Function at 0x1003c8e
Capabilities:
Accept command line arguments
Check if file exists
Check os version
Delete registry value
Get common file path
Get file attributes
Get system information on windows
Persist via run registry key
Query or enumerate registry value
Read .ini file
Set registry value
Write file on windows

Disassembly:
sub esp, 0x59c
and dword [esp + 0x14], 0
push ebx
push ebp
push esi
push edi
mov ecx, 0x240
xor eax, eax
mov edi, 0x1006328
rep stosd dword es:[edi], eax
push 0x1007630
mov dword [0x1007630], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov edi, dword [sym.imp.USER32.dll_LoadStringA]
mov esi, 0x100
mov ebp, dword [esp + 0x5b0]
push esi
push 0x100ae68
push 3
push ebp
mov dword [0x10077c8], esi
call edi
push esi
push 0x1006c28
push 4
push ebp
mov dword [0x10077c8], esi
call edi
push esi
push 0x100b170
push 1
push ebp
mov dword [0x10077c8], esi
call edi
push esi
push 0x10081d0
push 2
push ebp
mov dword [0x10077c8], esi
call edi
push 0x1001ad4
push 0x10080d0
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x3ac]
push esi
push eax
push 6
push ebp
mov dword [0x10077c8], esi
call edi
push esi
push 0x10084d8
push 7
push ebp
mov dword [0x10077c8], esi
call edi
push esi
push 0x1006020
push 8
push ebp
mov dword [0x10077c8], esi
call edi
push esi
push 0x1009b18
push 9
push ebp
mov dword [0x10077c8], esi
call edi
push esi
push 0x1009610
push 0xa
push ebp
mov dword [0x10077c8], esi
call edi
push esi
push 0x1009408
push 0xb
push ebp
mov dword [0x10077c8], esi
call edi
mov dword [0x10077c8], esi
push esi
push 0x100af70
push 0xc
push ebp
call edi
push esi
push 0x1009300
push 0xd
push ebp
mov dword [0x10077c8], esi
call edi
push esi
push 0x10076c8
push 0xe
push ebp
mov dword [0x10077c8], esi
call edi
push esi
push 0x10087d8
push 0xf
push ebp
mov dword [0x10077c8], esi
call edi
push esi
push 0x100b070
push 0x10
push ebp
mov dword [0x10077c8], esi
call edi
push esi
push 0x1009710
push 0x11
push ebp
mov dword [0x10077c8], esi
call edi
push esi
push 0x1008ee8
push 0x12
push ebp
mov dword [0x10077c8], esi
call edi
push esi
push 0x1009e18
push 0x13
push ebp
mov dword [0x10077c8], esi
call edi
push esi
push 0x10082d8
push 0x14
push ebp
mov dword [0x10077c8], esi
call edi
push esi
push 0x1008de8
push 0x15
push ebp
mov dword [0x10077c8], esi
call edi
push esi
push 0x1009a10
push 0x16
push ebp
mov dword [0x10077c8], esi
call edi
push esi
push 0x10089d8
push 0x17
push ebp
mov dword [0x10077c8], esi
call edi
push esi
push 0x1009810
push 0x18
push ebp
mov dword [0x10077c8], esi
call edi
push esi
push 0x10088d8
push 0x19
mov dword [0x10077c8], esi
push ebp
call edi
push esi
push 0x100a018
push 0x1a
push ebp
mov dword [0x10077c8], esi
call edi
push esi
push 0x1008ce0
push 0x1c
push ebp
mov dword [0x10077c8], esi
call edi
push esi
push 0x1009910
push 0x1b
push ebp
mov dword [0x10077c8], esi
call edi
push esi
push 0x100a118
push 0x1c
push ebp
mov dword [0x10077c8], esi
call edi
push esi
push 0x1008ad8
push 0x1d
push ebp
mov dword [0x10077c8], esi
call edi
push esi
push 0x10090f8
push 0x1e
push ebp
mov dword [0x10077c8], esi
call edi
push esi
push 0x1009f18
push 0x1f
push ebp
mov dword [0x10077c8], esi
call edi
push esi
push 0x10085d8
push 0x20
push ebp
mov dword [0x10077c8], esi
call edi
push esi
push 0x10083d8
push 0x21
push ebp
mov dword [0x10077c8], esi
call edi
mov ebx, 0x10086d8
push esi
push ebx
push 0x22
push ebp
mov dword [0x10077c8], esi
call edi
push esi
push 0x1006228
push 0x23
push ebp
mov dword [0x10077c8], esi
call edi
push esi
push 0x1009200
push 0x25
push ebp
mov dword [0x10077c8], esi
call edi
push 0x1009b14
push 0x20019
push 0
push 0x1001a98
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1003fae
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0x154
push eax
lea eax, [esp + 0x25c]
push eax
push 0
push 0
push 0x1001a84
push dword [0x1009b14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1003fa2
mov dword [0x100b278], 1
push dword [0x1009b14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x1009b14
push 0x20019
mov ebp, 0x80000002
push ebx
push ebp
xor edi, edi
call fcn.01001bc0
neg eax
sbb eax, eax
inc eax
mov dword [0x1009400], eax
mov eax, dword [0x1009b14]
cmp eax, edi
je 0x1003fe0
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x1009b14
push 0x20019
push 0x10080d0
push ebp
call fcn.01001bc0
test eax, eax
je 0x1004001
or eax, 0xffffffff
jmp 0x1004f79
cmp dword [0x1007640], 2
mov ebp, 0x10077c8
push ebp
push 0x100a318
push edi
mov dword [0x10077c8], esi
push edi
jne 0x100403a
push 0x1008ad8
push dword [0x1009b14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [0x1008bd8], 2
jmp 0x1004055
push 0x10090f8
push dword [0x1009b14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [0x1008bd8], 1
lea eax, [esp + 0x4ac]
push ebp
push eax
push edi
push edi
push 0x1001a78
push dword [0x1009b14]
mov dword [0x10077c8], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push ebp
push 0x1008be0
push edi
push edi
push 0x100a018
mov dword [0x10077c8], esi
push dword [0x1009b14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0x100a318
push 0x1009c18
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x1008be0
push 0x1009c18
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x100a318
push 0x1009d18
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x1008be0
push 0x1009d18
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push ebp
push 0x100ad18
push edi
push edi
push 0x10084d8
mov dword [0x10077c8], esi
push dword [0x1009b14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push ebp
push ebx
push edi
push edi
push 0x10085d8
mov dword [0x10077c8], esi
push dword [0x1009b14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push ebx
push 0x1009c18
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push ebp
push ebx
push edi
push edi
push 0x10083d8
mov dword [0x10077c8], esi
push dword [0x1009b14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push ebx
push 0x1009d18
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push ebp
push ebx
push edi
push edi
push 0x10088d8
mov dword [0x10077c8], esi
push dword [0x1009b14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push ebx
push 0x1009508
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebp
push ebx
push edi
push edi
push 0x1009200
mov dword [0x10077c8], esi
push dword [0x1009b14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x1004195
push 0x1001a64
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebx
push 0x1006120
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jl 0x10041e9
lea eax, [esp + 0x1c]
push eax
push 2
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x10041df
push 0x1008ff0
push dword [esp + 0x20]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
mov eax, dword [esp + 0x28]
push dword [esp + 0x1c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [esp + 0x28]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push 0x1001190
push 0x1008ff0
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x100ae68
push 0x1008ff0
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x1001190
push 0x1008ff0
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x1006c28
push 0x1008ff0
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x1001190
push 0x1008ff0
call dword [sym.imp.KERNEL32.dll_lstrcatA]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [esp + 0x18], eax
mov al, byte [eax]
mov ecx, dword [esp + 0x18]
test al, al
je 0x100425c
inc ecx
cmp al, 0x20
mov dword [esp + 0x18], ecx
je 0x100425c
mov al, byte [ecx]
test al, al
jne 0x100424d
mov al, byte [ecx]
test al, al
je 0x100426d
cmp al, 0x20
jne 0x100426d
inc ecx
mov dword [esp + 0x18], ecx
jmp 0x100425c
mov eax, ecx
mov cl, byte [ecx]
test cl, cl
je 0x1004280
cmp cl, 0x20
je 0x1004280
mov cl, byte [eax + 1]
inc eax
jmp 0x1004271
cmp byte [eax], 0
je 0x1004288
and byte [eax], 0
push edi
mov dword [esp + 0x20], edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0xffffffffffffffff
push 0x1001a58
push 0xffffffffffffffff
push dword [esp + 0x24]
push 0x20000
push 0x800
call dword [sym.imp.KERNEL32.dll_CompareStringA]
cmp eax, 2
je 0x10042fd
push 0xffffffffffffffff
push 0x1001a4c
push 0xffffffffffffffff
push dword [esp + 0x24]
push 0x20000
push 0x800
call dword [sym.imp.KERNEL32.dll_CompareStringA]
cmp eax, 2
je 0x10042fd
push 0xffffffffffffffff
push 0x1001a44
push 0xffffffffffffffff
push dword [esp + 0x24]
push 0x20000
push 0x800
call dword [sym.imp.KERNEL32.dll_CompareStringA]
cmp eax, 2
jne 0x1004b60
push 0xffffffffffffffff
push 0x1001a58
push 0xffffffffffffffff
mov dword [esp + 0x20], 1
push dword [esp + 0x24]
push 0x20000
push 0x800
call dword [sym.imp.KERNEL32.dll_CompareStringA]
cmp eax, 2
jne 0x1004358
push 0x1009b10
push 0x20019
push 0x1001a14
push 0x80000000
call fcn.01001bc0
test eax, eax
jne 0x1004358
mov eax, dword [0x1009b10]
cmp eax, edi
je 0x1004354
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], edi
push 0xffffffffffffffff
push 0x1001a44
push 0xffffffffffffffff
push dword [esp + 0x24]
push 0x20000
push 0x800
call dword [sym.imp.KERNEL32.dll_CompareStringA]
cmp eax, 2
jne 0x100437e
mov dword [esp + 0x14], edi
push 0x1009b10
push 0x20019
push 0x1001a04
mov dword [0x1008de0], 1
push dword [0x1009b14]
mov dword [0x1009b10], edi
call fcn.01001bc0
test eax, eax
jne 0x10043e1
push ebp
push ebx
push edi
push edi
push 0x10019f0
mov dword [0x10077c8], esi
push dword [0x1009b10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10043d1
mov dword [0x1008de0], edi
mov eax, dword [0x1009b10]
cmp eax, edi
je 0x10043e1
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x1008de0], edi
je 0x1004442
push 0x1009b10
push 0x20019
push 0x10019e0
mov dword [0x1009b10], edi
push dword [0x1009b14]
call fcn.01001bc0
test eax, eax
jne 0x1004442
push ebp
push ebx
push edi
push edi
push 0x10019f0
mov dword [0x10077c8], esi
push dword [0x1009b10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1004432
mov dword [0x1008de0], edi
mov eax, dword [0x1009b10]
cmp eax, edi
je 0x1004442
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x1009b10
lea eax, [esp + 0x3b0]
push 0x2001f
push eax
push dword [0x1009b14]
mov dword [0x100b274], edi
call fcn.01001bc0
test eax, eax
jne 0x10044b3
push 0x1002db0
push 0x2001f
push dword [0x1009b10]
call fcn.01003be3
cmp dword [esp + 0x14], edi
je 0x10044a3
push 0x1002db0
push 0x2001f
push dword [0x1009b10]
mov dword [0x100b274], 1
call fcn.01003be3
mov eax, dword [0x1009b10]
cmp eax, edi
je 0x10044b3
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x14], edi
je 0x100451d
push ebp
push 0x1009b10
push edi
push 0x2001f
push edi
push edi
push edi
push 0x10019b8
push 0x80000000
mov dword [0x1009b10], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x100451d
push 0x1009508
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push 0x1009508
push 1
push edi
push 0x1006020
mov dword [0x10077c8], eax
push dword [0x1009b10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [0x1009b10]
cmp eax, edi
je 0x100451d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x1009b10
push 0x2001f
push 0x10019ac
push dword [0x1009b14]
call fcn.01001bc0
test eax, eax
jne 0x1004610
push 0x10019a0
push esi
push ebx
push 0x10013f0
push 0x10013cc
push 0x100199c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebx
call esi
inc eax
push eax
push ebx
push 1
push edi
push 0x10013d8
mov dword [0x10077c8], eax
push dword [0x1009b10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push ebx
call esi
test eax, eax
je 0x10045a9
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push 0x1001990
push ebx
call esi
test eax, eax
je 0x10045a9
push 0x1001980
push ebx
call esi
test eax, eax
mov dword [esp + 0x24], edi
jne 0x10045b1
mov dword [esp + 0x24], 1
cmp dword [esp + 0x24], edi
je 0x1004600
cmp dword [0x1007640], 2
push 0x10019a0
jne 0x10045d6
push 0x1001980
push 0x10013cc
push 0x1001978
jmp 0x10045e5
push 0x1001990
push 0x10013cc
push 0x100199c
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push 0x1003b31
push 0x2001f
push dword [0x1009b10]
call fcn.01003be3
mov eax, dword [0x1009b10]
cmp eax, edi
je 0x1004610
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xffffffffffffffff
push 0x100196c
lea eax, [esp + 0x4b4]
push 0xffffffffffffffff
push eax
push 0x20000
push 0x800
call dword [sym.imp.KERNEL32.dll_CompareStringA]
cmp eax, 2
jne 0x1004881
cmp dword [0x1007634], 4
jne 0x100465a
cmp dword [0x1007638], 0xa
jb 0x100465a
cmp dword [0x1007640], eax
je 0x100465a
mov dword [esp + 0x10], edi
jmp 0x1004669
push 0x1001960
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], edi
je 0x1004881
push 0x1001954
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
cmp esi, edi
mov dword [esp + 0x20], esi
je 0x1004875
lea eax, [esp + 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [esp + 0x234], 2
jne 0x1004742
push 0x45
xor eax, eax
pop ecx
lea edi, [esp + 0x258]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x130]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [esp + 0x130]
push eax
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x130]
push 0x1001944
push eax
call edi
lea eax, [esp + 0x2c]
push 0x1001938
push eax
call edi
lea eax, [esp + 0x130]
push 0
mov dword [esp + 0x25c], eax
lea eax, [esp + 0x30]
mov dword [esp + 0x260], eax
lea eax, [esp + 0x25c]
push eax
mov dword [esp + 0x370], 0x2c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
mov dword [esp + 0x1c], eax
jmp 0x1004875
cmp dword [0x1007640], 1
jne 0x10047e3
push 0x45
xor eax, eax
pop ecx
lea edi, [esp + 0x258]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x130]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [esp + 0x130]
push eax
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x130]
push 0x100192c
push eax
call esi
lea eax, [esp + 0x2c]
push 0x1001920
push eax
call esi
lea eax, [esp + 0x130]
push 0
mov dword [esp + 0x25c], eax
lea eax, [esp + 0x30]
mov dword [esp + 0x260], eax
lea eax, [esp + 0x25c]
push eax
mov dword [esp + 0x370], 0x2c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [esp + 0x2c]
mov dword [esp + 0x1c], eax
jmp 0x10047e9
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x45
xor eax, eax
pop ecx
lea edi, [esp + 0x258]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x130]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [esp + 0x130]
push eax
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x130]
push 0x1001914
push eax
call esi
lea eax, [esp + 0x2c]
push 0x1001908
push eax
call esi
lea eax, [esp + 0x130]
push 0
mov dword [esp + 0x25c], eax
lea eax, [esp + 0x30]
mov dword [esp + 0x260], eax
lea eax, [esp + 0x25c]
push eax
mov dword [esp + 0x370], 0x2c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [esp + 0x2c]
or dword [esp + 0x1c], eax
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor edi, edi
mov esi, 0x100b170
push 0x10081d0
push esi
call fcn.010050d3
push 0x1006228
push esi
call fcn.010050d3
push 0x10018f0
push 0x10018dc
call fcn.010050d3
cmp dword [esp + 0x14], edi
je 0x10048c7
call fcn.01004fad
mov dword [0x1009608], 1
call fcn.01004f86
jmp 0x10048cc
call fcn.01001c75
mov eax, dword [0x1007634]
cmp eax, 4
jbe 0x10048ee
cmp dword [0x1007640], 2
jne 0x10048eb
push 0x10018d0
mov esi, 0x10018a8
jmp 0x1004903
cmp eax, 4
jne 0x100491f
cmp dword [0x1007638], 0xa
jne 0x100491f
push 0x10018d0
mov esi, 0x1001880
push esi
call fcn.010054ec
push 0x1001874
push esi
call fcn.010054ec
push 0x1001868
push esi
call fcn.010054ec
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x1001960
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0x100185c
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp esi, edi
mov dword [esp + 0x14], eax
je 0x10049ce
cmp eax, edi
je 0x10049de
lea eax, [esp + 0x130]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [esp + 0x130]
push eax
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x2c]
push 0x100184c
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x10049c5
push 0x100183c
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x10049c5
push edi
push 0xd
push edi
lea ecx, [esp + 0x13c]
push edi
push ecx
lea ecx, [esp + 0x40]
push 0x100182c
push ecx
push edi
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor esi, esi
cmp dword [esp + 0x14], edi
je 0x10049de
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp esi, edi
je 0x10049e9
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [esp + 0x24], edi
je 0x1004b60
lea eax, [esp + 0x10]
push ebp
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push 0x100181c
push 0x80000000
mov dword [esp + 0x34], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
mov esi, 0x10017f4
jne 0x1004a55
cmp dword [0x10077c8], 1
jne 0x1004a45
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push esi
push 1
push edi
push edi
mov dword [0x10077c8], eax
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp dword [esp + 0x10], edi
je 0x1004a55
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x10]
push ebp
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push 0x10017e4
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1004aae
cmp dword [0x10077c8], 1
jne 0x1004a9e
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push esi
push 1
push edi
push edi
mov dword [0x10077c8], eax
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp dword [esp + 0x10], edi
je 0x1004aae
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x10]
push ebp
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push 0x10017d4
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1004b07
cmp dword [0x10077c8], 1
jne 0x1004af7
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push esi
push 1
push edi
push edi
mov dword [0x10077c8], eax
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp dword [esp + 0x10], edi
je 0x1004b07
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x10]
push ebp
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push 0x10017c4
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1004b60
cmp dword [0x10077c8], 1
jne 0x1004b50
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push esi
push 1
push edi
push edi
mov dword [0x10077c8], eax
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp dword [esp + 0x10], edi
je 0x1004b60
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xffffffffffffffff
push 0x10017bc
push 0xffffffffffffffff
push dword [esp + 0x24]
push 0x20000
push 0x800
call dword [sym.imp.KERNEL32.dll_CompareStringA]
cmp eax, 2
jne 0x1004ef1
mov dword [0x100b274], eax
mov esi, 0x20019
push 0x100960c
lea eax, [esp + 0x3b0]
push esi
push eax
push dword [0x1009b14]
call fcn.01001bc0
push 0x1002db0
push 0x2001f
push dword [0x100960c]
call fcn.01003be3
mov eax, dword [0x100960c]
cmp eax, edi
je 0x1004bce
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x100960c
lea eax, [esp + 0x3b0]
push esi
push eax
push dword [0x1009b14]
mov dword [0x100b274], 3
call fcn.01001bc0
push 0x1002db0
push esi
push dword [0x100960c]
call fcn.01003be3
mov eax, dword [0x100960c]
cmp eax, edi
je 0x1004c12
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x1009400], edi
jne 0x1004c2b
push 0x10081d0
push 0x100b170
call fcn.010050d3
jmp 0x1004c30
call fcn.01004fad
mov dword [0x1009608], 1
call fcn.01004f86
cmp dword [0x1009400], edi
je 0x1004e9e
lea eax, [esp + 0x2c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [esp + 0x130]
push eax
push edi
lea eax, [esp + 0x34]
push 0x10017b4
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push edi
push 0x80
push 2
push edi
push edi
lea eax, [esp + 0x144]
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
je 0x1004e9e
push 0x10017a8
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
push ebp
push ebx
call esi
push eax
push ebx
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x100174c
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
push ebp
push ebx
call esi
push eax
push ebx
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x10016f0
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
push ebp
push ebx
call esi
push eax
push ebx
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x1001684
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
push ebp
push ebx
call esi
push eax
push ebx
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x1001628
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
push ebp
push ebx
call esi
push eax
push ebx
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x10015cc
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
push ebp
push ebx
call esi
push eax
push ebx
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x1001570
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
push ebp
push ebx
call esi
push eax
push ebx
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x1001508
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
push ebp
push ebx
call esi
push eax
push ebx
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0x10014a0
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
push ebp
push ebx
call esi
push eax
push ebx
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x14]
push ebp
push eax
push edi
push 0x2001f
push edi
push edi
mov ebx, 0x1001468
push edi
push ebx
push 0x80000002
mov dword [esp + 0x38], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1004e2b
lea eax, [esp + 0x130]
push eax
lea eax, [esp + 0x30]
push 0x1001458
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea eax, [esp + 0x2c]
push eax
call esi
inc eax
mov dword [0x10077c8], eax
push eax
lea eax, [esp + 0x30]
push eax
push 1
push edi
push 0x1001440
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp dword [esp + 0x14], edi
je 0x1004e2b
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x14]
push ebp
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push ebx
push 0x80000002
mov dword [esp + 0x38], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1004e9e
lea eax, [esp + 0x130]
push eax
lea eax, [esp + 0x30]
push 0x1001418
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea eax, [esp + 0x2c]
push eax
call esi
inc eax
mov dword [0x10077c8], eax
push eax
lea eax, [esp + 0x30]
push eax
push 1
push edi
push 0x1001400
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp dword [esp + 0x14], edi
je 0x1004e9e
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x100960c
push 0x20006
push 0x10019b8
push 0x80000000
mov dword [0x100960c], edi
call fcn.01001bc0
test eax, eax
jne 0x1004ee2
push 0x1006020
push dword [0x100960c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [0x100960c]
cmp eax, edi
je 0x1004ee2
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10080d0
push 0x80000002
call fcn.01005228
push 0xffffffffffffffff
push 0x10013f4
push 0xffffffffffffffff
push dword [esp + 0x24]
push 0x20000
push 0x800
call dword [sym.imp.KERNEL32.dll_CompareStringA]
cmp eax, 2
jne 0x1004f27
call fcn.01004fad
mov dword [0x1009608], 1
call fcn.01004f86
mov eax, dword [0x1009b14]
cmp eax, edi
je 0x1004f37
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x1009b14
push 0x20006
push 0x10080d0
push 0x80000002
call fcn.01001bc0
test eax, eax
jne 0x1004f75
push 0x1001a78
push dword [0x1009b14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [0x1009b14]
cmp eax, edi
je 0x1004f75
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x59c
ret 0x10