Function at 0x4276cb
Capabilities:
Acquire debug privileges
Contain obfuscated stackstrings
Create process on windows
Get common file path
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x439787
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x638
push edi
mov dword [ebp - 0x2c], 1
fld dword [ebp + 8]
fcomp dword [0x43b9b0]
fnstsw ax
test ah, 1
jne 0x427728
push 0x4917e0
call fcn.0040172b
add esp, 4
push 0x4917f4
call fcn.0040172b
add esp, 4
push 0x491808
call fcn.0040172b
add esp, 4
mov byte [ebp - 0x130], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x12f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x14], 0
push 0x4a4100
lea ecx, [ebp - 0x138]
call sub.MFC42.DLL_CString::CString_3
mov dword [ebp - 4], 0
push 0x4a4104
lea ecx, [ebp - 0x13c]
call sub.MFC42.DLL_CString::CString_3
mov byte [ebp - 4], 1
push 0x4a4108
lea ecx, [ebp - 0x148]
call sub.MFC42.DLL_CString::CString_3
mov byte [ebp - 4], 2
push 0x4a410c
lea ecx, [ebp - 0x1c]
call sub.MFC42.DLL_CString::CString_3
mov byte [ebp - 4], 3
push 0x4a4110
lea ecx, [ebp - 0x134]
call sub.MFC42.DLL_CString::CString_3
mov byte [ebp - 4], 4
push 0x4a4114
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString_3
mov byte [ebp - 4], 5
push 0x4a4118
lea ecx, [ebp - 0x28]
call sub.MFC42.DLL_CString::CString_3
mov byte [ebp - 4], 6
push 0x4a411c
lea ecx, [ebp - 0x24]
call sub.MFC42.DLL_CString::CString_3
mov byte [ebp - 4], 7
push 0x4a4120
lea ecx, [ebp - 0x144]
call sub.MFC42.DLL_CString::CString_3
mov byte [ebp - 4], 8
push 0x4a4124
lea ecx, [ebp - 0x20]
call sub.MFC42.DLL_CString::CString_3
mov byte [ebp - 4], 9
push 0x4a4128
lea ecx, [ebp - 0x18]
call sub.MFC42.DLL_CString::CString_3
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x140], 0
push 0x104
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x130]
push ecx
lea ecx, [ebp - 0x138]
call sub.MFC42.DLL_CString::operator_2
lea edx, [ebp - 0x130]
push edx
lea ecx, [ebp - 0x13c]
call sub.MFC42.DLL_CString::operator_2
push 0x49181c
lea ecx, [ebp - 0x13c]
call fcn.0043549e
push 0x491824
lea ecx, [ebp - 0x18]
call sub.MFC42.DLL_CString::operator_2
push ecx
mov ecx, esp
mov dword [ebp - 0x360], esp
lea eax, [ebp - 0x13c]
push eax
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 0x46c], eax
call fcn.00401590
add esp, 4
mov dword [ebp - 0x470], eax
cmp dword [ebp - 0x470], 0
je 0x428cb6
mov byte [ebp - 0x350], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x34f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x208
lea ecx, [ebp - 0x350]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [ebp - 0x350]
push edx
lea ecx, [ebp - 0x138]
call sub.MFC42.DLL_CString::operator_2
push 0x5c
lea ecx, [ebp - 0x138]
call sub.MFC42.DLL_CString::ReverseFind
push eax
lea eax, [ebp - 0x364]
push eax
lea ecx, [ebp - 0x138]
call sub.MFC42.DLL_CString::Left
mov dword [ebp - 0x474], eax
mov ecx, dword [ebp - 0x474]
mov dword [ebp - 0x478], ecx
mov byte [ebp - 4], 0xb
mov edx, dword [ebp - 0x478]
push edx
lea ecx, [ebp - 0x138]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x364]
call sub.MFC42.DLL_CString::CString
lea eax, [ebp - 0x138]
push eax
lea ecx, [ebp - 0x24]
call sub.MFC42.DLL_CString::operator_1
push str.OCRMODI11_
lea ecx, [ebp - 0x138]
call fcn.0043549e
lea ecx, [ebp - 0x138]
push ecx
lea ecx, [ebp - 0x1c]
call sub.MFC42.DLL_CString::operator_1
push str.WINDOWSSYSTEM32
lea ecx, [ebp - 0x1c]
call fcn.0043549e
push 0x5c
lea ecx, [ebp - 0x13c]
call sub.MFC42.DLL_CString::ReverseFind
push eax
lea edx, [ebp - 0x368]
push edx
lea ecx, [ebp - 0x13c]
call sub.MFC42.DLL_CString::Left
mov dword [ebp - 0x47c], eax
mov eax, dword [ebp - 0x47c]
mov dword [ebp - 0x480], eax
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x480]
push ecx
lea ecx, [ebp - 0x134]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x368]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x134]
call sub.MFC42.DLL_CString::MakeUpper
call fcn.004013e3
test eax, eax
je 0x4279f9
push str.SysWOW64
push str.SYSTEM32
lea ecx, [ebp - 0x134]
call sub.MFC42.DLL_CString::Replace
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x36c], esp
lea edx, [ebp - 0x134]
push edx
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 0x484], eax
mov eax, dword [ebp - 0x484]
mov dword [ebp - 0x488], eax
mov byte [ebp - 4], 0xd
push ecx
mov ecx, esp
mov dword [ebp - 0x370], esp
lea edx, [ebp - 0x1c]
push edx
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 0x48c], eax
mov byte [ebp - 4], 0xa
call fcn.00404f39
add esp, 0xc
push 3
lea eax, [ebp - 0x374]
push eax
lea ecx, [ebp - 0x13c]
call sub.MFC42.DLL_CString::Left
mov dword [ebp - 0x490], eax
mov ecx, dword [ebp - 0x490]
mov dword [ebp - 0x494], ecx
mov byte [ebp - 4], 0xe
mov edx, dword [ebp - 0x494]
push edx
lea ecx, [ebp - 0x148]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x374]
call sub.MFC42.DLL_CString::CString
push 0x491878
lea ecx, [ebp - 0x148]
call fcn.0043549e
lea eax, [ebp - 0x138]
push eax
lea ecx, [ebp - 0x1c]
call sub.MFC42.DLL_CString::operator_1
push ecx
mov ecx, esp
mov dword [ebp - 0x378], esp
lea edx, [ebp - 0x148]
push edx
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 0x498], eax
call fcn.00401590
add esp, 4
mov dword [ebp - 0x49c], eax
cmp dword [ebp - 0x49c], 0
je 0x427bfd
lea eax, [ebp - 0x138]
push eax
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::operator_1
cmp dword [0x4966a8], 0
je 0x427b14
push 0x49188c
lea ecx, [ebp - 0x10]
call fcn.0043549e
jmp 0x427bf8
lea ecx, [ebp - 0x148]
push ecx
lea ecx, [ebp - 0x134]
call sub.MFC42.DLL_CString::operator_1
push 0x4918a0
lea ecx, [ebp - 0x1c]
call fcn.0043549e
mov edx, dword [ebp - 0x134]
push edx
push 0x4918b0
lea eax, [ebp - 0x144]
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0xc
push 1
push 1
lea ecx, [ebp - 0x144]
call fcn.004190e0
push eax
call fcn.0040826b
mov ecx, dword [ebp - 0x134]
push ecx
push str._sCommon_FilesMicrosoft_SharedMODI
lea edx, [ebp - 0x144]
push edx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
push 1
push 1
lea ecx, [ebp - 0x144]
call fcn.004190e0
push eax
call fcn.0040826b
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x37c], esp
lea eax, [ebp - 0x134]
push eax
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 0x4a0], eax
mov ecx, dword [ebp - 0x4a0]
mov dword [ebp - 0x4a4], ecx
mov byte [ebp - 4], 0xf
push ecx
mov ecx, esp
mov dword [ebp - 0x380], esp
lea edx, [ebp - 0x1c]
push edx
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 0x4a8], eax
mov byte [ebp - 4], 0xa
call fcn.00404f39
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
call fcn.004354d4
jmp 0x427d73
push 0x491904
lea ecx, [ebp - 0x18]
call sub.MFC42.DLL_CString::operator_2
lea ecx, [ebp - 0x138]
push ecx
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::operator_1
cmp dword [0x4966a8], 0
je 0x427c34
push 0x491914
lea ecx, [ebp - 0x10]
call fcn.0043549e
jmp 0x427d73
push 3
lea edx, [ebp - 0x384]
push edx
lea ecx, [ebp - 0x13c]
call sub.MFC42.DLL_CString::Left
mov dword [ebp - 0x4ac], eax
mov eax, dword [ebp - 0x4ac]
mov dword [ebp - 0x4b0], eax
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0x4b0]
push ecx
lea ecx, [ebp - 0x148]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x384]
call sub.MFC42.DLL_CString::CString
push 0x491928
lea ecx, [ebp - 0x148]
call fcn.0043549e
lea edx, [ebp - 0x148]
push edx
lea ecx, [ebp - 0x134]
call sub.MFC42.DLL_CString::operator_1
push str.PROGRAM_FILES_
lea ecx, [ebp - 0x1c]
call fcn.0043549e
mov eax, dword [ebp - 0x134]
push eax
push str._sCommon_FilesMicrosoft_SharedOFFICE11
lea ecx, [ebp - 0x144]
push ecx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
push 1
push 1
lea ecx, [ebp - 0x144]
call fcn.004190e0
push eax
call fcn.0040826b
mov edx, dword [ebp - 0x134]
push edx
push str._sCommon_FilesMicrosoft_SharedMODI11.0
lea eax, [ebp - 0x144]
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0xc
push 1
push 1
lea ecx, [ebp - 0x144]
call fcn.004190e0
push eax
call fcn.0040826b
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x388], esp
lea edx, [ebp - 0x134]
push edx
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 0x4b4], eax
mov eax, dword [ebp - 0x4b4]
mov dword [ebp - 0x4b8], eax
mov byte [ebp - 4], 0x11
push ecx
mov ecx, esp
mov dword [ebp - 0x38c], esp
lea edx, [ebp - 0x1c]
push edx
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 0x4bc], eax
mov byte [ebp - 4], 0xa
call fcn.00404f39
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
call fcn.004354d4
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x148]
push ecx
push str._sCommon_Filesmicrosoft_sharedMODI11.0_
lea edx, [ebp - 0x138]
push edx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
mov eax, dword [ebp - 0x138]
push eax
push 0x4919cc
lea ecx, [ebp - 0x20]
push ecx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
push 0
push 0
lea ecx, [ebp - 0x20]
call fcn.004190e0
push eax
push 0x4919ec
push 0x4919f4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x138]
push edx
push 0x4919fc
lea eax, [ebp - 0x20]
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0xc
push 0
push 0
lea ecx, [ebp - 0x20]
call fcn.004190e0
push eax
push 0x491a1c
push 0x491a24
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.004013e3
test eax, eax
je 0x427e24
call fcn.004227c6
jmp 0x427e70
mov ecx, dword [ebp - 0x10]
push ecx
push 0x491a2c
push 0x491a34
lea edx, [ebp - 0x138]
push edx
call sub.MFC42.DLL_CString::Format
add esp, 0x10
push 5
push 0
lea ecx, [ebp - 0x138]
call fcn.004190e0
push eax
push 0x491a3c
push 0x491a48
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.0041ea19
fld dword [0x4966b0]
fcomp dword [0x43b9c8]
fnstsw ax
test ah, 1
je 0x428cab
lea ecx, [ebp - 0x358]
call sub.MFC42.DLL_CString::CString_2
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x35c]
call sub.MFC42.DLL_CString::CString_2
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x354]
call sub.MFC42.DLL_CString::CString_2
mov byte [ebp - 4], 0x14
mov eax, dword [ebp - 0x148]
push eax
push 0x491a50
lea ecx, [ebp - 0x138]
push ecx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
push 7
push ecx
mov ecx, esp
mov dword [ebp - 0x390], esp
push 0x491a74
call sub.MFC42.DLL_CString::CString_3
mov dword [ebp - 0x4c0], eax
mov edx, dword [ebp - 0x4c0]
mov dword [ebp - 0x4c4], edx
mov byte [ebp - 4], 0x15
push ecx
mov ecx, esp
mov dword [ebp - 0x394], esp
push 0x491a94
call sub.MFC42.DLL_CString::CString_3
mov dword [ebp - 0x4c8], eax
mov eax, dword [ebp - 0x4c8]
mov dword [ebp - 0x4cc], eax
mov byte [ebp - 4], 0x16
push ecx
mov ecx, esp
mov dword [ebp - 0x398], esp
push 0x491a9c
call sub.MFC42.DLL_CString::CString_3
mov dword [ebp - 0x4d0], eax
push 0x80000000
mov byte [ebp - 4], 0x14
call fcn.00405236
add esp, 0x14
mov dword [ebp - 0x4d4], eax
cmp dword [ebp - 0x4d4], 0
jne 0x427f88
push 0x491ad4
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::operator_2
push 0
push 0
lea ecx, [ebp - 0x10]
call fcn.004190e0
push eax
push 0x491b5c
push 0x491b64
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x39c], esp
push 0x4a412c
call sub.MFC42.DLL_CString::CString_3
mov dword [ebp - 0x4d8], eax
mov ecx, dword [ebp - 0x4d8]
mov dword [ebp - 0x4dc], ecx
mov byte [ebp - 4], 0x17
push ecx
mov ecx, esp
mov dword [ebp - 0x3a0], esp
push 0x491b6c
call sub.MFC42.DLL_CString::CString_3
mov dword [ebp - 0x4e0], eax
mov edx, dword [ebp - 0x4e0]
mov dword [ebp - 0x4e4], edx
mov byte [ebp - 4], 0x18
push ecx
mov ecx, esp
mov dword [ebp - 0x3a4], esp
push 0x491b78
call sub.MFC42.DLL_CString::CString_3
mov dword [ebp - 0x4e8], eax
push 0x80000000
mov byte [ebp - 4], 0x14
call fcn.00405236
add esp, 0x14
mov dword [ebp - 0x4ec], eax
cmp dword [ebp - 0x4ec], 0
jne 0x428038
push 0
push 0
push 0x491bac
push 0x491c10
push 0x491c18
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x491c20
lea ecx, [ebp - 0x358]
call sub.MFC42.DLL_CString::operator_2
push str.____mEMae_7q9DXdU_EPi
lea eax, [ebp - 0x354]
push eax
call sub.MFC42.DLL_CString::Format
add esp, 8
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x3a8], esp
lea edx, [ebp - 0x354]
push edx
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 0x4f0], eax
mov eax, dword [ebp - 0x4f0]
mov dword [ebp - 0x4f4], eax
mov byte [ebp - 4], 0x19
push ecx
mov ecx, esp
mov dword [ebp - 0x3ac], esp
push 0x491cb4
call sub.MFC42.DLL_CString::CString_3
mov dword [ebp - 0x4f8], eax
mov ecx, dword [ebp - 0x4f8]
mov dword [ebp - 0x4fc], ecx
mov byte [ebp - 4], 0x1a
push ecx
mov ecx, esp
mov dword [ebp - 0x3b0], esp
lea edx, [ebp - 0x358]
push edx
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 0x500], eax
push 0x80000002
mov byte [ebp - 4], 0x14
call fcn.00405236
add esp, 0x14
mov dword [ebp - 0x504], eax
cmp dword [ebp - 0x504], 0
jne 0x428121
push 0x491cbc
lea ecx, [ebp - 0x28]
call sub.MFC42.DLL_CString::operator_2
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.004190e0
push eax
push 0x491d7c
push 0x491d84
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x491d8c
lea ecx, [ebp - 0x358]
call sub.MFC42.DLL_CString::operator_2
mov eax, dword [ebp - 0x138]
push eax
push 0x491e00
lea ecx, [ebp - 0x354]
push ecx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x3b4], esp
lea edx, [ebp - 0x354]
push edx
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 0x508], eax
mov eax, dword [ebp - 0x508]
mov dword [ebp - 0x50c], eax
mov byte [ebp - 4], 0x1b
push ecx
mov ecx, esp
mov dword [ebp - 0x3b8], esp
push 0x491e18
call sub.MFC42.DLL_CString::CString_3
mov dword [ebp - 0x510], eax
mov ecx, dword [ebp - 0x510]
mov dword [ebp - 0x514], ecx
mov byte [ebp - 4], 0x1c
push ecx
mov ecx, esp
mov dword [ebp - 0x3bc], esp
lea edx, [ebp - 0x358]
push edx
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 0x518], eax
push 0x80000002
mov byte [ebp - 4], 0x14
call fcn.00405236
add esp, 0x14
mov dword [ebp - 0x51c], eax
cmp dword [ebp - 0x51c], 0
jne 0x42822d
push 0x491e3c
lea ecx, [ebp - 0x28]
call sub.MFC42.DLL_CString::operator_2
lea eax, [ebp - 0x138]
push eax
lea ecx, [ebp - 0x28]
call fcn.004354d4
push str.MODI11.0XPAGE3C.DLL____F_NUL
lea ecx, [ebp - 0x28]
call fcn.0043549e
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.004190e0
push eax
push 0x491f14
push 0x491f1c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x491f24
lea ecx, [ebp - 0x358]
call sub.MFC42.DLL_CString::operator_2
mov ecx, dword [ebp - 0x138]
push ecx
push str._sMODI11.0SCCODE.UNI
lea edx, [ebp - 0x354]
push edx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x3c0], esp
lea eax, [ebp - 0x354]
push eax
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 0x520], eax
mov ecx, dword [ebp - 0x520]
mov dword [ebp - 0x524], ecx
mov byte [ebp - 4], 0x1d
push ecx
mov ecx, esp
mov dword [ebp - 0x3c4], esp
push 0x491fb0
call sub.MFC42.DLL_CString::CString_3
mov dword [ebp - 0x528], eax
mov edx, dword [ebp - 0x528]
mov dword [ebp - 0x52c], edx
mov byte [ebp - 4], 0x1e
push ecx
mov ecx, esp
mov dword [ebp - 0x3c8], esp
lea eax, [ebp - 0x358]
push eax
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 0x530], eax
push 0x80000002
mov byte [ebp - 4], 0x14
call fcn.00405236
add esp, 0x14
mov dword [ebp - 0x534], eax
cmp dword [ebp - 0x534], 0
jne 0x428339
push 0x491fd4
lea ecx, [ebp - 0x28]
call sub.MFC42.DLL_CString::operator_2
lea ecx, [ebp - 0x138]
push ecx
lea ecx, [ebp - 0x28]
call fcn.004354d4
push str.MODI11.0SCCODE.UNI____F_NUL
lea ecx, [ebp - 0x28]
call fcn.0043549e
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.004190e0
push eax
push 0x4920ac
push 0x4920b4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x4920bc
lea ecx, [ebp - 0x358]
call sub.MFC42.DLL_CString::operator_2
mov edx, dword [ebp - 0x138]
push edx
push str._sMODI11.0MSPCORE.DLL
lea eax, [ebp - 0x354]
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0xc
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x3cc], esp
lea edx, [ebp - 0x354]
push edx
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 0x538], eax
mov eax, dword [ebp - 0x538]
mov dword [ebp - 0x53c], eax
mov byte [ebp - 4], 0x1f
push ecx
mov ecx, esp
mov dword [ebp - 0x3d0], esp
push 0x492148
call sub.MFC42.DLL_CString::CString_3
mov dword [ebp - 0x540], eax
mov ecx, dword [ebp - 0x540]
mov dword [ebp - 0x544], ecx
mov byte [ebp - 4], 0x20
push ecx
mov ecx, esp
mov dword [ebp - 0x3d4], esp
lea edx, [ebp - 0x358]
push edx
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 0x548], eax
push 0x80000002
mov byte [ebp - 4], 0x14
call fcn.00405236
add esp, 0x14
mov dword [ebp - 0x54c], eax
cmp dword [ebp - 0x54c], 0
jne 0x428445
push 0x49216c
lea ecx, [ebp - 0x28]
call sub.MFC42.DLL_CString::operator_2
lea eax, [ebp - 0x138]
push eax
lea ecx, [ebp - 0x28]
call fcn.004354d4
push str.MODI11.0MSPCORE.DLL____F_NUL
lea ecx, [ebp - 0x28]
call fcn.0043549e
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.004190e0
push eax
push 0x492244
push 0x49224c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x492254
lea ecx, [ebp - 0x358]
call sub.MFC42.DLL_CString::operator_2
mov ecx, dword [ebp - 0x138]
push ecx
push 0x4922c8
lea edx, [ebp - 0x354]
push edx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x3d8], esp
lea eax, [ebp - 0x354]
push eax
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 0x550], eax
mov ecx, dword [ebp - 0x550]
mov dword [ebp - 0x554], ecx
mov byte [ebp - 4], 0x21
push ecx
mov ecx, esp
mov dword [ebp - 0x3dc], esp
push 0x4922dc
call sub.MFC42.DLL_CString::CString_3
mov dword [ebp - 0x558], eax
mov edx, dword [ebp - 0x558]
mov dword [ebp - 0x55c], edx
mov byte [ebp - 4], 0x22
push ecx
mov ecx, esp
mov dword [ebp - 0x3e0], esp
lea eax, [ebp - 0x358]
push eax
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 0x560], eax
push 0x80000002
mov byte [ebp - 4], 0x14
call fcn.00405236
add esp, 0x14
mov dword [ebp - 0x564], eax
cmp dword [ebp - 0x564], 0
jne 0x428551
push 0x492300
lea ecx, [ebp - 0x28]
call sub.MFC42.DLL_CString::operator_2
lea ecx, [ebp - 0x138]
push ecx
lea ecx, [ebp - 0x28]
call fcn.004354d4
push str.OFFICE11MSO.DLL____F_NUL
lea ecx, [ebp - 0x28]
call fcn.0043549e
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.004190e0
push eax
push 0x4923d4
push 0x4923dc
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x4923e4
lea ecx, [ebp - 0x358]
call sub.MFC42.DLL_CString::operator_2
push str.dword:00000001
lea ecx, [ebp - 0x354]
call sub.MFC42.DLL_CString::operator_2
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x3e4], esp
lea edx, [ebp - 0x354]
push edx
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 0x568], eax
mov eax, dword [ebp - 0x568]
mov dword [ebp - 0x56c], eax
mov byte [ebp - 4], 0x23
push ecx
mov ecx, esp
mov dword [ebp - 0x3e8], esp
push 0x492478
call sub.MFC42.DLL_CString::CString_3
mov dword [ebp - 0x570], eax
mov ecx, dword [ebp - 0x570]
mov dword [ebp - 0x574], ecx
mov byte [ebp - 4], 0x24
push ecx
mov ecx, esp
mov dword [ebp - 0x3ec], esp
lea edx, [ebp - 0x358]
push edx
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 0x578], eax
push 0x80000002
mov byte [ebp - 4], 0x14
call fcn.00405236
add esp, 0x14
mov dword [ebp - 0x57c], eax
cmp dword [ebp - 0x57c], 0
jne 0x428643
push 0x49248c
lea ecx, [ebp - 0x28]
call sub.MFC42.DLL_CString::operator_2
push 0x492544
lea ecx, [ebp - 0x28]
call fcn.0043549e
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.004190e0
push eax
push 0x49255c
push 0x492564
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x49256c
lea ecx, [ebp - 0x358]
call sub.MFC42.DLL_CString::operator_2
mov eax, dword [ebp - 0x148]
push eax
push str._sCommon_Filesmicrosoft_sharedOFFICE11MSO.DLL
lea ecx, [ebp - 0x354]
push ecx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x3f0], esp
lea edx, [ebp - 0x354]
push edx
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 0x580], eax
mov eax, dword [ebp - 0x580]
mov dword [ebp - 0x584], eax
mov byte [ebp - 4], 0x25
push ecx
mov ecx, esp
mov dword [ebp - 0x3f4], esp
push 0x4925d4
call sub.MFC42.DLL_CString::CString_3
mov dword [ebp - 0x588], eax
mov ecx, dword [ebp - 0x588]
mov dword [ebp - 0x58c], ecx
mov byte [ebp - 4], 0x26
push ecx
mov ecx, esp
mov dword [ebp - 0x3f8], esp
lea edx, [ebp - 0x358]
push edx
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 0x590], eax
push 0x80000002
mov byte [ebp - 4], 0x14
call fcn.00405236
add esp, 0x14
mov dword [ebp - 0x594], eax
cmp dword [ebp - 0x594], 0
jne 0x42874f
push str._C_reg_add_HKLMSOFTWAREMicrosoftOffice11.0CommonFilesPaths__v_mso.dll__t_REG_SZ__d__
lea ecx, [ebp - 0x28]
call sub.MFC42.DLL_CString::operator_2
lea eax, [ebp - 0x138]
push eax
lea ecx, [ebp - 0x28]
call fcn.004354d4
push 0x492638
lea ecx, [ebp - 0x28]
call fcn.0043549e
push 0
push 0
lea ecx, [ebp - 0x28]
call fcn.004190e0
push eax
push 0x49264c
push 0x492654
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push ecx
mov ecx, esp
mov dword [ebp - 0x3fc], esp
push 0x49265c
call sub.MFC42.DLL_CString::CString_3
mov dword [ebp - 0x598], eax
mov ecx, dword [ebp - 0x598]
mov dword [ebp - 0x59c], ecx
mov byte [ebp - 4], 0x27
push ecx
mov ecx, esp
mov dword [ebp - 0x400], esp
push 0x492680
call sub.MFC42.DLL_CString::CString_3
mov dword [ebp - 0x5a0], eax
push 0x80000000
mov byte [ebp - 4], 0x14
call fcn.004018da
add esp, 0xc
mov dword [ebp - 0x5a4], eax
cmp dword [ebp - 0x5a4], 0
jne 0x4287d4
push 0
push 0
push 0x492694
push 0x4926f0
push 0x4926f8
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push ecx
mov ecx, esp
mov dword [ebp - 0x404], esp
push 0x492700
call sub.MFC42.DLL_CString::CString_3
mov dword [ebp - 0x5a8], eax
mov edx, dword [ebp - 0x5a8]
mov dword [ebp - 0x5ac], edx
mov byte [ebp - 4], 0x28
push ecx
mov ecx, esp
mov dword [ebp - 0x408], esp
push str.SOFTWAREClassesInstallerProducts
call sub.MFC42.DLL_CString::CString_3
mov dword [ebp - 0x5b0], eax
push 0x80000002
mov byte [ebp - 4], 0x14
call fcn.004018da
add esp, 0xc
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.00002052
lea eax, [ebp - 0x10]
push eax
call sub.MFC42.DLL_CString::Format
add esp, 8
push 4
push ecx
mov ecx, esp
mov dword [ebp - 0x40c], esp
lea edx, [ebp - 0x10]
push edx
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 0x5b4], eax
mov eax, dword [ebp - 0x5b4]
mov dword [ebp - 0x5b8], eax
mov byte [ebp - 4], 0x29
push ecx
mov ecx, esp
mov dword [ebp - 0x410], esp
push str.Language
call sub.MFC42.DLL_CString::CString_3
mov dword [ebp - 0x5bc], eax
mov ecx, dword [ebp - 0x5bc]
mov dword [ebp - 0x5c0], ecx
mov byte [ebp - 4], 0x2a
push ecx
mov ecx, esp
mov dword [ebp - 0x414], esp
push str.SOFTWAREClassesInstallerProducts4080110900063D11C8EF10054038389C
call sub.MFC42.DLL_CString::CString_3
mov dword [ebp - 0x5c4], eax
push 0x80000002
mov byte [ebp - 4], 0x14
call fcn.00401b77
add esp, 0x14
push ecx
mov ecx, esp
mov dword [ebp - 0x418], esp
push str.4080110900063D11C8EF10054038389CInstallProperties
call sub.MFC42.DLL_CString::CString_3
mov dword [ebp - 0x5c8], eax
mov edx, dword [ebp - 0x5c8]
mov dword [ebp - 0x5cc], edx
mov byte [ebp - 4], 0x2b
push ecx
mov ecx, esp
mov dword [ebp - 0x41c], esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionInstallerUserDataS_1_5_18Products
call sub.MFC42.DLL_CString::CString_3
mov dword [ebp - 0x5d0], eax
push 0x80000002
mov byte [ebp - 4], 0x14
call fcn.004018da
add esp, 0xc
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x49282c
lea eax, [ebp - 0x10]
push eax
call sub.MFC42.DLL_CString::Format
add esp, 8
push 4
push ecx
mov ecx, esp
mov dword [ebp - 0x420], esp
lea edx, [ebp - 0x10]
push edx
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 0x5d4], eax
mov eax, dword [ebp - 0x5d4]
mov dword [ebp - 0x5d8], eax
mov byte [ebp - 4], 0x2c
push ecx
mov ecx, esp
mov dword [ebp - 0x424], esp
push 0x492838
call sub.MFC42.DLL_CString::CString_3
mov dword [ebp - 0x5dc], eax
mov ecx, dword [ebp - 0x5dc]
mov dword [ebp - 0x5e0], ecx
mov byte [ebp - 4], 0x2d
push ecx
mov ecx, esp
mov dword [ebp - 0x428], esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionInstallerUserDataS_1_5_18Products4080110900063D11C8EF10054038389CInstallProperties
call sub.MFC42.DLL_CString::CString_3
mov dword [ebp - 0x5e4], eax
push 0x80000002
mov byte [ebp - 4], 0x14
call fcn.00401b77
add esp, 0x14
push ecx
mov ecx, esp
mov dword [ebp - 0x42c], esp
push str.656FC74EF9CF31E489052EA838626D68
call sub.MFC42.DLL_CString::CString_3
mov dword [ebp - 0x5e8], eax
mov edx, dword [ebp - 0x5e8]
mov dword [ebp - 0x5ec], edx
mov byte [ebp - 4], 0x2e
push ecx
mov ecx, esp
mov dword [ebp - 0x430], esp
push 0x4928f4
call sub.MFC42.DLL_CString::CString_3
mov dword [ebp - 0x5f0], eax
push 0x80000002
mov byte [ebp - 4], 0x14
call fcn.004018da
add esp, 0xc
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x138]
push eax
push str._sMODI11.0XPAGE3C.DLL
lea ecx, [ebp - 0x10]
push ecx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x434], esp
lea edx, [ebp - 0x10]
push edx
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 0x5f4], eax
mov eax, dword [ebp - 0x5f4]
mov dword [ebp - 0x5f8], eax
mov byte [ebp - 4], 0x2f
push ecx
mov ecx, esp
mov dword [ebp - 0x438], esp
push 0x492960
call sub.MFC42.DLL_CString::CString_3
mov dword [ebp - 0x5fc], eax
mov ecx, dword [ebp - 0x5fc]
mov dword [ebp - 0x600], ecx
mov byte [ebp - 4], 0x30
push ecx
mov ecx, esp
mov dword [ebp - 0x43c], esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionInstallerUserDataS_1_5_18Components656FC74EF9CF31E489052EA838626D68
call sub.MFC42.DLL_CString::CString_3
mov dword [ebp - 0x604], eax
push 0x80000002
mov byte [ebp - 4], 0x14
call fcn.00401b77
add esp, 0x14
push ecx
mov ecx, esp
mov dword [ebp - 0x440], esp
push str.0EAE1CE3652AD1140BB010C68A730687
call sub.MFC42.DLL_CString::CString_3
mov dword [ebp - 0x608], eax
mov edx, dword [ebp - 0x608]
mov dword [ebp - 0x60c], edx
mov byte [ebp - 4], 0x31
push ecx
mov ecx, esp
mov dword [ebp - 0x444], esp
push 0x492a1c
call sub.MFC42.DLL_CString::CString_3
mov dword [ebp - 0x610], eax
push 0x80000002
mov byte [ebp - 4], 0x14
call fcn.004018da
add esp, 0xc
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x138]
push eax
push str._sOFFICE11MSO.DLL
lea ecx, [ebp - 0x10]
push ecx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x448], esp
lea edx, [ebp - 0x10]
push edx
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 0x614], eax
mov eax, dword [ebp - 0x614]
mov dword [ebp - 0x618], eax
mov byte [ebp - 4], 0x32
push ecx
mov ecx, esp
mov dword [ebp - 0x44c], esp
push 0x492a84
call sub.MFC42.DLL_CString::CString_3
mov dword [ebp - 0x61c], eax
mov ecx, dword [ebp - 0x61c]
mov dword [ebp - 0x620], ecx
mov byte [ebp - 4], 0x33
push ecx
mov ecx, esp
mov dword [ebp - 0x450], esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionInstallerUserDataS_1_5_18Components0EAE1CE3652AD1140BB010C68A730687
call sub.MFC42.DLL_CString::CString_3
mov dword [ebp - 0x624], eax
push 0x80000002
mov byte [ebp - 4], 0x14
call fcn.00401b77
add esp, 0x14
push ecx
mov ecx, esp
mov dword [ebp - 0x454], esp
push str.EE944586907222A45916AB460C3EA7C6
call sub.MFC42.DLL_CString::CString_3
mov dword [ebp - 0x628], eax
mov edx, dword [ebp - 0x628]
mov dword [ebp - 0x62c], edx
mov byte [ebp - 4], 0x34
push ecx
mov ecx, esp
mov dword [ebp - 0x458], esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionInstallerUserDataS_1_5_18Components
call sub.MFC42.DLL_CString::CString_3
mov dword [ebp - 0x630], eax
push 0x80000002
mov byte [ebp - 4], 0x14
call fcn.004018da
add esp, 0xc
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x138]
push eax
push str._sMODI11.0MSPVIEW.EXE
lea ecx, [ebp - 0x10]
push ecx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x45c], esp
lea edx, [ebp - 0x10]
push edx
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 0x634], eax
mov eax, dword [ebp - 0x634]
mov dword [ebp - 0x638], eax
mov byte [ebp - 4], 0x35
push ecx
mov ecx, esp
mov dword [ebp - 0x460], esp
push str.4080110900063D11C8EF10054038389C
call sub.MFC42.DLL_CString::CString_3
mov dword [ebp - 0x63c], eax
mov ecx, dword [ebp - 0x63c]
mov dword [ebp - 0x640], ecx
mov byte [ebp - 4], 0x36
push ecx
mov ecx, esp
mov dword [ebp - 0x464], esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionInstallerUserDataS_1_5_18ComponentsEE944586907222A45916AB460C3EA7C6
call sub.MFC42.DLL_CString::CString_3
mov dword [ebp - 0x644], eax
push 0x80000002
mov byte [ebp - 4], 0x14
call fcn.00401b77
add esp, 0x14
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x354]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x35c]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x358]
call sub.MFC42.DLL_CString::CString
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x468], edx
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x18]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x20]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x144]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x24]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x28]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x134]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1c]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x148]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x13c]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x138]
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp - 0x468]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret