Function at 0x41d2c5
Capabilities:
Copy file
Persist via run registry key
Set file attributes
Set registry value

Disassembly:
mov eax, 0x4706e6
call fcn.004549fc
mov eax, 0x22a4
call fcn.00455140
push ebx
push esi
push edi
mov dword [ebp - 0x2c], ecx
call fcn.00401166
mov dword [ebp - 0x14], eax
xor ebx, ebx
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0xaae]
mov word [ebp - 0xab0], bx
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 0x14]
stosw word es:[edi], ax
call fcn.0042dd9a
test eax, eax
jne 0x41d45c
lea ecx, [ebp - 0xbc]
call fcn.004020b2
mov eax, dword [0x496f20]
mov dword [ebp - 4], ebx
cmp eax, ebx
jne 0x41d32d
mov eax, 0x4765fc
push eax
lea eax, [ebp - 0xab0]
push 0x497f70
push eax
call fcn.0043691c
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileW]
lea eax, [ebp - 0xab0]
push ebx
push eax
push 0x496f40
call esi
lea eax, [ebp - 0xab0]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0xab0]
lea ecx, [ebp - 0xbc]
push eax
call fcn.0040251f
push 9
xor eax, eax
pop ecx
lea edi, [ebp - 0x5e]
mov word [ebp - 0x60], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x268]
movzx eax, word [eax + 0x48]
push eax
lea eax, [ebp - 0x60]
push str._04x
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x1ab0]
push eax
lea eax, [ebp - 0x22b0]
push eax
push 0x496f40
call fcn.004366c6
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x22b0]
push eax
lea eax, [ebp - 0x1ab0]
push eax
call fcn.0043691c
lea eax, [ebp - 0x1ab0]
push str..ini
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x12ae]
mov word [ebp - 0x12b0], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x12b0]
push 0x497f70
push eax
call fcn.0043691c
lea eax, [ebp - 0x12b0]
push str..ini
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x12b0]
push ebx
push eax
lea eax, [ebp - 0x1ab0]
push eax
call esi
lea eax, [ebp - 0x12b0]
lea ecx, [ebp - 0xbc]
push eax
call fcn.0040251f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbc]
call fcn.004020df
jmp 0x41d46e
lea eax, [ebp - 0xab0]
push 0x496f40
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [str.NoSuppressRebootKey]
mov esi, 0x4765e0
mov edi, 0x4765d8
cmp eax, ebx
mov dword [ebp - 0x10c], esi
mov dword [ebp - 0xec], edi
jne 0x41d492
mov eax, 0x494ad8
lea ecx, [ebp - 0x25]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x10c]
call fcn.004011a9
mov eax, dword [str.Startup]
mov dword [ebp - 4], 1
cmp eax, ebx
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x40], edi
jne 0x41d4be
mov eax, 0x494ad8
lea ecx, [ebp - 0x1d]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x60]
call fcn.004011a9
mov ecx, dword [ebp - 0x14]
push 0xa
lea eax, [ebp - 0x10c]
push ebx
push eax
lea eax, [ebp - 0x60]
push eax
mov byte [ebp - 4], 2
call fcn.0042f43b
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x34], eax
mov byte [ebp - 4], 1
call fcn.00401093
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10c]
call fcn.00401093
lea eax, [ebp - 0x1d]
mov esi, 0x476628
mov edi, 0x476620
push ebx
push eax
lea ecx, [ebp - 0xe4]
mov dword [ebp - 0xe4], esi
mov dword [ebp - 0xc4], edi
call fcn.00403bf5
mov dword [ebp - 4], 3
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x1d]
push ebx
push eax
lea ecx, [ebp - 0x15c]
mov byte [ebp - 4], 4
mov dword [ebp - 0x15c], esi
mov dword [ebp - 0x13c], edi
call fcn.00403bf5
mov eax, dword [ebp - 0x34]
mov byte [ebp - 4], 5
sub eax, ebx
je 0x41d58a
dec eax
je 0x41d56c
dec eax
jne 0x41d5a6
mov eax, str.SoftwareMicrosoftWindowsCurrentVersionRun
jmp 0x41d571
mov eax, str.SoftwareMicrosoftWindowsCurrentVersionRunOnceEx
mov ecx, eax
test ecx, ecx
jne 0x41d57c
mov eax, 0x494ad8
push eax
lea ecx, [ebp - 0x15c]
call fcn.00403d99
jmp 0x41d5b0
mov eax, str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
mov ecx, eax
test ecx, ecx
jne 0x41d59a
mov eax, 0x494ad8
push eax
lea ecx, [ebp - 0x15c]
call fcn.00403d99
cmp dword [ebp - 0x34], 3
je 0x41ddc6
mov eax, dword [ebp - 0x154]
cmp eax, ebx
jne 0x41d5bf
mov eax, 0x476650
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
push ecx
push 0xf003f
push ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x41ddc6
lea ecx, [ebp - 0x1c]
call fcn.004112c1
mov ecx, dword [ebp - 0x10]
cmp eax, ebx
mov dword [ebp - 0x1c], ecx
jne 0x41ddc6
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c0], esi
cmp eax, ebx
mov dword [ebp - 0x1a0], edi
jne 0x41d60e
mov eax, 0x494ad8
lea ecx, [ebp - 0x25]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x1c0]
call fcn.00403cfd
cmp dword [ebp + 0xc], ebx
mov byte [ebp - 4], 6
je 0x41d644
push str._AFTERREBOOT1
call fcn.00454a24
pop ecx
push eax
push str._AFTERREBOOT1
lea ecx, [ebp - 0x1bc]
call fcn.004100fc
lea eax, [ebp + 0xf]
push ebx
push eax
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x88], esi
mov dword [ebp - 0x68], edi
call fcn.00403bf5
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 7
mov eax, dword [eax + 0x14]
dec eax
je 0x41d741
dec eax
je 0x41d6ec
dec eax
je 0x41d692
dec eax
je 0x41d688
dec eax
jne 0x41d75d
mov eax, 0x48c97c
jmp 0x41d746
mov eax, 0x48c974
jmp 0x41d746
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x2b0]
push 8
push eax
call fcn.0040a474
push eax
lea eax, [ebp - 0x134]
push 0x48b24c
push eax
mov byte [ebp - 4], 0xa
call fcn.0040c631
add esp, 0xc
push eax
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0xb
call fcn.0040249e
lea ecx, [ebp - 0x134]
mov byte [ebp - 4], 0xa
call fcn.00402424
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x2b0]
call fcn.00402424
jmp 0x41d75d
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0xb0]
push 8
push eax
call fcn.0040a474
push eax
lea eax, [ebp - 0x288]
push 0x48b280
push eax
mov byte [ebp - 4], 8
call fcn.0040c631
add esp, 0xc
push eax
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 9
call fcn.0040249e
lea ecx, [ebp - 0x288]
mov byte [ebp - 4], 8
call fcn.00402424
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xb0]
jmp 0x41d6e5
mov eax, 0x48b31c
mov ecx, eax
test ecx, ecx
jne 0x41d751
mov eax, 0x494ad8
push eax
lea ecx, [ebp - 0x88]
call fcn.00403d99
mov ecx, dword [ebp - 0x14]
call fcn.0042dd9a
test eax, eax
mov eax, 0x48c96c
jne 0x41d773
mov eax, 0x494ad8
cmp eax, ebx
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x40], edi
jne 0x41d782
mov eax, 0x494ad8
lea ecx, [ebp - 0x35]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x60]
call fcn.00403cfd
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x10c]
push eax
mov byte [ebp - 4], 0xc
call fcn.0042affa
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 0xd
call fcn.0042b22f
cmp eax, ebx
mov dword [ebp - 0x260], esi
mov dword [ebp - 0x240], edi
jne 0x41d7c4
mov eax, 0x494ad8
lea ecx, [ebp - 0x38]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x260]
call fcn.00403cfd
mov eax, 0x497f70
mov byte [ebp - 4], 0xe
test eax, eax
mov dword [ebp - 0x238], esi
mov dword [ebp - 0x218], edi
jne 0x41d7f3
mov eax, 0x494ad8
lea ecx, [ebp - 0x37]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x238]
call fcn.00403cfd
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 0xf
call fcn.0042dd9a
test eax, eax
je 0x41d892
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x54], ebx
jne 0x41d892
mov edx, dword [ebp - 0x58]
mov eax, 0x476650
cmp edx, ebx
jne 0x41d82a
mov edx, eax
mov ecx, dword [ebp - 0x1b8]
mov dword [ebp + 8], eax
cmp ecx, ebx
je 0x41d83a
mov dword [ebp + 8], ecx
mov ecx, dword [ebp - 0x230]
mov dword [ebp - 0x10], eax
cmp ecx, ebx
je 0x41d84a
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x258]
mov dword [ebp - 0x2c], eax
cmp ecx, ebx
je 0x41d85a
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x80]
cmp ecx, ebx
jne 0x41d863
mov ecx, eax
cmp dword [ebp - 0x104], ebx
je 0x41d871
mov eax, dword [ebp - 0x104]
push edx
mov edx, dword [ebp - 0x14]
push dword [ebp + 8]
mov edx, dword [edx + 0x268]
push dword [ebp - 0x10]
movzx edx, word [edx + 0x48]
push dword [ebp - 0x2c]
push edx
push ecx
push eax
push str.__s___k__s__l_d__t__s___e__s___w__v__s___s
jmp 0x41d906
mov edx, dword [ebp - 0x58]
mov eax, 0x476650
cmp edx, ebx
jne 0x41d8a0
mov edx, eax
mov ecx, dword [ebp - 0x1b8]
mov dword [ebp + 8], eax
cmp ecx, ebx
je 0x41d8b0
mov dword [ebp + 8], ecx
mov ecx, dword [ebp - 0x230]
mov dword [ebp - 0x2c], eax
cmp ecx, ebx
je 0x41d8c0
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x258]
mov dword [ebp - 0x10], eax
cmp ecx, ebx
je 0x41d8d0
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x80]
cmp ecx, ebx
jne 0x41d8d9
mov ecx, eax
cmp dword [ebp - 0x104], ebx
je 0x41d8e7
mov eax, dword [ebp - 0x104]
push edx
mov edx, dword [ebp - 0x14]
push dword [ebp + 8]
mov edx, dword [edx + 0x268]
push dword [ebp - 0x2c]
movzx edx, word [edx + 0x48]
push dword [ebp - 0x10]
push edx
push ecx
push eax
push str.__s___s__l_d__t__s___e__s___v__s___s
lea eax, [ebp - 0xe4]
push eax
call fcn.0040fb33
mov ecx, dword [ebp - 0x14]
add esp, 0x24
lea eax, [ebp - 0xb0]
push eax
call fcn.0041df89
cmp dword [eax + 0xc], ebx
lea ecx, [ebp - 0xb0]
setne byte [ebp + 0xb]
call fcn.00402424
cmp byte [ebp + 0xb], bl
je 0x41d9cc
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x2b0]
push eax
call fcn.0041df89
push eax
lea eax, [ebp - 0x288]
push str.__debuglog_
push eax
mov byte [ebp - 4], 0x10
call fcn.0040c631
push 0x48b634
push eax
lea eax, [ebp - 0xb0]
mov byte [ebp - 4], 0x11
push eax
call fcn.0040ffd5
add esp, 0x18
push dword [0x476630]
mov ecx, eax
add eax, 4
mov byte [ebp - 4], 0x12
neg ecx
sbb ecx, ecx
push ebx
and ecx, eax
push ecx
lea ecx, [ebp - 0xe0]
call fcn.0040b08e
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0x11
call fcn.00402424
lea ecx, [ebp - 0x288]
mov byte [ebp - 4], 0x10
call fcn.00402424
lea ecx, [ebp - 0x2b0]
mov byte [ebp - 4], 0xf
call fcn.00402424
cmp dword [ebp - 0x34], 1
jne 0x41da08
lea eax, [ebp - 0x2c]
mov dword [ebp + 8], ebx
push eax
lea eax, [ebp + 8]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.0001
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
jne 0x41da08
lea ecx, [ebp - 0x1c]
call fcn.004112c1
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c0]
push ebx
push eax
lea ecx, [ebp - 0x1e8]
mov dword [ebp - 0x1e8], esi
mov dword [ebp - 0x1c8], edi
call fcn.00403c6a
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 0x13
call fcn.0042b22f
cmp eax, ebx
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x1f0], edi
jne 0x41da48
mov eax, 0x494ad8
lea ecx, [ebp + 0xb]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x210]
call fcn.00403cfd
mov eax, 0x497f70
mov byte [ebp - 4], 0x14
test eax, eax
mov dword [ebp - 0x198], esi
mov dword [ebp - 0x178], edi
jne 0x41da77
mov eax, 0x494ad8
lea ecx, [ebp - 0x36]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x198]
call fcn.00403cfd
cmp dword [ebp - 0x204], ebx
mov byte [ebp - 4], 0x15
je 0x41dab2
lea eax, [ebp - 0xb0]
push ebx
push eax
lea ecx, [ebp - 0x210]
call fcn.00415d1d
lea ecx, [ebp - 0xb0]
call fcn.00402424
cmp dword [ebp - 0x18c], ebx
je 0x41dad8
lea eax, [ebp - 0xb0]
push ebx
push eax
lea ecx, [ebp - 0x198]
call fcn.00415d1d
lea ecx, [ebp - 0xb0]
call fcn.00402424
mov esi, dword [ebp - 0xdc]
cmp esi, ebx
jne 0x41dae7
mov esi, 0x476650
lea eax, [ebp - 0x15]
push 1
push eax
push str.C:Codebasesisdev_srcRuntimeMSISharedSetupmsiaction.cpp
lea ecx, [ebp - 0xb0]
call fcn.00401889
mov eax, dword [eax + 8]
mov byte [ebp - 4], 0x16
cmp eax, ebx
jne 0x41db0d
mov eax, 0x4765fc
mov dword [ebp - 0x30], eax
push esi
lea eax, [ebp - 0x30]
push str.MsiAction::Reboot_command_line__s
push eax
mov dword [ebp - 0x2c], 0x70d
call fcn.0040a580
add esp, 0xc
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0x15
call fcn.00401093
mov dword [ebp - 0x24], ebx
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 0x17
push eax
push 0xf003f
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x2c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, ebx
jne 0x41dcf7
lea ecx, [ebp - 0x24]
call fcn.004112c1
mov ecx, dword [ebp - 0x2c]
cmp eax, ebx
mov dword [ebp - 0x24], ecx
jne 0x41dcf7
mov eax, dword [ebp - 0x208]
mov dword [ebp - 0x10], 0x476650
cmp eax, ebx
je 0x41db9a
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
call edi
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0x10]
push 1
push ebx
push str._IS_T_
push dword [ebp - 0x24]
call esi
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x10], 0x476650
cmp eax, ebx
je 0x41dbc8
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
call edi
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0x10]
push 1
push ebx
push str._IS_E_
push dword [ebp - 0x24]
call esi
cmp dword [ebp - 0x1dc], ebx
je 0x41dc18
mov eax, dword [ebp - 0x1e0]
mov dword [ebp - 0x10], 0x476650
cmp eax, ebx
je 0x41dbfe
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
call edi
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0x10]
push 1
push ebx
push str._IS_V_
push dword [ebp - 0x24]
call esi
cmp dword [ebp - 0x24], ebx
je 0x41dc29
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x24], ebx
lea eax, [ebp - 0x15]
push 1
push eax
push str._IS_T_
lea ecx, [ebp - 0x134]
call fcn.00403cfd
lea eax, [ebp - 0x134]
lea ecx, [ebp - 0xe4]
push eax
lea eax, [ebp - 0x210]
push eax
mov byte [ebp - 4], 0x18
call fcn.00404b65
lea ecx, [ebp - 0x134]
mov byte [ebp - 4], 0x17
call fcn.00402424
lea eax, [ebp - 0x15]
push 1
push eax
push str._IS_E_
lea ecx, [ebp - 0x134]
call fcn.00403cfd
lea eax, [ebp - 0x134]
lea ecx, [ebp - 0xe4]
push eax
lea eax, [ebp - 0x198]
push eax
mov byte [ebp - 4], 0x19
call fcn.00404b65
lea ecx, [ebp - 0x134]
mov byte [ebp - 4], 0x17
call fcn.00402424
cmp dword [ebp - 0x1dc], ebx
je 0x41dcf7
lea eax, [ebp - 0x15]
push 1
push eax
push str._IS_V_
lea ecx, [ebp - 0x134]
call fcn.00403cfd
lea eax, [ebp - 0x134]
lea ecx, [ebp - 0xe4]
push eax
lea eax, [ebp - 0x1e8]
push eax
mov byte [ebp - 4], 0x1a
call fcn.00404b65
lea ecx, [ebp - 0x134]
mov byte [ebp - 4], 0x17
call fcn.00402424
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x10], 0x476650
cmp eax, ebx
je 0x41dd0b
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
call edi
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0x10]
push 1
push ebx
push str.ISSetup
push dword [ebp - 0x1c]
call esi
cmp dword [ebp - 0x1c], ebx
je 0x41dd36
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x15
call fcn.004112c1
lea ecx, [ebp - 0x198]
mov byte [ebp - 4], 0x14
call fcn.00402424
lea ecx, [ebp - 0x210]
mov byte [ebp - 4], 0x13
call fcn.00402424
lea ecx, [ebp - 0x1e8]
mov byte [ebp - 4], 0xf
call fcn.00402424
lea ecx, [ebp - 0x238]
mov byte [ebp - 4], 0xe
call fcn.00402424
lea ecx, [ebp - 0x260]
mov byte [ebp - 4], 0xd
call fcn.00402424
lea ecx, [ebp - 0x10c]
mov byte [ebp - 4], 0xc
call fcn.00402424
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 7
call fcn.00402424
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 6
call fcn.00402424
lea ecx, [ebp - 0x1c0]
mov byte [ebp - 4], 5
call fcn.00402424
xor eax, eax
lea edi, [ebp - 0x16e]
mov word [ebp - 0x170], bx
mov dword [ebp - 0x60], 0x4765e0
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [str.Type]
mov dword [ebp - 0x40], 0x4765d8
cmp eax, ebx
jne 0x41ddf7
mov eax, 0x494ad8
lea ecx, [ebp + 0xb]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x60]
call fcn.004011a9
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x288]
push 5
push eax
mov ecx, esi
mov byte [ebp - 4], 0x1b
call fcn.0040a474
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0x1c
push ecx
mov ecx, eax
call fcn.004247c7
push 0xa
lea ecx, [ebp - 0x60]
push ebx
push ecx
push eax
mov ecx, esi
mov byte [ebp - 4], 0x1d
call fcn.0042f43b
lea ecx, [ebp - 0xb0]
mov edi, eax
mov byte [ebp - 4], 0x1c
call fcn.00401093
lea ecx, [ebp - 0x288]
mov byte [ebp - 4], 0x1b
call fcn.00402424
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 5
call fcn.00401093
push 0xb
mov ecx, esi
call fcn.0040a44f
test al, al
jne 0x41de88
cmp edi, 1
je 0x41de88
cmp edi, 2
jne 0x41df21
push 4
lea eax, [ebp - 0x170]
push 0x48c858
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [ebp - 0x80]
call fcn.004028ee
lea eax, [ebp - 0xab0]
lea ecx, [ebp - 0x80]
push eax
mov byte [ebp - 4], 0x1e
call fcn.00402936
lea eax, [ebp - 0xb0]
push 5
push eax
mov ecx, esi
call fcn.0040a474
mov eax, dword [eax + 8]
mov byte [ebp - 4], 0x1f
cmp eax, ebx
jne 0x41deda
mov eax, 0x476650
lea ecx, [ebp - 0x170]
push ecx
lea ecx, [ebp - 0x80]
push dword [0x47677c]
push eax
call fcn.00402975
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0x1e
call fcn.00402424
lea ecx, [ebp - 0x80]
call fcn.00402962
push 1
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0x20
call fcn.00402f3d
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 5
call fcn.00403a04
cmp dword [ebp - 0x34], 3
je 0x41df49
mov esi, dword [esi + 0x268]
cmp byte [esi + 1], bl
je 0x41df3e
cmp byte [esi + 2], bl
jne 0x41df3e
call fcn.00437091
jmp 0x41df49
push 0x453
call fcn.0043619c
pop ecx
lea ecx, [ebp - 0x15c]
mov byte [ebp - 4], 4
call fcn.00402424
cmp dword [ebp - 0x1c], ebx
je 0x41df69
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1c], ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe4]
call fcn.00402424
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8