Function at 0x40bdd0
Capabilities:
Create process on windows
Delete file
Get common file path
Hide graphical window
Query or enumerate registry value
Read .ini file
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x6aec
call fcn.005cd2a0
push ebx
push esi
push edi
push 1
call fcn.005c08d0
mov eax, dword [0x708598]
mov ebx, dword [ebp + 0x10]
add esp, 4
xor esi, esi
cmp eax, 5
jne 0x40c102
xor eax, eax
xor ecx, ecx
mov dword [0x719a18], eax
xor edx, edx
mov dword [0x7199f4], ecx
mov dword [0x719a1c], eax
mov dword [0x7192f4], edx
mov dword [0x7199f8], ecx
mov dword [0x719a20], eax
mov dword [0x7192f8], edx
mov dword [0x7199fc], ecx
mov dword [0x719a24], eax
mov dword [0x7192fc], edx
mov dword [0x719a00], ecx
mov dword [0x719a28], eax
mov dword [0x719300], edx
mov dword [0x719a04], ecx
mov dword [0x719a2c], eax
mov dword [0x719304], edx
mov dword [0x719a08], ecx
mov dword [0x719a30], eax
mov dword [0x719308], edx
mov dword [0x719a34], eax
mov dword [0x719a0c], ecx
mov dword [0x71930c], edx
mov word [0x719a38], ax
mov dword [0x719a10], ecx
mov dword [0x719310], edx
mov word [0x719a14], cx
mov word [0x719314], dx
mov byte [0x719a16], cl
mov byte [0x719316], dl
mov ecx, 0x400
lea edi, [esp + 0xaf8]
lea edx, [esp + 0xaf8]
mov byte [0x719a3a], al
rep stosd dword es:[edi], eax
mov eax, ebx
sub edx, ebx
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40bed0
xor eax, eax
mov ecx, 0x1400
lea edi, [esp + 0x1af8]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xaf8]
push 0x6bc6f0
push eax
call fcn.005ce160
add esp, 8
xor ebx, ebx
cmp eax, esi
je 0x40bf40
lea edi, [esp + 0x1af8]
lea esp, [esp]
mov edx, edi
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40bf14
push 0x6bc6f0
push esi
call fcn.005ce160
add esp, 8
inc ebx
add edi, 0x1000
cmp eax, esi
jne 0x40bf10
cmp ebx, 4
jge 0x40c0a8
lea ecx, [esp + 0x68]
call fcn.0040abc0
push 0xa
mov edi, 0xf
push str.CONFIG.INI
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], esi
mov byte [esp + 0x24], 0
call fcn.00405710
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x6c]
call fcn.005c0ee0
mov eax, dword [esp + 0x30]
mov ebx, 0x10
cmp eax, ebx
jb 0x40bf93
mov edx, dword [esp + 0x1c]
push edx
call fcn.005cc620
add esp, 4
push 5
push str.LOGIN
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], esi
mov byte [esp + 0x24], 0
call fcn.00405710
push 0xffffffffffffffff
push esi
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x90]
call fcn.00405620
cmp dword [esp + 0x30], ebx
jb 0x40bfd7
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.005cc620
add esp, 4
push 0x10
push str.INTERNAL_TEST_IP
lea ecx, [esp + 0x20]
mov dword [esp + 0x54], edi
mov dword [esp + 0x50], esi
mov byte [esp + 0x40], 0
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], esi
mov byte [esp + 0x24], 0
call fcn.00405710
push 0x7085c4
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x74]
call fcn.005c0de0
mov bl, al
mov eax, dword [esp + 0x30]
neg bl
sbb bl, bl
inc bl
cmp eax, 0x10
jb 0x40c037
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.005cc620
add esp, 4
test bl, bl
je 0x40c041
push esi
call fcn.005ce120
cmp dword [esp + 0x4c], 0x10
mov esi, dword [esp + 0x38]
jae 0x40c050
lea esi, [esp + 0x38]
mov edi, str.TAIWAN
mov ecx, 7
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x40c072
push edx
push str.TAIWAN
push str.INTERNAL_TEST_VERSION
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp dword [esp + 0x4c], 0x10
jb 0x40c086
mov eax, dword [esp + 0x38]
push eax
call fcn.005cc620
add esp, 4
lea ecx, [esp + 0x68]
mov dword [esp + 0x4c], 0xf
mov dword [esp + 0x48], 0
mov byte [esp + 0x38], 0
call fcn.004c1760
xor esi, esi
jmp 0x40c102
xor eax, eax
lea ebx, [ebx]
mov cl, byte [esp + eax + 0x3af8]
mov byte [eax + 0x719a18], cl
inc eax
test cl, cl
jne 0x40c0b0
xor eax, eax
jmp 0x40c0d0
mov cl, byte [esp + eax + 0x4af8]
mov byte [eax + 0x7199f4], cl
inc eax
test cl, cl
jne 0x40c0d0
xor eax, eax
jmp 0x40c0f0
mov cl, byte [esp + eax + 0x5af8]
mov byte [eax + 0x7192f4], cl
inc eax
test cl, cl
jne 0x40c0f0
cmp dword [0x708598], 1
jne 0x40c1d1
push esi
push 0x10
lea ecx, [esp + 0x9f8]
push ecx
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x40c1d1
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0xe8]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x9f0]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c143
sub eax, edx
lea edx, [eax - 1]
cmp edx, esi
jl 0x40c161
mov al, 0x5c
cmp byte [esp + edx + 0x9f0], al
je 0x40c161
dec edx
jns 0x40c155
lea eax, [esp + 0x9f0]
lea esi, [eax + 1]
jmp 0x40c170
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c170
sub eax, esi
mov ecx, eax
sub ecx, edx
lea esi, [esp + edx + 0x9f1]
mov edx, ecx
shr ecx, 2
lea edi, [esp + 0xe8]
rep movsd dword es:[edi], dword [esi]
push 4
mov ecx, edx
lea eax, [esp + 0xec]
and ecx, 3
push 0x6bc6d0
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.005cdf60
add esp, 0xc
test eax, eax
jne 0x40c1d1
push eax
push str.Error___
push str.Korea_Version
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [0x708598], 4
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
jne 0x40c3b7
xor eax, eax
mov ecx, 0x200
lea edi, [esp + 0xaf8]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xaf8]
push ecx
push 0x800
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea edx, [esp + 0xaf8]
push edx
lea eax, [esp + 0x1f4]
push str._sDataItemItem.SData
push eax
call fcn.005cd489
add esp, 0xc
lea ecx, [esp + 0x1f0]
push ecx
call esi
lea edx, [esp + 0xaf8]
push edx
lea eax, [esp + 0x1f4]
push str._sDataNpcNpcQuest.SData
push eax
call fcn.005cd489
add esp, 0xc
lea ecx, [esp + 0x1f0]
push ecx
call esi
lea edx, [esp + 0xaf8]
push edx
lea eax, [esp + 0x1f4]
push str._sServerSequenceItemCreate.ini
push eax
call fcn.005cd489
add esp, 0xc
lea ecx, [esp + 0x1f0]
push ecx
call esi
lea edx, [esp + 0xaf8]
push edx
lea eax, [esp + 0x1f4]
push str._sServerItemDataExport_UNICODE.txt
push eax
call fcn.005cd489
add esp, 0xc
lea ecx, [esp + 0x1f0]
push ecx
call esi
lea edx, [esp + 0xaf8]
push edx
lea eax, [esp + 0x1f4]
push str._sServerGuildHouse.ini
push eax
call fcn.005cd489
add esp, 0xc
lea ecx, [esp + 0x1f0]
push ecx
call esi
lea edx, [esp + 0xaf8]
push edx
lea eax, [esp + 0x1f4]
push str._sServerVersion.txt
push eax
call fcn.005cd489
add esp, 0xc
lea ecx, [esp + 0x1f0]
push ecx
call esi
lea edx, [esp + 0xaf8]
push edx
lea eax, [esp + 0x1f4]
push str._sServer.zip
push eax
call fcn.005cd489
add esp, 0xc
lea ecx, [esp + 0x1f0]
push ecx
call esi
lea edx, [esp + 0xaf8]
push edx
push str._sServer
lea eax, [esp + 0x1f8]
push eax
call fcn.005cd489
lea ecx, [esp + 0x1fc]
push ecx
call fcn.005cdf2a
lea edx, [esp + 0xb08]
push edx
lea eax, [esp + 0x204]
push str._sDataItem
push eax
call fcn.005cd489
lea ecx, [esp + 0x20c]
push ecx
call fcn.005cdf2a
lea edx, [esp + 0xb18]
push edx
lea eax, [esp + 0x214]
push str._sDataNpc
push eax
call fcn.005cd489
lea ecx, [esp + 0x21c]
push ecx
call fcn.005cdf2a
lea edx, [esp + 0xb28]
push edx
lea eax, [esp + 0x224]
push str._sData
push eax
call fcn.005cd489
lea ecx, [esp + 0x22c]
push ecx
call fcn.005cdf2a
add esp, 0x40
call fcn.0040e2c0
push str.data_filter.txt
mov ecx, 0x71cff0
call fcn.0040bb10
push 0x4c
call fcn.005cc96d
add esp, 4
test eax, eax
je 0x40c3e2
mov ecx, eax
call fcn.0041f570
jmp 0x40c3e4
xor eax, eax
xor edx, edx
mov dword [esp + 0x50], edx
mov dword [esp + 0x54], edx
mov dword [0x7191d8], eax
mov eax, dword [0x224e9d4]
mov dword [esp + 0x58], edx
mov ebx, 5
cmp eax, ebx
mov dword [esp + 0x5c], edx
mov dword [esp + 0x60], edx
jb 0x40c420
mov eax, dword [str.Global_]
mov ecx, dword [0x6bc5b8]
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], ecx
lea edi, [esp + 0x50]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40c425
mov edx, dword [str.Shaiya]
mov ax, word [0x6bbce4]
mov cl, byte [0x6bbce6]
mov dword [edi], edx
lea edx, [esp + 0x50]
push edx
push 0
mov word [edi + 4], ax
push 0
mov byte [edi + 6], cl
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40c472
mov edi, dword [sym.imp.USER32.dll_FindWindowA]
push str.Shaiya
push 0x6bbc70
call edi
jmp 0x40c4b8
mov esi, dword [ebp + 0x10]
push 0xb
push str.new_updater
push esi
call fcn.005cdf60
add esp, 0xc
test eax, eax
jne 0x40c7ae
call fcn.0040e500
xor esi, esi
push esi
push str.new_updater.exe
call fcn.005cdee4
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 8
cmp eax, 0xffffffff
jne 0x40c518
inc esi
cmp esi, 0xa
jg 0x40c6b2
push 0x3e8
call ebx
push 0
push str.new_updater.exe
call fcn.005cdee4
add esp, 8
cmp eax, 0xffffffff
je 0x40c4f3
push str.Shaiya_Updater
push str.32770
xor esi, esi
call edi
test eax, eax
je 0x40c54d
lea ebx, [ebx]
inc esi
cmp esi, 0xa
jg 0x40c54d
push 0x3e8
call ebx
push str.Shaiya_Updater
push str.32770
call edi
test eax, eax
jne 0x40c530
push str.Shaiya_Updater
push str.32770
call edi
test eax, eax
je 0x40c5f7
push str.Shaiya_Updater
push str.32770
call edi
test eax, eax
je 0x40c5bd
push str.Shaiya_Updater
push str.32770
call edi
lea edx, [esp + 0x14]
push edx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [esp + 0x14]
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.Shaiya_Updater
push str.32770
call edi
test eax, eax
jne 0x40c571
push 0x3e8
call ebx
push str.Shaiya_Updater
push str.32770
xor esi, esi
call edi
test eax, eax
je 0x40c5f7
inc esi
cmp esi, 0xa
jg 0x40c6f1
push 0x3e8
call ebx
push str.Shaiya_Updater
push str.32770
call edi
test eax, eax
jne 0x40c5d6
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.Updater.exe
xor edi, edi
call esi
test eax, eax
jne 0x40c62c
lea ebx, [ebx]
inc edi
cmp edi, 0xa
jg 0x40c730
push 0x3e8
call ebx
push str.Updater.exe
call esi
test eax, eax
je 0x40c610
push str.Updater.exe
push str.new_updater.exe
xor esi, esi
call fcn.005cdeb6
add esp, 8
test eax, eax
je 0x40c66b
inc esi
cmp esi, 0xa
jg 0x40c76f
push 0x3e8
call ebx
push str.Updater.exe
push str.new_updater.exe
call fcn.005cdeb6
add esp, 8
test eax, eax
jne 0x40c644
push 0x1f4
call ebx
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 0x68]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x6c]
push edx
push eax
push eax
push eax
push 1
push eax
push eax
push 0x6bc55c
push eax
mov dword [esp + 0x90], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x2748
call fcn.0041d4a0
push eax
lea eax, [esp + 0x1f8]
push str._s_e01
push eax
call fcn.005cd489
add esp, 0x10
push 0
push 0
lea ecx, [esp + 0x1f8]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x2748
call fcn.0041d4a0
push eax
lea ecx, [esp + 0x1f8]
push str._s_e02
push ecx
call fcn.005cd489
add esp, 0x10
push 0
push 0
lea edx, [esp + 0x1f8]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x2748
call fcn.0041d4a0
push eax
lea eax, [esp + 0x1f8]
push str._s_e03
push eax
call fcn.005cd489
add esp, 0x10
push 0
push 0
lea ecx, [esp + 0x1f8]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x2748
call fcn.0041d4a0
push eax
lea edx, [esp + 0x1f8]
push str._s_e04
push edx
call fcn.005cd489
add esp, 0x10
push 0
push 0
lea eax, [esp + 0x1f8]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0xa
push str.start_game
push esi
call fcn.005cdf60
add esp, 0xc
test eax, eax
je 0x40c882
call fcn.0040e500
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 0x68]
rep stosd dword es:[edi], eax
cmp dword [0x708598], ebx
mov dword [esp + 0x68], 0x44
jne 0x40c854
mov eax, 0x719a18
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c7f0
sub eax, edx
mov dword [esp + 0x14], eax
je 0x40c854
push 0x7192f4
push 0x7199f4
push 0x719a18
lea eax, [esp + 0x1fc]
push str.Updater.exe__s__s__s
push eax
call fcn.005cd489
add esp, 0x14
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x6c]
push edx
push 0
push 0
push 0
push 1
push 0
push 0
lea eax, [esp + 0x210]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x6c]
push edx
push 0
push 0
push 0
push 1
push 0
push 0
push str.Updater.exe
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x6bc50c
call fcn.0040a040
add esp, 4
cmp eax, 0x5b000
je 0x40c8f7
cmp dword [0x708598], 3
push 0
push 0x6bb63c
jne 0x40c8d6
call fcn.0054bd80
add esp, 4
push eax
push 0x2736
call fcn.0041d4a0
push eax
call fcn.0054bd80
add esp, 8
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x2736
call fcn.0041d4a0
add esp, 4
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
call fcn.00409250
mov eax, dword [0x708598]
mov ebx, 2
cmp eax, ebx
jne 0x40c9c7
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x7191e0
push 0x104
lea eax, [esp + 0xf0]
push eax
push 0x6bb5d5
push str.TEST_IP
push str.LOGIN
call esi
test eax, eax
je 0x40c9a9
push 0x7191e0
push 0x104
lea ecx, [esp + 0xf0]
push ecx
push 0x6bb5d5
push str.INTERNAL_TEST_IP
push str.LOGIN
call esi
test eax, eax
je 0x40c9c7
mov edi, str.CHINA
lea esi, [esp + 0xe8]
mov ecx, 6
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x40c9c7
mov eax, dword [str.172.17.10.210]
mov ecx, dword [0x6bb954]
mov edx, dword [0x6bb958]
mov dword [0x7198b0], eax
mov ax, word [0x6bb95c]
mov dword [0x7198b4], ecx
mov dword [0x7198b8], edx
mov word [0x7198bc], ax
jmp 0x40c9c7
mov eax, dword [ebp + 0x10]
push 0x7198b0
lea ecx, [esp + 0x6c]
push ecx
mov edx, ecx
push edx
push str._s__s__s
push eax
call fcn.005cd26b
add esp, 0x14
call fcn.00409f00
test eax, eax
jne 0x40ca3b
cmp dword [0x708598], 3
push 0x10
push str.ERROR___
jne 0x40ca15
call fcn.0054bd80
add esp, 4
push eax
push 0x2736
call fcn.0041d4a0
push eax
call fcn.0054bd80
mov ecx, dword [0x719a3c]
add esp, 8
push eax
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x2736
call fcn.0041d4a0
mov edx, dword [0x719a3c]
add esp, 4
push eax
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
call fcn.00409f90
cmp dword [0x708598], ebx
jne 0x40cb9c
xor eax, eax
mov ecx, 0x100
lea edi, [esp + 0x1f0]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x1f0]
push eax
xor ebx, ebx
push 0x400
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea ecx, [esp + 0xc]
push ecx
push 0xf003f
push ebx
push str.SOFTWARESONOVShaiya
push reloc.ijl15.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x40cb1e
lea edx, [esp + 0x10]
push edx
push str.SOFTWARESONOVShaiya
push reloc.ijl15.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
lea eax, [esp + 0x1f0]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40cac1
mov ecx, dword [esp + 0x10]
sub eax, edx
push eax
lea eax, [esp + 0x1f4]
push eax
push 1
push 0x6bc4e0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
lea eax, [esp + 0x1f0]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40caf0
sub eax, edx
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x1f4]
push edx
push 1
push ebx
push 0x6bc4e0
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x10]
push ecx
call edi
jmp 0x40cb91
lea edx, [esp + 0x64]
push edx
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x1f4]
push eax
lea ecx, [esp + 0x1c]
push ecx
push ebx
push 0x6bc4e0
push edx
mov dword [esp + 0x2c], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x1f0]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40cb50
sub eax, edx
cmp eax, 1
jae 0x40cb91
mov esi, dword [esp + 0xc]
cmp esi, ebx
je 0x40cb9c
lea eax, [esp + 0x1f0]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40cb70
sub eax, edx
push eax
lea eax, [esp + 0x1f4]
push eax
push 1
push ebx
push 0x6bc4e0
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x40cb9c
push eax
call edi
call fcn.0040a970
test eax, eax
je 0x40ce55
mov eax, dword [0x70859c]
mov ebx, dword [0x7085a0]
mov ecx, dword [ebp + 8]
mov dword [0x7085a4], eax
mov dword [0x7085ac], eax
xor edi, edi
mov dword [esp + 0x10], eax
cmp dword [0x719a44], edi
mov dword [0x719a40], ecx
mov dword [0x7085a8], ebx
mov dword [0x7085b0], ebx
mov dword [esp + 0xc], edi
je 0x40cbf2
mov dword [esp + 0x14], 0x90000000
jmp 0x40cc85
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
mov dword [esp + 0x18], 0x10cf0000
call esi
cdq
sub eax, edx
mov ecx, eax
mov eax, dword [0x70859c]
cdq
sub eax, edx
sar ecx, 1
sar eax, 1
sub ecx, eax
push 1
mov dword [esp + 0x10], ecx
call esi
cdq
sub eax, edx
mov edi, eax
mov eax, dword [0x7085a0]
cdq
sub eax, edx
sar eax, 1
sar edi, 1
push 4
sub edi, eax
call esi
cdq
sub eax, edx
sar eax, 1
push 0x20
sub edi, eax
call esi
mov edx, dword [0x70859c]
lea eax, [edx + eax*2]
push 0x21
mov dword [esp + 0x14], eax
call esi
push 4
mov ebx, eax
call esi
add eax, dword [0x7085a0]
lea ebx, [eax + ebx*2]
mov eax, dword [esp + 0xc]
test eax, eax
jge 0x40cc79
push 0
mov dword [esp + 0x10], 0
call esi
mov dword [esp + 0x10], eax
test edi, edi
jge 0x40cc85
push 1
xor edi, edi
call esi
mov ebx, eax
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x14]
push ebx
push ecx
push edi
push edx
push eax
call fcn.0040a9d0
add esp, 0x14
call dword [sym.imp.WINMM.dll_timeGetTime]
push eax
call fcn.005cdac0
add esp, 4
call fcn.0040b2d0
test eax, eax
jne 0x40cccb
call fcn.0040aa20
call fcn.0040a7d0
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [0x719a3c]
push 0xa
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [0x719a3c]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, dword [0x719a3c]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
push 1
call fcn.00405840
fstp st(0)
push 0
call dword [sym.imp.USER32.dll_SetCursor]
cmp dword [0x708598], 3
mov dword [0x7199ec], 0x40cf40
je 0x40cd21
mov dword [0x7199ec], 0x409ff0
xor esi, esi
call dword [0x7199ec]
test eax, eax
jne 0x40cd23
push 5
call fcn.00405840
fstp dword [0x719a50]
cmp dword [0x719a60], esi
je 0x40cd55
push 1
call fcn.00405840
fstp dword [0x719a54]
mov dword [0x719a60], esi
push 6
call fcn.00405840
fst dword [0x719a54]
fcomp dword [0x6bb5fc]
fnstsw ax
test ah, 0x41
jp 0x40cd79
mov dword [0x719a54], 0x3d4ccccd
mov eax, dword [0x708598]
cmp eax, 2
je 0x40cd8d
cmp eax, 5
je 0x40cd8d
cmp eax, 9
jne 0x40cdaa
fld dword [0x719a54]
fcomp dword [0x6bc4dc]
fnstsw ax
test ah, 0x41
jne 0x40cdaa
mov dword [0x719a54], 0x3dcccccd
fld dword [0x7085c0]
fsub dword [0x719a54]
fst dword [0x7085c0]
fcomp dword [0x6bb5fc]
fnstsw ax
test ah, 5
jp 0x40cdd3
mov dword [0x7085c0], 0
cmp dword [0x719a48], esi
je 0x40ce12
cmp dword [0x719a4c], esi
je 0x40ce12
mov eax, dword [0x2209400]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
cmp eax, 0x88760869
jne 0x40cd23
mov ecx, 0x2209408
call fcn.00543a00
test eax, eax
je 0x40ce34
mov dword [0x719a4c], esi
jmp 0x40cd23
call fcn.0040a7a0
test eax, eax
je 0x40ce34
cmp dword [0x719a68], esi
jne 0x40cd23
call fcn.0042caf0
test eax, eax
jne 0x40cd23
call fcn.0040aa20
call fcn.0040a7d0
call fcn.0040e500
call fcn.005c0790
push 5
push str.Ending.exe
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10