Function at 0x40b2e0
Capabilities:
Copy file
Create directory
Delete file
Get common file path
Get installed programs
Get startup folder
Persist via lnk shortcut
Query or enumerate registry value
Set registry value
Write file to startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4174d5
mov eax, dword fs:[0]
push eax
sub esp, 0xe64
mov eax, dword [0x424d78]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0x14]
lea edx, [ebp - 0xb4c]
push edx
xor edi, edi
push 0x20119
push edi
mov dword [ebp - 0xb44], edi
push str.SoftwareConexant
xor ecx, ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xb5c], eax
mov word [eax], cx
mov dword [ebp - 4], edi
lea esi, [edi + 1]
mov dword [ebp - 0xb60], 0xff
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40b3aa
mov edx, dword [ebp - 0xb4c]
lea eax, [ebp - 0xb58]
push eax
lea ecx, [ebp - 0xb60]
push ecx
push edi
push edi
push str.SetCOMMBranding
push edx
mov dword [ebp - 0xb58], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40b395
mov eax, dword [ebp - 0xb60]
cmp eax, dword [ebp + 0xc]
jne 0x40b395
xor esi, esi
mov ecx, dword [ebp - 0xb4c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, edi
je 0x40d044
call fcn.00408ee0
cmp eax, 1
jne 0x40d044
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [str.SAConfig.HP.Slice.xml]
mov eax, dword [0x41e440]
mov dword [ebp - 0x320], edx
mov edx, dword [0x41e448]
mov ecx, 6
mov esi, str.SAConfig.BandO.Slice.xml
lea edi, [ebp - 0x62c]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x41e444]
mov dword [ebp - 0x314], edx
lea edx, [ebp - 0xb4c]
push edx
push 0x20119
push 0
mov dword [ebp - 0x31c], eax
mov eax, dword [0x41e44c]
mov dword [ebp - 0x318], ecx
mov cx, word [0x41e450]
push str.SOFTWAREConexantSA3
push reloc.OLEAUT32.dll_SysReAllocString
movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x310], eax
mov word [ebp - 0x30c], cx
xor bl, bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40b4c0
mov edx, dword [ebp - 0xb4c]
mov dword [ebp - 0xb54], eax
lea eax, [ebp - 0xb58]
push eax
lea ecx, [ebp - 0xb54]
push ecx
push 0
push 0
push str.FeatureByteBrandingStatus
push edx
mov dword [ebp - 0xb58], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40b4ab
cmp dword [ebp - 0xb54], eax
je 0x40b4ab
mov ecx, 7
mov esi, str.SAConfig.BandO.FeatureByte.xml
lea edi, [ebp - 0x62c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 7
mov esi, str.SAConfig.HP.FeatureByte.xml
lea edi, [ebp - 0x320]
rep movsd dword es:[edi], dword [esi]
mov bl, 1
mov eax, dword [ebp - 0xb4c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
jne 0x40b556
lea ecx, [ebp - 0xb4c]
push ecx
push 0x20119
push 0
push str.SOFTWAREConexantSA3HP_NB_AIO
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40b556
mov ecx, dword [ebp - 0xb4c]
lea edx, [ebp - 0xb58]
push edx
mov dword [ebp - 0xb54], eax
lea eax, [ebp - 0xb54]
push eax
push 0
push 0
push str.FeatureByteBrandingStatus
push ecx
mov dword [ebp - 0xb58], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40b549
cmp dword [ebp - 0xb54], eax
je 0x40b549
mov ecx, 7
mov esi, str.SAConfig.BandO.FeatureByte.xml
lea edi, [ebp - 0x62c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 7
mov esi, str.SAConfig.HP.FeatureByte.xml
lea edi, [ebp - 0x320]
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp - 0xb4c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0xc]
cmp eax, 4
ja case.default.0x40b562
jmp dword [eax*4 + 0x40d06c]
mov eax, dword [str.BandOPlay.ico]
mov ecx, 8
mov esi, str.Bang__Olufsen_Audio_Control_Panel
lea edi, [ebp - 0x424]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x41e384]
mov edx, dword [0x41e388]
movsw word es:[edi], word [esi]
mov dword [ebp - 0xd68], ecx
movzx ecx, byte [0x41e35b]
movsb byte es:[edi], byte [esi]
mov byte [ebp - 0x528], cl
mov ecx, 9
mov esi, str.Bang__Olufsen_Audio_Control_Panel.lnk
lea edi, [ebp - 0xe70]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x41e328]
mov dword [ebp - 0xd6c], eax
movzx eax, word [0x41e38c]
mov dword [ebp - 0xd64], edx
mov edx, dword [str.Audio_Controls.lnk]
mov word [ebp - 0xd60], ax
mov eax, dword [0x41e324]
mov dword [ebp - 0xc60], ecx
movzx ecx, byte [0x41e332]
movsw word es:[edi], word [esi]
mov dword [ebp - 0xc68], edx
mov edx, dword [0x41e32c]
mov dword [ebp - 0xc64], eax
movzx eax, word [0x41e330]
mov dword [ebp - 0xc5c], edx
mov byte [ebp - 0xc56], cl
movsb byte es:[edi], byte [esi]
mov word [ebp - 0xc58], ax
lea ecx, [ebp - 0x62c]
lea edx, [ebp - 0x834]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40b627
lea ecx, [ebp - 0x320]
lea edx, [ebp - 0x938]
lea ecx, [ecx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40b640
jmp case.default.0x40b562
mov cl, byte [0x41e31c]
mov byte [ebp - 0x41c], cl
mov ecx, dword [0x41e388]
mov edx, dword [str.BO_Play]
mov dword [ebp - 0xd64], ecx
mov eax, dword [0x41e318]
mov ecx, 7
mov esi, str.BO_Play_Control_Audio_Panel
lea edi, [ebp - 0x528]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 9
mov esi, str.Bang__Olufsen_Audio_Control_Panel.lnk
lea edi, [ebp - 0xe70]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x41e324]
mov dword [ebp - 0x424], edx
mov edx, dword [str.BandOPlay.ico]
mov dword [ebp - 0xd6c], edx
mov dx, word [0x41e38c]
mov dword [ebp - 0x420], eax
mov eax, dword [0x41e384]
mov word [ebp - 0xd60], dx
mov edx, dword [0x41e328]
mov dword [ebp - 0xd68], eax
mov eax, dword [str.Audio_Controls.lnk]
movsw word es:[edi], word [esi]
mov dword [ebp - 0xc64], ecx
mov cx, word [0x41e330]
mov dword [ebp - 0xc60], edx
mov dl, byte [0x41e332]
mov dword [ebp - 0xc68], eax
mov eax, dword [0x41e32c]
mov word [ebp - 0xc58], cx
mov byte [ebp - 0xc56], dl
movsb byte es:[edi], byte [esi]
mov dword [ebp - 0xc5c], eax
lea ecx, [ebp - 0x62c]
lea edx, [ebp - 0x834]
nop
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40b720
lea ecx, [ebp - 0x320]
lea edx, [ebp - 0x938]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40b736
jmp case.default.0x40b562
mov eax, dword [str.BandOPlay.ico]
mov ecx, 8
mov esi, str.Bang__Olufsen_Audio_Control_Panel
lea edi, [ebp - 0x424]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x41e384]
mov edx, dword [0x41e388]
movsw word es:[edi], word [esi]
mov dword [ebp - 0xd68], ecx
movzx ecx, byte [0x41e35b]
movsb byte es:[edi], byte [esi]
mov byte [ebp - 0x528], cl
mov ecx, 9
mov esi, str.Bang__Olufsen_Audio_Control_Panel.lnk
lea edi, [ebp - 0xe70]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x41e328]
mov dword [ebp - 0xd6c], eax
movzx eax, word [0x41e38c]
mov dword [ebp - 0xd64], edx
mov edx, dword [str.Audio_Controls.lnk]
mov word [ebp - 0xd60], ax
mov eax, dword [0x41e324]
mov dword [ebp - 0xc60], ecx
movzx ecx, byte [0x41e332]
movsw word es:[edi], word [esi]
mov dword [ebp - 0xc68], edx
mov edx, dword [0x41e32c]
mov dword [ebp - 0xc64], eax
movzx eax, word [0x41e330]
mov dword [ebp - 0xc5c], edx
mov byte [ebp - 0xc56], cl
movsb byte es:[edi], byte [esi]
mov word [ebp - 0xc58], ax
lea ecx, [ebp - 0x62c]
lea edx, [ebp - 0x834]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40b803
lea ecx, [ebp - 0x320]
lea edx, [ebp - 0x938]
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40b820
jmp case.default.0x40b562
mov ecx, dword [0x41e2e0]
mov esi, dword [0x41e2e8]
mov edi, dword [0x41e2ec]
mov edx, dword [0x41e2e4]
mov ebx, dword [0x41e2f0]
mov eax, dword [str.DTS_Audio_Control_Panel]
mov dword [ebp - 0x420], ecx
mov dword [ebp - 0x524], ecx
mov ecx, dword [0x41e324]
mov dword [ebp - 0xe6c], ecx
mov cx, word [0x41e330]
mov dword [ebp - 0x418], esi
mov dword [ebp - 0x414], edi
mov dword [ebp - 0x51c], esi
mov dword [ebp - 0x518], edi
mov word [ebp - 0xe60], cx
mov ecx, 9
mov esi, str.Bang__Olufsen_Audio_Control_Panel.lnk
lea edi, [ebp - 0xc68]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x41c], edx
mov dword [ebp - 0x520], edx
mov edx, dword [0x41e2f0]
mov dword [ebp - 0x410], ebx
mov ebx, dword [str.HPAudio.ico]
mov dword [ebp - 0x514], edx
mov edx, dword [0x41e328]
mov dword [ebp - 0x424], eax
mov dword [ebp - 0xd6c], ebx
mov ebx, dword [0x41e2d4]
mov dword [ebp - 0x528], eax
mov eax, dword [str.Audio_Controls.lnk]
mov dword [ebp - 0xe68], edx
mov dl, byte [0x41e332]
movsw word es:[edi], word [esi]
mov dword [ebp - 0xd68], ebx
mov ebx, dword [0x41e2d8]
mov dword [ebp - 0xe70], eax
mov eax, dword [0x41e32c]
mov byte [ebp - 0xe5e], dl
mov dword [ebp - 0xd64], ebx
mov dword [ebp - 0xe64], eax
movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x320]
lea edx, [ebp - 0x834]
lea ecx, [ecx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40b930
lea ecx, [ebp - 0x62c]
lea edx, [ebp - 0x938]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40b946
jmp case.default.0x40b562
mov ecx, dword [0x41e2c4]
mov eax, dword [str.Audio_Controls]
mov edx, dword [0x41e2c8]
mov dword [ebp - 0x420], ecx
movzx ecx, byte [0x41e2ce]
mov byte [ebp - 0x416], cl
mov ecx, dword [0x41e2d8]
mov dword [ebp - 0xd64], ecx
mov ecx, dword [0x41e2b0]
mov dword [ebp - 0x520], ecx
movzx ecx, byte [0x41e2bc]
mov byte [ebp - 0x514], cl
mov ecx, dword [0x41e328]
mov dword [ebp - 0x424], eax
movzx eax, word [0x41e2cc]
mov dword [ebp - 0xe68], ecx
movzx ecx, byte [0x41e332]
mov dword [ebp - 0x41c], edx
mov edx, dword [str.HPAudio.ico]
mov word [ebp - 0x418], ax
mov eax, dword [0x41e2d4]
mov byte [ebp - 0xe5e], cl
mov dword [ebp - 0xd6c], edx
mov edx, dword [str.Audio_Controls_Panel]
mov dword [ebp - 0xd68], eax
mov eax, dword [0x41e2ac]
mov ecx, 8
mov esi, str.Bang__Olufsen_Audio_Control.lnk
lea edi, [ebp - 0xc68]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x528], edx
mov edx, dword [0x41e2b4]
mov dword [ebp - 0x524], eax
mov eax, dword [0x41e2b8]
mov dword [ebp - 0x51c], edx
mov edx, dword [str.Audio_Controls.lnk]
mov dword [ebp - 0x518], eax
mov eax, dword [0x41e324]
mov dword [ebp - 0xe70], edx
mov edx, dword [0x41e32c]
mov dword [ebp - 0xe6c], eax
movzx eax, word [0x41e330]
mov dword [ebp - 0xe64], edx
mov word [ebp - 0xe60], ax
movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x320]
lea edx, [ebp - 0x834]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40ba66
lea ecx, [ebp - 0x62c]
lea edx, [ebp - 0x938]
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40ba80
mov eax, dword [ebp - 0xb5c]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [ebp - 0xb4c]
push ecx
push 0x20119
push 0
push str.SoftwareMicrosoftWindowsCurrentVersion
or edx, 0xffffffff
push reloc.OLEAUT32.dll_SysReAllocString
mov word [eax], dx
call ebx
test eax, eax
jne 0x40d03f
mov ecx, dword [ebp - 0xb4c]
lea edx, [ebp - 0xb58]
push edx
lea eax, [ebp - 0xa3c]
push eax
push 0
push 0
push str.ProgramFilesDir
push ecx
mov dword [ebp - 0xb58], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40d03f
lea ecx, [ebp - 0xa3c]
lea edx, [ebp - 0x62c]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40bb00
lea edi, [ebp - 0x62c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40bb11
lea edx, [ebp - 0xb40]
push edx
push 0
push 0
push 0x17
mov ecx, 7
mov esi, str.CONEXANTSA3HP_NB_AIOUX_
push 0
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea ecx, [ebp - 0xb40]
lea edx, [ebp - 0x320]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40bb46
lea edi, [ebp - 0x320]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40bb57
mov ax, word [0x41deac]
mov word [edi], ax
lea ecx, [ebp - 0xb40]
lea edx, [ebp - 0x730]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40bb74
lea edi, [ebp - 0x730]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40bb85
mov ecx, 6
mov esi, str.Music__Photos_and_Videos_
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0xb4c]
push ecx
push 0x20106
push 0
movsw word es:[edi], word [esi]
push str.CLSIDD3CD8822_6943_4214_90EE_12F40BEA126F
push SysReAllocString
movsb byte es:[edi], byte [esi]
call ebx
test eax, eax
jne 0x40bc24
lea eax, [ebp - 0x424]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40bbc3
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
sub eax, edx
push eax
mov eax, dword [ebp - 0xb4c]
lea edx, [ebp - 0x424]
push edx
push 1
push 0
push 0
push eax
call ebx
lea eax, [ebp - 0x528]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40bbf2
sub eax, edx
mov edx, dword [ebp - 0xb4c]
push eax
lea ecx, [ebp - 0x528]
push ecx
push 1
push 0
push str.InfoTip
push edx
call ebx
mov eax, dword [ebp - 0xb4c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40bc2a
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [ebp - 0xb4c]
push ecx
push 0x20106
push 0
push str.CLSIDD3CD8822_6943_4214_90EE_12F40BEA126FDefaultIcon
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40bcd0
lea ecx, [ebp - 0x62c]
lea edx, [ebp - 0x21c]
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40bc60
lea eax, [ebp - 0xd6c]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40bc72
lea edi, [ebp - 0x21c]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40bc82
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x21c]
rep movsb byte es:[edi], byte [esi]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40bca3
sub eax, edx
push eax
mov eax, dword [ebp - 0xb4c]
lea edx, [ebp - 0x21c]
push edx
push 1
push 0
push 0
push eax
call ebx
mov ecx, dword [ebp - 0xb4c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0xb4c]
push edx
push 0x20106
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallCNXT_AUDIO_HDA
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40bd75
lea ecx, [ebp - 0x62c]
lea edx, [ebp - 0x21c]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40bd02
lea eax, [ebp - 0xd6c]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40bd14
lea edi, [ebp - 0x21c]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40bd24
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x21c]
rep movsb byte es:[edi], byte [esi]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40bd45
mov ecx, dword [ebp - 0xb4c]
sub eax, edx
push eax
lea eax, [ebp - 0x21c]
push eax
push 1
push 0
push str.DisplayIcon
push ecx
call ebx
mov edx, dword [ebp - 0xb4c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp + 0x10], 0
je 0x40bea5
mov eax, dword [0x424d5c]
mov edx, dword [eax + 0xc]
mov ecx, 0x424d5c
call edx
lea edi, [eax + 0x10]
mov dword [ebp - 0xb48], edi
lea eax, [ebp - 0x730]
mov byte [ebp - 4], 1
push 0
test eax, 0xffff0000
jne 0x40bdd8
mov ecx, eax
movzx esi, cx
push esi
call fcn.00408d30
add esp, 8
test eax, eax
je 0x40be8f
push esi
push eax
lea ecx, [ebp - 0xb48]
call fcn.0040a590
mov edi, dword [ebp - 0xb48]
jmp 0x40be8f
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0xffffffffffffffff
lea edx, [ebp - 0x730]
push edx
push 0
push 3
call ebx
lea esi, [eax - 1]
test esi, esi
jle 0x40be3a
mov eax, dword [edi - 8]
mov ecx, 1
sub ecx, dword [edi - 4]
sub eax, esi
or eax, ecx
jge 0x40be19
push esi
lea ecx, [ebp - 0xb48]
call fcn.00409420
mov edi, dword [ebp - 0xb48]
push esi
push edi
push 0xffffffffffffffff
lea eax, [ebp - 0x730]
push eax
push 0
push 3
call ebx
cmp esi, dword [edi - 8]
jg 0x40be55
xor ecx, ecx
mov dword [edi - 0xc], esi
mov word [edi + esi*2], cx
jmp 0x40be8f
cmp dword [edi - 0xc], 0
mov esi, dword [edi - 0x10]
lea eax, [edi - 0x10]
je 0x40be8f
cmp dword [eax + 0xc], 0
lea ecx, [eax + 0xc]
jge 0x40be6d
cmp dword [edi - 8], 0
jge 0x40be5f
push 0x80070057
call fcn.00401270
xor edx, edx
mov dword [edi - 0xc], 0
mov word [edi], dx
jmp 0x40be8f
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40be83
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0xc]
mov ecx, esi
call eax
lea edi, [eax + 0x10]
or dword [ebp - 0xb44], 1
push 0
push edi
mov byte [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x40beab
mov edi, dword [ebp - 0xb48]
test byte [ebp - 0xb44], 1
je 0x40bed0
add edi, 0xfffffff0
lea ecx, [edi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40bed0
mov ecx, dword [edi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push edi
call edx
lea ecx, [ebp - 0x320]
lea edx, [ebp - 0x118]
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40bee0
lea eax, [ebp - 0xc68]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40bef2
lea edi, [ebp - 0x118]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40bf02
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [0x424d5c]
mov edx, dword [eax + 0xc]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x424d5c
call edx
lea edi, [eax + 0x10]
mov dword [ebp - 0xb48], edi
lea eax, [ebp - 0x118]
mov byte [ebp - 4], 2
push 0
test eax, 0xffff0000
jne 0x40bf73
mov ecx, eax
movzx esi, cx
push esi
call fcn.00408d30
add esp, 8
test eax, eax
je 0x40c02e
push esi
push eax
lea ecx, [ebp - 0xb48]
call fcn.0040a590
mov edi, dword [ebp - 0xb48]
jmp 0x40c02e
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0xffffffffffffffff
lea edx, [ebp - 0x118]
push edx
push 0
push 3
call ebx
lea esi, [eax - 1]
test esi, esi
jle 0x40bfd9
mov eax, dword [edi - 8]
mov ecx, 1
sub ecx, dword [edi - 4]
sub eax, esi
or eax, ecx
jge 0x40bfb4
push esi
lea ecx, [ebp - 0xb48]
call fcn.00409420
mov edi, dword [ebp - 0xb48]
push esi
push edi
push 0xffffffffffffffff
lea eax, [ebp - 0x118]
push eax
push 0
push 3
call ebx
cmp esi, dword [edi - 8]
jg 0x40be55
xor ecx, ecx
mov dword [edi - 0xc], esi
mov word [edi + esi*2], cx
jmp 0x40c02e
cmp dword [edi - 0xc], 0
mov esi, dword [edi - 0x10]
lea eax, [edi - 0x10]
je 0x40c02e
cmp dword [eax + 0xc], 0
lea ecx, [eax + 0xc]
jge 0x40c00c
cmp dword [edi - 8], 0
jge 0x40bffe
push 0x80070057
call fcn.00401270
xor edx, edx
mov dword [edi - 0xc], 0
mov word [edi], dx
jmp 0x40c02e
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c022
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0xc]
mov ecx, esi
call eax
lea edi, [eax + 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
mov byte [ebp - 4], 0
call ebx
add edi, 0xfffffff0
lea ecx, [edi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c057
mov ecx, dword [edi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push edi
call edx
cmp dword [ebp + 0x10], 0
je 0x40c1e3
lea ecx, [ebp - 0x730]
lea edx, [ebp - 0x118]
lea ecx, [ecx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40c070
lea eax, [ebp - 0xc68]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c082
lea edi, [ebp - 0x118]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40c092
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [0x424d5c]
mov edx, dword [eax + 0xc]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x424d5c
call edx
lea esi, [eax + 0x10]
mov dword [ebp - 0xb48], esi
lea eax, [ebp - 0x118]
mov byte [ebp - 4], 3
push 0
test eax, 0xffff0000
jne 0x40c103
mov ecx, eax
movzx edi, cx
push edi
call fcn.00408d30
add esp, 8
test eax, eax
je 0x40c1c0
push edi
push eax
lea ecx, [ebp - 0xb48]
call fcn.0040a590
mov esi, dword [ebp - 0xb48]
jmp 0x40c1c0
push 0
push 0xffffffffffffffff
lea edx, [ebp - 0x118]
push edx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea edi, [eax - 1]
test edi, edi
jle 0x40c16b
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x40c142
push edi
lea ecx, [ebp - 0xb48]
call fcn.00409420
mov esi, dword [ebp - 0xb48]
push edi
push esi
push 0xffffffffffffffff
lea eax, [ebp - 0x118]
push eax
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp edi, dword [esi - 8]
jg 0x40be55
xor ecx, ecx
mov dword [esi - 0xc], edi
mov word [esi + edi*2], cx
jmp 0x40c1c0
cmp dword [esi - 0xc], 0
mov edi, dword [esi - 0x10]
lea eax, [esi - 0x10]
je 0x40c1c0
cmp dword [eax + 0xc], 0
lea ecx, [eax + 0xc]
jge 0x40c19e
cmp dword [esi - 8], 0
jge 0x40c190
push 0x80070057
call fcn.00401270
xor edx, edx
mov dword [esi - 0xc], 0
mov word [esi], dx
jmp 0x40c1c0
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c1b4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [edi]
mov eax, dword [edx + 0xc]
mov ecx, edi
call eax
lea esi, [eax + 0x10]
push esi
mov byte [ebp - 4], 0
call ebx
add esi, 0xfffffff0
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c1e3
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
lea ecx, [ebp - 0x62c]
lea edx, [ebp - 0x21c]
nop
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40c1f0
lea eax, [ebp - 0xe70]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c202
lea edi, [ebp - 0x21c]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40c212
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
cmp dword [ebp + 0x10], 0
rep movsb byte es:[edi], byte [esi]
lea edx, [ebp - 0x118]
je 0x40c24c
lea ecx, [ebp - 0x730]
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40c240
jmp 0x40c25c
lea ecx, [ebp - 0x320]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40c252
lea eax, [ebp - 0xe70]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c264
lea edi, [ebp - 0x118]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40c274
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [0x424d5c]
mov edx, dword [eax + 0xc]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x424d5c
call edx
lea ebx, [eax + 0x10]
mov dword [ebp - 0xb48], ebx
lea eax, [ebp - 0x118]
mov byte [ebp - 4], 4
push 0
test eax, 0xffff0000
jne 0x40c2e5
mov ecx, eax
movzx esi, cx
push esi
call fcn.00408d30
add esp, 8
test eax, eax
je 0x40c3a6
push esi
push eax
lea ecx, [ebp - 0xb48]
call fcn.0040a590
mov ebx, dword [ebp - 0xb48]
jmp 0x40c3a6
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0xffffffffffffffff
lea edx, [ebp - 0x118]
push edx
push 0
push 3
call edi
lea esi, [eax - 1]
test esi, esi
jle 0x40c34b
mov eax, dword [ebx - 8]
mov ecx, 1
sub ecx, dword [ebx - 4]
sub eax, esi
or eax, ecx
jge 0x40c326
push esi
lea ecx, [ebp - 0xb48]
call fcn.00409420
mov ebx, dword [ebp - 0xb48]
push esi
push ebx
push 0xffffffffffffffff
lea eax, [ebp - 0x118]
push eax
push 0
push 3
call edi
cmp esi, dword [ebx - 8]
jg 0x40be55
xor ecx, ecx
mov dword [ebx - 0xc], esi
mov word [ebx + esi*2], cx
jmp 0x40c3a6
cmp dword [ebx - 0xc], 0
mov esi, dword [ebx - 0x10]
lea eax, [ebx - 0x10]
je 0x40c3a6
cmp dword [eax + 0xc], 0
lea ecx, [eax + 0xc]
jge 0x40c37e
cmp dword [ebx - 8], 0
jge 0x40c370
push 0x80070057
call fcn.00401270
xor edx, edx
mov dword [ebx - 0xc], 0
mov word [ebx], dx
jmp 0x40c3a6
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c394
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0xc]
mov ecx, esi
call eax
lea ebx, [eax + 0x10]
mov dword [ebp - 0xb48], ebx
mov edx, dword [0x424d5c]
mov eax, dword [edx + 0xc]
mov ecx, 0x424d5c
mov byte [ebp - 4], 5
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0xb44], esi
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 6
push 0
test ecx, 0xffff0000
jne 0x40c405
mov edx, ecx
movzx edi, dx
push edi
call fcn.00408d30
add esp, 8
test eax, eax
je 0x40c4c2
push edi
push eax
lea ecx, [ebp - 0xb44]
call fcn.0040a590
mov esi, dword [ebp - 0xb44]
jmp 0x40c4c2
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x21c]
push eax
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea edi, [eax - 1]
test edi, edi
jle 0x40c46d
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x40c444
push edi
lea ecx, [ebp - 0xb44]
call fcn.00409420
mov esi, dword [ebp - 0xb44]
push edi
push esi
push 0xffffffffffffffff
lea ecx, [ebp - 0x21c]
push ecx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp edi, dword [esi - 8]
jg 0x40be55
xor edx, edx
mov dword [esi - 0xc], edi
mov word [esi + edi*2], dx
jmp 0x40c4c2
cmp dword [esi - 0xc], 0
mov edi, dword [esi - 0x10]
lea eax, [esi - 0x10]
je 0x40c4c2
cmp dword [eax + 0xc], 0
lea ecx, [eax + 0xc]
jge 0x40c4a0
cmp dword [esi - 8], 0
jge 0x40c492
push 0x80070057
call fcn.00401270
xor eax, eax
mov dword [esi - 0xc], 0
mov word [esi], ax
jmp 0x40c4c2
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c4b6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [edi]
mov eax, dword [edx + 0xc]
mov ecx, edi
call eax
lea esi, [eax + 0x10]
push 1
push ebx
push esi
mov byte [ebp - 4], 5
call dword [sym.imp.KERNEL32.dll_CopyFileW]
add esi, 0xfffffff0
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c4ec
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
add ebx, 0xfffffff0
mov byte [ebp - 4], 0
lea eax, [ebx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40c50c
mov ecx, dword [ebx]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push ebx
call eax
lea ecx, [ebp - 0xa3c]
lea edx, [ebp - 0x320]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40c518
lea edi, [ebp - 0x320]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40c530
mov ecx, 6
mov esi, str.CONEXANTSA3HP_NB_AIO_
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x320]
lea edx, [ebp - 0x118]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40c551
lea eax, [ebp - 0x938]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c563
lea edi, [ebp - 0x118]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40c573
mov ecx, eax
shr ecx, 2
mov esi, edx
mov edx, dword [0x424d5c]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [edx + 0xc]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x424d5c
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0xb44], esi
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 7
push 0
test ecx, 0xffff0000
jne 0x40c711
mov edx, ecx
movzx edi, dx
push edi
call fcn.00408d30
add esp, 8
test eax, eax
je 0x40c5e1
push edi
push eax
lea ecx, [ebp - 0xb44]
call fcn.0040a590
mov esi, dword [ebp - 0xb44]
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push esi
mov byte [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esi, 0xfffffff0
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c60e
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
mov dword [ebp - 0xb5c], 1
lea ecx, [ebp - 0x62c]
lea edx, [ebp - 0x21c]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40c624
lea eax, [ebp - 0x834]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c636
lea edi, [ebp - 0x21c]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40c646
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x320]
lea edx, [ebp - 0x118]
lea ebx, [ebx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40c670
lea eax, [ebp - 0x834]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c682
lea edi, [ebp - 0x118]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40c692
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [0x424d5c]
mov edx, dword [eax + 0xc]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x424d5c
call edx
lea esi, [eax + 0x10]
mov dword [ebp - 0xb44], esi
lea eax, [ebp - 0x118]
shr eax, 0x10
mov byte [ebp - 4], 8
mov dword [ebp - 0xb54], eax
push 0
test eax, eax
jne 0x40c7db
lea eax, [ebp - 0x118]
movzx edi, ax
push edi
call fcn.00408d30
add esp, 8
test eax, eax
je 0x40c890
push edi
push eax
lea ecx, [ebp - 0xb44]
call fcn.0040a590
mov esi, dword [ebp - 0xb44]
jmp 0x40c890
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x118]
push eax
push 0
push 3
call ebx
lea edi, [eax - 1]
test edi, edi
jle 0x40c77a
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x40c752
push edi
lea ecx, [ebp - 0xb44]
call fcn.00409420
mov esi, dword [ebp - 0xb44]
push edi
push esi
push 0xffffffffffffffff
lea ecx, [ebp - 0x118]
push ecx
push 0
push 3
call ebx
cmp edi, dword [esi - 8]
jg 0x40be55
xor edx, edx
mov dword [esi - 0xc], edi
mov word [esi + edi*2], dx
jmp 0x40c5e7
cmp dword [esi - 0xc], 0
mov edi, dword [esi - 0x10]
lea eax, [esi - 0x10]
je 0x40c5e7
cmp dword [eax + 0xc], 0
lea ecx, [eax + 0xc]
jge 0x40c7b4
cmp dword [esi - 8], 0
jge 0x40c7a3
push 0x80070057
call fcn.00401270
xor eax, eax
mov dword [esi - 0xc], 0
mov word [esi], ax
jmp 0x40c5e7
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c7ca
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [edi]
mov eax, dword [edx + 0xc]
mov ecx, edi
call eax
lea esi, [eax + 0x10]
jmp 0x40c5e7
push 0
push 0xffffffffffffffff
lea ecx, [ebp - 0x118]
push ecx
push 0
push 3
call ebx
lea edi, [eax - 1]
test edi, edi
jle 0x40c83b
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x40c816
push edi
lea ecx, [ebp - 0xb44]
call fcn.00409420
mov esi, dword [ebp - 0xb44]
push edi
push esi
push 0xffffffffffffffff
lea edx, [ebp - 0x118]
push edx
push 0
push 3
call ebx
cmp edi, dword [esi - 8]
jg 0x40be55
xor eax, eax
mov dword [esi - 0xc], edi
mov word [esi + edi*2], ax
jmp 0x40c890
cmp dword [esi - 0xc], 0
mov edi, dword [esi - 0x10]
lea eax, [esi - 0x10]
je 0x40c890
cmp dword [eax + 0xc], 0
lea ecx, [eax + 0xc]
jge 0x40c86e
cmp dword [esi - 8], 0
jge 0x40c860
push 0x80070057
call fcn.00401270
xor ecx, ecx
mov dword [esi - 0xc], 0
mov word [esi], cx
jmp 0x40c890
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c884
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [edi]
mov eax, dword [edx + 0xc]
mov ecx, edi
call eax
lea esi, [eax + 0x10]
push esi
mov byte [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esi, 0xfffffff0
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c8b7
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
mov eax, dword [0x424d5c]
mov edx, dword [eax + 0xc]
mov ecx, 0x424d5c
call edx
lea ebx, [eax + 0x10]
mov dword [ebp - 0xb48], ebx
cmp dword [ebp - 0xb54], 0
mov byte [ebp - 4], 9
push 0
jne 0x40c910
lea eax, [ebp - 0x118]
movzx esi, ax
push esi
call fcn.00408d30
add esp, 8
test eax, eax
je 0x40c9d1
push esi
push eax
lea ecx, [ebp - 0xb48]
call fcn.0040a590
mov ebx, dword [ebp - 0xb48]
jmp 0x40c9d1
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0xffffffffffffffff
lea ecx, [ebp - 0x118]
push ecx
push 0
push 3
call edi
lea esi, [eax - 1]
test esi, esi
jle 0x40c976
mov eax, dword [ebx - 8]
mov ecx, 1
sub ecx, dword [ebx - 4]
sub eax, esi
or eax, ecx
jge 0x40c951
push esi
lea ecx, [ebp - 0xb48]
call fcn.00409420
mov ebx, dword [ebp - 0xb48]
push esi
push ebx
push 0xffffffffffffffff
lea edx, [ebp - 0x118]
push edx
push 0
push 3
call edi
cmp esi, dword [ebx - 8]
jg 0x40be55
xor eax, eax
mov dword [ebx - 0xc], esi
mov word [ebx + esi*2], ax
jmp 0x40c9d1
cmp dword [ebx - 0xc], 0
mov esi, dword [ebx - 0x10]
lea eax, [ebx - 0x10]
je 0x40c9d1
cmp dword [eax + 0xc], 0
lea ecx, [eax + 0xc]
jge 0x40c9a9
cmp dword [ebx - 8], 0
jge 0x40c99b
push 0x80070057
call fcn.00401270
xor ecx, ecx
mov dword [ebx - 0xc], 0
mov word [ebx], cx
jmp 0x40c9d1
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c9bf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0xc]
mov ecx, esi
call eax
lea ebx, [eax + 0x10]
mov dword [ebp - 0xb48], ebx
mov edx, dword [0x424d5c]
mov eax, dword [edx + 0xc]
mov ecx, 0x424d5c
mov byte [ebp - 4], 0xa
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0xb44], esi
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 0xb
push 0
test ecx, 0xffff0000
jne 0x40ca30
mov edx, ecx
movzx edi, dx
push edi
call fcn.00408d30
add esp, 8
test eax, eax
je 0x40caed
push edi
push eax
lea ecx, [ebp - 0xb44]
call fcn.0040a590
mov esi, dword [ebp - 0xb44]
jmp 0x40caed
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x21c]
push eax
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea edi, [eax - 1]
test edi, edi
jle 0x40ca98
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x40ca6f
push edi
lea ecx, [ebp - 0xb44]
call fcn.00409420
mov esi, dword [ebp - 0xb44]
push edi
push esi
push 0xffffffffffffffff
lea ecx, [ebp - 0x21c]
push ecx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp edi, dword [esi - 8]
jg 0x40be55
xor edx, edx
mov dword [esi - 0xc], edi
mov word [esi + edi*2], dx
jmp 0x40caed
cmp dword [esi - 0xc], 0
mov edi, dword [esi - 0x10]
lea eax, [esi - 0x10]
je 0x40caed
cmp dword [eax + 0xc], 0
lea ecx, [eax + 0xc]
jge 0x40cacb
cmp dword [esi - 8], 0
jge 0x40cabd
push 0x80070057
call fcn.00401270
xor eax, eax
mov dword [esi - 0xc], 0
mov word [esi], ax
jmp 0x40caed
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40cae1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [edi]
mov eax, dword [edx + 0xc]
mov ecx, edi
call eax
lea esi, [eax + 0x10]
push 1
push ebx
push esi
mov byte [ebp - 4], 0xa
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
sete byte [ebp - 0xb4d]
add esi, 0xfffffff0
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40cb20
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
add ebx, 0xfffffff0
mov byte [ebp - 4], 0
lea eax, [ebx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40cb40
mov ecx, dword [ebx]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push ebx
call eax
cmp byte [ebp - 0xb4d], 0
je 0x40cb53
mov dword [ebp - 0xb5c], 0
mov dword [ebp - 0xb64], 1
lea ecx, [ebp - 0x62c]
lea edx, [ebp - 0x21c]
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40cb70
lea eax, [ebp - 0xd6c]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40cb82
lea edi, [ebp - 0x21c]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40cb92
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x320]
lea edx, [ebp - 0x118]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40cbb6
lea eax, [ebp - 0x118]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x40cbc7
mov ecx, dword [str.SADefaultIcon.ico]
mov edx, dword [0x41e11c]
mov dword [eax], ecx
mov ecx, dword [0x41e120]
mov dword [eax + 4], edx
mov edx, dword [0x41e124]
mov dword [eax + 8], ecx
mov cx, word [0x41e128]
mov dword [eax + 0xc], edx
mov edx, dword [0x424d5c]
mov word [eax + 0x10], cx
mov eax, dword [edx + 0xc]
mov ecx, 0x424d5c
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0xb44], esi
lea eax, [ebp - 0x118]
shr eax, 0x10
mov byte [ebp - 4], 0xc
mov dword [ebp - 0xb54], eax
push 0
test eax, eax
jne 0x40cc61
lea ecx, [ebp - 0x118]
movzx edi, cx
push edi
call fcn.00408d30
add esp, 8
test eax, eax
je 0x40cd1c
push edi
push eax
lea ecx, [ebp - 0xb44]
call fcn.0040a590
mov esi, dword [ebp - 0xb44]
jmp 0x40cd1c
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0xffffffffffffffff
lea edx, [ebp - 0x118]
push edx
push 0
push 3
call ebx
lea edi, [eax - 1]
test edi, edi
jle 0x40ccc7
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x40cca2
push edi
lea ecx, [ebp - 0xb44]
call fcn.00409420
mov esi, dword [ebp - 0xb44]
push edi
push esi
push 0xffffffffffffffff
lea eax, [ebp - 0x118]
push eax
push 0
push 3
call ebx
cmp edi, dword [esi - 8]
jg 0x40be55
xor ecx, ecx
mov dword [esi - 0xc], edi
mov word [esi + edi*2], cx
jmp 0x40cd1c
cmp dword [esi - 0xc], 0
mov edi, dword [esi - 0x10]
lea eax, [esi - 0x10]
je 0x40cd1c
cmp dword [eax + 0xc], 0
lea ecx, [eax + 0xc]
jge 0x40ccfa
cmp dword [esi - 8], 0
jge 0x40ccec
push 0x80070057
call fcn.00401270
xor edx, edx
mov dword [esi - 0xc], 0
mov word [esi], dx
jmp 0x40cd1c
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40cd10
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [edi]
mov eax, dword [edx + 0xc]
mov ecx, edi
call eax
lea esi, [eax + 0x10]
push esi
mov byte [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esi, 0xfffffff0
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40cd43
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
mov eax, dword [0x424d5c]
mov edx, dword [eax + 0xc]
mov ecx, 0x424d5c
call edx
lea ebx, [eax + 0x10]
mov dword [ebp - 0xb48], ebx
cmp dword [ebp - 0xb54], 0
mov byte [ebp - 4], 0xd
push 0
jne 0x40cd9c
lea eax, [ebp - 0x118]
movzx esi, ax
push esi
call fcn.00408d30
add esp, 8
test eax, eax
je 0x40ce5d
push esi
push eax
lea ecx, [ebp - 0xb48]
call fcn.0040a590
mov ebx, dword [ebp - 0xb48]
jmp 0x40ce5d
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0xffffffffffffffff
lea ecx, [ebp - 0x118]
push ecx
push 0
push 3
call edi
lea esi, [eax - 1]
test esi, esi
jle 0x40ce02
mov eax, dword [ebx - 8]
mov ecx, 1
sub ecx, dword [ebx - 4]
sub eax, esi
or eax, ecx
jge 0x40cddd
push esi
lea ecx, [ebp - 0xb48]
call fcn.00409420
mov ebx, dword [ebp - 0xb48]
push esi
push ebx
push 0xffffffffffffffff
lea edx, [ebp - 0x118]
push edx
push 0
push 3
call edi
cmp esi, dword [ebx - 8]
jg 0x40be55
xor eax, eax
mov dword [ebx - 0xc], esi
mov word [ebx + esi*2], ax
jmp 0x40ce5d
cmp dword [ebx - 0xc], 0
mov esi, dword [ebx - 0x10]
lea eax, [ebx - 0x10]
je 0x40ce5d
cmp dword [eax + 0xc], 0
lea ecx, [eax + 0xc]
jge 0x40ce35
cmp dword [ebx - 8], 0
jge 0x40ce27
push 0x80070057
call fcn.00401270
xor ecx, ecx
mov dword [ebx - 0xc], 0
mov word [ebx], cx
jmp 0x40ce5d
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ce4b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0xc]
mov ecx, esi
call eax
lea ebx, [eax + 0x10]
mov dword [ebp - 0xb48], ebx
mov edx, dword [0x424d5c]
mov eax, dword [edx + 0xc]
mov ecx, 0x424d5c
mov byte [ebp - 4], 0xe
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0xb44], esi
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 0xf
push 0
test ecx, 0xffff0000
jne 0x40cebc
mov edx, ecx
movzx edi, dx
push edi
call fcn.00408d30
add esp, 8
test eax, eax
je 0x40cf79
push edi
push eax
lea ecx, [ebp - 0xb44]
call fcn.0040a590
mov esi, dword [ebp - 0xb44]
jmp 0x40cf79
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x21c]
push eax
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea edi, [eax - 1]
test edi, edi
jle 0x40cf24
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x40cefb
push edi
lea ecx, [ebp - 0xb44]
call fcn.00409420
mov esi, dword [ebp - 0xb44]
push edi
push esi
push 0xffffffffffffffff
lea ecx, [ebp - 0x21c]
push ecx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp edi, dword [esi - 8]
jg 0x40be55
xor edx, edx
mov dword [esi - 0xc], edi
mov word [esi + edi*2], dx
jmp 0x40cf79
cmp dword [esi - 0xc], 0
mov edi, dword [esi - 0x10]
lea eax, [esi - 0x10]
je 0x40cf79
cmp dword [eax + 0xc], 0
lea ecx, [eax + 0xc]
jge 0x40cf57
cmp dword [esi - 8], 0
jge 0x40cf49
push 0x80070057
call fcn.00401270
xor eax, eax
mov dword [esi - 0xc], 0
mov word [esi], ax
jmp 0x40cf79
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40cf6d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [edi]
mov eax, dword [edx + 0xc]
mov ecx, edi
call eax
lea esi, [eax + 0x10]
push 1
push ebx
push esi
mov byte [ebp - 4], 0xe
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
sete byte [ebp - 0xb4d]
add esi, 0xfffffff0
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40cfac
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
add ebx, 0xfffffff0
mov byte [ebp - 4], 0
lea eax, [ebx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40cfcc
mov ecx, dword [ebx]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push ebx
call eax
cmp byte [ebp - 0xb4d], 0
je 0x40cfd9
xor eax, eax
jmp 0x40cfdf
mov eax, dword [ebp - 0xb64]
cmp dword [ebp - 0xb5c], 1
jne 0x40d03f
cmp eax, 1
jne 0x40d03f
push 0
lea ecx, [ebp - 0xb4c]
push ecx
push 0
push 0x20106
push 0
push 0
push 0
push str.SoftwareConexant
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40d03f
push 4
lea edx, [ebp + 0xc]
push edx
push 4
push eax
mov eax, dword [ebp - 0xb4c]
push str.SetCOMMBranding
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0xb4c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00408fc0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040d7c0
mov esp, ebp
pop ebp
ret 0x10