Function at 0x4107f0
Capabilities:
Check if file exists
Check os version
Delete file
Get hostname
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42df96
mov eax, dword fs:[0]
push eax
sub esp, 0x5c4
mov eax, dword [0x43a00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x5b8], edi
mov dword [ebp - 0x58c], edi
mov dword [ebp - 0x58c], edi
lea ecx, [ebp - 0x558]
xor eax, eax
mov dword [ebp - 0x5b4], 0
push eax
mov dword [ebp - 0x558], 0
push 0x4354f8
mov dword [ebp - 0x548], 0
mov dword [ebp - 0x544], 7
mov word [ebp - 0x558], ax
call fcn.0040c560
lea ecx, [ebp - 0x47c]
mov dword [ebp - 4], 0
call fcn.0040e1c0
mov byte [ebp - 4], 1
cmp dword [ebp - 0x46c], 0
jne 0x410906
movups xmm0, xmmword [ebp - 0x558]
mov edx, dword [ebp - 0x468]
mov dword [edi], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
movups xmmword [edi], xmm0
movq xmm0, qword [ebp - 0x548]
movq qword [edi + 0x10], xmm0
cmp edx, 8
jb 0x412336
mov ecx, dword [ebp - 0x47c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4108f7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412353
push edx
push ecx
call fcn.00417807
add esp, 8
jmp 0x412336
xor eax, eax
mov dword [ebp - 0x464], 0
push eax
push 0x4354f8
lea ecx, [ebp - 0x464]
mov dword [ebp - 0x454], 0
mov dword [ebp - 0x450], 7
mov word [ebp - 0x464], ax
call fcn.0040c560
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x47c]
cmp dword [ebp - 0x468], 8
mov eax, dword [ebp - 0x46c]
jb 0x410962
mov ecx, dword [ebp - 0x47c]
lea eax, [ecx + eax*2]
jmp 0x41096b
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0x47c]
cmp eax, ecx
je 0x410bbb
cmp word [eax - 2], 0x5c
je 0x410bbb
push 0xd
xor eax, eax
mov dword [ebp - 0x430], 0
push str.BWAConfig.bin
lea ecx, [ebp - 0x430]
mov dword [ebp - 0x420], 0
mov dword [ebp - 0x41c], 7
mov word [ebp - 0x430], ax
call fcn.0040c560
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x44c]
push 1
xor eax, eax
mov dword [ebp - 0x44c], 0
push 0x434f10
mov dword [ebp - 0x43c], 0
mov dword [ebp - 0x438], 7
mov word [ebp - 0x44c], ax
call fcn.0040c560
mov byte [ebp - 4], 4
lea eax, [ebp - 0x47c]
cmp dword [ebp - 0x468], 8
push dword [ebp - 0x46c]
cmovae eax, dword [ebp - 0x47c]
push eax
push ecx
lea ecx, [ebp - 0x44c]
call fcn.0040b7c0
xor ecx, ecx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x5d0], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x5c0], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 5
push eax
lea eax, [ebp - 0x5d0]
push eax
push dword [ebp - 0x58c]
lea ecx, [ebp - 0x570]
call fcn.0040b4a0
mov edx, dword [ebp - 0x450]
mov esi, 6
cmp edx, 8
jb 0x410ab1
mov ecx, dword [ebp - 0x464]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x410aa7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412358
push edx
push ecx
call fcn.00417807
add esp, 8
movups xmm0, xmmword [ebp - 0x570]
movups xmmword [ebp - 0x464], xmm0
movq xmm0, qword [ebp - 0x560]
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x5bc]
movq qword [ebp - 0x454], xmm0
cmp edx, 8
jb 0x410b13
mov ecx, dword [ebp - 0x5d0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x410b09
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412358
push edx
push ecx
call fcn.00417807
add esp, 8
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x438]
cmp edx, 8
jb 0x410b57
mov ecx, dword [ebp - 0x44c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x410b4d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412358
push edx
push ecx
call fcn.00417807
add esp, 8
xor eax, eax
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x41c]
mov dword [ebp - 0x43c], 0
mov dword [ebp - 0x438], 7
mov word [ebp - 0x44c], ax
cmp edx, 8
jb 0x410cee
mov ecx, dword [ebp - 0x430]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x410ce4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412358
jmp 0x410ce4
push 0xd
xor eax, eax
mov dword [ebp - 0x44c], 0
push str.BWAConfig.bin
lea ecx, [ebp - 0x44c]
mov dword [ebp - 0x43c], 0
mov dword [ebp - 0x438], 7
mov word [ebp - 0x44c], ax
call fcn.0040c560
mov byte [ebp - 4], 6
lea eax, [ebp - 0x47c]
cmp dword [ebp - 0x468], 8
push dword [ebp - 0x46c]
cmovae eax, dword [ebp - 0x47c]
push eax
push ecx
lea ecx, [ebp - 0x44c]
call fcn.0040b7c0
xor ecx, ecx
mov esi, 8
movups xmm0, xmmword [eax]
movq xmm1, qword [eax + 0x10]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov edx, dword [ebp - 0x450]
movq qword [ebp - 0x590], xmm1
movups xmmword [ebp - 0x428], xmm0
cmp edx, esi
jb 0x410c9c
mov ecx, dword [ebp - 0x464]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x410c83
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41235d
push edx
push ecx
call fcn.00417807
movups xmm0, xmmword [ebp - 0x428]
add esp, 8
movq xmm1, qword [ebp - 0x590]
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x438]
movq qword [ebp - 0x454], xmm1
movups xmmword [ebp - 0x464], xmm0
cmp edx, esi
jb 0x410cee
mov ecx, dword [ebp - 0x44c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x410ce4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41235d
push edx
push ecx
call fcn.00417807
add esp, 8
push 0xd
xor eax, eax
mov dword [ebp - 0x430], 0
push str.BWAConfig.bin
lea ecx, [ebp - 0x430]
mov dword [ebp - 0x420], 0
mov dword [ebp - 0x41c], 7
mov word [ebp - 0x430], ax
call fcn.0040c560
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x44c]
push 1
xor eax, eax
mov dword [ebp - 0x44c], 0
push 0x434f10
mov dword [ebp - 0x43c], 0
mov dword [ebp - 0x438], 7
mov word [ebp - 0x44c], ax
call fcn.0040c560
mov byte [ebp - 4], 8
lea eax, [ebp - 0x47c]
cmp dword [ebp - 0x468], 8
push dword [ebp - 0x46c]
cmovae eax, dword [ebp - 0x47c]
push eax
push ecx
lea ecx, [ebp - 0x44c]
call fcn.0040b7c0
xor ecx, ecx
or esi, 0x10
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x5d0], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x5c0], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
lea eax, [ebp - 0x430]
mov byte [ebp - 4], 9
push eax
lea eax, [ebp - 0x5d0]
push eax
push dword [ebp - 0x58c]
lea ecx, [ebp - 0x570]
call fcn.0040b4a0
mov edx, dword [ebp - 0x450]
or esi, 0x20
cmp edx, 8
jb 0x410e22
mov ecx, dword [ebp - 0x464]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x410e18
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412362
push edx
push ecx
call fcn.00417807
add esp, 8
movups xmm0, xmmword [ebp - 0x570]
movups xmmword [ebp - 0x464], xmm0
movq xmm0, qword [ebp - 0x560]
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0x5bc]
movq qword [ebp - 0x454], xmm0
cmp edx, 8
jb 0x410e84
mov ecx, dword [ebp - 0x5d0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x410e7a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412362
push edx
push ecx
call fcn.00417807
add esp, 8
mov byte [ebp - 4], 7
mov edx, dword [ebp - 0x438]
cmp edx, 8
jb 0x410ec8
mov ecx, dword [ebp - 0x44c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x410ebe
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412362
push edx
push ecx
call fcn.00417807
add esp, 8
xor eax, eax
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x41c]
mov dword [ebp - 0x43c], 0
mov dword [ebp - 0x438], 7
mov word [ebp - 0x44c], ax
cmp edx, 8
jb 0x410f29
mov ecx, dword [ebp - 0x430]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x410f1f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412362
push edx
push ecx
call fcn.00417807
add esp, 8
cmp dword [ebp - 0x450], 8
lea eax, [ebp - 0x464]
cmovae eax, dword [ebp - 0x464]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x410f70
call fcn.00412aa0
test al, al
jne 0x412273
cmp dword [ebp - 0x450], 8
lea eax, [ebp - 0x464]
cmovae eax, dword [ebp - 0x464]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x208
lea eax, [ebp - 0x418]
push 0
push eax
call fcn.004195c0
add esp, 0xc
mov dword [ebp - 0x4ac], 0
xor eax, eax
mov dword [ebp - 0x540], 0x104
lea ecx, [ebp - 0x4ac]
mov dword [ebp - 0x49c], 0
mov dword [ebp - 0x498], 7
push 4
push str.live
mov word [ebp - 0x4ac], ax
call fcn.0040c560
lea eax, [ebp - 0x434]
mov byte [ebp - 4], 0xa
push eax
push 1
xor edi, edi
push edi
push str.SoftwareMicrosoftBingWallpaperApp
push 0x80000001
mov dword [ebp - 0x434], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x410ffa
mov edi, 0x80004005
jmp 0x411027
lea eax, [ebp - 0x540]
push eax
lea eax, [ebp - 0x418]
push eax
push 0
push 0
push str.Environment
push dword [ebp - 0x434]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov ecx, 0x80004005
cmovne edi, ecx
mov eax, dword [ebp - 0x434]
test eax, eax
je 0x411038
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x4110e0
lea ecx, [ebp - 0x418]
mov dword [ebp - 0x494], edi
mov dword [ebp - 0x484], edi
lea edx, [ecx + 2]
mov dword [ebp - 0x480], 7
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x411060
sub ecx, edx
lea eax, [ebp - 0x418]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x494]
call fcn.0040c560
mov edx, dword [ebp - 0x498]
cmp edx, 8
jb 0x4110c2
mov ecx, dword [ebp - 0x4ac]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4110b8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41236c
push edx
push ecx
call fcn.00417807
add esp, 8
movups xmm0, xmmword [ebp - 0x494]
movups xmmword [ebp - 0x4ac], xmm0
movq xmm0, qword [ebp - 0x484]
movq qword [ebp - 0x49c], xmm0
mov ecx, dword [ebp - 0x49c]
mov edi, 0x7ffffffe
mov eax, edi
sub eax, ecx
cmp eax, 5
jb 0x412367
cmp dword [ebp - 0x498], 8
lea eax, [ebp - 0x4ac]
push ecx
cmovae eax, dword [ebp - 0x4ac]
push eax
push 5
push str.env
push ecx
push dword [ebp - 0x58c]
lea ecx, [ebp - 0x5d0]
call fcn.0040b6b0
mov edx, dword [ebp - 0x498]
or esi, 0x40
cmp edx, 8
jb 0x41116a
mov ecx, dword [ebp - 0x4ac]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x411160
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41236c
push edx
push ecx
call fcn.00417807
add esp, 8
movups xmm0, xmmword [ebp - 0x5d0]
push 0x14
xor eax, eax
mov dword [ebp - 0x4f4], 0
movups xmmword [ebp - 0x4ac], xmm0
lea ecx, [ebp - 0x4f4]
mov dword [ebp - 0x4e4], 0
movq xmm0, qword [ebp - 0x5c0]
push str.BingWallpaperApp.exe
movq qword [ebp - 0x49c], xmm0
mov dword [ebp - 0x4e0], 7
mov word [ebp - 0x4f4], ax
call fcn.0040c560
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x44c]
push 1
xor eax, eax
mov dword [ebp - 0x44c], 0
push 0x434f10
mov dword [ebp - 0x43c], 0
mov dword [ebp - 0x438], 7
mov word [ebp - 0x44c], ax
call fcn.0040c560
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x47c]
cmp dword [ebp - 0x468], 8
push dword [ebp - 0x46c]
cmovae eax, dword [ebp - 0x47c]
push eax
push ecx
lea ecx, [ebp - 0x44c]
call fcn.0040b7c0
xor ecx, ecx
or esi, 0x80
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x494], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x484], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
lea eax, [ebp - 0x4f4]
mov byte [ebp - 4], 0xd
push eax
lea eax, [ebp - 0x494]
push eax
push dword [ebp - 0x58c]
lea ecx, [ebp - 0x570]
call fcn.0040b4a0
or esi, 0x100
mov byte [ebp - 4], 0xf
mov edx, dword [ebp - 0x480]
cmp edx, 8
jb 0x4112c6
mov ecx, dword [ebp - 0x494]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4112bc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412371
push edx
push ecx
call fcn.00417807
add esp, 8
mov byte [ebp - 4], 0x10
mov edx, dword [ebp - 0x438]
cmp edx, 8
jb 0x41130a
mov ecx, dword [ebp - 0x44c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x411300
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412371
push edx
push ecx
call fcn.00417807
add esp, 8
xor eax, eax
mov dword [ebp - 0x43c], 0
mov dword [ebp - 0x438], 7
mov word [ebp - 0x44c], ax
mov byte [ebp - 4], 0x11
mov edx, dword [ebp - 0x4e0]
cmp edx, 8
jb 0x41136b
mov ecx, dword [ebp - 0x4f4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x411361
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412371
push edx
push ecx
call fcn.00417807
add esp, 8
sub esp, 0x18
lea eax, [ebp - 0x570]
mov ecx, esp
push eax
call fcn.0040a240
lea ecx, [ebp - 0x4c4]
call fcn.0040fd50
add esp, 0x18
mov byte [ebp - 4], 0x12
mov ecx, dword [ebp - 0x4b4]
test ecx, ecx
jne 0x411483
lea ecx, [ebp - 0x494]
call fcn.004100c0
mov edi, eax
lea eax, [ebp - 0x4c4]
cmp eax, edi
je 0x411438
mov edx, dword [ebp - 0x4b0]
cmp edx, 8
jb 0x4113f7
mov ecx, dword [ebp - 0x4c4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4113ed
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412376
push edx
push ecx
call fcn.00417807
add esp, 8
mov dword [ebp - 0x4b4], 0
xor eax, eax
mov dword [ebp - 0x4b0], 7
mov word [ebp - 0x4c4], ax
movups xmm0, xmmword [edi]
movups xmmword [ebp - 0x4c4], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [ebp - 0x4b4], xmm0
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], 7
mov word [edi], ax
mov edx, dword [ebp - 0x480]
cmp edx, 8
jb 0x411478
mov ecx, dword [ebp - 0x494]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41146e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412376
push edx
push ecx
call fcn.00417807
add esp, 8
mov ecx, dword [ebp - 0x4b4]
mov edi, 0x7ffffffe
sub edi, ecx
cmp edi, 5
jb 0x41237b
cmp dword [ebp - 0x4b0], 8
lea eax, [ebp - 0x4c4]
push ecx
cmovae eax, dword [ebp - 0x4c4]
push eax
push 5
push str.ver
push ecx
push dword [ebp - 0x58c]
lea ecx, [ebp - 0x494]
call fcn.0040b6b0
or esi, 0x200
lea ecx, [ebp - 0x53c]
mov byte [ebp - 4], 0x13
call fcn.00410300
push 4
push str.pc
push ecx
mov ecx, eax
mov byte [ebp - 4], 0x14
call fcn.0040b7c0
xor ecx, ecx
or esi, 0x400
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x588], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x578], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 0x16
mov edx, dword [ebp - 0x528]
cmp edx, 8
jb 0x411559
mov ecx, dword [ebp - 0x53c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41154f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412380
push edx
push ecx
call fcn.00417807
add esp, 8
xor eax, eax
mov dword [ebp - 0x52c], 0
lea ecx, [ebp - 0x524]
mov dword [ebp - 0x528], 7
mov word [ebp - 0x53c], ax
call fcn.0040d5f0
push 5
push str.mkt
push ecx
mov ecx, eax
mov byte [ebp - 4], 0x17
call fcn.0040b7c0
xor ecx, ecx
or esi, 0x800
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x53c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x52c], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 0x19
mov edx, dword [ebp - 0x510]
cmp edx, 8
jb 0x411608
mov ecx, dword [ebp - 0x524]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4115fe
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412385
push edx
push ecx
call fcn.00417807
add esp, 8
xor eax, eax
mov dword [ebp - 0x514], 0
lea ecx, [ebp - 0x50c]
mov dword [ebp - 0x510], 7
mov word [ebp - 0x524], ax
call fcn.004126d0
push 5
push str.ops
push ecx
mov ecx, eax
mov byte [ebp - 4], 0x1a
call fcn.0040b7c0
xor ecx, ecx
or esi, 0x1000
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x524], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x514], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 0x1c
mov edx, dword [ebp - 0x4f8]
cmp edx, 8
jb 0x4116b7
mov ecx, dword [ebp - 0x50c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4116ad
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41238a
push edx
push ecx
call fcn.00417807
add esp, 8
xor eax, eax
mov dword [ebp - 0x4fc], 0
lea ecx, [ebp - 0x4dc]
mov dword [ebp - 0x4f8], 7
mov word [ebp - 0x50c], ax
call fcn.0040d860
push 8
push str.locale
push ecx
mov ecx, eax
mov byte [ebp - 4], 0x1d
call fcn.0040b7c0
or esi, 0x2000
xor ecx, ecx
mov dword [ebp - 0x58c], esi
mov dword [ebp - 0x5b4], esi
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x50c], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x4fc], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 0x1f
mov edx, dword [ebp - 0x4c8]
cmp edx, 8
jb 0x411772
mov ecx, dword [ebp - 0x4dc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x411768
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41238f
push edx
push ecx
call fcn.00417807
add esp, 8
xor eax, eax
mov dword [ebp - 0x4cc], 0
push eax
mov dword [ebp - 0x44c], eax
lea ecx, [ebp - 0x44c]
push 0x4354f8
mov dword [ebp - 0x4c8], 7
mov word [ebp - 0x4dc], ax
mov dword [ebp - 0x43c], eax
mov dword [ebp - 0x438], 7
mov word [ebp - 0x44c], ax
call fcn.0040c560
push 0x200
lea eax, [ebp - 0x210]
mov byte [ebp - 4], 0x20
push 0
push eax
call fcn.004195c0
add esp, 0xc
mov dword [ebp - 0x434], pe_nt_image_headers32
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x210]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
je 0x411826
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x411804
sub ecx, edx
lea eax, [ebp - 0x210]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x44c]
call fcn.0040c560
push pe_nt_image_headers32
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.004195c0
mov eax, dword [ebp - 0x44c]
lea ecx, [ebp - 0x44c]
mov edx, dword [ebp - 0x43c]
add esp, 0xc
cmp dword [ebp - 0x438], 8
jb 0x41185d
mov edi, eax
mov ecx, eax
jmp 0x411865
lea eax, [ebp - 0x44c]
mov edi, eax
lea esi, [eax + edx*2]
cmp edi, esi
je 0x411897
sub ecx, edi
mov dword [ebp - 0x594], ecx
movzx eax, word [edi]
push eax
call fcn.0041b160
mov ecx, dword [ebp - 0x594]
add esp, 4
mov word [edi + ecx], ax
add edi, 2
cmp edi, esi
jne 0x411874
mov edx, dword [ebp - 0x43c]
mov edi, dword [ebp - 0x438]
lea ecx, [ebp - 0x44c]
mov esi, dword [ebp - 0x44c]
cmp edi, 8
push 0xd
cmovae ecx, esi
setae byte [ebp - 0x595]
push str.microsoft.com
push ecx
call fcn.0040cea0
add esp, 0xc
mov dword [ebp - 0x594], eax
cmp byte [ebp - 0x595], 0
mov byte [ebp - 4], 0x1f
je 0x41190e
lea edi, [edi*2 + 2]
mov eax, esi
cmp edi, 0x1000
jb 0x4118fe
mov esi, dword [esi - 4]
add edi, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412394
push edi
push esi
call fcn.00417807
mov eax, dword [ebp - 0x594]
add esp, 8
cmp eax, 0xffffffff
jne 0x411921
call fcn.004128a0
mov edx, str.dm0
test al, al
je 0x411926
mov edx, str.dm1
mov ecx, edx
mov dword [ebp - 0x44c], 0
xor eax, eax
mov dword [ebp - 0x43c], 0
mov dword [ebp - 0x438], 7
mov word [ebp - 0x44c], ax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x411952
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x44c]
call fcn.0040c560
xor eax, eax
mov byte [ebp - 4], 0x22
push eax
mov dword [ebp - 0x5b0], 0
lea ecx, [ebp - 0x5b0]
push 0x4354f8
mov dword [ebp - 0x5a0], 0
mov dword [ebp - 0x59c], 7
mov word [ebp - 0x5b0], ax
call fcn.0040c560
mov eax, dword [ebp - 0x58c]
or eax, 0x4000
mov dword [ebp - 0x434], 0
mov dword [ebp - 0x5b4], eax
lea eax, [ebp - 0x12c]
push eax
mov dword [ebp - 0x12c], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x411ae3
lea eax, [ebp - 0x434]
push eax
push 0
push 0
push dword [ebp - 0x124]
push dword [ebp - 0x128]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
mov edx, dword [ebp - 0x434]
lea ecx, [ebp - 0x4dc]
call fcn.0040bed0
mov esi, eax
lea eax, [ebp - 0x5b0]
cmp eax, esi
je 0x411aa3
mov edx, dword [ebp - 0x59c]
cmp edx, 8
jb 0x411a62
mov ecx, dword [ebp - 0x5b0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x411a58
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412399
push edx
push ecx
call fcn.00417807
add esp, 8
mov dword [ebp - 0x5a0], 0
xor eax, eax
mov dword [ebp - 0x59c], 7
mov word [ebp - 0x5b0], ax
movups xmm0, xmmword [esi]
movups xmmword [ebp - 0x5b0], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x5a0], xmm0
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 7
mov word [esi], ax
mov edx, dword [ebp - 0x4c8]
cmp edx, 8
jb 0x411ae3
mov ecx, dword [ebp - 0x4dc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x411ad9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x412399
push edx
push ecx
call fcn.00417807
add esp, 8
push 5
push str.sku
push ecx
lea ecx, [ebp - 0x5b0]
call fcn.0040b7c0
xor ecx, ecx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x4dc], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x4cc], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 0x24
mov edx, dword [ebp - 0x59c]
cmp edx, 8
jb 0x411b64
mov ecx, dword [ebp - 0x5b0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x411b5a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41239e
push edx
push ecx
call fcn.00417807
add esp, 8
xor eax, eax
mov dword [ebp - 0x5a0], 0
push 0x2f
mov dword [ebp - 0x430], eax
lea ecx, [ebp - 0x430]
push str.https:__go.microsoft.com_fwlink__linkid2126573
mov dword [ebp - 0x59c], 7
mov word [ebp - 0x5b0], ax
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x41c], 7
mov word [ebp - 0x430], ax
call fcn.0040c560
mov byte [ebp - 4], 0x25
cmp dword [ebp - 0x4b4], 0
je 0x411c55
cmp dword [ebp - 0x480], 8
lea ecx, [ebp - 0x494]
mov esi, dword [ebp - 0x420]
cmovae ecx, dword [ebp - 0x494]
mov eax, dword [ebp - 0x41c]
mov edx, dword [ebp - 0x484]
sub eax, esi
mov dword [ebp - 0x594], ecx
mov dword [ebp - 0x58c], esi
cmp edx, eax
ja 0x411c3a
cmp dword [ebp - 0x41c], 8
lea edi, [esi + edx]
mov eax, dword [ebp - 0x58c]
lea esi, [ebp - 0x430]
cmovae esi, dword [ebp - 0x430]
mov dword [ebp - 0x420], edi
lea ecx, [esi + eax*2]
lea eax, [edx + edx]
push eax
push dword [ebp - 0x594]
push ecx
call fcn.00419040
add esp, 0xc
xor eax, eax
mov word [esi + edi*2], ax
jmp 0x411c55
push edx
push ecx
mov byte [ebp - 0x58c], 0
lea ecx, [ebp - 0x430]
push dword [ebp - 0x58c]
push edx
call fcn.0040b310
cmp dword [ebp - 0x574], 8
lea ecx, [ebp - 0x588]
mov esi, dword [ebp - 0x420]
cmovae ecx, dword [ebp - 0x588]
mov eax, dword [ebp - 0x41c]
mov edx, dword [ebp - 0x578]
sub eax, esi
mov dword [ebp - 0x594], ecx
mov dword [ebp - 0x58c], esi
cmp edx, eax
ja 0x411cce
cmp dword [ebp - 0x41c], 8
lea edi, [edx + esi]
mov eax, dword [ebp - 0x58c]
lea esi, [ebp - 0x430]
cmovae esi, dword [ebp - 0x430]
mov dword [ebp - 0x420], edi
lea ecx, [esi + eax*2]
lea eax, [edx + edx]
push eax
push dword [ebp - 0x594]
push ecx
call fcn.00419040
add esp, 0xc
xor eax, eax
mov word [esi + edi*2], ax
jmp 0x411ce9
push edx
push ecx
mov byte [ebp - 0x58c], 0
lea ecx, [ebp - 0x430]
push dword [ebp - 0x58c]
push edx
call fcn.0040b310
cmp dword [ebp - 0x528], 8
lea ecx, [ebp - 0x53c]
mov esi, dword [ebp - 0x420]
cmovae ecx, dword [ebp - 0x53c]
mov eax, dword [ebp - 0x41c]
mov edx, dword [ebp - 0x52c]
sub eax, esi
mov dword [ebp - 0x594], ecx
mov dword [ebp - 0x58c], esi
cmp edx, eax
ja 0x411d62
cmp dword [ebp - 0x41c], 8
lea edi, [edx + esi]
mov eax, dword [ebp - 0x58c]
lea esi, [ebp - 0x430]
cmovae esi, dword [ebp - 0x430]
mov dword [ebp - 0x420], edi
lea ecx, [esi + eax*2]
lea eax, [edx + edx]
push eax
push dword [ebp - 0x594]
push ecx
call fcn.00419040
add esp, 0xc
xor eax, eax
mov word [esi + edi*2], ax
jmp 0x411d7d
push edx
push ecx
mov byte [ebp - 0x58c], 0
lea ecx, [ebp - 0x430]
push dword [ebp - 0x58c]
push edx
call fcn.0040b310
cmp dword [ebp - 0x5bc], 8
lea ecx, [ebp - 0x4ac]
mov esi, dword [ebp - 0x420]
cmovae ecx, dword [ebp - 0x5d0]
mov eax, dword [ebp - 0x41c]
mov edx, dword [ebp - 0x5c0]
sub eax, esi
mov dword [ebp - 0x594], ecx
mov dword [ebp - 0x58c], esi
cmp edx, eax
ja 0x411df6
cmp dword [ebp - 0x41c], 8
lea edi, [esi + edx]
mov eax, dword [ebp - 0x58c]
lea esi, [ebp - 0x430]
cmovae esi, dword [ebp - 0x430]
mov dword [ebp - 0x420], edi
lea ecx, [esi + eax*2]
lea eax, [edx + edx]
push eax
push dword [ebp - 0x594]
push ecx
call fcn.00419040
add esp, 0xc
xor eax, eax
mov word [esi + edi*2], ax
jmp 0x411e11
push edx
push ecx
mov byte [ebp - 0x58c], 0
lea ecx, [ebp - 0x430]
push dword [ebp - 0x58c]
push edx
call fcn.0040b310
cmp dword [ebp - 0x510], 8
lea ecx, [ebp - 0x524]
mov esi, dword [ebp - 0x420]
cmovae ecx, dword [ebp - 0x524]
mov eax, dword [ebp - 0x41c]
mov edx, dword [ebp - 0x514]
sub eax, esi
mov dword [ebp - 0x594], ecx
mov dword [ebp - 0x58c], esi
cmp edx, eax
ja 0x411e8a
cmp dword [ebp - 0x41c], 8
lea edi, [edx + esi]
mov eax, dword [ebp - 0x58c]
lea esi, [ebp - 0x430]
cmovae esi, dword [ebp - 0x430]
mov dword [ebp - 0x420], edi
lea ecx, [esi + eax*2]
lea eax, [edx + edx]
push eax
push dword [ebp - 0x594]
push ecx
call fcn.00419040
add esp, 0xc
xor eax, eax
mov word [esi + edi*2], ax
jmp 0x411ea5
push edx
push ecx
mov byte [ebp - 0x58c], 0
lea ecx, [ebp - 0x430]
push dword [ebp - 0x58c]
push edx
call fcn.0040b310
cmp dword [ebp - 0x4f8], 8
lea ecx, [ebp - 0x50c]
mov esi, dword [ebp - 0x420]
cmovae ecx, dword [ebp - 0x50c]
mov eax, dword [ebp - 0x41c]
mov edx, dword [ebp - 0x4fc]
sub eax, esi
mov dword [ebp - 0x594], ecx
mov dword [ebp - 0x58c], esi
cmp edx, eax
ja 0x411f1e
cmp dword [ebp - 0x41c], 8
lea edi, [edx + esi]
mov eax, dword [ebp - 0x58c]
lea esi, [ebp - 0x430]
cmovae esi, dword [ebp - 0x430]
mov dword [ebp - 0x420], edi
lea ecx, [esi + eax*2]
lea eax, [edx + edx]
push eax
push dword [ebp - 0x594]
push ecx
call fcn.00419040
add esp, 0xc
xor eax, eax
mov word [esi + edi*2], ax
jmp 0x411f39
push edx
push ecx
mov byte [ebp - 0x58c], 0
lea ecx, [ebp - 0x430]
push dword [ebp - 0x58c]
push edx
call fcn.0040b310
cmp dword [ebp - 0x438], 8
lea ecx, [ebp - 0x44c]
mov esi, dword [ebp - 0x420]
cmovae ecx, dword [ebp - 0x44c]
mov eax, dword [ebp - 0x41c]
mov edx, dword [ebp - 0x43c]
sub eax, esi
mov dword [ebp - 0x594], ecx
mov dword [ebp - 0x58c], esi
cmp edx, eax
ja 0x411fb2
cmp dword [ebp - 0x41c], 8
lea edi, [edx + esi]
mov eax, dword [ebp - 0x58c]
lea esi, [ebp - 0x430]
cmovae esi, dword [ebp - 0x430]
mov dword [ebp - 0x420], edi
lea ecx, [esi + eax*2]
lea eax, [edx + edx]
push eax
push dword [ebp - 0x594]
push ecx
call fcn.00419040
add esp, 0xc
xor eax, eax
mov word [esi + edi*2], ax
jmp 0x411fcd
push edx
push ecx
mov byte [ebp - 0x58c], 0
lea ecx, [ebp - 0x430]
push dword [ebp - 0x58c]
push edx
call fcn.0040b310
cmp dword [ebp - 0x4c8], 8
lea ecx, [ebp - 0x4dc]
mov esi, dword [ebp - 0x420]
cmovae ecx, dword [ebp - 0x4dc]
mov eax, dword [ebp - 0x41c]
mov edx, dword [ebp - 0x4cc]
sub eax, esi
mov dword [ebp - 0x594], ecx
mov dword [ebp - 0x58c], esi
cmp edx, eax
ja 0x412046
cmp dword [ebp - 0x41c], 8
lea edi, [edx + esi]
mov eax, dword [ebp - 0x58c]
lea esi, [ebp - 0x430]
cmovae esi, dword [ebp - 0x430]
mov dword [ebp - 0x420], edi
lea ecx, [esi + eax*2]
lea eax, [edx + edx]
push eax
push dword [ebp - 0x594]
push ecx
call fcn.00419040
add esp, 0xc
xor eax, eax
mov word [esi + edi*2], ax
jmp 0x412061
push edx
push ecx
mov byte [ebp - 0x58c], 0
lea ecx, [ebp - 0x430]
push dword [ebp - 0x58c]
push edx
call fcn.0040b310
cmp dword [ebp - 0x450], 8
lea eax, [ebp - 0x464]
lea esi, [ebp - 0x430]
mov dword [ebp - 0x4f4], 0
cmovae eax, dword [ebp - 0x464]
lea ecx, [ebp - 0x4f4]
cmp dword [ebp - 0x41c], 8
mov edi, 0x80004005
mov dword [ebp - 0x58c], eax
cmovae esi, dword [ebp - 0x430]
xor eax, eax
push eax
push 0x4354f8
mov dword [ebp - 0x4e4], 0
mov dword [ebp - 0x4e0], 7
mov word [ebp - 0x4f4], ax
call fcn.0040c560
sub esp, 0x18
mov byte [ebp - 4], 0x26
mov ecx, esp
push esi
mov dword [ecx], 0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 7
call fcn.0040a150
lea edx, [ebp - 0x4f4]
xor ecx, ecx
call fcn.0040da70
add esp, 0x18
test eax, eax
js 0x412122
lea ecx, [ebp - 0x4f4]
call fcn.0040c390
mov edx, dword [ebp - 0x58c]
mov ecx, eax
call fcn.0040cf30
xor ecx, ecx
test eax, eax
cmovne edi, ecx
lea ecx, [ebp - 0x4f4]
mov byte [ebp - 4], 0x25
call fcn.0040c3a0
test edi, edi
je 0x4121f0
mov ecx, dword [ebp - 0x5b8]
lea eax, [ebp - 0x558]
push eax
call fcn.0040c110
lea ecx, [ebp - 0x430]
call fcn.0040c3a0
lea ecx, [ebp - 0x4dc]
call fcn.0040c3a0
lea ecx, [ebp - 0x44c]
call fcn.0040c3a0
lea ecx, [ebp - 0x50c]
call fcn.0040c3a0
lea ecx, [ebp - 0x524]
call fcn.0040c3a0
lea ecx, [ebp - 0x53c]
call fcn.0040c3a0
lea ecx, [ebp - 0x588]
call fcn.0040c3a0
lea ecx, [ebp - 0x494]
call fcn.0040c3a0
lea ecx, [ebp - 0x4c4]
call fcn.0040c3a0
lea ecx, [ebp - 0x570]
call fcn.0040c3a0
lea ecx, [ebp - 0x4ac]
call fcn.0040c3a0
lea ecx, [ebp - 0x464]
call fcn.0040c3a0
lea ecx, [ebp - 0x47c]
call fcn.0040c3a0
lea ecx, [ebp - 0x558]
call fcn.0040c3a0
mov eax, dword [ebp - 0x5b8]
jmp 0x412338
lea ecx, [ebp - 0x430]
call fcn.0040c3a0
lea ecx, [ebp - 0x4dc]
call fcn.0040c3a0
lea ecx, [ebp - 0x44c]
call fcn.0040c3a0
lea ecx, [ebp - 0x50c]
call fcn.0040c3a0
lea ecx, [ebp - 0x524]
call fcn.0040c3a0
lea ecx, [ebp - 0x53c]
call fcn.0040c3a0
lea ecx, [ebp - 0x588]
call fcn.0040c3a0
lea ecx, [ebp - 0x494]
call fcn.0040c3a0
lea ecx, [ebp - 0x4c4]
call fcn.0040c3a0
lea ecx, [ebp - 0x570]
call fcn.0040c3a0
lea ecx, [ebp - 0x4ac]
mov byte [ebp - 4], 2
call fcn.0040c3a0
mov edi, dword [ebp - 0x5b8]
lea eax, [ebp - 0x434]
mov dword [ebp - 0x434], 0
push eax
lea ecx, [ebp - 0x464]
call fcn.0040c390
xor edx, edx
mov ecx, eax
call fcn.0040d120
mov eax, dword [ebp - 0x434]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004180e6
add esp, 8
lea ecx, [ebp - 0x464]
mov esi, eax
lea eax, [ebp - 0x434]
push eax
call fcn.0040c390
mov edx, esi
mov ecx, eax
call fcn.0040d120
add esp, 4
test eax, eax
je 0x4122fe
push esi
lea ecx, [ebp - 0x570]
call fcn.0040c6c0
push eax
lea ecx, [ebp - 0x558]
call fcn.0040a1b0
lea ecx, [ebp - 0x570]
call fcn.0040c3a0
push esi
call fcn.004180ef
add esp, 4
lea eax, [ebp - 0x558]
mov ecx, edi
push eax
call fcn.0040c110
lea ecx, [ebp - 0x464]
call fcn.0040c3a0
lea ecx, [ebp - 0x47c]
call fcn.0040c3a0
lea ecx, [ebp - 0x558]
call fcn.0040c3a0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004177f9
mov esp, ebp
pop ebp
ret
call fcn.0041af8c
call fcn.0041af8c
call fcn.0041af8c
call fcn.0041af8c
call fcn.0040c400
call fcn.0041af8c
call fcn.0041af8c
call fcn.0041af8c
call fcn.0040c400
call fcn.0041af8c
call fcn.0041af8c
call fcn.0041af8c
call fcn.0041af8c
call fcn.0041af8c
call fcn.0041af8c
call fcn.0041af8c
int3