Function at 0x401110
Capabilities:
Check if file exists
Create process on windows
Delete file
Get common file path
Get file attributes
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fb0
call fcn.0041eee0
mov eax, dword [0x439c20]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov dword [ebp - 0x2a0], 0
mov dword [ebp - 0x298], 0
mov dword [ebp - 0x294], 0
xor eax, eax
mov word [ebp - 0x6f8], ax
push 0x206
push 0
lea ecx, [ebp - 0x6f6]
push ecx
call fcn.0041ca30
add esp, 0xc
xor edx, edx
mov word [ebp - 0x1830], dx
push 0x206
push 0
lea eax, [ebp - 0x182e]
push eax
call fcn.0041ca30
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0x1620], cx
push 0x206
push 0
lea edx, [ebp - 0x161e]
push edx
call fcn.0041ca30
add esp, 0xc
xor eax, eax
mov word [ebp - 0x2e4], ax
xor ecx, ecx
mov dword [ebp - 0x2e2], ecx
mov dword [ebp - 0x2de], ecx
mov dword [ebp - 0x2da], ecx
mov dword [ebp - 0x2d6], ecx
mov dword [ebp - 0x2d2], ecx
mov dword [ebp - 0x2ce], ecx
mov dword [ebp - 0x2ca], ecx
mov word [ebp - 0x2c6], cx
mov dx, word [0x4349d4]
mov word [ebp - 0x290], dx
push 0x7e
push 0
lea eax, [ebp - 0x28e]
push eax
call fcn.0041ca30
add esp, 0xc
mov cx, word [0x4349d8]
mov word [ebp - 0x1210], cx
push 0x7e
push 0
lea edx, [ebp - 0x120e]
push edx
call fcn.0041ca30
add esp, 0xc
xor eax, eax
mov word [ebp - 0x98c], ax
mov cx, word [0x4349dc]
mov word [ebp - 0x988], cx
push 0x7e
push 0
lea edx, [ebp - 0x986]
push edx
call fcn.0041ca30
add esp, 0xc
xor eax, eax
mov word [ebp - 0x1624], ax
xor ecx, ecx
mov word [ebp - 0x1418], cx
push 0x206
push 0
lea edx, [ebp - 0x1416]
push edx
call fcn.0041ca30
add esp, 0xc
xor eax, eax
mov word [ebp - 0x2c4], ax
xor ecx, ecx
mov dword [ebp - 0x2c2], ecx
mov dword [ebp - 0x2be], ecx
mov dword [ebp - 0x2ba], ecx
mov dword [ebp - 0x2b6], ecx
mov dword [ebp - 0x2b2], ecx
mov dword [ebp - 0x2ae], ecx
mov dword [ebp - 0x2aa], ecx
mov word [ebp - 0x2a6], cx
mov dword [ebp - 0x4ec], 0
mov dword [ebp - 0x29c], 0
xor edx, edx
mov word [ebp - 0x900], dx
push 0x206
push 0
lea eax, [ebp - 0x8fe]
push eax
call fcn.0041ca30
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0x210], cx
push 0x206
push 0
lea edx, [ebp - 0x20e]
push edx
call fcn.0041ca30
add esp, 0xc
mov dword [ebp - 0x2a4], 0
push 0x200
push 0
lea eax, [ebp - 0x4e8]
push eax
call fcn.0041ca30
add esp, 0xc
push 1
lea ecx, [ebp - 0x4e8]
push ecx
call fcn.00402230
add esp, 8
mov dword [ebp - 0x298], eax
push 0
lea edx, [ebp - 0x1a30]
push edx
call fcn.00402230
add esp, 8
mov dword [ebp - 0x29c], eax
push 0x104
lea eax, [ebp - 0x1830]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x6f8]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.HGDraw.dll
push 0x104
lea edx, [ebp - 0x6f8]
push edx
call fcn.0041a65d
add esp, 0xc
lea eax, [ebp - 0x6f8]
mov dword [ebp - 0x1e7c], eax
mov ecx, dword [ebp - 0x1e7c]
add ecx, 2
mov dword [ebp - 0x1e80], ecx
mov edx, dword [ebp - 0x1e7c]
mov ax, word [edx]
mov word [ebp - 0x1e82], ax
add dword [ebp - 0x1e7c], 2
cmp word [ebp - 0x1e82], 0
jne 0x4013a9
mov ecx, dword [ebp - 0x1e7c]
sub ecx, dword [ebp - 0x1e80]
sar ecx, 1
mov dword [ebp - 0x1e88], ecx
je 0x4013ff
lea edx, [ebp - 0x6f8]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4013ff
lea eax, [ebp - 0x6f8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x298], 0
je 0x40190e
lea ecx, [ebp - 0x6f8]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea edx, [ebp - 0x360]
push edx
push 0x104
lea eax, [ebp - 0x6f8]
push eax
call fcn.0041a65d
add esp, 0xc
push 0x4349f8
push 0x104
lea ecx, [ebp - 0x6f8]
push ecx
call fcn.0041a65d
add esp, 0xc
lea edx, [ebp - 0x6f8]
mov dword [ebp - 0x1e8c], edx
mov eax, dword [ebp - 0x1e8c]
add eax, 2
mov dword [ebp - 0x1e90], eax
mov ecx, dword [ebp - 0x1e8c]
mov dx, word [ecx]
mov word [ebp - 0x1e92], dx
add dword [ebp - 0x1e8c], 2
cmp word [ebp - 0x1e92], 0
jne 0x40146d
mov eax, dword [ebp - 0x1e8c]
sub eax, dword [ebp - 0x1e90]
sar eax, 1
mov dword [ebp - 0x1e98], eax
je 0x401550
lea ecx, [ebp - 0x6f8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x401550
lea edx, [ebp - 0x360]
mov dword [ebp - 0x1e9c], edx
lea eax, [ebp - 0x1c38]
mov dword [ebp - 0x1ea0], eax
mov ecx, dword [ebp - 0x1ea0]
mov dword [ebp - 0x1ea4], ecx
mov edx, dword [ebp - 0x1e9c]
mov ax, word [edx]
mov word [ebp - 0x1ea6], ax
mov ecx, dword [ebp - 0x1ea0]
mov dx, word [ebp - 0x1ea6]
mov word [ecx], dx
mov eax, dword [ebp - 0x1e9c]
add eax, 2
mov dword [ebp - 0x1e9c], eax
mov ecx, dword [ebp - 0x1ea0]
add ecx, 2
mov dword [ebp - 0x1ea0], ecx
cmp word [ebp - 0x1ea6], 0
jne 0x4014e2
push 0x434a04
push 0x104
lea edx, [ebp - 0x1c38]
push edx
call fcn.0041a65d
add esp, 0xc
lea eax, [ebp - 0x6f8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x340]
push ecx
push 0x10
lea edx, [ebp - 0x2e4]
push edx
call fcn.0041a6da
add esp, 0xc
lea eax, [ebp - 0x6f8]
push eax
lea ecx, [ebp - 0x340]
push ecx
call fcn.00402620
add esp, 8
lea edx, [ebp - 0x340]
push edx
call fcn.004026d0
add esp, 4
cmp eax, 1
jne 0x401599
xor eax, eax
jmp 0x40221c
lea eax, [ebp - 0x340]
mov dword [ebp - 0x1eac], eax
lea ecx, [ebp - 0x900]
mov dword [ebp - 0x1eb0], ecx
mov edx, dword [ebp - 0x1eb0]
mov dword [ebp - 0x1eb4], edx
mov eax, dword [ebp - 0x1eac]
mov cx, word [eax]
mov word [ebp - 0x1eb6], cx
mov edx, dword [ebp - 0x1eb0]
mov ax, word [ebp - 0x1eb6]
mov word [edx], ax
mov ecx, dword [ebp - 0x1eac]
add ecx, 2
mov dword [ebp - 0x1eac], ecx
mov edx, dword [ebp - 0x1eb0]
add edx, 2
mov dword [ebp - 0x1eb0], edx
cmp word [ebp - 0x1eb6], 0
jne 0x4015bd
lea eax, [ebp - 0x340]
mov dword [ebp - 0x1ebc], eax
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x1ec0], ecx
mov edx, dword [ebp - 0x1ec0]
mov dword [ebp - 0x1ec4], edx
mov eax, dword [ebp - 0x1ebc]
mov cx, word [eax]
mov word [ebp - 0x1ec6], cx
mov edx, dword [ebp - 0x1ec0]
mov ax, word [ebp - 0x1ec6]
mov word [edx], ax
mov ecx, dword [ebp - 0x1ebc]
add ecx, 2
mov dword [ebp - 0x1ebc], ecx
mov edx, dword [ebp - 0x1ec0]
add edx, 2
mov dword [ebp - 0x1ec0], edx
cmp word [ebp - 0x1ec6], 0
jne 0x401629
lea eax, [ebp - 0x210]
add eax, 0xfffffffe
mov dword [ebp - 0x1ecc], eax
mov ecx, dword [ebp - 0x1ecc]
mov dx, word [ecx + 2]
mov word [ebp - 0x1ece], dx
add dword [ebp - 0x1ecc], 2
cmp word [ebp - 0x1ece], 0
jne 0x401680
mov edi, dword [ebp - 0x1ecc]
mov eax, dword [0x434a10]
mov dword [edi], eax
mov ecx, dword [0x434a14]
mov dword [edi + 4], ecx
mov edx, dword [0x434a18]
mov dword [edi + 8], edx
lea eax, [ebp - 0x900]
push eax
push 0
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 0
je 0x40176d
mov ecx, dword [ebp - 0x2a4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 0x210]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0x2a4], eax
mov dword [ebp - 0x1c3c], 0
lea eax, [ebp - 0x900]
push eax
push 0
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 0
je 0x40176d
cmp dword [ebp - 0x1c3c], 5
jge 0x40176d
mov ecx, dword [ebp - 0x2a4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x1c3c]
add edx, 1
mov dword [ebp - 0x1c3c], edx
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x401718
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x6f8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x462]
mov dword [ebp - 0x1ed4], ecx
lea edx, [ebp - 0x290]
mov dword [ebp - 0x1ed8], edx
mov eax, dword [ebp - 0x1ed8]
mov dword [ebp - 0x1edc], eax
mov ecx, dword [ebp - 0x1ed4]
mov dx, word [ecx]
mov word [ebp - 0x1ede], dx
mov eax, dword [ebp - 0x1ed8]
mov cx, word [ebp - 0x1ede]
mov word [eax], cx
mov edx, dword [ebp - 0x1ed4]
add edx, 2
mov dword [ebp - 0x1ed4], edx
mov eax, dword [ebp - 0x1ed8]
add eax, 2
mov dword [ebp - 0x1ed8], eax
cmp word [ebp - 0x1ede], 0
jne 0x4017a9
lea ecx, [ebp - 0x4e4]
mov dword [ebp - 0x1ee4], ecx
lea edx, [ebp - 0x1210]
mov dword [ebp - 0x1ee8], edx
mov eax, dword [ebp - 0x1ee8]
mov dword [ebp - 0x1eec], eax
mov ecx, dword [ebp - 0x1ee4]
mov dx, word [ecx]
mov word [ebp - 0x1eee], dx
mov eax, dword [ebp - 0x1ee8]
mov cx, word [ebp - 0x1eee]
mov word [eax], cx
mov edx, dword [ebp - 0x1ee4]
add edx, 2
mov dword [ebp - 0x1ee4], edx
mov eax, dword [ebp - 0x1ee8]
add eax, 2
mov dword [ebp - 0x1ee8], eax
cmp word [ebp - 0x1eee], 0
jne 0x401815
mov cx, word [ebp - 0x464]
mov word [ebp - 0x98c], cx
lea edx, [ebp - 0x442]
mov dword [ebp - 0x1ef4], edx
lea eax, [ebp - 0x988]
mov dword [ebp - 0x1ef8], eax
mov ecx, dword [ebp - 0x1ef8]
mov dword [ebp - 0x1efc], ecx
mov edx, dword [ebp - 0x1ef4]
mov ax, word [edx]
mov word [ebp - 0x1efe], ax
mov ecx, dword [ebp - 0x1ef8]
mov dx, word [ebp - 0x1efe]
mov word [ecx], dx
mov eax, dword [ebp - 0x1ef4]
add eax, 2
mov dword [ebp - 0x1ef4], eax
mov ecx, dword [ebp - 0x1ef8]
add ecx, 2
mov dword [ebp - 0x1ef8], ecx
cmp word [ebp - 0x1efe], 0
jne 0x40188f
mov dx, word [ebp - 0x3c2]
mov word [ebp - 0x1624], dx
mov eax, dword [ebp - 0x320]
mov dword [ebp - 0x4ec], eax
lea ecx, [ebp - 0x360]
push ecx
push 0x10
lea edx, [ebp - 0x2c4]
push edx
call fcn.0041a6da
add esp, 0xc
jmp 0x401a2b
cmp dword [0x43afbc], 3
jne 0x401a2b
push 0x236
push 0
lea eax, [ebp - 0x1e78]
push eax
call fcn.0041ca30
add esp, 0xc
lea ecx, [ebp - 0x1e78]
push ecx
call fcn.00402950
add esp, 4
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 0
je 0x401a2b
lea edx, [ebp - 0x1d6a]
mov dword [ebp - 0x1f04], edx
lea eax, [ebp - 0x290]
mov dword [ebp - 0x1f08], eax
mov ecx, dword [ebp - 0x1f08]
mov dword [ebp - 0x1f0c], ecx
mov edx, dword [ebp - 0x1f04]
mov ax, word [edx]
mov word [ebp - 0x1f0e], ax
mov ecx, dword [ebp - 0x1f08]
mov dx, word [ebp - 0x1f0e]
mov word [ecx], dx
mov eax, dword [ebp - 0x1f04]
add eax, 2
mov dword [ebp - 0x1f04], eax
mov ecx, dword [ebp - 0x1f08]
add ecx, 2
mov dword [ebp - 0x1f08], ecx
cmp word [ebp - 0x1f0e], 0
jne 0x401977
lea edx, [ebp - 0x1210]
push edx
mov eax, dword [ebp - 0x1d72]
push eax
call fcn.00402e20
add esp, 8
mov cx, word [ebp - 0x1d6e]
mov word [ebp - 0x98c], cx
lea edx, [ebp - 0x988]
push edx
mov eax, dword [ebp - 0x1d78]
push eax
call fcn.00402e20
add esp, 8
mov cx, word [ebp - 0x1d74]
mov word [ebp - 0x1624], cx
mov edx, dword [ebp - 0x1e70]
mov dword [ebp - 0x4ec], edx
lea eax, [ebp - 0x1d4a]
push eax
push 0x10
lea ecx, [ebp - 0x2e4]
push ecx
call fcn.0041a6da
add esp, 0xc
cmp dword [ebp - 0x29c], 0
je 0x401c60
lea edx, [ebp - 0x19aa]
mov dword [ebp - 0x1f14], edx
lea eax, [ebp - 0x290]
mov dword [ebp - 0x1f18], eax
mov ecx, dword [ebp - 0x1f18]
mov dword [ebp - 0x1f1c], ecx
mov edx, dword [ebp - 0x1f14]
mov ax, word [edx]
mov word [ebp - 0x1f1e], ax
mov ecx, dword [ebp - 0x1f18]
mov dx, word [ebp - 0x1f1e]
mov word [ecx], dx
mov eax, dword [ebp - 0x1f14]
add eax, 2
mov dword [ebp - 0x1f14], eax
mov ecx, dword [ebp - 0x1f18]
add ecx, 2
mov dword [ebp - 0x1f18], ecx
cmp word [ebp - 0x1f1e], 0
jne 0x401a5c
lea edx, [ebp - 0x1a2c]
mov dword [ebp - 0x1f24], edx
lea eax, [ebp - 0x1210]
mov dword [ebp - 0x1f28], eax
mov ecx, dword [ebp - 0x1f28]
mov dword [ebp - 0x1f2c], ecx
mov edx, dword [ebp - 0x1f24]
mov ax, word [edx]
mov word [ebp - 0x1f2e], ax
mov ecx, dword [ebp - 0x1f28]
mov dx, word [ebp - 0x1f2e]
mov word [ecx], dx
mov eax, dword [ebp - 0x1f24]
add eax, 2
mov dword [ebp - 0x1f24], eax
mov ecx, dword [ebp - 0x1f28]
add ecx, 2
mov dword [ebp - 0x1f28], ecx
cmp word [ebp - 0x1f2e], 0
jne 0x401ac8
mov dx, word [ebp - 0x19ac]
mov word [ebp - 0x98c], dx
mov dword [ebp - 0x1f34], 0x434a1c
lea eax, [ebp - 0x988]
mov dword [ebp - 0x1f38], eax
mov ecx, dword [ebp - 0x1f38]
mov dword [ebp - 0x1f3c], ecx
mov edx, dword [ebp - 0x1f34]
mov ax, word [edx]
mov word [ebp - 0x1f3e], ax
mov ecx, dword [ebp - 0x1f38]
mov dx, word [ebp - 0x1f3e]
mov word [ecx], dx
mov eax, dword [ebp - 0x1f34]
add eax, 2
mov dword [ebp - 0x1f34], eax
mov ecx, dword [ebp - 0x1f38]
add ecx, 2
mov dword [ebp - 0x1f38], ecx
cmp word [ebp - 0x1f3e], 0
jne 0x401b40
mov dx, word [ebp - 0x190a]
mov word [ebp - 0x1624], dx
mov eax, dword [0x43afb8]
mov dword [ebp - 0x4ec], eax
cmp dword [0x43afbc], 3
je 0x401bbd
push 1
lea ecx, [ebp - 0x1418]
push ecx
call fcn.00402ed0
add esp, 8
jmp 0x401bce
push 0
lea edx, [ebp - 0x1418]
push edx
call fcn.00402ed0
add esp, 8
lea eax, [ebp - 0x1418]
mov dword [ebp - 0x1f44], eax
lea ecx, [ebp - 0x1620]
mov dword [ebp - 0x1f48], ecx
mov edx, dword [ebp - 0x1f48]
mov dword [ebp - 0x1f4c], edx
mov eax, dword [ebp - 0x1f44]
mov cx, word [eax]
mov word [ebp - 0x1f4e], cx
mov edx, dword [ebp - 0x1f48]
mov ax, word [ebp - 0x1f4e]
mov word [edx], ax
mov ecx, dword [ebp - 0x1f44]
add ecx, 2
mov dword [ebp - 0x1f44], ecx
mov edx, dword [ebp - 0x1f48]
add edx, 2
mov dword [ebp - 0x1f48], edx
cmp word [ebp - 0x1f4e], 0
jne 0x401bf2
push 0x434a38
push 0x104
lea eax, [ebp - 0x1620]
push eax
call fcn.0041a65d
add esp, 0xc
lea ecx, [ebp - 0x1620]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x200
push 0
lea edx, [ebp - 0x4e8]
push edx
call fcn.0041ca30
add esp, 0xc
mov dword [ebp - 0x4e8], 0x504d534d
mov eax, 0x51
mov word [ebp - 0x464], ax
mov dword [ebp - 0x1f54], 0x434a50
lea ecx, [ebp - 0x4e4]
mov dword [ebp - 0x1f58], ecx
mov edx, dword [ebp - 0x1f58]
mov dword [ebp - 0x1f5c], edx
mov eax, dword [ebp - 0x1f54]
mov cx, word [eax]
mov word [ebp - 0x1f5e], cx
mov edx, dword [ebp - 0x1f58]
mov ax, word [ebp - 0x1f5e]
mov word [edx], ax
mov ecx, dword [ebp - 0x1f54]
add ecx, 2
mov dword [ebp - 0x1f54], ecx
mov edx, dword [ebp - 0x1f58]
add edx, 2
mov dword [ebp - 0x1f58], edx
cmp word [ebp - 0x1f5e], 0
jne 0x401cae
mov eax, 0x2b66
mov word [ebp - 0x3c2], ax
mov dword [ebp - 0x1f64], 0x434a6c
lea ecx, [ebp - 0x442]
mov dword [ebp - 0x1f68], ecx
mov edx, dword [ebp - 0x1f68]
mov dword [ebp - 0x1f6c], edx
mov eax, dword [ebp - 0x1f64]
mov cx, word [eax]
mov word [ebp - 0x1f6e], cx
mov edx, dword [ebp - 0x1f68]
mov ax, word [ebp - 0x1f6e]
mov word [edx], ax
mov ecx, dword [ebp - 0x1f64]
add ecx, 2
mov dword [ebp - 0x1f64], ecx
mov edx, dword [ebp - 0x1f68]
add edx, 2
mov dword [ebp - 0x1f68], edx
cmp word [ebp - 0x1f6e], 0
jne 0x401d24
mov dword [ebp - 0x1f74], 0x434a88
lea eax, [ebp - 0x462]
mov dword [ebp - 0x1f78], eax
mov ecx, dword [ebp - 0x1f78]
mov dword [ebp - 0x1f7c], ecx
mov edx, dword [ebp - 0x1f74]
mov ax, word [edx]
mov word [ebp - 0x1f7e], ax
mov ecx, dword [ebp - 0x1f78]
mov dx, word [ebp - 0x1f7e]
mov word [ecx], dx
mov eax, dword [ebp - 0x1f74]
add eax, 2
mov dword [ebp - 0x1f74], eax
mov ecx, dword [ebp - 0x1f78]
add ecx, 2
mov dword [ebp - 0x1f78], ecx
cmp word [ebp - 0x1f7e], 0
jne 0x401d8e
mov edx, dword [0x43afb8]
mov dword [ebp - 0x320], edx
cmp dword [ebp - 0x298], 0
jne 0x401dfd
cmp dword [ebp - 0x294], 0
jne 0x401dfd
cmp dword [ebp - 0x29c], 0
je 0x401e7b
lea eax, [ebp - 0x290]
push eax
lea ecx, [ebp - 0x462]
push ecx
call fcn.00406800
add esp, 8
lea edx, [ebp - 0x1210]
push edx
lea eax, [ebp - 0x4e4]
push eax
call fcn.00406820
add esp, 8
mov cx, word [ebp - 0x98c]
mov word [ebp - 0x464], cx
lea edx, [ebp - 0x988]
push edx
lea eax, [ebp - 0x442]
push eax
call fcn.00406820
add esp, 8
mov cx, word [ebp - 0x1624]
mov word [ebp - 0x3c2], cx
mov edx, dword [ebp - 0x4ec]
mov dword [ebp - 0x320], edx
cmp dword [ebp - 0x4ec], 0
jne 0x401e7b
mov eax, dword [0x43afb8]
mov dword [ebp - 0x320], eax
movzx ecx, word [ebp - 0x4e4]
test ecx, ecx
je 0x401e91
movzx edx, word [ebp - 0x464]
test edx, edx
jg 0x401e9b
jmp 0x40220c
mov dword [ebp - 0x4e8], 0x504d534d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.0041a749
add esp, 4
xor eax, eax
mov word [ebp - 0x1190], ax
push 0x7fe
push 0
lea ecx, [ebp - 0x118e]
push ecx
call fcn.0041ca30
add esp, 0xc
movzx edx, word [ebp - 0x3c0]
test edx, edx
jne 0x401f07
lea eax, [ebp - 0x1190]
push eax
push 6
push 5
call fcn.00402f20
add esp, 0xc
lea ecx, [ebp - 0x1190]
push ecx
lea edx, [ebp - 0x3c0]
push edx
call fcn.00406800
add esp, 8
movzx eax, word [ebp - 0x3a0]
test eax, eax
jne 0x401f3b
lea ecx, [ebp - 0x1190]
push ecx
push 6
push 5
call fcn.00402f20
add esp, 0xc
lea edx, [ebp - 0x1190]
push edx
lea eax, [ebp - 0x3a0]
push eax
call fcn.00406800
add esp, 8
lea ecx, [ebp - 0x2c4]
mov dword [ebp - 0x1f84], ecx
mov edx, dword [ebp - 0x1f84]
add edx, 2
mov dword [ebp - 0x1f88], edx
mov eax, dword [ebp - 0x1f84]
mov cx, word [eax]
mov word [ebp - 0x1f8a], cx
add dword [ebp - 0x1f84], 2
cmp word [ebp - 0x1f8a], 0
jne 0x401f56
mov edx, dword [ebp - 0x1f84]
sub edx, dword [ebp - 0x1f88]
sar edx, 1
mov dword [ebp - 0x1f90], edx
je 0x401fbd
lea eax, [ebp - 0x2c4]
push eax
push 0
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
test eax, eax
je 0x401fbd
lea ecx, [ebp - 0x2c4]
push ecx
push 0x10
lea edx, [ebp - 0x360]
push edx
call fcn.0041a6da
add esp, 0xc
movzx eax, word [ebp - 0x360]
test eax, eax
jne 0x401ff1
lea ecx, [ebp - 0x1190]
push ecx
push 6
push 5
call fcn.00402f20
add esp, 0xc
lea edx, [ebp - 0x1190]
push edx
lea eax, [ebp - 0x360]
push eax
call fcn.00406800
add esp, 8
movzx ecx, word [ebp - 0x340]
test ecx, ecx
jne 0x402091
lea edx, [ebp - 0x1190]
push edx
push 6
push 5
call fcn.00402f20
add esp, 0xc
lea eax, [ebp - 0x1190]
push eax
lea ecx, [ebp - 0x340]
push ecx
call fcn.00406800
add esp, 8
lea edx, [ebp - 0x2e4]
mov dword [ebp - 0x1f94], edx
mov eax, dword [ebp - 0x1f94]
add eax, 2
mov dword [ebp - 0x1f98], eax
mov ecx, dword [ebp - 0x1f94]
mov dx, word [ecx]
mov word [ebp - 0x1f9a], dx
add dword [ebp - 0x1f94], 2
cmp word [ebp - 0x1f9a], 0
jne 0x402044
mov eax, dword [ebp - 0x1f94]
sub eax, dword [ebp - 0x1f98]
sar eax, 1
mov dword [ebp - 0x1fa0], eax
je 0x402091
lea ecx, [ebp - 0x2e4]
push ecx
lea edx, [ebp - 0x340]
push edx
call fcn.00406800
add esp, 8
movzx eax, word [ebp - 0x380]
test eax, eax
jne 0x4020c5
lea ecx, [ebp - 0x1190]
push ecx
push 6
push 5
call fcn.00402f20
add esp, 0xc
lea edx, [ebp - 0x1190]
push edx
lea eax, [ebp - 0x380]
push eax
call fcn.00406800
add esp, 8
mov ecx, dword [0x43afb4]
mov dword [ebp - 0x31c], ecx
cmp dword [ebp - 0x320], 0
jne 0x4020e6
mov edx, dword [0x43afb8]
mov dword [ebp - 0x320], edx
lea eax, [ebp - 0x4e8]
push eax
call fcn.00403080
add esp, 4
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 0
jne 0x40210e
jmp 0x40220c
lea ecx, [ebp - 0x6f8]
push ecx
lea edx, [ebp - 0x340]
push edx
call fcn.00402620
add esp, 8
push 0x32
lea eax, [ebp - 0x6f8]
push eax
lea ecx, [ebp - 0x1830]
push ecx
call fcn.004032b0
add esp, 0xc
mov dword [ebp - 0x904], 0
lea edx, [ebp - 0x904]
push edx
push 3
push 0
push 0x434a98
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4021f2
lea eax, [ebp - 0x6f8]
mov dword [ebp - 0x1fa4], eax
mov ecx, dword [ebp - 0x1fa4]
add ecx, 2
mov dword [ebp - 0x1fa8], ecx
mov edx, dword [ebp - 0x1fa4]
mov ax, word [edx]
mov word [ebp - 0x1faa], ax
add dword [ebp - 0x1fa4], 2
cmp word [ebp - 0x1faa], 0
jne 0x402184
mov ecx, dword [ebp - 0x1fa4]
sub ecx, dword [ebp - 0x1fa8]
sar ecx, 1
mov dword [ebp - 0x1fb0], ecx
mov edx, dword [ebp - 0x1fb0]
lea eax, [edx + edx + 2]
push eax
lea ecx, [ebp - 0x6f8]
push ecx
push 1
push 0
push 0x434b04
mov edx, dword [ebp - 0x904]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x4021f2
mov eax, dword [ebp - 0x904]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
push 0
push 0x434b0c
lea ecx, [ebp - 0x6f8]
push ecx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x2a0], 1
mov eax, dword [ebp - 0x2a0]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041a64e
mov esp, ebp
pop ebp
ret