Function at 0x410313
Capabilities:
Delete registry value
Persist via run registry key
Query or enumerate registry value

Disassembly:
mov eax, 0x445e1f
call fcn.004312c8
sub esp, 0x524
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
xor edi, edi
mov ebx, 0x449504
mov esi, 0x4494fc
cmp eax, edi
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x38], esi
jne 0x410344
mov eax, 0x45d464
lea ecx, [ebp - 0x1d]
push edi
push ecx
push eax
lea ecx, [ebp - 0x58]
call fcn.00403912
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], edi
movzx eax, word [eax]
add eax, 0xffffffbf
cmp eax, 0x39
ja case.0x410367.71
jmp dword [eax*4 + 0x41111b]
push 0x456d14
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x410396
push edi
push edi
mov dword [0x4623dc], 1
push str._auto
jmp 0x4110dc
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], edi
je 0x4103aa
push eax
call fcn.0040fba8
pop ecx
jmp 0x4104dd
mov ecx, dword [ebp + 8]
push edi
push edi
push 0x456d00
mov dword [ecx + 0x14], 1
call fcn.00427172
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_CharNextW]
cmp eax, edi
mov dword [ebp - 0x1e8], ebx
mov dword [ebp - 0x1c8], esi
jne 0x4103de
mov eax, 0x45d464
lea ecx, [ebp - 0x22]
push edi
push ecx
push eax
lea ecx, [ebp - 0x1e8]
call fcn.00403912
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x1e8]
push edi
push eax
push 0x10
mov byte [ebp - 4], 1
call fcn.00407ad8
and byte [ebp - 4], 0
lea ecx, [ebp - 0x1e8]
jmp 0x410d9c
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_CharNextW]
cmp eax, edi
mov dword [ebp - 0xf8], ebx
mov dword [ebp - 0xd8], esi
jne 0x410432
mov eax, 0x45d464
lea ecx, [ebp - 0x24]
push edi
push ecx
push eax
lea ecx, [ebp - 0xf8]
call fcn.00403912
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0xf8]
push edi
push eax
push 0xd
mov byte [ebp - 4], 2
call fcn.00407ad8
and byte [ebp - 4], 0
lea ecx, [ebp - 0xf8]
jmp 0x410d9c
mov esi, dword [ebp + 8]
push 1
pop edi
mov ecx, esi
push edi
call fcn.00424b2e
mov dword [esi + 0x4c], edi
jmp 0x4110e4
mov eax, str.debuglog
mov dword [ebp - 0x238], ebx
mov ecx, eax
mov dword [ebp - 0x218], esi
test ecx, ecx
jne 0x41049a
mov eax, 0x45d464
lea ecx, [ebp - 0x17]
push edi
push ecx
push eax
lea ecx, [ebp - 0x238]
call fcn.00403912
lea eax, [ebp - 0x238]
push edi
push eax
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 3
call fcn.00404602
mov ebx, eax
lea ecx, [ebp - 0x238]
neg ebx
sbb bl, bl
and byte [ebp - 4], 0
inc bl
call fcn.00401cce
test bl, bl
push 1
je 0x4104f0
pop edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.00401cce
mov eax, edi
jmp 0x41110c
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_CharNextW]
push eax
push 0x456ce4
jmp 0x4110dc
mov eax, 0x456cd4
mov dword [ebp - 0x2d8], ebx
mov ecx, eax
mov dword [ebp - 0x2b8], esi
test ecx, ecx
jne 0x410520
mov eax, 0x45d464
lea ecx, [ebp - 0x1f]
push edi
push ecx
push eax
lea ecx, [ebp - 0x2d8]
call fcn.00403912
lea eax, [ebp - 0x2d8]
push edi
push eax
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 4
call fcn.00404602
test eax, eax
jne 0x4105a2
mov eax, 0x456cd0
mov dword [ebp - 0x148], ebx
mov ecx, eax
mov dword [ebp - 0x128], esi
test ecx, ecx
jne 0x410565
mov eax, 0x45d464
lea ecx, [ebp - 0x19]
push edi
push ecx
push eax
lea ecx, [ebp - 0x148]
call fcn.00403912
lea eax, [ebp - 0x148]
lea ecx, [ebp - 0x58]
push eax
mov byte [ebp - 4], 5
call fcn.00411355
lea ecx, [ebp - 0x148]
mov bl, al
mov byte [ebp - 4], 4
call fcn.00401cce
test bl, bl
je 0x4105a2
mov bl, 1
jmp 0x4105a4
xor bl, bl
and byte [ebp - 4], 0
lea ecx, [ebp - 0x2d8]
call fcn.00401cce
test bl, bl
je 0x4105e9
push 0xffffffffffffffff
lea eax, [ebp - 0x328]
push 5
push eax
lea ecx, [ebp - 0x58]
call fcn.0040290a
mov ecx, dword [ebp + 8]
push edi
push eax
push 0x13
mov byte [ebp - 4], 6
call fcn.00407ad8
and byte [ebp - 4], 0
lea ecx, [ebp - 0x328]
jmp 0x410d9c
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_CharNextW]
mov ebx, eax
push str._IS_E_
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x410616
mov esi, 0x461bd8
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x4106b8
mov dword [ebp + 0xc], edi
push 0xf003f
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 7
call fcn.00411218
test eax, eax
jne 0x4107c0
xor edx, edx
mov ecx, 0x81
lea edi, [ebp - 0x52e]
mov word [ebp - 0x530], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x104
push eax
lea eax, [ebp - 0x530]
push eax
lea eax, [ebp - 0x10]
push eax
push edx
push ebx
mov dword [ebp - 0x10], edx
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x530]
mov esi, 0x461bd8
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
je 0x4106aa
push dword [ebp + 0xc]
call edi
mov dword [ebp + 0xc], ebx
and byte [ebp - 4], 0
cmp dword [ebp + 0xc], ebx
je 0x4106b8
push dword [ebp + 0xc]
call edi
push esi
call fcn.0042d208
mov eax, dword [ebp + 8]
mov dword [eax + 0x4c], 1
mov eax, dword [0x4613b0]
test eax, eax
jne 0x4106d6
mov eax, 0x4494dc
push eax
push esi
push 0x45fdc8
call fcn.0042d32b
lea eax, [ebp - 0x23]
push 0
mov ebx, 0x45d464
mov edi, 0x4494c4
mov esi, 0x4494bc
push eax
push ebx
lea ecx, [ebp - 0xa8]
mov dword [ebp - 0xa8], edi
mov dword [ebp - 0x88], esi
call fcn.0040856d
mov eax, dword [str.PackageName]
mov byte [ebp - 4], 8
test eax, eax
mov dword [ebp - 0x288], edi
mov dword [ebp - 0x268], esi
jne 0x41072a
mov eax, ebx
lea ecx, [ebp - 0x1b]
push 0
push ecx
push eax
lea ecx, [ebp - 0x288]
call fcn.0040856d
mov eax, dword [str.Startup]
mov byte [ebp - 4], 9
test eax, eax
mov dword [ebp - 0x198], edi
mov dword [ebp - 0x178], esi
je 0x410757
mov ebx, eax
lea eax, [ebp - 0x21]
push 0
push eax
push ebx
lea ecx, [ebp - 0x198]
call fcn.0040856d
lea eax, [ebp - 0xa8]
mov ecx, dword [ebp + 8]
push eax
lea eax, [ebp - 0x288]
push eax
lea eax, [ebp - 0x198]
push eax
push 6
mov byte [ebp - 4], 0xa
call fcn.00407bf8
lea ecx, [ebp - 0x198]
call fcn.00401929
lea ecx, [ebp - 0x288]
call fcn.00401929
and byte [ebp - 4], 0
lea ecx, [ebp - 0xa8]
call fcn.00401929
mov ecx, dword [ebp + 8]
push 2
call fcn.00424b50
jmp 0x4110e4
push dword [ebp + 8]
call fcn.0040fba8
cmp dword [ebp + 0xc], edi
pop ecx
je 0x4110fe
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 0xc], edi
jmp 0x4110fe
mov ebx, dword [ebp + 0xc]
mov esi, dword [sym.imp.USER32.dll_CharNextW]
push ebx
call esi
movzx eax, word [eax]
sub eax, 0x31
je 0x41083b
dec eax
je 0x410829
dec eax
je 0x41080c
push edi
push ebx
call esi
push eax
push 0x456c64
jmp 0x4110dc
mov edi, dword [ebp + 8]
push ebx
mov byte [edi + 0x270], 1
call esi
push eax
call esi
push eax
mov ecx, edi
call fcn.00424a4e
jmp 0x4110e4
push edi
push ebx
call esi
push eax
call esi
push eax
push 0x456c5c
jmp 0x4110dc
push edi
push ebx
call esi
push eax
call esi
mov esi, dword [ebp + 8]
push eax
push 0x456804
mov ecx, esi
call fcn.00427172
mov dword [esi + 0x54], 1
jmp 0x4110e4
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str.hide_progress
push dword [ebp + 0xc]
call esi
mov edi, dword [ebp + 8]
test eax, eax
jne 0x41087c
mov byte [edi + 0x26a], 1
push str.hide_splash
push dword [ebp + 0xc]
call esi
test eax, eax
jne 0x4110e4
mov byte [edi + 0x26b], 1
jmp 0x4110e4
mov eax, str.instance
mov dword [ebp - 0x300], ebx
mov ecx, eax
mov dword [ebp - 0x2e0], esi
test ecx, ecx
jne 0x4108b6
mov eax, 0x45d464
lea ecx, [ebp - 0x15]
push edi
push ecx
push eax
lea ecx, [ebp - 0x300]
call fcn.00403912
lea eax, [ebp - 0x300]
push edi
push eax
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0xb
call fcn.00404602
mov ebx, eax
lea ecx, [ebp - 0x300]
neg ebx
sbb bl, bl
and byte [ebp - 4], 0
inc bl
call fcn.00401cce
test bl, bl
je 0x4110e4
mov eax, dword [ebp + 8]
push 0xfffffffffffffffd
pop edi
lea ecx, [ebp - 0x58]
lea esi, [eax + 0x26c]
push 0xffffffffffffffff
lea eax, [ebp - 0xd0]
push 9
push eax
mov dword [esi], edi
call fcn.0040290a
lea eax, [ebp - 0xd0]
lea ecx, [ebp - 0xcc]
neg eax
sbb eax, eax
push str.default
and eax, ecx
mov byte [ebp - 4], 0xc
push eax
call fcn.00411486
pop ecx
test al, al
pop ecx
je 0x410947
or dword [esi], 0xffffffff
jmp 0x41095b
push 0xa
push esi
lea ecx, [ebp - 0xd0]
call fcn.0041130c
test al, al
jne 0x41095b
mov dword [esi], edi
and byte [ebp - 4], 0
lea ecx, [ebp - 0xd0]
jmp 0x410d9c
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], edi
jne case.0x410367.71
push dword [ebp + 0xc]
mov dword [eax + 0x14], 3
call dword [sym.imp.USER32.dll_CharNextW]
cmp eax, edi
mov dword [ebp + 0xc], eax
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x100], esi
jne 0x41099e
mov eax, 0x45d464
lea ecx, [ebp - 0x25]
push edi
push ecx
push eax
lea ecx, [ebp - 0x120]
call fcn.00403912
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x120]
push edi
push eax
push 9
mov byte [ebp - 4], 0xd
call fcn.00407ad8
and byte [ebp - 4], 0
lea ecx, [ebp - 0x120]
call fcn.00401cce
push edi
push dword [ebp + 0xc]
push 0x456bfc
jmp 0x4110dc
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push esi
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x14], edi
call dword [sym.imp.USER32.dll_CharNextW]
push eax
call fcn.004114a9
add esp, 0xc
test eax, eax
je 0x410a13
mov eax, dword [ebp - 0x14]
mov dword [esi + 0x50], eax
mov dword [0x4609f0], eax
jmp 0x4110e4
push esi
jmp 0x4110f8
push dword [ebp + 0xc]
mov esi, dword [sym.imp.USER32.dll_CharNextW]
call esi
movzx ecx, word [eax]
sub ecx, 0x31
je 0x410a48
dec ecx
push edi
push eax
je 0x410a3b
push 0x456bf4
jmp 0x4110dc
call esi
push eax
push 0x456bec
jmp 0x4110dc
push edi
push eax
call esi
push eax
push 0x456be4
jmp 0x4110dc
push str.noscript_uninst
push dword [ebp + 0xc]
call fcn.004322e6
pop ecx
test eax, eax
pop ecx
jne 0x410a76
push edi
push edi
push str._noscript_uninst
jmp 0x4110dc
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_CharNextW]
cmp eax, edi
mov dword [ebp - 0x170], ebx
mov dword [ebp - 0x150], esi
jne 0x410a94
mov eax, 0x45d464
lea ecx, [ebp - 0x16]
push edi
push ecx
push eax
lea ecx, [ebp - 0x170]
call fcn.00403912
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x170]
push edi
push eax
push 6
mov ecx, esi
mov byte [ebp - 4], 0xe
call fcn.00407ad8
and byte [ebp - 4], 0
lea ecx, [ebp - 0x170]
call fcn.00401cce
push 2
mov ecx, esi
call fcn.00424b50
mov dword [esi + 0x4c], 1
jmp 0x4110e4
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_CharNextW]
push eax
push 0x45d4a8
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x4110e4
mov eax, dword [ebp + 8]
mov byte [eax + 0x271], 1
jmp 0x4110e4
mov esi, dword [ebp + 0xc]
push str.removeonly
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x410b29
push edi
push edi
push str._removeonly
jmp 0x4110dc
push str.runas
push esi
call fcn.004322e6
pop ecx
test eax, eax
pop ecx
je 0x4110e4
push str.runfromtemp
push esi
call fcn.004322e6
pop ecx
test eax, eax
pop ecx
je 0x4110e4
push 6
push str.reboot
push esi
call fcn.00431c97
add esp, 0xc
test eax, eax
je 0x4110e4
push str.removeasmajorupgrade
push esi
call fcn.004322e6
pop ecx
test eax, eax
pop ecx
je 0x4110e4
push edi
push edi
push 0x456b08
jmp 0x4110dc
push 0x456b00
push dword [ebp + 0xc]
call fcn.004322e6
pop ecx
test eax, eax
pop ecx
je 0x410bb5
push edi
push edi
mov dword [0x4623e0], 1
push 0x456af8
jmp 0x4110dc
push edi
push edi
push str._SMS
jmp 0x4110dc
mov esi, str.tempdisk1folder
push esi
call fcn.004319bf
pop ecx
push eax
push edi
push esi
lea ecx, [ebp - 0x54]
call fcn.004027c4
cmp eax, edi
je 0x4110e4
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_CharNextW]
mov esi, eax
push str._IS_T_
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x410c09
mov ecx, dword [ebp + 8]
push esi
call fcn.00424a00
jmp 0x410cb1
mov dword [ebp + 0xc], edi
push 0xf003f
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 0xf
call fcn.00411218
test eax, eax
jne 0x410cca
xor ebx, ebx
mov ecx, 0x81
lea edi, [ebp - 0x52e]
mov word [ebp - 0x530], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x104
push eax
lea eax, [ebp - 0x530]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push esi
mov dword [ebp - 0x10], ebx
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x530]
push eax
call fcn.0042d208
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x530]
push eax
call fcn.00424a00
push esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp dword [ebp + 0xc], ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x410ca3
push dword [ebp + 0xc]
call esi
mov dword [ebp + 0xc], ebx
and byte [ebp - 4], 0
cmp dword [ebp + 0xc], ebx
je 0x410cb1
push dword [ebp + 0xc]
call esi
mov ecx, dword [ebp + 8]
push 3
call fcn.00424b50
mov eax, dword [ebp + 8]
mov dword [eax + 0x4c], 1
jmp 0x4110e4
push dword [ebp + 8]
call fcn.0040fba8
cmp dword [ebp + 0xc], edi
pop ecx
je 0x4110fe
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 0xc], edi
jmp 0x4110fe
push dword [ebp + 0xc]
mov edi, dword [sym.imp.USER32.dll_CharNextW]
call edi
movzx eax, word [eax]
cmp eax, 0x41
je 0x410df8
cmp eax, 0x4d
je 0x410da6
cmp eax, 0x57
je 0x410d4c
cmp eax, 0x61
je 0x410df8
cmp eax, 0x6d
je 0x410da6
cmp eax, 0x77
je 0x410d4c
push str.uninst
push dword [ebp + 0xc]
call fcn.004322e6
pop ecx
test eax, eax
pop ecx
jne 0x4110e4
push eax
push eax
push str._uninst
jmp 0x4110dc
push dword [ebp + 0xc]
call edi
push eax
call edi
test eax, eax
mov dword [ebp - 0x1c0], ebx
mov dword [ebp - 0x1a0], esi
jne 0x410d69
mov eax, 0x45d464
lea ecx, [ebp - 0x18]
push 0
push ecx
push eax
lea ecx, [ebp - 0x1c0]
call fcn.00403912
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x1c0]
push 0
push eax
push 0xb
mov byte [ebp - 4], 0x11
call fcn.00407ad8
and byte [ebp - 4], 0
lea ecx, [ebp - 0x1c0]
call fcn.00401cce
jmp 0x4110e4
push dword [ebp + 0xc]
call edi
push eax
call edi
test eax, eax
mov dword [ebp - 0x210], ebx
mov dword [ebp - 0x1f0], esi
jne 0x410dc3
mov eax, 0x45d464
lea ecx, [ebp - 0x1a]
push 0
push ecx
push eax
lea ecx, [ebp - 0x210]
call fcn.00403912
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x210]
push 0
push eax
push 0xc
mov byte [ebp - 4], 0x12
call fcn.00407ad8
and byte [ebp - 4], 0
lea ecx, [ebp - 0x210]
jmp 0x410d9c
push dword [ebp + 0xc]
call edi
push eax
call edi
test eax, eax
mov dword [ebp - 0x260], ebx
mov dword [ebp - 0x240], esi
jne 0x410e15
mov eax, 0x45d464
lea ecx, [ebp - 0x1c]
push 0
push ecx
push eax
lea ecx, [ebp - 0x260]
call fcn.00403912
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x260]
push 0
push eax
push 0xa
mov byte [ebp - 4], 0x10
call fcn.00407ad8
and byte [ebp - 4], 0
lea ecx, [ebp - 0x260]
jmp 0x410d9c
mov dword [ebp - 0x10], edi
push 0xf003f
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x13
call fcn.00411218
test eax, eax
jne 0x410e8e
push str.ISSetup
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp dword [ebp - 0x10], edi
je 0x410e8e
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], edi
push 7
push str.verbose
push dword [ebp + 0xc]
call fcn.00431c97
add esp, 0xc
test eax, eax
je 0x41106a
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_CharNextW]
push 0x456a10
push eax
mov dword [ebp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x410f5c
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 8
push eax
mov eax, dword [ebp + 8]
lea ecx, [eax + 4]
call fcn.00408436
cmp dword [eax + 0xc], edi
mov dword [ebp - 0x14], eax
je 0x410f02
push 0x456a0c
call fcn.004319bf
pop ecx
push eax
mov eax, dword [ebp - 0x14]
push 0x456a0c
lea ecx, [eax + 4]
call fcn.0041022c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x80], ebx
cmp eax, edi
mov dword [ebp - 0x60], esi
jne 0x410f14
mov eax, 0x45d464
lea ecx, [ebp - 0x1e]
push edi
push ecx
push eax
lea ecx, [ebp - 0x80]
call fcn.00403912
push dword [0x44950c]
lea eax, [ebp - 0x80]
neg eax
sbb eax, eax
lea ecx, [ebp - 0x7c]
and eax, ecx
push edi
push eax
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 0x14
lea ecx, [eax + 4]
call fcn.0040e572
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 0x13
call fcn.00401cce
mov esi, dword [ebp + 0xc]
push 1
push esi
jmp 0x411040
push 0xf003f
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x10]
call fcn.00411218
test eax, eax
jne 0x411047
xor edx, edx
mov ecx, 0x81
lea edi, [ebp - 0x52e]
mov word [ebp - 0x530], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x104
push eax
lea eax, [ebp - 0x530]
push eax
lea eax, [ebp - 0x30]
push eax
push edx
push dword [ebp + 0xc]
mov dword [ebp - 0x30], edx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp dword [ebp - 0x10], 0
je 0x410fd8
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x530]
mov dword [ebp - 0x2b0], ebx
test eax, eax
mov dword [ebp - 0x290], esi
lea eax, [ebp - 0x530]
jne 0x410ff9
mov eax, 0x45d464
lea ecx, [ebp - 0x20]
push 0
push ecx
push eax
lea ecx, [ebp - 0x2b0]
call fcn.00403912
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x2b0]
push 0
push eax
push 8
mov byte [ebp - 4], 0x15
call fcn.00407ad8
lea ecx, [ebp - 0x2b0]
mov byte [ebp - 4], 0x13
call fcn.00401cce
lea eax, [ebp - 0x530]
push 1
lea esi, [ebp - 0x530]
push eax
push 0x4563bc
jmp 0x411078
push dword [ebp + 8]
call fcn.0040fba8
cmp dword [ebp - 0x10], edi
pop ecx
je 0x4110fe
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], edi
jmp 0x4110fe
mov eax, dword [ebp + 0xc]
push 1
lea esi, [eax + 0xe]
push esi
push str._verbose
mov ecx, dword [ebp + 8]
call fcn.00427172
test esi, esi
je 0x411097
push esi
push 0x45d570
mov byte [0x45f574], 1
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp dword [ebp - 0x10], 0
je 0x4110e4
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x10], 0
jmp 0x4110e4
mov eax, dword [ebp + 8]
mov dword [eax + 0x3c], 1
jmp 0x4110e4
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], edi
je 0x4110c3
push eax
jmp 0x4110f8
mov dword [eax + 0x14], 4
jmp 0x4110e4
push edi
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_CharNextW]
push eax
push 0x4569f0
mov ecx, dword [ebp + 8]
call fcn.00427172
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.00401cce
push 1
pop eax
jmp 0x41110c
push dword [ebp + 8]
call fcn.0040fba8
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.00401cce
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret