax
je 0x40dc4d
cmp esi, ebx
jne 0x40dc35
mov esi, dword [0x42f194]
cmp esi, ebx
je 0x40dc4d
lea eax, [ebp - 0x28c]
push 0xff
push eax
push 0xf2
push esi
call dword [sym.imp.USER32.dll_LoadStringA]
push dword [ebp - 0x28]
call dword [sym.imp.ATL.DLL_AtlModuleRevokeClassObjects]
call dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], bl
call fcn.0040ed08
jmp 0x40ea50
push 0x42b154
lea ecx, [ebp - 0x14]
call fcn.004017af
push ecx
lea ecx, [ebp - 0x14]
mov eax, esp
mov dword [ebp - 0x30], esp
push ecx
push eax
mov ecx, edi
mov byte [ebp - 4], 5
call fcn.00403115
mov ecx, esi
mov byte [ebp - 4], 5
call fcn.004177ce
mov ecx, eax
call fcn.00413438
cmp ax, bx
lea ecx, [ebp - 0x14]
sete byte [ebp - 0x19]
mov byte [ebp - 4], 1
call fcn.00406e16
cmp byte [ebp - 0x19], bl
je 0x40ddfe
mov dword [ebp - 0x24], ebx
mov eax, dword [0x42f3e8]
push 0x323
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 7
push dword [eax + 8]
call fcn.0040ec58
lea ecx, [ebp - 0x24]
call fcn.0040cb59
push ecx
mov ecx, esp
mov dword [ebp - 0x30], esp
push eax
call fcn.0040306a
mov ecx, esi
mov byte [ebp - 4], 7
call fcn.004177ce
mov ecx, eax
call fcn.004133dc
cmp ax, bx
jne 0x40ddf1
push ecx
mov ecx, esp
mov dword [ebp - 0x30], esp
push 0x42bb8c
call fcn.004017af
push ecx
mov byte [ebp - 4], 9
mov ecx, esp
mov dword [ebp - 0x38], esp
push 0x42b554
call fcn.004017af
push ecx
mov byte [ebp - 4], 0xa
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x42bba8
call fcn.004017af
push ecx
mov byte [ebp - 4], 0xb
mov ecx, esp
mov dword [ebp - 0x20], esp
push 0x42b070
call fcn.004017af
push ebx
mov byte [ebp - 4], 7
call fcn.0040f439
mov esi, dword [0x42f3c8]
lea eax, [ebp - 0x28c]
add esp, 0x14
mov byte [ebp - 0x28c], bl
test eax, eax
mov byte [ebp - 0x18c], bl
je 0x40dda4
cmp esi, ebx
mov eax, esi
jne 0x40dd88
mov eax, dword [0x42f194]
cmp eax, ebx
je 0x40dda4
lea ecx, [ebp - 0x28c]
push 0xff
push ecx
push 0xe8
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [ebp - 0x18c]
test eax, eax
je 0x40ddd4
cmp esi, ebx
jne 0x40ddbc
mov esi, dword [0x42f194]
cmp esi, ebx
je 0x40ddd4
lea eax, [ebp - 0x18c]
push 0xff
push eax
push 0xf4
push esi
call dword [sym.imp.USER32.dll_LoadStringA]
push dword [ebp - 0x28]
call dword [sym.imp.ATL.DLL_AtlModuleRevokeClassObjects]
call dword [sym.imp.ole32.dll_CoUninitialize]
push dword [ebp - 0x24]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x40dc5c
push dword [ebp - 0x24]
mov byte [ebp - 4], 1
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp dword [esi], ebx
jne 0x40de0c
push 0x80004003
call fcn.004178f6
mov ecx, dword [esi]
lea eax, [ebp - 0x18]
push eax
call fcn.0040362e
mov edi, eax
cmp dword [edi], ebx
mov byte [ebp - 4], 0xc
jne 0x40de2b
push 0x80004003
call fcn.004178f6
mov ecx, dword [edi]
call fcn.00413318
mov ecx, dword [ebp - 0x28]
mov byte [ebp - 4], 1
mov word [ecx + 0x1c4], ax
mov eax, dword [ebp - 0x18]
cmp eax, ebx
je 0x40de4d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [esi], ebx
jne 0x40de5b
push 0x80004003
call fcn.004178f6
mov ecx, dword [esi]
lea eax, [ebp - 0x18]
push eax
call fcn.0040362e
mov edi, eax
cmp dword [edi], ebx
mov byte [ebp - 4], 0xd
jne 0x40de7a
push 0x80004003
call fcn.004178f6
mov ecx, dword [edi]
call fcn.00413340
mov ecx, dword [ebp - 0x28]
mov byte [ebp - 4], 1
mov dword [ecx + 0x1c8], eax
mov eax, dword [ebp - 0x18]
cmp eax, ebx
je 0x40de9b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [esi], ebx
jne 0x40dea9
push 0x80004003
call fcn.004178f6
mov ecx, dword [esi]
lea eax, [ebp - 0x18]
push eax
call fcn.0040362e
mov edi, eax
cmp dword [edi], ebx
mov byte [ebp - 4], 0xe
jne 0x40dec8
push 0x80004003
call fcn.004178f6
mov ecx, dword [edi]
call fcn.00413367
mov ecx, dword [ebp - 0x28]
mov byte [ebp - 4], 1
mov dword [ecx + 0x1cc], eax
mov eax, dword [ebp - 0x18]
cmp eax, ebx
je 0x40dee9
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [esi], ebx
jne 0x40def7
push 0x80004003
call fcn.004178f6
mov ecx, dword [esi]
lea eax, [ebp - 0x18]
push eax
call fcn.0040362e
mov edi, eax
cmp dword [edi], ebx
mov byte [ebp - 4], 0xf
jne 0x40df16
push 0x80004003
call fcn.004178f6
mov ecx, dword [edi]
call fcn.0041338e
mov ecx, dword [ebp - 0x28]
mov byte [ebp - 4], 1
mov dword [ecx + 0x1d0], eax
mov eax, dword [ebp - 0x18]
cmp eax, ebx
je 0x40df37
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [esi], ebx
jne 0x40df45
push 0x80004003
call fcn.004178f6
mov ecx, dword [esi]
lea eax, [ebp - 0x18]
push eax
call fcn.0040362e
mov edi, eax
cmp dword [edi], ebx
mov byte [ebp - 4], 0x10
jne 0x40df64
push 0x80004003
call fcn.004178f6
mov ecx, dword [edi]
call fcn.004133b5
mov ecx, dword [ebp - 0x28]
mov byte [ebp - 4], 1
mov dword [ecx + 0x1d4], eax
lea ecx, [ebp - 0x18]
call fcn.00413e77
cmp dword [esi], ebx
jne 0x40df8e
push 0x80004003
call fcn.004178f6
mov esi, dword [esi]
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
call fcn.00413494
mov esi, eax
mov eax, dword [ebp - 0x28]
lea edi, [eax + 0x220]
mov eax, dword [esi]
cmp eax, ebx
je 0x40dfb6
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov ecx, edi
call fcn.00406e16
mov eax, dword [esi]
lea ecx, [ebp - 0x18]
mov dword [edi], eax
call fcn.00406e16
mov ecx, dword [edi]
cmp ecx, ebx
je 0x40dfd6
call fcn.00401863
jmp 0x40dfd8
xor eax, eax
push 0x42f160
push eax
call fcn.00417b40
pop ecx
test eax, eax
pop ecx
jne 0x40e067
push 0x42bb7c
lea ecx, [ebp - 0x14]
call fcn.004017af
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 0x11
push eax
call fcn.00415058
pop ecx
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x12
push ecx
lea ecx, [ebp - 0x18]
push ecx
mov ecx, eax
call fcn.00403115
mov esi, eax
mov eax, dword [esi]
cmp eax, ebx
je 0x40e029
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov ecx, edi
call fcn.00406e16
mov eax, dword [esi]
lea ecx, [ebp - 0x18]
mov dword [edi], eax
call fcn.00406e16
lea ecx, [ebp - 0x20]
call fcn.00406e16
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.00406e16
mov ecx, dword [edi]
cmp ecx, ebx
je 0x40e05d
call fcn.00401863
jmp 0x40e05f
xor eax, eax
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x42bb74
lea ecx, [ebp - 0x14]
call fcn.004017af
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 0x13
push eax
call fcn.00414f5a
pop ecx
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x14
push ecx
lea ecx, [ebp - 0x20]
push ecx
mov ecx, eax
call fcn.00403115
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov eax, dword [eax]
cmp eax, ebx
lea esi, [ecx + 0x224]
je 0x40e0b1
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov ecx, esi
call fcn.00406e16
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x20]
mov eax, dword [eax]
mov dword [esi], eax
call fcn.00406e16
lea ecx, [ebp - 0x3c]
call fcn.00406e16
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.00406e16
mov ecx, dword [esi]
cmp ecx, ebx
je 0x40e0e8
call fcn.00401863
jmp 0x40e0ea
xor eax, eax
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov esi, 0x42b4a8
lea ecx, [ebp - 0x14]
push esi
call fcn.004017af
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 0x15
push eax
mov eax, dword [ebp - 0x28]
lea ecx, [eax + 0x224]
call fcn.0040317a
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.00406e16
push 0x42bb6c
lea ecx, [ebp - 0x14]
call fcn.004017af
lea eax, [ebp - 0x14]
mov ecx, edi
push eax
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 4], 0x16
call fcn.00403115
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov eax, dword [eax]
cmp eax, ebx
lea edi, [ecx + 0x22c]
je 0x40e15e
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov ecx, edi
call fcn.00406e16
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x20]
mov eax, dword [eax]
mov dword [edi], eax
call fcn.00406e16
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.00406e16
mov ecx, dword [edi]
cmp ecx, ebx
je 0x40e18d
call fcn.00401863
jmp 0x40e18f
xor eax, eax
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push esi
lea ecx, [ebp - 0x14]
call fcn.004017af
lea eax, [ebp - 0x14]
mov ecx, edi
push eax
mov byte [ebp - 4], 0x17
call fcn.0040317a
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.00406e16
push 0x42bb64
lea ecx, [ebp - 0x14]
mov byte [ebp - 0x19], bl
call fcn.004017af
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 0x18
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x28]
lea ecx, [eax + 0x224]
call fcn.00403115
mov ecx, dword [eax]
mov byte [ebp - 4], 0x19
cmp ecx, ebx
je 0x40e1f6
call fcn.00401863
jmp 0x40e1f8
xor eax, eax
lea ecx, [ebp - 0x4cc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea ecx, [ebp - 0x18]
mov esi, eax
call fcn.00406e16
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.00406e16
cmp esi, 0xffffffff
je 0x40e2dd
mov eax, dword [ebp - 0x28]
lea edi, [eax + 0x208]
lea eax, [ebp - 0x4a0]
lea ecx, [ebp - 0x2c]
push eax
call fcn.004017af
push 0x42bb60
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x1a
call fcn.004017af
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x2c]
push eax
mov byte [ebp - 4], 0x1b
call fcn.004134ce
push eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00413505
push eax
lea ecx, [ebp - 0x2c]
call fcn.004061df
lea ecx, [ebp - 0x18]
call fcn.00406e16
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x1a
call fcn.00406e16
push ecx
mov ecx, dword [ebp - 0x2c]
mov eax, esp
mov dword [ebp - 0x30], esp
mov dword [eax], ecx
mov eax, dword [ebp - 0x2c]
cmp eax, ebx
je 0x40e2a4
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov ecx, edi
call fcn.00411168
lea eax, [ebp - 0x4cc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40e2c1
mov byte [ebp - 0x19], 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.00406e16
cmp byte [ebp - 0x19], bl
je 0x40e22e
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edi, dword [ebp - 0x28]
cmp word [edi + 0x1c4], 0xffff
jne 0x40e2f5
lea ecx, [edi + 0x1d8]
call fcn.00414079
lea esi, [edi + 0x204]
push 0x17
push ebx
push 0x42bb50
mov ecx, esi
call fcn.004110ea
cmp dword [esi], ebx
jne 0x40e3e4
push ecx
mov ecx, esp
mov dword [ebp - 0x30], esp
push 0x42bb20
call fcn.004017af
push ecx
mov byte [ebp - 4], 0x1c
mov ecx, esp
mov dword [ebp - 0x38], esp
push 0x42b554
call fcn.004017af
push ecx
mov byte [ebp - 4], 0x1d
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x42bba8
call fcn.004017af
push ecx
mov byte [ebp - 4], 0x1e
mov ecx, esp
mov dword [ebp - 0x20], esp
push 0x42b070
call fcn.004017af
push ebx
mov byte [ebp - 4], 1
call fcn.0040f439
mov esi, dword [0x42f3c8]
lea eax, [ebp - 0x28c]
add esp, 0x14
mov byte [ebp - 0x28c], bl
test eax, eax
mov byte [ebp - 0x18c], bl
je 0x40e3ae
cmp esi, ebx
mov eax, esi
jne 0x40e392
mov eax, dword [0x42f194]
cmp eax, ebx
je 0x40e3ae
lea ecx, [ebp - 0x28c]
push 0xff
push ecx
push 0xe8
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [ebp - 0x18c]
test eax, eax
je 0x40e3de
cmp esi, ebx
jne 0x40e3c6
mov esi, dword [0x42f194]
cmp esi, ebx
je 0x40e3de
lea eax, [ebp - 0x18c]
push 0xff
push eax
push 0xf3
push esi
call dword [sym.imp.USER32.dll_LoadStringA]
push edi
jmp 0x40dc50
push 0x42bb10
lea ecx, [ebp - 0x14]
call fcn.004017af
push ecx
lea ecx, [ebp - 0x14]
mov eax, esp
mov dword [ebp - 0x30], esp
push ecx
push eax
lea ecx, [edi + 0x228]
mov byte [ebp - 4], 0x1f
call fcn.00403115
mov ecx, esi
mov byte [ebp - 4], 0x1f
call fcn.004177ce
mov ecx, eax
call fcn.00413160
mov ecx, dword [ebp - 0x14]
cmp ax, bx
sete byte [ebp - 0x19]
cmp ecx, ebx
mov byte [ebp - 4], 1
je 0x40e434
call fcn.00401836
cmp byte [ebp - 0x19], bl
je 0x40e57c
mov dword [ebp - 0x24], ebx
mov eax, dword [0x42f3e8]
push 0x325
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x21
push dword [eax + 8]
call fcn.0040ec58
lea ecx, [ebp - 0x24]
call fcn.0040cb59
push ecx
mov ecx, esp
mov dword [ebp - 0x30], esp
push eax
call fcn.0040306a
mov ecx, esi
mov byte [ebp - 4], 0x21
call fcn.004177ce
mov ecx, eax
call fcn.00413280
cmp ax, bx
jne 0x40e56f
push ecx
mov ecx, esp
mov dword [ebp - 0x30], esp
push 0x42bae4
call fcn.004017af
push ecx
mov byte [ebp - 4], 0x23
mov ecx, esp
mov dword [ebp - 0x38], esp
push 0x42b554
call fcn.004017af
push ecx
mov byte [ebp - 4], 0x24
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x42bba8
call fcn.004017af
push ecx
mov byte [ebp - 4], 0x25
mov ecx, esp
mov dword [ebp - 0x20], esp
push 0x42b070
call fcn.004017af
push ebx
mov byte [ebp - 4], 0x21
call fcn.0040f439
mov esi, dword [0x42f3c8]
lea eax, [ebp - 0x28c]
add esp, 0x14
mov byte [ebp - 0x28c], bl
test eax, eax
mov byte [ebp - 0x18c], bl
je 0x40e524
cmp esi, ebx
mov eax, esi
jne 0x40e508
mov eax, dword [0x42f194]
cmp eax, ebx
je 0x40e524
lea ecx, [ebp - 0x28c]
push 0xff
push ecx
push 0xe8
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [ebp - 0x18c]
test eax, eax
je 0x40e554
cmp esi, ebx
jne 0x40e53c
mov esi, dword [0x42f194]
cmp esi, ebx
je 0x40e554
lea eax, [ebp - 0x18c]
push 0xff
push eax
push 0xf5
push esi
call dword [sym.imp.USER32.dll_LoadStringA]
push edi
call dword [sym.imp.ATL.DLL_AtlModuleRevokeClassObjects]
call dword [sym.imp.ole32.dll_CoUninitialize]
push dword [ebp - 0x24]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x40ea3f
push dword [ebp - 0x24]
mov byte [ebp - 4], 1
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push 0x42bad8
push edi
call fcn.0040d81a
cmp dword [edi + 0x1a8], ebx
pop ecx
pop ecx
je 0x40e59a
push 4
mov ecx, edi
call fcn.0040d96b
mov esi, dword [sym.imp.USER32.dll_SetTimer]
mov edi, 0x1f4
push 0x40f73c
push edi
push 1
push ebx
call esi
push 0x40fa14
push edi
push 2
push ebx
mov dword [ebp - 0x30], eax
call esi
mov dword [ebp - 0x38], eax
push ebx
push ebx
lea eax, [ebp - 0x7c]
push ebx
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x40e8dc
mov eax, dword [ebp - 0x78]
sub eax, 0x500
je 0x40e887
dec eax
je 0x40e74c
dec eax
je 0x40e707
dec eax
je 0x40e6df
dec eax
je 0x40e6cc
dec eax
je 0x40e6b9
dec eax
jne 0x40e8cd
mov esi, dword [ebp - 0x70]
push 0x17
push ebx
push 0x42b538
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x24], ebx
call fcn.00406271
cmp eax, ebx
jge 0x40e635
cmp eax, 0x80004002
je 0x40e635
push eax
call fcn.004178f6
mov eax, dword [esi + 0xc]
push ecx
mov ecx, esp
cmp eax, ebx
mov dword [ebp - 0x20], esp
mov dword [ecx], eax
je 0x40e64e
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x26
call fcn.004177ce
mov ecx, eax
call fcn.004069a8
mov eax, dword [ebp - 0x24]
mov ecx, 0x42f180
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
call fcn.004062ef
cmp dword [ebp - 0x24], ebx
jne 0x40e684
push 0x80004003
call fcn.004178f6
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [eax]
call dword [ecx + 4]
cmp esi, ebx
je 0x40e69f
mov ecx, esi
call fcn.0040ed1f
push esi
call fcn.0041804b
pop ecx
mov eax, dword [ebp - 0x24]
mov byte [ebp - 4], 1
cmp eax, ebx
je 0x40e8cd
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x40e8cd
mov eax, dword [ebp - 0x28]
lea ecx, [eax + 0x1d8]
call fcn.004140b9
jmp 0x40e8cd
mov eax, dword [ebp - 0x28]
lea ecx, [eax + 0x1d8]
call fcn.00414079
jmp 0x40e8cd
mov eax, dword [ebp - 0x70]
push ecx
mov esi, eax
mov ecx, esp
mov eax, dword [eax + 8]
mov dword [ebp - 0x20], esp
cmp eax, ebx
mov dword [ecx], eax
je 0x40e6fd
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
call fcn.0041055b
jmp 0x40e8ba
mov eax, dword [ebp - 0x70]
mov esi, eax
push dword [eax + 0x14]
add eax, 0xc
push dword [eax + 4]
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push eax
call fcn.00401790
push ecx
lea eax, [esi + 8]
mov ecx, esp
mov dword [ebp - 0x20], esp
push eax
call fcn.00401790
push dword [esi + 4]
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push esi
call fcn.00401790
call fcn.0041049f
add esp, 0x18
jmp 0x40e8bb
mov eax, dword [ebp - 0x70]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x24], eax
lea edi, [eax + 0xc]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x2c], eax
call fcn.00406260
push 0x42b758
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x29
call fcn.004017af
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x2c]
push eax
mov byte [ebp - 4], 0x2a
call fcn.004134ce
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
cmp ecx, ebx
mov byte [ebp - 4], 0x29
je 0x40e79a
call fcn.00401836
mov dword [ebp - 0x14], ebx
push dword [ebp - 0x20]
lea eax, [ebp - 0x3c]
lea ecx, [ebp - 0x2c]
push eax
call fcn.00413505
mov esi, eax
mov ecx, esi
call fcn.00406260
lea ecx, [ebp - 0x2c]
call fcn.00406e16
mov ecx, dword [ebp - 0x3c]
mov eax, dword [esi]
cmp ecx, ebx
mov dword [ebp - 0x2c], eax
je 0x40e7ce
call fcn.00401836
mov dword [ebp - 0x3c], ebx
push dword [ebp - 0x20]
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x2c]
push eax
call fcn.00413505
push eax
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 0x2b
call fcn.00403390
mov ecx, eax
mov byte [ebp - 4], 0x2c
call fcn.004064f2
mov esi, eax
lea eax, [ebp - 0x60]
push eax
mov byte [ebp - 4], 0x2b
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
cmp eax, ebx
jge 0x40e80f
push eax
call fcn.004178f6
mov ecx, dword [ebp - 0x18]
mov byte [ebp - 4], 0x29
cmp ecx, ebx
je 0x40e822
call fcn.00401836
mov dword [ebp - 0x18], ebx
mov eax, dword [edi]
push ecx
mov ecx, esp
cmp eax, ebx
mov dword [ebp - 0x20], esp
mov dword [ecx], eax
je 0x40e83a
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [ebp - 0x24]
push esi
push ecx
add eax, 8
mov ecx, esp
mov dword [ebp - 0x20], esp
push eax
call fcn.00401790
call fcn.004103fe
mov ecx, dword [ebp - 0x2c]
add esp, 0xc
cmp ecx, ebx
je 0x40e86e
call fcn.00401836
mov dword [ebp - 0x2c], ebx
jmp 0x40e86e
cmp dword [ebp - 0x24], ebx
mov dword [ebp - 4], 1
je 0x40e8cd
mov ecx, dword [ebp - 0x24]
call fcn.0040ed1f
push dword [ebp - 0x24]
jmp 0x40e8c7
mov eax, dword [ebp - 0x70]
push ecx
mov esi, eax
mov ecx, esp
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x20], esp
cmp eax, ebx
mov dword [ecx], eax
je 0x40e8a5
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push ecx
lea eax, [esi + 8]
mov ecx, esp
mov dword [ebp - 0x20], esp
push eax
call fcn.00401790
call fcn.0041035a
pop ecx
pop ecx
cmp esi, ebx
je 0x40e8cd
mov ecx, esi
call fcn.0040ed1f
push esi
call fcn.0041804b
pop ecx
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x40e5c1
push dword [ebp - 0x38]
mov esi, dword [sym.imp.USER32.dll_KillTimer]
push ebx
call esi
push dword [ebp - 0x30]
push ebx
call esi
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
push ecx
mov ecx, esp
mov dword [ebp - 0x30], esp
push 0x42bacc
call fcn.004017af
push ecx
mov byte [ebp - 4], 0x2e
mov ecx, esp
mov dword [ebp - 0x38], esp
push 0x42bac4
call fcn.004017af
mov byte [ebp - 4], 1
call fcn.0041035a
mov esi, dword [ebp - 0x28]
pop ecx
pop ecx
cmp word [esi + 0x1c4], 0xffff
jne 0x40e940
lea ecx, [esi + 0x1d8]
call fcn.004140b9
push 0x42bb10
lea ecx, [ebp - 0x18]
call fcn.004017af
push ecx
lea ecx, [ebp - 0x18]
lea edi, [esi + 0x228]
mov eax, esp
mov dword [ebp - 0x30], esp
push ecx
push eax
mov ecx, edi
mov byte [ebp - 4], 0x2f
call fcn.00403115
lea ecx, [esi + 0x204]
mov byte [ebp - 4], 0x2f
call fcn.004177ce
mov ecx, eax
call fcn.00413204
mov ecx, dword [ebp - 0x18]
mov byte [ebp - 4], 1
cmp ecx, ebx
je 0x40e98f
call fcn.00401836
push 0x42b154
lea ecx, [ebp - 0x14]
call fcn.004017af
push ecx
lea ecx, [ebp - 0x14]
mov eax, esp
mov dword [ebp - 0x30], esp
push ecx
push eax
mov ecx, edi
mov byte [ebp - 4], 0x31
call fcn.00403115
lea edi, [esi + 0x200]
mov byte [ebp - 4], 0x31
mov ecx, edi
call fcn.004177ce
mov ecx, eax
call fcn.00403660
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 1
cmp ecx, ebx
je 0x40e9dd
call fcn.00401836
mov dword [ebp - 0x14], ebx
push ebx
lea ecx, [esi + 0x234]
call fcn.004110c9
push ebx
mov ecx, edi
call fcn.004110c9
push ebx
lea ecx, [esi + 0x204]
call fcn.004110c9
xor edi, edi
cmp dword [0x42f184], ebx
jle 0x40ea1e
mov eax, dword [0x42f180]
mov eax, dword [eax + edi*4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
inc edi
cmp edi, dword [0x42f184]
jl 0x40ea07
mov ecx, 0x42f180
call fcn.0041119f
mov ecx, 0x42f170
call fcn.0041119f
push esi
call dword [sym.imp.ATL.DLL_AtlModuleRevokeClassObjects]
call dword [sym.imp.ole32.dll_CoUninitialize]
cmp dword [ebp - 0x34], ebx
je 0x40ea50
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x34], ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x50]
call fcn.00413617
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret