Function at 0x402c10
Capabilities:
Execute command
Persist via winlogon helper dll registry key
Set console window title

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x411fb9
mov eax, dword fs:[0]
push eax
sub esp, 0x338
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1b0], 0
push 0x4150b0
lea eax, [ebp - 0x100]
push eax
call fcn.00401870
add esp, 4
mov dword [ebp - 0x24c], eax
mov ecx, dword [ebp - 0x24c]
mov dword [ebp - 0x218], ecx
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x218]
push edx
push str.mkdir__
lea eax, [ebp - 0x190]
push eax
call fcn.004046f0
add esp, 0xc
mov dword [ebp - 0x220], eax
mov ecx, dword [ebp - 0x220]
mov dword [ebp - 0x228], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x228]
push edx
lea eax, [ebp - 0xd0]
push eax
call fcn.004045f0
add esp, 0xc
mov dword [ebp - 0x230], eax
mov ecx, dword [ebp - 0x230]
call fcn.00406040
push eax
call dword [sym.imp.MSVCR120.dll_system]
add esp, 4
lea ecx, [ebp - 0xd0]
call fcn.00404f80
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x190]
call fcn.00404f80
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x100]
call fcn.00404f80
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x2a8], esp
push str.Xyzabcd.Starter_Started
call fcn.00404d30
mov dword [ebp - 0x2b4], eax
call fcn.004019c0
add esp, 0x18
mov byte [ebp - 0x1b1], 0
mov byte [ebp - 0x1aa], 0
lea ecx, [ebp - 0x1a9]
call fcn.0040fbd0
push 0x4150d4
push 0x4150ec
push 0x80000002
lea ecx, [ebp - 0x1a9]
call fcn.00410000
mov dword [ebp - 0x1b8], eax
push 0x41511c
push 0x415134
push 0x80000002
lea ecx, [ebp - 0x1a9]
call fcn.00410000
mov dword [ebp - 0x1bc], eax
mov ecx, dword [ebp - 0x1b8]
push ecx
lea edx, [ebp - 0x160]
push edx
call fcn.00407220
add esp, 8
mov dword [ebp - 0x238], eax
mov eax, dword [ebp - 0x238]
mov dword [ebp - 0x240], eax
mov dword [ebp - 4], 2
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x2bc], esp
mov edx, dword [ebp - 0x240]
push edx
push str.ResetCount_registry___Old_Value:
push ecx
call fcn.004046f0
add esp, 0xc
mov dword [ebp - 0x2c4], eax
call fcn.004019c0
add esp, 0x18
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x160]
call fcn.00404f80
push str.GhablamWinVersion
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push 0x80000002
lea ecx, [ebp - 0x1a9]
call fcn.0040fd90
mov byte [ebp - 0x1bd], al
cmp dword [ebp - 0x1b8], 5
jl 0x402f38
mov eax, dword [ebp - 0x1b8]
add eax, 1
mov dword [ebp - 0x1b8], eax
mov ecx, dword [ebp - 0x1b8]
push ecx
push 0x4151f4
push 0x41520c
push 0x80000002
lea ecx, [ebp - 0x1a9]
call fcn.00410180
cmp dword [ebp - 0x1bc], 0xffffffff
je 0x402e81
mov edx, dword [ebp - 0x1bc]
add edx, 1
mov dword [ebp - 0x1bc], edx
mov eax, dword [ebp - 0x1bc]
push eax
push 0x41523c
push 0x415254
push 0x80000002
lea ecx, [ebp - 0x1a9]
call fcn.00410180
movzx ecx, byte [ebp - 0x1bd]
test ecx, ecx
je 0x402eaf
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x2cc], esp
push str.Start_Xyzabcd_Agent___Result_:_Failed___Reson_:_Xyzabcd_Reset_Count_is_High_and_Ghablam_Registry_key_is_exist___Next_:_Exiting...
call fcn.00404d30
mov dword [ebp - 0x2d4], eax
call fcn.004019c0
add esp, 0x18
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x2dc], esp
push 0x4152fc
call fcn.00404d30
mov dword [ebp - 0x2e4], eax
call fcn.00401bb0
add esp, 0x18
mov byte [ebp - 0x1cc], al
mov dl, byte [ebp - 0x1cc]
mov byte [ebp - 0x1aa], dl
push 0x415338
call dword [sym.imp.MSVCR120.dll_system]
add esp, 4
movzx eax, byte [ebp - 0x1aa]
test eax, eax
jne 0x402f33
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x2ec], esp
push 0x415358
call fcn.00404d30
mov dword [ebp - 0x2f4], eax
call fcn.004019c0
add esp, 0x18
push 0x415388
call dword [sym.imp.MSVCR120.dll_system]
add esp, 4
call fcn.00402850
jmp 0x4030d6
cmp dword [ebp - 0x1bc], 5
jl 0x40302f
mov ecx, dword [ebp - 0x1bc]
add ecx, 1
mov dword [ebp - 0x1bc], ecx
mov edx, dword [ebp - 0x1bc]
push edx
push 0x41538c
push 0x4153a4
push 0x80000002
lea ecx, [ebp - 0x1a9]
call fcn.00410180
cmp dword [ebp - 0x1b8], 0xffffffff
je 0x402fae
mov eax, dword [ebp - 0x1b8]
add eax, 1
mov dword [ebp - 0x1b8], eax
mov ecx, dword [ebp - 0x1b8]
push ecx
push 0x4153c8
push 0x4153e0
push 0x80000002
lea ecx, [ebp - 0x1a9]
call fcn.00410180
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x2fc], esp
push str.C:Program_FilesXyzabcd_Agentconfigsimages_suspend.jpg
call fcn.00404d30
mov dword [ebp - 0x304], eax
call fcn.00401bb0
add esp, 0x18
mov byte [ebp - 0x1ca], al
mov dl, byte [ebp - 0x1ca]
mov byte [ebp - 0x1aa], dl
push str.taskkill__f__im_explorer.exe
call dword [sym.imp.MSVCR120.dll_system]
add esp, 4
movzx eax, byte [ebp - 0x1aa]
test eax, eax
jne 0x40302a
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x30c], esp
push str.ATM_Restarted_Manay_Time...._nCall_to_Center....
call fcn.00404d30
mov dword [ebp - 0x314], eax
call fcn.004019c0
add esp, 0x18
push 0xea60
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4030d6
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x31c], esp
push 0x41440d
call fcn.00404d30
mov dword [ebp - 0x324], eax
call fcn.00401bb0
add esp, 0x18
mov byte [ebp - 0x1cb], al
mov cl, byte [ebp - 0x1cb]
mov byte [ebp - 0x1aa], cl
cmp dword [ebp - 0x1b8], 0xffffffff
je 0x40309d
mov edx, dword [ebp - 0x1b8]
add edx, 1
mov dword [ebp - 0x1b8], edx
mov eax, dword [ebp - 0x1b8]
push eax
push 0x41549c
push 0x4154b4
push 0x80000002
lea ecx, [ebp - 0x1a9]
call fcn.00410180
cmp dword [ebp - 0x1bc], 0xffffffff
je 0x4030d6
mov ecx, dword [ebp - 0x1bc]
add ecx, 1
mov dword [ebp - 0x1bc], ecx
mov edx, dword [ebp - 0x1bc]
push edx
push str.ResetCount
push str.SOFTWAREAbcdefgh
push 0x80000002
lea ecx, [ebp - 0x1a9]
call fcn.00410180
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov dword [ebp - 0x248], eax
push str.Supervisor
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov dword [ebp - 0x1dc], 0xa
jmp 0x403108
mov eax, dword [ebp - 0x1dc]
sub eax, 1
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 0
jl 0x403135
push 0x400
mov ecx, dword [ebp - 0x1dc]
push ecx
push 0
mov edx, dword [ebp - 0x248]
push edx
call dword [sym.imp.USER32.dll_GetSystemMenu]
push eax
call dword [sym.imp.USER32.dll_DeleteMenu]
jmp 0x4030f9
movzx eax, byte [ebp - 0x1bd]
test eax, eax
jne 0x403a30
push str.Shell
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push 0x80000002
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x1a9]
call fcn.0040fe30
mov dword [ebp - 4], 3
sub esp, 0x18
mov edx, esp
mov dword [ebp - 0x32c], esp
lea eax, [ebp - 0x28]
push eax
push str.Shell_registry___Old_Value:
push edx
call fcn.00404730
add esp, 0xc
mov dword [ebp - 0x334], eax
call fcn.004019c0
add esp, 0x18
push 0x2c
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x33c], esp
lea edx, [ebp - 0x28]
push edx
call fcn.00404c90
mov dword [ebp - 0x344], eax
lea eax, [ebp - 0x1fc]
push eax
call fcn.0040c9b0
add esp, 0x20
mov dword [ebp - 0x330], eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x28]
call fcn.004060c0
mov dword [ebp - 0x1c4], 0
jmp 0x4031ec
mov ecx, dword [ebp - 0x1c4]
add ecx, 1
mov dword [ebp - 0x1c4], ecx
lea ecx, [ebp - 0x1fc]
call fcn.004071a0
cmp dword [ebp - 0x1c4], eax
jae 0x4037ed
mov dword [ebp - 0x1d4], 0
mov dword [ebp - 0x1e0], 0
mov dword [ebp - 0x1d8], 0
jmp 0x403232
mov edx, dword [ebp - 0x1d8]
add edx, 1
mov dword [ebp - 0x1d8], edx
mov eax, dword [ebp - 0x1c4]
push eax
lea ecx, [ebp - 0x1fc]
call fcn.00405330
mov ecx, eax
call fcn.00406970
cmp dword [ebp - 0x1d8], eax
jae 0x403290
mov ecx, dword [ebp - 0x1d8]
push ecx
mov edx, dword [ebp - 0x1c4]
push edx
lea ecx, [ebp - 0x1fc]
call fcn.00405330
mov ecx, eax
call fcn.00405310
movsx eax, byte [eax]
cmp eax, 0x20
jne 0x40328c
mov ecx, dword [ebp - 0x1d4]
add ecx, 1
mov dword [ebp - 0x1d4], ecx
jmp 0x40328e
jmp 0x403290
jmp 0x403223
mov edx, dword [ebp - 0x1c4]
push edx
lea ecx, [ebp - 0x1fc]
call fcn.00405330
mov ecx, eax
call fcn.00406970
sub eax, 1
mov dword [ebp - 0x1d0], eax
jmp 0x4032c3
mov eax, dword [ebp - 0x1d0]
sub eax, 1
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 0
jl 0x403309
mov ecx, dword [ebp - 0x1d0]
push ecx
mov edx, dword [ebp - 0x1c4]
push edx
lea ecx, [ebp - 0x1fc]
call fcn.00405330
mov ecx, eax
call fcn.00405310
movsx eax, byte [eax]
cmp eax, 0x20
jne 0x403305
mov ecx, dword [ebp - 0x1e0]
add ecx, 1
mov dword [ebp - 0x1e0], ecx
jmp 0x403307
jmp 0x403309
jmp 0x4032b4
mov edx, dword [ebp - 0x1c4]
push edx
lea ecx, [ebp - 0x1fc]
call fcn.00405330
mov ecx, eax
call fcn.00406970
mov ecx, dword [ebp - 0x1d4]
add ecx, dword [ebp - 0x1e0]
sub eax, ecx
push eax
mov edx, dword [ebp - 0x1d4]
push edx
lea eax, [ebp - 0x40]
push eax
mov ecx, dword [ebp - 0x1c4]
push ecx
lea ecx, [ebp - 0x1fc]
call fcn.00405330
mov ecx, eax
call fcn.004071c0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x40]
call fcn.00406970
cmp eax, 3
jae 0x403377
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x40]
call fcn.00404f80
jmp 0x4031dd
push 0
push str.yass
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x29c], esp
lea edx, [ebp - 0x40]
push edx
call fcn.00404c90
mov dword [ebp - 0x2f8], eax
lea eax, [ebp - 0x148]
push eax
call fcn.0040c520
add esp, 0x1c
mov dword [ebp - 0x250], eax
mov ecx, dword [ebp - 0x250]
mov dword [ebp - 0x258], ecx
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x1b0]
or edx, 1
mov dword [ebp - 0x1b0], edx
mov ecx, dword [ebp - 0x258]
call fcn.00406540
mov dword [ebp - 0x260], eax
mov eax, dword [ebp - 0x260]
cmp eax, dword [0x415610]
jne 0x4035e3
push 0
push str.irmagent
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x2b0], esp
lea edx, [ebp - 0x40]
push edx
call fcn.00404c90
mov dword [ebp - 0x320], eax
lea eax, [ebp - 0x118]
push eax
call fcn.0040c520
add esp, 0x1c
mov dword [ebp - 0x268], eax
mov ecx, dword [ebp - 0x268]
mov dword [ebp - 0x270], ecx
mov dword [ebp - 4], 7
mov edx, dword [ebp - 0x1b0]
or edx, 2
mov dword [ebp - 0x1b0], edx
mov ecx, dword [ebp - 0x270]
call fcn.00406540
mov dword [ebp - 0x278], eax
mov eax, dword [ebp - 0x278]
cmp eax, dword [0x415610]
jne 0x4035e3
push 0
push str.decide
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x2b8], esp
lea edx, [ebp - 0x40]
push edx
call fcn.00404c90
mov dword [ebp - 0x300], eax
lea eax, [ebp - 0xe8]
push eax
call fcn.0040c520
add esp, 0x1c
mov dword [ebp - 0x280], eax
mov ecx, dword [ebp - 0x280]
mov dword [ebp - 0x288], ecx
mov dword [ebp - 4], 8
mov edx, dword [ebp - 0x1b0]
or edx, 4
mov dword [ebp - 0x1b0], edx
mov ecx, dword [ebp - 0x288]
call fcn.00406540
mov dword [ebp - 0x290], eax
mov eax, dword [ebp - 0x290]
cmp eax, dword [0x415610]
jne 0x4035e3
push 0
push str.startup2.bat
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x2c0], esp
lea edx, [ebp - 0x40]
push edx
call fcn.00404c90
mov dword [ebp - 0x340], eax
lea eax, [ebp - 0xb8]
push eax
call fcn.0040c520
add esp, 0x1c
mov dword [ebp - 0x28c], eax
mov ecx, dword [ebp - 0x28c]
mov dword [ebp - 0x208], ecx
mov dword [ebp - 4], 9
mov edx, dword [ebp - 0x1b0]
or edx, 8
mov dword [ebp - 0x1b0], edx
mov ecx, dword [ebp - 0x208]
call fcn.00406540
mov dword [ebp - 0x204], eax
mov eax, dword [ebp - 0x204]
cmp eax, dword [0x415610]
jne 0x4035e3
push 0
push str.tpdrv
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x2c8], esp
lea edx, [ebp - 0x40]
push edx
call fcn.00404c90
mov dword [ebp - 0x308], eax
lea eax, [ebp - 0x88]
push eax
call fcn.0040c520
add esp, 0x1c
mov dword [ebp - 0x20c], eax
mov ecx, dword [ebp - 0x20c]
mov dword [ebp - 0x210], ecx
mov dword [ebp - 4], 0xa
mov edx, dword [ebp - 0x1b0]
or edx, 0x10
mov dword [ebp - 0x1b0], edx
mov ecx, dword [ebp - 0x210]
call fcn.00406540
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
cmp eax, dword [0x415610]
jne 0x4035e3
mov dword [ebp - 0x1e4], 0
jmp 0x4035ed
mov dword [ebp - 0x1e4], 1
mov cl, byte [ebp - 0x1e4]
mov byte [ebp - 0x1c9], cl
mov dword [ebp - 4], 9
mov edx, dword [ebp - 0x1b0]
and edx, 0x10
je 0x40361d
and dword [ebp - 0x1b0], 0xffffffef
lea ecx, [ebp - 0x88]
call fcn.00404f80
mov dword [ebp - 4], 8
mov eax, dword [ebp - 0x1b0]
and eax, 8
je 0x403641
and dword [ebp - 0x1b0], 0xfffffff7
lea ecx, [ebp - 0xb8]
call fcn.00404f80
mov dword [ebp - 4], 7
mov ecx, dword [ebp - 0x1b0]
and ecx, 4
je 0x403665
and dword [ebp - 0x1b0], 0xfffffffb
lea ecx, [ebp - 0xe8]
call fcn.00404f80
mov dword [ebp - 4], 6
mov edx, dword [ebp - 0x1b0]
and edx, 2
je 0x403689
and dword [ebp - 0x1b0], 0xfffffffd
lea ecx, [ebp - 0x118]
call fcn.00404f80
mov dword [ebp - 4], 5
mov eax, dword [ebp - 0x1b0]
and eax, 1
je 0x4036ad
and dword [ebp - 0x1b0], 0xfffffffe
lea ecx, [ebp - 0x148]
call fcn.00404f80
movzx ecx, byte [ebp - 0x1c9]
test ecx, ecx
je 0x4036d7
mov byte [ebp - 0x1b1], 1
mov byte [ebp - 0x1aa], 1
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x40]
call fcn.00404f80
jmp 0x4031dd
push 0
push str.xyzabcd
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x2d0], esp
lea edx, [ebp - 0x40]
push edx
call fcn.00404c90
mov dword [ebp - 0x328], eax
lea eax, [ebp - 0x178]
push eax
call fcn.0040c520
add esp, 0x1c
mov dword [ebp - 0x254], eax
mov ecx, dword [ebp - 0x254]
mov dword [ebp - 0x21c], ecx
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x21c]
call fcn.00406540
mov dword [ebp - 0x274], eax
mov edx, dword [ebp - 0x274]
cmp edx, dword [0x415610]
je 0x403748
mov dword [ebp - 0x1ec], 1
jmp 0x403752
mov dword [ebp - 0x1ec], 0
mov al, byte [ebp - 0x1ec]
mov byte [ebp - 0x1c6], al
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x178]
call fcn.00404f80
movzx ecx, byte [ebp - 0x1c6]
test ecx, ecx
je 0x403790
mov byte [ebp - 0x1b1], 1
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x40]
call fcn.00404f80
jmp 0x4031dd
push 0x414d84
lea edx, [ebp - 0x40]
push edx
lea eax, [ebp - 0x1a8]
push eax
call fcn.00404630
add esp, 0xc
mov dword [ebp - 0x224], eax
mov ecx, dword [ebp - 0x224]
mov dword [ebp - 0x25c], ecx
mov byte [ebp - 4], 0xc
mov edx, dword [ebp - 0x25c]
push edx
lea ecx, [ebp - 0x28]
call fcn.00405400
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x1a8]
call fcn.00404f80
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x40]
call fcn.00404f80
jmp 0x4031dd
push 0
push 0x414dc4
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x2d8], esp
lea eax, [ebp - 0x28]
push eax
call fcn.00404c90
mov dword [ebp - 0x310], eax
lea ecx, [ebp - 0xa0]
push ecx
call fcn.0040c520
add esp, 0x1c
mov dword [ebp - 0x22c], eax
mov edx, dword [ebp - 0x22c]
mov dword [ebp - 0x284], edx
mov byte [ebp - 4], 0xd
mov ecx, dword [ebp - 0x284]
call fcn.00406540
mov dword [ebp - 0x234], eax
mov eax, dword [ebp - 0x234]
cmp eax, dword [0x415610]
jne 0x40385e
mov dword [ebp - 0x1f0], 1
jmp 0x403868
mov dword [ebp - 0x1f0], 0
mov cl, byte [ebp - 0x1f0]
mov byte [ebp - 0x1c8], cl
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xa0]
call fcn.00404f80
movzx edx, byte [ebp - 0x1c8]
test edx, edx
je 0x4038d4
lea eax, [ebp - 0x28]
push eax
push str.explorer.exe_
lea ecx, [ebp - 0x130]
push ecx
call fcn.00404730
add esp, 0xc
mov dword [ebp - 0x264], eax
mov edx, dword [ebp - 0x264]
push edx
lea ecx, [ebp - 0x28]
call fcn.004050f0
lea ecx, [ebp - 0x130]
call fcn.00404f80
mov byte [ebp - 0x1b1], 1
mov byte [ebp - 0x1aa], 1
push 0
push str.Xyzabcd.Starter.exe
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x2e0], esp
lea eax, [ebp - 0x28]
push eax
call fcn.00404c90
mov dword [ebp - 0x338], eax
lea ecx, [ebp - 0x58]
push ecx
call fcn.0040c520
add esp, 0x1c
mov dword [ebp - 0x23c], eax
mov edx, dword [ebp - 0x23c]
mov dword [ebp - 0x27c], edx
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x27c]
call fcn.00406540
mov dword [ebp - 0x244], eax
mov eax, dword [ebp - 0x244]
cmp eax, dword [0x415610]
jne 0x403942
mov dword [ebp - 0x1e8], 1
jmp 0x40394c
mov dword [ebp - 0x1e8], 0
mov cl, byte [ebp - 0x1e8]
mov byte [ebp - 0x1c5], cl
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x58]
call fcn.00404f80
movzx edx, byte [ebp - 0x1c5]
test edx, edx
je 0x4039a8
push str.C:Program_FilesXyzabcd_AgentXyzabcd.Starter.exe
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x70]
push ecx
call fcn.00404630
add esp, 0xc
mov dword [ebp - 0x26c], eax
mov edx, dword [ebp - 0x26c]
push edx
lea ecx, [ebp - 0x28]
call fcn.004050f0
lea ecx, [ebp - 0x70]
call fcn.00404f80
mov byte [ebp - 0x1b1], 1
movzx eax, byte [ebp - 0x1b1]
test eax, eax
je 0x403a12
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x2e8], esp
lea edx, [ebp - 0x28]
push edx
push str.change_Shell_registry_is_needed___New_Value:
push ecx
call fcn.00404730
add esp, 0xc
mov dword [ebp - 0x318], eax
call fcn.004019c0
add esp, 0x18
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x2f0], esp
lea eax, [ebp - 0x28]
push eax
call fcn.00404c90
mov dword [ebp - 0x2a0], eax
push 0x414eb4
push 0x414f28
push 0x80000002
lea ecx, [ebp - 0x1a9]
call fcn.004102e0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1fc]
call fcn.00404fa0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.00404f80
movzx ecx, byte [ebp - 0x1aa]
test ecx, ecx
je 0x403a40
call fcn.00401b30
push 0x404aa0
push str.Starting_Xyzabcd_Starter__Please_Wait_...
mov edx, dword [sym.imp.MSVCP120.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push edx
call fcn.004040f0
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP120.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
push 0xea60
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x1c7]
call fcn.00407330
lea ecx, [ebp - 0x1c7]
call fcn.00407340
lea ecx, [ebp - 0x298]
call fcn.00409b30
mov dword [ebp - 4], 0xf
lea ecx, [ebp - 0x298]
call fcn.00409c00
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x2a4], esp
push 0x414fc0
call fcn.00404d30
mov dword [ebp - 0x2ac], eax
call fcn.004019c0
add esp, 0x18
push 0x404aa0
push str.Xyzabcd_Starter_Finished__Please_Wait_...
mov eax, dword [sym.imp.MSVCP120.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
push eax
call fcn.004040f0
add esp, 8
mov ecx, eax
call dword [sym.imp.MSVCP120.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov dword [ebp - 0x200], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x298]
call fcn.00409b50
mov eax, dword [ebp - 0x200]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004113d0
mov esp, ebp
pop ebp
ret