Function at 0x421d1a
Capabilities:
Create process on windows
Get common file path
Identify system language via api
Shutdown system

Disassembly:
push ebp
lea ebp, [esp - 0x14e2c]
mov eax, 0x14e2c
call fcn.004226e0
push 0xffffffffffffffff
push 0x433dc0
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
mov eax, dword [0x43c730]
xor eax, ebp
mov dword [ebp + 0x14e28], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 0x14e34]
xor ebx, ebx
push 0x30
lea eax, [ebp - 0xb0]
push ebx
push eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0xb4], ebx
call fcn.00422290
push 0x12c28
lea ecx, [ebp + 4]
push ebx
push ecx
mov dword [ebp], ebx
call fcn.00422290
push 0x206
lea eax, [ebp + 0x14532]
xor edx, edx
push ebx
push eax
mov word [ebp + 0x14530], dx
call fcn.00422290
push 0x464
lea ecx, [ebp + 0x12d44]
push ebx
push ecx
mov dword [ebp + 0x12d40], ebx
call fcn.00422290
add esp, 0x30
lea edx, [ebp + 0x12c2c]
push edx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x78], ebx
mov dword [0x4464d0], esi
mov dword [ebp + 0x12c2c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp + 0x12c30]
cmp eax, 5
jne 0x420206
xor eax, eax
cmp eax, dword [ebp + 0x12c34]
sbb eax, eax
neg eax
inc eax
mov dword [0x4464d8], eax
jmp 0x420227
cmp eax, 6
jne 0x420222
xor ecx, ecx
cmp ecx, dword [ebp + 0x12c34]
sbb eax, eax
and eax, 4
add eax, 4
mov dword [0x4464d8], eax
jmp 0x420227
mov eax, dword [0x4464d8]
push 0x104
lea edx, [ebp + 0x14530]
push edx
mov dword [ebp + 0xbc], eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [ebp + 0x12d40]
push ecx
push eax
call fcn.0041d8a0
add esp, 8
cmp dword [ebp + 0x12d40], ebx
je 0x420643
push 0xf9e
lea eax, [ebp + 0x131aa]
xor edx, edx
push ebx
push eax
mov word [ebp + 0x131a8], dx
call fcn.00422290
push 0x18e
lea edx, [ebp + 0x14c9a]
xor ecx, ecx
push ebx
push edx
mov word [ebp + 0x14c98], cx
call fcn.00422290
push str._install
push str._s___run_the_wizard_in_system_startup_mode__loads_nview__shows_initial_install_wizard_
lea eax, [ebp + 0x14c98]
push 0x190
push eax
call fcn.00419b60
add esp, 0x28
lea ecx, [ebp + 0x14c98]
push ecx
push 0xfa0
lea edx, [ebp + 0x131a8]
push edx
call fcn.00419ab0
push str._installquiet
push str._n_s___run_the_wizard_in_system_startup_mode_but_with_NO_ui
lea eax, [ebp + 0x14c98]
push 0x190
push eax
call fcn.00419b60
add esp, 0x10
lea ecx, [ebp + 0x14c98]
push ecx
push 0xfa0
lea edx, [ebp + 0x131a8]
push edx
call fcn.00419ab0
push str._n_____Note___nview_requires_one_of_the_two_options_above_to_be_run_at_startup
lea eax, [ebp + 0x14c98]
push 0x190
push eax
call fcn.00419b60
add esp, 0xc
lea ecx, [ebp + 0x14c98]
push ecx
push 0xfa0
lea edx, [ebp + 0x131a8]
push edx
call fcn.00419ab0
push str._uninstall
push str._n_s___uninstall_nview
lea eax, [ebp + 0x14c98]
push 0x190
push eax
call fcn.00419b60
add esp, 0x10
lea ecx, [ebp + 0x14c98]
push ecx
push 0xfa0
lea edx, [ebp + 0x131a8]
push edx
call fcn.00419ab0
push str._nodetect
push str._n_s___do_not_check_for_multimon_when_initializing_system
lea eax, [ebp + 0x14c98]
push 0x190
push eax
call fcn.00419b60
add esp, 0x10
lea ecx, [ebp + 0x14c98]
push ecx
push 0xfa0
lea edx, [ebp + 0x131a8]
push edx
call fcn.00419ab0
push str._keeploaded
push str._n_s___keep_nview_loaded_when_the_wizard_runs_for_the_first_time
push 0x190
lea eax, [ebp + 0x14c98]
push eax
call fcn.00419b60
add esp, 0x10
lea ecx, [ebp + 0x14c98]
push ecx
push 0xfa0
lea edx, [ebp + 0x131a8]
push edx
call fcn.00419ab0
push str._noshell
push str._n_s___do_not_register_the_shell_extension
lea eax, [ebp + 0x14c98]
push 0x190
push eax
call fcn.00419b60
add esp, 0x10
lea ecx, [ebp + 0x14c98]
push ecx
push 0xfa0
lea edx, [ebp + 0x131a8]
push edx
call fcn.00419ab0
push str._exe:
push str._n_scmd___run_the_cmd_after_exiting_the_wizard
lea eax, [ebp + 0x14c98]
push 0x190
push eax
call fcn.00419b60
add esp, 0x10
lea ecx, [ebp + 0x14c98]
push ecx
push 0xfa0
lea edx, [ebp + 0x131a8]
push edx
call fcn.00419ab0
push str._ModesetWizard
push str._n_s___run_the_modeset_wizard_UI
lea eax, [ebp + 0x14c98]
push 0x190
push eax
call fcn.00419b60
add esp, 0x10
lea ecx, [ebp + 0x14c98]
push ecx
push 0xfa0
lea edx, [ebp + 0x131a8]
push edx
call fcn.00419ab0
push str._DeskmanWizard
push str._n_s___run_the_desktop_wizard_UI
lea eax, [ebp + 0x14c98]
push 0x190
push eax
call fcn.00419b60
add esp, 0x10
lea ecx, [ebp + 0x14c98]
push ecx
push 0xfa0
lea edx, [ebp + 0x131a8]
push edx
call fcn.00419ab0
push str._clear
push str._n_s___clear_nview_settings
lea eax, [ebp + 0x14c98]
push 0x190
push eax
call fcn.00419b60
add esp, 0x10
lea ecx, [ebp + 0x14c98]
push ecx
push 0xfa0
lea edx, [ebp + 0x131a8]
push edx
call fcn.00419ab0
push str._regload
push str._n_s___force_nview_to_use_initial_settings_from_HKLM_rather_than_a_profile
lea eax, [ebp + 0x14c98]
push 0x190
push eax
call fcn.00419b60
add esp, 0x10
lea ecx, [ebp + 0x14c98]
push ecx
push 0xfa0
lea edx, [ebp + 0x131a8]
push edx
call fcn.00419ab0
push str._nohookload
push str._n_s___loads_nview_without_hooks_for_hotkeys
lea eax, [ebp + 0x14c98]
push 0x190
push eax
call fcn.00419b60
add esp, 0x10
lea ecx, [ebp + 0x14c98]
push ecx
push 0xfa0
lea edx, [ebp + 0x131a8]
push edx
call fcn.00419ab0
push str._enterprise
push str._n_s___enable_enterprise_client_support
lea eax, [ebp + 0x14c98]
push 0x190
push eax
call fcn.00419b60
add esp, 0x10
lea ecx, [ebp + 0x14c98]
push ecx
push 0xfa0
lea edx, [ebp + 0x131a8]
push edx
call fcn.00419ab0
push str._forceregload
push str._n_s___reset_EVERY_users_nview_settings_to_HKLM_settings_on_initialization
lea eax, [ebp + 0x14c98]
push 0x190
push eax
call fcn.00419b60
add esp, 0x10
lea ecx, [ebp + 0x14c98]
push ecx
push 0xfa0
lea edx, [ebp + 0x131a8]
push edx
call fcn.00419ab0
push str._forceNVload
push str._n_s___always_force_nview_to_be_on_for_every_boot
lea eax, [ebp + 0x14c98]
push 0x190
push eax
call fcn.00419b60
add esp, 0x10
lea ecx, [ebp + 0x14c98]
push ecx
push 0xfa0
lea edx, [ebp + 0x131a8]
push edx
call fcn.00419ab0
push 1
push str._modesetwizavail
push str._n_s___returns__d_if_the_display_wizard_will_run_with_the_current_system_config
lea eax, [ebp + 0x14c98]
push 0x190
push eax
call fcn.00419b60
add esp, 0x14
lea ecx, [ebp + 0x14c98]
push ecx
push 0xfa0
lea edx, [ebp + 0x131a8]
push edx
call fcn.00419ab0
push ebx
push str.nwiz_cmd_help
lea eax, [ebp + 0x131a8]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x42152e
push 1
call fcn.00419bd0
add esp, 4
cmp dword [0x4464d4], ebx
je 0x42152e
mov dword [ebp - 0x64], 1
mov dword [ebp - 0x14], ebx
cmp dword [ebp + 0x12d44], ebx
je 0x42078d
lea ecx, [ebp - 0x78]
push ecx
lea edx, [ebp - 0x14]
push edx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.SoftwareNVIDIA_CorporationGlobalTest
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4206fe
mov eax, dword [ebp - 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call edi
push str.SoftwareNVIDIA_CorporationGlobalTest
push 0x80000002
mov dword [ebp - 0x14], ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea ecx, [ebp - 0x14]
push ecx
push 0xf003f
push ebx
push str.SoftwareNVIDIA_CorporationGlobalNVTweak
push 0x80000002
mov dword [ebp + 0x80], 1
mov esi, 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x420731
mov eax, dword [ebp - 0x14]
push ebx
push ebx
lea edx, [ebp - 0x64]
push edx
push ebx
push str.nViewShellIsRegistered
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x420709
xor esi, esi
jmp 0x420724
mov dword [ebp + 0x80], ebx
jmp 0x42078d
mov edx, dword [ebp - 0x14]
push 4
lea ecx, [ebp - 0x30]
push ecx
push 4
push ebx
push str.nViewShellIsRegistered
push edx
mov dword [ebp - 0x30], esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x14]
push eax
call edi
mov dword [ebp - 0x14], ebx
cmp esi, ebx
je 0x42078d
cmp dword [ebp + 0x12d5c], ebx
jne 0x420743
mov edi, 1
call fcn.0041a140
call fcn.00418be0
test eax, eax
jne 0x42078d
push 0x206
lea edx, [ebp + 0x14c22]
xor ecx, ecx
push ebx
push edx
mov word [ebp + 0x14c20], cx
call fcn.00422290
push str.regsvr32.exe__s_nvwdmcpl.dll
lea eax, [ebp + 0x14c20]
push 0x208
push eax
call fcn.00419b60
lea ecx, [ebp + 0x14c20]
push ebx
push ecx
call fcn.00418c60
add esp, 0x20
mov dword [ebp + 0x60], ebx
call fcn.00419850
mov esi, eax
cmp esi, ebx
je 0x420830
cmp dword [0x4464c0], ebx
je 0x420830
xor eax, eax
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov edi, 0x2710
mov ebx, 0x6e80
lea edx, [ebp - 0x70]
push edx
push 8
push 0
push 0
push ebx
push esi
call fcn.00404420
test eax, eax
jle 0x4207da
cmp dword [ebp - 0x70], ebx
je 0x420806
cmp dword [ebp + 0x60], 0
jne 0x4207f1
mov eax, dword [0x446438]
test eax, eax
je 0x4207f1
call eax
mov esi, eax
test esi, esi
jne 0x420813
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
sub edi, 0xc8
jne 0x4207c0
jmp 0x420821
mov eax, 1
mov dword [ebp + 0x60], eax
mov dword [ebp + 0x5c], eax
jmp 0x420821
push esi
call dword [sym.imp.GDI32.dll_DeleteDC]
mov dword [ebp + 0x5c], 1
push esi
call dword [sym.imp.GDI32.dll_DeleteDC]
test edi, edi
je 0x42152e
xor ebx, ebx
cmp dword [ebp + 0x60], ebx
jne 0x420854
mov eax, dword [0x446438]
cmp eax, ebx
je 0x420854
call eax
cmp eax, ebx
je 0x420854
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
mov dword [ebp + 0x5c], 1
call fcn.00401170
test eax, eax
jne 0x4208e4
push 0x3e6
lea ecx, [ebp + 0x1414a]
push ebx
push ecx
mov word [ebp + 0x14148], ax
call fcn.00422290
push 0x62
lea eax, [ebp + 0x14bbe]
xor edx, edx
push ebx
push eax
mov word [ebp + 0x14bbc], dx
call fcn.00422290
mov edx, dword [0x4464d0]
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
add esp, 0x18
push 0x1f4
lea ecx, [ebp + 0x14148]
push ecx
push 0x7f7
push edx
call esi
mov ecx, dword [0x4464d0]
push 0x32
lea eax, [ebp + 0x14bbc]
push eax
push 0x9fb
push ecx
call esi
push ebx
lea edx, [ebp + 0x14bbc]
push edx
lea eax, [ebp + 0x14148]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x4208ea
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
mov ecx, dword [0x43dae4]
push 0x32
push 0x4464e0
push 0x3cfe
push ecx
call esi
cmp dword [ebp + 0x12d4c], ebx
jne 0x420b38
xor esi, esi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
cmp dword [ebp + 0x12d68], ebx
je 0x420998
cmp dword [ebp + 0x60], ebx
je 0x42152e
lea edx, [ebp + 0xbc]
push edx
call fcn.004184d0
add esp, 4
test eax, eax
je 0x420980
call fcn.00418160
test eax, eax
je 0x420980
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp + 0xbc]
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 0x18]
push edx
push eax
lea ecx, [ebp + 0xc0]
push ecx
call fcn.00403770
add esp, 0x14
test eax, eax
je 0x420980
lea edx, [ebp]
push edx
call fcn.00418180
add esp, 4
test eax, eax
je 0x420980
mov esi, 1
jmp 0x420982
xor esi, esi
lea eax, [ebp + 0xc0]
push eax
call fcn.004070c0
add esp, 4
mov eax, esi
jmp 0x421530
cmp dword [ebp + 0x12d74], ebx
je 0x420a25
cmp dword [ebp + 0x60], ebx
jne 0x4209b3
mov eax, 3
jmp 0x421530
lea ecx, [ebp + 0xbc]
push ecx
call fcn.004184d0
add esp, 4
test eax, eax
je 0x420a0a
lea edx, [ebp - 0x20]
push edx
mov edx, dword [ebp + 0xbc]
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x18]
push ecx
push edx
lea eax, [ebp + 0xc0]
push eax
call fcn.00403770
add esp, 0x14
test eax, eax
je 0x420a0a
lea ecx, [ebp]
push ecx
call fcn.00418180
add esp, 4
test eax, eax
je 0x420a0a
call fcn.00402500
mov esi, 4
test eax, eax
jne 0x420a0f
mov esi, 3
lea edx, [ebp + 0xc0]
push edx
call fcn.004070c0
add esp, 4
mov eax, esi
jmp 0x421530
cmp dword [ebp + 0x12d78], ebx
je 0x420add
cmp dword [ebp + 0x60], ebx
je 0x42152e
lea eax, [ebp + 0xbc]
push eax
call fcn.004184d0
add esp, 4
test eax, eax
je 0x420a9e
call fcn.00418160
test eax, eax
je 0x420a9e
lea ecx, [ebp - 0x20]
push ecx
mov ecx, dword [ebp + 0xbc]
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp - 0x18]
push eax
push ecx
lea edx, [ebp + 0xc0]
push edx
call fcn.00403770
add esp, 0x14
test eax, eax
je 0x420a9e
lea eax, [ebp]
push eax
call fcn.00418180
add esp, 4
test eax, eax
je 0x420a9e
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffffe
cmp ecx, 1
ja 0x420aa0
mov esi, 1
jmp 0x420aa0
xor esi, esi
call fcn.004186e0
test eax, eax
jne 0x420ac7
mov edx, dword [ebp - 0x24]
push edx
call fcn.00401c30
add esp, 4
test eax, eax
je 0x420abc
or esi, 4
mov eax, dword [ebp - 0x20]
add eax, 0xffffffff
jne 0x420ac7
or esi, 4
lea ecx, [ebp + 0xc0]
push ecx
call fcn.004070c0
add esp, 4
mov eax, esi
jmp 0x421530
cmp dword [ebp + 0x12d7c], ebx
je 0x420aef
call fcn.004060a0
jmp 0x421530
cmp dword [ebp + 0x5c], ebx
je 0x420b09
cmp dword [ebp + 0x60], ebx
jne 0x420b38
cmp dword [ebp + 0x12d64], ebx
jne 0x420b09
cmp dword [ebp + 0x12d70], ebx
je 0x420b38
lea edx, [ebp + 0xc0]
push edx
call fcn.004070c0
add esp, 4
mov eax, dword [0x4464d4]
cmp eax, ebx
je 0x420b28
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x4464d4], ebx
call fcn.00419910
jmp 0x42152e
cmp dword [ebp + 0x12d44], ebx
je 0x420bef
cmp dword [ebp + 0x12d94], ebx
jne 0x420bef
push 0x206
lea ecx, [ebp + 0x14c22]
xor eax, eax
push ebx
push ecx
mov word [ebp + 0x14c20], ax
call fcn.00422290
lea edx, [ebp + 0x14c20]
push edx
call fcn.0041e290
add esp, 0x10
test eax, eax
je 0x420bef
push 0x206
lea ecx, [ebp + 0x1491a]
xor eax, eax
push ebx
push ecx
mov word [ebp + 0x14918], ax
call fcn.00422290
mov eax, dword [0x4464d4]
add esp, 0xc
cmp eax, ebx
je 0x420bac
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x4464d4], ebx
call fcn.00419910
lea edx, [ebp + 0x14c20]
push edx
push str.nvepclnt.exe
push str._s__s
lea eax, [ebp + 0x14918]
push 0x208
push eax
call fcn.00419b60
lea ecx, [ebp + 0x14918]
push 1
push ecx
call fcn.00418c60
add esp, 0x1c
jmp 0x42152e
cmp dword [ebp + 0x12d4c], ebx
jne 0x420c25
call fcn.0041dea0
test eax, eax
je 0x420c25
mov eax, dword [0x43dae4]
cmp eax, ebx
je 0x420b18
cmp eax, dword [0x4464d0]
je 0x420b18
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x420b18
cmp dword [ebp + 0x12d88], ebx
je 0x420c3c
lea edx, [ebp + 0x12d40]
push edx
call fcn.0041f7e0
add esp, 4
cmp dword [ebp + 0x12d44], ebx
je 0x420e96
lea eax, [ebp - 0x2c]
push eax
push 1
push ebx
push str.SoftwareNVIDIA_CorporationGlobal_nViewInstalled
mov dword [ebp - 0x2c], ebx
call fcn.00418b80
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
call esi
test eax, eax
jne 0x420c7a
mov ecx, dword [ebp - 0x2c]
push ecx
mov dword [ebp - 0x44], 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp + 0x12d44], ebx
je 0x420e96
lea edx, [ebp - 0x18]
push edx
push 0x20019
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
mov dword [ebp - 0x18], ebx
call esi
test eax, eax
jne 0x420d4f
push 0xc6
lea ecx, [ebp + 0x14b5a]
push ebx
push ecx
mov word [ebp + 0x14b58], ax
call fcn.00422290
mov ecx, dword [ebp - 0x18]
add esp, 0xc
lea edx, [ebp - 0x30]
push edx
lea eax, [ebp + 0x14b58]
push eax
push ebx
push ebx
push 0x435180
push ecx
mov dword [ebp - 0x30], 0xc8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x420d3d
cmp word [ebp + 0x14b58], 0x72
jne 0x420d3d
mov edi, dword [sym.imp.USER32.dll_FindWindowW]
push str.NVIDIA_TwinView_Window
push str.NVIDIA_TwinView_Window
xor esi, esi
call edi
test eax, eax
jne 0x420d43
lea esp, [esp]
cmp esi, 0x1e
jae 0x420d43
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.NVIDIA_TwinView_Window
push str.NVIDIA_TwinView_Window
inc esi
call edi
test eax, eax
je 0x420d10
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x420d55
mov edi, dword [sym.imp.USER32.dll_FindWindowW]
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x420d55
mov edi, dword [sym.imp.USER32.dll_FindWindowW]
lea eax, [ebp]
push eax
call fcn.00419ff0
add esp, 4
cmp dword [ebp + 0x74], ebx
jne 0x420e19
cmp dword [ebp + 0x12d8c], ebx
jne 0x420e19
cmp dword [ebp + 0x12d90], ebx
je 0x420e9c
mov eax, dword [0x43dae4]
cmp eax, ebx
je 0x420d9a
cmp eax, dword [0x4464d0]
je 0x420d9a
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [0x4464d4]
cmp eax, ebx
je 0x420daa
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x4464d4], ebx
call fcn.00419910
push 0x206
lea edx, [ebp + 0x1491a]
xor ecx, ecx
push ebx
push edx
mov word [ebp + 0x14918], cx
call fcn.00422290
push str.nViewLoadNoHook
push str.nview.dll
push 0x436508
lea eax, [ebp + 0x14918]
push 0x208
push eax
call fcn.00419b60
add esp, 0x20
push 1
lea ecx, [ebp + 0x14530]
push ecx
lea edx, [ebp + 0x14918]
push edx
push str.rundll32.exe
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x42152e
push 1
call fcn.00419bd0
mov eax, dword [0x4464c4]
add esp, 4
cmp eax, ebx
je 0x420e3a
call eax
test eax, eax
jne 0x420e3a
push 1
call dword [0x446454]
push str.NVIDIA_TwinView_Window
push str.NVIDIA_TwinView_Window
xor esi, esi
call edi
test eax, eax
jne 0x420e71
lea esp, [esp]
cmp esi, 0x3c
jae 0x420e71
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.NVIDIA_TwinView_Window
push str.NVIDIA_TwinView_Window
inc esi
call edi
test eax, eax
je 0x420e50
cmp dword [ebp + 0x74], ebx
jne 0x420e89
lea eax, [ebp]
push eax
mov dword [ebp + 0x64], 1
call fcn.0041a0d0
add esp, 4
mov eax, dword [0x446458]
cmp eax, ebx
je 0x420e9c
call eax
jmp 0x420e9c
mov edi, dword [sym.imp.USER32.dll_FindWindowW]
cmp dword [ebp + 0x12d4c], ebx
jne 0x420eb6
push 1
call fcn.00406de0
add esp, 4
test eax, eax
jne 0x420f61
cmp dword [ebp + 0x12d44], ebx
je 0x420f14
lea ecx, [ebp - 0x18]
push ecx
push 0x20019
push ebx
push str.SoftwareNVIDIA_CorporationGlobal_nView
push 0x80000002
mov dword [ebp - 0x18], ebx
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x420f0b
mov eax, dword [ebp - 0x18]
push ebx
push ebx
lea edx, [ebp - 0x64]
push edx
push ebx
push str.LoadAlways
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x420efe
lea esi, [eax + 1]
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x44], ebx
je 0x420f14
cmp esi, ebx
je 0x420f61
mov ecx, dword [ebp + 0x12d4c]
cmp ecx, ebx
jne 0x420f86
cmp dword [0x4464d4], ebx
jne 0x420f86
cmp dword [ebp + 0x12d44], ebx
jne 0x420f61
mov eax, dword [0x43dae4]
push 0xc8
lea edx, [ebp + 0x14c98]
push edx
push 0x7f9
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
push ebx
push 0x4464e0
lea ecx, [ebp + 0x14c98]
push ecx
push ebx
call fcn.004157a0
add esp, 0x10
mov eax, dword [0x43dae4]
cmp eax, ebx
je 0x42152e
cmp eax, dword [0x4464d0]
je 0x42152e
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x42152e
mov eax, dword [0x4464c4]
cmp eax, ebx
je 0x421082
call eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp + 0x12d4c], ebx
jne 0x421111
push str.nwiz.exe
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0x42152e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x421114
push 0xbb8
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x421114
cmp dword [ebp + 0x12d44], ebx
jne 0x42104a
push 0x18e
lea eax, [ebp + 0x14c9a]
xor edx, edx
push ebx
push eax
mov word [ebp + 0x14c98], dx
call fcn.00422290
mov edx, dword [0x43dae4]
add esp, 0xc
push 0xc8
lea ecx, [ebp + 0x14c98]
push ecx
push 0x7fc
push edx
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x4464e0
push ebx
call edi
test eax, eax
jne 0x42104a
push ebx
push 0x4464e0
lea eax, [ebp + 0x14c98]
push eax
push ebx
call fcn.004157a0
add esp, 0x10
mov eax, dword [0x43dae4]
cmp eax, ebx
je 0x421062
cmp eax, dword [0x4464d0]
je 0x421062
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [0x4464d4]
cmp eax, ebx
je 0x421072
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x4464d4], ebx
call fcn.00419910
jmp 0x421520
cmp ecx, ebx
jne 0x421111
push 0x3e6
lea eax, [ebp + 0x1473a]
xor edx, edx
push ebx
push eax
mov word [ebp + 0x14738], dx
call fcn.00422290
mov edx, dword [0x43dae4]
add esp, 0xc
push 0x1f4
lea ecx, [ebp + 0x14738]
push ecx
push 0x4779
push edx
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp + 0x14738]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x4210f1
push 0x40010
push 0x4464e0
lea ecx, [ebp + 0x14738]
push ecx
push ebx
call fcn.004157a0
add esp, 0x10
mov eax, dword [0x4464d4]
cmp eax, ebx
je 0x421101
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x4464d4], ebx
call fcn.00419910
jmp 0x420f61
mov esi, dword [ebp - 0x20]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp + 0x12d60], ebx
je 0x4211a2
lea ecx, [ebp + 0x14530]
push ecx
call fcn.0041e540
add esp, 4
lea edx, [ebp - 0x14]
push edx
push 0xf003f
push ebx
push str.SoftwareNVIDIA_CorporationGlobal
call fcn.00418b80
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42117d
mov eax, dword [ebp - 0x14]
push 0x435180
push eax
call fcn.00418dc0
mov ecx, dword [ebp - 0x14]
add esp, 8
push ecx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x14], ebx
mov eax, dword [0x43dae4]
cmp eax, ebx
je 0x42151c
cmp eax, dword [0x4464d0]
je 0x42151c
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x42151c
cmp dword [ebp + 0x12d4c], ebx
je 0x4211e0
mov eax, dword [ebp + 0x12d50]
push eax
lea ecx, [ebp + 0x14530]
push ecx
call fcn.0041b380
mov eax, dword [0x4464d4]
add esp, 8
cmp eax, ebx
je 0x4211d0
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x4464d4], ebx
call fcn.00419910
jmp 0x42151c
lea edx, [ebp]
push ebx
push edx
call fcn.0041a1e0
add esp, 8
mov dword [ebp + 0x7c], ebx
cmp dword [ebp + 0x12d44], ebx
je 0x421767
xor esi, esi
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x3c], ebx
cmp dword [ebp + 0x5c], ebx
je 0x421757
cmp dword [ebp + 0x80], ebx
je 0x421267
lea eax, [ebp - 0x14]
push eax
push 0x20019
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionRun_nview
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x421255
mov ecx, dword [ebp - 0x14]
push 0x435180
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x14], ebx
push str.SoftwareMicrosoftWindowsCurrentVersionRun_nview
push 0x80000001
call fcn.00418dc0
add esp, 8
lea eax, [ebp - 0x14]
push eax
push 0xf003f
push ebx
push str.SOFTWARENVIDIA_CorporationGlobalNVTweak
push 0x80000001
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x34], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4212da
lea ecx, [ebp - 0x34]
push ecx
mov ecx, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x7c]
push eax
push ebx
push str.DesktopManager
push ecx
call edi
cmp dword [ebp - 0x18], ebx
je 0x4212cd
mov eax, dword [ebp - 0x14]
push 4
lea edx, [ebp - 0x18]
push edx
push 4
push ebx
push str.DesktopManager
push eax
mov dword [ebp - 0x18], ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x44], ebx
je 0x4212eb
mov dword [ebp - 0x1c], 1
jmp 0x4213f5
lea eax, [ebp]
push 1
push eax
call fcn.0041a1e0
add esp, 8
cmp dword [ebp + 0x54], 1
ja 0x421313
cmp dword [ebp + 0x12d54], ebx
jne 0x421313
mov dword [ebp - 0x1c], 1
jmp 0x421402
lea ecx, [ebp - 0x40]
push ecx
lea edx, [ebp - 0x14]
push edx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.SoftwareNVIDIA_CorporationGlobal_nViewInstalled
call fcn.00418b80
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x421346
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x14], ebx
lea ecx, [ebp - 0x14]
push ecx
push 0x20019
push ebx
push str.SoftwareNVIDIA_CorporationGlobal_nView
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x421402
lea edx, [ebp - 0x28]
push edx
mov edx, dword [ebp - 0x14]
lea eax, [ebp + 0x14918]
push eax
lea ecx, [ebp - 0x24]
push ecx
push ebx
push str.InitProfile
push edx
mov dword [ebp - 0x28], 0x208
call edi
test eax, eax
jne 0x421391
lea esi, [eax + 1]
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x24]
push edx
push ebx
push str.CopyKeys
push eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x28], 4
call edi
test eax, eax
jne 0x4213c3
cmp dword [ebp - 0x18], ebx
je 0x4213c3
mov dword [ebp - 0x30], 1
lea ecx, [ebp - 0x28]
push ecx
mov ecx, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x24]
push eax
push ebx
push str.LoadModes
push ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x28], 4
call edi
test eax, eax
jne 0x4213f5
cmp dword [ebp - 0x18], ebx
je 0x4213f5
mov dword [ebp - 0x50], 1
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x14], ebx
lea eax, [ebp - 0x14]
push eax
push 0x20019
push ebx
push str.SoftwareNVIDIA_CorporationGlobal_nView
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4214c9
mov edx, dword [ebp - 0x14]
push ebx
push ebx
lea ecx, [ebp - 0x24]
push ecx
push ebx
push str.LoadAlways
push edx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x28], 0x208
call edi
test eax, eax
jne 0x421464
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x14]
lea ecx, [ebp + 0x14918]
push ecx
lea edx, [ebp - 0x24]
push edx
push ebx
push str.LoadAlways
push eax
call edi
mov esi, 1
lea ecx, [ebp - 0x28]
push ecx
mov ecx, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x24]
push eax
push ebx
push str.ProfileLoadMask
push ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x28], 4
call edi
test eax, eax
jne 0x421490
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x2c], edx
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x24]
push edx
push ebx
push str.ProfileCplMask
push eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x28], 4
call edi
test eax, eax
jne 0x4214bc
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x3c], ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x14], ebx
cmp dword [ebp + 0x12d84], ebx
jne 0x4216c7
cmp esi, ebx
je 0x4216be
cmp dword [0x4464d4], ebx
jne 0x421557
mov ecx, dword [0x43dae4]
push 0xc8
lea eax, [ebp + 0x14c98]
push eax
push 0x7f9
push ecx
call dword [sym.imp.USER32.dll_LoadStringW]
push ebx
push 0x4464e0
lea edx, [ebp + 0x14c98]
push edx
push ebx
call fcn.004157a0
add esp, 0x10
mov esi, dword [ebp - 0x20]
cmp esi, ebx
je 0x42152e
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x14e28]
xor ecx, ebp
call fcn.00422272
add ebp, 0x14e2c
mov esp, ebp
pop ebp
ret 0x10
mov edi, 1
call dword [0x4464c4]
test eax, eax
jne 0x4215af
mov eax, dword [0x446400]
xor esi, esi
xor edi, edi
push 1
cmp eax, ebx
jne 0x4215ad
call dword [0x446454]
call dword [0x4464c4]
test eax, eax
jne 0x4215a0
cmp esi, 0xa
jae 0x4215a0
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
call dword [0x4464c4]
test eax, eax
je 0x421585
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4215af
call eax
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp + 0x14b20]
push ecx
push ebx
xor esi, esi
call dword [0x4464bc]
test eax, eax
je 0x4216a9
jmp 0x4215d0
lea edx, [ebp + 0x14b20]
push edx
push str._s.tvp
lea eax, [ebp + 0x14d28]
push 0x100
push eax
call fcn.00419b60
lea ecx, [ebp + 0x14d28]
push 0x100
push ecx
call fcn.00423a0b
lea edx, [ebp + 0x14918]
push 0x208
push edx
call fcn.00423a0b
add esp, 0x20
lea ecx, [ebp + 0x14918]
lea eax, [ebp + 0x14d28]
mov edi, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x421646
cmp dx, bx
je 0x421642
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x421646
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x421620
xor eax, eax
jmp 0x42164b
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x42166c
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp + 0x14b20]
push ecx
inc esi
push esi
call dword [0x4464bc]
test eax, eax
jne 0x4215d0
jmp 0x4216a9
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x50], ebx
je 0x421687
mov edx, dword [ebp - 0x3c]
push edx
or eax, 0x401
push eax
lea eax, [ebp + 0x14b20]
push eax
jmp 0x421698
mov ecx, dword [ebp - 0x3c]
push ecx
or eax, 0x400
push eax
lea edx, [ebp + 0x14b20]
push edx
call dword [0x446418]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp edi, ebx
jne 0x4216be
call dword [0x4464c4]
test eax, eax
je 0x4216be
push ebx
call dword [0x446454]
cmp dword [ebp - 0x30], ebx
je 0x421757
mov eax, dword [0x4464c4]
xor esi, esi
mov dword [ebp - 0x2c], ebx
cmp eax, ebx
je 0x4216e7
call eax
test eax, eax
je 0x4216e7
push ebx
call dword [0x446454]
mov esi, 1
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x2c]
push ecx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.SoftwareNVIDIA_CorporationGlobal_nView
call fcn.00418b80
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x42173d
push str.SHLWAPI
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, ebx
je 0x42173d
push str.SHCopyKeyW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x42173d
mov edx, dword [ebp - 0x2c]
push ebx
push edx
push str.SoftwareNVIDIA_CorporationGlobal_nView
push 0x80000002
call eax
mov eax, dword [ebp - 0x2c]
cmp eax, ebx
je 0x42174b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x421757
push 1
call dword [0x446454]
mov eax, dword [ebp + 0x12d48]
or dword [ebp - 0x1c], eax
mov dword [ebp + 0x7c], 1
cmp dword [ebp + 0x12d64], ebx
je 0x421789
mov dword [ebp + 8], 2
mov dword [ebp], 0x15
mov dword [ebp + 0x12c28], 0xb78
jmp 0x4217db
cmp dword [ebp + 0x12d70], ebx
je 0x4217ab
mov dword [ebp + 8], 4
mov dword [ebp], 0xb
mov dword [ebp + 0x12c28], 0xb97
jmp 0x4217db
cmp dword [ebp + 0x12d6c], ebx
je 0x4217c3
mov dword [ebp + 8], 3
mov dword [ebp], 7
jmp 0x4217db
mov dword [ebp + 8], 1
mov dword [ebp], 0x16
mov dword [ebp + 0x12c28], 0x855
push 0xc8
mov dword [ebp + 4], 0xffffffff
call fcn.00422359
mov esi, eax
push 0x190
mov dword [ebp - 0x30], esi
call fcn.00422359
push 0x4b0
mov dword [ebp + 0x12c14], eax
call fcn.00422359
add esp, 0xc
mov dword [ebp + 0x12c18], eax
cmp esi, ebx
je 0x421519
cmp dword [ebp + 0x12c14], ebx
je 0x421519
cmp eax, ebx
je 0x421519
push 0xc8
push ebx
push esi
call fcn.00422290
mov ecx, dword [ebp + 0x12c14]
push 0x190
push ebx
push ecx
call fcn.00422290
mov edx, dword [ebp + 0x12c18]
push 0x4b0
push ebx
push edx
call fcn.00422290
mov eax, dword [ebp + 8]
add esp, 0x24
cmp eax, 3
jne 0x42187d
lea eax, [ebp]
push eax
push esi
call fcn.0041fe90
add esp, 8
jmp 0x421b38
mov edi, 1
cmp eax, edi
jne 0x421aa5
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0x60], ebx
je 0x421a2e
lea ecx, [ebp + 0xbc]
push ecx
call fcn.004184d0
add esp, 4
cmp eax, ebx
jne 0x4218b8
cmp dword [ebp + 0x12d54], ebx
je 0x421a2e
call fcn.00418160
cmp eax, ebx
jne 0x4218e7
push 4
call fcn.004237c1
add esp, 4
cmp eax, ebx
je 0x4218d6
mov dword [eax], ebx
mov dword [ebp - 0x60], eax
jmp 0x4218d9
mov dword [ebp - 0x60], ebx
push 0x438adc
lea edx, [ebp - 0x60]
push edx
call fcn.00423e08
lea eax, [ebp]
push edi
push eax
call fcn.00406d00
add esp, 8
cmp eax, ebx
jne 0x42191e
push 4
call fcn.004237c1
add esp, 4
cmp eax, ebx
je 0x42190d
mov dword [eax], ebx
mov dword [ebp - 0x54], eax
jmp 0x421910
mov dword [ebp - 0x54], ebx
push 0x438adc
lea ecx, [ebp - 0x54]
push ecx
call fcn.00423e08
call fcn.00408f00
cmp eax, ebx
je 0x421961
test dword [ebp + 0x6c4], 0xffff00
jne 0x421961
cmp dword [ebp + 0x12d54], ebx
jne 0x421961
push 4
call fcn.004237c1
add esp, 4
cmp eax, ebx
je 0x421950
mov dword [eax], ebx
mov dword [ebp - 0x58], eax
jmp 0x421953
mov dword [ebp - 0x58], ebx
push 0x438adc
lea edx, [ebp - 0x58]
push edx
call fcn.00423e08
lea eax, [ebp]
push eax
mov ecx, eax
push ecx
push esi
call fcn.00410660
add esp, 0xc
cmp dword [ebp - 0x1c], ebx
jne 0x421a22
cmp dword [ebp + 0x5c], ebx
jne 0x42198b
cmp dword [ebp + 0x12d54], ebx
je 0x421a22
lea edx, [ebp - 0x18]
push edx
push edi
push ebx
push str.SoftwareNVIDIA_CorporationGlobal_nViewInstalled
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4219d5
mov eax, dword [ebp - 0x18]
push ebx
push ebx
push ebx
push ebx
push str.wizard
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4219d5
mov ecx, dword [ebp - 0x18]
push ecx
mov dword [ebp - 0x1c], edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
jmp 0x421b38
lea edx, [ebp - 0x40]
push edx
lea eax, [ebp - 0x18]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.SoftwareNVIDIA_CorporationGlobal_nViewInstalled
push 0x80000002
mov dword [ebp - 0x40], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x421a22
mov edx, dword [ebp - 0x18]
push 4
lea ecx, [ebp - 0x34]
push ecx
push 4
push ebx
push str.wizard
push edx
mov dword [ebp - 0x34], edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
jmp 0x421b38
push 4
call fcn.004237c1
add esp, 4
cmp eax, ebx
je 0x421a43
mov dword [eax], ebx
mov dword [ebp - 0x5c], eax
jmp 0x421a46
mov dword [ebp - 0x5c], ebx
push 0x438adc
lea ecx, [ebp - 0x5c]
push ecx
call fcn.00423e08
mov edx, dword [ebp - 0x80]
push edx
call fcn.00422e16
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, 0x421a6d
ret
cmp eax, 2
jne 0x421af7
lea ecx, [ebp + 0xbc]
push ecx
call fcn.004184d0
add esp, 4
test eax, eax
je 0x421aef
call fcn.00418160
test eax, eax
je 0x421aef
lea edx, [ebp]
push edi
push edx
call fcn.00406d00
add esp, 8
test eax, eax
je 0x421aef
call fcn.00408f00
test eax, eax
jne 0x421aef
lea eax, [ebp]
push eax
mov ecx, eax
push ecx
push esi
call fcn.00410810
jmp 0x421b35
mov esi, dword [ebp - 0x20]
jmp 0x421520
cmp eax, 4
jne 0x421b38
lea edx, [ebp + 0xbc]
push edx
call fcn.004184d0
add esp, 4
test eax, eax
je 0x421519
lea eax, [ebp]
push edi
push eax
call fcn.00406d00
add esp, 8
test eax, eax
je 0x421519
lea ecx, [ebp]
push ecx
mov edx, ecx
push edx
push esi
call fcn.00410970
add esp, 0xc
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp]
mov esi, dword [ebp - 0x30]
lea edx, [ebp + 0xc]
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp + 8]
push edx
xor edi, edi
push eax
mov dword [ebp - 0xb4], 0x34
mov dword [ebp - 0xac], edi
mov dword [ebp - 0x94], esi
mov dword [ebp - 0xb0], 0x1088020
mov dword [ebp - 0x8c], 0x837
mov dword [ebp - 0x84], 0x836
mov dword [ebp - 0x98], edi
mov dword [ebp - 0x9c], ecx
call fcn.00419700
mov ecx, dword [ebp + 0x12d6c]
mov ebx, dword [ebp - 0x4c]
add esp, 8
mov dword [ebp + 0x6c], edi
mov dword [ebp + 0x70], edi
mov dword [ebp + 0x4c], edi
mov dword [ebp + 0x94], edi
mov dword [ebp + 0x98], ecx
cmp dword [ebp - 0x1c], edi
jne 0x421db6
cmp dword [ebp + 0x5c], edi
jne 0x421bd1
cmp dword [ebp + 0x12d54], edi
je 0x421db6
cmp dword [0x4464d4], edi
jne 0x421c64
push 1
call fcn.00419bd0
add esp, 4
cmp dword [0x4464d4], edi
jne 0x421c64
mov eax, dword [0x43dae4]
push 0xc8
lea edx, [ebp + 0x14c98]
push edx
push 0x7f9
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
push edi
push 0x4464e0
lea ecx, [ebp + 0x14c98]
push ecx
push edi
call fcn.004157a0
push esi
call fcn.00422423
mov eax, dword [ebp + 0x12c14]
add esp, 0x14
cmp eax, edi
je 0x421c41
push eax
call fcn.00422423
add esp, 4
mov dword [ebp + 0x12c14], edi
mov eax, dword [ebp + 0x12c18]
cmp eax, edi
je 0x421c5a
push eax
call fcn.00422423
add esp, 4
mov dword [ebp + 0x12c18], edi
mov esi, dword [ebp - 0x20]
cmp esi, edi
jmp 0x42151e
call dword [0x4464c4]
test eax, eax
jne 0x421cae
cmp dword [ebp + 0x12d6c], edi
je 0x421cae
cmp dword [ebp + 0x5c], edi
je 0x421cae
push 1
xor esi, esi
call dword [0x446454]
call dword [0x4464c4]
test eax, eax
jne 0x421cae
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, 0xa
jae 0x421cac
push 0x1f4
call edi
inc esi
call dword [0x4464c4]
test eax, eax
je 0x421c95
xor edi, edi
lea edx, [ebp - 0xb4]
push edx
call dword [sym.imp.COMCTL32.dll_PropertySheetW]
cmp dword [ebp + 0x12d6c], edi
je 0x421ceb
cmp dword [ebp + 0x10], edi
je 0x421ceb
cmp dword [ebp + 0x70], edi
jne 0x421d4e
cmp dword [ebp + 0x6c], edi
je 0x421cf0
cmp dword [ebp + 0x5c], edi
je 0x421cf0
push 0xc00
push str.nvwiztmp
call dword [0x446424]
cmp dword [ebp + 0x70], edi
jne 0x421d4e
mov eax, dword [ebp + 0x74]
cmp eax, edi
je 0x421d51
cmp dword [ebp + 0x7c], edi
je 0x421d51
mov ecx, dword [0x43dae4]
push 0xff
lea eax, [ebp + 0x14c28]
push eax
push 0x800
push ecx
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x24
push 0xa07
call fcn.004159c0
add esp, 4
push eax
lea edx, [ebp + 0x14c28]
push edx
push edi
call fcn.004157a0
add esp, 0x10
cmp eax, 7
jne 0x421d4e
lea eax, [ebp]
push eax
mov dword [ebp + 0x64], edi
call fcn.0041a0d0
add esp, 4
mov eax, dword [ebp + 0x74]
cmp dword [ebp + 0x12d6c], edi
je 0x421d71
cmp dword [ebp + 0x6c], edi
je 0x421d71
cmp dword [ebp + 0x5c], edi
je 0x421d71
push str.nvwiztmp
call dword [0x4464ac]
mov eax, dword [ebp + 0x74]
cmp dword [ebp + 0x7c], edi
je 0x421d86
cmp dword [ebp + 0x70], edi
jne 0x421d8b
neg eax
sbb eax, eax
and eax, dword [ebp + 0x64]
mov ebx, eax
jmp 0x421d8e
cmp dword [ebp + 0x70], edi
je 0x421d8e
mov ebx, dword [ebp + 0x64]
mov eax, dword [ebp + 0xc]
cmp eax, edi
je 0x421d9f
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebp + 0xc], edi
mov eax, dword [ebp + 0x9c]
cmp eax, edi
je 0x421db6
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebp + 0x9c], edi
cmp dword [ebp + 0x8c], edi
je 0x421e6b
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
cmp dword [ebp + 0x12d6c], 0
je 0x421eb9
cmp dword [ebp + 0x3c], 0
je 0x421eb9
call dword [0x446498]
cmp eax, 6
jae 0x421eb9
call dword [0x446420]
test al, 2
jne 0x421eb9
mov edx, dword [0x43dae4]
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x32
lea ecx, [ebp + 0x14bbc]
push ecx
push 0x3d01
push edx
call esi
mov ecx, dword [0x43dae4]
push 0x190
lea eax, [ebp + 0x14800]
push eax
push 0x3d02
push ecx
call esi
push 0
lea edx, [ebp + 0x14bbc]
push edx
lea eax, [ebp + 0x14800]
push eax
push 0
call fcn.004157a0
add esp, 0x10
cmp dword [ebp + 0x12d6c], 0
je 0x421e6b
mov eax, dword [ebp + 0x88]
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
push ecx
push 2
call dword [0x44645c]
xor edi, edi
cmp dword [ebp + 0x12d58], edi
je 0x421e89
lea edx, [ebp]
mov ebx, 1
push edx
mov dword [ebp + 0x64], ebx
call fcn.0041a0d0
add esp, 4
cmp dword [ebp + 0xa0], edi
jne 0x42211a
cmp dword [ebp + 0x5c], edi
je 0x422107
call dword [0x4464c4]
cmp ebx, edi
je 0x4220e9
test eax, eax
je 0x4220ed
jmp 0x4220ff
cmp dword [0x4464d8], 1
jne 0x421f07
mov edi, dword [sym.imp.USER32.dll_FindWindowExW]
push 0
push str.32770
push 0
push 0
call edi
mov esi, eax
test esi, esi
je 0x421f07
jmp 0x421ee0
push str.NVIDIA_Dualview
push 0x43657c
push 0
push esi
call edi
test eax, eax
jne 0x422048
push eax
push str.32770
push esi
push eax
call edi
mov esi, eax
test esi, esi
jne 0x421ee0
cmp dword [ebp + 0x12d6c], 0
je 0x421e6b
xor ecx, ecx
push 0x62
push ecx
lea edx, [ebp + 0x14bbe]
push edx
mov word [ebp + 0x14bbc], cx
call fcn.00422290
mov ecx, dword [0x43dae4]
mov edi, dword [sym.imp.USER32.dll_LoadStringW]
add esp, 0xc
push 0x190
lea eax, [ebp + 0x14800]
push eax
push 0x3d03
push ecx
call edi
mov eax, dword [0x43dae4]
push 0x32
lea edx, [ebp + 0x14bbc]
push edx
push 0x3d01
push eax
call edi
push 0x34
lea ecx, [ebp + 0x14bbc]
push ecx
lea edx, [ebp + 0x14800]
push edx
push 0
call fcn.004157a0
add esp, 0x10
cmp eax, 6
jne 0x421e6b
mov eax, dword [ebp + 0x3c]
lea ecx, [ebp - 0x1c]
push ecx
push 2
mov dword [ebp - 0x1c], eax
call dword [0x44645c]
mov esi, dword [sym.imp.USER32.dll_ExitWindowsEx]
push 0
push 0
call esi
test eax, eax
jne 0x4220d5
mov eax, dword [0x43dae4]
push 0x190
lea edx, [ebp + 0x14800]
push edx
push 0x3d04
push eax
call edi
push 0x31
lea ecx, [ebp + 0x14bbc]
push ecx
lea edx, [ebp + 0x14800]
push edx
push 0
call fcn.004157a0
mov edi, 1
add esp, 0x10
cmp eax, edi
jne 0x4220c3
lea eax, [ebp - 0x38]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea ecx, [ebp - 0x70]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [ebp - 0x38]
push 0
push 0
push 0
lea edx, [ebp - 0x74]
push edx
push 0
push eax
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x68], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0
push 2
call esi
push 0
mov dword [ebp - 0x48], edi
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x421e6b
xor ecx, ecx
push 0x62
push ecx
lea edx, [ebp + 0x14bbe]
push edx
mov word [ebp + 0x14bbc], cx
call fcn.00422290
mov ecx, dword [0x43dae4]
add esp, 0xc
push 0x32
lea eax, [ebp + 0x14bbc]
push eax
push 0x3d01
push ecx
call dword [sym.imp.USER32.dll_LoadStringW]
push 0xa0d
call fcn.004159c0
push eax
lea edx, [ebp + 0x14800]
push 0x320
push edx
call fcn.00419b60
push 0
lea eax, [ebp + 0x14bbc]
push eax
lea ecx, [ebp + 0x14800]
push ecx
push 0
call fcn.004157a0
mov edx, dword [ebp + 0x3c]
add esp, 0x20
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
push eax
jmp 0x421e63
mov ecx, dword [ebp + 0x88]
lea edx, [ebp - 0x1c]
mov dword [ebp - 0x1c], ecx
push edx
jmp 0x421e63
push 0
mov dword [ebp - 0x48], 1
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x421e6b
test eax, eax
je 0x4220ff
push ebx
call dword [0x446454]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp + 0xa0], edi
jne 0x42211a
cmp ebx, edi
jne 0x42211a
lea eax, [ebp + 0x14530]
push eax
call fcn.0041e540
add esp, 4
mov eax, dword [0x4464d4]
cmp eax, edi
je 0x42212a
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x4464d4], edi
call fcn.00419910
mov eax, dword [0x43dae4]
cmp eax, edi
je 0x42214d
cmp eax, dword [0x4464d0]
je 0x42214d
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [ebp - 0x20]
cmp esi, edi
je 0x422162
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 0xa0], edi
jne 0x42221f
cmp dword [ebp - 0x48], edi
jne 0x42221f
cmp dword [ebp + 0x12d80], edi
je 0x4221c8
push 1
lea ecx, [ebp + 0x14530]
push ecx
lea edx, [ebp + 0x12fa0]
push edx
lea eax, [ebp + 0x12d98]
push eax
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x21
jae 0x42221f
push edi
push 0x9fd
call fcn.004159c0
add esp, 4
push eax
lea ecx, [ebp + 0x12d98]
push ecx
push edi
call fcn.004157a0
add esp, 0x10
jmp 0x42221f
cmp dword [ebp + 0x94], edi
je 0x42221f
push 0x206
lea eax, [ebp + 0x1432a]
xor edx, edx
push edi
push eax
mov word [ebp + 0x14328], dx
call fcn.00422290
add esp, 0xc
push 0x104
lea ecx, [ebp + 0x14328]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 1
lea edx, [ebp + 0x14328]
push edx
push str.nvwdmcpl.dll_nViewMain
push str.rundll32.exe
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [ebp - 0x30]
push eax
call fcn.00422423
mov eax, dword [ebp + 0x12c14]
add esp, 4
cmp eax, edi
je 0x422244
push eax
call fcn.00422423
add esp, 4
mov dword [ebp + 0x12c14], edi
mov eax, dword [ebp + 0x12c18]
cmp eax, edi
je 0x42152e
push eax
call fcn.00422423
add esp, 4
jmp 0x42152e