Function at 0x40f170
Capabilities:
Check if file exists
Check os version
Create http request
Create process on windows
Create thread
Get common file path
Get file attributes
Get graphical window text
Get process image filename
Log keystrokes via polling
Persist via default file association registry key
Query or enumerate registry key
Query or enumerate registry value
Resume thread
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x649aa7
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x86e4
call fcn.00525750
mov eax, dword [0x703eb0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x20]
mov edi, dword [ebp + 0x1c]
mov dword [ebp - 0x8664], esi
mov dword [ebp - 0x8678], ebx
cmp eax, dword [esi + 0x10]
jg case.default.0x40f1e5
mov ecx, 1
cmp eax, ecx
jl case.default.0x40f1e5
dec eax
mov dword [ebp - 4], 0
cmp eax, 0x25
ja case.default.0x40f1e5
jmp dword [eax*4 + 0x410e48]
test byte [ebp + 0x18], 2
je case.default.0x40f1e5
test ebx, ebx
jne 0x40f204
mov eax, 0x8002000e
jmp 0x41077f
cmp dword [edi + 8], 0
jne 0x40f1fa
lea eax, [ebp - 0x21c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [ebp - 0x21c]
push ecx
lea ecx, [ebp - 0x865c]
call fcn.004023d0
push str._reimageRepair.exe
lea ecx, [ebp - 0x865c]
mov byte [ebp - 4], 1
call fcn.00406390
mov edx, dword [ebp - 0x865c]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40f2f3
push 0x104
lea eax, [ebp - 0x21c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x21c]
push ecx
lea ecx, [ebp - 0x8660]
call fcn.004023d0
push 0x5c
lea ecx, [ebp - 0x8660]
mov byte [ebp - 4], 2
call fcn.00406740
push eax
lea edx, [ebp - 0x86c8]
push edx
lea ecx, [ebp - 0x8660]
call fcn.004067f0
push str._reimageRepair.exe
push eax
lea eax, [ebp - 0x86ec]
push eax
mov byte [ebp - 4], 3
call fcn.00402600
add esp, 0xc
push eax
lea ecx, [ebp - 0x865c]
mov byte [ebp - 4], 4
call fcn.00402930
lea ecx, [ebp - 0x86ec]
call fcn.0040be80
lea ecx, [ebp - 0x86c8]
call fcn.0040be80
lea ecx, [ebp - 0x8660]
call fcn.0040be80
mov ecx, dword [ebp - 0x865c]
push 5
push 0
push 0
push ecx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edx, 3
push ebx
mov word [ebp - 0x8674], dx
mov dword [ebp - 0x866c], 0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0x8674]
push eax
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
lea ecx, [ebp - 0x8674]
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea ecx, [ebp - 0x865c]
call fcn.0040be80
xor eax, eax
jmp 0x41077f
test byte [ebp + 0x18], 2
je case.default.0x40f1e5
test ebx, ebx
je 0x40f1fa
cmp dword [edi + 8], 0
jne 0x40f1fa
lea ecx, [ebp - 0x865c]
call fcn.004023a0
lea edx, [ebp - 0x8698]
push edx
mov byte [ebp - 4], 5
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [ebp - 0x8694]
mov ecx, dword [ebp - 0x8698]
push eax
push ecx
call dword [sym.imp.USER32.dll_WindowFromPoint]
mov edi, dword [sym.imp.USER32.dll_GetParent]
mov esi, eax
jmp 0x40f3b0
push 0x100
lea edx, [ebp - 0x214]
push edx
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jle 0x40f3eb
push 0x6cd8c4
lea eax, [ebp - 0x865c]
push eax
call fcn.004119e0
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x865c]
push edx
call fcn.004119e0
push esi
call edi
test eax, eax
je 0x40f3fc
cmp eax, esi
je 0x40f3fc
mov esi, eax
xor al, al
je 0x40f3b0
lea eax, [ebp - 0x8664]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea ecx, [ebp - 0x867c]
mov dword [ebp - 0x8678], eax
call fcn.004023a0
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x8664]
push ecx
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x40f47f
push 0x208
lea edx, [ebp - 0x424]
push 0
push edx
call fcn.005236f0
add esp, 0xc
push 0x103
lea eax, [ebp - 0x424]
push eax
push esi
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
je 0x40f478
lea ecx, [ebp - 0x424]
push ecx
lea ecx, [ebp - 0x867c]
call fcn.00402490
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x8660]
call fcn.004023a0
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x867c]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x8668], esp
mov esi, esp
push eax
call fcn.00402be0
add eax, 0x10
add esp, 4
lea edi, [ebp - 0x86e0]
mov dword [esi], eax
call fcn.0040f040
add esp, 4
mov byte [ebp - 4], 8
mov edx, dword [eax]
mov eax, dword [ebp - 0x8678]
mov ecx, dword [ebp - 0x8664]
push edx
push eax
push ecx
lea edx, [ebp - 0x8660]
push str.Process_ID:0x_.4X_Thread_ID:0x_.4X___s__br_Looking_at
push edx
call fcn.00402d30
add esp, 0x14
mov ecx, edi
mov byte [ebp - 4], 7
call fcn.0040be80
lea eax, [ebp - 0x865c]
push eax
lea ecx, [ebp - 0x8660]
push ecx
lea edx, [ebp - 0x86d8]
push edx
call fcn.00402540
add esp, 0xc
push eax
lea ecx, [ebp - 0x865c]
mov byte [ebp - 4], 9
call fcn.00402930
lea ecx, [ebp - 0x86d8]
mov byte [ebp - 4], 7
call fcn.0040be80
mov eax, dword [ebp - 0x865c]
mov eax, dword [eax - 0xc]
push 1
dec eax
push eax
lea ecx, [ebp - 0x865c]
call fcn.004118a0
mov edi, dword [ebp - 0x865c]
lea esi, [ebp - 0x8690]
call fcn.004033f0
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov ecx, esi
push ecx
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
mov edx, esi
push edx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea ecx, [ebp - 0x8660]
call fcn.0040be80
lea ecx, [ebp - 0x867c]
call fcn.0040be80
lea ecx, [ebp - 0x865c]
call fcn.0040be80
xor eax, eax
jmp 0x41077f
test byte [ebp + 0x18], 2
je case.default.0x40f1e5
test ebx, ebx
je 0x40f1fa
cmp dword [edi + 8], 0
jne 0x40f1fa
call dword [sym.imp.KERNEL32.dll_GetVersion]
and eax, 0xff
mov ecx, 0x13
mov word [ebp - 0x8690], cx
mov dword [ebp - 0x8688], eax
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea edx, [ebp - 0x8690]
push edx
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
lea eax, [ebp - 0x8690]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
xor eax, eax
jmp 0x41077f
test byte [ebp + 0x18], 2
je case.default.0x40f1e5
test ebx, ebx
je 0x40f1fa
cmp dword [edi + 8], 0
jne 0x40f1fa
mov ecx, dword [ebp - 0x8664]
mov edi, dword [ecx + 0x24]
lea esi, [ebp - 0x8674]
call fcn.004033f0
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea edx, [ebp - 0x8674]
push edx
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
lea eax, [ebp - 0x8674]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
xor eax, eax
jmp 0x41077f
test byte [ebp + 0x18], 2
je case.default.0x40f1e5
test ebx, ebx
je 0x40f1fa
cmp dword [edi + 8], 0
jne 0x40f1fa
push 0x208
lea ecx, [ebp - 0x424]
push 0
push ecx
call fcn.005236f0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x424]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edi, [ebp - 0x424]
lea esi, [ebp - 0x8674]
call fcn.004033f0
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, esi
push eax
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
mov ecx, esi
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
xor eax, eax
jmp 0x41077f
test byte [ebp + 0x18], 1
je case.default.0x40f1e5
test ebx, ebx
je 0x40f1fa
cmp dword [edi + 8], ecx
jne 0x40f1fa
mov ecx, dword [edi]
lea esi, [ebp - 0x86a8]
call fcn.004070d0
lea edi, [ebp - 0x8664]
mov dword [ebp - 0x8664], 0
call fcn.0040d650
mov esi, dword [ebp - 0x8664]
push 0x17
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
setne al
movzx eax, al
neg eax
mov edx, 0xb
sbb eax, eax
push ebx
mov word [ebp - 0x8674], dx
mov word [ebp - 0x866c], ax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea ecx, [ebp - 0x8674]
push ecx
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea edx, [ebp - 0x8674]
push edx
call edi
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea eax, [ebp - 0x86a8]
push eax
call edi
xor eax, eax
jmp 0x41077f
test byte [ebp + 0x18], 1
je case.default.0x40f1e5
cmp dword [edi + 8], 0
jne 0x40f1fa
mov ecx, 0xb
xor edx, edx
mov word [ebp - 0x8674], cx
mov word [ebp - 0x866c], dx
push str.Reimage_Booster
push edx
mov byte [ebp - 4], 0xa
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
jne 0x40f911
lea eax, [ebp - 0x21c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [ebp - 0x21c]
push ecx
lea ecx, [ebp - 0x865c]
call fcn.004023d0
push str.REI_Booster.exe
lea ecx, [ebp - 0x865c]
mov byte [ebp - 4], 0xb
call fcn.00406390
mov edx, dword [ebp - 0x865c]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40f8ae
push 0x104
lea eax, [ebp - 0x21c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x21c]
push ecx
lea ecx, [ebp - 0x867c]
call fcn.004023d0
push 0x5c
lea ecx, [ebp - 0x867c]
mov byte [ebp - 4], 0xc
call fcn.00406740
push eax
lea edx, [ebp - 0x86c4]
push edx
lea ecx, [ebp - 0x867c]
call fcn.004067f0
push str.REI_Booster.exe
push eax
lea eax, [ebp - 0x86b8]
push eax
mov byte [ebp - 4], 0xd
call fcn.00402600
add esp, 0xc
push eax
lea ecx, [ebp - 0x865c]
mov byte [ebp - 4], 0xe
call fcn.00402930
lea ecx, [ebp - 0x86b8]
call fcn.0040be80
lea ecx, [ebp - 0x86c4]
call fcn.0040be80
lea ecx, [ebp - 0x867c]
mov byte [ebp - 4], 0xb
call fcn.0040be80
mov ecx, dword [ebp - 0x865c]
push 2
push 0
push 0
push ecx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esi, 0x64
call fcn.0040b9a0
cmp word [ebp - 0x8674], 0xb
je 0x40f8fc
lea edx, [ebp - 0x8674]
push edx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
test eax, eax
jns 0x40f8f0
push eax
call fcn.00401090
mov eax, 0xb
mov word [ebp - 0x8674], ax
or ecx, 0xffffffff
mov word [ebp - 0x866c], cx
lea ecx, [ebp - 0x865c]
call fcn.0040be80
test ebx, ebx
je 0x40f63e
jmp 0x40f629
test byte [ebp + 0x18], 2
je case.default.0x40f1e5
cmp dword [edi + 8], 0
jne 0x40f1fa
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 4
call esi
push 2
mov di, ax
call esi
push 1
or di, ax
call esi
or ax, di
xor ecx, ecx
cmp cx, ax
setne al
movzx eax, al
neg eax
sbb eax, eax
mov edx, 0xb
mov word [ebp - 0x8690], dx
mov word [ebp - 0x8688], ax
test ebx, ebx
je 0x40f988
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea ecx, [ebp - 0x8690]
push ecx
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
lea edx, [ebp - 0x8690]
push edx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
xor eax, eax
jmp 0x41077f
test byte [ebp + 0x18], 1
je case.default.0x40f1e5
cmp dword [edi + 8], 0
jne 0x40f1fa
mov eax, dword [0x722680]
mov ecx, 0x64
cmp dword [eax + 0x1bc], ecx
jae 0x40f64b
mov dword [eax + 0x1bc], ecx
xor eax, eax
jmp 0x41077f
mov al, byte [ebp + 0x18]
test al, 2
je 0x40fa0f
cmp dword [edi + 8], 0
jne 0x40f1fa
test ebx, ebx
je 0x40f1fa
movzx ecx, byte [0x722724]
neg ecx
mov eax, 0xb
sbb ecx, ecx
mov word [ebp - 0x8690], ax
mov word [ebp - 0x8688], cx
jmp 0x40f5d0
test al, 4
je case.default.0x40f1e5
cmp dword [edi + 8], ecx
jne 0x40f1fa
mov ecx, dword [edi]
lea esi, [ebp - 0x86a8]
call fcn.004070d0
cmp word [ebp - 0x86a0], 0xffff
mov esi, 0x722660
sete al
call fcn.00408b10
lea ecx, [ebp - 0x86a8]
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
xor eax, eax
jmp 0x41077f
test byte [ebp + 0x18], 1
je case.default.0x40f1e5
cmp dword [edi + 8], 0
jne 0x40f1fa
test ebx, ebx
je 0x40f1fa
mov dword [ebp - 0x865c], 0
lea edx, [ebp - 0x865c]
push edx
mov byte [ebp - 4], 0xf
call fcn.00411d20
mov edi, eax
test edi, edi
jns 0x40faaf
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x865c]
test eax, eax
je 0x40faa8
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, edi
jmp 0x41077f
mov eax, dword [ebp - 0x865c]
test eax, eax
jne 0x40fac3
push 0x80004003
call fcn.0053a0c0
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
mov eax, 9
mov word [ebp - 0x8674], ax
mov eax, dword [ebp - 0x865c]
mov dword [ebp - 0x866c], eax
test eax, eax
je 0x40faef
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0x8674]
push eax
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
lea ecx, [ebp - 0x8674]
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x865c]
test eax, eax
je 0x40f5f2
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
xor eax, eax
jmp 0x41077f
test byte [ebp + 0x18], 1
je case.default.0x40f1e5
cmp dword [edi + 8], 4
jne 0x40f1fa
mov edi, dword [edi]
mov ecx, 8
cmp cx, word [edi + 0x30]
jne 0x40fef0
mov edx, 9
cmp dx, word [edi + 0x20]
jne 0x40fef0
mov eax, 3
cmp ax, word [edi + 0x10]
jne 0x40fef0
mov ecx, eax
cmp cx, word [edi]
jne 0x40fef0
mov edx, dword [edi + 8]
mov eax, dword [edi + 0x18]
mov ecx, dword [edi + 0x28]
push edx
mov edx, dword [edi + 0x38]
push eax
push ecx
push edx
push 0x722660
call fcn.00408dd0
jmp 0x41077f
test byte [ebp + 0x18], 1
je case.default.0x40f1e5
cmp dword [edi + 8], ecx
jne 0x40f1fa
mov edi, dword [edi]
mov eax, 8
cmp ax, word [edi]
jne 0x40fef0
mov edx, dword [edi + 8]
lea ecx, [ebp - 0x8660]
push ecx
push edx
push 0x722660
call fcn.00408ef0
mov edi, eax
test edi, edi
js 0x40fc24
test ebx, ebx
je 0x40fc24
xor ecx, ecx
cmp word [ebp - 0x8660], 0xffff
mov eax, 0xb
setne cl
push ebx
mov word [ebp - 0x8690], ax
dec ecx
mov word [ebp - 0x8688], cx
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea edx, [ebp - 0x8690]
push edx
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
lea eax, [ebp - 0x8690]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, edi
jmp 0x41077f
test byte [ebp + 0x18], 1
je case.default.0x40f1e5
cmp dword [edi + 8], ecx
jne 0x40f1fa
mov edi, dword [edi]
mov ecx, 8
cmp cx, word [edi]
jne 0x40fef0
mov edx, dword [edi + 8]
push ebx
push edx
push 0x722660
call fcn.00409020
jmp 0x41077f
test byte [ebp + 0x18], 1
je case.default.0x40f1e5
cmp dword [edi + 8], 3
jne 0x40f1fa
mov edi, dword [edi]
mov eax, 8
cmp ax, word [edi + 0x20]
jne 0x40fef0
movsx ecx, word [edi + 8]
mov edx, dword [edi + 0x10]
push ecx
mov ecx, dword [edi + 0x14]
sub esp, 0x10
mov eax, esp
mov dword [eax], edx
mov edx, dword [edi + 0x18]
mov dword [eax + 4], ecx
mov ecx, dword [edi + 0x1c]
mov dword [eax + 8], edx
mov edx, dword [edi + 0x28]
push edx
push 0x722660
mov dword [eax + 0xc], ecx
call fcn.00409130
jmp 0x41077f
test byte [ebp + 0x18], 1
je case.default.0x40f1e5
cmp dword [edi + 8], 3
jne 0x40f1fa
mov edi, dword [edi]
mov eax, 8
cmp ax, word [edi + 0x20]
jne 0x40fef0
mov ecx, eax
cmp cx, word [edi + 0x10]
jne 0x40fef0
mov edx, 3
cmp dx, word [edi]
jne 0x40fef0
mov eax, dword [edi + 8]
mov ecx, dword [edi + 0x18]
mov edx, dword [edi + 0x28]
push eax
push ecx
push edx
push 0x722660
call fcn.00409270
jmp 0x41077f
push 0
call fcn.00522b97
mov eax, dword [0x722680]
mov ecx, dword [eax + 0x20]
push 0
push 0x800a
push 0x111
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
jmp 0x41077f
test byte [ebp + 0x18], 1
je case.default.0x40f1e5
cmp dword [edi + 8], ecx
jne 0x40f1fa
test ebx, ebx
je 0x40f1fa
mov edx, dword [edi]
mov eax, 8
cmp ax, word [edx]
jne 0x40fef0
lea ecx, [ebp - 0x8690]
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea edx, [ebp - 0x8664]
push edx
push 0x20019
push 0
push str.SOFTWARE_reimagePC_Repair
push SysReAllocString
mov byte [ebp - 4], 0x10
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40f5d0
mov eax, dword [edi]
mov eax, dword [eax + 8]
test eax, eax
jne 0x40fe23
xor ebx, ebx
mov dword [ebp - 0x867c], ebx
push 0x200
lea ecx, [ebp - 0x214]
push 0
push ecx
mov byte [ebp - 4], 0x11
call fcn.005236f0
add esp, 0xc
lea edx, [ebp - 0x865c]
push edx
mov edx, dword [ebp - 0x8664]
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x8660]
push ecx
push 0
push ebx
push edx
mov dword [ebp - 0x865c], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40fe6e
mov eax, dword [ebp - 0x8660]
dec eax
je 0x40fe5d
sub eax, 2
je 0x40fe44
dec eax
jne 0x40fe6e
mov eax, dword [ebp - 0x214]
push eax
lea esi, [ebp - 0x8690]
call fcn.00407130
jmp 0x40fe6e
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ebx, eax
mov dword [ebp - 0x867c], ebx
test ebx, ebx
jne 0x40fdb1
push 0x8007000e
call fcn.00401090
fld qword [ebp - 0x214]
sub esp, 8
lea esi, [ebp - 0x8690]
fstp qword [esp]
call fcn.00407100
jmp 0x40fe6e
lea edi, [ebp - 0x214]
lea esi, [ebp - 0x8690]
call fcn.00403440
mov ecx, dword [ebp - 0x8664]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ebx, dword [ebp - 0x8678]
jmp 0x40f5d0
test byte [ebp + 0x18], 1
je case.default.0x40f1e5
cmp dword [edi + 8], 2
jne 0x40f1fa
mov eax, dword [edi]
mov ecx, 8
cmp cx, word [eax + 0x10]
jne 0x40fef0
mov edx, dword [eax + 0x18]
push edx
lea ecx, [ebp - 0x865c]
call fcn.004023d0
lea eax, [ebp - 0x865c]
push str.HWFreqSignal
push eax
mov byte [ebp - 4], 0x12
call fcn.00411bb0
add esp, 8
test al, al
je 0x40ff1f
mov edi, dword [edi]
mov ecx, 3
cmp cx, word [edi]
je 0x40fefa
lea ecx, [ebp - 0x865c]
call fcn.0040be80
mov eax, 0x80020008
jmp 0x41077f
mov edx, dword [edi + 8]
push 0x6cbc40
push edx
mov ecx, 0x722868
call fcn.00418ac0
lea ecx, [ebp - 0x865c]
call fcn.0040be80
xor eax, eax
jmp 0x41077f
push 0
lea eax, [ebp - 0x8660]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push str.SOFTWARE_reimagePC_Repair
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40f342
mov ecx, dword [edi]
mov dword [ebp - 0x867c], eax
mov eax, dword [ecx + 0x18]
test eax, eax
jne 0x40ff80
xor ebx, ebx
mov dword [ebp - 0x8678], ebx
mov byte [ebp - 4], 0x13
mov edi, dword [edi]
movzx eax, word [edi]
add eax, 0xfffffffe
cmp eax, 6
ja case.0x40ff79.6
jmp dword [eax*4 + 0x410ee0]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ebx, eax
mov dword [ebp - 0x8678], ebx
test ebx, ebx
jne 0x40ff64
push 0x8007000e
call fcn.00401090
push 4
add edi, 8
push edi
push 4
mov edx, dword [ebp - 0x8660]
push 0
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x40fffd
mov esi, 0x80004005
jmp 0x410003
mov edi, dword [edi + 8]
test edi, edi
jne 0x410029
xor esi, esi
push esi
call dword [sym.imp.OLEAUT32.dll_VariantInit]
mov ecx, dword [ebp - 0x8660]
lea eax, [eax + eax + 2]
push eax
push esi
push 1
push 0
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x40fff6
mov dword [ebp - 0x867c], 0x80004005
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov esi, dword [ebp - 0x867c]
mov eax, dword [ebp - 0x8660]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea ecx, [ebp - 0x865c]
call fcn.0040be80
mov eax, esi
jmp 0x41077f
push edi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
test esi, esi
jne 0x40ffc9
push 0x8007000e
call fcn.00401090
push 8
add edi, 8
push edi
push 3
jmp 0x40ffa5
mov esi, 0x80020008
jmp 0x410003
test byte [ebp + 0x18], 2
je case.default.0x40f1e5
cmp dword [edi + 8], 0
jne 0x40f1fa
test ebx, ebx
je 0x40f1fa
mov ecx, 0x722868
call fcn.00418960
test eax, eax
mov ecx, 3
mov dword [ebp - 0x866c], eax
sete al
mov esi, 0x722660
mov word [ebp - 0x8674], cx
call fcn.00408b10
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea edx, [ebp - 0x8674]
push edx
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
lea eax, [ebp - 0x8674]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
xor eax, eax
jmp 0x41077f
mov al, byte [ebp + 0x18]
test al, 2
je 0x410124
cmp dword [edi + 8], 0
jne 0x40f1fa
test ebx, ebx
je 0x40f1fa
movzx edx, byte [0x722728]
neg edx
mov ecx, 0xb
sbb edx, edx
push ebx
mov word [ebp - 0x8690], cx
mov word [ebp - 0x8688], dx
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0x8690]
push eax
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
lea ecx, [ebp - 0x8690]
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
xor eax, eax
jmp 0x41077f
test al, 4
je case.default.0x40f1e5
cmp dword [edi + 8], ecx
jne 0x40f1fa
mov edi, dword [edi]
mov edx, 0xb
cmp dx, word [edi]
jne 0x40fef0
cmp word [edi + 8], 0xffff
sete al
mov byte [0x722728], al
xor eax, eax
jmp 0x41077f
test byte [ebp + 0x18], 2
je case.default.0x40f1e5
cmp dword [edi + 8], 0
jne 0x40f1fa
test ebx, ebx
je 0x40f1fa
lea ecx, [ebp - 0x86cc]
push ecx
mov ecx, 0x722868
call fcn.00417110
mov byte [ebp - 4], 0x14
mov edi, dword [eax]
lea esi, [ebp - 0x86a8]
call fcn.004033f0
lea ecx, [ebp - 0x86cc]
call fcn.0040be80
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov edx, esi
push edx
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
mov eax, esi
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
xor eax, eax
jmp 0x41077f
test byte [ebp + 0x18], 1
je case.default.0x40f1e5
cmp dword [edi + 8], ecx
jne 0x40f1fa
mov edi, dword [edi]
mov ecx, 8
cmp cx, word [edi]
jne 0x40fef0
mov edx, dword [edi]
mov ecx, dword [edi + 4]
push 1
sub esp, 0x10
mov eax, esp
mov dword [eax], edx
mov edx, dword [edi + 8]
mov dword [eax + 4], ecx
mov ecx, dword [edi + 0xc]
push str.RunJSCode
mov dword [eax + 8], edx
push 0x722660
mov dword [eax + 0xc], ecx
call fcn.00409130
xor eax, eax
jmp 0x41077f
test byte [ebp + 0x18], 1
je case.default.0x40f1e5
cmp dword [edi + 8], ecx
jne 0x40f1fa
mov edi, dword [edi]
mov edx, 8
cmp dx, word [edi]
jne 0x40fef0
lea eax, [ebp - 0x8664]
mov dword [ebp - 0x8664], 0
mov ecx, dword [edi + 8]
push eax
push ecx
push 0x722660
call fcn.0040aa50
test eax, eax
js 0x41077f
mov eax, dword [ebp - 0x8664]
mov edx, 9
mov word [ebp - 0x8674], dx
mov dword [ebp - 0x866c], eax
test eax, eax
je 0x410287
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0x8674]
push eax
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
lea ecx, [ebp - 0x8674]
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
xor eax, eax
jmp 0x41077f
test byte [ebp + 0x18], 1
je case.default.0x40f1e5
cmp dword [edi + 8], ecx
jne 0x40f1fa
mov edi, dword [edi]
mov edx, 8
cmp dx, word [edi]
jne 0x40fef0
lea eax, [ebp - 0x8664]
mov dword [ebp - 0x8664], 0
mov ecx, dword [edi + 8]
push eax
push ecx
push 0x722660
call fcn.0040aac0
test eax, eax
js 0x41077f
mov eax, dword [ebp - 0x8664]
mov edx, 9
mov word [ebp - 0x8674], dx
mov dword [ebp - 0x866c], eax
test eax, eax
je 0x41031e
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0x8674]
push eax
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
lea ecx, [ebp - 0x8674]
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
xor eax, eax
jmp 0x41077f
cmp dword [edi + 8], 4
jne 0x40f1fa
mov eax, dword [edi]
mov edx, 8
cmp dx, word [eax + 0x30]
jne 0x40fef0
mov ecx, edx
cmp cx, word [eax + 0x20]
jne 0x40fef0
cmp dx, word [eax + 0x10]
jne 0x40fef0
cmp cx, word [eax]
jne 0x40fef0
mov edx, dword [eax + 8]
push ecx
mov ecx, esp
mov dword [ebp - 0x8668], esp
push edx
call fcn.004023d0
mov byte [ebp - 4], 0x15
mov eax, dword [edi]
mov edx, dword [eax + 0x18]
push ecx
mov ecx, esp
mov dword [ebp - 0x8694], esp
push edx
call fcn.004023d0
mov byte [ebp - 4], 0x16
mov eax, dword [edi]
mov edx, dword [eax + 0x28]
push ecx
mov ecx, esp
mov dword [ebp - 0x86ac], esp
push edx
call fcn.004023d0
mov byte [ebp - 4], 0x17
mov eax, dword [edi]
mov edx, dword [eax + 0x38]
push ecx
mov ecx, esp
mov dword [ebp - 0x86bc], esp
push edx
call fcn.004023d0
mov ecx, 0x722660
mov byte [ebp - 4], 0
call fcn.0040ab40
xor eax, eax
jmp 0x41077f
mov al, byte [ebp + 0x18]
test al, 2
je 0x41043d
cmp dword [edi + 8], 0
jne 0x40f1fa
test ebx, ebx
je 0x40f1fa
mov ecx, 0x722660
call fcn.0042a4c9
mov eax, dword [eax + 0x20]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
dec eax
neg eax
sbb eax, eax
neg eax
mov ecx, 0xb
dec eax
mov word [ebp - 0x8674], cx
mov word [ebp - 0x866c], ax
jmp 0x41009b
test al, 4
je case.default.0x40f1e5
cmp dword [edi + 8], ecx
jne 0x40f1fa
mov ecx, dword [edi]
mov edx, 0xb
cmp dx, word [ecx]
jne 0x40fef0
mov ecx, 0x722660
call fcn.0042a4c9
mov ecx, dword [edi]
xor edx, edx
cmp word [ecx + 8], 0xffff
mov ecx, eax
setne dl
dec edx
and edx, 5
push edx
call fcn.0042505e
mov ecx, 0x722660
call fcn.0042a4c9
mov eax, dword [eax + 0x20]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov ecx, 0x722660
call fcn.0042a4c9
mov ecx, dword [eax + 0x20]
push 1
push ecx
call dword [sym.imp.USER32.dll_FlashWindow]
mov ecx, 0x722660
call fcn.0042a4c9
mov edx, dword [eax + 0x20]
push edx
call dword [sym.imp.USER32.dll_BringWindowToTop]
xor eax, eax
jmp 0x41077f
test byte [ebp + 0x18], 1
je case.default.0x40f1e5
cmp dword [edi + 8], 3
jne 0x40f1fa
mov eax, dword [edi]
mov ecx, 8
cmp cx, word [eax + 0x20]
jne 0x40fef0
mov edx, ecx
cmp dx, word [eax + 0x10]
jne 0x40fef0
mov ecx, 3
cmp cx, word [eax]
jne 0x40fef0
mov ecx, 0x722660
call fcn.0042a4c9
mov edi, dword [edi]
mov edx, dword [edi + 8]
mov ecx, dword [edi + 0x18]
push 0
push edx
push ecx
mov ecx, dword [edi + 0x28]
mov esi, eax
call fcn.004041c0
xor eax, eax
jmp 0x41077f
test byte [ebp + 0x18], 2
je case.default.0x40f1e5
cmp dword [edi + 8], 0
jne 0x40f1fa
test ebx, ebx
je 0x40f1fa
lea edx, [ebp - 0x86d4]
push edx
mov ecx, 0x722868
call fcn.00417110
mov byte [ebp - 4], 0x18
mov edi, dword [eax]
lea esi, [ebp - 0x86a8]
call fcn.004033f0
lea ecx, [ebp - 0x86d4]
call fcn.0040be80
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0x86a8]
push eax
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
lea ecx, [ebp - 0x86a8]
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
xor eax, eax
jmp 0x41077f
test byte [ebp + 0x18], 1
je case.default.0x40f1e5
cmp dword [edi + 8], 0
jne 0x40f1fa
push str.CollectCpuInfo
lea ecx, [ebp - 0x86dc]
call fcn.004023d0
lea edx, [ebp - 0x8668]
push edx
push 4
push esi
push 0x410f00
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
je 0x4105f9
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x86dc]
call fcn.0040be80
xor eax, eax
jmp 0x41077f
test byte [ebp + 0x18], 1
je case.default.0x40f1e5
cmp dword [edi + 8], 0
jne 0x40f1fa
push str.Reimage_Booster
push 0
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x41063d
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, 0x1f4
call fcn.0040b9a0
xor eax, eax
jmp 0x41077f
test byte [ebp + 0x18], 1
je case.default.0x40f1e5
cmp dword [edi + 8], ecx
jne 0x40f1fa
mov eax, dword [edi]
mov ecx, 8
cmp cx, word [eax]
jne 0x40fef0
test ebx, ebx
je 0x40f1fa
push 0
push 0
push 0
push 0
push str.Reimage_PC_Booster
call dword [sym.imp.WININET.dll_InternetOpenW]
mov esi, eax
mov dword [ebp - 0x8664], esi
test esi, esi
je 0x410737
mov dword [ebp - 0x8678], 0x4000
mov dword [ebp - 0x867c], 0
lea edx, [ebp - 0x8678]
push edx
mov byte [ebp - 4], 0x1a
mov ecx, dword [edi]
mov edx, dword [ecx + 8]
lea eax, [ebp - 0x862c]
push eax
push 0
push edx
call dword [sym.imp.WININET.dll_InternetGetCookieW]
test eax, eax
je 0x410728
lea esi, [ebp - 0x862c]
lea edi, [ebp - 0x867c]
call fcn.004033b0
mov eax, dword [ebp - 0x8664]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
lea esi, [ebp - 0x86a8]
call fcn.0040d5f0
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov ecx, esi
push ecx
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
mov edx, esi
push edx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [ebp - 0x867c]
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
xor eax, eax
jmp 0x41077f
push esi
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, 0x80004005
jmp 0x41077f
test byte [ebp + 0x18], 1
je case.default.0x40f1e5
cmp dword [edi + 8], 2
jne 0x40f1fa
mov edi, dword [edi]
mov ecx, 8
cmp cx, word [edi + 0x10]
jne 0x40fef0
mov edx, ecx
cmp dx, word [edi]
jne 0x40fef0
mov eax, dword [edi + 8]
mov ecx, dword [edi + 0x18]
push eax
push 0
push ecx
call dword [sym.imp.WININET.dll_InternetSetCookieW]
mov eax, 0x80004001
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00521602
mov esp, ebp
pop ebp
ret 0x24
test byte [ebp + 0x18], 2
je case.default.0x40f1e5
cmp dword [edi + 8], 0
jne 0x40f1fa
test ebx, ebx
je 0x40f1fa
lea edx, [ebp - 0x86e4]
push edx
call fcn.0040b680
mov byte [ebp - 4], 0x1b
mov edi, dword [eax]
lea esi, [ebp - 0x86a8]
call fcn.004033f0
lea ecx, [ebp - 0x86e4]
jmp 0x41056f
test byte [ebp + 0x18], 1
je case.default.0x40f1e5
cmp dword [edi + 8], ecx
jne 0x40f1fa
mov edi, dword [edi]
mov edx, 8
cmp dx, word [edi]
jne 0x40fef0
mov eax, dword [edi + 8]
push eax
lea ecx, [esi + 0x18]
call fcn.00402490
push str.UpdateFromWeb
lea ecx, [ebp - 0x86b4]
call fcn.004023d0
lea ecx, [ebp - 0x8668]
push ecx
push 4
push esi
push 0x4112a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
je 0x410850
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x86b4]
call fcn.0040be80
xor eax, eax
jmp 0x41077f
test byte [ebp + 0x18], 1
je case.default.0x40f1e5
mov eax, dword [edi + 8]
cmp eax, ecx
je 0x41087c
cmp eax, 2
jne 0x40f1fa
lea ecx, [ebp - 0x865c]
call fcn.004023a0
mov byte [ebp - 4], 0x1d
cmp dword [edi + 8], 2
jne 0x4108b4
mov eax, dword [edi]
mov edx, 8
lea ecx, [ebp - 0x865c]
cmp dx, word [eax + 0x10]
je 0x4108ab
push 0x6cbc40
jmp 0x4108af
mov eax, dword [eax + 0x18]
push eax
call fcn.00402490
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x7225a4]
test ecx, ecx
je 0x4108d4
mov edx, eax
sub edx, ecx
cmp edx, 0x3a98
jb 0x40f342
mov edi, dword [edi]
mov dword [0x7225a4], eax
mov eax, 8
cmp ax, word [edi]
jne 0x40fee5
mov ecx, dword [edi + 8]
push ecx
lea ecx, [esi + 0x1c]
call fcn.00402490
lea edx, [ebp - 0x865c]
push str.reimagedefaultbrowserreimage
push edx
call fcn.00411bb0
add esp, 8
push 0x6cbc40
test al, al
je 0x41097f
lea ecx, [esi + 0x20]
call fcn.00402490
push str.OpenNewBrowserWindow
lea ecx, [ebp - 0x86f4]
call fcn.004023d0
lea eax, [ebp - 0x8694]
push eax
push 4
push esi
push 0x411800
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
je 0x410962
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x86f4]
call fcn.0040be80
lea ecx, [ebp - 0x865c]
call fcn.0040be80
xor eax, eax
jmp 0x41077f
lea ecx, [ebp - 0x8668]
call fcn.004023d0
lea ecx, [ebp - 0x8678]
push ecx
push 0x20019
push 0
push 0x6cbc40
mov byte [ebp - 4], 0x1e
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push SysReAllocString
call ebx
xor edi, edi
mov ecx, dword [ebp - 0x8678]
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x86bc]
push edx
lea eax, [ebp - 0x214]
push eax
push edi
push ecx
mov dword [ebp - 0x86bc], 0xff
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
je 0x410ae5
lea edx, [ebp - 0x214]
push edx
lea ecx, [ebp - 0x867c]
call fcn.004023d0
mov byte [ebp - 4], 0x1f
mov eax, dword [ebp - 0x865c]
mov eax, dword [eax - 0xc]
push eax
lea ecx, [ebp - 0x86e8]
push ecx
lea ecx, [ebp - 0x867c]
call fcn.004067f0
mov byte [ebp - 4], 0x20
mov edx, dword [ebp - 0x865c]
push edx
mov ecx, eax
call fcn.004024e0
lea ecx, [ebp - 0x86e8]
mov esi, eax
mov byte [ebp - 4], 0x1f
call fcn.0040be80
test esi, esi
jne 0x410c4d
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x8660]
call fcn.004023d0
push str._shellopencommand_
lea ecx, [ebp - 0x8660]
mov byte [ebp - 4], 0x21
call fcn.00406c30
mov edx, dword [ebp - 0x8660]
mov eax, dword [ebp - 0x8678]
lea ecx, [ebp - 0x8694]
push ecx
push 0x20019
push esi
push edx
push eax
call ebx
test eax, eax
jne 0x410c42
lea ecx, [ebp - 0x86ac]
push ecx
lea edx, [ebp - 0x62c]
push edx
push eax
push eax
mov eax, dword [ebp - 0x8694]
push 0x6cbc40
push eax
mov dword [ebp - 0x86ac], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x410c42
lea ecx, [ebp - 0x8660]
call fcn.0040be80
lea ecx, [ebp - 0x867c]
mov byte [ebp - 4], 0x1e
call fcn.0040be80
mov esi, dword [ebp - 0x8664]
lea ecx, [ebp - 0x62c]
push ecx
lea ecx, [ebp - 0x8660]
call fcn.004023d0
mov bl, 0x22
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x8660]
cmp dword [eax - 0xc], 0
jl 0x410b5d
push str..exe
push eax
call fcn.00522032
add esp, 8
test eax, eax
je 0x410b5d
sub eax, dword [ebp - 0x8660]
sar eax, 1
cmp eax, 0xffffffff
je 0x410b5d
add eax, 3
push eax
push 1
lea edx, [ebp - 0x86d0]
push edx
lea ecx, [ebp - 0x8660]
call fcn.0040bbb0
push eax
lea ecx, [ebp - 0x8660]
mov byte [ebp - 4], 0x23
call fcn.00402930
lea ecx, [ebp - 0x86d0]
mov byte [ebp - 4], bl
call fcn.0040be80
lea ecx, [ebp - 0x8660]
call fcn.0040bb20
mov eax, dword [ebp - 0x8660]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x410bb6
mov eax, dword [ebp - 0x8660]
cmp dword [eax - 0xc], 0
jl 0x410ba5
push str.explorer.exe
push eax
call fcn.00522032
add esp, 8
test eax, eax
je 0x410ba5
sub eax, dword [ebp - 0x8660]
sar eax, 1
cmp eax, 0xffffffff
jne 0x410bb6
lea edx, [ebp - 0x8660]
lea ecx, [esi + 0x20]
push edx
call fcn.00402930
jmp 0x410bc3
push 0x6cbc40
lea ecx, [esi + 0x20]
call fcn.00402490
lea ecx, [ebp - 0x8660]
mov byte [ebp - 4], 0x1e
call fcn.0040be80
push str.OpenNewBrowserWindow
lea ecx, [ebp - 0x86f0]
call fcn.004023d0
lea eax, [ebp - 0x8694]
push eax
push 4
push esi
push 0x411800
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
je 0x410c1a
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x86f0]
call fcn.0040be80
lea ecx, [ebp - 0x8668]
call fcn.0040be80
lea ecx, [ebp - 0x865c]
call fcn.0040be80
xor eax, eax
jmp 0x41077f
lea ecx, [ebp - 0x8660]
call fcn.0040be80
lea ecx, [ebp - 0x867c]
mov byte [ebp - 4], 0x1e
call fcn.0040be80
mov esi, dword [ebp - 0x8664]
inc edi
jmp 0x4109b0
cmp dword [edi + 8], 0
jne 0x40f1fa
test ebx, ebx
je 0x40f1fa
mov ecx, 3
mov word [ebp - 0x8690], cx
mov dword [ebp - 0x8688], 0xffffffff
xor edx, edx
mov dword [ebp - 0x8634], 7
mov dword [ebp - 0x8638], 0
mov word [ebp - 0x8648], dx
push 0x104
lea eax, [ebp - 0x62c]
push eax
mov byte [ebp - 4], 0x25
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x410cd3
mov ecx, 0x63
mov word [ebp - 0x62c], cx
mov edx, dword [ebp - 0x62c]
push edx
lea esi, [ebp - 0x8648]
call fcn.0040c070
push 0x19
push str.:ReimageUndo_reimage.und
mov ecx, esi
call fcn.0040bf50
cmp dword [ebp - 0x8634], 8
mov eax, dword [ebp - 0x8648]
jae 0x410d04
mov eax, esi
push 0
push 0
push 3
push 0
push 0
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x410e0b
test esi, esi
je 0x410e0b
lea eax, [ebp - 0x8698]
push eax
lea ecx, [ebp - 0x86c0]
push ecx
lea edx, [ebp - 0x8680]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
mov edi, dword [ebp - 0x8698]
mov ebx, dword [ebp - 0x8694]
lea eax, [ebp - 0x8658]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea ecx, [ebp - 0x86b0]
push ecx
lea edx, [ebp - 0x8658]
push edx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov eax, dword [ebp - 0x86b0]
mov ecx, dword [ebp - 0x86ac]
push 0
sub eax, edi
push 0x2710
sbb ecx, ebx
push ecx
push eax
call fcn.0052d190
push 0
push 0x3e8
push edx
push eax
call fcn.0052d190
push 0
push 0x3c
push edx
push eax
call fcn.0052d190
push 0
push 0x3c
push edx
push eax
call fcn.0052d190
push 0
push 0x18
push edx
push eax
call fcn.0052d190
cmp word [ebp - 0x8690], 3
mov edi, eax
mov dword [ebp - 0x8668], edx
je 0x410df8
lea eax, [ebp - 0x8690]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
test eax, eax
jns 0x410dec
push eax
call fcn.00401090
mov ecx, 3
mov word [ebp - 0x8690], cx
push esi
mov dword [ebp - 0x8688], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp - 0x8678]
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea edx, [ebp - 0x8690]
push edx
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
lea ecx, [ebp - 0x8648]
call fcn.0040bef0
lea eax, [ebp - 0x8690]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
xor eax, eax
jmp 0x41077f