Function at 0x14000fa90
Capabilities:
Check for time delay via gettickcount
Delete file
Enumerate files on windows
Get common file path
Query environment variable
Query or enumerate registry value
Set environment variable

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
push rbp
mov eax, 0x118b8
call fcn.14001c210
sub rsp, 0x118b8
mov r13, r8
mov rax, qword [0x140024c20]
mov rbp, rdx
xor rax, rsp
mov r12, rcx
mov qword [rsp + 0x118b0], rax
cmp dword [0x140024c40], 0
jne 0x14000fadd
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x140024c40], eax
mov ecx, 0x104
lea rdx, [rsp + 0x110f8]
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
mov edx, dword [0x140024c40]
test eax, eax
jbe 0x14000fb2e
lea rax, str.ssproiut
lea rcx, [rsp + 0x111fc]
mov qword [rsp + 0x20], rax
lea r8, str._s_s__d.log
mov dword [rsp + 0x28], edx
mov edx, 0x104
lea r9, [rsp + 0x110f8]
call qword [sym.imp.MSVCR100.dll__snprintf]
jmp 0x14000fb6d
mov dword [rsp + 0x20], edx
lea r9, str.ssproiut
mov edx, 0x104
lea rcx, [rsp + 0x111fc]
lea r8, str.c:_temp_s__d.log
call qword [sym.imp.MSVCR100.dll__snprintf]
mov edx, 0x104
lea rcx, [rsp + 0x110f8]
lea r8, str.c:_temp
call qword [sym.imp.MSVCR100.dll__snprintf]
movabs r15, 0
mov eax, 0x140
mov qword [rsp + rax + 0x1173c], r15
mov qword [rsp + rax + 0x11734], r15
mov qword [rsp + rax + 0x1172c], r15
mov qword [rsp + rax + 0x11724], r15
sub rax, 0x20
jne 0x14000fb7c
mov edx, 0x103
lea rcx, [rsp + 0x11300]
lea r8, [0x1400202fc]
lea r9, [rsp + 0x110f8]
lea rax, str.ssproiut
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCR100.dll__snprintf]
lea rcx, [rsp + 0x11300]
lea rdx, [rsp + 0x11744]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbx, rax
cmp rbx, 0xffffffffffffffff
je 0x140010bf8
mov rcx, rbx
lea rdx, [rsp + 0x11744]
mov edi, 1
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x14000fc24
mov rcx, rbx
lea rdx, [rsp + 0x11744]
inc edi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x14000fc0d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp edi, 0x3c
jbe 0x14000fd32
mov eax, 0x140
mov qword [rsp + rax + 0x1173c], r15
mov qword [rsp + rax + 0x11734], r15
mov qword [rsp + rax + 0x1172c], r15
mov qword [rsp + rax + 0x11724], r15
sub rax, 0x20
jne 0x14000fc3b
lea rcx, [rsp + 0x11300]
lea rdx, [rsp + 0x11744]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbx, rax
cmp rbx, 0xffffffffffffffff
je 0x140010bf8
mov edx, 0x103
lea rcx, [rsp + 0x10ce8]
lea r8, str._s_s
lea r9, [rsp + 0x110f8]
lea rsi, [rsp + 0x11770]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.MSVCR100.dll__snprintf]
lea rcx, [rsp + 0x10ce8]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, rbx
lea rdx, [rsp + 0x11744]
dec edi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x14000fd29
cmp edi, 0x3c
jbe 0x14000fd29
mov edx, 0x103
lea rcx, [rsp + 0x10ce8]
lea r8, str._s_s
lea r9, [rsp + 0x110f8]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.MSVCR100.dll__snprintf]
lea rcx, [rsp + 0x10ce8]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, rbx
lea rdx, [rsp + 0x11744]
dec edi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x14000fcd8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
xor esi, esi
lea rdx, [0x14001e89c]
lea rcx, [rsp + 0x111fc]
call qword [sym.imp.MSVCR100.dll_fopen]
mov rbx, rax
test esi, esi
je 0x14000fd77
test rbx, rbx
je 0x14000fd77
mov rcx, rbx
lea rdx, str.Purging_of_old_files__s_s_failed__Error__d
lea r9, str.ssproiut
lea r8, [rsp + 0x110f8]
mov dword [rsp + 0x20], esi
call fcn.140010c10
mov rax, qword [r12 + 0x178]
lea rdx, [rsp + 0x11504]
mov rcx, qword [rax + 8]
test cl, 3
je 0x14000fda3
mov al, byte [rcx]
inc rcx
test al, al
mov byte [rdx], al
je 0x14000fda8
inc rdx
test cl, 3
jne 0x14000fd90
call fcn.1400188b0
mov rax, qword [r12 + 0x178]
lea rdx, [rsp + 0x11404]
mov rcx, qword [rax + 0x18]
test cl, 3
je 0x14000fdd4
mov al, byte [rcx]
inc rcx
test al, al
mov byte [rdx], al
je 0x14000fdd9
inc rdx
test cl, 3
jne 0x14000fdc1
call fcn.1400188b0
mov rcx, rbx
lea rdx, str.ocx_path___s
lea r8, [rsp + 0x11504]
call fcn.140010c10
mov rax, qword [r12 + 0x178]
mov rcx, rbx
lea rdx, str.to_register___s
mov r8, qword [rax + 0x28]
call fcn.140010c10
mov rax, qword [r12 + 0x178]
lea rdx, str.false
mov rcx, qword [rax + 0x28]
call qword [sym.imp.MSVCR100.dll__stricmp]
mov r14d, eax
mov rcx, rbx
lea rdx, str.work_dir___s
lea r8, [rsp + 0x11404]
call fcn.140010c10
mov edx, 0x104
lea rcx, [rsp + 0x1099e]
call qword [sym.imp.MSVCR100.dll__getcwd]
mov r12, rax
lea rcx, [rsp + 0x11404]
call qword [sym.imp.MSVCR100.dll__chdir]
mov rcx, rbx
lea rdx, str.changing_to_work_dir___s
lea r8, [rsp + 0x11404]
call fcn.140010c10
mov rcx, rbx
lea rdx, str.going_to_register_OCX
call fcn.140010c10
mov dword [rsp + 0x11884], 0x7fff
cmp dword [0x140024c40], 0
jne 0x14000fea8
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x140024c40], eax
mov ecx, 0x104
lea rdx, [rsp + 0x10dec]
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
mov edx, dword [0x140024c40]
test eax, eax
jbe 0x14000fef9
lea rax, str.ssproiut
lea rcx, [rsp + 0x10ef0]
mov qword [rsp + 0x20], rax
lea r8, str._s_s__d.log
mov dword [rsp + 0x28], edx
mov edx, 0x104
lea r9, [rsp + 0x10dec]
call qword [sym.imp.MSVCR100.dll__snprintf]
jmp 0x14000ff38
mov dword [rsp + 0x20], edx
lea rcx, [rsp + 0x10ef0]
mov edx, 0x104
lea r8, str.c:_temp_s__d.log
lea r9, str.ssproiut
call qword [sym.imp.MSVCR100.dll__snprintf]
mov edx, 0x104
lea rcx, [rsp + 0x10dec]
lea r8, str.c:_temp
call qword [sym.imp.MSVCR100.dll__snprintf]
mov eax, 0x140
mov qword [rsp + rax + 0x115fc], r15
mov qword [rsp + rax + 0x115f4], r15
mov qword [rsp + rax + 0x115ec], r15
mov qword [rsp + rax + 0x115e4], r15
sub rax, 0x20
jne 0x14000ff3d
mov edx, 0x103
lea rcx, [rsp + 0x10ff4]
lea r8, [0x1400202fc]
lea r9, [rsp + 0x10dec]
lea rax, str.ssproiut
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCR100.dll__snprintf]
lea rcx, [rsp + 0x10ff4]
lea rdx, [rsp + 0x11604]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rdi, rax
cmp rdi, 0xffffffffffffffff
je 0x140010beb
mov rcx, rdi
lea rdx, [rsp + 0x11604]
mov esi, 1
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x14000ffe5
mov rcx, rdi
lea rdx, [rsp + 0x11604]
inc esi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x14000ffce
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp esi, 0x3c
jbe 0x140010105
mov eax, 0x140
mov qword [rsp + rax + 0x115fc], r15
mov qword [rsp + rax + 0x115f4], r15
mov qword [rsp + rax + 0x115ec], r15
mov qword [rsp + rax + 0x115e4], r15
sub rax, 0x20
jne 0x14000fffc
lea rcx, [rsp + 0x10ff4]
lea rdx, [rsp + 0x11604]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rdi, rax
cmp rdi, 0xffffffffffffffff
je 0x140010beb
mov edx, 0x103
lea rcx, [rsp + 0x10be4]
lea r8, str._s_s
lea r9, [rsp + 0x10dec]
lea rax, [rsp + 0x11630]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCR100.dll__snprintf]
lea rcx, [rsp + 0x10be4]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, rdi
lea rdx, [rsp + 0x11604]
dec esi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x1400100fc
lea r15, [rsp + 0x11630]
cmp esi, 0x3c
jbe 0x1400100f2
mov edx, 0x103
lea rcx, [rsp + 0x10be4]
lea r8, str._s_s
lea r9, [rsp + 0x10dec]
mov qword [rsp + 0x20], r15
call qword [sym.imp.MSVCR100.dll__snprintf]
lea rcx, [rsp + 0x10be4]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, rdi
lea rdx, [rsp + 0x11604]
dec esi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1400100a1
movabs r15, 0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
xor esi, esi
lea rdx, [0x14001e89c]
lea rcx, [rsp + 0x10ef0]
call qword [sym.imp.MSVCR100.dll_fopen]
mov rdi, rax
test esi, esi
je 0x14001014a
test rdi, rdi
je 0x14001014a
mov rcx, rdi
lea rdx, str.Purging_of_old_files__s_s_failed__Error__d
lea r9, str.ssproiut
lea r8, [rsp + 0x10dec]
mov dword [rsp + 0x20], esi
call fcn.140010c10
mov rcx, rdi
lea rdx, str.Starting_registration_of_OCX
call fcn.140010c10
xor ecx, ecx
call qword [sym.imp.ole32.dll_OleInitialize]
test eax, eax
jl 0x140010bcf
lea rcx, [rsp + 0x11504]
call qword [sym.imp.orauts.dll_LoadLibraryA]
mov rsi, rax
test rsi, rsi
je 0x140010663
mov rcx, rdi
lea rdx, str.Finding_the_entry_point_for_OCX
mov dword [r13], 1
call fcn.140010c10
test r14d, r14d
lea rax, str.DllRegisterServer
lea rdx, str.DllUnregisterServer
mov rcx, rsi
cmovne rdx, rax
call qword [sym.imp.orauts.dll_GetProcAddress]
mov rsi, rax
test rsi, rsi
je 0x140010647
mov rcx, rdi
lea rdx, str.Call_the_entry_point_for_OCX
call fcn.140010c10
call rsi
test rax, rax
jl 0x14001062b
mov rcx, rdi
lea rdx, str.Successfully_registered_OCX
call fcn.140010c10
xor esi, esi
call qword [sym.imp.ole32.dll_OleUninitialize]
test rdi, rdi
je 0x140010203
mov rcx, rdi
call qword [sym.imp.MSVCR100.dll_fclose]
mov rcx, rbx
lea rdx, str.finish_registering_OCX
call fcn.140010c10
test r12, r12
je 0x140010237
mov rcx, rbx
lea rdx, str.changing_back_to_old_work_dir___s
mov r8, r12
call fcn.140010c10
lea rcx, [rsp + 0x1099e]
call qword [sym.imp.MSVCR100.dll__chdir]
test esi, esi
jne 0x140010277
mov dword [rbp + 0x100], 0
test rbx, rbx
je 0x140010253
mov rcx, rbx
call qword [sym.imp.MSVCR100.dll_fclose]
mov rcx, qword [rsp + 0x118b0]
xor rcx, rsp
call fcn.14001c150
add rsp, 0x118b8
pop rbp
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
xor edi, edi
mov ecx, 0x1100
xor edx, edx
mov r8d, esi
mov r9d, 0x400
lea rax, [rsp + 0x11898]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0
mov dword [rbp + 0x100], 1
mov qword [rsp + 0x11898], rdi
mov dword [rbp + 0x104], esi
mov qword [rsp + 0x30], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov r12, qword [rsp + 0x11898]
test r12, r12
je 0x140010245
cmp dword [0x140024c40], 0
jne 0x1400102e7
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x140024c40], eax
mov ecx, 0x104
lea rsi, [rsp + 0x40]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
mov edx, dword [0x140024c40]
test eax, eax
jbe 0x140010333
lea rax, str.ssproiut
lea rcx, [rsp + 0x144]
mov qword [rsp + 0x20], rax
lea r8, str._s_s__d.log
mov dword [rsp + 0x28], edx
mov edx, 0x104
mov r9, rsi
call qword [sym.imp.MSVCR100.dll__snprintf]
jmp 0x14001036d
mov dword [rsp + 0x20], edx
lea rcx, [rsp + 0x144]
lea r8, str.c:_temp_s__d.log
mov edx, 0x104
lea r9, str.ssproiut
call qword [sym.imp.MSVCR100.dll__snprintf]
lea r8, str.c:_temp
mov rcx, rsi
mov edx, 0x104
call qword [sym.imp.MSVCR100.dll__snprintf]
movabs rax, 0
lea rdi, [rsp + 0x450]
push 0x28
pop rcx
rep stosq qword [rdi], rax
mov edx, 0x103
lea r13, [rsp + 0x34c]
mov rcx, r13
lea r8, [0x1400202fc]
mov r9, rsi
lea rax, str.ssproiut
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCR100.dll__snprintf]
mov rcx, r13
lea rdx, [rsp + 0x450]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rdi, rax
cmp rdi, 0xffffffffffffffff
je 0x14001061d
mov dword [rsp + 0x11890], 1
mov rcx, rdi
lea rdx, [rsp + 0x450]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x14001041a
mov r14d, dword [rsp + 0x11890]
lea r15, [rsp + 0x450]
mov rcx, rdi
mov rdx, r15
inc r14d
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1400103ff
mov dword [rsp + 0x11890], r14d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [rsp + 0x11890], 0x3c
jbe 0x14001052d
movabs rax, 0
lea rdi, [rsp + 0x450]
push 0x28
pop rcx
rep stosq qword [rdi], rax
mov rcx, r13
lea rdx, [rsp + 0x450]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rdi, rax
cmp rdi, 0xffffffffffffffff
je 0x14001061d
lea r15, str._s_s
lea r14, [rsp + 0x248]
mov rcx, r14
mov edx, 0x103
mov r8, r15
mov r9, rsi
lea r13, [rsp + 0x47c]
mov qword [rsp + 0x20], r13
call qword [sym.imp.MSVCR100.dll__snprintf]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
dec dword [rsp + 0x11890]
mov rcx, rdi
lea rdx, [rsp + 0x450]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x140010524
mov qword [rsp + 0x11888], rbx
mov qword [rsp + 0x118a0], rbp
lea rbp, [rsp + 0x450]
mov ebx, dword [rsp + 0x11890]
cmp ebx, 0x3c
jbe 0x140010514
mov rcx, r14
mov edx, 0x103
mov r8, r15
mov r9, rsi
mov qword [rsp + 0x20], r13
call qword [sym.imp.MSVCR100.dll__snprintf]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, rdi
mov rdx, rbp
dec ebx
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1400104db
mov rbx, qword [rsp + 0x11888]
mov rbp, qword [rsp + 0x118a0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
xor r13d, r13d
lea rdx, [0x14001e89c]
lea rcx, [rsp + 0x144]
call qword [sym.imp.MSVCR100.dll_fopen]
mov rdi, rax
test r13d, r13d
je 0x140010570
test rdi, rdi
je 0x140010570
lea rdx, str.Purging_of_old_files__s_s_failed__Error__d
mov rcx, rdi
mov r8, rsi
lea r9, str.ssproiut
mov dword [rsp + 0x20], r13d
call fcn.140010c10
mov rcx, r12
xor eax, eax
movzx edx, byte [rcx + rax]
test edx, edx
je 0x14001058d
movzx edx, byte [rcx + rax + 1]
add rax, 2
test edx, edx
jne 0x140010575
dec rax
mov r13, rax
mov ecx, 1
lea rsi, [r13 + 1]
mov rdx, rsi
call qword [sym.imp.MSVCR100.dll_calloc]
mov qword [rbp + 0x158], rax
test rax, rax
je 0x1400105f0
mov rcx, rax
mov rdx, r12
mov r8, rsi
call qword [sym.imp.MSVCR100.dll_strncpy]
movsxd rax, dword [rbp + 4]
mov qword [rbp + 0x20], rsi
lea rdx, [r13 + rax + 1]
mov dword [rbp + 4], edx
test rdi, rdi
je 0x1400105e5
mov rcx, qword [rsp + 0x11898]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140010245
mov rcx, rdi
call qword [sym.imp.MSVCR100.dll_fclose]
jmp 0x1400105d2
lea rdx, str._s:_d_allocation_of__d_bytes_for_response_failed
lea r8, str.ssproiut.c
mov rcx, rdi
mov r9d, 0x42a
mov qword [rsp + 0x20], rsi
call fcn.140010c10
mov dword [rbp + 0x100], 1
jmp 0x1400105cd
call qword [sym.imp.orauts.dll_GetLastError]
mov r13d, eax
jmp 0x140010530
mov rcx, rdi
lea rdx, str.Unable_to_call_the_entry_point_for_OCX
call fcn.140010c10
call qword [sym.imp.orauts.dll_GetLastError]
mov esi, eax
jmp 0x1400101ef
mov rcx, rdi
lea rdx, str.Missing_entry_point_for_OCX
call fcn.140010c10
call qword [sym.imp.orauts.dll_GetLastError]
mov esi, eax
jmp 0x1400101ef
mov rcx, rdi
lea rdx, str.Library_cannot_be_loaded_for_OCX_with_the_specified_path___s
lea r8, [rsp + 0x11504]
call fcn.140010c10
lea rcx, str.PATH
lea rdx, [rsp + 0x858f]
mov r8d, 0x7ffe
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x140010bb3
mov rcx, rdi
lea rdx, str.Try_to_get_the_system_path_for_OCX
call fcn.140010c10
mov qword [rsp + 0x118a8], 0
xor esi, esi
cmp dword [0x140024c40], 0
jne 0x1400106cf
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x140024c40], eax
mov ecx, 0x104
lea rdx, [rsp + 0x10692]
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
mov edx, dword [0x140024c40]
test eax, eax
jbe 0x140010720
lea rax, str.ssproiut
lea rcx, [rsp + 0x10796]
mov qword [rsp + 0x20], rax
lea r8, str._s_s__d.log
mov dword [rsp + 0x28], edx
mov edx, 0x104
lea r9, [rsp + 0x10692]
call qword [sym.imp.MSVCR100.dll__snprintf]
jmp 0x14001075f
mov dword [rsp + 0x20], edx
lea rcx, [rsp + 0x10796]
mov edx, 0x104
lea r8, str.c:_temp_s__d.log
lea r9, str.ssproiut
call qword [sym.imp.MSVCR100.dll__snprintf]
mov edx, 0x104
lea rcx, [rsp + 0x10692]
lea r8, str.c:_temp
call qword [sym.imp.MSVCR100.dll__snprintf]
mov eax, 0x140
mov qword [rsp + rax + 0x10a9c], r15
mov qword [rsp + rax + 0x10a94], r15
mov qword [rsp + rax + 0x10a8c], r15
mov qword [rsp + rax + 0x10a84], r15
sub rax, 0x20
jne 0x140010764
mov edx, 0x103
lea rcx, [rsp + 0x1089a]
lea r8, [0x1400202fc]
lea r9, [rsp + 0x10692]
lea rax, str.ssproiut
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCR100.dll__snprintf]
lea rcx, [rsp + 0x1089a]
lea rdx, [rsp + 0x10aa4]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rcx, rax
cmp rcx, 0xffffffffffffffff
je 0x140010b24
mov dword [rsp + 0x48], 1
lea rdx, [rsp + 0x10aa4]
mov qword [rsp + 0x40], rcx
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
mov rcx, qword [rsp + 0x40]
test eax, eax
je 0x140010841
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x118a0], rbp
mov rbp, rcx
mov r13d, dword [rsp + 0x48]
mov rcx, rbp
lea rdx, [rsp + 0x10aa4]
inc r13d
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x140010814
mov dword [rsp + 0x48], r13d
mov rcx, rbp
mov rbp, qword [rsp + 0x118a0]
mov r13, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [rsp + 0x48], 0x3c
jbe 0x140010979
mov eax, 0x140
mov qword [rsp + rax + 0x10a9c], r15
mov qword [rsp + rax + 0x10a94], r15
mov qword [rsp + rax + 0x10a8c], r15
mov qword [rsp + rax + 0x10a84], r15
sub rax, 0x20
jne 0x140010857
lea rcx, [rsp + 0x1089a]
lea rdx, [rsp + 0x10aa4]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov r15, rax
cmp r15, 0xffffffffffffffff
je 0x140010b24
mov edx, 0x103
lea rcx, [rsp + 0x1058e]
lea r8, str._s_s
lea r9, [rsp + 0x10692]
lea rax, [rsp + 0x10ad0]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCR100.dll__snprintf]
lea rcx, [rsp + 0x1058e]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
dec dword [rsp + 0x48]
mov rcx, r15
lea rdx, [rsp + 0x10aa4]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x140010970
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x118a0], rbp
lea rbp, [rsp + 0x10ad0]
mov r13d, dword [rsp + 0x48]
cmp r13d, 0x3c
jbe 0x140010963
mov edx, 0x103
lea rcx, [rsp + 0x1058e]
lea r8, str._s_s
lea r9, [rsp + 0x10692]
mov qword [rsp + 0x20], rbp
call qword [sym.imp.MSVCR100.dll__snprintf]
lea rcx, [rsp + 0x1058e]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, r15
lea rdx, [rsp + 0x10aa4]
dec r13d
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x140010910
mov rbp, qword [rsp + 0x118a0]
mov r13, qword [rsp + 0x40]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindClose]
mov dword [rsp + 0x40], 0
lea rdx, [0x14001e89c]
lea rcx, [rsp + 0x10796]
call qword [sym.imp.MSVCR100.dll_fopen]
mov r15, rax
cmp dword [rsp + 0x40], 0
je 0x1400109cb
test r15, r15
je 0x1400109cb
mov eax, dword [rsp + 0x40]
mov rcx, r15
lea rdx, str.Purging_of_old_files__s_s_failed__Error__d
lea r8, [rsp + 0x10692]
lea r9, str.ssproiut
mov dword [rsp + 0x20], eax
call fcn.140010c10
mov rcx, r15
lea rdx, str.Opening_registry_key
call fcn.140010c10
movabs rcx, 0xffffffff80000002
lea rdx, str.SYSTEMCurrentControlSetControlSession_ManagerEnvironment
xor r8d, r8d
mov r9d, 1
lea rax, [rsp + 0x118a8]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140010b97
mov rcx, r15
lea rdx, str.Querying_registry_key
call fcn.140010c10
xor r8d, r8d
lea rdx, str.PATH
mov rcx, qword [rsp + 0x118a8]
xor r9d, r9d
lea rax, [rsp + 0x590]
mov qword [rsp + 0x20], rax
lea r10, [rsp + 0x11884]
mov qword [rsp + 0x28], r10
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [rsp + 0x40], eax
mov rcx, r15
lea rdx, str.result_of_querying_registry_key___d
call fcn.140010c10
cmp dword [rsp + 0x40], 0
jne 0x140010ba6
mov rcx, qword [rsp + 0x118a8]
test rcx, rcx
je 0x140010a84
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r15, r15
je 0x140010a92
mov rcx, r15
call qword [sym.imp.MSVCR100.dll_fclose]
test esi, esi
je 0x140010aaa
mov rcx, rdi
lea rdx, str.Unable_to_get_system_path_for_OCX
call fcn.140010c10
jmp 0x1400101ef
mov rcx, rdi
lea rdx, str.Try_to_set_the_new_path_for_OCX
call fcn.140010c10
lea rcx, str.PATH
lea rdx, [rsp + 0x590]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
test eax, eax
je 0x140010b7b
mov rcx, rdi
lea rdx, str.Try_loading_the_library_again_for_OCX
call fcn.140010c10
lea rcx, [rsp + 0x11504]
call qword [sym.imp.orauts.dll_LoadLibraryA]
mov rsi, rax
test rsi, rsi
je 0x140010b33
mov rcx, rdi
lea rdx, str.Restoring_path_for_OCX
call fcn.140010c10
lea rcx, str.PATH
lea rdx, [rsp + 0x858f]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
jmp 0x140010183
call qword [sym.imp.orauts.dll_GetLastError]
mov dword [rsp + 0x40], eax
jmp 0x140010981
mov rcx, rdi
lea rdx, str.Library_cannot_be_loaded_for_OCX_with_path___s
lea r8, [rsp + 0x11504]
call fcn.140010c10
call qword [sym.imp.orauts.dll_GetLastError]
mov esi, eax
mov rcx, rdi
lea rdx, str.Restoring_old_path_for_OCX
call fcn.140010c10
lea rcx, str.PATH
lea rdx, [rsp + 0x858f]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
jmp 0x1400101ef
mov rcx, rdi
lea rdx, str.Unable_to_set_the_new_path_for_OCX
call fcn.140010c10
call qword [sym.imp.orauts.dll_GetLastError]
mov esi, eax
jmp 0x1400101ef
mov rcx, r15
lea rdx, str.Unsuccessful_in_opening_registry_key
call fcn.140010c10
call qword [sym.imp.orauts.dll_GetLastError]
mov esi, eax
jmp 0x140010a71
mov rcx, rdi
lea rdx, str.Unable_to_get_the_old_path_for_OCX
call fcn.140010c10
call qword [sym.imp.orauts.dll_GetLastError]
mov esi, eax
jmp 0x1400101ef
mov rcx, rdi
lea rdx, str.Unsuccessful_in_initialization_for_OCX
call fcn.140010c10
call qword [sym.imp.orauts.dll_GetLastError]
mov esi, eax
jmp 0x140010203
call qword [sym.imp.orauts.dll_GetLastError]
mov esi, eax
jmp 0x140010107
call qword [sym.imp.orauts.dll_GetLastError]
mov esi, eax
jmp 0x14000fd34