Function at 0x42041d
Capabilities:
Copy file
Persist via run registry key
Set file attributes
Set registry value

Disassembly:
mov eax, 0x477735
call fcn.004461a8
mov eax, 0x22ac
call fcn.004468d0
push ebx
push esi
push edi
mov dword [ebp - 0x28], ecx
call fcn.0040104a
mov dword [ebp - 0x1c], eax
xor esi, esi
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0xab6]
mov word [ebp - 0xab8], si
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 0x1c]
stosw word es:[edi], ax
call fcn.004314d4
test eax, eax
jne 0x4205ac
lea ecx, [ebp - 0xc4]
call fcn.00401c24
mov eax, dword [0x4a0be0]
mov dword [ebp - 4], esi
cmp eax, esi
jne 0x420485
mov eax, 0x47e5b8
push eax
lea eax, [ebp - 0xab8]
push 0x4a140c
push eax
call fcn.004419d2
mov ebx, dword [sym.imp.KERNEL32.dll_CopyFileW]
lea eax, [ebp - 0xab8]
push esi
push eax
push 0x49f5e0
call ebx
lea eax, [ebp - 0xab8]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0xab8]
lea ecx, [ebp - 0xc4]
push eax
call fcn.00402067
push 9
xor eax, eax
pop ecx
lea edi, [ebp - 0x66]
push dword [0x4a0208]
mov word [ebp - 0x68], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x68]
push str._04x
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x1ab8]
push eax
lea eax, [ebp - 0x22b8]
push eax
push 0x49f5e0
call fcn.0044177c
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x22b8]
push eax
lea eax, [ebp - 0x1ab8]
push eax
call fcn.004419d2
lea eax, [ebp - 0x1ab8]
push str..ini
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x12b6]
mov word [ebp - 0x12b8], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x12b8]
push 0x4a140c
push eax
call fcn.004419d2
lea eax, [ebp - 0x12b8]
push str..ini
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x12b8]
push esi
push eax
lea eax, [ebp - 0x1ab8]
push eax
call ebx
lea eax, [ebp - 0x12b8]
lea ecx, [ebp - 0xc4]
push eax
call fcn.00402067
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc4]
call fcn.00401c51
jmp 0x4205be
lea eax, [ebp - 0xab8]
push 0x49f5e0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [str.NoSuppressRebootKey]
mov ebx, 0x47e5a0
mov edi, 0x47e598
cmp eax, esi
mov dword [ebp - 0x114], ebx
mov dword [ebp - 0xf4], edi
jne 0x4205e2
mov eax, 0x49cc4c
lea ecx, [ebp - 0x2d]
push esi
push ecx
push eax
lea ecx, [ebp - 0x114]
call fcn.00408d43
mov eax, dword [str.Startup]
mov dword [ebp - 4], 1
cmp eax, esi
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x48], edi
jne 0x42060e
mov eax, 0x49cc4c
lea ecx, [ebp - 0x1d]
push esi
push ecx
push eax
lea ecx, [ebp - 0x68]
call fcn.00408d43
mov ecx, dword [ebp - 0x1c]
push 0xa
lea eax, [ebp - 0x114]
push esi
push eax
lea eax, [ebp - 0x68]
push eax
mov byte [ebp - 4], 2
call fcn.00432f11
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x38], eax
mov byte [ebp - 4], 1
call fcn.00401bc7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x114]
call fcn.00401bc7
lea eax, [ebp - 0x1d]
mov ebx, 0x47e5e0
mov edi, 0x47e5d8
push esi
push eax
lea ecx, [ebp - 0xec]
mov dword [ebp - 0xec], ebx
mov dword [ebp - 0xcc], edi
call fcn.004029f5
mov dword [ebp - 4], 3
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x1d]
push esi
push eax
lea ecx, [ebp - 0x164]
mov byte [ebp - 4], 4
mov dword [ebp - 0x164], ebx
mov dword [ebp - 0x144], edi
call fcn.004029f5
mov eax, dword [ebp - 0x38]
mov byte [ebp - 4], 5
sub eax, esi
je 0x4206da
dec eax
je 0x4206bc
dec eax
jne 0x4206f6
mov eax, str.SoftwareMicrosoftWindowsCurrentVersionRun
jmp 0x4206c1
mov eax, str.SoftwareMicrosoftWindowsCurrentVersionRunOnceEx
mov ecx, eax
test ecx, ecx
jne 0x4206cc
mov eax, 0x49cc4c
push eax
lea ecx, [ebp - 0x164]
call fcn.00403ca9
jmp 0x420700
mov eax, str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
mov ecx, eax
test ecx, ecx
jne 0x4206ea
mov eax, 0x49cc4c
push eax
lea ecx, [ebp - 0x164]
call fcn.00403ca9
cmp dword [ebp - 0x38], 3
je 0x420efa
mov eax, dword [ebp - 0x15c]
cmp eax, esi
jne 0x42070f
mov eax, 0x47e608
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push ecx
push 0xf003f
push esi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x420efa
lea ecx, [ebp - 0x18]
call fcn.0040d2f9
mov ecx, dword [ebp - 0x10]
cmp eax, esi
mov dword [ebp - 0x18], ecx
jne 0x420efa
mov eax, dword [ebp + 8]
mov dword [ebp - 0x240], ebx
cmp eax, esi
mov dword [ebp - 0x220], edi
jne 0x42075e
mov eax, 0x49cc4c
lea ecx, [ebp + 0xb]
push esi
push ecx
push eax
lea ecx, [ebp - 0x240]
call fcn.00403c0d
cmp dword [ebp + 0xc], esi
mov byte [ebp - 4], 6
je 0x420794
push str._AFTERREBOOT1
call fcn.004468ff
pop ecx
push eax
push str._AFTERREBOOT1
lea ecx, [ebp - 0x23c]
call fcn.004152f5
lea eax, [ebp + 0xf]
push esi
push eax
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x70], edi
call fcn.004029f5
mov eax, dword [ebp - 0x1c]
mov byte [ebp - 4], 7
mov eax, dword [eax + 0x24]
dec eax
je 0x420891
dec eax
je 0x42083c
dec eax
je 0x4207e2
dec eax
je 0x4207d8
dec eax
jne 0x4208ad
mov eax, 0x494864
jmp 0x420896
mov eax, 0x49485c
jmp 0x420896
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x2b8]
push 9
push eax
call fcn.0040832b
push eax
lea eax, [ebp - 0x13c]
push 0x493370
push eax
mov byte [ebp - 4], 0xa
call fcn.004155c8
add esp, 0xc
push eax
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 0xb
call fcn.00401fe6
lea ecx, [ebp - 0x13c]
mov byte [ebp - 4], 0xa
call fcn.00401f6c
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x2b8]
call fcn.00401f6c
jmp 0x4208ad
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0xb8]
push 9
push eax
call fcn.0040832b
push eax
lea eax, [ebp - 0x290]
push 0x4933d8
push eax
mov byte [ebp - 4], 8
call fcn.004155c8
add esp, 0xc
push eax
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 9
call fcn.00401fe6
lea ecx, [ebp - 0x290]
mov byte [ebp - 4], 8
call fcn.00401f6c
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xb8]
jmp 0x420835
mov eax, 0x493420
mov ecx, eax
test ecx, ecx
jne 0x4208a1
mov eax, 0x49cc4c
push eax
lea ecx, [ebp - 0x90]
call fcn.00403ca9
mov ecx, dword [ebp - 0x1c]
call fcn.004314d4
test eax, eax
mov eax, 0x494854
jne 0x4208c3
mov eax, 0x49cc4c
cmp eax, esi
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x48], edi
jne 0x4208d2
mov eax, 0x49cc4c
lea ecx, [ebp - 0x2d]
push esi
push ecx
push eax
lea ecx, [ebp - 0x68]
call fcn.00403c0d
mov ecx, dword [ebp - 0x1c]
mov byte [ebp - 4], 0xc
call fcn.0042e55c
cmp eax, esi
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x1f8], edi
jne 0x420901
mov eax, 0x49cc4c
lea ecx, [ebp - 0x3a]
push esi
push ecx
push eax
lea ecx, [ebp - 0x218]
call fcn.00403c0d
mov ecx, dword [ebp - 0x1c]
mov byte [ebp - 4], 0xd
call fcn.0042e771
cmp eax, esi
mov dword [ebp - 0x114], ebx
mov dword [ebp - 0xf4], edi
jne 0x420933
mov eax, 0x49cc4c
lea ecx, [ebp - 0x39]
push esi
push ecx
push eax
lea ecx, [ebp - 0x114]
call fcn.00403c0d
mov eax, 0x4a140c
mov byte [ebp - 4], 0xe
test eax, eax
mov dword [ebp - 0x268], ebx
mov dword [ebp - 0x248], edi
jne 0x420962
mov eax, 0x49cc4c
lea ecx, [ebp - 0x3c]
push esi
push ecx
push eax
lea ecx, [ebp - 0x268]
call fcn.00403c0d
mov ecx, dword [ebp - 0x1c]
mov byte [ebp - 4], 0xf
call fcn.004314d4
test eax, eax
je 0x4209fc
mov eax, dword [ebp - 0x28]
cmp dword [eax + 0x54], esi
jne 0x4209fc
mov edx, dword [ebp - 0x60]
mov eax, 0x47e608
cmp edx, esi
jne 0x420999
mov edx, eax
mov ecx, dword [ebp - 0x238]
mov dword [ebp - 0x10], eax
cmp ecx, esi
je 0x4209a9
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x260]
mov dword [ebp - 0x34], eax
cmp ecx, esi
je 0x4209b9
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x10c]
mov dword [ebp - 0x28], eax
cmp ecx, esi
je 0x4209c9
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x88]
cmp ecx, esi
jne 0x4209d5
mov ecx, eax
cmp dword [ebp - 0x210], esi
je 0x4209e3
mov eax, dword [ebp - 0x210]
push edx
push dword [ebp - 0x10]
push dword [ebp - 0x34]
push dword [ebp - 0x28]
push dword [0x4a0208]
push ecx
push eax
push str.__s___k__s__l_d__t__s___e__s___w__v__s___s
jmp 0x420a6b
mov edx, dword [ebp - 0x60]
mov eax, 0x47e608
cmp edx, esi
jne 0x420a0a
mov edx, eax
mov ecx, dword [ebp - 0x238]
mov dword [ebp - 0x28], eax
cmp ecx, esi
je 0x420a1a
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x260]
mov dword [ebp - 0x34], eax
cmp ecx, esi
je 0x420a2a
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x10c]
mov dword [ebp - 0x10], eax
cmp ecx, esi
je 0x420a3a
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x88]
cmp ecx, esi
jne 0x420a46
mov ecx, eax
cmp dword [ebp - 0x210], esi
je 0x420a54
mov eax, dword [ebp - 0x210]
push edx
push dword [ebp - 0x28]
push dword [ebp - 0x34]
push dword [ebp - 0x10]
push dword [0x4a0208]
push ecx
push eax
push str.__s___s__l_d__t__s___e__s___v__s___s
lea eax, [ebp - 0xec]
push eax
call fcn.00414bf6
mov eax, dword [ebp - 0x1c]
add esp, 0x24
cmp dword [eax + 0xc14], esi
je 0x420b00
add eax, 0xc08
push eax
lea eax, [ebp - 0x290]
push str.__debuglog_
push eax
call fcn.004154ac
push 0x492cac
push eax
lea eax, [ebp - 0xb8]
mov byte [ebp - 4], 0x10
push eax
call fcn.0041553a
add esp, 0x18
mov eax, dword [eax + 8]
mov byte [ebp - 4], 0x11
cmp eax, esi
mov dword [ebp - 0x10], 0x47e5b8
je 0x420aca
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
call fcn.004468ff
pop ecx
push eax
lea ecx, [ebp - 0xe8]
push dword [ebp - 0x10]
call fcn.004152f5
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0x10
call fcn.00401bc7
lea ecx, [ebp - 0x290]
mov byte [ebp - 4], 0xf
call fcn.00401bc7
cmp dword [ebp - 0x38], 1
jne 0x420b3c
lea eax, [ebp - 0x34]
mov dword [ebp - 0x28], esi
push eax
lea eax, [ebp - 0x28]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push str.0001
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, esi
jne 0x420b3c
lea ecx, [ebp - 0x18]
call fcn.0040d2f9
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x240]
push esi
push eax
lea ecx, [ebp - 0x1f0]
mov dword [ebp - 0x1f0], ebx
mov dword [ebp - 0x1d0], edi
call fcn.00403b7a
mov ecx, dword [ebp - 0x1c]
mov byte [ebp - 4], 0x12
call fcn.0042e771
cmp eax, esi
mov dword [ebp - 0x18c], ebx
mov dword [ebp - 0x16c], edi
jne 0x420b7c
mov eax, 0x49cc4c
lea ecx, [ebp - 0x3d]
push esi
push ecx
push eax
lea ecx, [ebp - 0x18c]
call fcn.00403c0d
mov eax, 0x4a140c
mov byte [ebp - 4], 0x13
test eax, eax
mov dword [ebp - 0x1c8], ebx
mov dword [ebp - 0x1a8], edi
jne 0x420bab
mov eax, 0x49cc4c
lea ecx, [ebp - 0x3b]
push esi
push ecx
push eax
lea ecx, [ebp - 0x1c8]
call fcn.00403c0d
cmp dword [ebp - 0x180], esi
mov byte [ebp - 4], 0x14
je 0x420be6
lea eax, [ebp - 0xb8]
push esi
push eax
lea ecx, [ebp - 0x18c]
call fcn.00416a5c
lea ecx, [ebp - 0xb8]
call fcn.00401f6c
cmp dword [ebp - 0x1bc], esi
je 0x420c0c
lea eax, [ebp - 0xb8]
push esi
push eax
lea ecx, [ebp - 0x1c8]
call fcn.00416a5c
lea ecx, [ebp - 0xb8]
call fcn.00401f6c
mov edi, dword [ebp - 0xe4]
cmp edi, esi
jne 0x420c1b
mov edi, 0x47e608
lea eax, [ebp - 0x11]
push 1
push eax
push str.C:CodeBasesisdev_srcRuntimeMSISharedSetupmsiaction.cpp
lea ecx, [ebp - 0xb8]
call fcn.00401764
mov eax, dword [eax + 8]
mov byte [ebp - 4], 0x15
cmp eax, esi
jne 0x420c41
mov eax, 0x47e5b8
mov dword [ebp - 0x2c], eax
push edi
lea eax, [ebp - 0x2c]
push str.MsiAction::Reboot_command_line__s
push eax
mov dword [ebp - 0x28], 0x6c6
call fcn.00408437
add esp, 0xc
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0x14
call fcn.00401bc7
mov dword [ebp - 0x24], esi
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x16
push eax
push 0xf003f
push esi
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x28], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, esi
jne 0x420e2b
lea ecx, [ebp - 0x24]
call fcn.0040d2f9
mov ecx, dword [ebp - 0x28]
cmp eax, esi
mov dword [ebp - 0x24], ecx
jne 0x420e2b
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0x10], 0x47e608
cmp eax, esi
je 0x420cce
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
call ebx
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0x10]
push 1
push esi
push str._IS_T_
push dword [ebp - 0x24]
call edi
mov eax, dword [ebp - 0x1c0]
mov dword [ebp - 0x10], 0x47e608
cmp eax, esi
je 0x420cfc
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
call ebx
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0x10]
push 1
push esi
push str._IS_E_
push dword [ebp - 0x24]
call edi
cmp dword [ebp - 0x1e4], esi
je 0x420d4c
mov eax, dword [ebp - 0x1e8]
mov dword [ebp - 0x10], 0x47e608
cmp eax, esi
je 0x420d32
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
call ebx
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0x10]
push 1
push esi
push str._IS_V_
push dword [ebp - 0x24]
call edi
cmp dword [ebp - 0x24], esi
je 0x420d5d
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x24], esi
lea eax, [ebp - 0x11]
push 1
push eax
push str._IS_T_
lea ecx, [ebp - 0x13c]
call fcn.00403c0d
lea eax, [ebp - 0x13c]
lea ecx, [ebp - 0xec]
push eax
lea eax, [ebp - 0x18c]
push eax
mov byte [ebp - 4], 0x17
call fcn.00403cd2
lea ecx, [ebp - 0x13c]
mov byte [ebp - 4], 0x16
call fcn.00401f6c
lea eax, [ebp - 0x11]
push 1
push eax
push str._IS_E_
lea ecx, [ebp - 0x13c]
call fcn.00403c0d
lea eax, [ebp - 0x13c]
lea ecx, [ebp - 0xec]
push eax
lea eax, [ebp - 0x1c8]
push eax
mov byte [ebp - 4], 0x18
call fcn.00403cd2
lea ecx, [ebp - 0x13c]
mov byte [ebp - 4], 0x16
call fcn.00401f6c
cmp dword [ebp - 0x1e4], esi
je 0x420e2b
lea eax, [ebp - 0x11]
push 1
push eax
push str._IS_V_
lea ecx, [ebp - 0x13c]
call fcn.00403c0d
lea eax, [ebp - 0x13c]
lea ecx, [ebp - 0xec]
push eax
lea eax, [ebp - 0x1f0]
push eax
mov byte [ebp - 4], 0x19
call fcn.00403cd2
lea ecx, [ebp - 0x13c]
mov byte [ebp - 4], 0x16
call fcn.00401f6c
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x10], 0x47e608
cmp eax, esi
je 0x420e3f
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
call ebx
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0x10]
push 1
push esi
push str.ISSetup
push dword [ebp - 0x18]
call edi
cmp dword [ebp - 0x18], esi
je 0x420e6a
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x14
call fcn.0040d2f9
lea ecx, [ebp - 0x1c8]
mov byte [ebp - 4], 0x13
call fcn.00401f6c
lea ecx, [ebp - 0x18c]
mov byte [ebp - 4], 0x12
call fcn.00401f6c
lea ecx, [ebp - 0x1f0]
mov byte [ebp - 4], 0xf
call fcn.00401f6c
lea ecx, [ebp - 0x268]
mov byte [ebp - 4], 0xe
call fcn.00401f6c
lea ecx, [ebp - 0x114]
mov byte [ebp - 4], 0xd
call fcn.00401f6c
lea ecx, [ebp - 0x218]
mov byte [ebp - 4], 0xc
call fcn.00401f6c
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 7
call fcn.00401f6c
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 6
call fcn.00401f6c
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 5
call fcn.00401f6c
xor eax, eax
lea edi, [ebp - 0x19e]
mov word [ebp - 0x1a0], si
mov dword [ebp - 0x68], 0x47e5a0
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [str.Type]
mov dword [ebp - 0x48], 0x47e598
cmp eax, esi
jne 0x420f2b
mov eax, 0x49cc4c
lea ecx, [ebp + 0xb]
push esi
push ecx
push eax
lea ecx, [ebp - 0x68]
call fcn.00408d43
mov edi, dword [ebp - 0x1c]
lea eax, [ebp - 0x290]
push 6
push eax
mov ecx, edi
mov byte [ebp - 4], 0x1a
call fcn.0040832b
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0x1b
push ecx
mov ecx, eax
call fcn.00414baf
push 0xa
lea ecx, [ebp - 0x68]
push esi
push ecx
push eax
mov ecx, edi
mov byte [ebp - 4], 0x1c
call fcn.00432f11
lea ecx, [ebp - 0xb8]
mov ebx, eax
mov byte [ebp - 4], 0x1b
call fcn.00401bc7
lea ecx, [ebp - 0x290]
mov byte [ebp - 4], 0x1a
call fcn.00401f6c
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 5
call fcn.00401bc7
push 0xc
mov ecx, edi
call fcn.00408306
test al, al
jne 0x420fbc
cmp ebx, 1
je 0x420fbc
cmp ebx, 2
jne 0x421064
push 4
lea eax, [ebp - 0x1a0]
push 0x494758
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [ebp - 0x88]
call fcn.00402569
lea eax, [ebp - 0xab8]
lea ecx, [ebp - 0x88]
push eax
mov byte [ebp - 4], 0x1d
call fcn.004025b1
lea eax, [ebp - 0xb8]
push 6
push eax
mov ecx, edi
call fcn.0040832b
mov eax, dword [eax + 8]
mov byte [ebp - 4], 0x1e
cmp eax, esi
jne 0x421014
mov eax, 0x47e608
lea ecx, [ebp - 0x1a0]
push ecx
lea ecx, [ebp - 0x88]
push dword [0x47e748]
push eax
call fcn.004025f0
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0x1d
call fcn.00401f6c
lea ecx, [ebp - 0x88]
call fcn.004025dd
push 1
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 0x1f
call fcn.00402f32
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 5
call fcn.00403989
cmp dword [ebp - 0x38], 3
je 0x421084
cmp dword [0x4a1c14], esi
je 0x421079
call fcn.00442149
jmp 0x421084
push 0x453
call fcn.00441026
pop ecx
lea ecx, [ebp - 0x164]
mov byte [ebp - 4], 4
call fcn.00401f6c
cmp dword [ebp - 0x18], esi
je 0x4210a4
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x18], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xec]
call fcn.00401f6c
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8