Function at 0x406012
Capabilities:
Create process on windows
Delete registry key
Delete registry value
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0xbec
cmp dword [0x414860], 0x3e9
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x28], 0x1d
mov dword [esp + 0x2c], 0x1e
mov dword [esp + 0x30], 0x1f
mov dword [esp + 0x34], 0x20
mov dword [esp + 0x38], 0x21
mov dword [esp + 0x3c], 0x22
mov dword [esp + 0x40], 0x23
mov dword [esp + 0x44], 0x24
mov dword [esp + 0x48], 0x25
mov dword [esp + 0x4c], 0x28
mov dword [esp + 0x50], 0x2c
mov dword [esp + 0x54], 0x38
mov dword [esp + 0x58], 0x39
mov dword [esp + 0x5c], 0x3a
jne 0x4060a8
cmp dword [0x4148e8], 0
je 0x4060a8
and dword [0x4148e8], 0
cmp dword [0x4148e8], 0
push 1
pop ebx
je 0x4060c1
mov ax, word [0x414cf4]
mov word [esp + 0x10], ax
jmp 0x4060c5
mov dword [esp + 0x10], ebx
push 0xe
lea esi, [esp + 0x2c]
lea edi, [esp + 0x80]
pop ebp
push 0x40
push edi
push dword [esi]
push dword [0x414bf0]
call fcn.00408ff4
add esp, 0x10
add edi, 0x40
add esi, 4
dec ebp
jne 0x4060d3
mov eax, dword [0x414be0]
mov ecx, dword [0x414864]
add eax, ecx
and dword [0x414888], 0
add eax, dword [0x414c5c]
add eax, dword [0x414c64]
add eax, dword [0x414cfc]
add eax, dword [0x4148a4]
add eax, dword [0x4148ec]
add eax, dword [0x414ce8]
add eax, dword [0x4148e0]
add eax, dword [0x414c0c]
mov dword [0x414c58], eax
jne 0x406140
mov dword [0x414c58], ebx
cmp dword [0x414bec], 0
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
jne 0x406393
push 0x44
xor edi, edi
pop esi
lea eax, [esp + 0x28]
push esi
push edi
push eax
call fcn.0040a1f0
add esp, 0xc
mov dword [esp + 0x28], esi
push edi
push 0x3ea
call fcn.00402d14
pop ecx
pop ecx
push edi
push 0x3ec
call fcn.00402d14
pop ecx
mov esi, 0x3ed
pop ecx
push 1
push esi
call fcn.00402d14
pop ecx
pop ecx
push 1
push 0x3ef
call fcn.00402d14
pop ecx
lea eax, [esp + 0x400]
pop ecx
push 0x100
push eax
push 0x2d
push dword [0x414bf0]
call fcn.00408ff4
add esp, 0x10
lea eax, [esp + 0x3fc]
push dword [0x414c00]
push eax
lea eax, [esp + 0x804]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0x7fc]
push eax
push esi
push dword [0x414838]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 1
push dword [0x414838]
call edi
mov esi, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call esi
push 0
push 5
push dword [0x414838]
call edi
push eax
call esi
xor edi, edi
mov esi, 0x414c80
lea eax, [edi + 0x6b]
movzx eax, ax
push eax
push dword [0x414bf0]
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [esi], eax
add esi, 4
inc edi
cmp esi, 0x414cd4
jl 0x406229
xor edi, edi
cmp dword [0x4148f4], edi
je 0x40626e
push 5
push 0xef6
push dword [0x414838]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
call fcn.00407537
cmp dword [0x414bf8], edi
pop ecx
mov dword [0x414bec], 1
jle 0x406393
cmp dword [0x4148a8], 0
jne 0x406393
cmp dword [0x414860], 0x3e8
je 0x4062b9
mov eax, dword [0x4148c4]
mov eax, dword [eax + edi*4]
cmp dword [eax + 0x204], 0
je 0x406386
mov eax, dword [0x4148c4]
mov cx, word [esp + 0x10]
mov esi, edi
shl esi, 2
mov eax, dword [eax + esi]
cmp word [eax + 0x208], cx
jb 0x406386
push 0x5c
push eax
call fcn.0040a260
pop ecx
test eax, eax
pop ecx
je 0x4062f7
mov eax, dword [0x4148c4]
push 0
push dword [eax + esi]
call fcn.00408bfa
pop ecx
pop ecx
lea eax, [esp + 0x3fc]
push 0x411584
push eax
call ebp
push 0
call fcn.004096d9
mov byte [esp + 0x400], al
pop ecx
lea eax, [esp + 0x37c]
push eax
push dword [0x4148d0]
call ebp
mov eax, dword [0x4148c4]
mov eax, dword [eax + esi]
cmp byte [eax + 0x104], 0
lea ecx, [eax + 0x104]
je 0x40633f
push ecx
jmp 0x406340
push eax
push dword [0x4148d0]
call ebx
push dword [0x4148d0]
call fcn.00407537
pop ecx
lea eax, [esp + 0x6c]
push eax
lea eax, [esp + 0x2c]
mov ecx, dword [0x4148c4]
push eax
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ecx + esi]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x406386
push 0xffffffffffffffff
push dword [esp + 0x70]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
inc edi
cmp edi, dword [0x414bf8]
jl 0x40628b
xor esi, esi
cmp dword [0x414be0], esi
jle 0x406439
cmp dword [0x4148a8], 0
jne 0x406439
cmp dword [0x414860], 0x3e8
je 0x4063cb
mov eax, dword [0x414cf8]
mov eax, dword [eax + esi*4]
cmp dword [eax + 0x104], 0
je 0x406426
mov eax, dword [0x414cf8]
mov eax, dword [eax + esi*4]
mov ax, word [eax + 0x108]
cmp ax, word [esp + 0x10]
jb 0x406426
lea eax, [esp + 0x3bc]
push eax
push dword [0x4148d0]
call ebp
mov eax, dword [0x414cf8]
push dword [eax + esi*4]
push dword [0x4148d0]
call ebx
push dword [0x4148d0]
call fcn.00407537
mov eax, dword [0x414cf8]
pop ecx
push dword [eax + esi*4]
call fcn.004090a5
pop ecx
push 0xdac
call fcn.0040763d
pop ecx
inc dword [0x414888]
inc esi
cmp esi, dword [0x414be0]
jl 0x4063a1
cmp dword [0x414910], 0
je 0x40648e
cmp dword [0x414860], 0x3e8
je 0x406457
cmp dword [0x41486c], 0
je 0x40648e
lea eax, [esp + 0x2fc]
push eax
push dword [0x4148d0]
call ebp
push dword [0x414910]
push dword [0x4148d0]
call ebx
push dword [0x4148d0]
call fcn.00407537
pop ecx
call fcn.004084e1
test eax, eax
jne 0x40752c
xor edi, edi
cmp dword [0x4148ec], edi
jle 0x40653f
cmp dword [0x4148a8], 0
jne 0x40653f
cmp dword [0x414860], 0x3e8
je 0x4064c6
mov eax, dword [0x41484c]
mov eax, dword [eax + edi*4]
cmp dword [eax + 0x104], 0
je 0x40652c
mov eax, dword [0x41484c]
mov cx, word [esp + 0x10]
mov esi, edi
shl esi, 2
mov eax, dword [eax + esi]
cmp word [eax + 0x108], cx
jb 0x40652c
lea eax, [esp + 0x17c]
push eax
push dword [0x4148d0]
call ebp
mov eax, dword [0x41484c]
push dword [eax + esi]
push dword [0x4148d0]
call ebx
push dword [0x4148d0]
call fcn.00407537
mov eax, dword [0x41484c]
pop ecx
push 0
push dword [eax + esi]
call fcn.00408b41
mov eax, dword [0x41484c]
pop ecx
pop ecx
push dword [eax + esi]
call fcn.004088aa
pop ecx
inc dword [0x414888]
inc edi
cmp edi, dword [0x4148ec]
jl 0x40649c
xor edi, edi
cmp dword [0x4148a4], edi
jle 0x406627
cmp dword [0x4148a8], 0
jne 0x406627
cmp dword [0x414860], 0x3e8
je 0x40657b
mov eax, dword [0x41491c]
mov eax, dword [eax + edi*4]
cmp dword [eax + 0x70c], 0
je 0x406614
mov eax, dword [0x41491c]
mov cx, word [esp + 0x10]
mov esi, edi
shl esi, 2
mov eax, dword [eax + esi]
cmp word [eax + 0x710], cx
jb 0x406614
add eax, 8
push 0
push eax
call fcn.00408d8e
pop ecx
test eax, eax
pop ecx
jne 0x406614
lea eax, [esp + 0x1bc]
push eax
push dword [0x4148d0]
call ebp
mov eax, dword [0x41491c]
mov eax, dword [eax + esi]
add eax, 8
push eax
push dword [0x4148d0]
call ebx
push dword [0x4148d0]
call fcn.00407537
mov eax, dword [0x41491c]
cmp dword [0x4148e8], 0
pop ecx
mov eax, dword [eax + esi]
lea ecx, [eax + 0x50c]
jne 0x4065f4
lea ecx, [eax + 0x30c]
lea edx, [eax + 8]
push edx
mov dl, byte [ecx]
neg dl
sbb edx, edx
and edx, ecx
lea ecx, [eax + 0x20c]
push edx
add eax, 0x10c
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
inc dword [0x414888]
inc edi
cmp edi, dword [0x4148a4]
jl 0x40654d
xor esi, esi
cmp dword [0x414c08], esi
jle 0x406686
cmp dword [0x4148e8], 0
je 0x40667d
mov eax, dword [0x414848]
mov cx, word [esp + 0x10]
mov eax, dword [eax + esi*4]
cmp word [eax + 0x208], cx
jb 0x40667d
add eax, 0x104
push 0
push eax
call fcn.00408d8e
pop ecx
test eax, eax
pop ecx
jne 0x40667d
mov eax, dword [0x414848]
push 1
mov eax, dword [eax + esi*4]
lea ecx, [eax + 0x104]
push ecx
push eax
call fcn.0040812c
add esp, 0xc
inc esi
cmp esi, dword [0x414c08]
jl 0x406631
mov eax, dword [0x414c0c]
lea esi, [eax - 1]
test esi, esi
jl 0x4067b9
cmp dword [0x414860], 0x3e8
jne 0x4066c6
mov eax, dword [0x414878]
mov eax, dword [eax + esi*4]
cmp dword [eax + 0x214], 0
jne 0x4066db
cmp dword [0x4148e8], 0
je 0x4066c6
lea ecx, [eax + 0x10c]
test ecx, ecx
jne 0x4066db
mov eax, dword [0x414878]
mov eax, dword [eax + esi*4]
cmp dword [eax + 0x210], 0
je 0x4067b2
mov cx, word [esp + 0x10]
cmp word [eax + 0x21c], cx
jb 0x4067b2
cmp word [eax + 0x220], cx
jb 0x40670c
push dword [eax + 0x224]
add eax, 8
push 1
push eax
call fcn.00407f25
add esp, 0xc
jmp 0x40670e
xor eax, eax
cmp eax, 1
jne 0x406749
cmp dword [0x4148e8], 0
je 0x40673b
mov eax, dword [0x414878]
mov cx, word [esp + 0x10]
mov eax, dword [eax + esi*4]
cmp word [eax + 0x21e], cx
jne 0x40673b
cmp byte [eax + 0x10c], 0
jne 0x4067b2
mov eax, dword [0x414878]
mov eax, dword [eax + esi*4]
and byte [eax + 8], 0
jmp 0x4067b2
mov eax, dword [0x414878]
mov eax, dword [eax + esi*4]
mov cx, word [eax + 0x21e]
cmp cx, word [eax + 0x21c]
jne 0x40676a
cmp byte [eax + 0x10c], 0
je 0x406773
cmp dword [0x4148e8], 0
jne 0x4067b2
mov di, word [esp + 0x10]
cmp word [eax + 0x218], di
jb 0x406797
add eax, 8
push 0
push eax
lea eax, [esp + 0x2c4]
push eax
call fcn.0040832c
add esp, 0xc
mov eax, dword [0x414878]
mov eax, dword [eax + esi*4]
cmp word [eax + 0x21a], di
jb 0x4067b2
add eax, 8
push eax
call fcn.004090fa
pop ecx
dec esi
jns 0x406696
mov eax, dword [0x4148e0]
lea edi, [eax - 1]
test edi, edi
jl 0x4068e3
mov eax, dword [0x414c6c]
mov dx, word [esp + 0x10]
mov esi, edi
shl esi, 2
mov eax, dword [eax + esi]
cmp word [eax + 0x214], dx
jb 0x4068dc
mov ecx, dword [eax + 0x208]
test ecx, ecx
jne 0x4067fa
cmp dword [0x41487c], ecx
je 0x406866
cmp word [eax + 0x218], dx
jb 0x406815
push dword [eax + 0x21c]
push ecx
push eax
call fcn.00407f25
add esp, 0xc
jmp 0x406817
xor eax, eax
push 1
pop ecx
cmp eax, ecx
jne 0x406853
cmp dword [0x4148e8], 0
je 0x406846
mov eax, dword [0x414c6c]
mov eax, dword [eax + esi]
mov cx, word [eax + 0x216]
cmp cx, word [esp + 0x10]
jne 0x406846
cmp byte [eax + 0x104], 0
jne 0x406866
mov eax, dword [0x414c6c]
mov eax, dword [eax + esi]
and byte [eax], 0
jmp 0x406866
cmp eax, 2
jne 0x406866
mov eax, dword [0x414c6c]
mov eax, dword [eax + esi]
mov dword [eax + 0x208], ecx
mov eax, dword [0x414c6c]
mov eax, dword [eax + esi]
cmp dword [eax + 0x208], 0
je 0x4068dc
cmp byte [eax], 0
je 0x4068dc
mov cx, word [eax + 0x216]
cmp cx, word [eax + 0x214]
jne 0x406895
cmp byte [eax + 0x104], 0
je 0x40689e
cmp dword [0x4148e8], 0
jne 0x4068dc
mov cx, word [esp + 0x10]
cmp word [eax + 0x210], cx
jb 0x4068bf
push 0
push eax
lea eax, [esp + 0x2c4]
push eax
call fcn.0040832c
add esp, 0xc
mov eax, dword [0x414c6c]
mov esi, dword [eax + esi]
mov ax, word [esp + 0x10]
cmp word [esi + 0x212], ax
jb 0x4068dc
push esi
call fcn.004090fa
pop ecx
dec edi
jns 0x4067c9
xor esi, esi
cmp dword [0x414c0c], esi
jle 0x4069ef
cmp dword [0x4148a8], 0
jne 0x4069ef
mov eax, dword [0x414878]
mov eax, dword [eax + esi*4]
cmp byte [eax + 8], 0
lea ecx, [eax + 8]
je 0x4069dc
cmp dword [0x414860], 0x3e8
jne 0x406948
cmp dword [eax + 0x214], 0
jne 0x406955
cmp dword [0x4148e8], 0
je 0x406948
cmp byte [eax + 0x10c], 0
je 0x406948
mov dx, word [eax + 0x21e]
cmp dx, word [esp + 0x10]
je 0x406955
cmp dword [eax + 0x210], 0
je 0x4069dc
mov dx, word [esp + 0x10]
cmp word [eax + 0x21c], dx
jb 0x4069dc
cmp word [eax + 0x21e], dx
jne 0x40697a
cmp dword [0x4148e8], 0
je 0x40697a
push 1
pop edx
jmp 0x40697c
xor edx, edx
add eax, 0x10c
push edx
push eax
push ecx
call fcn.0040812c
add esp, 0xc
test eax, eax
je 0x4069dc
lea eax, [esp + 0x7c]
push eax
push dword [0x4148d0]
call ebp
mov eax, dword [0x414878]
mov eax, dword [eax + esi*4]
add eax, 8
push eax
push dword [0x4148d0]
call ebx
push dword [0x4148d0]
push 0x3ef
push dword [0x414838]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call fcn.00407d39
pop ecx
pop ecx
push dword [0x4148d0]
call fcn.00407537
pop ecx
inc dword [0x414888]
inc esi
cmp esi, dword [0x414c0c]
jl 0x4068f1
xor esi, esi
cmp dword [0x4148e0], esi
jle 0x406aea
cmp dword [0x4148a8], 0
jne 0x406aea
mov eax, dword [0x414c6c]
mov eax, dword [eax + esi*4]
cmp byte [eax], 0
je 0x406ad7
cmp dword [eax + 0x208], 0
jne 0x406a50
cmp dword [0x4148e8], 0
je 0x406ad7
cmp byte [eax + 0x104], 0
je 0x406ad7
mov cx, word [esp + 0x10]
cmp word [eax + 0x216], cx
jne 0x406ad7
mov cx, word [esp + 0x10]
cmp word [eax + 0x214], cx
jb 0x406ad7
cmp word [eax + 0x216], cx
jne 0x406a75
cmp dword [0x4148e8], 0
je 0x406a75
push 1
pop ecx
jmp 0x406a77
xor ecx, ecx
push ecx
lea ecx, [eax + 0x104]
push ecx
push eax
call fcn.0040812c
add esp, 0xc
test eax, eax
je 0x406ad7
lea eax, [esp + 0xbc]
push eax
push dword [0x4148d0]
call ebp
mov eax, dword [0x414c6c]
push dword [eax + esi*4]
push dword [0x4148d0]
call ebx
push dword [0x4148d0]
push 0x3ef
push dword [0x414838]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call fcn.00407d39
pop ecx
pop ecx
push dword [0x4148d0]
call fcn.00407537
pop ecx
inc dword [0x414888]
inc esi
cmp esi, dword [0x4148e0]
jl 0x4069fd
xor esi, esi
cmp dword [0x4148e8], esi
je 0x406c18
cmp dword [0x414c0c], esi
jle 0x406b9b
cmp dword [0x4148a8], 0
jne 0x406b9b
mov eax, dword [0x414878]
mov eax, dword [eax + esi*4]
cmp byte [eax + 8], 0
lea ecx, [eax + 8]
je 0x406b8e
cmp dword [0x414860], 0x3e8
jne 0x406b49
cmp dword [eax + 0x214], 0
jne 0x406b52
cmp dword [0x4148e8], 0
je 0x406b49
cmp byte [eax + 0x10c], 0
jne 0x406b52
cmp dword [eax + 0x210], 0
je 0x406b8e
mov dx, word [esp + 0x10]
cmp word [eax + 0x21c], dx
jb 0x406b8e
cmp byte [eax + 0x10c], 0
je 0x406b8e
cmp word [eax + 0x21e], dx
jne 0x406b8e
cmp word [eax + 0x218], dx
jb 0x406b8e
push 1
lea eax, [esp + 0x2c0]
push ecx
push eax
call fcn.0040832c
add esp, 0xc
inc esi
cmp esi, dword [0x414c0c]
jl 0x406b04
xor esi, esi
cmp dword [0x4148e0], esi
jle 0x406c18
xor ecx, ecx
cmp dword [0x4148a8], ecx
jne 0x406c18
mov eax, dword [0x414c6c]
mov eax, dword [eax + esi*4]
cmp byte [eax], cl
je 0x406c0f
cmp dword [eax + 0x208], ecx
jne 0x406bd3
cmp dword [0x4148e8], ecx
je 0x406c0f
cmp byte [eax + 0x104], cl
je 0x406c0f
mov cx, word [esp + 0x10]
cmp word [eax + 0x214], cx
jb 0x406c0f
cmp byte [eax + 0x104], 0
je 0x406c0f
cmp word [eax + 0x216], cx
jne 0x406c0f
cmp word [eax + 0x210], cx
jb 0x406c0f
push 1
push eax
lea eax, [esp + 0x2c4]
push eax
call fcn.0040832c
add esp, 0xc
inc esi
cmp esi, dword [0x4148e0]
jl 0x406ba5
cmp dword [0x414860], 0x3e8
mov ebp, dword [esp + 0xc00]
jne 0x406c44
cmp dword [0x4148a8], 0
jne 0x406c44
cmp dword [0x4148e8], 0
jne 0x406c44
push ebp
call fcn.004088aa
pop ecx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
xor edi, edi
cmp dword [0x414ce8], edi
jle 0x406d71
cmp dword [0x4148a8], 0
jne 0x406d71
mov edx, dword [0x414860]
cmp edx, 0x3e8
je 0x406c88
mov eax, dword [0x41488c]
mov eax, dword [eax + edi*4]
cmp dword [eax + 0x104], 0
je 0x406d5e
mov eax, dword [0x41488c]
mov cx, word [esp + 0x10]
mov esi, edi
shl esi, 2
mov eax, dword [eax + esi]
cmp word [eax + 0x10a], cx
jb 0x406d5e
cmp edx, 0x3e9
je 0x406cbf
cmp word [eax + 0x108], cx
lea eax, [esp + 0x13c]
jb 0x406cc6
lea eax, [esp + 0xfc]
push eax
push dword [0x4148d0]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [0x41488c]
push dword [eax + esi]
call ebx
mov ecx, dword [0x41488c]
mov ecx, dword [ecx + esi]
and byte [eax + ecx - 1], 0
mov eax, dword [0x41488c]
push dword [eax + esi]
push dword [0x4148d0]
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push dword [0x4148d0]
push 0x3ef
push dword [0x414838]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call fcn.00407d39
pop ecx
pop ecx
push dword [0x4148d0]
call fcn.00407537
cmp dword [0x414860], 0x3e9
mov eax, dword [0x41488c]
pop ecx
je 0x406d50
mov ecx, dword [eax + esi]
mov dx, word [esp + 0x10]
cmp word [ecx + 0x108], dx
jae 0x406d50
xor ecx, ecx
jmp 0x406d53
push 1
pop ecx
push ecx
push dword [eax + esi]
call fcn.004076c0
pop ecx
pop ecx
inc dword [0x414888]
inc edi
cmp edi, dword [0x414ce8]
jl 0x406c58
cmp dword [0x4148e8], 0
je 0x406db1
cmp dword [0x414908], 0
jne 0x406d8b
push ebp
call fcn.004088aa
jmp 0x406db0
push 1
push ebp
call fcn.0040a900
mov esi, eax
pop ecx
cmp esi, 0xffffffff
pop ecx
je 0x406db1
push dword [0x414908]
push esi
call fcn.0040a780
pop ecx
pop ecx
push esi
call fcn.0040a6a0
pop ecx
xor edi, edi
cmp dword [0x414c5c], edi
mov dword [esp + 0x24], edi
jle 0x407054
cmp dword [0x4148a8], 0
jne 0x407054
cmp dword [0x414860], 0x3e8
je 0x406df1
mov eax, dword [0x414be4]
mov eax, dword [eax + edi*4]
cmp dword [eax + 0x1210], 0
je 0x40703d
mov eax, dword [0x414be4]
mov cx, word [esp + 0x10]
mov ebp, edi
shl ebp, 2
mov eax, dword [eax + ebp]
cmp word [eax + 0x1214], cx
jb 0x40703d
lea eax, [esp + 0x23c]
push eax
push dword [0x4148d0]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [0x4148d0]
call ebx
mov ecx, dword [0x414be4]
mov esi, eax
mov eax, dword [0x4148d0]
mov ecx, dword [ecx + ebp]
add esi, eax
add ecx, 8
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push esi
call ebx
cmp eax, 0x30
jle 0x406e60
add esi, 0x2d
push 0x411580
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [0x4148d0]
call fcn.00407537
mov eax, dword [0x414be4]
cmp dword [0x4148e8], 0
pop ecx
lea ecx, [eax + ebp]
mov eax, dword [eax + ebp]
lea esi, [eax + 0xa08]
jne 0x406e8c
lea esi, [eax + 0x208]
cmp dword [0x414854], 0
je 0x407017
mov ecx, dword [ecx]
lea eax, [esp + 0x20]
push eax
push 0x1f
lea eax, [ecx + 8]
push 0
push eax
mov eax, dword [ecx + 0x1208]
push dword [eax*4 + 0x411020]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40703d
push esi
call ebx
mov edi, eax
mov eax, dword [0x414be4]
inc edi
mov eax, dword [eax + ebp]
mov eax, dword [eax + 0x120c]
cmp eax, 3
jne 0x406eed
push esi
call fcn.0040a5c0
pop ecx
mov dword [esi], eax
push 4
pop edi
jmp 0x406fd8
cmp eax, 2
jne 0x406f21
xor edi, edi
cmp byte [esi], 0
mov ebx, esi
je 0x406fd8
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebx
lea edi, [edi + eax + 1]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [ebx + eax + 1], 0
lea ebx, [ebx + eax + 1]
jne 0x406eff
jmp 0x406fd8
cmp eax, 4
jne 0x406fd8
and byte [esp + 0x17], 0
xor edi, edi
cmp byte [esi], 0
mov dword [esp + 0x1c], edi
mov ebx, esi
mov dword [esp + 0x18], esi
je 0x406fd8
movsx eax, byte [ebx]
push eax
call fcn.0040a320
mov byte [ebx], al
cmp dword [0x41205c], 1
pop ecx
jle 0x406f68
movsx eax, al
push 4
push eax
call fcn.0040a520
pop ecx
pop ecx
jmp 0x406f77
mov ecx, dword [str.________________________________H]
movsx eax, al
mov al, byte [ecx + eax*2]
and eax, 4
test eax, eax
jne 0x406f85
mov al, byte [ebx]
cmp al, 0x41
jl 0x406fce
cmp al, 0x46
jg 0x406fce
cmp dword [esp + 0x1c], 0
mov al, byte [ebx]
je 0x406fb8
cmp al, 0x39
movsx eax, al
jg 0x406f9a
sub eax, 0x30
jmp 0x406f9d
sub eax, 0x37
mov cl, byte [esp + 0x17]
shl cl, 4
or cl, al
mov eax, dword [esp + 0x18]
inc dword [esp + 0x18]
inc edi
and dword [esp + 0x1c], 0
mov byte [eax], cl
jmp 0x406fce
cmp al, 0x39
jg 0x406fc0
sub al, 0x30
jmp 0x406fc2
sub al, 0x37
mov byte [esp + 0x17], al
mov dword [esp + 0x1c], 1
inc ebx
cmp byte [ebx], 0
jne 0x406f44
mov eax, dword [0x414be4]
push edi
push esi
mov eax, dword [eax + ebp]
mov ecx, dword [eax + 0x120c]
add eax, 0x108
push dword [ecx*4 + 0x411038]
push 0
push eax
push dword [esp + 0x34]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [esp + 0x24]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
jmp 0x40703d
cmp byte [eax + 0x108], 0
jne 0x40703d
cmp dword [eax + 0x1208], 0
jne 0x40703d
push 0
push esi
add eax, 8
push 1
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
inc dword [0x414888]
inc edi
cmp edi, dword [0x414c5c]
mov dword [esp + 0x24], edi
jl 0x406dc3
mov eax, dword [0x414cfc]
dec eax
test eax, eax
mov dword [esp + 0x24], eax
jl 0x407289
jmp 0x40706c
mov eax, dword [esp + 0x24]
cmp dword [0x4148a8], 0
jne 0x407289
cmp dword [0x414860], 0x3e8
je 0x40709b
mov ecx, dword [0x414868]
mov eax, dword [ecx + eax*4]
cmp dword [eax + 0x210], 0
je 0x407279
mov eax, dword [esp + 0x24]
mov cx, word [esp + 0x10]
mov esi, eax
mov eax, dword [0x414868]
shl esi, 2
mov eax, dword [eax + esi]
cmp word [eax + 0x214], cx
jb 0x407279
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x1fc]
push eax
push dword [0x4148d0]
call ebp
push dword [0x4148d0]
call ebx
mov ecx, dword [0x414868]
mov edi, eax
mov eax, dword [0x4148d0]
mov ecx, dword [ecx + esi]
add edi, eax
add ecx, 8
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
call ebx
cmp eax, 0x30
jle 0x40710c
add edi, 0x2d
push 0x411580
push edi
call ebp
push dword [0x4148d0]
call fcn.00407537
cmp dword [0x414854], 0
pop ecx
je 0x407250
mov dword [esp + 0x20], 1
mov eax, dword [0x414868]
lea ecx, [esp + 0x18]
push ecx
push 0x1f
mov eax, dword [eax + esi]
push 0
lea ecx, [eax + 8]
mov eax, dword [eax + 0x20c]
push ecx
push dword [eax*4 + 0x411020]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x407236
cmp dword [esp + 0x20], eax
je 0x40717b
mov eax, dword [0x414868]
mov eax, dword [eax + esi]
add eax, 0x10c
push eax
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
xor edi, edi
lea eax, [esp + 0x1c]
push edi
push edi
push edi
push edi
push eax
lea eax, [esp + 0x410]
push eax
push edi
push dword [esp + 0x34]
mov dword [esp + 0x40], edi
mov dword [esp + 0x3c], 0x100
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov ebp, eax
cmp ebp, edi
je 0x407200
push edi
push edi
push edi
lea eax, [esp + 0x28]
push edi
push eax
lea eax, [esp + 0x410]
mov dword [esp + 0x30], 0x100
push eax
push edi
push dword [esp + 0x34]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push dword [esp + 0x18]
mov ebp, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebp, edi
je 0x407238
mov eax, dword [0x414868]
mov eax, dword [eax + esi]
lea ecx, [eax + 8]
mov eax, dword [eax + 0x20c]
push ecx
push dword [eax*4 + 0x411020]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x40720a
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebp, edi
je 0x407238
mov eax, dword [0x414868]
mov edi, dword [eax + esi]
mov eax, edi
add eax, 8
push eax
call ebx
lea eax, [eax + edi + 7]
add edi, 8
cmp eax, edi
jbe 0x407231
cmp byte [eax], 0x5c
je 0x407231
dec eax
jmp 0x407225
and byte [eax], 0
jmp 0x407238
xor ebp, ebp
test ebp, ebp
je 0x407279
mov eax, dword [0x414868]
mov eax, dword [eax + esi]
cmp byte [eax + 8], 0
jne 0x40712d
jmp 0x407279
mov eax, dword [0x414868]
mov esi, dword [eax + esi]
cmp byte [esi + 0x10c], 0
jne 0x407279
cmp dword [esi + 0x20c], 0
jne 0x407279
add esi, 8
push esi
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
inc dword [0x414888]
dec dword [esp + 0x24]
jns 0x407068
mov eax, dword [0x414c64]
lea edi, [eax - 1]
test edi, edi
jl 0x407356
cmp dword [0x4148a8], 0
jne 0x40752c
cmp dword [0x414860], 0x3e8
je 0x4072c7
mov eax, dword [0x414930]
mov eax, dword [eax + edi*4]
cmp dword [eax + 0x104], 0
je 0x407349
mov eax, dword [0x414930]
mov eax, dword [eax + edi*4]
mov ax, word [eax + 0x108]
cmp ax, word [esp + 0x10]
jb 0x407349
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x33c]
push eax
push dword [0x4148d0]
call ebp
push dword [0x4148d0]
call ebx
mov ecx, dword [0x414930]
mov esi, eax
mov eax, dword [0x4148d0]
push dword [ecx + edi*4]
add esi, eax
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push esi
call ebx
cmp eax, 0x30
jle 0x407327
add esi, 0x2d
push 0x411580
push esi
call ebp
push dword [0x4148d0]
call fcn.00407537
mov eax, dword [0x414930]
pop ecx
mov eax, dword [eax + edi*4]
push dword [eax + 0x100]
push eax
call fcn.004086e5
pop ecx
pop ecx
inc dword [0x414888]
dec edi
jns 0x407299
cmp dword [0x4148a8], 0
jne 0x40752c
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
xor ebp, ebp
push 1
xor esi, esi
cmp dword [0x414864], ebp
pop edi
jle 0x40741d
cmp dword [0x4148a8], ebp
jne 0x40741d
cmp dword [0x414860], 0x3e8
je 0x4073a4
mov eax, dword [0x4148b4]
mov eax, dword [eax + esi*4]
cmp dword [eax + 0x300], ebp
je 0x40740a
mov eax, dword [0x4148b4]
mov eax, dword [eax + esi*4]
mov ax, word [eax + 0x304]
cmp ax, word [esp + 0x10]
je 0x4073c2
cmp dword [0x4148e8], ebp
jne 0x40740a
cmp edi, ebp
je 0x4073cd
call fcn.00407876
xor edi, edi
lea eax, [esp + 0x27c]
push eax
push dword [0x4148d0]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [0x4148b4]
mov eax, dword [eax + esi*4]
add eax, 0x100
push eax
push dword [0x4148d0]
call ebx
push dword [0x4148d0]
call fcn.00407537
pop ecx
push esi
call fcn.00407a47
pop ecx
inc dword [0x414888]
inc esi
cmp esi, dword [0x414864]
jl 0x40737c
cmp edi, ebp
jne 0x407442
mov eax, dword [0x4148ac]
cmp eax, ebp
je 0x407430
push eax
call sub.USER32.dll_DdeDisconnect
push ebp
call fcn.00407537
pop ecx
push dword [0x41485c]
call sub.USER32.dll_DdeUninitialize
cmp dword [0x4148f8], ebp
je 0x40752c
cmp dword [0x414860], 0x3e8
jne 0x407462
cmp dword [0x4148e8], ebp
je 0x40747a
cmp dword [0x4148e8], ebp
je 0x40752c
cmp dword [0x414908], ebp
jne 0x40752c
cmp dword [0x414854], ebp
je 0x40752c
lea eax, [esp + 0x20]
push eax
push 0x1f
push ebp
push str.SoftwareWise_SolutionsWamUser
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40752c
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0x100
push eax
lea eax, [esp + 0x400]
push eax
lea eax, [esp + 0x20]
push eax
push ebp
push str.Path
push dword [esp + 0x34]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x407522
lea eax, [esp + 0x3fc]
push ebp
push eax
call fcn.00408bfa
pop ecx
lea eax, [esp + 0x400]
pop ecx
push str.__U__
push eax
call ebx
push dword [0x4148f8]
lea eax, [esp + 0x400]
push eax
call ebx
lea eax, [esp + 0x3fc]
push 0x41154c
push eax
call ebx
lea eax, [esp + 0x3fc]
push 5
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xbec
ret