Function at 0x401b30
Capabilities:
Create process on windows
Delete directory
Delete file
Delete registry key
Delete registry value
Delete service
Enumerate files on windows
Get common file path
Get installed programs
Persist via run registry key
Persist via windows service
Query environment variable
Query or enumerate registry value
Read .ini file
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x40a5ec
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xf94
push ebx
push ebp
push esi
mov ebx, ecx
push edi
mov dword [esp + 0x18], ebx
mov byte [esp + 0x13b], 0
mov byte [esp + 0x283], 0
call fcn.00409230
test eax, 0x10000
je 0x401b9a
mov eax, dword [str.AgentAdminExit]
mov ecx, dword [str.Global]
push eax
push ecx
push 0x40d9d0
lea edx, [esp + 0x18c]
push 0x103
push edx
call fcn.004031e4
add esp, 0x14
jmp 0x401bb5
mov eax, dword [str.AgentAdminExit]
push 0x103
lea ecx, [esp + 0x184]
push eax
push ecx
call fcn.00402f30
add esp, 0xc
mov ebp, dword [sym.imp.KERNEL32.dll_CreateEventA]
lea edx, [esp + 0x180]
push edx
push 0
push 1
push 0
call ebp
mov esi, eax
test esi, esi
jne 0x401c10
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [str.AgentAdminExit]
push eax
push 0x40dfc8
lea ecx, [esp + 0x44]
push 0x103
push ecx
call fcn.004031e4
mov edx, dword [0x40b44c]
add esp, 0x14
lea eax, [esp + 0x38]
mov ecx, ebx
push edx
push eax
call fcn.00402cc0
or eax, 0xffffffff
jmp 0x402a01
mov edi, dword [sym.imp.KERNEL32.dll_SetEvent]
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00409230
test eax, 0x10000
je 0x401c56
mov ecx, dword [str.LSMonSvcExit]
mov edx, dword [str.Global]
push ecx
push edx
push 0x40d9d0
lea eax, [esp + 0x18c]
push 0x103
push eax
call fcn.004031e4
add esp, 0x14
jmp 0x401c72
mov ecx, dword [str.LSMonSvcExit]
push 0x103
lea edx, [esp + 0x184]
push ecx
push edx
call fcn.00402f30
add esp, 0xc
lea eax, [esp + 0x180]
push eax
push 0
push 1
push 0
call ebp
mov esi, eax
test esi, esi
jne 0x401cc7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [str.LSMonSvcExit]
push eax
push ecx
push 0x40dfc8
lea edx, [esp + 0x44]
push 0x103
push edx
call fcn.004031e4
mov eax, dword [0x40b44c]
add esp, 0x14
lea ecx, [esp + 0x38]
push eax
push ecx
mov ecx, ebx
call fcn.00402cc0
or eax, 0xffffffff
jmp 0x402a01
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00409230
test eax, 0x10000
je 0x401d06
mov edx, dword [str.LSAgentExit]
mov eax, dword [str.Global]
push edx
push eax
push 0x40d9d0
lea ecx, [esp + 0x18c]
push 0x103
push ecx
call fcn.004031e4
add esp, 0x14
jmp 0x401d22
mov edx, dword [str.LSAgentExit]
push 0x103
lea eax, [esp + 0x184]
push edx
push eax
call fcn.00402f30
add esp, 0xc
lea ecx, [esp + 0x180]
push ecx
push 0
push 1
push 0
call ebp
mov esi, eax
test esi, esi
jne 0x401d78
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [str.LSAgentExit]
push eax
push edx
push 0x40dfc8
lea eax, [esp + 0x44]
push 0x103
push eax
call fcn.004031e4
mov ecx, dword [0x40b44c]
add esp, 0x14
lea edx, [esp + 0x38]
push ecx
push edx
mov ecx, ebx
call fcn.00402cc0
or eax, 0xffffffff
jmp 0x402a01
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00402ce0
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
push 0x1f4
call edi
inc esi
cmp esi, 0x1e
jg 0x401dad
mov eax, dword [str.LSMonSvc.exe]
mov ecx, ebx
push eax
call fcn.00402a20
test al, al
jne 0x401d8f
xor esi, esi
push 0x1f4
call edi
inc esi
cmp esi, 0x1e
jg 0x401dd3
mov ecx, dword [str.LSAgent.exe]
push ecx
mov ecx, ebx
call fcn.00402a20
test al, al
jne 0x401daf
cmp esi, 0x1e
jle 0x401df5
mov edx, dword [str.AgentAdmin.exe]
mov ecx, ebx
push edx
call fcn.00402a20
test al, al
je 0x401df5
mov eax, dword [0x40b44c]
push eax
push str.AgentAdmin
jmp 0x4029f5
mov ecx, dword [str.LSAgent.exe]
push ecx
mov ecx, ebx
call fcn.00402b50
mov edx, dword [str.RegisterInfo.exe]
mov ecx, ebx
push edx
call fcn.00402b50
mov eax, dword [str.LSMonSvc.exe]
mov ecx, ebx
push eax
call fcn.00402b50
lea ecx, [esp + 0xea0]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x4029cb
cmp eax, 0x104
jg 0x4029cb
lea edx, [esp + 0x430]
push 0x104
push edx
push str.windir
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x4029bd
cmp eax, 0x104
jg 0x4029bd
lea eax, [esp + 0x39c]
mov dword [esp + 0x39c], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x401e9d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x40df80
jmp 0x4029d7
mov al, byte [ebx + 0x22]
test al, al
jne 0x401f49
mov eax, dword [esp + 0x3ac]
cmp eax, 1
jne 0x4021be
mov edx, dword [str.SOFTWAREMicrosoftWindowsCurrentVersionRun]
lea ecx, [esp + 0x10]
push ecx
push 0xf003f
push 0
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x401efd
push eax
mov eax, dword [str.SOFTWAREMicrosoftWindowsCurrentVersionRun]
push eax
push 0x40df5c
lea ecx, [esp + 0x44]
push 0x103
push ecx
call fcn.004031e4
add esp, 0x14
jmp 0x4029e9
mov ecx, dword [str.LSAgent]
mov edx, dword [esp + 0x10]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [str.SOFTWAREBaosightlsagent]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push ecx
push 0x80000002
call esi
mov edx, dword [str.SOFTWAREMicrosoftActive_SetupInstalled_ComponentsB6B13EE4_A974_11d2_8DB7_00C04FB6E8F6]
push edx
push 0x80000002
call esi
mov eax, dword [str.SOFTWAREMicrosoftWindowsCurrentVersionUninstalleCop3000LAgent]
push eax
push 0x80000002
call esi
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, 0x41148c
mov edx, dword [esi]
lea eax, [esp + 0x430]
push edx
push eax
push 0x40d9d0
lea ecx, [esp + 0x18c]
push 0x103
push ecx
call fcn.004031e4
add esp, 0x14
lea edx, [esp + 0x180]
push edx
call ebp
add esi, 4
cmp esi, 0x4114a0
jl 0x401f54
lea eax, [esp + 0x430]
lea ecx, [esp + 0x84c]
push eax
push str._sPictureSave
push 0x103
push ecx
call fcn.004031e4
add esp, 0x10
lea edx, [esp + 0xc5c]
lea eax, [esp + 0x84c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40201e
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea ecx, [esp + 0xc88]
lea edx, [esp + 0x430]
push ecx
push edx
push str._sPictureSave_s
lea eax, [esp + 0xda8]
push 0x103
push eax
call fcn.004031e4
add esp, 0x14
lea ecx, [esp + 0xd9c]
push ecx
call ebp
lea edx, [esp + 0xc5c]
push edx
push esi
call edi
cmp eax, 1
je 0x401fd3
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [esp + 0x430]
lea ecx, [esp + 0x84c]
push eax
push 0x40df24
push 0x103
push ecx
call fcn.004031e4
add esp, 0x10
lea edx, [esp + 0x84c]
push edx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
call fcn.00402e40
mov eax, dword [str.eCopClientOcx.ocx]
lea ecx, [esp + 0x180]
push eax
push str.regsvr32__u__s__s
push 0x103
push ecx
call fcn.004031e4
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x14c]
xor edx, edx
rep stosd dword es:[edi], eax
mov dword [esp + 0x38], edx
add esp, 0x10
mov word [esp + 0x16c], ax
mov dword [esp + 0x2c], edx
lea eax, [esp + 0x28]
lea ecx, [esp + 0x13c]
mov dword [esp + 0x30], edx
push eax
push ecx
push edx
push edx
push edx
push edx
push edx
push edx
mov dword [esp + 0x54], edx
push edx
lea edx, [esp + 0x1a4]
push edx
mov dword [esp + 0x164], 0x44
mov dword [esp + 0x190], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4020fa
mov eax, dword [esp + 0x28]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 0x28]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0x2c]
push edx
call esi
cmp dword [esp + 0x3ac], 2
jne 0x402148
mov ecx, dword [str.BSProMon]
lea eax, [esp + 0x1c]
push eax
push ecx
call fcn.00402d70
add esp, 8
call fcn.00409230
cmp eax, 0x10600
jae 0x402148
mov eax, dword [str.BSFsFltr]
lea edx, [esp + 0x1c]
push edx
push eax
call fcn.00402d70
mov edx, dword [str.BSNetControl]
lea ecx, [esp + 0x24]
push ecx
push edx
call fcn.00402d70
add esp, 0x10
mov esi, 0x4114a0
mov eax, dword [esi]
lea ecx, [esp + 0xea0]
push eax
push ecx
push 0x40d9d0
lea edx, [esp + 0x18c]
push 0x103
push edx
call fcn.004031e4
add esp, 0x14
lea eax, [esp + 0x180]
push eax
call ebp
add esi, 4
cmp esi, 0x4114d8
jl 0x40214d
mov eax, dword [esp + 0x3ac]
cmp eax, 1
jne 0x4026e9
lea ecx, [esp + 0x430]
lea edx, [esp + 0x950]
push ecx
push str._sDesktop
push 0x103
push edx
call fcn.004031e4
add esp, 0x10
jmp 0x4027d0
cmp eax, 2
jne 0x401f49
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
jne 0x4021ed
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x40dee0
jmp 0x4029d7
mov ecx, dword [str.LSAgent]
push 0xf01ff
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
test edi, edi
je 0x40226c
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x402269
call ebx
cmp eax, 0x430
je 0x402269
call ebx
mov edx, dword [str.LSAgent]
push eax
push edx
push 0x40dec0
lea eax, [esp + 0x44]
push 0x103
push eax
call fcn.004031e4
mov ecx, dword [0x40b44c]
add esp, 0x14
lea edx, [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x1c]
push edx
call fcn.00402cc0
push edi
mov edi, ebp
call edi
push esi
call edi
jmp 0x4029fc
push edi
call ebp
mov eax, dword [str.LSMonSvc]
push 0xf01ff
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
je 0x4022db
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x4022d8
call ebx
cmp eax, 0x430
je 0x4022d8
call ebx
mov ecx, dword [str.LSMonSvc]
push eax
push ecx
push 0x40dec0
lea edx, [esp + 0x44]
push 0x103
push edx
call fcn.004031e4
mov eax, dword [0x40b44c]
add esp, 0x14
lea ecx, [esp + 0x38]
push eax
push ecx
mov ecx, dword [esp + 0x20]
call fcn.00402cc0
push edi
call ebp
push esi
call ebp
jmp 0x4029fc
push edi
call ebp
push esi
call ebp
mov edx, dword [str.SYSTEMCurrentControlSetServicesEventLogApplicationLSAgent]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push edx
push 0x80000002
call esi
mov eax, dword [str.SYSTEMCurrentControlSetServicesEventLogApplicationLSMonSvc]
push eax
push 0x80000002
call esi
mov edx, dword [str.SYSTEMCurrentControlSetServicesEventLogApplication]
lea ecx, [esp + 0x10]
push ecx
push 0xf003f
push 0
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x402354
push eax
mov eax, dword [str.SYSTEMCurrentControlSetServicesEventLogApplication]
push eax
push 0x40df5c
lea ecx, [esp + 0x44]
push 0x103
push ecx
call fcn.004031e4
mov edx, dword [0x40b44c]
mov ecx, dword [esp + 0x2c]
add esp, 0x14
lea eax, [esp + 0x38]
push edx
push eax
jmp 0x4029f7
mov edx, dword [str.Sources]
mov eax, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
push 0
push edx
push eax
call edi
test eax, eax
jne 0x4026af
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x4026af
lea ecx, [esp + 0x284]
call fcn.0040a420
lea ecx, [esp + 0x638]
mov dword [esp + 0xfac], 0
call fcn.0040a420
mov ecx, dword [esp + 0x14]
mov byte [esp + 0xfac], 1
push ecx
lea ecx, [esp + 0x288]
call fcn.0040a460
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x638]
push edx
mov esi, eax
call fcn.0040a460
mov edx, dword [str.Sources]
mov ebx, eax
lea eax, [esp + 0x14]
lea ecx, [esp + 0x20]
push eax
mov eax, dword [esp + 0x14]
push esi
push ecx
push 0
push edx
push eax
mov dword [esp + 0x3c], ebx
call edi
test eax, eax
jne 0x40263a
cmp dword [esp + 0x20], 7
jne 0x40263a
mov dword [esp + 0x1c], eax
mov al, byte [esi]
test al, al
mov ebp, esi
mov edx, ebx
je 0x402568
mov esi, dword [str.LSAgent]
mov eax, ebp
mov bl, byte [eax]
mov cl, bl
cmp bl, byte [esi]
jne 0x402448
test cl, cl
je 0x402444
mov bl, byte [eax + 1]
mov cl, bl
cmp bl, byte [esi + 1]
jne 0x402448
add eax, 2
add esi, 2
test cl, cl
jne 0x402424
xor eax, eax
jmp 0x40244d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4024b7
mov esi, dword [str.LSMonSvc]
mov eax, ebp
mov bl, byte [eax]
mov cl, bl
cmp bl, byte [esi]
jne 0x40247d
test cl, cl
je 0x402479
mov bl, byte [eax + 1]
mov cl, bl
cmp bl, byte [esi + 1]
jne 0x40247d
add eax, 2
add esi, 2
test cl, cl
jne 0x402459
xor eax, eax
jmp 0x402482
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4024b7
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [edx + ecx + 1]
jmp 0x4024da
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
mov dword [esp + 0x1c], 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
or eax, 0xffffffff
sub eax, ecx
mov ecx, dword [esp + 0x14]
add ecx, eax
mov dword [esp + 0x14], ecx
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov al, byte [ecx + ebp + 1]
lea ebp, [ecx + ebp + 1]
test al, al
jne 0x40241c
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x402568
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
push ecx
mov ecx, dword [str.Sources]
push edx
mov edx, dword [esp + 0x18]
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x402568
mov ecx, dword [str.SYSTEMCurrentControlSetServicesEventLogApplication]
push eax
mov eax, dword [str.Sources]
lea edx, [esp + 0x3c]
push eax
push ecx
push 0x40de94
push 0x103
push edx
call fcn.004031e4
mov eax, dword [0x40b44c]
add esp, 0x18
lea ecx, [esp + 0x38]
push eax
push ecx
mov ecx, dword [esp + 0x20]
call fcn.00402cc0
mov edx, dword [esp + 0x10]
push edx
jmp 0x402679
mov eax, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call edi
mov ecx, dword [str.SOFTWAREBaosightlsagent]
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
push ecx
push 0x80000002
call esi
mov edx, dword [str.SOFTWAREMicrosoftActive_SetupInstalled_ComponentsB6B13EE4_A974_11d2_8DB7_00C04FB6E8F6]
push edx
push 0x80000002
call esi
mov eax, dword [str.SOFTWAREMicrosoftWindowsCurrentVersionUninstalleCop3000LAgent]
push eax
push 0x80000002
call esi
mov ecx, dword [str.SOFTWAREPoliciesMicrosoftWindowsWindowsUpdate]
push ecx
push 0x80000002
call esi
mov eax, dword [str.SOFTWAREMicrosoftWindowsCurrentVersionRun]
lea edx, [esp + 0x10]
push edx
push 0xf003f
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4025ec
mov ecx, dword [0x40b3dc]
mov edx, dword [esp + 0x10]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [esp + 0x10]
push eax
call edi
mov edi, 0x411578
mov ecx, dword [edi]
push ecx
push 0x80000002
call esi
add edi, 4
cmp edi, 0x411590
jl 0x4025f1
lea ecx, [esp + 0x638]
mov byte [esp + 0xfac], 0
call fcn.0040a450
lea ecx, [esp + 0x284]
mov dword [esp + 0xfac], 0xffffffff
call fcn.0040a450
mov ebx, dword [esp + 0x18]
jmp 0x401f49
mov edx, dword [str.Sources]
push eax
mov eax, dword [str.SYSTEMCurrentControlSetServicesEventLogApplication]
push edx
push eax
push 0x40de68
lea ecx, [esp + 0x48]
push 0x103
push ecx
call fcn.004031e4
mov edx, dword [0x40b44c]
mov ecx, dword [esp + 0x30]
add esp, 0x18
lea eax, [esp + 0x38]
push edx
push eax
call fcn.00402cc0
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x638]
mov byte [esp + 0xfac], 0
call fcn.0040a450
lea ecx, [esp + 0x284]
mov dword [esp + 0xfac], 0xffffffff
call fcn.0040a450
jmp 0x4029fc
mov edx, dword [str.Sources]
push eax
mov eax, dword [str.SYSTEMCurrentControlSetServicesEventLogApplication]
push edx
push eax
push 0x40de38
lea ecx, [esp + 0x48]
push 0x103
push ecx
call fcn.004031e4
mov edx, dword [0x40b44c]
mov ecx, dword [esp + 0x30]
add esp, 0x18
lea eax, [esp + 0x38]
push edx
push eax
jmp 0x4027b0
cmp eax, 2
jne 0x4027d0
mov ecx, dword [str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders]
lea eax, [esp + 0x10]
push eax
push 0xf003f
push 0
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x402744
mov edx, dword [str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders]
push eax
push edx
push 0x40df5c
lea eax, [esp + 0x44]
push 0x103
push eax
call fcn.004031e4
mov ecx, dword [0x40b44c]
add esp, 0x14
lea edx, [esp + 0x38]
push ecx
push edx
jmp 0x4029f5
lea eax, [esp + 0x14]
lea ecx, [esp + 0x950]
push eax
mov eax, dword [str.Common_Desktop]
lea edx, [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x18]
push edx
push 0
push eax
push ecx
mov dword [esp + 0x38], 1
mov dword [esp + 0x2c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4027c5
mov edx, dword [str.Common_Desktop]
push eax
mov eax, dword [str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders]
push edx
push eax
push 0x40de68
lea ecx, [esp + 0x48]
push 0x103
push ecx
call fcn.004031e4
mov edx, dword [0x40b44c]
add esp, 0x18
lea eax, [esp + 0x38]
mov ecx, ebx
push edx
push eax
call fcn.00402cc0
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4029fc
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0xa54]
lea edx, [esp + 0x534]
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0xb58]
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x534]
rep stosd dword es:[edi], eax
mov eax, dword [str.AgentSetUpFile.INI]
lea ecx, [esp + 0x430]
push eax
push ecx
push 0x40d9d0
push 0x103
push edx
call fcn.004031e4
add esp, 0x14
lea eax, [esp + 0x534]
push eax
push 0
push str.count
push str.ShortCut
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov edi, eax
xor esi, esi
test edi, edi
jle 0x4028ca
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push esi
push str.shortcut_d
lea ecx, [esp + 0xa5c]
push 0x103
push ecx
call fcn.004031e4
add esp, 0x10
lea edx, [esp + 0x534]
lea eax, [esp + 0xb58]
lea ecx, [esp + 0xa54]
push edx
push 0x104
push eax
push 0
push ecx
push str.ShortCut
call ebx
lea edx, [esp + 0xb58]
lea eax, [esp + 0x950]
push edx
push eax
push 0x40d9d0
lea ecx, [esp + 0x18c]
push 0x103
push ecx
call fcn.004031e4
add esp, 0x14
lea edx, [esp + 0x180]
push edx
call ebp
inc esi
cmp esi, edi
jl 0x402850
lea eax, [esp + 0x534]
push eax
call ebp
call fcn.00409230
cmp eax, 0x10501
jb 0x402950
call fcn.00409230
cmp eax, 0x10503
jae 0x402950
lea ecx, [esp + 0x284]
call fcn.004097f0
lea ecx, [esp + 0x284]
mov dword [esp + 0xfac], 2
call fcn.00409950
test eax, eax
jl 0x402932
push 0x2ee2
push 6
lea ecx, [esp + 0x28c]
call fcn.00409d80
lea ecx, [esp + 0x284]
call fcn.00409a00
lea ecx, [esp + 0x284]
mov dword [esp + 0xfac], 0xffffffff
call fcn.004098e0
xor eax, eax
jmp 0x402a01
call fcn.00409230
cmp eax, 0x10503
jb 0x4029b9
lea ecx, [esp + 0x744]
call fcn.00409470
lea ecx, [esp + 0x744]
mov dword [esp + 0xfac], 3
call fcn.00409500
test eax, eax
jl 0x4029a2
push 6
push 0x2ee2
lea ecx, [esp + 0x74c]
call fcn.00409640
lea ecx, [esp + 0x744]
call fcn.00409610
lea ecx, [esp + 0x744]
mov dword [esp + 0xfac], 0xffffffff
call fcn.004094e0
xor eax, eax
jmp 0x402a01
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x40ddf4
jmp 0x4029d7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x40ddd0
lea ecx, [esp + 0x40]
push 0x103
push ecx
call fcn.004031e4
add esp, 0x10
mov edx, dword [0x40b44c]
lea eax, [esp + 0x38]
push edx
push eax
mov ecx, ebx
call fcn.00402cc0
mov eax, 1
mov ecx, dword [esp + 0xfa4]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xfa0
ret