Function at 0x409d3a
Capabilities:
Check os version
Print debug messages
Set current directory

Disassembly:
mov eax, 0x41bf14
call fcn.00418ff0
sub esp, 0x294
mov eax, dword [0x428674]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [sym.imp.MSVCR71.dll__wcsicmp]
xor eax, ebp
push str._StartTP
push ebx
mov dword [ebp - 0x10], eax
mov byte [ebp - 0x295], 0
call esi
test eax, eax
pop ecx
pop ecx
je 0x409d94
push str._debug
push ebx
call dword [sym.imp.MSVCR71.dll_wcscmp]
test eax, eax
pop ecx
pop ecx
je 0x409d94
push 0x41f084
push ebx
call esi
test eax, eax
pop ecx
pop ecx
jne 0x409d9b
mov byte [ebp - 0x295], 1
lea ecx, [ebp - 0x80]
call fcn.0040965e
and dword [ebp - 4], 0
lea eax, [ebp - 0x80]
push eax
call fcn.00409b09
cmp byte [ebp - 0x295], 0
pop ecx
je 0x409dc4
lea eax, [ebp - 0x80]
push eax
call fcn.004096e9
pop ecx
lea eax, [ebp - 0x80]
push eax
call fcn.004098c1
lea eax, [ebp - 0x2c]
push eax
call fcn.0040cded
pop ecx
pop ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP71.dll_public:_wchar_t_const____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::c_str_void_const]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push str._RegServer
push ebx
call esi
test eax, eax
pop ecx
pop ecx
jne 0x409e16
call fcn.00409c59
mov ecx, dword [0x4287e0]
call fcn.004091b4
mov esi, eax
call fcn.00409cd8
jmp 0x409f8d
push str._RegServerEx
push ebx
call esi
test eax, eax
pop ecx
pop ecx
jne 0x409e37
call fcn.00409c59
mov eax, dword [0x4287e0]
mov byte [eax + 0xf0], 0
jmp 0x409dff
push str._UnRegServer
push ebx
call esi
test eax, eax
pop ecx
pop ecx
jne 0x409e57
call fcn.00409c59
mov ecx, dword [0x4287e0]
call fcn.00408e1d
jmp 0x409e0a
push edi
lea ecx, [ebp - 0x2a0]
call fcn.0040360f
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x294]
call fcn.004016bc
mov byte [ebp - 4], 3
and dword [ebp - 0x29c], 0
push str.IsWow64Process
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x409eaa
lea eax, [ebp - 0x29c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
push 0x44
pop ecx
xor eax, eax
lea edi, [ebp - 0x190]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x194]
push eax
mov dword [ebp - 0x194], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x190], 5
pop edi
jne 0x409ee3
cmp dword [ebp - 0x18c], 1
jne 0x409f12
jmp 0x409ef5
cmp dword [ebp - 0x190], 6
jne 0x409f12
cmp dword [ebp - 0x18c], 0
jne 0x409efe
cmp dword [ebp - 0x29c], 0
jmp 0x409f05
cmp dword [ebp - 0x18c], 1
jne 0x409f12
lea ecx, [ebp - 0x294]
call fcn.00401914
push str._StartTP
push ebx
call esi
test eax, eax
pop ecx
pop ecx
je 0x409f51
push str._debug
push ebx
call dword [sym.imp.MSVCR71.dll_wcscmp]
test eax, eax
pop ecx
pop ecx
je 0x409f45
push 0x41f084
push ebx
call esi
test eax, eax
pop ecx
pop ecx
je 0x409f45
or esi, 0xffffffff
jmp 0x409f6f
call fcn.00409a47
mov ecx, eax
call fcn.0040a034
xor esi, esi
call fcn.00409a47
mov ecx, eax
call fcn.0040c2d0
push str.Calling_into_UnInitReplaceProgram_...
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call fcn.004188c0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x294]
call fcn.00401838
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2a0]
call fcn.0040368c
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call dword [sym.imp.MSVCP71.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x80]
call fcn.004096a2
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.00418f69
leave
ret 0x10