Function at 0x40a6a0
Capabilities:
Contain obfuscated stackstrings
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dd509
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1b0
push esi
push edi
mov ecx, 0x510279
mov dword [ebp - 4], 2
call fcn.004b782d
lea eax, [ebp + 0x20]
push eax
lea ecx, [ebp - 0x1bc]
call fcn.00403da0
lea eax, [ebp + 0x20]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x1a4]
call fcn.00403da0
lea eax, [ebp + 0x20]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x18c]
call fcn.00403da0
xor eax, eax
mov byte [ebp - 4], 5
mov word [ebp - 0x1c], ax
lea ecx, [ebp - 0x1a]
lea eax, [ebp - 0xd]
mov dword [ebp - 0x44], 0
push eax
push ecx
lea edx, [ebp - 0x34]
mov dword [ebp - 0x34], 0x41005c
push edx
lea ecx, [ebp - 0x98]
mov dword [ebp - 0x30], 0x700070
mov dword [ebp - 0x2c], 0x69006c
mov dword [ebp - 0x28], 0x610063
mov dword [ebp - 0x24], 0x690074
mov dword [ebp - 0x20], 0x6e006f
call fcn.00403ee0
push dword [eax]
lea ecx, [ebp - 0x1bc]
mov byte [ebp - 4], 6
call fcn.0040c590
cmp dword [eax + 0x14], 8
jb 0x40a771
mov eax, dword [eax]
lea ecx, [ebp - 0x88]
push ecx
lea ecx, [ebp - 0x44]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 5
mov esi, eax
call fcn.0040c340
test esi, esi
jne 0x40b4ba
xor eax, eax
mov dword [ebp - 0xc4], 0x410020
mov word [ebp - 0xb4], ax
lea ecx, [ebp - 0xb2]
mov word [ebp - 0xdc], ax
lea edx, [ebp - 0xc4]
mov word [ebp - 0x90], ax
lea eax, [ebp - 0xd]
push eax
push ecx
push edx
lea ecx, [ebp - 0x174]
mov dword [ebp - 0xc0], 0x740075
mov dword [ebp - 0xbc], 0x6f0068
mov dword [ebp - 0xb8], 0x730072
mov dword [ebp - 0xf0], 0x500047
mov dword [ebp - 0xec], 0x200054
mov dword [ebp - 0xe8], 0x680043
mov dword [ebp - 0xe4], 0x6f0072
mov dword [ebp - 0xe0], 0x65006d
mov dword [ebp - 0x98], 0x680054
mov dword [ebp - 0x94], 0x200065
call fcn.00403ee0
mov edi, eax
lea eax, [ebp - 0xd]
mov byte [ebp - 4], 7
push eax
lea ecx, [ebp - 0xda]
push ecx
lea edx, [ebp - 0xf0]
push edx
lea ecx, [ebp - 0x168]
call fcn.00403ee0
mov esi, dword [eax]
mov byte [ebp - 4], 8
call fcn.00405900
mov ecx, eax
test ecx, ecx
je 0x40b503
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x14], eax
push esi
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 9
call fcn.004048a0
test al, al
jne 0x40a8cc
test esi, esi
jne 0x40a8ae
xor ecx, ecx
jmp 0x40a8c2
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40a8b3
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x14]
call fcn.00406c80
lea eax, [ebp - 0xd]
mov byte [ebp - 4], 0xa
push eax
lea ecx, [ebp - 0x8e]
push ecx
lea edx, [ebp - 0x98]
push edx
lea ecx, [ebp - 0x15c]
call fcn.00403ee0
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0xb
push ecx
push dword [eax]
lea eax, [ebp - 0x124]
push eax
call fcn.00404460
push dword [edi]
mov byte [ebp - 4], 0xc
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.00404390
add esp, 0x18
mov edx, dword [ebp - 0x124]
or edi, 0xffffffff
mov byte [ebp - 4], 0xe
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40a93d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x15c]
call fcn.0040c340
mov edx, dword [ebp - 0x14]
mov eax, edi
mov byte [ebp - 4], 0x10
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40a966
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x168]
call fcn.0040c340
lea ecx, [ebp - 0x174]
mov byte [ebp - 4], 0x12
call fcn.0040c340
xor eax, eax
mov dword [ebp - 0x40], 0x700041
mov word [ebp - 0x1c], ax
lea ecx, [ebp - 0x1a]
lea eax, [ebp - 0xd]
mov dword [ebp - 0x3c], 0x6c0070
push eax
push ecx
lea edx, [ebp - 0x40]
mov dword [ebp - 0x38], 0x630069
push edx
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0x34], 0x740061
mov dword [ebp - 0x30], 0x6f0069
mov dword [ebp - 0x2c], 0x43006e
mov dword [ebp - 0x28], 0x6d006f
mov dword [ebp - 0x24], 0x610070
mov dword [ebp - 0x20], 0x79006e
call fcn.00403ee0
mov esi, dword [eax]
mov byte [ebp - 4], 0x13
call fcn.00405900
mov ecx, eax
test ecx, ecx
je 0x40b50d
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x14], eax
push esi
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x14
call fcn.004048a0
test al, al
jne 0x40aa39
test esi, esi
jne 0x40aa17
xor ecx, ecx
jmp 0x40aa2f
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40aa20
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x14]
call fcn.00406c80
mov eax, dword [ebp - 0x84]
mov esi, dword [ebp - 0x14]
mov byte [ebp - 4], 0x13
mov ecx, dword [eax - 0xc]
lea ecx, [ecx*2 + 2]
push ecx
push eax
push 1
push 0
push esi
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40aa77
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 0x12
call fcn.0040c340
call fcn.00405900
mov ecx, eax
test ecx, ecx
je 0x40b517
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x14], eax
push 0x4e4930
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x15
call fcn.004048a0
test al, al
jne 0x40aac6
push 5
push 0x4e4930
lea ecx, [ebp - 0x14]
call fcn.00406c80
xor eax, eax
mov byte [ebp - 4], 0x16
mov word [ebp - 0x54], ax
lea ecx, [ebp - 0x52]
lea eax, [ebp - 0xd]
mov dword [ebp - 0x80], 0x700041
push eax
push ecx
lea edx, [ebp - 0x80]
mov dword [ebp - 0x7c], 0x6c0070
push edx
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0x78], 0x630069
mov dword [ebp - 0x74], 0x740061
mov dword [ebp - 0x70], 0x6f0069
mov dword [ebp - 0x6c], 0x44006e
mov dword [ebp - 0x68], 0x730065
mov dword [ebp - 0x64], 0x720063
mov dword [ebp - 0x60], 0x700069
mov dword [ebp - 0x5c], 0x690074
mov dword [ebp - 0x58], 0x6e006f
call fcn.00403ee0
mov esi, dword [eax]
mov byte [ebp - 4], 0x17
call fcn.00405900
mov ecx, eax
test ecx, ecx
je 0x40b521
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x18], eax
push esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x18
call fcn.004048a0
test al, al
jne 0x40ab8d
test esi, esi
jne 0x40ab6f
xor ecx, ecx
jmp 0x40ab83
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40ab74
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x18]
call fcn.00406c80
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
mov byte [ebp - 4], 0x17
mov ecx, dword [eax - 0xc]
lea ecx, [ecx*2 + 2]
push ecx
push eax
push 1
push 0
push esi
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40abc8
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 0x16
call fcn.0040c340
cmp dword [ebp + 0x1c], 8
lea esi, [ebp + 8]
cmovae esi, dword [ebp + 8]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x40abe5
sub esi, ecx
mov dword [ebp - 0x38], 0x700041
lea eax, [ebp - 0xd]
sar esi, 1
push eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x34], 0x6c0070
push ecx
lea edx, [ebp - 0x38]
mov dword [ebp - 0x30], 0x630069
push edx
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0x2c], 0x740061
mov dword [ebp - 0x28], 0x6f0069
mov dword [ebp - 0x24], 0x49006e
mov dword [ebp - 0x20], 0x6f0063
mov dword [ebp - 0x1c], 0x6e
call fcn.00403ee0
mov eax, dword [eax]
mov byte [ebp - 4], 0x19
mov dword [ebp - 0x48], eax
call fcn.00405900
mov ecx, eax
test ecx, ecx
je 0x40b52b
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x18], eax
push dword [ebp - 0x48]
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x1a
call fcn.004048a0
test al, al
jne 0x40acaa
mov edx, dword [ebp - 0x48]
test edx, edx
jne 0x40ac86
xor ecx, ecx
jmp 0x40aca0
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x50], eax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40ac90
sub ecx, dword [ebp - 0x50]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x18]
call fcn.00406c80
cmp dword [ebp + 0x1c], 8
lea eax, [esi*2 + 2]
mov esi, dword [ebp - 0x18]
lea ecx, [ebp + 8]
cmovae ecx, dword [ebp + 8]
push eax
push ecx
push 1
push 0
push esi
push dword [ebp - 0x44]
mov byte [ebp - 4], 0x19
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40acea
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 0x16
call fcn.0040c340
xor eax, eax
mov dword [ebp - 0x108], 0x500047
mov word [ebp - 0xf4], ax
lea ecx, [ebp - 0xf2]
lea eax, [ebp - 0xd]
mov dword [ebp - 0x104], 0x200054
push eax
push ecx
lea edx, [ebp - 0x108]
mov dword [ebp - 0x100], 0x680043
push edx
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0xfc], 0x6f0072
mov dword [ebp - 0xf8], 0x65006d
call fcn.00403ee0
mov esi, dword [eax]
mov byte [ebp - 4], 0x1b
call fcn.00405900
mov ecx, eax
test ecx, ecx
je 0x40b535
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x18], eax
push esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x1c
call fcn.004048a0
test al, al
jne 0x40adaa
test esi, esi
jne 0x40ad8c
xor ecx, ecx
jmp 0x40ada0
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40ad91
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x18]
call fcn.00406c80
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 0x1e
call fcn.0040c340
lea eax, [ebp - 0xd]
mov dword [ebp - 0x38], 0x700041
push eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x34], 0x6c0070
push ecx
lea edx, [ebp - 0x38]
mov dword [ebp - 0x30], 0x630069
push edx
lea ecx, [ebp - 0x138]
mov dword [ebp - 0x2c], 0x740061
mov dword [ebp - 0x28], 0x6f0069
mov dword [ebp - 0x24], 0x4e006e
mov dword [ebp - 0x20], 0x6d0061
mov dword [ebp - 0x1c], 0x65
call fcn.00403ee0
mov esi, dword [eax]
mov byte [ebp - 4], 0x1f
call fcn.00405900
mov ecx, eax
test ecx, ecx
je 0x40b53f
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x4c], eax
push esi
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0x20
call fcn.004048a0
test al, al
jne 0x40ae69
test esi, esi
jne 0x40ae43
xor ecx, ecx
jmp 0x40ae5f
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40ae50
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x4c]
call fcn.00406c80
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x4c]
mov byte [ebp - 4], 0x1f
mov ecx, dword [eax - 0xc]
lea ecx, [ecx*2 + 2]
push ecx
push eax
push 1
push 0
push esi
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40aea4
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x138]
mov byte [ebp - 4], 0x1e
call fcn.0040c340
lea eax, [ebp - 0xd]
mov dword [ebp - 0xd8], 0x530054
push eax
lea ecx, [ebp - 0xc4]
mov dword [ebp - 0xd4], 0x720042
push ecx
lea edx, [ebp - 0xd8]
mov dword [ebp - 0xd0], 0x77006f
push edx
lea ecx, [ebp - 0x138]
mov dword [ebp - 0xcc], 0x650073
mov dword [ebp - 0xc8], 0x72
call fcn.00403ee0
mov esi, dword [eax]
mov byte [ebp - 4], 0x21
call fcn.00405900
mov ecx, eax
test ecx, ecx
je 0x40b549
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x4c], eax
push esi
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0x22
call fcn.004048a0
test al, al
jne 0x40af5b
test esi, esi
jne 0x40af3d
xor ecx, ecx
jmp 0x40af51
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40af42
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x4c]
call fcn.00406c80
lea ecx, [ebp - 0x138]
mov byte [ebp - 4], 0x24
call fcn.0040c340
xor eax, eax
mov dword [ebp - 0x38], 0x700041
mov word [ebp - 0x1c], ax
lea ecx, [ebp - 0x1a]
lea eax, [ebp - 0xd]
mov dword [ebp - 0x34], 0x550070
push eax
push ecx
lea edx, [ebp - 0x38]
mov dword [ebp - 0x30], 0x650073
push edx
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x2c], 0x4d0072
mov dword [ebp - 0x28], 0x64006f
mov dword [ebp - 0x24], 0x6c0065
mov dword [ebp - 0x20], 0x640049
call fcn.00403ee0
mov esi, dword [eax]
mov byte [ebp - 4], 0x25
call fcn.00405900
mov ecx, eax
test ecx, ecx
je 0x40b553
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x48], eax
push esi
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x26
call fcn.004048a0
test al, al
jne 0x40b019
test esi, esi
jne 0x40aff3
xor ecx, ecx
jmp 0x40b00f
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40b000
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x48]
call fcn.00406c80
mov edi, dword [ebp - 0x4c]
mov esi, dword [ebp - 0x48]
mov byte [ebp - 4], 0x25
mov eax, dword [edi - 0xc]
lea eax, [eax*2 + 2]
push eax
push edi
push 1
push 0
push esi
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40b055
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0x24
call fcn.0040c340
xor eax, eax
mov dword [ebp - 0x34], 0x44005c
mov word [ebp - 0x1c], ax
lea ecx, [ebp - 0x1a]
lea eax, [ebp - 0xd]
mov dword [ebp - 0x30], 0x660065
push eax
push ecx
lea edx, [ebp - 0x34]
mov dword [ebp - 0x2c], 0x750061
push edx
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x28], 0x74006c
mov dword [ebp - 0x24], 0x630049
mov dword [ebp - 0x20], 0x6e006f
call fcn.00403ee0
push dword [eax]
lea ecx, [ebp - 0x1a4]
mov byte [ebp - 4], 0x27
call fcn.0040c590
cmp dword [eax + 0x14], 8
jb 0x40b0c4
mov eax, dword [eax]
lea ecx, [ebp - 0x88]
push ecx
lea ecx, [ebp - 0x44]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0x24
mov esi, eax
call fcn.0040c340
test esi, esi
jne 0x40b441
mov esi, dword [ebp + 0x1c]
lea edx, [ebp + 8]
cmp esi, 8
cmovae edx, dword [ebp + 8]
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x40b111
sub edx, ecx
lea ecx, [ebp + 8]
sar edx, 1
cmp esi, 8
cmovae ecx, dword [ebp + 8]
lea eax, [edx*2 + 2]
push eax
push ecx
push 1
push 0
push 0x4e4830
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [ebp - 0xd]
mov dword [ebp - 0x40], 0x73005c
push eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x3c], 0x650068
push ecx
lea edx, [ebp - 0x40]
mov dword [ebp - 0x38], 0x6c006c
push edx
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x34], 0x6f005c
mov dword [ebp - 0x30], 0x650070
mov dword [ebp - 0x2c], 0x5c006e
mov dword [ebp - 0x28], 0x6f0063
mov dword [ebp - 0x24], 0x6d006d
mov dword [ebp - 0x20], 0x6e0061
mov dword [ebp - 0x1c], 0x64
call fcn.00403ee0
push dword [eax]
lea ecx, [ebp - 0x18c]
mov byte [ebp - 4], 0x28
call fcn.0040c590
cmp dword [eax + 0x14], 8
jb 0x40b1bb
mov eax, dword [eax]
lea ecx, [ebp - 0x88]
push ecx
lea ecx, [ebp - 0x44]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0x24
mov esi, eax
call fcn.0040c340
test esi, esi
jne 0x40b441
lea eax, [ebp - 0xd]
mov dword [ebp - 0x80], 0x2d0020
push eax
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x7c], 0x73002d
push ecx
lea edx, [ebp - 0x80]
mov dword [ebp - 0x78], 0x6e0069
push edx
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x74], 0x6c0067
mov dword [ebp - 0x70], 0x2d0065
mov dword [ebp - 0x6c], 0x720061
mov dword [ebp - 0x68], 0x750067
mov dword [ebp - 0x64], 0x65006d
mov dword [ebp - 0x60], 0x74006e
mov dword [ebp - 0x5c], 0x250020
mov dword [ebp - 0x58], 0x31
call fcn.00403ee0
mov dword [ebp - 0x8c], eax
mov edx, dword [ebp + 0x48]
mov ecx, SysReAllocString
sub ecx, edx
mov byte [ebp - 4], 0x29
mov dword [ebp - 0x50], edx
cmp ecx, 1
jb 0x40b55d
cmp dword [ebp + 0x4c], 8
lea eax, [ebp + 0x38]
mov dword [ebp - 0x110], esi
lea ecx, [edx + 1]
cmovae eax, dword [ebp + 0x38]
xorps xmm0, xmm0
mov dword [ebp - 0x10c], esi
mov esi, 7
mov dword [ebp - 0x12c], eax
lea eax, [ebp - 0x120]
mov dword [ebp - 0x128], ecx
mov dword [ebp - 0x48], eax
movups xmmword [ebp - 0x120], xmm0
cmp ecx, esi
jbe 0x40b2fd
mov esi, ecx
or esi, 7
cmp esi, 0x7ffffffe
jbe 0x40b2d2
mov esi, SysReAllocString
jmp 0x40b2dc
mov eax, 0xa
cmp esi, eax
cmovb esi, eax
lea eax, [esi + 1]
push eax
lea ecx, [ebp - 0x120]
call fcn.00403670
mov ecx, dword [ebp - 0x128]
mov edx, dword [ebp - 0x50]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x110], ecx
mov ecx, 0x22
mov dword [ebp - 0x10c], esi
mov word [eax], cx
lea ecx, [eax + 2]
lea eax, [edx + edx]
push eax
push dword [ebp - 0x12c]
push ecx
call fcn.004ba310
mov eax, dword [ebp - 0x48]
xor edx, edx
mov ecx, dword [ebp - 0x50]
mov word [eax + ecx*2 + 2], dx
push 0x4e4904
lea eax, [ebp - 0x120]
mov byte [ebp - 4], 0x2a
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.00403730
mov ecx, dword [ebp - 0x8c]
mov byte [ebp - 4], 0x2b
push dword [ecx]
push eax
lea eax, [ebp - 0x150]
push eax
call fcn.00403730
add esp, 0x24
lea ecx, [ebp - 0x30]
call fcn.00403120
mov ecx, dword [ebp - 0x10c]
mov byte [ebp - 4], 0x29
cmp ecx, 8
jb 0x40b3b2
mov edx, dword [ebp - 0x120]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40b3a8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40b562
push ecx
push edx
call fcn.004b781f
add esp, 8
xor eax, eax
mov dword [ebp - 0x110], 0
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x10c], 7
mov word [ebp - 0x120], ax
call fcn.0040c340
mov esi, dword [ebp - 0x13c]
lea edx, [ebp - 0x150]
cmp esi, 8
cmovae edx, dword [ebp - 0x150]
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x40b3f3
sub edx, ecx
lea ecx, [ebp - 0x150]
sar edx, 1
cmp esi, 8
cmovae ecx, dword [ebp - 0x150]
lea eax, [edx*2 + 2]
push eax
push ecx
push 1
push 0
push 0x4e4830
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x150]
call fcn.00403120
or esi, 0xffffffff
mov byte [ebp - 4], 0x1e
mov eax, esi
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x40b45f
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x18]
mov eax, esi
add edx, 0xfffffff0
mov byte [ebp - 4], 0x16
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40b47d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x14]
mov eax, esi
add edx, 0xfffffff0
mov byte [ebp - 4], 0x12
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40b49b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x84]
add edx, 0xfffffff0
mov byte [ebp - 4], 5
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x40b4ba
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x18c]
call fcn.00403120
lea ecx, [ebp - 0x1a4]
call fcn.00403120
lea ecx, [ebp - 0x1bc]
call fcn.00403120
lea ecx, [ebp + 8]
call fcn.00403120
lea ecx, [ebp + 0x20]
call fcn.00403120
lea ecx, [ebp + 0x38]
call fcn.00403120
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00404870
push 0x80004005
call fcn.00404870
push 0x80004005
call fcn.00404870
push 0x80004005
call fcn.00404870
push 0x80004005
call fcn.00404870
push 0x80004005
call fcn.00404870
push 0x80004005
call fcn.00404870
push 0x80004005
call fcn.00404870
push 0x80004005
call fcn.00404870
call fcn.00402980
call fcn.004be74f
int3