Function at 0x4089e0
Capabilities:
Delete file
Delete registry key
Disable system features via registry on windows
Persist via appinit_dlls registry key
Persist via default file association registry key
Persist via image file execution options registry key
Persist via winlogon helper dll registry key
Query or enumerate registry key
Query or enumerate registry value
Read .ini file
Set file attributes
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x4152b1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x45c
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x3c]
call fcn.00413970
push ecx
xor ebp, ebp
mov ecx, esp
mov dword [esp + 0x20], esp
push str.File
mov dword [esp + 0x47c], ebp
call sub.MFC42u.DLL_CString::CString_1
lea eax, [esp + 0x30]
mov ecx, esi
push eax
call fcn.0040e300
mov eax, dword [eax]
lea ecx, [esp + 0x3c]
push eax
push 0x5000
push 0x5000
mov byte [esp + 0x480], 1
call sub.MFC42u.DLL_CString::GetBuffer
mov edi, dword [sym.imp.KERNEL32.DLL_GetPrivateProfileStringW]
push eax
push 0x41f9bc
push str.ProcName
push str.KillProc
call edi
lea ecx, [esp + 0x2c]
mov byte [esp + 0x474], 0
call sub.MFC42u.DLL_CString::CString
push 0xffffffffffffffff
lea ecx, [esp + 0x40]
call sub.MFC42u.DLL_CString::ReleaseBuffer
mov ecx, dword [esp + 0x3c]
mov eax, dword [ecx - 8]
cmp eax, ebp
je 0x408ba8
mov bl, 3
lea ecx, [esp + 0x18]
call fcn.00413970
push 0x2c
lea ecx, [esp + 0x40]
mov byte [esp + 0x478], 2
call sub.MFC42u.DLL_CString::Find
cmp eax, 0xffffffff
je 0x408b2c
push 0x2c
lea ecx, [esp + 0x40]
call sub.MFC42u.DLL_CString::Find
lea edx, [esp + 0x2c]
push eax
push edx
lea ecx, [esp + 0x44]
call sub.MFC42u.DLL_CString::Left
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x478], bl
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 0x2c]
mov byte [esp + 0x474], 2
call sub.MFC42u.DLL_CString::CString
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x34]
mov eax, dword [eax - 8]
inc eax
push eax
push ecx
lea ecx, [esp + 0x44]
call sub.MFC42u.DLL_CString::Mid
push eax
lea ecx, [esp + 0x40]
mov byte [esp + 0x478], 4
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 0x34]
mov byte [esp + 0x474], 2
call sub.MFC42u.DLL_CString::CString
jmp 0x408b48
lea edx, [esp + 0x3c]
lea ecx, [esp + 0x18]
push edx
call sub.MFC42u.DLL_CString::operator
push 0x41f9bc
lea ecx, [esp + 0x40]
call sub.MFC42u.DLL_CString::operator_1
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::TrimLeft
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::TrimRight
mov eax, dword [esp + 0x18]
push 0x41f9bc
push eax
call dword [sym.imp.MSVCRT.dll_wcscmp]
add esp, 8
cmp eax, ebp
je 0x408b8a
push ebp
push ecx
lea edx, [esp + 0x20]
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
call fcn.00413b2c
mov ecx, esi
call fcn.0040d050
lea ecx, [esp + 0x18]
mov byte [esp + 0x474], 0
call sub.MFC42u.DLL_CString::CString
mov eax, dword [esp + 0x3c]
cmp dword [eax - 8], ebp
jne 0x408a93
lea ecx, [esp + 0x48]
call fcn.00413970
push ecx
mov byte [esp + 0x478], 5
mov ecx, esp
mov dword [esp + 0x20], esp
push str.File
call sub.MFC42u.DLL_CString::CString_1
lea ecx, [esp + 0x30]
push ecx
mov ecx, esi
call fcn.0040e300
mov eax, dword [eax]
lea ecx, [esp + 0x48]
push eax
push 0x5000
push 0x5000
mov byte [esp + 0x480], 6
call sub.MFC42u.DLL_CString::GetBuffer
push eax
push 0x41f9bc
push str.File
push str.FileRight
call edi
lea ecx, [esp + 0x2c]
mov byte [esp + 0x474], 5
call sub.MFC42u.DLL_CString::CString
push 0xffffffffffffffff
lea ecx, [esp + 0x4c]
call sub.MFC42u.DLL_CString::ReleaseBuffer
mov edx, dword [esp + 0x48]
cmp dword [edx - 8], ebp
je 0x408d61
mov bl, 7
lea ecx, [esp + 0x18]
call fcn.00413970
push 0x2c
lea ecx, [esp + 0x4c]
mov byte [esp + 0x478], bl
call sub.MFC42u.DLL_CString::Find
cmp eax, 0xffffffff
je 0x408cc8
push 0x2c
lea ecx, [esp + 0x4c]
call sub.MFC42u.DLL_CString::Find
push eax
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x50]
call sub.MFC42u.DLL_CString::Left
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x478], 8
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 0x2c]
mov byte [esp + 0x474], bl
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x34]
mov eax, dword [ecx - 8]
lea ecx, [esp + 0x48]
inc eax
push eax
push edx
call sub.MFC42u.DLL_CString::Mid
push eax
lea ecx, [esp + 0x4c]
mov byte [esp + 0x478], 9
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 0x34]
mov byte [esp + 0x474], bl
call sub.MFC42u.DLL_CString::CString
jmp 0x408ce4
lea eax, [esp + 0x48]
lea ecx, [esp + 0x18]
push eax
call sub.MFC42u.DLL_CString::operator
push 0x41f9bc
lea ecx, [esp + 0x4c]
call sub.MFC42u.DLL_CString::operator_1
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::TrimLeft
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::TrimRight
mov ecx, dword [esp + 0x18]
push 0x41f9bc
push ecx
call dword [sym.imp.MSVCRT.dll_wcscmp]
add esp, 8
cmp eax, ebp
je 0x408d43
mov eax, dword [esi + 0x64]
push ecx
cmp eax, ebp
mov ecx, esp
je 0x408d2e
lea edx, [esp + 0x1c]
mov dword [esp + 0x20], esp
push edx
call fcn.00413b2c
mov ecx, esi
call fcn.0040f170
jmp 0x408d43
lea eax, [esp + 0x1c]
mov dword [esp + 0x20], esp
push eax
call fcn.00413b2c
mov ecx, esi
call fcn.0040ee50
lea ecx, [esp + 0x18]
mov byte [esp + 0x474], 5
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x48]
cmp dword [ecx - 8], ebp
jne 0x408c31
lea ecx, [esp + 0x54]
call fcn.00413970
push ecx
mov byte [esp + 0x478], 0xa
mov ecx, esp
mov dword [esp + 0x20], esp
push str.File
call sub.MFC42u.DLL_CString::CString_1
lea edx, [esp + 0x30]
mov ecx, esi
push edx
call fcn.0040e300
mov eax, dword [eax]
lea ecx, [esp + 0x54]
push eax
push 0x5000
push 0x5000
mov byte [esp + 0x480], 0xb
call sub.MFC42u.DLL_CString::GetBuffer
push eax
push 0x41f9bc
push 0x41f618
push str.RegRight
call edi
lea ecx, [esp + 0x2c]
mov byte [esp + 0x474], 0xa
call sub.MFC42u.DLL_CString::CString
push 0xffffffffffffffff
lea ecx, [esp + 0x58]
call sub.MFC42u.DLL_CString::ReleaseBuffer
mov eax, dword [esp + 0x54]
cmp dword [eax - 8], ebp
je 0x408f1a
mov bl, 0xc
lea ecx, [esp + 0x18]
call fcn.00413970
push 0x2c
lea ecx, [esp + 0x58]
mov byte [esp + 0x478], bl
call sub.MFC42u.DLL_CString::Find
cmp eax, 0xffffffff
je 0x408e81
push 0x2c
lea ecx, [esp + 0x58]
call sub.MFC42u.DLL_CString::Find
lea ecx, [esp + 0x2c]
push eax
push ecx
lea ecx, [esp + 0x5c]
call sub.MFC42u.DLL_CString::Left
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x478], 0xd
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 0x2c]
mov byte [esp + 0x474], bl
call sub.MFC42u.DLL_CString::CString
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x54]
mov eax, dword [edx - 8]
inc eax
push eax
lea eax, [esp + 0x38]
push eax
call sub.MFC42u.DLL_CString::Mid
push eax
lea ecx, [esp + 0x58]
mov byte [esp + 0x478], 0xe
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 0x34]
mov byte [esp + 0x474], bl
call sub.MFC42u.DLL_CString::CString
jmp 0x408e9d
lea ecx, [esp + 0x54]
push ecx
lea ecx, [esp + 0x1c]
call sub.MFC42u.DLL_CString::operator
push 0x41f9bc
lea ecx, [esp + 0x58]
call sub.MFC42u.DLL_CString::operator_1
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::TrimLeft
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::TrimRight
mov edx, dword [esp + 0x18]
push 0x41f9bc
push edx
call dword [sym.imp.MSVCRT.dll_wcscmp]
add esp, 8
cmp eax, ebp
je 0x408efc
mov eax, dword [esi + 0x68]
push ecx
cmp eax, ebp
mov ecx, esp
je 0x408ee7
lea eax, [esp + 0x1c]
mov dword [esp + 0x20], esp
push eax
call fcn.00413b2c
mov ecx, esi
call fcn.0040f490
jmp 0x408efc
lea edx, [esp + 0x1c]
mov dword [esp + 0x20], esp
push edx
call fcn.00413b2c
mov ecx, esi
call fcn.0040fbd0
lea ecx, [esp + 0x18]
mov byte [esp + 0x474], 0xa
call sub.MFC42u.DLL_CString::CString
mov eax, dword [esp + 0x54]
cmp dword [eax - 8], ebp
jne 0x408dea
lea ecx, [esp + 0x4c]
call fcn.00413970
push ecx
mov byte [esp + 0x478], 0xf
mov ecx, esp
mov dword [esp + 0x20], esp
push str.File
call sub.MFC42u.DLL_CString::CString_1
lea ecx, [esp + 0x30]
push ecx
mov ecx, esi
call fcn.0040e300
mov eax, dword [eax]
lea ecx, [esp + 0x4c]
push eax
push 0x5000
push 0x5000
mov byte [esp + 0x480], 0x10
call sub.MFC42u.DLL_CString::GetBuffer
push eax
push 0x41f9bc
push str.File
push str.DelFile
call edi
lea ecx, [esp + 0x2c]
mov byte [esp + 0x474], 0xf
call sub.MFC42u.DLL_CString::CString
push 0xffffffffffffffff
lea ecx, [esp + 0x50]
call sub.MFC42u.DLL_CString::ReleaseBuffer
mov edx, dword [esp + 0x4c]
mov eax, dword [edx - 8]
cmp eax, ebp
je 0x409223
mov bl, 0x16
lea ecx, [esp + 0x18]
call fcn.00413970
push 0x2c
lea ecx, [esp + 0x50]
mov byte [esp + 0x478], 0x11
call sub.MFC42u.DLL_CString::Find
cmp eax, 0xffffffff
je 0x40903f
push 0x2c
lea ecx, [esp + 0x50]
call sub.MFC42u.DLL_CString::Find
push eax
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x54]
call sub.MFC42u.DLL_CString::Left
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x478], 0x12
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 0x2c]
mov byte [esp + 0x474], 0x11
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x34]
mov eax, dword [ecx - 8]
lea ecx, [esp + 0x4c]
inc eax
push eax
push edx
call sub.MFC42u.DLL_CString::Mid
push eax
lea ecx, [esp + 0x50]
mov byte [esp + 0x478], 0x13
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 0x34]
mov byte [esp + 0x474], 0x11
call sub.MFC42u.DLL_CString::CString
jmp 0x40905b
lea eax, [esp + 0x4c]
lea ecx, [esp + 0x18]
push eax
call sub.MFC42u.DLL_CString::operator
push 0x41f9bc
lea ecx, [esp + 0x50]
call sub.MFC42u.DLL_CString::operator_1
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::TrimLeft
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::TrimRight
push 0x5c
lea ecx, [esp + 0x1c]
call sub.MFC42u.DLL_CString::Find
cmp eax, 0xffffffff
jne 0x4091ed
mov ecx, dword [esp + 0x18]
push 0x41f9bc
push ecx
call dword [sym.imp.MSVCRT.dll_wcscmp]
add esp, 8
cmp eax, ebp
je 0x409205
lea ecx, [esp + 0x28]
call fcn.00413970
lea ecx, [esp + 0x30]
mov byte [esp + 0x474], 0x14
call fcn.00413970
lea ecx, [esp + 0x40]
mov byte [esp + 0x474], 0x15
call fcn.00413970
lea edx, [esp + 0x18]
lea eax, [esp + 0x58]
push edx
push str._SystemRoot__
push eax
mov byte [esp + 0x480], bl
call sub.MFC42u.DLL_operator_1
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x478], 0x17
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 0x58]
mov byte [esp + 0x474], bl
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x18]
lea edx, [esp + 0x14]
push ecx
push str._SystemRoot__system_
push edx
call sub.MFC42u.DLL_operator_1
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x478], 0x18
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 0x14]
mov byte [esp + 0x474], bl
call sub.MFC42u.DLL_CString::CString
lea eax, [esp + 0x18]
lea ecx, [esp + 0x1c]
push eax
push str._SystemRoot__system32_
push ecx
call sub.MFC42u.DLL_operator_1
push eax
lea ecx, [esp + 0x44]
mov byte [esp + 0x478], 0x19
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 0x1c]
mov byte [esp + 0x474], bl
call sub.MFC42u.DLL_CString::CString
push ecx
lea edx, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
call fcn.00413b2c
mov ecx, esi
call fcn.00406e00
push ecx
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00413b2c
mov ecx, esi
call fcn.00406e00
push ecx
lea edx, [esp + 0x44]
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
call fcn.00413b2c
mov ecx, esi
call fcn.00406e00
lea ecx, [esp + 0x40]
mov byte [esp + 0x474], 0x15
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x30]
mov byte [esp + 0x474], 0x14
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x28]
mov byte [esp + 0x474], 0x11
call sub.MFC42u.DLL_CString::CString
jmp 0x409205
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00413b2c
mov ecx, esi
call fcn.00406e00
lea ecx, [esp + 0x18]
mov byte [esp + 0x474], 0xf
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x4c]
cmp dword [ecx - 8], ebp
jne 0x408fa5
lea ecx, [esp + 0x38]
call fcn.00413970
push ecx
mov byte [esp + 0x478], 0x1a
mov ecx, esp
mov dword [esp + 0x24], esp
push str.File
call sub.MFC42u.DLL_CString::CString_1
lea edx, [esp + 0x20]
mov ecx, esi
push edx
call fcn.0040e300
mov eax, dword [eax]
lea ecx, [esp + 0x38]
push eax
push 0x5000
push 0x5000
mov byte [esp + 0x480], 0x1b
call sub.MFC42u.DLL_CString::GetBuffer
push eax
push 0x41f9bc
push str.Folder
push str.DelFolder
call edi
lea ecx, [esp + 0x1c]
mov byte [esp + 0x474], 0x1a
call sub.MFC42u.DLL_CString::CString
push 0xffffffffffffffff
lea ecx, [esp + 0x3c]
call sub.MFC42u.DLL_CString::ReleaseBuffer
mov eax, dword [esp + 0x38]
cmp dword [eax - 8], ebp
je 0x40952a
mov bl, 0x21
lea ecx, [esp + 0x18]
call fcn.00413970
push 0x2c
lea ecx, [esp + 0x3c]
mov byte [esp + 0x478], 0x1c
call sub.MFC42u.DLL_CString::Find
cmp eax, 0xffffffff
je 0x409346
push 0x2c
lea ecx, [esp + 0x3c]
call sub.MFC42u.DLL_CString::Find
lea ecx, [esp + 0x1c]
push eax
push ecx
lea ecx, [esp + 0x40]
call sub.MFC42u.DLL_CString::Left
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x478], 0x1d
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 0x1c]
mov byte [esp + 0x474], 0x1c
call sub.MFC42u.DLL_CString::CString
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x38]
mov eax, dword [edx - 8]
inc eax
push eax
lea eax, [esp + 0x30]
push eax
call sub.MFC42u.DLL_CString::Mid
push eax
lea ecx, [esp + 0x3c]
mov byte [esp + 0x478], 0x1e
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 0x2c]
mov byte [esp + 0x474], 0x1c
call sub.MFC42u.DLL_CString::CString
jmp 0x409362
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x1c]
call sub.MFC42u.DLL_CString::operator
push 0x41f9bc
lea ecx, [esp + 0x3c]
call sub.MFC42u.DLL_CString::operator_1
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::TrimLeft
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::TrimRight
push 0x5c
lea ecx, [esp + 0x1c]
call sub.MFC42u.DLL_CString::Find
cmp eax, 0xffffffff
jne 0x4094f4
mov edx, dword [esp + 0x18]
push 0x41f9bc
push edx
call dword [sym.imp.MSVCRT.dll_wcscmp]
add esp, 8
cmp eax, ebp
je 0x40950c
lea ecx, [esp + 0x30]
call fcn.00413970
lea ecx, [esp + 0x40]
mov byte [esp + 0x474], 0x1f
call fcn.00413970
lea ecx, [esp + 0x28]
mov byte [esp + 0x474], 0x20
call fcn.00413970
lea eax, [esp + 0x18]
lea ecx, [esp + 0x34]
push eax
push str._SystemRoot__
push ecx
mov byte [esp + 0x480], bl
call sub.MFC42u.DLL_operator_1
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x478], 0x22
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 0x34]
mov byte [esp + 0x474], bl
call sub.MFC42u.DLL_CString::CString
lea edx, [esp + 0x18]
lea eax, [esp + 0x58]
push edx
push str._SystemRoot__system_
push eax
call sub.MFC42u.DLL_operator_1
push eax
lea ecx, [esp + 0x44]
mov byte [esp + 0x478], 0x23
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 0x58]
mov byte [esp + 0x474], bl
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x18]
lea edx, [esp + 0x14]
push ecx
push str._SystemRoot__system32_
push edx
call sub.MFC42u.DLL_operator_1
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x478], 0x24
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 0x14]
mov byte [esp + 0x474], bl
call sub.MFC42u.DLL_CString::CString
push ecx
lea eax, [esp + 0x34]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00413b2c
mov ecx, esi
call fcn.00406a10
push ecx
lea edx, [esp + 0x44]
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
call fcn.00413b2c
mov ecx, esi
call fcn.00406a10
push ecx
lea eax, [esp + 0x2c]
mov ecx, esp
mov dword [esp + 0x24], esp
push eax
call fcn.00413b2c
mov ecx, esi
call fcn.00406a10
lea ecx, [esp + 0x28]
mov byte [esp + 0x474], 0x20
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x40]
mov byte [esp + 0x474], 0x1f
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x30]
mov byte [esp + 0x474], 0x1c
call sub.MFC42u.DLL_CString::CString
jmp 0x40950c
push ecx
lea edx, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
call fcn.00413b2c
mov ecx, esi
call fcn.00406a10
lea ecx, [esp + 0x18]
mov byte [esp + 0x474], 0x1a
call sub.MFC42u.DLL_CString::CString
mov eax, dword [esp + 0x38]
cmp dword [eax - 8], ebp
jne 0x4092ac
lea ecx, [esp + 0x50]
call fcn.00413970
push ecx
mov byte [esp + 0x478], 0x25
mov ecx, esp
mov dword [esp + 0x24], esp
push str.File
call sub.MFC42u.DLL_CString::CString_1
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
call fcn.0040e300
mov eax, dword [eax]
lea ecx, [esp + 0x50]
push eax
push 0x5000
push 0x5000
mov byte [esp + 0x480], 0x26
call sub.MFC42u.DLL_CString::GetBuffer
push eax
push 0x41f9bc
push str.RegKey
push str.DelRegKey
call edi
lea ecx, [esp + 0x1c]
mov byte [esp + 0x474], 0x25
call sub.MFC42u.DLL_CString::CString
push 0xffffffffffffffff
lea ecx, [esp + 0x54]
call sub.MFC42u.DLL_CString::ReleaseBuffer
mov edx, dword [esp + 0x50]
cmp dword [edx - 8], ebp
je 0x4096c5
mov bl, 0x27
lea ecx, [esp + 0x18]
call fcn.00413970
push 0x2c
lea ecx, [esp + 0x54]
mov byte [esp + 0x478], bl
call sub.MFC42u.DLL_CString::Find
cmp eax, 0xffffffff
je 0x40964a
push 0x2c
lea ecx, [esp + 0x54]
call sub.MFC42u.DLL_CString::Find
push eax
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x58]
call sub.MFC42u.DLL_CString::Left
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x478], 0x28
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 0x1c]
mov byte [esp + 0x474], bl
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x2c]
mov eax, dword [ecx - 8]
lea ecx, [esp + 0x50]
inc eax
push eax
push edx
call sub.MFC42u.DLL_CString::Mid
push eax
lea ecx, [esp + 0x54]
mov byte [esp + 0x478], 0x29
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 0x2c]
mov byte [esp + 0x474], bl
call sub.MFC42u.DLL_CString::CString
jmp 0x409666
lea eax, [esp + 0x50]
lea ecx, [esp + 0x18]
push eax
call sub.MFC42u.DLL_CString::operator
push 0x41f9bc
lea ecx, [esp + 0x54]
call sub.MFC42u.DLL_CString::operator_1
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::TrimLeft
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::TrimRight
mov ecx, dword [esp + 0x18]
push 0x41f9bc
push ecx
call dword [sym.imp.MSVCRT.dll_wcscmp]
add esp, 8
cmp eax, ebp
je 0x4096a7
push ecx
lea edx, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
call fcn.00413b2c
mov ecx, esi
call fcn.00407290
lea ecx, [esp + 0x18]
mov byte [esp + 0x474], 0x25
call sub.MFC42u.DLL_CString::CString
mov eax, dword [esp + 0x50]
cmp dword [eax - 8], ebp
jne 0x4095b3
lea ecx, [esp + 0x44]
call fcn.00413970
push ecx
mov byte [esp + 0x478], 0x2a
mov ecx, esp
mov dword [esp + 0x24], esp
push str.File
call sub.MFC42u.DLL_CString::CString_1
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
call fcn.0040e300
mov eax, dword [eax]
lea ecx, [esp + 0x44]
push eax
push 0x5000
push 0x5000
mov byte [esp + 0x480], 0x2b
call sub.MFC42u.DLL_CString::GetBuffer
push eax
push 0x41f9bc
push str.RegValue
push str.DelRegValue
call edi
lea ecx, [esp + 0x1c]
mov byte [esp + 0x474], 0x2a
call sub.MFC42u.DLL_CString::CString
push 0xffffffffffffffff
lea ecx, [esp + 0x48]
call sub.MFC42u.DLL_CString::ReleaseBuffer
mov edx, dword [esp + 0x44]
cmp dword [edx - 8], ebp
je 0x409864
mov edi, dword [sym.imp.MSVCRT.dll_wcscmp]
mov bl, 0x2e
lea ecx, [esp + 0x18]
call fcn.00413970
push 0x2c
lea ecx, [esp + 0x48]
mov byte [esp + 0x478], 0x2c
call sub.MFC42u.DLL_CString::Find
cmp eax, 0xffffffff
je 0x4097ed
push 0x2c
lea ecx, [esp + 0x48]
call sub.MFC42u.DLL_CString::Find
push eax
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x4c]
call sub.MFC42u.DLL_CString::Left
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x478], 0x2d
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 0x1c]
mov byte [esp + 0x474], 0x2c
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x2c]
mov eax, dword [ecx - 8]
lea ecx, [esp + 0x44]
inc eax
push eax
push edx
call sub.MFC42u.DLL_CString::Mid
push eax
lea ecx, [esp + 0x48]
mov byte [esp + 0x478], bl
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 0x2c]
mov byte [esp + 0x474], 0x2c
call sub.MFC42u.DLL_CString::CString
jmp 0x409809
lea eax, [esp + 0x44]
lea ecx, [esp + 0x18]
push eax
call sub.MFC42u.DLL_CString::operator
push 0x41f9bc
lea ecx, [esp + 0x48]
call sub.MFC42u.DLL_CString::operator_1
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::TrimLeft
lea ecx, [esp + 0x18]
call sub.MFC42u.DLL_CString::TrimRight
mov ecx, dword [esp + 0x18]
push 0x41f9bc
push ecx
call edi
add esp, 8
cmp eax, ebp
je 0x409846
push ecx
lea edx, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
call fcn.00413b2c
mov ecx, esi
call fcn.00408160
lea ecx, [esp + 0x18]
mov byte [esp + 0x474], 0x2a
call sub.MFC42u.DLL_CString::CString
mov eax, dword [esp + 0x44]
cmp dword [eax - 8], ebp
jne 0x409754
mov dword [esp + 0x10], ebp
push ecx
mov byte [esp + 0x478], 0x2f
mov ecx, esp
mov dword [esp + 0x24], esp
push str.File
call sub.MFC42u.DLL_CString::CString_1
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
call fcn.0040e300
mov eax, dword [eax]
push eax
push ebp
push str.Load
push str.DefaultValue
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntW]
lea ecx, [esp + 0x1c]
mov edi, eax
call sub.MFC42u.DLL_CString::CString
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp edi, ebp
je 0x4099c0
lea edx, [esp + 0x14]
mov dword [esp + 0x14], ebp
push edx
push 0xf003f
push ebp
push str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
push 0x80000001
call ebx
cmp eax, ebp
jne 0x4098f6
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp ecx, ebp
je 0x4098ea
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x14]
cmp eax, ebp
mov dword [esp + 0x10], ecx
je 0x40993a
push 1
push str.CURRENT_USERSoftwareMicrosoftWindows_NTCurrentVersionWindows
mov ecx, esi
call fcn.0040d430
lea edx, [esp + 0x14]
mov dword [esp + 0x14], ebp
push edx
push 0xf003f
push ebp
push str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
push 0x80000001
call ebx
cmp eax, ebp
jne 0x40993a
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x409932
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], eax
push 0x41f9bc
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
mov edx, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea ecx, [eax + eax + 2]
push ecx
push 0x41f9bc
push 1
push ebp
push str.load
push edx
call edi
push 0x41f9bc
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
mov ecx, dword [esp + 0x10]
lea eax, [eax + eax + 2]
push eax
push 0x41f9bc
push 1
push ebp
push 0x41f49c
push ecx
call edi
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x40999b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], ebp
push ebp
push ebp
push ebp
push ebp
lea edi, [esi + 0x7c]
push str.b__rYL
push ebp
push 1
mov ecx, edi
call sub.MFC42u.DLL_CListCtrl::InsertItem
push 0x41f478
push 1
push ebp
mov ecx, edi
call sub.MFC42u.DLL_CListCtrl::SetItemText
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.File
call sub.MFC42u.DLL_CString::CString_1
lea edx, [esp + 0x20]
mov ecx, esi
push edx
call fcn.0040e300
mov eax, dword [eax]
push eax
push ebp
push 0x41b0f8
push str.DefaultValue
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntW]
lea ecx, [esp + 0x1c]
mov edi, eax
call sub.MFC42u.DLL_CString::CString
cmp edi, ebp
je 0x409ae4
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ebp
push eax
push 0xf003f
push ebp
push str.SoftwareMicrosoftWindows_NTCurrentVersionWinlogon
push 0x80000002
call ebx
cmp eax, ebp
jne 0x409a40
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp ecx, ebp
je 0x409a34
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x14]
cmp eax, ebp
mov dword [esp + 0x10], ecx
je 0x409a84
push 1
push str.MACHINESoftwareMicrosoftWindows_NTCurrentVersionWinlogon
mov ecx, esi
call fcn.0040d430
lea edx, [esp + 0x14]
mov dword [esp + 0x14], ebp
push edx
push 0xf003f
push ebp
push str.SoftwareMicrosoftWindows_NTCurrentVersionWinlogon
push 0x80000002
call ebx
cmp eax, ebp
jne 0x409a84
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x409a7c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], eax
push str.Explorer.exe
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
mov edx, dword [esp + 0x10]
lea ecx, [eax + eax + 2]
push ecx
push str.Explorer.exe
push 1
push ebp
push str.shell
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x409abf
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], ebp
push ebp
push ebp
push ebp
push ebp
lea edi, [esi + 0x7c]
push str.b__rYS
push ebp
push 1
mov ecx, edi
call sub.MFC42u.DLL_CListCtrl::InsertItem
push 0x41f478
push 1
push ebp
mov ecx, edi
call sub.MFC42u.DLL_CListCtrl::SetItemText
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.File
call sub.MFC42u.DLL_CString::CString_1
lea eax, [esp + 0x20]
mov ecx, esi
push eax
call fcn.0040e300
mov eax, dword [eax]
push eax
push ebp
push 0x41b0e4
push str.DefaultValue
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntW]
lea ecx, [esp + 0x1c]
mov edi, eax
call sub.MFC42u.DLL_CString::CString
cmp edi, ebp
je 0x409c2f
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], ebp
push ecx
push 0xf003f
push ebp
push str.SoftwareMicrosoftWindows_NTCurrentVersionWinlogon
push 0x80000002
call ebx
cmp eax, ebp
jne 0x409b64
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp ecx, ebp
je 0x409b58
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x14]
cmp eax, ebp
mov dword [esp + 0x10], edx
je 0x409ba8
push 1
push str.MACHINESoftwareMicrosoftWindows_NTCurrentVersionWinlogon
mov ecx, esi
call fcn.0040d430
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ebp
push eax
push 0xf003f
push ebp
push str.SoftwareMicrosoftWindows_NTCurrentVersionWinlogon
push 0x80000002
call ebx
cmp eax, ebp
jne 0x409ba8
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x409ba0
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x10], ecx
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str._SystemRoot__system32userinit.exe_
call sub.MFC42u.DLL_CString::CString_1
lea edx, [esp + 0x20]
mov ecx, esi
push edx
call fcn.0040e0f0
mov ecx, eax
call fcn.00407280
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
mov ecx, dword [esp + 0x10]
lea eax, [eax + eax + 2]
push eax
push edi
push 1
push ebp
push 0x41b0e4
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea ecx, [esp + 0x1c]
call sub.MFC42u.DLL_CString::CString
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x409c0a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], ebp
push ebp
push ebp
push ebp
push ebp
lea edi, [esi + 0x7c]
push str.b__rYU
push ebp
push 1
mov ecx, edi
call sub.MFC42u.DLL_CListCtrl::InsertItem
push 0x41f478
push 1
push ebp
mov ecx, edi
call sub.MFC42u.DLL_CListCtrl::SetItemText
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.File
call sub.MFC42u.DLL_CString::CString_1
lea edx, [esp + 0x20]
mov ecx, esi
push edx
call fcn.0040e300
mov eax, dword [eax]
push eax
push ebp
push 0x41b0c8
push str.DefaultValue
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntW]
lea ecx, [esp + 0x1c]
mov edi, eax
call sub.MFC42u.DLL_CString::CString
cmp edi, ebp
je 0x409d53
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ebp
push eax
push 0xf003f
push ebp
push str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
push 0x80000002
call ebx
cmp eax, ebp
jne 0x409caf
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp ecx, ebp
je 0x409ca3
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x14]
cmp eax, ebp
mov dword [esp + 0x10], ecx
je 0x409cf3
push 1
push str.MACHINESoftwareMicrosoftWindows_NTCurrentVersionWindows
mov ecx, esi
call fcn.0040d430
lea edx, [esp + 0x14]
mov dword [esp + 0x14], ebp
push edx
push 0xf003f
push ebp
push str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
push 0x80000002
call ebx
cmp eax, ebp
jne 0x409cf3
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x409ceb
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], eax
push 0x41f9bc
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
mov edx, dword [esp + 0x10]
lea ecx, [eax + eax + 2]
push ecx
push 0x41f9bc
push 1
push ebp
push 0x41b0c8
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x409d2e
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], ebp
push ebp
push ebp
push ebp
push ebp
lea edi, [esi + 0x7c]
push str.b__rYA
push ebp
push 1
mov ecx, edi
call sub.MFC42u.DLL_CListCtrl::InsertItem
push 0x41f478
push 1
push ebp
mov ecx, edi
call sub.MFC42u.DLL_CListCtrl::SetItemText
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.File
call sub.MFC42u.DLL_CString::CString_1
lea eax, [esp + 0x20]
mov ecx, esi
push eax
call fcn.0040e300
mov eax, dword [eax]
push eax
push ebp
push 0x41b0b8
push str.DefaultValue
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntW]
lea ecx, [esp + 0x1c]
mov edi, eax
call sub.MFC42u.DLL_CString::CString
cmp edi, ebp
je 0x409e77
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], ebp
push ecx
push 0xf003f
push ebp
push str.SoftwareMicrosoftWindows_NTCurrentVersionWinlogon
push 0x80000002
call ebx
cmp eax, ebp
jne 0x409dd3
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp ecx, ebp
je 0x409dc7
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x14]
cmp eax, ebp
mov dword [esp + 0x10], edx
je 0x409e17
push 1
push str.MACHINESoftwareMicrosoftWindows_NTCurrentVersionWinlogon
mov ecx, esi
call fcn.0040d430
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ebp
push eax
push 0xf003f
push ebp
push str.SoftwareMicrosoftWindows_NTCurrentVersionWinlogon
push 0x80000002
call ebx
cmp eax, ebp
jne 0x409e17
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x409e0f
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x10], ecx
push str.logonui.exe
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
lea edx, [eax + eax + 2]
mov eax, dword [esp + 0x10]
push edx
push str.logonui.exe
push 1
push ebp
push 0x41b0b8
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x409e52
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], ebp
push ebp
push ebp
push ebp
push ebp
lea edi, [esi + 0x7c]
push 0x41f21c
push ebp
push 1
mov ecx, edi
call sub.MFC42u.DLL_CListCtrl::InsertItem
push 0x41f478
push 1
push ebp
mov ecx, edi
call sub.MFC42u.DLL_CListCtrl::SetItemText
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.File
call sub.MFC42u.DLL_CString::CString_1
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
call fcn.0040e300
mov eax, dword [eax]
push eax
push ebp
push 0x41f214
push str.Other
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntW]
lea ecx, [esp + 0x1c]
mov edi, eax
call sub.MFC42u.DLL_CString::CString
cmp edi, ebp
je 0x40a04c
lea edx, [esp + 0x14]
mov dword [esp + 0x14], ebp
push edx
push 0xf003f
push ebp
push str.SOFTWAREClasses.exe
push 0x80000002
call ebx
cmp eax, ebp
jne 0x409ef7
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp ecx, ebp
je 0x409eeb
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x14]
cmp eax, ebp
mov dword [esp + 0x10], ecx
je 0x409f3b
push 1
push str.MACHINESOFTWAREClasses.exe
mov ecx, esi
call fcn.0040d430
lea edx, [esp + 0x14]
mov dword [esp + 0x14], ebp
push edx
push 0xf003f
push ebp
push str.SOFTWAREClasses.exe
push 0x80000002
call ebx
cmp eax, ebp
jne 0x409f3b
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x409f33
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], eax
push str.exefile
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
mov edx, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea ecx, [eax + eax + 2]
push ecx
push str.exefile
push 1
push ebp
push ebp
push edx
call edi
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x409f74
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], ebp
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ebp
push eax
push 0xf003f
push ebp
push str.SOFTWAREClassesexefile_shellopencommand
push 0x80000002
call ebx
cmp eax, ebp
jne 0x409fb0
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp ecx, ebp
je 0x409fa4
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x14]
cmp eax, ebp
mov dword [esp + 0x10], ecx
je 0x409ff4
push 1
push str.MACHINESOFTWAREClassesexefile_shellopencommand
mov ecx, esi
call fcn.0040d430
lea edx, [esp + 0x14]
mov dword [esp + 0x14], ebp
push edx
push 0xf003f
push ebp
push str.SOFTWAREClassesexefile_shellopencommand
push 0x80000002
call ebx
cmp eax, ebp
jne 0x409ff4
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x409fec
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], eax
push str.__1___
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
mov edx, dword [esp + 0x10]
lea ecx, [eax + eax + 2]
push ecx
push str.__1___
push 1
push ebp
push ebp
push edx
call edi
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x40a027
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], ebp
push ebp
push ebp
push ebp
push ebp
lea edi, [esi + 0x7c]
push 0x41f0a8
push ebp
push 1
mov ecx, edi
call sub.MFC42u.DLL_CListCtrl::InsertItem
push 0x41f478
push 1
push ebp
mov ecx, edi
call sub.MFC42u.DLL_CListCtrl::SetItemText
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.File
call sub.MFC42u.DLL_CString::CString_1
lea eax, [esp + 0x20]
mov ecx, esi
push eax
call fcn.0040e300
mov eax, dword [eax]
push eax
push ebp
push 0x41f0a0
push str.Other
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntW]
lea ecx, [esp + 0x1c]
mov edi, eax
call sub.MFC42u.DLL_CString::CString
cmp edi, ebp
je 0x40a221
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], ebp
push ecx
push 0xf003f
push ebp
push str.SOFTWAREClasses.com
push 0x80000002
call ebx
cmp eax, ebp
jne 0x40a0cc
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp ecx, ebp
je 0x40a0c0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x14]
cmp eax, ebp
mov dword [esp + 0x10], edx
je 0x40a110
push 1
push str.MACHINESOFTWAREClasses.com
mov ecx, esi
call fcn.0040d430
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ebp
push eax
push 0xf003f
push ebp
push str.SOFTWAREClasses.com
push 0x80000002
call ebx
cmp eax, ebp
jne 0x40a110
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x40a108
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x10], ecx
push str.comfile
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea edx, [eax + eax + 2]
mov eax, dword [esp + 0x10]
push edx
push str.comfile
push 1
push ebp
push ebp
push eax
call edi
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x40a149
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], ebp
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], ebp
push ecx
push 0xf003f
push ebp
push str.SOFTWAREClassescomfile_shellopencommand
push 0x80000002
call ebx
cmp eax, ebp
jne 0x40a185
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp ecx, ebp
je 0x40a179
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x14]
cmp eax, ebp
mov dword [esp + 0x10], edx
je 0x40a1c9
push 1
push str.MACHINESOFTWAREClassescomfile_shellopencommand
mov ecx, esi
call fcn.0040d430
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ebp
push eax
push 0xf003f
push ebp
push str.SOFTWAREClassescomfile_shellopencommand
push 0x80000002
call ebx
cmp eax, ebp
jne 0x40a1c9
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x40a1c1
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x10], ecx
push str.__1___
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
lea edx, [eax + eax + 2]
mov eax, dword [esp + 0x10]
push edx
push str.__1___
push 1
push ebp
push ebp
push eax
call edi
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x40a1fc
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], ebp
push ebp
push ebp
push ebp
push ebp
lea edi, [esi + 0x7c]
push 0x41ef50
push ebp
push 1
mov ecx, edi
call sub.MFC42u.DLL_CListCtrl::InsertItem
push 0x41f478
push 1
push ebp
mov ecx, edi
call sub.MFC42u.DLL_CListCtrl::SetItemText
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.File
call sub.MFC42u.DLL_CString::CString_1
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
call fcn.0040e300
mov eax, dword [eax]
push eax
push ebp
push 0x41ef48
push str.Other
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntW]
lea ecx, [esp + 0x1c]
mov edi, eax
call sub.MFC42u.DLL_CString::CString
cmp edi, ebp
je 0x40a3f6
lea edx, [esp + 0x14]
mov dword [esp + 0x14], ebp
push edx
push 0xf003f
push ebp
push str.SOFTWAREClasses.bat
push 0x80000002
call ebx
cmp eax, ebp
jne 0x40a2a1
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp ecx, ebp
je 0x40a295
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x14]
cmp eax, ebp
mov dword [esp + 0x10], ecx
je 0x40a2e5
push 1
push str.MACHINESOFTWAREClasses.bat
mov ecx, esi
call fcn.0040d430
lea edx, [esp + 0x14]
mov dword [esp + 0x14], ebp
push edx
push 0xf003f
push ebp
push str.SOFTWAREClasses.bat
push 0x80000002
call ebx
cmp eax, ebp
jne 0x40a2e5
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x40a2dd
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], eax
push str.batfile
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
mov edx, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea ecx, [eax + eax + 2]
push ecx
push str.batfile
push 1
push ebp
push ebp
push edx
call edi
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x40a31e
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], ebp
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ebp
push eax
push 0xf003f
push ebp
push str.SOFTWAREClasses_batfile_shellopencommand
push 0x80000002
call ebx
cmp eax, ebp
jne 0x40a35a
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp ecx, ebp
je 0x40a34e
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x14]
cmp eax, ebp
mov dword [esp + 0x10], ecx
je 0x40a39e
push 1
push str.MACHINESOFTWAREClasses_batfile_shellopencommand
mov ecx, esi
call fcn.0040d430
lea edx, [esp + 0x14]
mov dword [esp + 0x14], ebp
push edx
push 0xf003f
push ebp
push str.SOFTWAREClasses_batfile_shellopencommand
push 0x80000002
call ebx
cmp eax, ebp
jne 0x40a39e
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x40a396
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], eax
push str.__1___
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
mov edx, dword [esp + 0x10]
lea ecx, [eax + eax + 2]
push ecx
push str.__1___
push 1
push ebp
push ebp
push edx
call edi
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x40a3d1
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], ebp
push ebp
push ebp
push ebp
push ebp
lea edi, [esi + 0x7c]
push 0x41edf8
push ebp
push 1
mov ecx, edi
call sub.MFC42u.DLL_CListCtrl::InsertItem
push 0x41f478
push 1
push ebp
mov ecx, edi
call sub.MFC42u.DLL_CListCtrl::SetItemText
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.File
call sub.MFC42u.DLL_CString::CString_1
lea eax, [esp + 0x20]
mov ecx, esi
push eax
call fcn.0040e300
mov eax, dword [eax]
push eax
push ebp
push 0x41edf0
push str.Other
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntW]
lea ecx, [esp + 0x1c]
mov edi, eax
call sub.MFC42u.DLL_CString::CString
cmp edi, ebp
je 0x40a5cb
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], ebp
push ecx
push 0xf003f
push ebp
push str.SOFTWAREClasses.cmd
push 0x80000002
call ebx
cmp eax, ebp
jne 0x40a476
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp ecx, ebp
je 0x40a46a
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x14]
cmp eax, ebp
mov dword [esp + 0x10], edx
je 0x40a4ba
push 1
push str.MACHINESOFTWAREClasses.cmd
mov ecx, esi
call fcn.0040d430
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ebp
push eax
push 0xf003f
push ebp
push str.SOFTWAREClasses.cmd
push 0x80000002
call ebx
cmp eax, ebp
jne 0x40a4ba
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x40a4b2
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x10], ecx
push str.cmdfile
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea edx, [eax + eax + 2]
mov eax, dword [esp + 0x10]
push edx
push str.cmdfile
push 1
push ebp
push ebp
push eax
call edi
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x40a4f3
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], ebp
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], ebp
push ecx
push 0xf003f
push ebp
push str.SOFTWAREClassescmdfile_shellopencommand
push 0x80000002
call ebx
cmp eax, ebp
jne 0x40a52f
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp ecx, ebp
je 0x40a523
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x14]
cmp eax, ebp
mov dword [esp + 0x10], edx
je 0x40a573
push 1
push str.MACHINESOFTWAREClassescmdfile_shellopencommand
mov ecx, esi
call fcn.0040d430
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ebp
push eax
push 0xf003f
push ebp
push str.SOFTWAREClassescmdfile_shellopencommand
push 0x80000002
call ebx
cmp eax, ebp
jne 0x40a573
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x40a56b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x10], ecx
push str.__1___
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
lea edx, [eax + eax + 2]
mov eax, dword [esp + 0x10]
push edx
push str.__1___
push 1
push ebp
push ebp
push eax
call edi
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x40a5a6
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], ebp
push ebp
push ebp
push ebp
push ebp
lea edi, [esi + 0x7c]
push 0x41eca0
push ebp
push 1
mov ecx, edi
call sub.MFC42u.DLL_CListCtrl::InsertItem
push 0x41f478
push 1
push ebp
mov ecx, edi
call sub.MFC42u.DLL_CListCtrl::SetItemText
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.File
call sub.MFC42u.DLL_CString::CString_1
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
call fcn.0040e300
mov eax, dword [eax]
push eax
push ebp
push 0x41ec98
push str.Other
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntW]
lea ecx, [esp + 0x1c]
mov edi, eax
call sub.MFC42u.DLL_CString::CString
cmp edi, ebp
je 0x40a7a0
lea edx, [esp + 0x14]
mov dword [esp + 0x14], ebp
push edx
push 0xf003f
push ebp
push str.SOFTWAREClasses.pif
push 0x80000002
call ebx
cmp eax, ebp
jne 0x40a64b
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp ecx, ebp
je 0x40a63f
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x14]
cmp eax, ebp
mov dword [esp + 0x10], ecx
je 0x40a68f
push 1
push str.MACHINESOFTWAREClasses.pif
mov ecx, esi
call fcn.0040d430
lea edx, [esp + 0x14]
mov dword [esp + 0x14], ebp
push edx
push 0xf003f
push ebp
push str.SOFTWAREClasses.pif
push 0x80000002
call ebx
cmp eax, ebp
jne 0x40a68f
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x40a687
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], eax
push str.piffile
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
mov edx, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea ecx, [eax + eax + 2]
push ecx
push str.piffile
push 1
push ebp
push ebp
push edx
call edi
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x40a6c8
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], ebp
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ebp
push eax
push 0xf003f
push ebp
push str.SOFTWAREClassespiffile_shellopencommand
push 0x80000002
call ebx
cmp eax, ebp
jne 0x40a704
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp ecx, ebp
je 0x40a6f8
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x14]
cmp eax, ebp
mov dword [esp + 0x10], ecx
je 0x40a748
push 1
push str.MACHINESOFTWAREClassespiffile_shellopencommand
mov ecx, esi
call fcn.0040d430
lea edx, [esp + 0x14]
mov dword [esp + 0x14], ebp
push edx
push 0xf003f
push ebp
push str.SOFTWAREClassespiffile_shellopencommand
push 0x80000002
call ebx
cmp eax, ebp
jne 0x40a748
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x40a740
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], eax
push str.__1___
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
mov edx, dword [esp + 0x10]
lea ecx, [eax + eax + 2]
push ecx
push str.__1___
push 1
push ebp
push ebp
push edx
call edi
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x40a77b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], ebp
push ebp
push ebp
push ebp
push ebp
lea edi, [esi + 0x7c]
push 0x41eb48
push ebp
push 1
mov ecx, edi
call sub.MFC42u.DLL_CListCtrl::InsertItem
push 0x41f478
push 1
push ebp
mov ecx, edi
call sub.MFC42u.DLL_CListCtrl::SetItemText
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.File
call sub.MFC42u.DLL_CString::CString_1
lea eax, [esp + 0x20]
mov ecx, esi
push eax
call fcn.0040e300
mov eax, dword [eax]
push eax
push ebp
push 0x41eb40
push str.Other
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntW]
lea ecx, [esp + 0x1c]
mov edi, eax
call sub.MFC42u.DLL_CString::CString
cmp edi, ebp
je 0x40a975
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], ebp
push ecx
push 0xf003f
push ebp
push str.SOFTWAREClasses.scr
push 0x80000002
call ebx
cmp eax, ebp
jne 0x40a820
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp ecx, ebp
je 0x40a814
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x14]
cmp eax, ebp
mov dword [esp + 0x10], edx
je 0x40a864
push 1
push str.MACHINESOFTWAREClasses.scr
mov ecx, esi
call fcn.0040d430
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ebp
push eax
push 0xf003f
push ebp
push str.SOFTWAREClasses.scr
push 0x80000002
call ebx
cmp eax, ebp
jne 0x40a864
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x40a85c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x10], ecx
push str.scrfile
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea edx, [eax + eax + 2]
mov eax, dword [esp + 0x10]
push edx
push str.scrfile
push 1
push ebp
push ebp
push eax
call edi
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x40a89d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], ebp
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], ebp
push ecx
push 0xf003f
push ebp
push str.SOFTWAREClasses_scrfile_shellopencommand
push 0x80000002
call ebx
cmp eax, ebp
jne 0x40a8d9
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp ecx, ebp
je 0x40a8cd
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x14]
cmp eax, ebp
mov dword [esp + 0x10], edx
je 0x40a91d
push 1
push str.MACHINESOFTWAREClasses_scrfile_shellopencommand
mov ecx, esi
call fcn.0040d430
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ebp
push eax
push 0xf003f
push ebp
push str.SOFTWAREClasses_scrfile_shellopencommand
push 0x80000002
call ebx
cmp eax, ebp
jne 0x40a91d
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x40a915
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x10], ecx
push str.__1___S
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
lea edx, [eax + eax + 2]
mov eax, dword [esp + 0x10]
push edx
push str.__1___S
push 1
push ebp
push ebp
push eax
call edi
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x40a950
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], ebp
push ebp
push ebp
push ebp
push ebp
lea edi, [esi + 0x7c]
push 0x41e9e0
push ebp
push 1
mov ecx, edi
call sub.MFC42u.DLL_CListCtrl::InsertItem
push 0x41f478
push 1
push ebp
mov ecx, edi
call sub.MFC42u.DLL_CListCtrl::SetItemText
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.File
call sub.MFC42u.DLL_CString::CString_1
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
call fcn.0040e300
mov eax, dword [eax]
push eax
push ebp
push 0x41e9d8
push str.Other
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntW]
lea ecx, [esp + 0x1c]
mov edi, eax
call sub.MFC42u.DLL_CString::CString
cmp edi, ebp
je 0x40ab4a
lea edx, [esp + 0x14]
mov dword [esp + 0x14], ebp
push edx
push 0xf003f
push ebp
push str.SOFTWAREClasses.reg
push 0x80000002
call ebx
cmp eax, ebp
jne 0x40a9f5
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp ecx, ebp
je 0x40a9e9
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x14]
cmp eax, ebp
mov dword [esp + 0x10], ecx
je 0x40aa39
push 1
push str.MACHINESOFTWAREClasses.reg
mov ecx, esi
call fcn.0040d430
lea edx, [esp + 0x14]
mov dword [esp + 0x14], ebp
push edx
push 0xf003f
push ebp
push str.SOFTWAREClasses.reg
push 0x80000002
call ebx
cmp eax, ebp
jne 0x40aa39
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x40aa31
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], eax
push str.regfile
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
mov edx, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea ecx, [eax + eax + 2]
push ecx
push str.regfile
push 1
push ebp
push ebp
push edx
call edi
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x40aa72
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], ebp
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ebp
push eax
push 0xf003f
push ebp
push str.SOFTWAREClasses_regfile_shellopencommand
push 0x80000002
call ebx
cmp eax, ebp
jne 0x40aaae
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp ecx, ebp
je 0x40aaa2
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x14]
cmp eax, ebp
mov dword [esp + 0x10], ecx
je 0x40aaf2
push 1
push str.MACHINESOFTWAREClasses_regfile_shellopencommand
mov ecx, esi
call fcn.0040d430
lea edx, [esp + 0x14]
mov dword [esp + 0x14], ebp
push edx
push 0xf003f
push ebp
push str.SOFTWAREClasses_regfile_shellopencommand
push 0x80000002
call ebx
cmp eax, ebp
jne 0x40aaf2
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x40aaea
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], eax
push str.regedit.exe___1_
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
mov edx, dword [esp + 0x10]
lea ecx, [eax + eax + 2]
push ecx
push str.regedit.exe___1_
push 1
push ebp
push ebp
push edx
call edi
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x40ab25
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], ebp
push ebp
push ebp
push ebp
push ebp
lea edi, [esi + 0x7c]
push 0x41e864
push ebp
push 1
mov ecx, edi
call sub.MFC42u.DLL_CListCtrl::InsertItem
push 0x41f478
push 1
push ebp
mov ecx, edi
call sub.MFC42u.DLL_CListCtrl::SetItemText
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.File
call sub.MFC42u.DLL_CString::CString_1
lea eax, [esp + 0x20]
mov ecx, esi
push eax
call fcn.0040e300
mov eax, dword [eax]
push eax
push ebp
push 0x41e85c
push str.Other
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntW]
lea ecx, [esp + 0x1c]
mov edi, eax
call sub.MFC42u.DLL_CString::CString
cmp edi, ebp
je 0x40af23
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], ebp
push ecx
push 0xf003f
push ebp
push str.SOFTWAREClasses.txt
push 0x80000002
call ebx
cmp eax, ebp
jne 0x40abca
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp ecx, ebp
je 0x40abbe
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x14]
cmp eax, ebp
mov dword [esp + 0x10], edx
je 0x40ac0e
push 1
push str.MACHINESOFTWAREClasses.txt
mov ecx, esi
call fcn.0040d430
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ebp
push eax
push 0xf003f
push ebp
push str.SOFTWAREClasses.txt
push 0x80000002
call ebx
cmp eax, ebp
jne 0x40ac0e
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x40ac06
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x10], ecx
push str.txtfile
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea edx, [eax + eax + 2]
mov eax, dword [esp + 0x10]
push edx
push str.txtfile
push 1
push ebp
push ebp
push eax
call edi
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x40ac47
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], ebp
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], ebp
push ecx
push 0xf003f
push ebp
push str.SOFTWAREClasses.ini
push 0x80000002
call ebx
cmp eax, ebp
jne 0x40ac83
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp ecx, ebp
je 0x40ac77
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x14]
cmp eax, ebp
mov dword [esp + 0x10], edx
je 0x40acc7
push 1
push str.MACHINESOFTWAREClasses.ini
mov ecx, esi
call fcn.0040d430
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ebp
push eax
push 0xf003f
push ebp
push str.SOFTWAREClasses.ini
push 0x80000002
call ebx
cmp eax, ebp
jne 0x40acc7
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x40acbf
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x10], ecx
push str.inifile
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
lea edx, [eax + eax + 2]
mov eax, dword [esp + 0x10]
push edx
push str.inifile
push 1
push ebp
push ebp
push eax
call edi
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x40acfa
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], ebp
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], ebp
push ecx
push 0xf003f
push ebp
push str.SOFTWAREClasses.inf
push 0x80000002
call ebx
cmp eax, ebp
jne 0x40ad36
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp ecx, ebp
je 0x40ad2a
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x14]
cmp eax, ebp
mov dword [esp + 0x10], edx
je 0x40ad7a
push 1
push str.MACHINESOFTWAREClasses.inf
mov ecx, esi
call fcn.0040d430
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ebp
push eax
push 0xf003f
push ebp
push str.SOFTWAREClasses.inf
push 0x80000002
call ebx
cmp eax, ebp
jne 0x40ad7a
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x40ad72
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x10], ecx
push str.inffile
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
lea edx, [eax + eax + 2]
mov eax, dword [esp + 0x10]
push edx
push str.inffile
push 1
push ebp
push ebp
push eax
call edi
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x40adad
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], ebp
lea ecx, [esp + 0x18]
push ecx
push 0xf003f
push ebp
push str.SOFTWAREClasses_txtfile_shellopencommand
push 0x80000002
call ebx
test eax, eax
je 0x40aded
push 1
push str.MACHINESOFTWAREClasses_txtfile_shellopencommand
mov ecx, esi
call fcn.0040d430
lea edx, [esp + 0x18]
push edx
push 0xf003f
push ebp
push str.SOFTWAREClasses_txtfile_shellopencommand
push 0x80000002
call ebx
push str._SystemRoot__system32NOTEPAD.EXE__1
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
mov ecx, dword [esp + 0x18]
lea eax, [eax + eax + 2]
push eax
push str._SystemRoot__system32NOTEPAD.EXE__1
push 2
push ebp
push 0x41f9bc
push ecx
call edi
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x18]
push eax
push 0xf003f
push ebp
push str.SOFTWAREClassesinifile_shellopencommand
push 0x80000002
call ebx
test eax, eax
je 0x40ae5c
push 1
push str.MACHINESOFTWAREClassesinifile_shellopencommand
mov ecx, esi
call fcn.0040d430
lea ecx, [esp + 0x18]
push ecx
push 0xf003f
push ebp
push str.SOFTWAREClassesinifile_shellopencommand
push 0x80000002
call ebx
push str._SystemRoot__system32NOTEPAD.EXE__1
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
lea edx, [eax + eax + 2]
mov eax, dword [esp + 0x18]
push edx
push str._SystemRoot__system32NOTEPAD.EXE__1
push 2
push ebp
push 0x41f9bc
push eax
call edi
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x18]
push edx
push 0xf003f
push ebp
push str.SOFTWAREClassesinffile_shellopencommand
push 0x80000002
call ebx
test eax, eax
je 0x40aecb
push 1
push str.MACHINESOFTWAREClassesinffile_shellopencommand
mov ecx, esi
call fcn.0040d430
lea eax, [esp + 0x18]
push eax
push 0xf003f
push ebp
push str.SOFTWAREClassesinffile_shellopencommand
push 0x80000002
call ebx
push str._SystemRoot__system32NOTEPAD.EXE__1
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
mov edx, dword [esp + 0x18]
lea ecx, [eax + eax + 2]
push ecx
push str._SystemRoot__system32NOTEPAD.EXE__1
push 2
push ebp
push 0x41f9bc
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
push ebp
push ebp
push ebp
lea edi, [esi + 0x7c]
push 0x41e440
push ebp
push 1
mov ecx, edi
call sub.MFC42u.DLL_CListCtrl::InsertItem
push 0x41f478
push 1
push ebp
mov ecx, edi
call sub.MFC42u.DLL_CListCtrl::SetItemText
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.File
call sub.MFC42u.DLL_CString::CString_1
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
call fcn.0040e300
mov eax, dword [eax]
push eax
push ebp
push str.Regedit
push str.Other
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntW]
lea ecx, [esp + 0x1c]
mov edi, eax
call sub.MFC42u.DLL_CString::CString
cmp edi, ebp
je 0x40b03d
lea edx, [esp + 0x14]
mov dword [esp + 0x14], ebp
push edx
push 0xf003f
push ebp
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000001
call ebx
cmp eax, ebp
jne 0x40afa3
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp ecx, ebp
je 0x40af97
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x14]
cmp eax, ebp
mov dword [esp + 0x10], ecx
je 0x40afe7
push 1
push str.CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
mov ecx, esi
call fcn.0040d430
lea edx, [esp + 0x14]
mov dword [esp + 0x14], ebp
push edx
push 0xf003f
push ebp
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000001
call ebx
cmp eax, ebp
jne 0x40afe7
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x40afdf
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
push 4
push ecx
push 4
push ebp
push str.DisableRegistryTools
push edx
mov dword [esp + 0x34], ebp
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x40b018
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], ebp
push ebp
push ebp
push ebp
push ebp
lea edi, [esi + 0x7c]
push 0x41e2ec
push ebp
push 1
mov ecx, edi
call sub.MFC42u.DLL_CListCtrl::InsertItem
push 0x41f478
push 1
push ebp
mov ecx, edi
call sub.MFC42u.DLL_CListCtrl::SetItemText
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.File
call sub.MFC42u.DLL_CString::CString_1
lea eax, [esp + 0x20]
mov ecx, esi
push eax
call fcn.0040e300
mov eax, dword [eax]
push eax
push ebp
push str.TaskMgr
push str.Other
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntW]
lea ecx, [esp + 0x1c]
mov edi, eax
call sub.MFC42u.DLL_CString::CString
cmp edi, ebp
je 0x40b157
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], ebp
push ecx
push 0xf003f
push ebp
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000001
call ebx
cmp eax, ebp
jne 0x40b0bd
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp ecx, ebp
je 0x40b0b1
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x14]
cmp eax, ebp
mov dword [esp + 0x10], edx
je 0x40b101
push 1
push str.CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
mov ecx, esi
call fcn.0040d430
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ebp
push eax
push 0xf003f
push ebp
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000001
call ebx
cmp eax, ebp
jne 0x40b101
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x40b0f9
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push 4
push edx
push 4
push ebp
push str.DisableTaskMgr
push eax
mov dword [esp + 0x34], ebp
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x40b132
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], ebp
push ebp
push ebp
push ebp
push ebp
lea edi, [esi + 0x7c]
push 0x41e2ac
push ebp
push 1
mov ecx, edi
call sub.MFC42u.DLL_CListCtrl::InsertItem
push 0x41f478
push 1
push ebp
mov ecx, edi
call sub.MFC42u.DLL_CListCtrl::SetItemText
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.File
call sub.MFC42u.DLL_CString::CString_1
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
call fcn.0040e300
mov eax, dword [eax]
push eax
push ebp
push str.IESettings
push str.Other
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntW]
lea ecx, [esp + 0x1c]
mov edi, eax
call sub.MFC42u.DLL_CString::CString
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp edi, ebp
je 0x40b5da
lea edx, [esp + 0x14]
mov dword [esp + 0x14], ebp
push edx
push 0xf003f
push ebp
push str.SoftwarePoliciesMicrosoft
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebp
jne 0x40b1db
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x40b1d3
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], ebp
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push 0x2001f
push ebp
push str.Internet_Explorer
push edx
mov byte [esp + 0x488], 0x30
mov dword [esp + 0x28], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp edi, ebp
jne 0x40b29e
lea ecx, [esp + 0x18]
call fcn.00404200
mov edi, eax
mov eax, dword [esp + 0x14]
cmp edi, ebp
mov dword [esp + 0x18], eax
jne 0x40b29e
lea ecx, [esp + 0x20]
lea edx, [esp + 0x28]
push ecx
push ebp
push ebp
push ebp
lea ecx, [esp + 0x6c]
push edx
push ecx
push ebp
push eax
mov dword [esp + 0x48], 0x100
call ebx
test eax, eax
jne 0x40b283
lea edx, [esp + 0x5c]
lea ecx, [esp + 0x18]
push edx
call fcn.00404220
mov edi, eax
cmp edi, ebp
jne 0x40b29e
lea eax, [esp + 0x20]
lea ecx, [esp + 0x28]
push eax
mov eax, dword [esp + 0x1c]
push ebp
push ebp
push ebp
lea edx, [esp + 0x6c]
push ecx
push edx
push ebp
push eax
mov dword [esp + 0x48], 0x100
call ebx
test eax, eax
je 0x40b249
lea ecx, [esp + 0x18]
call fcn.00404200
mov ecx, dword [esp + 0x10]
push str.Internet_Explorer
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edi, eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x474], 0x2f
call fcn.00404200
cmp edi, ebp
je 0x40b398
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.HKEY_LOCAL_MACHINESoftwarePoliciesMicrosoftInternet_Explorer
call sub.MFC42u.DLL_CString::CString_1
mov ecx, esi
call fcn.0040fbd0
mov dword [esp + 0x18], ebp
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push 0x2001f
push ebp
push str.Internet_Explorer
push eax
mov byte [esp + 0x488], 0x31
mov dword [esp + 0x28], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebp
jne 0x40b387
lea ecx, [esp + 0x18]
call fcn.00404200
mov ecx, dword [esp + 0x14]
cmp eax, ebp
mov dword [esp + 0x18], ecx
jne 0x40b387
lea edx, [esp + 0x20]
lea eax, [esp + 0x28]
push edx
push ebp
push ebp
push ebp
lea edx, [esp + 0x6c]
push eax
push edx
mov edi, 0x100
push ebp
push ecx
mov dword [esp + 0x48], edi
call ebx
test eax, eax
jne 0x40b36e
lea eax, [esp + 0x5c]
lea ecx, [esp + 0x18]
push eax
call fcn.00404220
cmp eax, ebp
jne 0x40b387
lea ecx, [esp + 0x20]
lea edx, [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x1c]
push ebp
push ebp
push ebp
lea eax, [esp + 0x6c]
push edx
push eax
push ebp
push ecx
mov dword [esp + 0x48], edi
call ebx
test eax, eax
je 0x40b33a
lea ecx, [esp + 0x18]
call fcn.00404200
mov edx, dword [esp + 0x10]
push str.Internet_Explorer
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea ecx, [esp + 0x18]
mov byte [esp + 0x474], 0x2f
call fcn.00404200
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x40b3ab
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], ebp
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ebp
push eax
push 0xf003f
push ebp
push str.SoftwarePoliciesMicrosoft
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebp
jne 0x40b3e5
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x40b3dd
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], ebp
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push 0x2001f
push ebp
push str.Internet_Explorer
push eax
mov byte [esp + 0x488], 0x32
mov dword [esp + 0x28], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp edi, ebp
jne 0x40b4a8
lea ecx, [esp + 0x18]
call fcn.00404200
mov edi, eax
mov eax, dword [esp + 0x14]
cmp edi, ebp
mov dword [esp + 0x18], eax
jne 0x40b4a8
lea ecx, [esp + 0x20]
lea edx, [esp + 0x28]
push ecx
push ebp
push ebp
push ebp
lea ecx, [esp + 0x6c]
push edx
push ecx
push ebp
push eax
mov dword [esp + 0x48], 0x100
call ebx
test eax, eax
jne 0x40b48d
lea edx, [esp + 0x5c]
lea ecx, [esp + 0x18]
push edx
call fcn.00404220
mov edi, eax
cmp edi, ebp
jne 0x40b4a8
lea eax, [esp + 0x20]
lea ecx, [esp + 0x28]
push eax
mov eax, dword [esp + 0x1c]
push ebp
push ebp
push ebp
lea edx, [esp + 0x6c]
push ecx
push edx
push ebp
push eax
mov dword [esp + 0x48], 0x100
call ebx
test eax, eax
je 0x40b453
lea ecx, [esp + 0x18]
call fcn.00404200
mov ecx, dword [esp + 0x10]
push str.Internet_Explorer
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edi, eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x474], 0x2f
call fcn.00404200
cmp edi, ebp
je 0x40b5a2
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.HKEY_CURRENT_USERSoftwarePoliciesMicrosoftInternet_Explorer
call sub.MFC42u.DLL_CString::CString_1
mov ecx, esi
call fcn.0040fbd0
mov dword [esp + 0x18], ebp
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push 0x2001f
push ebp
push str.Internet_Explorer
push eax
mov byte [esp + 0x488], 0x33
mov dword [esp + 0x28], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebp
jne 0x40b591
lea ecx, [esp + 0x18]
call fcn.00404200
mov ecx, dword [esp + 0x14]
cmp eax, ebp
mov dword [esp + 0x18], ecx
jne 0x40b591
lea edx, [esp + 0x20]
lea eax, [esp + 0x28]
push edx
push ebp
push ebp
push ebp
lea edx, [esp + 0x6c]
push eax
push edx
mov edi, 0x100
push ebp
push ecx
mov dword [esp + 0x48], edi
call ebx
test eax, eax
jne 0x40b578
lea eax, [esp + 0x5c]
lea ecx, [esp + 0x18]
push eax
call fcn.00404220
cmp eax, ebp
jne 0x40b591
lea ecx, [esp + 0x20]
lea edx, [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x1c]
push ebp
push ebp
push ebp
lea eax, [esp + 0x6c]
push edx
push eax
push ebp
push ecx
mov dword [esp + 0x48], edi
call ebx
test eax, eax
je 0x40b544
lea ecx, [esp + 0x18]
call fcn.00404200
mov edx, dword [esp + 0x10]
push str.Internet_Explorer
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea ecx, [esp + 0x18]
mov byte [esp + 0x474], 0x2f
call fcn.00404200
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x40b5b5
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], ebp
push ebp
push ebp
push ebp
push ebp
lea edi, [esi + 0x7c]
push 0x41e11c
push ebp
push 1
mov ecx, edi
call sub.MFC42u.DLL_CListCtrl::InsertItem
push 0x41f478
push 1
push ebp
mov ecx, edi
call sub.MFC42u.DLL_CListCtrl::SetItemText
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.File
call sub.MFC42u.DLL_CString::CString_1
lea eax, [esp + 0x20]
mov ecx, esi
push eax
call fcn.0040e300
mov eax, dword [eax]
push eax
push ebp
push str.ShowHide
push str.Other
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntW]
lea ecx, [esp + 0x1c]
mov edi, eax
call sub.MFC42u.DLL_CString::CString
cmp edi, ebp
je 0x40bc10
lea ecx, [esp + 0x20]
lea edx, [esp + 0x14]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push edx
push ebp
push 0xf003f
push ebp
push ebp
push ebp
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvancedFolderHidden
push 0x80000002
mov dword [esp + 0x38], ebp
call edi
cmp eax, ebp
jne 0x40b676
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x40b666
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call ebx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], eax
jmp 0x40b67c
mov eax, dword [esp + 0x14]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], eax
jmp 0x40b67c
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x20]
lea edx, [esp + 0x14]
push ecx
push edx
push ebp
push 0xf003f
push ebp
push ebp
push ebp
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvancedFolderHiddenNOHIDDEN
push 0x80000002
mov dword [esp + 0x38], ebp
call edi
cmp eax, ebp
jne 0x40b6b6
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x40b6ae
push eax
call ebx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x20]
lea edx, [esp + 0x14]
push ecx
push edx
push ebp
push 0xf003f
push ebp
push ebp
push ebp
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvancedFolderHiddenSHOWALL
push 0x80000002
mov dword [esp + 0x38], ebp
call edi
cmp eax, ebp
jne 0x40b6f0
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x40b6e8
push eax
call ebx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x20]
lea edx, [esp + 0x14]
push ecx
push edx
push ebp
push 0xf003f
push ebp
push ebp
push ebp
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvancedFolderSuperHidden
push 0x80000002
mov dword [esp + 0x38], ebp
call edi
cmp eax, ebp
jne 0x40b72a
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x40b722
push eax
call ebx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x20]
lea edx, [esp + 0x14]
push ecx
push edx
push ebp
push 0xf003f
push ebp
push ebp
push ebp
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
push 0x80000001
mov dword [esp + 0x38], ebp
call edi
cmp eax, ebp
jne 0x40b764
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x40b75c
push eax
call ebx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [esp + 0x14]
push ecx
push 0xf003f
push ebp
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvancedFolderHidden
push 0x80000002
mov dword [esp + 0x28], ebp
call edi
cmp eax, ebp
jne 0x40b7a2
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp ecx, ebp
je 0x40b796
push ecx
call ebx
mov edx, dword [esp + 0x14]
cmp eax, ebp
mov dword [esp + 0x10], edx
je 0x40b7e2
push 1
push str.MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvancedFolderHidden
mov ecx, esi
call fcn.0040d430
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ebp
push eax
push 0xf003f
push ebp
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvancedFolderHidden
push 0x80000002
call edi
cmp eax, ebp
jne 0x40b7e2
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x40b7da
push eax
call ebx
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x10], ecx
mov edi, dword [sym.imp.KERNEL32.DLL_lstrlenW]
push str.group
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea edx, [eax + eax + 2]
mov eax, dword [esp + 0x10]
push edx
push str.group
push 1
push ebp
push str.Type
push eax
call ebx
push str._shell32.dll__30499
call edi
mov edx, dword [esp + 0x10]
lea ecx, [eax + eax + 2]
push ecx
push str._shell32.dll__30499
push 1
push ebp
push str.Text
push edx
call ebx
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x40b841
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], ebp
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ebp
push eax
push 0xf003f
push ebp
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvancedFolderHiddenNOHIDDEN
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebp
jne 0x40b881
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp ecx, ebp
je 0x40b875
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x14]
cmp eax, ebp
mov dword [esp + 0x10], ecx
je 0x40b8c9
push 1
push str.MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvancedFolderHiddenNOHIDDEN
mov ecx, esi
call fcn.0040d430
lea edx, [esp + 0x14]
mov dword [esp + 0x14], ebp
push edx
push 0xf003f
push ebp
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvancedFolderHiddenNOHIDDEN
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebp
jne 0x40b8c9
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x40b8c1
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
push 4
push ecx
push 4
push ebp
push str.CheckedValue
push edx
mov dword [esp + 0x34], 2
call ebx
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x1c]
push 4
push eax
push 4
push ebp
push str.DefaultValue
push ecx
mov dword [esp + 0x34], 2
call ebx
push str.radio
call edi
lea edx, [eax + eax + 2]
mov eax, dword [esp + 0x10]
push edx
push str.radio
push 1
push ebp
push str.Type
push eax
call ebx
push str.Hidden
call edi
mov edx, dword [esp + 0x10]
lea ecx, [eax + eax + 2]
push ecx
push str.Hidden
push 1
push ebp
push str.ValueName
push edx
call ebx
push str._shell32.dll__30501
call edi
mov ecx, dword [esp + 0x10]
lea eax, [eax + eax + 2]
push eax
push str._shell32.dll__30501
push 1
push ebp
push str.Text
push ecx
call ebx
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
call edi
lea edx, [eax + eax + 2]
mov eax, dword [esp + 0x10]
push edx
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
push 1
push ebp
push str.RegPath
push eax
call ebx
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x40b998
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], ebp
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [esp + 0x14]
push ecx
push 0xf003f
push ebp
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvancedFolderHiddenSHOWALL
push 0x80000002
mov dword [esp + 0x28], ebp
call edi
cmp eax, ebp
jne 0x40b9da
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp ecx, ebp
je 0x40b9ce
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x14]
cmp eax, ebp
mov dword [esp + 0x10], edx
je 0x40ba1e
push 1
push str.MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvancedFolderHiddenSHOWALL
mov ecx, esi
call fcn.0040d430
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ebp
push eax
push 0xf003f
push ebp
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvancedFolderHiddenSHOWALL
push 0x80000002
call edi
cmp eax, ebp
jne 0x40ba1e
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x40ba16
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push 4
push edx
push 4
push ebp
push str.CheckedValue
push eax
mov dword [esp + 0x34], 1
call ebx
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
push 4
push ecx
push 4
push ebp
push str.DefaultValue
push edx
mov dword [esp + 0x34], 2
call ebx
push str.Type
push str.radio
lea ecx, [esp + 0x18]
call fcn.004104a0
push str.ValueName
push str.Hidden
lea ecx, [esp + 0x18]
call fcn.004104a0
push str.Text
push str._shell32.dll__30500
lea ecx, [esp + 0x18]
call fcn.004104a0
push str.RegPath
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
lea ecx, [esp + 0x18]
call fcn.004104a0
lea ecx, [esp + 0x10]
call fcn.00404200
push 0xf003f
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvancedFolderSuperHidden
push 0x80000002
lea ecx, [esp + 0x1c]
call fcn.00410430
test eax, eax
je 0x40baf1
push 1
push str.MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvancedFolderSuperHidden
mov ecx, esi
call fcn.0040d430
push 0xf003f
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvancedFolderSuperHidden
push 0x80000002
lea ecx, [esp + 0x1c]
call fcn.00410430
push str.CheckedValue
push ebp
lea ecx, [esp + 0x18]
call fcn.00410480
push str.DefaultValue
push ebp
lea ecx, [esp + 0x18]
call fcn.00410480
push str.UncheckedValue
push 1
lea ecx, [esp + 0x18]
call fcn.00410480
push str.Type
push str.checkbox
lea ecx, [esp + 0x18]
call fcn.004104a0
push str.ValueName
push str.ShowSuperHidden
lea ecx, [esp + 0x18]
call fcn.004104a0
push str.Text
push str._shell32.dll__30508
lea ecx, [esp + 0x18]
call fcn.004104a0
push str.RegPath
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
lea ecx, [esp + 0x18]
call fcn.004104a0
lea ecx, [esp + 0x10]
call fcn.00404200
push 0xf003f
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
push 0x80000001
lea ecx, [esp + 0x1c]
call fcn.00410430
test eax, eax
je 0x40bbb6
push 1
push str.CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
mov ecx, esi
call fcn.0040d430
push 0xf003f
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
push 0x80000001
lea ecx, [esp + 0x1c]
call fcn.00410430
push str.Hidden
push 1
lea ecx, [esp + 0x18]
call fcn.00410480
push str.ShowSuperHidden
push 1
lea ecx, [esp + 0x18]
call fcn.00410480
push str.SuperHidden
push 1
lea ecx, [esp + 0x18]
call fcn.00410480
lea ecx, [esp + 0x10]
call fcn.00404200
lea edi, [esi + 0x7c]
push 0x41d8a0
push ebp
mov ecx, edi
call fcn.004104d0
push 0x41f478
push 1
push ebp
mov ecx, edi
call sub.MFC42u.DLL_CListCtrl::SetItemText
jmp 0x40bc16
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.File
call sub.MFC42u.DLL_CString::CString_1
lea eax, [esp + 0x20]
mov ecx, esi
push eax
call fcn.0040e300
mov ecx, eax
call fcn.00407280
push eax
push ebp
push str.ShowExt
push str.Other
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntW]
lea ecx, [esp + 0x1c]
mov edi, eax
call sub.MFC42u.DLL_CString::CString
cmp edi, ebp
je 0x40c134
push ebp
push ebp
push 0xf003f
push ebp
push ebp
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvancedFolderHideFileExt
push 0x80000002
lea ecx, [esp + 0x2c]
call fcn.004103c0
push 0xf003f
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvancedFolderHideFileExt
push 0x80000002
lea ecx, [esp + 0x1c]
call fcn.00410430
test eax, eax
je 0x40bcbd
push 1
push str.MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvancedFolderHideFileExt
mov ecx, esi
call fcn.0040d430
push 0xf003f
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvancedFolderHideFileExt
push 0x80000002
lea ecx, [esp + 0x1c]
call fcn.00410430
push str.CheckedValue
push 1
lea ecx, [esp + 0x18]
call fcn.00410480
push str.DefaultValue
push 1
lea ecx, [esp + 0x18]
call fcn.00410480
push str.UncheckedValue
push ebp
lea ecx, [esp + 0x18]
call fcn.00410480
push str.Type
push str.checkbox
lea ecx, [esp + 0x18]
call fcn.004104a0
push str.ValueName
push str.HideFileExt
lea ecx, [esp + 0x18]
call fcn.004104a0
push str.Text
push str._shell32.dll__30503
lea ecx, [esp + 0x18]
call fcn.004104a0
push str.RegPath
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
lea ecx, [esp + 0x18]
call fcn.004104a0
lea ecx, [esp + 0x10]
call fcn.00404200
push 0xf003f
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
push 0x80000001
lea ecx, [esp + 0x1c]
call fcn.00410430
test eax, eax
je 0x40bd83
push 1
push str.CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
mov ecx, esi
call fcn.0040d430
push 0xf003f
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
push 0x80000001
lea ecx, [esp + 0x1c]
call fcn.00410430
push str.HideFileExt
push ebp
lea ecx, [esp + 0x18]
call fcn.00410480
lea ecx, [esp + 0x10]
call fcn.00404200
push 0xf003f
push str.SOFTWAREClassesexefile
push 0x80000002
lea ecx, [esp + 0x1c]
call fcn.00410430
test eax, eax
je 0x40bddd
push 1
push str.MACHINESOFTWAREClassesexefile
mov ecx, esi
call fcn.0040d430
push 0xf003f
push str.SOFTWAREClassesexefile
push 0x80000002
lea ecx, [esp + 0x1c]
call fcn.00410430
push str.NeverShowExt
lea ecx, [esp + 0x14]
call fcn.004103a0
lea ecx, [esp + 0x10]
call fcn.00404200
push 0xf003f
push str.SOFTWAREClassescomfile
push 0x80000002
lea ecx, [esp + 0x1c]
call fcn.00410430
test eax, eax
je 0x40be36
push 1
push str.MACHINESOFTWAREClassescomfile
mov ecx, esi
call fcn.0040d430
push 0xf003f
push str.SOFTWAREClassescomfile
push 0x80000002
lea ecx, [esp + 0x1c]
call fcn.00410430
push str.NeverShowExt
lea ecx, [esp + 0x14]
call fcn.004103a0
lea ecx, [esp + 0x10]
call fcn.00404200
push 0xf003f
push str.SOFTWAREClasses_batfile
push 0x80000002
lea ecx, [esp + 0x1c]
call fcn.00410430
test eax, eax
je 0x40be8f
push 1
push str.MACHINESOFTWAREClasses_batfile
mov ecx, esi
call fcn.0040d430
push 0xf003f
push str.SOFTWAREClasses_batfile
push 0x80000002
lea ecx, [esp + 0x1c]
call fcn.00410430
push str.NeverShowExt
lea ecx, [esp + 0x14]
call fcn.004103a0
lea ecx, [esp + 0x10]
call fcn.00404200
push 0xf003f
push str.SOFTWAREClassescmdfile
push 0x80000002
lea ecx, [esp + 0x1c]
call fcn.00410430
test eax, eax
je 0x40bee8
push 1
push str.MACHINESOFTWAREClassescmdfile
mov ecx, esi
call fcn.0040d430
push 0xf003f
push str.SOFTWAREClassescmdfile
push 0x80000002
lea ecx, [esp + 0x1c]
call fcn.00410430
push str.NeverShowExt
lea ecx, [esp + 0x14]
call fcn.004103a0
lea ecx, [esp + 0x10]
call fcn.00404200
push 0xf003f
push str.SOFTWAREClassespiffile
push 0x80000002
lea ecx, [esp + 0x1c]
call fcn.00410430
test eax, eax
je 0x40bf41
push 1
push str.MACHINESOFTWAREClassespiffile
mov ecx, esi
call fcn.0040d430
push 0xf003f
push str.SOFTWAREClassespiffile
push 0x80000002
lea ecx, [esp + 0x1c]
call fcn.00410430
push str.NeverShowExt
lea ecx, [esp + 0x14]
call fcn.004103a0
lea ecx, [esp + 0x10]
call fcn.00404200
push 0xf003f
push str.SOFTWAREClasses_scrfile
push 0x80000002
lea ecx, [esp + 0x1c]
call fcn.00410430
test eax, eax
je 0x40bf9a
push 1
push str.MACHINESOFTWAREClasses_scrfile
mov ecx, esi
call fcn.0040d430
push 0xf003f
push str.SOFTWAREClasses_scrfile
push 0x80000002
lea ecx, [esp + 0x1c]
call fcn.00410430
push str.NeverShowExt
lea ecx, [esp + 0x14]
call fcn.004103a0
lea ecx, [esp + 0x10]
call fcn.00404200
push 0xf003f
push str.SOFTWAREClasses_regfile
push 0x80000002
lea ecx, [esp + 0x1c]
call fcn.00410430
test eax, eax
je 0x40bff3
push 1
push str.MACHINESOFTWAREClasses_regfile
mov ecx, esi
call fcn.0040d430
push 0xf003f
push str.SOFTWAREClasses_regfile
push 0x80000002
lea ecx, [esp + 0x1c]
call fcn.00410430
push str.NeverShowExt
lea ecx, [esp + 0x14]
call fcn.004103a0
lea ecx, [esp + 0x10]
call fcn.00404200
push 0xf003f
push str.SOFTWAREClasses_txtfile
push 0x80000002
lea ecx, [esp + 0x1c]
call fcn.00410430
test eax, eax
je 0x40c04c
push 1
push str.MACHINESOFTWAREClasses_txtfile
mov ecx, esi
call fcn.0040d430
push 0xf003f
push str.SOFTWAREClasses_txtfile
push 0x80000002
lea ecx, [esp + 0x1c]
call fcn.00410430
push str.NeverShowExt
lea ecx, [esp + 0x14]
call fcn.004103a0
lea ecx, [esp + 0x10]
call fcn.00404200
push 0xf003f
push str.SOFTWAREClassesinifile
push 0x80000002
lea ecx, [esp + 0x1c]
call fcn.00410430
test eax, eax
je 0x40c0a5
push 1
push str.MACHINESOFTWAREClassesinifile
mov ecx, esi
call fcn.0040d430
push 0xf003f
push str.SOFTWAREClassesinifile
push 0x80000002
lea ecx, [esp + 0x1c]
call fcn.00410430
push str.NeverShowExt
lea ecx, [esp + 0x14]
call fcn.004103a0
lea ecx, [esp + 0x10]
call fcn.00404200
push 0xf003f
push str.SOFTWAREClassesinffile
push 0x80000002
lea ecx, [esp + 0x1c]
call fcn.00410430
test eax, eax
je 0x40c0fe
push 1
push str.MACHINESOFTWAREClassesinffile
mov ecx, esi
call fcn.0040d430
push 0xf003f
push str.SOFTWAREClassesinffile
push 0x80000002
lea ecx, [esp + 0x1c]
call fcn.00410430
push str.NeverShowExt
lea ecx, [esp + 0x14]
call fcn.004103a0
lea ecx, [esp + 0x10]
call fcn.00404200
lea edi, [esi + 0x7c]
push 0x41d220
push ebp
mov ecx, edi
call fcn.004104d0
push 0x41f478
push 1
push ebp
mov ecx, edi
call sub.MFC42u.DLL_CListCtrl::SetItemText
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.File
call sub.MFC42u.DLL_CString::CString_1
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
call fcn.0040e300
mov ecx, eax
call fcn.00407280
push eax
push ebp
push str.ShowDrive
push str.Other
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntW]
lea ecx, [esp + 0x1c]
mov edi, eax
call sub.MFC42u.DLL_CString::CString
cmp edi, ebp
je 0x40c24e
push 0xf003f
push str.SOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer
push 0x80000002
lea ecx, [esp + 0x1c]
call fcn.00410430
test eax, eax
je 0x40c1bf
push 1
push str.MACHINESOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer
mov ecx, esi
call fcn.0040d430
push 0xf003f
push str.SOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer
push 0x80000002
lea ecx, [esp + 0x1c]
call fcn.00410430
push str.NoDrives
lea ecx, [esp + 0x14]
call fcn.004103a0
lea ecx, [esp + 0x10]
call fcn.00404200
push 0xf003f
push str.SOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer
push 0x80000001
lea ecx, [esp + 0x1c]
call fcn.00410430
test eax, eax
je 0x40c218
push 1
push str.CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer
mov ecx, esi
call fcn.0040d430
push 0xf003f
push str.SOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorer
push 0x80000001
lea ecx, [esp + 0x1c]
call fcn.00410430
push str.NoDrives
lea ecx, [esp + 0x14]
call fcn.004103a0
lea ecx, [esp + 0x10]
call fcn.00404200
lea edi, [esi + 0x7c]
push 0x41d050
push ebp
mov ecx, edi
call fcn.004104d0
push 0x41f478
push 1
push ebp
mov ecx, edi
call sub.MFC42u.DLL_CListCtrl::SetItemText
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.File
call sub.MFC42u.DLL_CString::CString_1
lea edx, [esp + 0x20]
mov ecx, esi
push edx
call fcn.0040e300
mov ecx, eax
call fcn.00407280
push eax
push ebp
push str.DDOpen
push str.Other
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntW]
lea ecx, [esp + 0x1c]
mov edi, eax
call sub.MFC42u.DLL_CString::CString
cmp edi, ebp
je 0x40c384
push 0xf003f
push str.SOFTWAREClassesDirectory_shell
push 0x80000002
lea ecx, [esp + 0x1c]
call fcn.00410430
test eax, eax
je 0x40c2d9
push 1
push str.MACHINESOFTWAREClassesDirectory_shell
mov ecx, esi
call fcn.0040d430
push 0xf003f
push str.SOFTWAREClassesDirectory_shell
push 0x80000002
lea ecx, [esp + 0x1c]
call fcn.00410430
push str.open
lea ecx, [esp + 0x14]
call fcn.00404220
push str.explore
lea ecx, [esp + 0x14]
call fcn.00404220
lea ecx, [esp + 0x10]
call fcn.00404200
push 0xf003f
push str.SOFTWAREClassesDrive_shell
push 0x80000002
lea ecx, [esp + 0x1c]
call fcn.00410430
test eax, eax
je 0x40c340
push 1
push str.MACHINESOFTWAREClassesDrive_shell
mov ecx, esi
call fcn.0040d430
push 0xf003f
push str.SOFTWAREClassesDrive_shell
push 0x80000002
lea ecx, [esp + 0x1c]
call fcn.00410430
push str.open
lea ecx, [esp + 0x14]
call fcn.00404220
push str.explore
lea ecx, [esp + 0x14]
call fcn.00404220
lea ecx, [esp + 0x10]
call fcn.00404200
lea edi, [esi + 0x7c]
push 0x41cef4
push ebp
mov ecx, edi
call fcn.004104d0
push 0x41f478
push 1
push ebp
mov ecx, edi
call sub.MFC42u.DLL_CListCtrl::SetItemText
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.File
call sub.MFC42u.DLL_CString::CString_1
lea eax, [esp + 0x20]
mov ecx, esi
push eax
call fcn.0040e300
mov ecx, eax
call fcn.00407280
push eax
push ebp
push str.FixSB
push str.Other
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntW]
lea ecx, [esp + 0x1c]
mov edi, eax
call sub.MFC42u.DLL_CString::CString
cmp edi, ebp
je 0x40c50a
mov eax, dword [esi + 0x60]
cmp eax, 5
jne 0x40c40e
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.C:FixSB.reg
call sub.MFC42u.DLL_CString::CString_1
push ecx
mov byte [esp + 0x47c], 0x34
mov ecx, esp
mov dword [esp + 0x24], esp
push 0x41e9d8
call sub.MFC42u.DLL_CString::CString_1
mov byte [esp + 0x47c], 0x2f
push 0x92
jmp 0x40c480
push ecx
cmp eax, 4
mov ecx, esp
jne 0x40c44c
mov dword [esp + 0x24], esp
push str.C:FixSB.reg
call sub.MFC42u.DLL_CString::CString_1
push ecx
mov byte [esp + 0x47c], 0x35
mov ecx, esp
mov dword [esp + 0x24], esp
push 0x41e9d8
call sub.MFC42u.DLL_CString::CString_1
mov byte [esp + 0x47c], 0x2f
push 0x91
jmp 0x40c480
mov dword [esp + 0x24], esp
push str.C:FixSB.reg
call sub.MFC42u.DLL_CString::CString_1
push ecx
mov byte [esp + 0x47c], 0x36
mov ecx, esp
mov dword [esp + 0x24], esp
push 0x41e9d8
call sub.MFC42u.DLL_CString::CString_1
mov byte [esp + 0x47c], 0x2f
push 0x90
mov ecx, esi
call fcn.0040dc60
lea edi, [esi + 0x7c]
push 0x41ceb8
push ebp
mov ecx, edi
call fcn.004104d0
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str._import_C:FixSB.reg
call sub.MFC42u.DLL_CString::CString_1
push ecx
mov byte [esp + 0x47c], 0x37
mov ebx, esp
mov dword [esp + 0x24], esp
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str._SystemRoot__system32_reg.exe
call sub.MFC42u.DLL_CString::CString_1
push ebx
mov ecx, esi
call fcn.0040e0f0
mov ecx, esi
mov byte [esp + 0x47c], 0x2f
call fcn.0040e660
cmp eax, ebp
je 0x40c4ea
push 0x41f478
jmp 0x40c4ef
push 0x41b924
push 1
push ebp
mov ecx, edi
call sub.MFC42u.DLL_CListCtrl::SetItemText
push str.C:FixSB.reg
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.File
call sub.MFC42u.DLL_CString::CString_1
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
call fcn.0040e300
mov ecx, eax
call fcn.00407280
push eax
push ebp
push str.StartPage
push str.Other
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntW]
lea ecx, [esp + 0x1c]
mov edi, eax
call sub.MFC42u.DLL_CString::CString
cmp edi, ebp
je 0x40c7e5
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.__ProgramFiles_Internet_Exploreriexplore.exe_
call sub.MFC42u.DLL_CString::CString_1
lea edx, [esp + 0x34]
mov ecx, esi
push edx
call fcn.0040e0f0
push 0xf003f
push str.SoftwareMicrosoftInternet_ExplorerMain
push 0x80000002
lea ecx, [esp + 0x1c]
mov byte [esp + 0x480], 0x38
call fcn.00410430
test eax, eax
je 0x40c5ba
push 1
push str.MACHINESoftwareMicrosoftInternet_ExplorerMain
mov ecx, esi
call fcn.0040d430
push 0xf003f
push str.SoftwareMicrosoftInternet_ExplorerMain
push 0x80000002
lea ecx, [esp + 0x1c]
call fcn.00410430
push str.Start_Page
push str.about:blank
lea ecx, [esp + 0x18]
call fcn.004104a0
push str.Default_Page_URL
push str.about:blank
lea ecx, [esp + 0x18]
call fcn.004104a0
lea ecx, [esp + 0x10]
call fcn.00404200
push 0xf003f
push str.SoftwareMicrosoftInternet_ExplorerMain
push 0x80000001
lea ecx, [esp + 0x1c]
call fcn.00410430
test eax, eax
je 0x40c62b
push 1
push str.CURRENT_USERSoftwareMicrosoftInternet_ExplorerMain
mov ecx, esi
call fcn.0040d430
push 0xf003f
push str.SoftwareMicrosoftInternet_ExplorerMain
push 0x80000001
lea ecx, [esp + 0x1c]
call fcn.00410430
push str.Start_Page
push str.about:blank
lea ecx, [esp + 0x18]
call fcn.004104a0
push str.Default_Page_URL
push str.about:blank
lea ecx, [esp + 0x18]
call fcn.004104a0
lea ecx, [esp + 0x10]
call fcn.00404200
push 0xf003f
push str.SOFTWAREClientsStartMenuInternetIEXPLORE.EXE_shellopencommand
push 0x80000002
lea ecx, [esp + 0x1c]
call fcn.00410430
test eax, eax
je 0x40c69c
push 1
push str.MACHINESOFTWAREClientsStartMenuInternetIEXPLORE.EXE_shellopencommand
mov ecx, esi
call fcn.0040d430
push 0xf003f
push str.SOFTWAREClientsStartMenuInternetIEXPLORE.EXE_shellopencommand
push 0x80000002
lea ecx, [esp + 0x1c]
call fcn.00410430
push 0x41f9bc
lea ecx, [esp + 0x34]
call fcn.00407280
push eax
lea ecx, [esp + 0x18]
call fcn.004104a0
lea ecx, [esp + 0x10]
call fcn.00404200
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x18]
push eax
push 0xf003f
push ebp
push str.SOFTWAREClassesCLSID871C5380_42A0_1069_A2EA_08002B30309D_shellOpenHomePageCommand
push 0x80000002
call edi
test eax, eax
je 0x40c703
push 1
push str.MACHINESOFTWAREClassesCLSID871C5380_42A0_1069_A2EA_08002B30309D_shellOpenHomePageCommand
mov ecx, esi
call fcn.0040d430
lea ecx, [esp + 0x18]
push ecx
push 0xf003f
push ebp
push str.SOFTWAREClassesCLSID871C5380_42A0_1069_A2EA_08002B30309D_shellOpenHomePageCommand
push 0x80000002
call edi
lea ecx, [esp + 0x30]
call fcn.00407280
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
lea edx, [eax + eax + 2]
lea ecx, [esp + 0x30]
push edx
call fcn.00407280
push eax
mov eax, dword [esp + 0x20]
push 2
push ebp
push 0x41f9bc
push eax
call ebx
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x18]
push edx
push 0xf003f
push ebp
push str.SOFTWAREClassesCLSID871C5380_42A0_1069_A2EA_08002B30309D_shellopenCommand
push 0x80000002
call edi
test eax, eax
je 0x40c77c
push 1
push str.MACHINESOFTWAREClassesCLSID871C5380_42A0_1069_A2EA_08002B30309D_shellopenCommand
mov ecx, esi
call fcn.0040d430
lea eax, [esp + 0x18]
push eax
push 0xf003f
push ebp
push str.SOFTWAREClassesCLSID871C5380_42A0_1069_A2EA_08002B30309D_shellopenCommand
push 0x80000002
call edi
lea ecx, [esp + 0x30]
call fcn.00407280
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
lea ecx, [eax + eax + 2]
push ecx
lea ecx, [esp + 0x34]
call fcn.00407280
mov edx, dword [esp + 0x1c]
push eax
push 2
push ebp
push 0x41f9bc
push edx
call ebx
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edi, [esi + 0x7c]
push str.b__rYI
push ebp
mov ecx, edi
call fcn.004104d0
push 0x41f478
push 1
push ebp
mov ecx, edi
call sub.MFC42u.DLL_CListCtrl::SetItemText
lea ecx, [esp + 0x30]
mov byte [esp + 0x474], 0x2f
call sub.MFC42u.DLL_CString::CString
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.File
call sub.MFC42u.DLL_CString::CString_1
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
call fcn.0040e300
mov ecx, eax
call fcn.00407280
push eax
push ebp
push 0x41c890
push str.Other
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntW]
lea ecx, [esp + 0x1c]
mov edi, eax
call sub.MFC42u.DLL_CString::CString
cmp edi, ebp
je 0x40cae2
lea edx, [esp + 0x14]
xor ebx, ebx
push edx
push 0x20019
push ebx
mov ebp, 0x104
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options
push 0x80000002
mov dword [esp + 0x6c], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40caab
mov edx, dword [esp + 0x14]
push 0
push 0
push 0
lea eax, [esp + 0x64]
push 0
lea ecx, [esp + 0x6c]
push eax
push ecx
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
je 0x40caab
lea ecx, [esp + 0x18]
inc ebx
mov dword [esp + 0x58], ebp
mov dword [esp + 0x34], ebp
xor edi, edi
call fcn.00413970
lea ecx, [esp + 0x40]
mov byte [esp + 0x474], 0x39
call fcn.00413970
lea eax, [esp + 0x5c]
lea ecx, [esp + 0x18]
push eax
push 0x41b170
push ecx
mov byte [esp + 0x480], 0x3a
call sub.MFC42u.DLL_CString::Format
add esp, 0xc
lea edx, [esp + 0x18]
lea eax, [esp + 0x1c]
push edx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_
push eax
call sub.MFC42u.DLL_operator_1
push eax
lea ecx, [esp + 0x44]
mov byte [esp + 0x478], 0x3b
call sub.MFC42u.DLL_CString::operator
lea ecx, [esp + 0x1c]
mov byte [esp + 0x474], 0x3a
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x28]
push ecx
push 0x20019
push edi
lea ecx, [esp + 0x4c]
call fcn.00407280
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40ca65
mov ecx, dword [esp + 0x28]
push 0
push 0
push 0
lea edx, [esp + 0x40]
push 0
lea eax, [esp + 0x274]
push edx
push eax
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
je 0x40ca65
lea ecx, [esp + 0x30]
inc edi
mov dword [esp + 0x34], ebp
call fcn.00413970
lea edx, [esp + 0x264]
lea eax, [esp + 0x30]
push edx
push 0x41b170
push eax
mov byte [esp + 0x480], 0x3c
call sub.MFC42u.DLL_CString::Format
add esp, 0xc
lea ecx, [esp + 0x30]
call sub.MFC42u.DLL_CString::MakeUpper
lea ecx, [esp + 0x30]
push str.DEBUGGER
push ecx
call fcn.0040d030
test al, al
jne 0x40c9df
lea ecx, [esp + 0x30]
mov byte [esp + 0x474], 0x3a
call sub.MFC42u.DLL_CString::CString
lea edx, [esp + 0x28]
lea ecx, [esp + 0x40]
push edx
push 0x20019
push 0
call fcn.00407280
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40c928
jmp 0x40ca65
lea eax, [esp + 0x18]
lea ecx, [esp + 0x2c]
push eax
push str.MACHINESOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_
push ecx
call sub.MFC42u.DLL_operator_1
push 1
lea ecx, [esp + 0x30]
mov byte [esp + 0x478], 0x3d
call fcn.00407280
push eax
mov ecx, esi
call fcn.0040d430
push 0xf003f
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options
push 0x80000002
lea ecx, [esp + 0x1c]
call fcn.00410430
lea ecx, [esp + 0x18]
call fcn.00407280
push eax
lea ecx, [esp + 0x14]
call fcn.00404220
lea ecx, [esp + 0x10]
call fcn.00404200
lea ecx, [esp + 0x2c]
dec ebx
mov byte [esp + 0x474], 0x3c
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x30]
mov byte [esp + 0x474], 0x3a
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x40]
mov byte [esp + 0x474], 0x39
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x18]
mov byte [esp + 0x474], 0x2f
call sub.MFC42u.DLL_CString::CString
lea edx, [esp + 0x14]
push edx
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40c85c
mov eax, dword [esp + 0x28]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call edi
mov ecx, dword [esp + 0x14]
push ecx
call edi
lea edi, [esi + 0x7c]
push 0x41c698
push 0
mov ecx, edi
call fcn.004104d0
push 0x41f478
push 1
push 0
mov ecx, edi
call sub.MFC42u.DLL_CListCtrl::SetItemText
xor ebp, ebp
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.File
call sub.MFC42u.DLL_CString::CString_1
lea edx, [esp + 0x20]
mov ecx, esi
push edx
call fcn.0040e300
mov ecx, eax
call fcn.00407280
push eax
push ebp
push str.ResetWinsock
push str.Other
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntW]
lea ecx, [esp + 0x1c]
mov edi, eax
call sub.MFC42u.DLL_CString::CString
cmp edi, ebp
je 0x40cb99
lea edi, [esi + 0x7c]
push 0x41c668
push ebp
mov ecx, edi
call fcn.004104d0
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str._winsock_reset
call sub.MFC42u.DLL_CString::CString_1
push ecx
mov byte [esp + 0x47c], 0x3e
mov ebx, esp
mov dword [esp + 0x24], esp
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str._SystemRoot__system32_netsh.exe
call sub.MFC42u.DLL_CString::CString_1
push ebx
mov ecx, esi
call fcn.0040e0f0
mov ecx, esi
mov byte [esp + 0x47c], 0x2f
call fcn.0040e660
cmp eax, ebp
je 0x40cb8a
push 0x41f478
jmp 0x40cb8f
push 0x41b924
push 1
push ebp
mov ecx, edi
call sub.MFC42u.DLL_CListCtrl::SetItemText
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.File
call sub.MFC42u.DLL_CString::CString_1
lea eax, [esp + 0x20]
mov ecx, esi
push eax
call fcn.0040e300
mov ecx, eax
call fcn.00407280
push eax
push ebp
push str.ResetHosts
push str.Other
call dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntW]
lea ecx, [esp + 0x1c]
mov edi, eax
call sub.MFC42u.DLL_CString::CString
cmp edi, ebp
je 0x40cc7b
lea edi, [esi + 0x7c]
push 0x41c5e0
push ebp
mov ecx, edi
call fcn.004104d0
push 0x80
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str._SystemRoot__system32driversetchosts
call sub.MFC42u.DLL_CString::CString_1
lea ecx, [esp + 0x24]
push ecx
mov ecx, esi
call fcn.0040e0f0
mov ecx, eax
call fcn.00407280
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
lea ecx, [esp + 0x1c]
call sub.MFC42u.DLL_CString::CString
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str._SystemRoot__system32driversetchosts
call sub.MFC42u.DLL_CString::CString_1
lea edx, [esp + 0x20]
mov ecx, esi
push edx
call fcn.0040e0f0
mov ecx, eax
call fcn.00407280
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
lea ecx, [esp + 0x1c]
mov ebx, eax
call sub.MFC42u.DLL_CString::CString
cmp ebx, ebp
je 0x40cc6c
push 0x41f478
jmp 0x40cc71
push 0x41b924
push 1
push ebp
mov ecx, edi
call sub.MFC42u.DLL_CListCtrl::SetItemText
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.File
call sub.MFC42u.DLL_CString::CString_1
lea eax, [esp + 0x20]
mov ecx, esi
push eax
call fcn.0040e300
mov ecx, eax
call fcn.00407280
mov ebx, dword [sym.imp.KERNEL32.DLL_GetPrivateProfileIntW]
push eax
push ebp
push str.AntiAutorun
push str.Other
call ebx
lea ecx, [esp + 0x1c]
mov edi, eax
call sub.MFC42u.DLL_CString::CString
cmp edi, ebp
je 0x40ce41
push 0xf003f
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push 0x80000001
lea ecx, [esp + 0x1c]
call fcn.00410430
test eax, eax
je 0x40cd08
push 1
push str.CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
mov ecx, esi
call fcn.0040d430
push 0xf003f
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push 0x80000001
lea ecx, [esp + 0x1c]
call fcn.00410430
push str.NoDriveTypeAutoRun
push 0xff
lea ecx, [esp + 0x18]
call fcn.00410480
lea ecx, [esp + 0x10]
call fcn.00404200
push 0xf003f
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push 0x80000002
lea ecx, [esp + 0x1c]
call fcn.00410430
test eax, eax
je 0x40cd66
push 1
push str.MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
mov ecx, esi
call fcn.0040d430
push 0xf003f
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push 0x80000002
lea ecx, [esp + 0x1c]
call fcn.00410430
push str.NoDriveTypeAutoRun
push 0xff
lea ecx, [esp + 0x18]
call fcn.00410480
lea ecx, [esp + 0x10]
call fcn.00404200
mov eax, dword [esi + 0x60]
push 0xf003f
cmp eax, 1
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer
push 0x80000001
lea ecx, [esp + 0x1c]
je 0x40cddd
call fcn.00410430
push str.MountPoints2
lea ecx, [esp + 0x14]
call fcn.00404220
push ebp
push ebp
push 0xf003f
push ebp
push ebp
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerMountPoints2
push 0x80000001
lea ecx, [esp + 0x2c]
call fcn.004103c0
lea ecx, [esp + 0x10]
call fcn.00404200
push ebp
push str.CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerMountPoints2
jmp 0x40ce1b
call fcn.00410430
push str.MountPoints
lea ecx, [esp + 0x14]
call fcn.00404220
push ebp
push ebp
push 0xf003f
push ebp
push ebp
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerMountPoints
push 0x80000001
lea ecx, [esp + 0x2c]
call fcn.004103c0
lea ecx, [esp + 0x10]
call fcn.00404200
push ebp
push str.CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerMountPoints
mov ecx, esi
call fcn.0040d430
lea edi, [esi + 0x7c]
push 0x41c0dc
push ebp
mov ecx, edi
call fcn.004104d0
push 0x41f478
push 1
push ebp
mov ecx, edi
call sub.MFC42u.DLL_CListCtrl::SetItemText
push ecx
mov ecx, esp
mov dword [esp + 0x24], esp
push str.File
call sub.MFC42u.DLL_CString::CString_1
lea ecx, [esp + 0x20]
push ecx
mov ecx, esi
call fcn.0040e300
mov ecx, eax
call fcn.00407280
push eax
push ebp
push str.ExtReg
push str.Other
call ebx
lea ecx, [esp + 0x1c]
mov edi, eax
call sub.MFC42u.DLL_CString::CString
cmp edi, ebp
je 0x40cf79
lea edi, [esi + 0x7c]
push 0x41c0b8
push ebp
mov ecx, edi
call fcn.004104d0
push str.LA.REG_
push ecx
mov ecx, esp
mov dword [esp + 0x28], esp
push str.Folder
call sub.MFC42u.DLL_CString::CString_1
lea edx, [esp + 0x3c]
mov ecx, esi
push edx
call fcn.0040e300
push eax
lea eax, [esp + 0x24]
push str._import__
push eax
mov byte [esp + 0x484], 0x3f
call sub.MFC42u.DLL_operator_1
lea ecx, [esp + 0x30]
push eax
push ecx
mov byte [esp + 0x480], 0x40
call sub.MFC42u.DLL_operator
lea ecx, [esp + 0x1c]
mov byte [esp + 0x474], 0x43
call sub.MFC42u.DLL_CString::CString
mov bl, 0x42
lea ecx, [esp + 0x34]
mov byte [esp + 0x474], bl
call sub.MFC42u.DLL_CString::CString
push ecx
lea edx, [esp + 0x30]
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
call fcn.00413b2c
push ecx
mov byte [esp + 0x47c], 0x44
mov ebp, esp
mov dword [esp + 0x60], esp
push ecx
mov ecx, esp
mov dword [esp + 0x64], esp
push str._SystemRoot__system32_reg.exe
call sub.MFC42u.DLL_CString::CString_1
push ebp
mov ecx, esi
call fcn.0040e0f0
mov ecx, esi
mov byte [esp + 0x47c], bl
call fcn.0040e660
test eax, eax
je 0x40cf58
push 0x41f478
jmp 0x40cf5d
push 0x41b924
push 1
push 0
mov ecx, edi
call sub.MFC42u.DLL_CListCtrl::SetItemText
lea ecx, [esp + 0x2c]
mov byte [esp + 0x474], 0x2f
call sub.MFC42u.DLL_CString::CString
mov ecx, esi
call fcn.0040d670
lea ecx, [esp + 0x10]
mov byte [esp + 0x474], 0x2a
call fcn.004041e0
lea ecx, [esp + 0x44]
mov byte [esp + 0x474], 0x25
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x50]
mov byte [esp + 0x474], 0x1a
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x38]
mov byte [esp + 0x474], 0xf
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x4c]
mov byte [esp + 0x474], 0xa
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x54]
mov byte [esp + 0x474], 5
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x48]
mov byte [esp + 0x474], 0
call sub.MFC42u.DLL_CString::CString
lea ecx, [esp + 0x3c]
mov dword [esp + 0x474], 0xffffffff
call sub.MFC42u.DLL_CString::CString
mov ecx, dword [esp + 0x46c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x468
ret