Function at 0x401000
Capabilities:
Accept command line arguments
Create process on windows
Get common file path
Get program files directory
Persist via default file association registry key
Set registry value
Terminate process

Disassembly:
sub rsp, 8
sub rsp, 0x20
mov rcx, 0
mov rdx, section..data
mov r8, 0x26
mov r9, 0
call qword [sym.imp.SHELL32.DLL_SHGetSpecialFolderPathA]
add rsp, 0x20
sub rsp, 0x20
mov rcx, section..data
call qword [sym.imp.SHLWAPI.DLL_PathAddBackslashA]
add rsp, 0x20
sub rsp, 0x20
mov rcx, section..data
jmp 0x401057
lea rdx, [0x00401050]
call qword [sym.imp.KERNEL32.DLL_lstrcatA]
add rsp, 0x20
sub rsp, 0x20
mov rcx, section..data
call qword [sym.imp.SHLWAPI.DLL_PathAddBackslashA]
add rsp, 0x20
sub rsp, 0x20
mov rcx, section..data
jmp 0x401095
lea rdx, [0x0040108a]
call qword [sym.imp.KERNEL32.DLL_lstrcatA]
add rsp, 0x20
sub rsp, 0x20
mov rcx, section..data
mov rdx, 0x404218
call qword [sym.imp.KERNEL32.DLL_GetBinaryTypeA]
add rsp, 0x20
cmp eax, 0
je 0x4030c7
sub rsp, 0x20
mov rcx, 0
call qword [sym.imp.USER32.DLL_GetSystemMetrics]
add rsp, 0x20
sub rsp, 0x20
mov rcx, 0x404208
jmp 0x4010f0
lea rdx, [0x004010ed]
mov r8d, eax
call qword [sym.imp.USER32.DLL_wsprintfA]
add rsp, 0x20
sub rsp, 0x20
mov rcx, 1
call qword [sym.imp.USER32.DLL_GetSystemMetrics]
add rsp, 0x20
sub eax, 0x34
sub rsp, 0x20
mov rcx, 0x404210
jmp 0x40112c
lea rdx, [0x00401129]
mov r8d, eax
call qword [sym.imp.USER32.DLL_wsprintfA]
add rsp, 0x20
sub rsp, 0x20
mov rcx, section..data
jmp 0x401152
lea rdx, [0x0040114d]
call qword [sym.imp.SHLWAPI.DLL_PathRenameExtensionA]
add rsp, 0x20
sub rsp, 0x20
jmp 0x401170
lea rcx, [0x00401169]
jmp 0x401183
lea rdx, [0x00401179]
jmp 0x40118e
lea r8, [0x0040118c]
mov r9, section..data
call qword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringA]
add rsp, 0x20
sub rsp, 0x20
jmp 0x4011b3
lea rcx, [0x004011ac]
jmp 0x4011c2
lea rdx, [0x004011bc]
jmp 0x4011cd
lea r8, [0x004011cb]
mov r9, section..data
call qword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringA]
add rsp, 0x20
sub rsp, 0x20
jmp 0x4011f2
lea rcx, [0x004011eb]
jmp 0x401201
lea rdx, [0x004011fb]
jmp 0x40120d
lea r8, [0x0040120a]
mov r9, section..data
call qword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringA]
add rsp, 0x20
sub rsp, 0x20
jmp 0x401232
lea rcx, [0x0040122b]
jmp 0x401241
lea rdx, [0x0040123b]
mov r8, 0x404208
mov r9, section..data
call qword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringA]
add rsp, 0x20
sub rsp, 0x20
jmp 0x40126d
lea rcx, [0x00401266]
jmp 0x40127c
lea rdx, [0x00401276]
mov r8, 0x404210
mov r9, section..data
call qword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringA]
add rsp, 0x20
sub rsp, 0x20
jmp 0x4012aa
lea rcx, [0x004012a1]
jmp 0x4012be
lea rdx, [0x004012b3]
jmp 0x4012c9
lea r8, [0x004012c7]
mov r9, section..data
call qword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringA]
add rsp, 0x20
sub rsp, 0x20
jmp 0x4012f0
lea rcx, [0x004012e7]
jmp 0x401302
lea rdx, [0x004012f9]
jmp 0x40130d
lea r8, [0x0040130b]
mov r9, section..data
call qword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringA]
add rsp, 0x20
sub rsp, 0x20
jmp 0x401334
lea rcx, [0x0040132b]
jmp 0x401346
lea rdx, [0x0040133d]
jmp 0x401352
lea r8, [0x0040134f]
mov r9, section..data
call qword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringA]
add rsp, 0x20
sub rsp, 0x20
jmp 0x401379
lea rcx, [0x00401370]
jmp 0x40138b
lea rdx, [0x00401382]
mov r8, 0x404208
mov r9, section..data
call qword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringA]
add rsp, 0x20
sub rsp, 0x20
jmp 0x4013b9
lea rcx, [0x004013b0]
jmp 0x4013cb
lea rdx, [0x004013c2]
mov r8, 0x404210
mov r9, section..data
call qword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringA]
add rsp, 0x20
sub rsp, 0x30
movabs rcx, 0x80000002
jmp 0x401410
lea rdx, [0x004013fa]
mov r8, 0
mov r9, 1
jmp 0x401436
lea rax, [0x00401427]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0xe
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000002
jmp 0x401485
lea rdx, [0x00401465]
mov r8, 0
mov r9, 1
jmp 0x40149e
lea rax, [0x0040149c]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 1
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000002
jmp 0x4014f9
lea rdx, [0x004014cd]
mov r8, 0
mov r9, 1
jmp 0x401535
lea rax, [0x00401510]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x24
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000002
jmp 0x401597
lea rdx, [0x00401564]
mov r8, 0
mov r9, 1
jmp 0x4015c7
lea rax, [0x004015ae]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x18
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000002
jmp 0x401611
lea rdx, [0x004015f6]
mov r8, 0
mov r9, 1
jmp 0x401635
lea rax, [0x00401628]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0xc
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000002
jmp 0x401682
lea rdx, [0x00401664]
mov r8, 0
mov r9, 1
jmp 0x40169b
lea rax, [0x00401699]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 1
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000002
jmp 0x4016f4
lea rdx, [0x004016ca]
mov r8, 0
mov r9, 1
jmp 0x401730
lea rax, [0x0040170b]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x24
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000002
jmp 0x401790
lea rdx, [0x0040175f]
mov r8, 0
mov r9, 1
jmp 0x4017b7
lea rax, [0x004017a7]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0xf
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000002
jmp 0x401800
lea rdx, [0x004017e6]
mov r8, 0
mov r9, 1
jmp 0x401829
lea rax, [0x00401817]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x11
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000002
jmp 0x40187b
lea rdx, [0x00401858]
mov r8, 0
mov r9, 1
jmp 0x401894
lea rax, [0x00401892]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 1
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000002
jmp 0x4018f2
lea rdx, [0x004018c3]
mov r8, 0
mov r9, 1
jmp 0x40192e
lea rax, [0x00401909]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x24
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000002
jmp 0x401993
lea rdx, [0x0040195d]
mov r8, 0
mov r9, 1
jmp 0x4019c3
lea rax, [0x004019aa]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x18
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000002
jmp 0x401a10
lea rdx, [0x004019f2]
mov r8, 0
mov r9, 1
jmp 0x401a3a
lea rax, [0x00401a27]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x12
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000002
jmp 0x401a8a
lea rdx, [0x00401a69]
mov r8, 0
mov r9, 1
jmp 0x401ab4
lea rax, [0x00401aa1]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x15
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000002
jmp 0x401b07
lea rdx, [0x00401ae3]
mov r8, 0
mov r9, 1
jmp 0x401b20
lea rax, [0x00401b1e]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 1
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000002
jmp 0x401b7f
lea rdx, [0x00401b4f]
mov r8, 0
mov r9, 1
jmp 0x401bbb
lea rax, [0x00401b96]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x24
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000002
jmp 0x401c21
lea rdx, [0x00401bea]
mov r8, 0
mov r9, 1
jmp 0x401c48
lea rax, [0x00401c38]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0xf
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000002
jmp 0x401c98
lea rdx, [0x00401c77]
mov r8, 0
mov r9, 1
jmp 0x401cc5
lea rax, [0x00401caf]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x15
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000002
jmp 0x401d1b
lea rdx, [0x00401cf4]
mov r8, 0
mov r9, 1
jmp 0x401d34
lea rax, [0x00401d32]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 1
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000002
jmp 0x401d96
lea rdx, [0x00401d63]
mov r8, 0
mov r9, 1
jmp 0x401dd2
lea rax, [0x00401dad]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x24
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000002
jmp 0x401e3b
lea rdx, [0x00401e01]
mov r8, 0
mov r9, 1
jmp 0x401e62
lea rax, [0x00401e52]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0xf
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x401ebc
lea rdx, [0x00401e91]
jmp 0x401ecb
lea r8, [0x00401ec5]
mov r9, 1
jmp 0x401f06
lea rax, [0x00401edb]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x2a
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x401f60
lea rdx, [0x00401f35]
jmp 0x401f72
lea r8, [0x00401f69]
mov r9, 1
jmp 0x401f8b
lea rax, [0x00401f82]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 8
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x401fe2
lea rdx, [0x00401fba]
jmp 0x401ff1
lea r8, [0x00401feb]
mov r9, 1
jmp 0x40202c
lea rax, [0x00402001]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x2a
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x402083
lea rdx, [0x0040205b]
jmp 0x402095
lea r8, [0x0040208c]
mov r9, 1
jmp 0x4020ae
lea rax, [0x004020a5]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 8
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x402107
lea rdx, [0x004020dd]
jmp 0x402116
lea r8, [0x00402110]
mov r9, 1
jmp 0x402188
lea rax, [0x00402126]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x61
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x4021e1
lea rdx, [0x004021b7]
jmp 0x4021f3
lea r8, [0x004021ea]
mov r9, 1
jmp 0x40220c
lea rax, [0x00402203]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 8
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x402265
lea rdx, [0x0040223b]
jmp 0x402274
lea r8, [0x0040226e]
mov r9, 1
jmp 0x4022af
lea rax, [0x00402284]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x2a
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x402308
lea rdx, [0x004022de]
jmp 0x40231a
lea r8, [0x00402311]
mov r9, 1
jmp 0x402333
lea rax, [0x0040232a]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 8
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40238c
lea rdx, [0x00402362]
jmp 0x40239b
lea r8, [0x00402395]
mov r9, 1
jmp 0x4023d6
lea rax, [0x004023ab]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x2a
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40242f
lea rdx, [0x00402405]
jmp 0x402441
lea r8, [0x00402438]
mov r9, 1
jmp 0x40245a
lea rax, [0x00402451]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 8
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x4024b5
lea rdx, [0x00402489]
jmp 0x4024c4
lea r8, [0x004024be]
mov r9, 1
jmp 0x4024ff
lea rax, [0x004024d4]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x15
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x20
mov rcx, 0
call qword [sym.imp.USER32.DLL_GetSystemMetrics]
add rsp, 0x20
shr eax, 1
sub eax, 0x214
sub rsp, 0x20
mov rcx, 0x404208
jmp 0x40254a
lea rdx, [0x00402547]
mov r8d, eax
call qword [sym.imp.USER32.DLL_wsprintfA]
add rsp, 0x20
sub rsp, 0x20
mov rcx, 0
call qword [sym.imp.USER32.DLL_GetSystemMetrics]
add rsp, 0x20
shr eax, 1
sub eax, 0xbc
sub rsp, 0x20
mov rcx, 0x404210
jmp 0x40258a
lea rdx, [0x00402587]
mov r8d, eax
call qword [sym.imp.USER32.DLL_wsprintfA]
add rsp, 0x20
sub rsp, 0x20
mov rcx, 0x404104
jmp 0x4025e0
lea rdx, [0x004025ab]
mov r8, 0x404208
mov r9, 0x404210
call qword [sym.imp.USER32.DLL_wsprintfA]
add rsp, 0x20
sub rsp, 0x20
mov rcx, 0x404104
call qword [sym.imp.KERNEL32.DLL_lstrlenA]
add rsp, 0x20
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40264d
lea rdx, [0x00402624]
jmp 0x402665
lea r8, [0x00402656]
mov r9, 1
mov qword [rsp + 0x20], 0x404104
mov dword [rsp + 0x28], eax
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x20
mov rcx, 0
call qword [sym.imp.USER32.DLL_GetSystemMetrics]
add rsp, 0x20
shr eax, 1
sub eax, 0x217
sub rsp, 0x20
mov rcx, 0x404208
jmp 0x4026b6
lea rdx, [0x004026b3]
mov r8d, eax
call qword [sym.imp.USER32.DLL_wsprintfA]
add rsp, 0x20
sub rsp, 0x20
mov rcx, 0
call qword [sym.imp.USER32.DLL_GetSystemMetrics]
add rsp, 0x20
shr eax, 1
sub eax, 0xbc
sub rsp, 0x20
mov rcx, 0x404210
jmp 0x4026f6
lea rdx, [0x004026f3]
mov r8d, eax
call qword [sym.imp.USER32.DLL_wsprintfA]
add rsp, 0x20
sub rsp, 0x20
mov rcx, 0x404104
jmp 0x40274c
lea rdx, [0x00402717]
mov r8, 0x404208
mov r9, 0x404210
call qword [sym.imp.USER32.DLL_wsprintfA]
add rsp, 0x20
sub rsp, 0x20
mov rcx, 0x404104
call qword [sym.imp.KERNEL32.DLL_lstrlenA]
add rsp, 0x20
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x4027b6
lea rdx, [0x00402790]
jmp 0x4027ce
lea r8, [0x004027bf]
mov r9, 1
mov qword [rsp + 0x20], 0x404104
mov dword [rsp + 0x28], eax
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x20
mov rcx, 0
call qword [sym.imp.USER32.DLL_GetSystemMetrics]
add rsp, 0x20
shr eax, 1
sub eax, 0x193
sub rsp, 0x20
mov rcx, 0x404208
jmp 0x40281f
lea rdx, [0x0040281c]
mov r8d, eax
call qword [sym.imp.USER32.DLL_wsprintfA]
add rsp, 0x20
sub rsp, 0x20
mov rcx, 0
call qword [sym.imp.USER32.DLL_GetSystemMetrics]
add rsp, 0x20
shr eax, 1
sub eax, 0xbc
sub rsp, 0x20
mov rcx, 0x404210
jmp 0x40285f
lea rdx, [0x0040285c]
mov r8d, eax
call qword [sym.imp.USER32.DLL_wsprintfA]
add rsp, 0x20
sub rsp, 0x20
mov rcx, 0x404104
jmp 0x4028b6
lea rdx, [0x00402880]
mov r8, 0x404208
mov r9, 0x404210
call qword [sym.imp.USER32.DLL_wsprintfA]
add rsp, 0x20
sub rsp, 0x20
mov rcx, 0x404104
call qword [sym.imp.KERNEL32.DLL_lstrlenA]
add rsp, 0x20
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x402922
lea rdx, [0x004028fa]
jmp 0x40293a
lea r8, [0x0040292b]
mov r9, 1
mov qword [rsp + 0x20], 0x404104
mov dword [rsp + 0x28], eax
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x20
mov rcx, 0
call qword [sym.imp.USER32.DLL_GetSystemMetrics]
add rsp, 0x20
shr eax, 1
sub eax, 0x1a0
sub rsp, 0x20
mov rcx, 0x404208
jmp 0x40298b
lea rdx, [0x00402988]
mov r8d, eax
call qword [sym.imp.USER32.DLL_wsprintfA]
add rsp, 0x20
sub rsp, 0x20
mov rcx, 0
call qword [sym.imp.USER32.DLL_GetSystemMetrics]
add rsp, 0x20
shr eax, 1
sub eax, 0xbc
sub rsp, 0x20
mov rcx, 0x404210
jmp 0x4029cb
lea rdx, [0x004029c8]
mov r8d, eax
call qword [sym.imp.USER32.DLL_wsprintfA]
add rsp, 0x20
sub rsp, 0x20
mov rcx, 0x404104
jmp 0x402a22
lea rdx, [0x004029ec]
mov r8, 0x404208
mov r9, 0x404210
call qword [sym.imp.USER32.DLL_wsprintfA]
add rsp, 0x20
sub rsp, 0x20
mov rcx, 0x404104
call qword [sym.imp.KERNEL32.DLL_lstrlenA]
add rsp, 0x20
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x402a8e
lea rdx, [0x00402a66]
jmp 0x402aa6
lea r8, [0x00402a97]
mov r9, 1
mov qword [rsp + 0x20], 0x404104
mov dword [rsp + 0x28], eax
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x20
mov rcx, 0
call qword [sym.imp.USER32.DLL_GetSystemMetrics]
add rsp, 0x20
shr eax, 1
sub eax, 0x1a0
sub rsp, 0x20
mov rcx, 0x404208
jmp 0x402af7
lea rdx, [0x00402af4]
mov r8d, eax
call qword [sym.imp.USER32.DLL_wsprintfA]
add rsp, 0x20
sub rsp, 0x20
mov rcx, 0
call qword [sym.imp.USER32.DLL_GetSystemMetrics]
add rsp, 0x20
shr eax, 1
sub eax, 0xbc
sub rsp, 0x20
mov rcx, 0x404210
jmp 0x402b37
sub rsp, 0x20
mov rcx, 0
call qword [sym.imp.KERNEL32.DLL_ExitProcess]