Function at 0x40aa70
Capabilities:
Connect to wmi namespace via wbemlocator
Get common file path
Get disk information
Get mac address on windows
Query or enumerate registry value
Reference wmi statements
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c09d1
mov eax, dword fs:[0]
push eax
sub esp, 0x6e0
mov eax, dword [0x4f6414]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x6e0], esi
push 0x200
push 0
push esi
call fcn.00465ca0
push 0x200
lea edi, [esi + 0x200]
push 0
push edi
mov dword [ebp - 0x694], edi
call fcn.00465ca0
push 0x200
lea eax, [esi + 0x400]
push 0
push eax
call fcn.00465ca0
push 0x200
lea ebx, [esi + 0x600]
push 0
push ebx
call fcn.00465ca0
push 0x200
lea eax, [esi + 0x800]
push 0
push eax
call fcn.00465ca0
push 0x200
lea eax, [esi + 0xa00]
push 0
push eax
call fcn.00465ca0
add esp, 0x48
add esi, 0xc00
push 0x200
push 0
push esi
call fcn.00465ca0
mov eax, dword [ebp - 0x6e0]
push 0x200
add eax, 0xe00
push 0
push eax
call fcn.00465ca0
mov eax, dword [ebp - 0x6e0]
push 0x200
add eax, 0x1000
push 0
push eax
call fcn.00465ca0
mov eax, dword [ebp - 0x6e0]
push 0x200
add eax, 0x1200
push 0
push eax
mov dword [ebp - 0x6bc], eax
call fcn.00465ca0
mov eax, dword [ebp - 0x6e0]
push 0x200
add eax, 0x1400
push 0
push eax
mov dword [ebp - 0x6ec], eax
call fcn.00465ca0
mov eax, dword [ebp - 0x6e0]
push 0x200
add eax, 0x1600
push 0
push eax
call fcn.00465ca0
add esp, 0x48
push 0
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
push 0
push 0
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
js 0x40b3ad
lea eax, [ebp - 0x6d4]
mov dword [ebp - 0x6d4], 0
push eax
push 0x4d5e78
push 1
push 0
push 0x4d5f48
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x40b3ad
mov eax, dword [ebp - 0x6d4]
lea edx, [ebp - 0x690]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [ebp - 0x690], 0
mov ecx, dword [eax]
push str.ROOTCIMV2
push eax
call dword [ecx + 0xc]
test eax, eax
js 0x40b3a1
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [ebp - 0x690]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
js 0x40b395
mov eax, dword [ebp - 0x690]
lea edx, [ebp - 0x6c8]
push edx
push 0
push 0x30
push str.SELECT__FROM_Win32_ComputerSystemProduct
mov dword [ebp - 0x6c8], 0
mov ecx, dword [eax]
push 0x4e8e4c
push eax
call dword [ecx + 0x50]
test eax, eax
js 0x40ad90
mov eax, dword [ebp - 0x6c8]
lea edx, [ebp - 0x6b4]
push edx
lea edx, [ebp - 0x6cc]
mov dword [ebp - 0x6b4], 0
push edx
push 1
mov dword [ebp - 0x6cc], 0
mov ecx, dword [eax]
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x40ad7c
cmp dword [ebp - 0x6b4], 0
jbe 0x40ad7c
xor eax, eax
lea edx, [ebp - 0x6a8]
push 0
push 0
mov word [ebp - 0x6a8], ax
xorps xmm0, xmm0
mov dword [ebp - 0x69e], eax
mov word [ebp - 0x69a], ax
mov eax, dword [ebp - 0x6cc]
push edx
push 0
movq qword [ebp - 0x6a6], xmm0
mov ecx, dword [eax]
push str.UUID
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x40ad5c
push 0x100
push dword [ebp - 0x6a0]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpynW]
call ebx
lea eax, [ebp - 0x6a8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp - 0x6cc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x6c8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x40ad96
mov eax, dword [ebp - 0x6cc]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpynW]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x6c8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x40ad96
mov eax, dword [ebp - 0x6c8]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpynW]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x40ad96
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov eax, dword [ebp - 0x690]
lea edx, [ebp - 0x6c8]
push edx
push 0
push 0x30
mov ecx, dword [eax]
push str.SELECT__FROM_Win32_ComputerSystemProduct
push 0x4e8e4c
push eax
call dword [ecx + 0x50]
test eax, eax
js 0x40ae7f
mov eax, dword [ebp - 0x6c8]
lea edx, [ebp - 0x6b4]
push edx
lea edx, [ebp - 0x6cc]
mov dword [ebp - 0x6b4], 0
push edx
push 1
mov dword [ebp - 0x6cc], 0
mov ecx, dword [eax]
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x40ae73
cmp dword [ebp - 0x6b4], 0
jbe 0x40ae73
xor eax, eax
lea edx, [ebp - 0x6a8]
push 0
push 0
mov word [ebp - 0x6a8], ax
xorps xmm0, xmm0
mov dword [ebp - 0x69e], eax
mov word [ebp - 0x69a], ax
mov eax, dword [ebp - 0x6cc]
push edx
push 0
movq qword [ebp - 0x6a6], xmm0
mov ecx, dword [eax]
push str.Name
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x40ae67
mov eax, dword [ebp - 0x6e0]
push 0x100
push dword [ebp - 0x6a0]
add eax, 0x800
push eax
call ebx
lea eax, [ebp - 0x6a8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp - 0x6cc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x6c8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x690]
lea edx, [ebp - 0x6c8]
push edx
push 0
push 0x30
mov ecx, dword [eax]
push str.SELECT__FROM_Win32_OperatingSystem
push 0x4e8e4c
push eax
call dword [ecx + 0x50]
test eax, eax
js 0x40af68
mov eax, dword [ebp - 0x6c8]
lea edx, [ebp - 0x6b4]
push edx
lea edx, [ebp - 0x6cc]
mov dword [ebp - 0x6b4], 0
push edx
push 1
mov dword [ebp - 0x6cc], 0
mov ecx, dword [eax]
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x40af5c
cmp dword [ebp - 0x6b4], 0
jbe 0x40af5c
xor eax, eax
lea edx, [ebp - 0x6a8]
push 0
push 0
mov word [ebp - 0x6a8], ax
xorps xmm0, xmm0
mov dword [ebp - 0x69e], eax
mov word [ebp - 0x69a], ax
mov eax, dword [ebp - 0x6cc]
push edx
push 0
movq qword [ebp - 0x6a6], xmm0
mov ecx, dword [eax]
push str.SerialNumber
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x40af50
mov eax, dword [ebp - 0x6e0]
push 0x100
push dword [ebp - 0x6a0]
add eax, 0xa00
push eax
call ebx
lea eax, [ebp - 0x6a8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp - 0x6cc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x6c8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x690]
lea edx, [ebp - 0x6c8]
push edx
push 0
push 0x30
mov ecx, dword [eax]
push str.SELECT__FROM_Win32_OperatingSystem
push 0x4e8e4c
push eax
call dword [ecx + 0x50]
test eax, eax
js 0x40b06c
mov eax, dword [ebp - 0x6c8]
lea edx, [ebp - 0x6b4]
push edx
lea edx, [ebp - 0x6cc]
mov dword [ebp - 0x6b4], 0
push edx
push 1
mov dword [ebp - 0x6cc], 0
mov ecx, dword [eax]
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x40b060
cmp dword [ebp - 0x6b4], 0
jbe 0x40b060
xor eax, eax
lea edx, [ebp - 0x6a8]
push 0
push 0
mov word [ebp - 0x6a8], ax
xorps xmm0, xmm0
mov dword [ebp - 0x69e], eax
mov word [ebp - 0x69a], ax
mov eax, dword [ebp - 0x6cc]
push edx
push 0
movq qword [ebp - 0x6a6], xmm0
mov ecx, dword [eax]
push 0x4e8ed4
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x40b054
push 0x100
push dword [ebp - 0x6a0]
push esi
call ebx
cmp word [esi], 0
je 0x40b047
mov eax, esi
cmp word [esi], 0x2e
jne 0x40b03c
xor ecx, ecx
mov word [esi], cx
add eax, 2
mov esi, eax
cmp word [eax], 0
jne 0x40b031
lea eax, [ebp - 0x6a8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp - 0x6cc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x6c8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x690]
lea edx, [ebp - 0x6c8]
push edx
push 0
push 0x30
mov ecx, dword [eax]
push str.SELECT__FROM_Win32_BIOS
push 0x4e8e4c
push eax
call dword [ecx + 0x50]
test eax, eax
js 0x40b155
mov eax, dword [ebp - 0x6c8]
lea edx, [ebp - 0x6b4]
push edx
lea edx, [ebp - 0x6cc]
mov dword [ebp - 0x6b4], 0
push edx
push 1
mov dword [ebp - 0x6cc], 0
mov ecx, dword [eax]
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x40b149
cmp dword [ebp - 0x6b4], 0
jbe 0x40b149
xor eax, eax
lea edx, [ebp - 0x6a8]
push 0
push 0
mov word [ebp - 0x6a8], ax
xorps xmm0, xmm0
mov dword [ebp - 0x69e], eax
mov word [ebp - 0x69a], ax
mov eax, dword [ebp - 0x6cc]
push edx
push 0
movq qword [ebp - 0x6a6], xmm0
mov ecx, dword [eax]
push str.SerialNumber
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x40b13d
mov eax, dword [ebp - 0x6e0]
push 0x100
push dword [ebp - 0x6a0]
add eax, 0xe00
push eax
call ebx
lea eax, [ebp - 0x6a8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp - 0x6cc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x6c8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x690]
lea edx, [ebp - 0x6c8]
push edx
push 0
push 0x30
mov ecx, dword [eax]
push str.SELECT__FROM_Win32_BIOS
push 0x4e8e4c
push eax
call dword [ecx + 0x50]
test eax, eax
js 0x40b23e
mov eax, dword [ebp - 0x6c8]
lea edx, [ebp - 0x6b4]
push edx
lea edx, [ebp - 0x6cc]
mov dword [ebp - 0x6b4], 0
push edx
push 1
mov dword [ebp - 0x6cc], 0
mov ecx, dword [eax]
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x40b232
cmp dword [ebp - 0x6b4], 0
jbe 0x40b232
xor eax, eax
lea edx, [ebp - 0x6a8]
push 0
push 0
mov word [ebp - 0x6a8], ax
xorps xmm0, xmm0
mov dword [ebp - 0x69e], eax
mov word [ebp - 0x69a], ax
mov eax, dword [ebp - 0x6cc]
push edx
push 0
movq qword [ebp - 0x6a6], xmm0
mov ecx, dword [eax]
push str.SMBIOSBIOSVersion
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x40b226
mov eax, dword [ebp - 0x6e0]
push 0x100
push dword [ebp - 0x6a0]
add eax, 0x1000
push eax
call ebx
lea eax, [ebp - 0x6a8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp - 0x6cc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x6c8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x690]
lea edx, [ebp - 0x6c8]
push edx
push 0
push 0x30
mov ecx, dword [eax]
push str.SELECT__FROM_Win32_DiskDrive
push 0x4e8e4c
push eax
call dword [ecx + 0x50]
test eax, eax
js 0x40b395
mov eax, dword [ebp - 0x6c8]
lea edx, [ebp - 0x6b4]
push edx
lea edx, [ebp - 0x6cc]
mov dword [ebp - 0x6b4], 0
push edx
push 1
mov dword [ebp - 0x6cc], 0
mov ecx, dword [eax]
push 0xffffffffffffffff
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x40b389
cmp dword [ebp - 0x6b4], 0
jbe 0x40b389
xor eax, eax
lea edx, [ebp - 0x6a8]
push 0
push 0
mov word [ebp - 0x6a8], ax
xorps xmm0, xmm0
mov dword [ebp - 0x69e], eax
mov word [ebp - 0x69a], ax
mov eax, dword [ebp - 0x6cc]
push edx
push 0
movq qword [ebp - 0x6a6], xmm0
mov ecx, dword [eax]
push str.SerialNumber
push eax
call dword [ecx + 0x10]
test eax, eax
js 0x40b37d
push 0x208
lea eax, [ebp - 0x27c]
push 0
push eax
call fcn.00465ca0
add esp, 0xc
lea eax, [ebp - 0x27c]
push 0x100
push dword [ebp - 0x6a0]
push eax
call ebx
xor edi, edi
lea esi, [ebp - 0x27c]
movzx eax, word [esi]
push eax
call fcn.0046f9a8
add esp, 4
test eax, eax
je 0x40b34b
inc edi
add esi, 2
cmp edi, 0x208
jb 0x40b327
mov edi, dword [ebp - 0x694]
jmp 0x40b370
lea eax, [edi + edi]
mov edi, dword [ebp - 0x694]
mov ecx, edi
sub ecx, eax
lea eax, [ebp - 0x27c]
sub ecx, eax
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x40b360
lea eax, [ebp - 0x6a8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp - 0x6cc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x6c8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x690]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x6d4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov dword [ebp - 0x6e8], 0
mov dword [ebp - 0x6e4], 0
mov eax, 1
xor edx, edx
cpuid
mov dword [ebp - 0x6e8], edx
mov dword [ebp - 0x6e4], eax
push dword [ebp - 0x6e4]
push dword [ebp - 0x6e8]
push str._08X_08X
push dword [ebp - 0x6e0]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
call fcn.0040a990
add esp, 4
test al, al
je 0x40b418
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40b407
sub ecx, edx
sar ecx, 1
jne 0x40b46d
push 0x200
push 0
push edi
call fcn.00465ca0
add esp, 0xc
xor esi, esi
nop word [eax + eax]
push 0x200
lea eax, [ebp - 0x274]
push 0
push eax
call fcn.00465ca0
add esp, 0xc
lea edx, [ebp - 0x274]
mov ecx, esi
call fcn.0040a6d0
test eax, eax
jne 0x40b45f
inc esi
cmp esi, 0xa
jl 0x40b430
jmp 0x40b46d
lea eax, [ebp - 0x274]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ebx, dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
lea eax, [ebp - 0x6dc]
push eax
push 0
mov byte [ebp - 0x698], 0
mov dword [ebp - 0x697], 0
mov byte [ebp - 0x693], 0
mov dword [ebp - 0x6dc], 0
call ebx
push dword [ebp - 0x6dc]
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x40b501
lea eax, [ebp - 0x6dc]
push eax
push esi
call ebx
test eax, eax
jne 0x40b501
mov ebx, dword [ebp - 0x698]
lea ecx, [esi + 8]
call fcn.0040a840
mov ecx, eax
cmp ecx, 1
je 0x40b4db
test ecx, ecx
jne 0x40b4f9
mov ax, word [esi + 0x198]
mov ebx, dword [esi + 0x194]
mov dword [ebp - 0x698], ebx
mov word [ebp - 0x694], ax
test ecx, ecx
je 0x40b507
mov esi, dword [esi]
test esi, esi
jne 0x40b4c8
jmp 0x40b507
mov ebx, dword [ebp - 0x698]
mov eax, dword [ebp - 0x694]
shr eax, 8
movzx eax, al
push eax
movzx eax, byte [ebp - 0x694]
push eax
mov eax, ebx
shr eax, 0x18
push eax
mov eax, ebx
shr ebx, 8
shr eax, 0x10
movzx eax, al
push eax
movzx eax, bl
push eax
movzx eax, byte [ebp - 0x698]
push eax
mov eax, dword [ebp - 0x6e0]
add eax, 0x400
push str._02X__02X__02X__02X__02X__02X
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x20
mov ecx, edi
call fcn.0040c8b0
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40b560
sub ecx, edx
sar ecx, 1
je 0x40b764
lea eax, [ebp - 0x6b0]
push edi
push eax
call fcn.004022f0
add esp, 8
mov dword [ebp - 4], 0
lea eax, [ebp - 0x6b0]
cmp dword [ebp - 0x69c], 0x10
push dword [ebp - 0x6a0]
cmovae eax, dword [ebp - 0x6b0]
push eax
call fcn.0040f5f0
cmp dword [ebp - 0x69c], 0x10
lea eax, [ebp - 0x690]
mov ebx, dword [ebp - 0x6a0]
lea edi, [ebp - 0x6b0]
cmovae edi, dword [ebp - 0x6b0]
push eax
push str.SoftwareJZipInstall
push reloc.WS2_32.dll_accept
mov dword [ebp - 0x690], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x40b608
push ebx
push edi
push 3
push 0
push 0x4e8fd0
push dword [ebp - 0x690]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x690]
test eax, eax
je 0x40b615
push eax
call esi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x69c]
cmp eax, 0x10
jb 0x40b66c
mov ecx, dword [ebp - 0x6b0]
inc eax
cmp eax, 0x1000
jb 0x40b663
test cl, 0x1f
je 0x40b63f
call fcn.0046e308
mov eax, dword [ecx - 4]
cmp eax, ecx
jb 0x40b64b
call fcn.0046e308
sub ecx, eax
cmp ecx, 4
jae 0x40b657
call fcn.0046e308
cmp ecx, 0x23
jbe 0x40b661
call fcn.0046e308
mov ecx, eax
push ecx
call fcn.0043a731
add esp, 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov edi, dword [ebp - 0x6e0]
mov ecx, edi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40b680
sub ecx, edx
sar ecx, 1
je 0x40b9cd
lea eax, [ebp - 0x6b0]
push edi
push eax
call fcn.004022f0
add esp, 8
mov dword [ebp - 4], 1
lea eax, [ebp - 0x6b0]
cmp dword [ebp - 0x69c], 0x10
push dword [ebp - 0x6a0]
cmovae eax, dword [ebp - 0x6b0]
push eax
call fcn.0040f5f0
cmp dword [ebp - 0x69c], 0x10
lea eax, [ebp - 0x690]
mov ebx, dword [ebp - 0x6a0]
lea edi, [ebp - 0x6b0]
cmovae edi, dword [ebp - 0x6b0]
push eax
push str.SoftwareJZipInstall
push reloc.WS2_32.dll_accept
mov dword [ebp - 0x690], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x40b721
push ebx
push edi
push 3
push eax
push 0x4e8fd4
push dword [ebp - 0x690]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x690]
test eax, eax
je 0x40b72e
push eax
call esi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x69c]
cmp eax, 0x10
jb 0x40b8d5
mov ecx, dword [ebp - 0x6b0]
inc eax
cmp eax, 0x1000
jb 0x40b8cc
test cl, 0x1f
je 0x40b8a8
call fcn.0046e308
push 0x64
lea eax, [ebp - 0x74]
push 0
push eax
call fcn.00465ca0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea eax, [ebp - 0x690]
add esp, 0xc
mov dword [ebp - 0x694], 0x64
mov dword [ebp - 0x690], 0
push eax
push str.SoftwareJZipInstall
push reloc.WS2_32.dll_accept
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x40b7ba
mov eax, dword [ebp - 0x690]
test eax, eax
je 0x40b803
push eax
call esi
jmp 0x40b803
lea eax, [ebp - 0x694]
push eax
lea eax, [ebp - 0x74]
push eax
push 0
push 0
push 0x4e8fd0
push dword [ebp - 0x690]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov eax, dword [ebp - 0x690]
je 0x40b7ed
test eax, eax
je 0x40b803
push eax
call esi
jmp 0x40b803
test eax, eax
je 0x40b7f4
push eax
call esi
push dword [ebp - 0x694]
lea eax, [ebp - 0x74]
push eax
call fcn.0040f5f0
push 0x200
push 0
push edi
call fcn.00465ca0
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x6b0]
push eax
call fcn.00402420
mov ecx, eax
add esp, 0x14
cmp dword [ecx + 0x14], 8
jb 0x40b830
mov ecx, dword [ecx]
nop dword [eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edi], ax
lea edi, [edi + 2]
test ax, ax
jne 0x40b830
mov eax, dword [ebp - 0x69c]
cmp eax, 8
jb 0x40b672
mov ecx, dword [ebp - 0x6b0]
inc eax
cmp eax, 0x7fffffff
jbe 0x40b863
call fcn.0046e308
add eax, eax
cmp eax, 0x1000
jb 0x40b89a
test cl, 0x1f
je 0x40b876
call fcn.0046e308
mov eax, dword [ecx - 4]
cmp eax, ecx
jb 0x40b882
call fcn.0046e308
sub ecx, eax
cmp ecx, 4
jae 0x40b88e
call fcn.0046e308
cmp ecx, 0x23
jbe 0x40b898
call fcn.0046e308
mov ecx, eax
push ecx
call fcn.0043a731
add esp, 4
jmp 0x40b672
mov eax, dword [ecx - 4]
cmp eax, ecx
jb 0x40b8b4
call fcn.0046e308
sub ecx, eax
cmp ecx, 4
jae 0x40b8c0
call fcn.0046e308
cmp ecx, 0x23
jbe 0x40b8ca
call fcn.0046e308
mov ecx, eax
push ecx
call fcn.0043a731
add esp, 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov edi, dword [ebp - 0x6e0]
add edi, 0x400
mov ecx, edi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40b8f0
sub ecx, edx
sar ecx, 1
je 0x40bb2e
lea eax, [ebp - 0x6b0]
push edi
push eax
call fcn.004022f0
add esp, 8
mov dword [ebp - 4], 2
lea eax, [ebp - 0x6b0]
cmp dword [ebp - 0x69c], 0x10
push dword [ebp - 0x6a0]
cmovae eax, dword [ebp - 0x6b0]
push eax
call fcn.0040f5f0
cmp dword [ebp - 0x69c], 0x10
lea eax, [ebp - 0x690]
mov ebx, dword [ebp - 0x6a0]
lea edi, [ebp - 0x6b0]
cmovae edi, dword [ebp - 0x6b0]
push eax
push str.SoftwareJZipInstall
push reloc.WS2_32.dll_accept
mov dword [ebp - 0x690], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x40b991
push ebx
push edi
push 3
push eax
push 0x4e8fd8
push dword [ebp - 0x690]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x690]
test eax, eax
je 0x40b99e
push eax
call esi
mov eax, dword [ebp - 0x69c]
cmp eax, 0x10
jb 0x40bc41
mov ecx, dword [ebp - 0x6b0]
inc eax
cmp eax, 0x1000
jb 0x40bc38
test cl, 0x1f
je 0x40bb08
call fcn.0046e308
push 0x64
lea eax, [ebp - 0x74]
push 0
push eax
call fcn.00465ca0
add esp, 0xc
mov dword [ebp - 0x694], 0x64
lea eax, [ebp - 0x690]
mov dword [ebp - 0x690], 0
push eax
push str.SoftwareJZipInstall
push reloc.WS2_32.dll_accept
call ebx
test eax, eax
je 0x40ba17
mov eax, dword [ebp - 0x690]
test eax, eax
je 0x40ba60
push eax
call esi
jmp 0x40ba60
lea eax, [ebp - 0x694]
push eax
lea eax, [ebp - 0x74]
push eax
push 0
push 0
push 0x4e8fd4
push dword [ebp - 0x690]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov eax, dword [ebp - 0x690]
je 0x40ba4a
test eax, eax
je 0x40ba60
push eax
call esi
jmp 0x40ba60
test eax, eax
je 0x40ba51
push eax
call esi
push dword [ebp - 0x694]
lea eax, [ebp - 0x74]
push eax
call fcn.0040f5f0
push 0x200
push 0
push edi
call fcn.00465ca0
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x6b0]
push eax
call fcn.00402420
mov ecx, eax
add esp, 0x14
cmp dword [ecx + 0x14], 8
jb 0x40ba8a
mov ecx, dword [ecx]
mov edx, edi
nop dword [eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x40ba90
mov eax, dword [ebp - 0x69c]
cmp eax, 8
jb 0x40b8db
mov ecx, dword [ebp - 0x6b0]
inc eax
cmp eax, 0x7fffffff
jbe 0x40bac3
call fcn.0046e308
add eax, eax
cmp eax, 0x1000
jb 0x40bafa
test cl, 0x1f
je 0x40bad6
call fcn.0046e308
mov eax, dword [ecx - 4]
cmp eax, ecx
jb 0x40bae2
call fcn.0046e308
sub ecx, eax
cmp ecx, 4
jae 0x40baee
call fcn.0046e308
cmp ecx, 0x23
jbe 0x40baf8
call fcn.0046e308
mov ecx, eax
push ecx
call fcn.0043a731
add esp, 4
jmp 0x40b8db
mov eax, dword [ecx - 4]
cmp eax, ecx
jb 0x40bb14
call fcn.0046e308
sub ecx, eax
cmp ecx, 4
jae 0x40bb20
call fcn.0046e308
cmp ecx, 0x23
jbe 0x40bc36
call fcn.0046e308
push 0x64
lea eax, [ebp - 0x74]
push 0
push eax
call fcn.00465ca0
add esp, 0xc
mov dword [ebp - 0x694], 0x64
lea eax, [ebp - 0x690]
mov dword [ebp - 0x690], 0
push eax
push str.SoftwareJZipInstall
push reloc.WS2_32.dll_accept
call ebx
test eax, eax
je 0x40bb78
mov eax, dword [ebp - 0x690]
test eax, eax
je 0x40bbc1
push eax
call esi
jmp 0x40bbc1
lea eax, [ebp - 0x694]
push eax
lea eax, [ebp - 0x74]
push eax
push 0
push 0
push 0x4e8fd8
push dword [ebp - 0x690]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov eax, dword [ebp - 0x690]
je 0x40bbab
test eax, eax
je 0x40bbc1
push eax
call esi
jmp 0x40bbc1
test eax, eax
je 0x40bbb2
push eax
call esi
push dword [ebp - 0x694]
lea eax, [ebp - 0x74]
push eax
call fcn.0040f5f0
push 0x200
push 0
push edi
call fcn.00465ca0
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x6b0]
push eax
call fcn.00402420
mov ecx, eax
add esp, 0x14
cmp dword [ecx + 0x14], 8
jb 0x40bbf0
mov ecx, dword [ecx]
nop dword [eax + eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edi], ax
lea edi, [edi + 2]
test ax, ax
jne 0x40bbf0
mov eax, dword [ebp - 0x69c]
cmp eax, 8
jb 0x40bc41
mov ecx, dword [ebp - 0x6b0]
inc eax
cmp eax, 0x7fffffff
jbe 0x40bc1f
call fcn.0046e308
add eax, eax
cmp eax, 0x1000
jb 0x40bc38
test cl, 0x1f
je 0x40bb08
call fcn.0046e308
mov ecx, eax
push ecx
call fcn.0043a731
add esp, 4
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x6c4]
mov dword [ebp - 0x6c4], 0
push eax
push 0
push 0
push 0x4e8fdc
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x40bc87
push dword [ebp - 0x6c4]
push str._08X
push dword [ebp - 0x6bc]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x208
lea eax, [ebp - 0x68c]
push 0
push eax
call fcn.00465ca0
push 0x208
lea eax, [ebp - 0x484]
push 0
push eax
call fcn.00465ca0
add esp, 0x18
lea eax, [ebp - 0x68c]
xorps xmm0, xmm0
movlpd qword [ebp - 0x6d8], xmm0
movlpd qword [ebp - 0x6b8], xmm0
push eax
push 0
push 0
push 0x25
push 0
movlpd qword [ebp - 0x698], xmm0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x40bef0
push str.kernel32.dll
lea eax, [ebp - 0x68c]
push eax
lea eax, [ebp - 0x484]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileTime]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
test eax, eax
je 0x40bda4
push 0
push 0
push 3
push 0
push 1
push accept
lea eax, [ebp - 0x484]
push eax
call esi
mov esi, eax
cmp esi, 0xffffffff
je 0x40bd9e
push 0
push 0
lea eax, [ebp - 0x6c0]
mov dword [ebp - 0x6c0], 0
push eax
push esi
mov dword [ebp - 0x6bc], 0
call ebx
test eax, eax
je 0x40bd9b
mov ecx, dword [ebp - 0x6c0]
mov eax, dword [ebp - 0x6bc]
add ecx, 0x2ac18000
push 0
push 0x989680
adc eax, 0xfe624e21
mov dword [ebp - 0x6cc], 0
push eax
push ecx
call fcn.004649d0
mov dword [ebp - 0x6d8], eax
mov dword [ebp - 0x6d4], edx
push esi
call edi
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push str.user32.dll
lea eax, [ebp - 0x68c]
push eax
lea eax, [ebp - 0x484]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
je 0x40be48
push 0
push 0
push 3
push 0
push 1
push accept
lea eax, [ebp - 0x484]
push eax
call esi
mov esi, eax
cmp esi, 0xffffffff
je 0x40be48
push 0
push 0
lea eax, [ebp - 0x6c0]
mov dword [ebp - 0x6c0], 0
push eax
push esi
mov dword [ebp - 0x6bc], 0
call ebx
test eax, eax
je 0x40be45
mov ecx, dword [ebp - 0x6c0]
mov eax, dword [ebp - 0x6bc]
add ecx, 0x2ac18000
push 0
push 0x989680
adc eax, 0xfe624e21
mov dword [ebp - 0x6cc], 0
push eax
push ecx
call fcn.004649d0
mov dword [ebp - 0x6b8], eax
mov dword [ebp - 0x6b4], edx
push esi
call edi
push str.notepad.exe
lea eax, [ebp - 0x68c]
push eax
lea eax, [ebp - 0x484]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
je 0x40bef0
push 0
push 0
push 3
push 0
push 1
push accept
lea eax, [ebp - 0x484]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40bef0
push 0
push 0
lea eax, [ebp - 0x6c0]
mov dword [ebp - 0x6c0], 0
push eax
push esi
mov dword [ebp - 0x6bc], 0
call ebx
test eax, eax
je 0x40beed
mov ecx, dword [ebp - 0x6c0]
mov eax, dword [ebp - 0x6bc]
add ecx, 0x2ac18000
push 0
push 0x989680
adc eax, 0xfe624e21
mov dword [ebp - 0x6cc], 0
push eax
push ecx
call fcn.004649d0
mov dword [ebp - 0x698], eax
mov dword [ebp - 0x694], edx
push esi
call edi
push dword [ebp - 0x694]
push dword [ebp - 0x698]
push dword [ebp - 0x6b4]
push dword [ebp - 0x6b8]
push dword [ebp - 0x6d4]
push dword [ebp - 0x6d8]
push str._llu__llu__llu
push 0x100
push dword [ebp - 0x6ec]
call fcn.0040bf90
mov eax, dword [ebp - 0x6e0]
add esp, 0x24
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004640c2
mov esp, ebp
pop ebp
ret