Function at 0x404260
Capabilities:
Get common file path
Get disk information
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x27e4
call fcn.0040d200
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
mov edi, 0x4145b4
push edi
push dword [0x417bec]
call esi
push edi
push dword [0x417c4c]
call esi
cmp dword [0x417838], 0
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
je 0x4043c7
lea eax, [ebp - 8]
push eax
push 0x13
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call edi
test eax, eax
jne 0x404338
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x100
push eax
lea eax, [ebp - 0xbd0]
push eax
lea eax, [ebp - 0x24]
push eax
push 0
push str.Start_Menu
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40432f
cmp byte [ebp - 0xbd0], al
je 0x40432f
lea eax, [ebp - 0xbd0]
push eax
push dword [0x417bec]
call esi
push dword [0x417bec]
call ebx
mov ecx, dword [0x417bec]
add eax, ecx
cmp eax, ecx
jbe 0x40432b
cmp byte [eax], 0x5c
je 0x40431d
dec eax
cmp eax, ecx
ja 0x404313
cmp eax, ecx
jbe 0x40432b
dec eax
cmp eax, ecx
jbe 0x40432b
cmp byte [eax], 0x5c
jne 0x404321
and byte [eax + 1], 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x4177f0], 1
jne 0x4043c7
lea eax, [ebp - 8]
push eax
push 0x13
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000002
call edi
test eax, eax
jne 0x4043c7
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x100
push eax
lea eax, [ebp - 0xbd0]
push eax
lea eax, [ebp - 0x24]
push eax
push 0
push str.Common_Start_Menu
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4043be
cmp byte [ebp - 0xbd0], al
je 0x4043be
lea eax, [ebp - 0xbd0]
push eax
push dword [0x417c4c]
call esi
push dword [0x417c4c]
call ebx
mov ecx, dword [0x417c4c]
add eax, ecx
cmp eax, ecx
jbe 0x4043ba
cmp byte [eax], 0x5c
je 0x4043ba
dec eax
jmp 0x4043ae
and byte [eax + 1], 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push edi
call esi
push edi
call fcn.0040bdf6
cmp eax, edi
pop ecx
jbe 0x4043df
and byte [eax - 1], 0
push 0
push edi
call fcn.0040b02b
pop ecx
pop ecx
push 0x4140ec
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edi, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
and dword [ebp - 0x30], 0
push 0x41454c
call edi
push 0x414548
mov dword [ebp - 0x14], eax
call edi
push 0x10c
mov dword [ebp - 0x20], eax
call fcn.0040bf28
mov edx, dword [0x417cc8]
pop ecx
mov ecx, dword [0x417848]
push dword [ebp + 8]
mov dword [ecx + edx*4], eax
mov eax, dword [0x417848]
mov ecx, dword [0x417cc8]
mov eax, dword [eax + ecx*4]
and dword [eax + 0x104], 0
mov eax, dword [0x417848]
mov ecx, dword [0x417cc8]
mov eax, dword [eax + ecx*4]
and word [eax + 0x108], 0
mov eax, dword [0x417848]
mov ecx, dword [0x417cc8]
mov eax, dword [eax + ecx*4]
mov word [eax + 0x10a], 0x7fff
mov eax, dword [0x417848]
mov ecx, dword [0x417cc8]
mov edi, dword [eax + ecx*4]
push edi
call esi
push 1
push edi
call fcn.0040b02b
pop ecx
pop ecx
push edi
call ebx
lea eax, [eax + edi - 1]
cmp eax, edi
jbe 0x4044a3
cmp byte [eax], 0x5c
je 0x4044a8
and byte [eax], 0
dec eax
jmp 0x404494
cmp byte [eax], 0x5c
jne 0x4044ac
and byte [eax + 1], 0
push edi
call ebx
cmp eax, 3
jg 0x4044b7
and byte [edi], 0
and dword [ebp - 4], 0
mov ebx, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov dword [ebp - 0xc], 1
cmp dword [ebp - 4], 0
je 0x4044e2
lea eax, [ebp - 0x8d0]
push 0x100
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x4044f0
lea eax, [ebp - 0x8d0]
push 0x104
push eax
call ebx
lea eax, [ebp - 0x8d0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [ebp + eax - 0x8d1], 0x5c
je 0x404519
lea eax, [ebp - 0x8d0]
push 0x4140ec
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x8d0]
push eax
push edi
call fcn.00411110
add esp, 0xc
test eax, eax
jne 0x404538
and dword [ebp - 0xc], eax
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x4044c8
lea eax, [ebp - 0x1ae0]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x15d4]
push 0x104
push eax
call ebx
lea eax, [ebp - 0x15d4]
push eax
lea eax, [ebp - 0x18d8]
push eax
call esi
lea eax, [ebp - 0x18d8]
push str.WIN32S
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp dword [0x4177f0], 1
jne 0x4045dd
push 0x104
push dword [0x417888]
call ebx
push dword [0x417888]
lea eax, [ebp - 0x19dc]
push eax
call esi
lea eax, [ebp - 0x19dc]
push 0x4140ec
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x19dc]
push eax
push edi
call fcn.00411110
add esp, 0xc
test eax, eax
jne 0x4045ec
xor ebx, ebx
mov dword [ebp - 0xc], ebx
jmp 0x4045ee
lea eax, [ebp - 0x15d4]
push eax
push dword [0x417888]
call esi
xor ebx, ebx
cmp dword [ebp - 0xc], ebx
je 0x4045fe
cmp byte [edi], 0
je 0x4045fe
inc dword [0x417cc8]
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll__lopen]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
jne 0x404675
mov esi, 0x100
lea eax, [ebp - 0x8d0]
push esi
push eax
push 3
push dword [0x417bd4]
call fcn.0040b454
lea eax, [ebp - 0xbd0]
push esi
push eax
push 2
push dword [0x417bd4]
call fcn.0040b454
mov eax, dword [0x4177cc]
add esp, 0x20
cmp eax, ebx
je 0x404652
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
lea eax, [ebp - 0xbd0]
push ebx
push eax
lea eax, [ebp - 0x8d0]
push eax
push dword [0x4177d0]
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
pop eax
jmp 0x4070d5
mov edi, dword [sym.imp.KERNEL32.dll__llseek]
push 2
push ebx
push dword [ebp + 8]
call edi
push ebx
push ebx
push dword [ebp + 8]
mov dword [0x417c18], eax
call edi
or dword [ebp - 0x2c], 0xffffffff
push ebx
push dword [ebp + 8]
mov edi, 0x800
lea eax, [ebp - 0x8d0]
push edi
push eax
call fcn.004071cb
add esp, 0x10
cmp byte [ebp - 0x8cc], 0x20
jne 0x4046bf
mov dword [0x41785c], 1
movzx eax, word [0x417cd4]
mov ecx, dword [0x4177e0]
push str.
mov dword [ecx + eax*4], ebx
inc word [0x417cd4]
movzx eax, word [0x417cd4]
mov ecx, dword [0x4177e0]
mov dword [ecx + eax*4], ebx
and byte [ebp - 0x8cc], 0
lea eax, [ebp - 0x8d0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x404876
push ebx
lea eax, [ebp - 0x8d0]
push dword [ebp + 8]
push edi
push eax
call fcn.004071cb
and byte [ebp - 0x8ca], 0
add esp, 0x10
lea eax, [ebp - 0x8d0]
push str.Title:
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x404741
cmp byte [ebp - 0x8d0], 0
jne 0x404707
cmp byte [ebp - 0x8d0], 0
je 0x404876
lea eax, [ebp - 0x8d0]
push eax
call fcn.0040c599
pop ecx
lea eax, [ebp - 0x8d0]
push ebx
push dword [ebp + 8]
push edi
push eax
call fcn.004071cb
add esp, 0x10
cmp byte [ebp - 0x8d0], 0
je 0x4070ca
xor ebx, ebx
cmp dword [0x4177cc], ebx
je 0x404832
push 1
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll__llseek]
cmp dword [ebp - 0x2c], eax
mov dword [0x417c50], eax
je 0x404832
push 0xef6
mov dword [ebp - 0x2c], eax
push dword [0x4177cc]
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp eax, ebx
je 0x404832
lea ecx, [ebp - 0x40]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x40]
mov edi, dword [sym.imp.USER32.dll_ScreenToClient]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push eax
push dword [0x4177cc]
call edi
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push eax
push dword [0x4177cc]
call edi
mov eax, dword [ebp - 0x1c]
push ebx
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x40]
push eax
push dword [0x4177cc]
call dword [sym.imp.USER32.dll_InvalidateRect]
push dword [0x4177cc]
call dword [sym.imp.USER32.dll_UpdateWindow]
lea eax, [ebp - 0x8d0]
push str.Non_System_File:
push eax
mov dword [ebp - 8], 1
call fcn.004111c0
pop ecx
test eax, eax
pop ecx
jne 0x4048db
push ebx
mov edi, 0x800
push dword [ebp + 8]
lea eax, [ebp - 0x8d0]
mov dword [ebp - 0x10], 1
push edi
push eax
call fcn.004071cb
add esp, 0x10
jmp 0x4048e3
mov esi, 0x100
lea eax, [ebp - 0x8d0]
push esi
push eax
push 4
push dword [0x417bd4]
call fcn.0040b454
lea eax, [ebp - 0xbd0]
push esi
push eax
push 2
push dword [0x417bd4]
call fcn.0040b454
mov eax, dword [0x4177cc]
add esp, 0x20
cmp eax, ebx
je 0x4048b8
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
lea eax, [ebp - 0xbd0]
push ebx
push eax
lea eax, [ebp - 0x8d0]
push eax
push dword [0x4177d0]
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
pop ebx
jmp 0x4070ca
mov dword [ebp - 0x10], ebx
mov edi, 0x800
lea eax, [ebp - 0x8d0]
push str.Shared_DLL_counter_ignored:
push eax
call fcn.004111c0
pop ecx
test eax, eax
pop ecx
jne 0x404917
push ebx
lea eax, [ebp - 0x8d0]
push dword [ebp + 8]
mov dword [ebp - 4], 1
push edi
push eax
call fcn.004071cb
add esp, 0x10
jmp 0x40491a
mov dword [ebp - 4], ebx
push 0xb
lea eax, [ebp - 0x8d0]
push str.File_Copy:
push eax
call fcn.00411110
add esp, 0xc
test eax, eax
je 0x406517
push 0xc
lea eax, [ebp - 0x8d0]
push str.Shell_Link:
push eax
call fcn.00411110
add esp, 0xc
test eax, eax
je 0x406517
push 0x10
lea eax, [ebp - 0x8d0]
push str.File_Overwrite:
push eax
call fcn.00411110
add esp, 0xc
test eax, eax
je 0x406517
push 0xb
lea eax, [ebp - 0x8d0]
push str.RegDB_Key:
push eax
call fcn.00411110
add esp, 0xc
test eax, eax
jne 0x404e7b
lea eax, [ebp - 0x8c5]
push eax
lea eax, [ebp - 0xed0]
push eax
call esi
push ebx
lea eax, [ebp - 0x8d0]
push dword [ebp + 8]
push edi
push eax
call fcn.004071cb
push 0xb
lea eax, [ebp - 0x8d0]
push str.RegDB_Val:
push eax
call fcn.00411110
add esp, 0x1c
test eax, eax
jne 0x40705c
lea eax, [ebp - 0x8c5]
push eax
lea eax, [ebp - 0x27e4]
push eax
call esi
push 0
lea eax, [ebp - 0x8d0]
push dword [ebp + 8]
push 0x800
push eax
call fcn.004071cb
push 0xb
lea eax, [ebp - 0x8d0]
push str.RegDB_Val:
push eax
call fcn.00411110
add esp, 0x1c
test eax, eax
je 0x4049e1
and byte [ebp - 0x17d4], 0
push 0xc
lea eax, [ebp - 0x8d0]
xor ebx, ebx
push str.RegDB_Name:
push eax
mov dword [ebp - 4], ebx
call fcn.00411110
add esp, 0xc
test eax, eax
jne 0x404a62
lea eax, [ebp - 0x8c4]
push eax
lea eax, [ebp - 0x17d4]
push eax
call esi
push ebx
mov edi, 0x800
push dword [ebp + 8]
lea eax, [ebp - 0x8d0]
push edi
push eax
call fcn.004071cb
add esp, 0x10
jmp 0x404a67
mov edi, 0x800
push 0xc
lea eax, [ebp - 0x8d0]
push str.RegDB_Type:
push eax
call fcn.00411110
add esp, 0xc
test eax, eax
jne 0x404aa5
lea eax, [ebp - 0x8c4]
push eax
call fcn.0040d026
push 0
mov dword [ebp - 4], eax
push dword [ebp + 8]
lea eax, [ebp - 0x8d0]
push edi
push eax
call fcn.004071cb
add esp, 0x14
push 0xc
lea eax, [ebp - 0x8d0]
push str.RegDB_Root:
push eax
call fcn.00411110
add esp, 0xc
test eax, eax
jne 0x404af4
lea eax, [ebp - 0x8c4]
push eax
call fcn.0040d026
push 0
mov ebx, eax
push dword [ebp + 8]
lea eax, [ebp - 0x8d0]
push edi
push eax
call fcn.004071cb
add esp, 0x14
cmp ebx, 1
jne 0x404af4
cmp dword [0x4178d4], 0
jne 0x40705c
push ebx
lea eax, [ebp - 0x4c]
push 0x414484
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push 0x10
call fcn.0040bf28
mov ecx, dword [0x417894]
mov edx, dword [0x4177f8]
add esp, 0x10
mov dword [ecx + edx*4], eax
mov eax, dword [0x417894]
mov ecx, dword [0x4177f8]
mov edi, dword [eax + ecx*4]
inc dword [0x4177f8]
lea eax, [ebp - 0x27e4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
call fcn.0040bf28
pop ecx
mov dword [edi + 0xc], eax
lea ecx, [ebp - 0x27e4]
push ecx
push eax
call esi
and dword [edi], 0
and dword [edi + 8], 0
push 0xb
lea eax, [ebp - 0x8d0]
push str.RegDB_Old:
push eax
call fcn.00411110
add esp, 0xc
test eax, eax
jne 0x404d73
lea eax, [ebp - 0x4c]
mov dword [edi], 1
mov ecx, dword [0x417c3c]
push eax
lea eax, [ebp - 0x17d4]
push eax
lea eax, [ebp - 0xed0]
push eax
mov eax, dword [0x417bc8]
push ecx
push 0x1224
push dword [eax]
lea eax, [eax + ecx*4]
push eax
call fcn.0040c04a
add esp, 0x1c
mov dword [ebp - 8], eax
test eax, eax
jne 0x404cfd
mov eax, dword [0x417bc8]
mov ecx, dword [0x417c3c]
mov eax, dword [eax + ecx*4]
and dword [eax + 0x121c], 0
mov eax, dword [0x417bc8]
mov ecx, dword [0x417c3c]
mov eax, dword [eax + ecx*4]
mov ecx, dword [ebp - 4]
mov dword [eax + 0x1218], ecx
mov eax, dword [0x417bc8]
mov ecx, dword [0x417c3c]
mov eax, dword [eax + ecx*4]
mov dword [eax + 0x1214], ebx
mov eax, dword [0x417bc8]
mov ecx, dword [0x417c3c]
mov eax, dword [eax + ecx*4]
mov cx, word [0x417cd4]
mov word [eax + 0x1220], cx
mov ecx, dword [0x417c3c]
lea eax, [ebp - 0xed0]
push eax
mov eax, dword [0x417bc8]
mov eax, dword [eax + ecx*4]
add eax, 8
push eax
call esi
mov ecx, dword [0x417c3c]
lea eax, [ebp - 0x17d4]
push eax
mov eax, dword [0x417bc8]
mov eax, dword [eax + ecx*4]
add eax, 0x108
push eax
call esi
mov ecx, dword [0x417c3c]
lea eax, [ebp - 0x4c]
push eax
mov eax, dword [0x417bc8]
mov eax, dword [eax + ecx*4]
add eax, 0x208
push eax
call esi
mov eax, dword [0x417c3c]
mov ecx, dword [0x417bc8]
mov ebx, dword [ecx + eax*4]
add ebx, 0x214
lea eax, [ebp - 0x8c5]
push eax
push ebx
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push 0
lea ebx, [ebx + eax + 1]
push dword [ebp + 8]
lea eax, [ebp - 0x8d0]
push 0x800
push eax
call fcn.004071cb
push 0xb
lea eax, [ebp - 0x8d0]
push str.RegDB_Old:
push eax
call fcn.00411110
add esp, 0x1c
test eax, eax
je 0x404c7c
and byte [ebx], 0
mov eax, dword [0x417bc8]
mov ecx, dword [0x417c3c]
mov eax, dword [eax + ecx*4]
lea ecx, [eax + 0x214]
add eax, 0xa14
push ecx
push eax
call esi
mov eax, dword [0x417c3c]
mov ecx, dword [0x417bc8]
mov eax, dword [ecx + eax*4]
mov dword [edi + 8], eax
inc dword [0x417c3c]
jmp 0x40705c
lea ebx, [ebp - 0x1fe4]
lea eax, [ebp - 0x8c5]
push eax
push ebx
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push 0
lea ebx, [ebx + eax + 1]
push dword [ebp + 8]
lea eax, [ebp - 0x8d0]
push 0x800
push eax
call fcn.004071cb
push 0xb
lea eax, [ebp - 0x8d0]
push str.RegDB_Old:
push eax
call fcn.00411110
add esp, 0x1c
test eax, eax
je 0x404d03
and byte [ebx], 0
lea eax, [ebp - 0x1fe4]
push eax
mov eax, dword [ebp - 8]
add eax, 0xa14
push eax
call esi
mov eax, dword [ebp - 8]
mov cx, word [0x417cd4]
mov word [eax + 0x1220], cx
jmp 0x404e73
mov eax, dword [ebp - 4]
mov dword [edi + 4], eax
mov ecx, dword [0x417cdc]
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x17d4]
push eax
lea eax, [ebp - 0xed0]
push eax
mov eax, dword [0x417814]
push ecx
push 0x224
push dword [eax]
lea eax, [eax + ecx*4]
push eax
call fcn.0040c04a
add esp, 0x1c
test eax, eax
jne 0x404e65
mov eax, dword [0x417814]
mov ecx, dword [0x417cdc]
mov eax, dword [eax + ecx*4]
and dword [eax + 0x21c], 0
mov eax, dword [0x417814]
mov ecx, dword [0x417cdc]
mov eax, dword [eax + ecx*4]
mov dword [eax + 0x218], ebx
mov eax, dword [0x417814]
mov ecx, dword [0x417cdc]
mov eax, dword [eax + ecx*4]
mov cx, word [0x417cd4]
mov word [eax + 0x220], cx
mov ecx, dword [0x417cdc]
lea eax, [ebp - 0xed0]
push eax
mov eax, dword [0x417814]
mov eax, dword [eax + ecx*4]
add eax, 8
push eax
call esi
mov ecx, dword [0x417cdc]
lea eax, [ebp - 0x17d4]
push eax
mov eax, dword [0x417814]
mov eax, dword [eax + ecx*4]
add eax, 0x10c
push eax
call esi
mov ecx, dword [0x417cdc]
lea eax, [ebp - 0x4c]
push eax
mov eax, dword [0x417814]
mov eax, dword [eax + ecx*4]
add eax, 0x20c
push eax
call esi
mov eax, dword [0x417cdc]
mov ecx, dword [0x417814]
mov eax, dword [ecx + eax*4]
mov dword [edi + 8], eax
inc dword [0x417cdc]
jmp 0x40705c
mov cx, word [0x417cd4]
mov word [eax + 0x220], cx
mov dword [edi + 8], eax
jmp 0x40705c
push 0xb
lea eax, [ebp - 0x8d0]
push str.File_Edit:
push eax
call fcn.00411110
add esp, 0xc
test eax, eax
jne 0x40509e
lea eax, [ebp - 0x8c5]
push eax
lea eax, [ebp - 0xfd0]
push eax
call esi
push ebx
lea eax, [ebp - 0x8d0]
push dword [ebp + 8]
push edi
push eax
call fcn.004071cb
and byte [ebp - 0x14d0], 0
push 0xd
lea eax, [ebp - 0x8d0]
push str.Backup_Copy:
push eax
call fcn.00411110
add esp, 0x1c
test eax, eax
jne 0x404eed
lea eax, [ebp - 0x8c3]
push eax
lea eax, [ebp - 0x14d0]
push eax
call esi
jmp 0x404ef0
mov dword [ebp - 8], ebx
push 2
lea eax, [ebp - 0xfd0]
pop edi
push edi
push 0x414458
push eax
call fcn.00411110
add esp, 0xc
test eax, eax
jne 0x404f15
cmp dword [ebp - 0x14], edi
je 0x40703d
push edi
lea eax, [ebp - 0xfd0]
push 0x414454
push eax
call fcn.00411110
add esp, 0xc
test eax, eax
jne 0x404f37
cmp dword [ebp - 0x20], edi
je 0x40703d
cmp byte [ebp - 0x14d0], 0
je 0x40703d
lea eax, [ebp - 0xfd0]
push 0
push eax
call fcn.0040b1ca
pop ecx
test eax, eax
pop ecx
jne 0x40703d
lea eax, [ebp - 0xfd0]
push eax
lea eax, [ebp - 0xbd0]
push eax
call esi
xor ebx, ebx
xor edi, edi
cmp dword [0x417bf8], ebx
jle 0x404fa3
mov eax, dword [0x4177dc]
push dword [eax + edi*4]
lea eax, [ebp - 0xfd0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
mov eax, dword [0x417bf8]
je 0x404f9b
inc edi
cmp edi, eax
jl 0x404f78
cmp edi, eax
jl 0x405068
push 0x20a
call fcn.0040bf28
mov edx, dword [0x4177dc]
pop ecx
mov ecx, dword [0x417bf8]
mov dword [edx + ecx*4], eax
cmp dword [0x41785c], ebx
je 0x404fde
mov ecx, dword [0x4177dc]
lea eax, [ebp - 0xfd0]
push eax
mov eax, dword [0x417bf8]
push dword [ecx + eax*4]
call esi
jmp 0x404ff9
mov eax, dword [0x417bf8]
mov ecx, dword [0x4177dc]
push dword [ecx + eax*4]
lea eax, [ebp - 0xfd0]
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
cmp dword [0x41785c], ebx
je 0x405020
mov ecx, dword [0x4177dc]
lea eax, [ebp - 0x14d0]
push eax
mov eax, dword [0x417bf8]
mov eax, dword [ecx + eax*4]
add eax, 0x104
push eax
call esi
jmp 0x405041
mov eax, dword [0x417bf8]
mov ecx, dword [0x4177dc]
mov eax, dword [ecx + eax*4]
add eax, 0x104
push eax
lea eax, [ebp - 0x14d0]
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov eax, dword [0x417bf8]
mov ecx, dword [0x4177dc]
mov eax, dword [ecx + eax*4]
mov cx, word [0x417cd4]
mov word [eax + 0x208], cx
inc dword [0x417bf8]
jmp 0x40703d
mov ecx, dword [0x4177dc]
mov dx, word [0x417cd4]
mov eax, edi
shl eax, 2
mov ecx, dword [eax + ecx]
mov word [ecx + 0x208], dx
lea ecx, [ebp - 0x14d0]
push ecx
mov ecx, dword [0x4177dc]
mov eax, dword [eax + ecx]
add eax, 0x104
jmp 0x406f8e
push 0x10
lea eax, [ebp - 0x8d0]
push str.Create_Service:
push eax
call fcn.00411110
add esp, 0xc
test eax, eax
jne 0x405174
xor edi, edi
cmp dword [0x417bc0], ebx
jle 0x4050ed
mov eax, dword [0x417cd8]
push dword [eax + edi*4]
lea eax, [ebp - 0x8c0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
mov eax, dword [0x417bc0]
je 0x4050e9
inc edi
cmp edi, eax
jl 0x4050c6
cmp edi, eax
jl 0x405159
push 0x10c
call fcn.0040bf28
mov edx, dword [0x417bc0]
pop ecx
mov ecx, dword [0x417cd8]
mov dword [ecx + edx*4], eax
mov eax, dword [0x417cd8]
mov ecx, dword [0x417bc0]
mov eax, dword [eax + ecx*4]
mov dword [eax + 0x104], ebx
mov eax, dword [0x417cd8]
mov ecx, dword [0x417bc0]
mov eax, dword [eax + ecx*4]
mov cx, word [0x417cd4]
mov word [eax + 0x108], cx
mov ecx, dword [0x417cd8]
lea eax, [ebp - 0x8c0]
push eax
mov eax, dword [0x417bc0]
push dword [ecx + eax*4]
call esi
inc dword [0x417bc0]
jmp 0x407043
mov eax, dword [0x417cd8]
mov cx, word [0x417cd4]
mov eax, dword [eax + edi*4]
mov word [eax + 0x108], cx
jmp 0x407043
push 0xc
lea eax, [ebp - 0x8d0]
push str.Add_Device:
push eax
call fcn.00411110
add esp, 0xc
test eax, eax
jne 0x405223
xor edi, edi
cmp dword [0x417bfc], ebx
jle 0x4051d8
lea eax, [ebp - 0x8c4]
push eax
mov eax, dword [0x417830]
mov eax, dword [eax + edi*4]
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4051cf
mov eax, dword [0x417830]
mov cx, word [0x417cd4]
mov eax, dword [eax + edi*4]
mov word [eax + 0x26e], cx
inc edi
cmp edi, dword [0x417bfc]
jl 0x40519c
xor edi, edi
cmp dword [0x4178b8], ebx
jle 0x407043
lea eax, [ebp - 0x8c4]
push eax
mov eax, dword [0x417c58]
push dword [eax + edi*4]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x405215
mov eax, dword [0x417c58]
mov cx, word [0x417cd4]
mov eax, dword [eax + edi*4]
mov word [eax + 0x266], cx
inc edi
cmp edi, dword [0x4178b8]
jl 0x4051e6
jmp 0x407043
push 0xf
lea eax, [ebp - 0x8d0]
push str.Self_Register:
push eax
call fcn.00411110
add esp, 0xc
test eax, eax
jne 0x405332
lea eax, [ebp - 0x8c1]
push eax
lea eax, [ebp - 0xbd0]
push eax
call esi
lea eax, [ebp - 0xbd0]
push 1
push eax
call fcn.0040b02b
pop ecx
xor edi, edi
cmp dword [0x417bfc], ebx
pop ecx
jle 0x4052c7
mov eax, dword [0x417830]
mov eax, dword [eax + edi*4]
add eax, 8
push eax
lea eax, [ebp - 0xed0]
push eax
call esi
lea eax, [ebp - 0xed0]
push 1
push eax
call fcn.0040b02b
pop ecx
lea eax, [ebp - 0xbd0]
pop ecx
push eax
lea eax, [ebp - 0xed0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4052be
mov eax, dword [0x417830]
mov cx, word [0x417cd4]
mov eax, dword [eax + edi*4]
mov word [eax + 0x26c], cx
inc edi
cmp edi, dword [0x417bfc]
jl 0x40526b
xor edi, edi
cmp dword [0x4178b8], ebx
jle 0x407043
mov eax, dword [0x417c58]
push dword [eax + edi*4]
lea eax, [ebp - 0xed0]
push eax
call esi
lea eax, [ebp - 0xed0]
push 1
push eax
call fcn.0040b02b
pop ecx
lea eax, [ebp - 0xbd0]
pop ecx
push eax
lea eax, [ebp - 0xed0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x405324
mov eax, dword [0x417c58]
mov cx, word [0x417cd4]
mov eax, dword [eax + edi*4]
mov word [eax + 0x264], cx
inc edi
cmp edi, dword [0x4178b8]
jl 0x4052d5
jmp 0x407043
push 9
lea eax, [ebp - 0x8d0]
push str.INI_New:
push eax
call fcn.00411110
add esp, 0xc
test eax, eax
jne 0x405507
push ebx
lea eax, [ebp - 0x8d0]
push dword [ebp + 8]
push edi
push eax
call fcn.004071cb
push 0xa
lea eax, [ebp - 0x8d0]
push str.INI_File:
push eax
call fcn.00411110
add esp, 0x1c
test eax, eax
jne 0x40705c
push 2
lea eax, [ebp - 0x8c6]
pop edi
push edi
push 0x414458
push eax
call fcn.00411110
add esp, 0xc
test eax, eax
jne 0x4053a4
cmp dword [ebp - 0x14], edi
je 0x4054b8
push edi
lea eax, [ebp - 0x8c6]
push 0x414454
push eax
call fcn.00411110
add esp, 0xc
test eax, eax
jne 0x4053c6
cmp dword [ebp - 0x20], edi
je 0x4054b8
xor ebx, ebx
lea eax, [ebp - 0x8c6]
push ebx
push eax
call fcn.0040b1ca
pop ecx
test eax, eax
pop ecx
jne 0x4054b8
xor edi, edi
cmp dword [0x4178c4], ebx
jle 0x405414
mov eax, dword [0x4177e8]
push dword [eax + edi*4]
lea eax, [ebp - 0x8c6]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
mov eax, dword [0x4178c4]
je 0x40540c
inc edi
cmp edi, eax
jl 0x4053e9
cmp edi, eax
jl 0x4054a2
push 0x10c
call fcn.0040bf28
mov edx, dword [0x4178c4]
pop ecx
mov ecx, dword [0x4177e8]
mov dword [ecx + edx*4], eax
mov eax, dword [0x4178c4]
mov ecx, dword [0x4177e8]
mov eax, dword [ecx + eax*4]
mov dword [eax + 0x104], ebx
cmp dword [0x41785c], ebx
je 0x405463
mov ecx, dword [0x4177e8]
lea eax, [ebp - 0x8c6]
push eax
mov eax, dword [0x4178c4]
push dword [ecx + eax*4]
call esi
jmp 0x40547e
mov eax, dword [0x4178c4]
mov ecx, dword [0x4177e8]
push dword [ecx + eax*4]
lea eax, [ebp - 0x8c6]
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov eax, dword [0x4178c4]
mov ecx, dword [0x4177e8]
mov eax, dword [ecx + eax*4]
mov cx, word [0x417cd4]
mov word [eax + 0x108], cx
inc dword [0x4178c4]
jmp 0x4054b8
mov eax, dword [0x4177e8]
mov cx, word [0x417cd4]
mov eax, dword [eax + edi*4]
mov word [eax + 0x108], cx
push 0
lea eax, [ebp - 0x8d0]
push dword [ebp + 8]
push 0x800
push eax
call fcn.004071cb
push 4
lea eax, [ebp - 0x8d0]
push str.INI
push eax
call fcn.00411110
add esp, 0x1c
test eax, eax
jne 0x40705c
cmp byte [ebp - 0x8cc], 0x46
je 0x40705c
cmp byte [ebp - 0x8cc], 0x4e
jne 0x4054b8
jmp 0x40705c
push 0xa
lea eax, [ebp - 0x8d0]
push str.INI_File:
push eax
call fcn.00411110
add esp, 0xc
test eax, eax
jne 0x4057b5
push 2
lea eax, [ebp - 0x8c6]
push 0x414458
push eax
call fcn.00411110
add esp, 0xc
test eax, eax
jne 0x405545
cmp dword [ebp - 0x14], 2
je 0x405565
push 2
lea eax, [ebp - 0x8c6]
push 0x414454
push eax
call fcn.00411110
add esp, 0xc
test eax, eax
jne 0x40556a
cmp dword [ebp - 0x20], 2
jne 0x40556a
mov dword [ebp - 8], ebx
jmp 0x405571
mov dword [ebp - 8], 1
cmp dword [0x41785c], ebx
je 0x40558b
lea eax, [ebp - 0x8c6]
push eax
lea eax, [ebp - 0x17d4]
push eax
call esi
jmp 0x40559f
lea eax, [ebp - 0x17d4]
push eax
lea eax, [ebp - 0x8c6]
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
push ebx
lea eax, [ebp - 0x8d0]
push dword [ebp + 8]
push edi
push eax
call fcn.004071cb
add esp, 0x10
cmp dword [ebp - 8], ebx
je 0x407043
and dword [ebp - 8], 0
push 0xa
lea eax, [ebp - 0x8d0]
push str.INI_Sect:
push eax
call fcn.00411110
add esp, 0xc
test eax, eax
jne 0x40705c
lea eax, [ebp - 0x8c6]
push eax
lea eax, [ebp - 0xbd0]
push eax
call esi
push 0
lea eax, [ebp - 0x8d0]
push dword [ebp + 8]
push 0x800
push eax
call fcn.004071cb
push 0xa
lea eax, [ebp - 0x8d0]
push str.INI_Item:
push eax
call fcn.00411110
add esp, 0x1c
test eax, eax
jne 0x40705c
lea eax, [ebp - 0x8c6]
push eax
lea eax, [ebp - 0xed0]
push eax
call esi
push 0
lea eax, [ebp - 0x8d0]
push dword [ebp + 8]
push 0x800
push eax
call fcn.004071cb
push 9
lea eax, [ebp - 0x8d0]
push str.INI_Val:
push eax
call fcn.00411110
add esp, 0x1c
test eax, eax
jne 0x40705c
push eax
lea eax, [ebp - 0x8d0]
push dword [ebp + 8]
push 0x800
push eax
call fcn.004071cb
push 9
lea eax, [ebp - 0x8d0]
push str.INI_Old:
push eax
call fcn.00411110
add esp, 0x1c
test eax, eax
jne 0x4056a4
mov dword [ebp - 8], 1
lea edi, [ebp - 0x8c7]
jmp 0x4056a9
mov edi, 0x417600
mov ecx, dword [0x41786c]
lea eax, [ebp - 0xed0]
push eax
lea eax, [ebp - 0xbd0]
push eax
lea eax, [ebp - 0x17d4]
push eax
mov eax, dword [0x4178f8]
push ecx
push 0x714
push dword [eax]
lea eax, [eax + ecx*4]
push eax
call fcn.0040c04a
add esp, 0x1c
test eax, eax
jne 0x4057aa
mov eax, dword [0x4178f8]
mov ecx, dword [0x41786c]
mov eax, dword [eax + ecx*4]
and dword [eax + 0x70c], 0
mov eax, dword [0x4178f8]
mov ecx, dword [0x41786c]
mov eax, dword [eax + ecx*4]
mov cx, word [0x417cd4]
mov word [eax + 0x710], cx
mov ecx, dword [0x41786c]
lea eax, [ebp - 0x17d4]
push eax
mov eax, dword [0x4178f8]
mov eax, dword [eax + ecx*4]
add eax, 8
push eax
call esi
mov ecx, dword [0x41786c]
lea eax, [ebp - 0xbd0]
push eax
mov eax, dword [0x4178f8]
mov eax, dword [eax + ecx*4]
add eax, 0x10c
push eax
call esi
mov ecx, dword [0x41786c]
lea eax, [ebp - 0xed0]
push eax
mov eax, dword [0x4178f8]
mov eax, dword [eax + ecx*4]
add eax, 0x20c
push eax
call esi
mov eax, dword [0x4178f8]
mov ecx, dword [0x41786c]
push edi
mov eax, dword [eax + ecx*4]
add eax, 0x30c
push eax
call esi
mov eax, dword [0x41786c]
mov ecx, dword [0x4178f8]
mov eax, dword [ecx + eax*4]
lea ecx, [eax + 0x30c]
add eax, 0x50c
push ecx
push eax
call esi
inc dword [0x41786c]
jmp 0x40703d
push edi
add eax, 0x50c
jmp 0x406f8e
push 0xe
lea eax, [ebp - 0x8d0]
push str.Execute_Path:
push eax
call fcn.00411110
add esp, 0xc
test eax, eax
je 0x4063d1
push 0x11
lea eax, [ebp - 0x8d0]
push str.Execute_Program:
push eax
call fcn.00411110
add esp, 0xc
test eax, eax
je 0x4063d1
push 0xc
lea eax, [ebp - 0x8d0]
push str.Icon_Group:
push eax
call fcn.00411110
add esp, 0xc
test eax, eax
jne 0x4059a7
lea eax, [ebp - 0x8c4]
push eax
lea eax, [ebp - 0xbd0]
push eax
call esi
push ebx
lea eax, [ebp - 0x8d0]
push dword [ebp + 8]
push edi
push eax
call fcn.004071cb
push 0xb
lea eax, [ebp - 0x8d0]
push str.Icon_Name:
push eax
call fcn.00411110
add esp, 0x1c
test eax, eax
jne 0x40705c
lea eax, [ebp - 0x8c5]
push eax
lea eax, [ebp - 0xed0]
push eax
call esi
push 0
lea eax, [ebp - 0x8d0]
push dword [ebp + 8]
push 0x800
push eax
call fcn.004071cb
push 0xa
lea eax, [ebp - 0x8d0]
push str.Icon_Cmd:
push eax
call fcn.00411110
add esp, 0x1c
test eax, eax
jne 0x40705c
xor edi, edi
cmp dword [0x417810], edi
jle 0x4058e7
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea eax, [ebp - 0xbd0]
push eax
mov eax, dword [0x417884]
push dword [eax + edi*4]
call ebx
test eax, eax
jne 0x4058d2
lea eax, [ebp - 0xed0]
push eax
mov eax, dword [0x417884]
mov eax, dword [eax + edi*4]
add eax, 0x100
push eax
call ebx
test eax, eax
je 0x4058db
inc edi
cmp edi, dword [0x417810]
jl 0x4058a2
cmp edi, dword [0x417810]
jl 0x40598e
push 0x308
call fcn.0040bf28
mov edx, dword [0x417810]
pop ecx
mov ecx, dword [0x417884]
mov dword [ecx + edx*4], eax
mov eax, dword [0x417884]
mov ecx, dword [0x417810]
mov eax, dword [eax + ecx*4]
and dword [eax + 0x300], 0
mov eax, dword [0x417884]
mov ecx, dword [0x417810]
mov eax, dword [eax + ecx*4]
mov cx, word [0x417cd4]
mov word [eax + 0x304], cx
mov ecx, dword [0x417810]
lea eax, [ebp - 0xed0]
push eax
mov eax, dword [0x417884]
mov eax, dword [eax + ecx*4]
add eax, 0x100
push eax
call esi
mov ecx, dword [0x417810]
lea eax, [ebp - 0xbd0]
push eax
mov eax, dword [0x417884]
push dword [eax + ecx*4]
call esi
mov ecx, dword [0x417884]
lea eax, [ebp - 0x8c6]
push eax
mov eax, dword [0x417810]
mov eax, dword [ecx + eax*4]
add eax, 0x200
push eax
call esi
inc dword [0x417810]
jmp 0x407043
lea eax, [ebp - 0x8c6]
push eax
mov eax, dword [0x417884]
mov eax, dword [eax + edi*4]
add eax, 0x200
jmp 0x406304
push 0xc
lea eax, [ebp - 0x8d0]
push str.SubSystem:_B
push eax
call fcn.00411110
add esp, 0xc
test eax, eax
jne 0x4059f0
lea eax, [ebp - 0x8c5]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
call fcn.0040bf28
pop ecx
mov dword [0x4178ec], eax
lea ecx, [ebp - 0x8c5]
push ecx
push eax
call esi
mov dword [0x417818], ebx
jmp 0x407043
push 0xa
lea eax, [ebp - 0x8d0]
push str.Made_Dir:
push eax
call fcn.00411110
add esp, 0xc
test eax, eax
jne 0x405c28
lea eax, [ebp - 0x8d0]
push 0x4140ec
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x8c6]
push eax
lea eax, [ebp - 0xbd0]
push eax
call esi
lea eax, [ebp - 0xbd0]
push 0
push eax
call fcn.0040b02b
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
pop ecx
pop ecx
lea eax, [ebp - 0xbd0]
push eax
call ebx
mov edi, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0xbd0]
push edi
push eax
call fcn.00411110
add esp, 0xc
test eax, eax
jne 0x405a74
lea eax, [ebp - 0xbd0]
push eax
call ebx
and byte [eax + edi], 0
lea eax, [ebp - 0x8c6]
push eax
call ebx
cmp eax, 3
mov dword [ebp - 4], eax
jle 0x407043
cmp byte [ebp - 0x8c6], 0x5c
jne 0x405a9b
cmp byte [ebp - 0x8c5], 0x5c
je 0x405af2
cmp dword [0x41521c], 1
jle 0x405aba
movsx eax, byte [ebp - 0x8c6]
push 0x103
push eax
call fcn.0040cea8
pop ecx
pop ecx
jmp 0x405ad0
movsx eax, byte [ebp - 0x8c6]
mov ecx, dword [str.________________________________H]
mov ax, word [ecx + eax*2]
and eax, 0x103
test eax, eax
je 0x407043
cmp byte [ebp - 0x8c5], 0x3a
jne 0x407043
cmp byte [ebp - 0x8c4], 0x5c
jne 0x407043
xor edi, edi
cmp dword [0x417cc8], edi
jle 0x405b48
mov eax, dword [0x417848]
push dword [eax + edi*4]
call ebx
cmp dword [ebp - 4], eax
jge 0x405b10
mov eax, dword [ebp - 4]
jmp 0x405b1a
mov eax, dword [0x417848]
push dword [eax + edi*4]
call ebx
push eax
mov eax, dword [0x417848]
push dword [eax + edi*4]
lea eax, [ebp - 0x8c6]
push eax
call fcn.00411110
add esp, 0xc
test eax, eax
mov eax, dword [0x417cc8]
je 0x405b40
inc edi
cmp edi, eax
jl 0x405afc
cmp edi, eax
jl 0x405bed
push 0x10c
call fcn.0040bf28
mov edx, dword [0x417cc8]
pop ecx
mov ecx, dword [0x417848]
mov dword [ecx + edx*4], eax
mov eax, dword [0x417848]
mov ecx, dword [0x417cc8]
mov ecx, dword [eax + ecx*4]
xor eax, eax
mov dword [ecx + 0x104], eax
mov ecx, dword [0x417848]
mov edx, dword [0x417cc8]
mov ecx, dword [ecx + edx*4]
mov word [ecx + 0x108], ax
mov ecx, dword [0x417848]
mov edx, dword [0x417cc8]
mov ecx, dword [ecx + edx*4]
mov dx, word [0x417cd4]
mov word [ecx + 0x10a], dx
cmp dword [0x41785c], eax
je 0x405bcd
mov ecx, dword [0x417cc8]
lea eax, [ebp - 0x8c6]
push eax
mov eax, dword [0x417848]
push dword [eax + ecx*4]
jmp 0x405f14
mov eax, dword [0x417848]
mov ecx, dword [0x417cc8]
push dword [eax + ecx*4]
lea eax, [ebp - 0x8c6]
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
jmp 0x405f16
mov eax, dword [0x417848]
shl edi, 2
push dword [edi + eax]
call ebx
cmp dword [ebp - 4], eax
jge 0x405c04
mov eax, dword [ebp - 4]
jmp 0x405c0e
mov eax, dword [0x417848]
push dword [edi + eax]
call ebx
mov ecx, dword [0x417848]
mov ecx, dword [edi + ecx]
and byte [ecx + eax], 0
mov eax, dword [0x417848]
mov eax, dword [edi + eax]
jmp 0x405f46
push 0xd
lea eax, [ebp - 0x8d0]
push str.File_Delete:
push eax
call fcn.00411110
add esp, 0xc
test eax, eax
jne 0x405d68
lea eax, [ebp - 0x8c3]
push eax
lea eax, [ebp - 0x1be4]
push eax
call esi
push ebx
lea eax, [ebp - 0x8d0]
push dword [ebp + 8]
push edi
push eax
call fcn.004071cb
push 0xd
lea eax, [ebp - 0x8d0]
push str.Backup_Copy:
push eax
call fcn.00411110
add esp, 0x1c
test eax, eax
jne 0x40705c
xor edi, edi
mov dword [0x417bdc], 1
cmp dword [0x4177fc], edi
jle 0x405cc0
mov eax, dword [0x4177e4]
push dword [eax + edi*4]
lea eax, [ebp - 0x1be4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
mov eax, dword [0x4177fc]
je 0x405cbc
inc edi
cmp edi, eax
jl 0x405c99
cmp edi, eax
jl 0x405d35
push 0x20a
call fcn.0040bf28
mov edx, dword [0x4177fc]
pop ecx
mov ecx, dword [0x4177e4]
mov dword [ecx + edx*4], eax
mov eax, dword [0x4177e4]
mov ecx, dword [0x4177fc]
mov eax, dword [eax + ecx*4]
mov cx, word [0x417cd4]
mov word [eax + 0x208], cx
mov ecx, dword [0x4177fc]
lea eax, [ebp - 0x1be4]
push eax
mov eax, dword [0x4177e4]
push dword [eax + ecx*4]
call esi
mov ecx, dword [0x4177e4]
lea eax, [ebp - 0x8c3]
push eax
mov eax, dword [0x4177fc]
mov eax, dword [ecx + eax*4]
add eax, 0x104
push eax
call esi
inc dword [0x4177fc]
jmp 0x407043
lea ecx, [ebp - 0x8c3]
push ecx
mov ecx, dword [0x4177e4]
mov eax, dword [ecx + eax*4]
add eax, 0x104
push eax
call esi
mov eax, dword [0x4177e4]
mov cx, word [0x417cd4]
mov eax, dword [eax + edi*4]
mov word [eax + 0x208], cx
jmp 0x407043
push 0xb
lea eax, [ebp - 0x8d0]
push str.File_Tree:
push eax
call fcn.00411110
add esp, 0xc
test eax, eax
jne 0x405f59
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp - 0x8c5]
push eax
call ebx
lea edi, [ebp + eax - 0x8c9]
push str..
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x405dae
and byte [edi], al
lea eax, [ebp - 0x8d0]
push 0x2a
push eax
call fcn.0040c57a
pop ecx
test eax, eax
pop ecx
jne 0x405de8
lea eax, [ebp - 0x8d0]
push 0x3f
push eax
call fcn.0040c57a
pop ecx
test eax, eax
pop ecx
jne 0x405de8
lea eax, [ebp - 0x8d0]
push 0x4140ec
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x8c5]
push eax
call ebx
cmp eax, 3
jle 0x407043
cmp byte [ebp - 0x8c5], 0x5c
jne 0x405e0c
cmp byte [ebp - 0x8c4], 0x5c
je 0x405e63
cmp dword [0x41521c], 1
jle 0x405e2b
movsx eax, byte [ebp - 0x8c5]
push 0x103
push eax
call fcn.0040cea8
pop ecx
pop ecx
jmp 0x405e41
movsx eax, byte [ebp - 0x8c5]
mov ecx, dword [str.________________________________H]
mov ax, word [ecx + eax*2]
and eax, 0x103
test eax, eax
je 0x407043
cmp byte [ebp - 0x8c4], 0x3a
jne 0x407043
cmp byte [ebp - 0x8c3], 0x5c
jne 0x407043
xor edi, edi
cmp dword [0x417cc8], edi
jle 0x405e98
mov eax, dword [0x417848]
push dword [eax + edi*4]
lea eax, [ebp - 0x8c5]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
mov eax, dword [0x417cc8]
je 0x405e90
inc edi
cmp edi, eax
jl 0x405e6d
cmp edi, eax
jl 0x405f21
push 0x10c
call fcn.0040bf28
mov edx, dword [0x417cc8]
pop ecx
mov ecx, dword [0x417848]
mov dword [ecx + edx*4], eax
mov eax, dword [0x417848]
mov ecx, dword [0x417cc8]
mov eax, dword [eax + ecx*4]
and dword [eax + 0x104], 0
mov eax, dword [0x417848]
mov ecx, dword [0x417cc8]
mov eax, dword [eax + ecx*4]
mov cx, word [0x417cd4]
mov word [eax + 0x108], cx
mov eax, dword [0x417848]
mov ecx, dword [0x417cc8]
mov eax, dword [eax + ecx*4]
mov cx, word [0x417cd4]
mov word [eax + 0x10a], cx
mov ecx, dword [0x417848]
lea eax, [ebp - 0x8c5]
push eax
mov eax, dword [0x417cc8]
push dword [ecx + eax*4]
call esi
inc dword [0x417cc8]
jmp 0x407043
mov ecx, dword [0x417848]
mov dx, word [0x417cd4]
mov eax, edi
shl eax, 2
mov ecx, dword [eax + ecx]
mov word [ecx + 0x108], dx
mov ecx, dword [0x417848]
mov eax, dword [eax + ecx]
mov cx, word [0x417cd4]
mov word [eax + 0x10a], cx
jmp 0x407043
push 0xc
lea eax, [ebp - 0x8d0]
push str.RegDB_Tree:
push eax
call fcn.00411110
add esp, 0xc
test eax, eax
jne 0x4060bc
lea eax, [ebp - 0x8c4]
push eax
lea eax, [ebp - 0xed0]
push eax
call esi
push ebx
lea eax, [ebp - 0x8d0]
push dword [ebp + 8]
push edi
push eax
call fcn.004071cb
push 0xc
lea eax, [ebp - 0x8d0]
push str.RegDB_Root:
push eax
mov dword [ebp - 4], ebx
call fcn.00411110
add esp, 0x1c
test eax, eax
jne 0x405fd8
lea eax, [ebp - 0x8c4]
push eax
call fcn.0040d026
push ebx
mov dword [ebp - 4], eax
push dword [ebp + 8]
lea eax, [ebp - 0x8d0]
push edi
push eax
call fcn.004071cb
add esp, 0x14
xor edi, edi
cmp dword [0x417c48], ebx
jle 0x406023
mov eax, dword [0x417910]
push dword [eax + edi*4]
lea eax, [ebp - 0xed0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
mov eax, dword [0x417910]
jne 0x40600e
mov ecx, dword [eax + edi*4]
mov edx, dword [ebp - 4]
cmp edx, dword [ecx + 0x100]
je 0x406017
inc edi
cmp edi, dword [0x417c48]
jl 0x405fe7
cmp edi, dword [0x417c48]
jl 0x4060a6
push 0x10c
call fcn.0040bf28
mov edx, dword [0x417c48]
pop ecx
mov ecx, dword [0x417910]
mov dword [ecx + edx*4], eax
mov eax, dword [0x417910]
mov ecx, dword [0x417c48]
mov eax, dword [eax + ecx*4]
mov dword [eax + 0x104], ebx
mov eax, dword [0x417910]
mov ecx, dword [0x417c48]
mov eax, dword [eax + ecx*4]
mov ecx, dword [ebp - 4]
mov dword [eax + 0x100], ecx
mov eax, dword [0x417910]
mov ecx, dword [0x417c48]
mov eax, dword [eax + ecx*4]
mov cx, word [0x417cd4]
mov word [eax + 0x108], cx
mov ecx, dword [0x417910]
lea eax, [ebp - 0xed0]
push eax
mov eax, dword [0x417c48]
push dword [ecx + eax*4]
call esi
inc dword [0x417c48]
jmp 0x40705c
mov eax, dword [eax + edi*4]
mov cx, word [0x417cd4]
mov word [eax + 0x108], cx
jmp 0x40705c
push 4
lea eax, [ebp - 0x8d0]
push str.
push eax
call fcn.00411110
add esp, 0xc
test eax, eax
jne 0x406127
lea eax, [ebp - 0x8d0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [0x4178dc]
mov edx, dword [0x4178bc]
add edx, ecx
mov ecx, dword [0x4177e0]
sub edx, eax
dec edx
inc word [0x417cd4]
movzx eax, word [0x417cd4]
mov dword [0x4178e4], edx
mov dword [ecx + eax*4], ebx
xor eax, eax
cmp byte [ebp - 0x8cc], 0x20
sete al
mov dword [0x41785c], eax
jmp 0x407043
push 8
lea eax, [ebp - 0x8d0]
push str.Source:
push eax
call fcn.00411110
add esp, 0xc
test eax, eax
jne 0x4061a6
lea eax, [ebp - 0x8c8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
call fcn.0040bf28
mov edx, dword [0x4177e0]
pop ecx
movzx ecx, word [0x417cd4]
mov dword [edx + ecx*4], eax
mov ecx, dword [0x4177e0]
lea eax, [ebp - 0x8c8]
push eax
movzx eax, word [0x417cd4]
push dword [ecx + eax*4]
call esi
lea eax, [ebp - 0x8d0]
push 0x7c
push eax
call fcn.0040c57a
pop ecx
test eax, eax
pop ecx
je 0x407043
mov dword [0x41787c], 1
jmp 0x407043
push 0xf
lea eax, [ebp - 0x8d0]
push str.Uninstall_MIF:
push eax
call fcn.00411110
add esp, 0xc
test eax, eax
jne 0x4061d1
lea eax, [ebp - 0x8c1]
push eax
push 0x417920
jmp 0x406305
push 0xe
lea eax, [ebp - 0x8d0]
push str.Manufacturer:
push eax
call fcn.00411110
add esp, 0xc
test eax, eax
jne 0x4061fc
lea eax, [ebp - 0x8c2]
push eax
push 0x4179a0
jmp 0x406305
push 9
lea eax, [ebp - 0x8d0]
push str.Product:
push eax
call fcn.00411110
add esp, 0xc
test eax, eax
jne 0x406227
lea eax, [ebp - 0x8c7]
push eax
push 0x417a20
jmp 0x406305
push 0x10
lea eax, [ebp - 0x8d0]
push str.Version_Number:
push eax
call fcn.00411110
add esp, 0xc
test eax, eax
jne 0x406252
lea eax, [ebp - 0x8c0]
push eax
push 0x417aa0
jmp 0x406305
push 0xf
lea eax, [ebp - 0x8d0]
push str.Serial_Number:
push eax
call fcn.00411110
add esp, 0xc
test eax, eax
jne 0x40627d
lea eax, [ebp - 0x8c1]
push eax
push 0x417b20
jmp 0x406305
lea eax, [ebp - 0x8d0]
push str.User_Rights:_Admin
push eax
call fcn.004111c0
pop ecx
test eax, eax
pop ecx
jne 0x4062d3
cmp dword [ebp - 0x30], ebx
jne 0x407043
cmp dword [0x4177f0], 1
jne 0x407043
push 1
xor edi, edi
pop ebx
push 0xe0000000
push edi
push edi
mov dword [ebp - 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
cmp eax, edi
je 0x40706d
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x407043
push 0xd
lea eax, [ebp - 0x8d0]
push str.Per_User_ID:
push eax
call fcn.00411110
add esp, 0xc
test eax, eax
jne 0x40630c
push 0x100
call fcn.0040bf28
pop ecx
mov dword [0x4178d4], eax
lea ecx, [ebp - 0x8c3]
push ecx
push eax
call esi
jmp 0x407043
push 0x15
lea eax, [ebp - 0x8d0]
push str.Delete_in_use_files:
push eax
call fcn.00411110
add esp, 0xc
test eax, eax
jne 0x406378
push 2
lea eax, [ebp - 0x8bb]
push 0x414298
push eax
call fcn.00411110
add esp, 0xc
test eax, eax
jne 0x40634f
mov dword [0x4178e8], 1
jmp 0x407043
push 2
lea eax, [ebp - 0x8bb]
push 0x414294
push eax
call fcn.00411110
add esp, 0xc
test eax, eax
jne 0x407043
and dword [0x4178e8], eax
jmp 0x407043
push 0x17
lea eax, [ebp - 0x8d0]
push str.System_Restore:_Enabled
push eax
call fcn.00411110
add esp, 0xc
test eax, eax
jne 0x4063a1
mov dword [0x417834], 1
jmp 0x407043
push 7
lea eax, [ebp - 0x8d0]
push 0x414274
push eax
call fcn.00411110
add esp, 0xc
test eax, eax
jne 0x407043
lea eax, [ebp - 0x8d0]
push eax
call fcn.0040c599
pop ecx
jmp 0x407043
xor eax, eax
cmp byte [ebp - 0x8c7], 0x72
mov dword [ebp - 0xc], ebx
setne al
dec eax
and eax, 3
add eax, 0xe
cmp dword [0x417be4], ebx
mov dword [ebp - 4], eax
jle 0x40642a
mov eax, dword [0x417898]
mov ecx, dword [ebp - 0xc]
push dword [eax + ecx*4]
mov eax, dword [ebp - 4]
lea eax, [ebp + eax - 0x8d0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
mov eax, dword [0x417be4]
je 0x40641f
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], eax
jl 0x4063f2
mov ecx, dword [ebp - 0xc]
cmp ecx, eax
jl 0x4064fc
push 0x20c
call fcn.0040bf28
mov edx, dword [0x417be4]
pop ecx
mov ecx, dword [0x417898]
mov dword [ecx + edx*4], eax
mov eax, dword [0x417898]
mov ecx, dword [0x417be4]
mov eax, dword [eax + ecx*4]
mov dword [eax + 0x204], ebx
mov eax, dword [0x417898]
mov ecx, dword [0x417be4]
mov eax, dword [eax + ecx*4]
mov cx, word [0x417cd4]
mov word [eax + 0x208], cx
mov eax, dword [ebp - 4]
mov ecx, dword [0x417be4]
lea eax, [ebp + eax - 0x8d0]
push eax
mov eax, dword [0x417898]
push dword [eax + ecx*4]
call esi
mov eax, dword [0x417be4]
mov ecx, dword [0x417898]
push ebx
mov eax, dword [ecx + eax*4]
push dword [ebp + 8]
and byte [eax + 0x104], 0
lea eax, [ebp - 0x8d0]
push edi
push eax
call fcn.004071cb
push 0xe
lea eax, [ebp - 0x8d0]
push str.Execute_Name:
push eax
call fcn.00411110
add esp, 0x1c
test eax, eax
jne 0x4064ee
mov ecx, dword [0x417898]
lea eax, [ebp - 0x8c2]
push eax
mov eax, dword [0x417be4]
mov eax, dword [ecx + eax*4]
add eax, 0x104
push eax
call esi
jmp 0x4064f1
mov dword [ebp - 8], ebx
inc dword [0x417be4]
jmp 0x40703d
mov eax, dword [0x417898]
mov eax, dword [eax + ecx*4]
mov cx, word [0x417cd4]
mov word [eax + 0x208], cx
jmp 0x40703d
and dword [ebp - 0xc], 0
and byte [ebp - 0x13d0], 0
and byte [ebp - 0xd0], 0
lea eax, [ebp - 0x8d0]
push 0x7c
push eax
call fcn.0040c57a
mov ebx, eax
pop ecx
test ebx, ebx
pop ecx
je 0x40655b
lea eax, [ebx + 1]
push eax
lea eax, [ebp - 0xd0]
push eax
call esi
cmp byte [ebx - 1], 0x20
jne 0x406558
and byte [ebx - 1], 0
jmp 0x40655b
and byte [ebx], 0
cmp byte [ebp - 0x8d0], 0x53
jne 0x4065df
lea eax, [ebp - 0x8c4]
push eax
lea eax, [ebp - 0x9d0]
push eax
call esi
cmp dword [0x4178d4], 0
je 0x40666f
push dword [0x417bec]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
call ebx
push eax
lea eax, [ebp - 0x9d0]
push dword [0x417bec]
push eax
call fcn.00411110
add esp, 0xc
test eax, eax
jne 0x40666f
push dword [0x417c4c]
call ebx
push eax
lea eax, [ebp - 0x9d0]
push dword [0x417c4c]
push eax
call fcn.00411110
add esp, 0xc
test eax, eax
je 0x40666f
and byte [ebp - 0x9d0], 0
jmp 0x40666f
cmp byte [ebp - 0x8cb], 0x43
jne 0x4065fa
lea eax, [ebp - 0x8c5]
push eax
lea eax, [ebp - 0x9d0]
push eax
call esi
jmp 0x40666f
lea eax, [ebp - 0x8c0]
push eax
lea eax, [ebp - 0x9d0]
push eax
call esi
cmp dword [0x417838], 0
mov dword [ebp - 0xc], 1
je 0x40666f
lea eax, [ebp - 0x28]
push eax
push 0x1f
push 0
push dword [0x414058]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40666f
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x100
push eax
lea eax, [ebp - 0x19d8]
push eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x9d0]
push 0
push eax
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x406666
and dword [ebp - 0xc], eax
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
lea eax, [ebp - 0x8d0]
push ebx
push dword [ebp + 8]
push edi
push eax
call fcn.004071cb
and byte [ebp - 0xcd0], bl
push 0xb
lea eax, [ebp - 0x8d0]
push str.Link_Info:
push eax
call fcn.00411110
add esp, 0x1c
test eax, eax
jne 0x4066c6
lea eax, [ebp - 0x8c5]
push eax
lea eax, [ebp - 0x13d0]
push eax
call esi
push ebx
lea eax, [ebp - 0x8d0]
push dword [ebp + 8]
push edi
push eax
call fcn.004071cb
add esp, 0x10
push 0xd
lea eax, [ebp - 0x8d0]
push str.Backup_Copy:
push eax
call fcn.00411110
add esp, 0xc
test eax, eax
jne 0x4066fc
lea eax, [ebp - 0x8c3]
push eax
lea eax, [ebp - 0xcd0]
push eax
call esi
mov dword [0x417bdc], 1
jmp 0x4066ff
mov dword [ebp - 8], ebx
push 2
lea eax, [ebp - 0x9d0]
pop edi
push edi
push 0x414458
push eax
call fcn.00411110
add esp, 0xc
test eax, eax
jne 0x406724
cmp dword [ebp - 0x14], edi
je 0x406e97
push edi
lea eax, [ebp - 0x9d0]
push 0x414454
push eax
call fcn.00411110
add esp, 0xc
test eax, eax
jne 0x406746
cmp dword [ebp - 0x20], edi
je 0x406e97
cmp dword [ebp - 0xc], ebx
je 0x406758
cmp byte [ebp - 0xcd0], 0
je 0x406e97
cmp byte [ebp - 0x9d0], 0
je 0x406e97
lea eax, [ebp - 0x9d0]
push ebx
push eax
call fcn.0040b1ca
pop ecx
test eax, eax
pop ecx
jne 0x406dd2
lea eax, [ebp - 0x9d0]
push eax
lea eax, [ebp - 0xbd0]
push eax
call esi
lea eax, [ebp - 0xbd0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp + eax - 0xbd1]
lea ecx, [ebp - 0xbd0]
cmp eax, ecx
jbe 0x4067b5
cmp byte [eax], 0x5c
je 0x4067ba
and byte [eax], 0
dec eax
jmp 0x4067a0
cmp byte [eax], 0x5c
jne 0x4067bd
and byte [eax], 0
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea eax, [ebp - 0x1ae0]
push eax
lea eax, [ebp - 0xbd0]
push eax
call ebx
test eax, eax
je 0x406ad9
lea eax, [ebp - 0x15d4]
push eax
lea eax, [ebp - 0xbd0]
push eax
call ebx
test eax, eax
je 0x406ad9
push dword [0x417888]
lea eax, [ebp - 0xbd0]
push eax
call ebx
test eax, eax
je 0x406ad9
lea eax, [ebp - 0x18d8]
push eax
lea eax, [ebp - 0xbd0]
push eax
call ebx
test eax, eax
je 0x406ad9
mov ecx, dword [0x417bfc]
xor ebx, ebx
push ebx
lea eax, [ebp - 0x9d0]
push ebx
push eax
mov eax, dword [0x417830]
push ecx
push 0x27c
push dword [eax]
lea eax, [eax + ecx*4]
push eax
call fcn.0040c04a
mov edi, eax
add esp, 0x1c
cmp edi, ebx
jne 0x406a85
mov eax, dword [0x417830]
mov ecx, dword [0x417bfc]
mov eax, dword [eax + ecx*4]
mov word [eax + 0x274], bx
mov eax, dword [0x417bfc]
mov ecx, dword [0x417830]
mov eax, dword [ecx + eax*4]
mov dword [eax + 0x264], ebx
cmp dword [0x41785c], ebx
je 0x4068a4
mov ecx, dword [0x417830]
lea eax, [ebp - 0x9d0]
push eax
mov eax, dword [0x417bfc]
mov eax, dword [ecx + eax*4]
add eax, 8
push eax
call esi
jmp 0x4068c3
mov eax, dword [0x417bfc]
mov ecx, dword [0x417830]
mov eax, dword [ecx + eax*4]
add eax, 8
push eax
lea eax, [ebp - 0x9d0]
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
cmp dword [0x41785c], ebx
je 0x4068ea
mov ecx, dword [0x417830]
lea eax, [ebp - 0xcd0]
push eax
mov eax, dword [0x417bfc]
mov eax, dword [ecx + eax*4]
add eax, 0x10c
push eax
call esi
jmp 0x40690b
mov eax, dword [0x417bfc]
mov ecx, dword [0x417830]
mov eax, dword [ecx + eax*4]
add eax, 0x10c
push eax
lea eax, [ebp - 0xcd0]
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov eax, dword [0x417830]
mov ecx, dword [0x417bfc]
cmp dword [ebp - 4], ebx
mov eax, dword [eax + ecx*4]
mov word [eax + 0x26e], bx
mov eax, dword [0x417830]
mov ecx, dword [0x417bfc]
mov eax, dword [eax + ecx*4]
mov word [eax + 0x26c], bx
mov eax, dword [0x417830]
mov ecx, dword [0x417bfc]
mov eax, dword [eax + ecx*4]
mov cx, word [0x417cd4]
mov word [eax + 0x270], cx
mov eax, dword [0x417bfc]
mov ecx, dword [0x417830]
mov eax, dword [ecx + eax*4]
mov cx, word [0x417cd4]
mov word [eax + 0x272], cx
jne 0x4069a8
mov eax, dword [0x417830]
mov ecx, dword [0x417bfc]
mov eax, dword [eax + ecx*4]
mov cx, word [0x417cd4]
mov word [eax + 0x276], cx
mov eax, dword [0x417bfc]
mov ecx, dword [0x417830]
mov eax, dword [ecx + eax*4]
mov dword [eax + 0x278], 1
jmp 0x4069bd
mov eax, dword [0x417bfc]
mov ecx, dword [0x417830]
mov eax, dword [ecx + eax*4]
mov word [eax + 0x276], bx
cmp dword [ebp - 0xc], ebx
jne 0x4069e5
cmp byte [ebp - 0xcd0], 0
jne 0x4069e5
mov eax, dword [0x417bfc]
mov ecx, dword [0x417830]
mov eax, dword [ecx + eax*4]
mov dword [eax + 0x268], 1
jmp 0x4069f9
mov eax, dword [0x417bfc]
mov ecx, dword [0x417830]
mov eax, dword [ecx + eax*4]
mov dword [eax + 0x268], ebx
mov ecx, dword [0x417bfc]
lea eax, [ebp - 0xd0]
push eax
mov eax, dword [0x417830]
mov eax, dword [eax + ecx*4]
add eax, 0x210
push eax
call esi
mov eax, dword [0x417bfc]
mov ecx, dword [0x417830]
mov eax, dword [ecx + eax*4]
mov dword [eax + 0x260], ebx
cmp byte [ebp - 0x13d0], 0
je 0x406a7a
lea eax, [ebp - 0x13d0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
call fcn.0040bf28
mov edx, dword [0x417bfc]
pop ecx
mov ecx, dword [0x417830]
mov ecx, dword [ecx + edx*4]
mov dword [ecx + 0x260], eax
mov ecx, dword [0x417830]
lea eax, [ebp - 0x13d0]
push eax
mov eax, dword [0x417bfc]
mov eax, dword [ecx + eax*4]
push dword [eax + 0x260]
call esi
inc dword [0x417bfc]
jmp 0x40703d
mov ax, word [0x417cd4]
cmp dword [ebp - 4], ebx
mov word [edi + 0x270], ax
jne 0x406aaa
mov ax, word [0x417cd4]
inc dword [edi + 0x278]
mov word [edi + 0x276], ax
cmp byte [ebp - 0xcd0], 0
je 0x406f4f
lea eax, [ebp - 0xcd0]
push eax
lea eax, [edi + 0x10c]
push eax
call esi
mov ax, word [0x417cd4]
mov word [edi + 0x272], ax
jmp 0x406f4f
xor edi, edi
cmp dword [0x4178b8], edi
jle 0x406b0a
mov eax, dword [0x417c58]
push dword [eax + edi*4]
lea eax, [ebp - 0x9d0]
push eax
call ebx
test eax, eax
mov eax, dword [0x4178b8]
je 0x406b02
inc edi
cmp edi, eax
jl 0x406ae3
cmp edi, eax
jl 0x406d50
push 0x274
call fcn.0040bf28
mov edx, dword [0x4178b8]
pop ecx
mov ecx, dword [0x417c58]
xor edi, edi
mov dword [ecx + edx*4], eax
mov eax, dword [0x417c58]
mov ecx, dword [0x4178b8]
mov eax, dword [eax + ecx*4]
mov word [eax + 0x26c], di
mov eax, dword [0x4178b8]
mov ecx, dword [0x417c58]
mov eax, dword [ecx + eax*4]
mov ecx, dword [ebp - 0x10]
mov dword [eax + 0x25c], ecx
cmp dword [0x41785c], edi
je 0x406b73
mov ecx, dword [0x417c58]
lea eax, [ebp - 0x9d0]
push eax
mov eax, dword [0x4178b8]
push dword [ecx + eax*4]
call esi
jmp 0x406b8e
mov eax, dword [0x4178b8]
mov ecx, dword [0x417c58]
push dword [ecx + eax*4]
lea eax, [ebp - 0x9d0]
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
cmp dword [0x41785c], edi
je 0x406bb5
mov ecx, dword [0x417c58]
lea eax, [ebp - 0xcd0]
push eax
mov eax, dword [0x4178b8]
mov eax, dword [ecx + eax*4]
add eax, 0x104
push eax
call esi
jmp 0x406bd6
mov eax, dword [0x4178b8]
mov ecx, dword [0x417c58]
mov eax, dword [ecx + eax*4]
add eax, 0x104
push eax
lea eax, [ebp - 0xcd0]
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov eax, dword [0x417c58]
mov ecx, dword [0x4178b8]
cmp dword [ebp - 4], edi
mov eax, dword [eax + ecx*4]
mov word [eax + 0x266], di
mov eax, dword [0x417c58]
mov ecx, dword [0x4178b8]
mov eax, dword [eax + ecx*4]
mov word [eax + 0x264], di
mov eax, dword [0x417c58]
mov ecx, dword [0x4178b8]
mov eax, dword [eax + ecx*4]
mov cx, word [0x417cd4]
mov word [eax + 0x268], cx
mov eax, dword [0x4178b8]
mov ecx, dword [0x417c58]
mov eax, dword [ecx + eax*4]
mov cx, word [0x417cd4]
mov word [eax + 0x26a], cx
jne 0x406c73
mov eax, dword [0x417c58]
mov ecx, dword [0x4178b8]
mov eax, dword [eax + ecx*4]
mov cx, word [0x417cd4]
mov word [eax + 0x26e], cx
mov eax, dword [0x4178b8]
mov ecx, dword [0x417c58]
mov eax, dword [ecx + eax*4]
mov dword [eax + 0x270], 1
jmp 0x406c88
mov eax, dword [0x4178b8]
mov ecx, dword [0x417c58]
mov eax, dword [ecx + eax*4]
mov word [eax + 0x26e], di
cmp dword [ebp - 0xc], edi
jne 0x406cb0
cmp byte [ebp - 0xcd0], 0
jne 0x406cb0
mov eax, dword [0x4178b8]
mov ecx, dword [0x417c58]
mov eax, dword [ecx + eax*4]
mov dword [eax + 0x260], 1
jmp 0x406cc4
mov eax, dword [0x4178b8]
mov ecx, dword [0x417c58]
mov eax, dword [ecx + eax*4]
mov dword [eax + 0x260], edi
mov ecx, dword [0x4178b8]
lea eax, [ebp - 0xd0]
push eax
mov eax, dword [0x417c58]
mov eax, dword [eax + ecx*4]
add eax, 0x208
push eax
call esi
mov eax, dword [0x4178b8]
mov ecx, dword [0x417c58]
mov eax, dword [ecx + eax*4]
mov dword [eax + 0x258], edi
cmp byte [ebp - 0x13d0], 0
je 0x406d45
lea eax, [ebp - 0x13d0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
call fcn.0040bf28
mov edx, dword [0x4178b8]
pop ecx
mov ecx, dword [0x417c58]
mov ecx, dword [ecx + edx*4]
mov dword [ecx + 0x258], eax
mov ecx, dword [0x417c58]
lea eax, [ebp - 0x13d0]
push eax
mov eax, dword [0x4178b8]
mov eax, dword [ecx + eax*4]
push dword [eax + 0x258]
call esi
inc dword [0x4178b8]
jmp 0x40703d
mov eax, dword [0x417c58]
mov cx, word [0x417cd4]
shl edi, 2
cmp dword [ebp - 4], 0
mov eax, dword [edi + eax]
mov word [eax + 0x268], cx
jne 0x406d93
mov eax, dword [0x417c58]
mov cx, word [0x417cd4]
mov eax, dword [edi + eax]
mov word [eax + 0x26e], cx
mov eax, dword [0x417c58]
mov eax, dword [edi + eax]
inc dword [eax + 0x270]
cmp byte [ebp - 0xcd0], 0
je 0x406fe2
lea eax, [ebp - 0xcd0]
push eax
mov eax, dword [0x417c58]
mov eax, dword [edi + eax]
add eax, 0x104
push eax
call esi
mov eax, dword [0x417c58]
mov cx, word [0x417cd4]
mov eax, dword [edi + eax]
mov word [eax + 0x26a], cx
jmp 0x406fe2
xor edi, edi
cmp dword [0x41781c], ebx
jle 0x406e03
mov eax, dword [0x41784c]
push dword [eax + edi*4]
lea eax, [ebp - 0x9d0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
mov eax, dword [0x41781c]
je 0x406dff
inc edi
cmp edi, eax
jl 0x406ddc
cmp edi, eax
jl 0x406e25
lea eax, [ebp - 0x13d0]
push eax
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x9d0]
push eax
call fcn.004070da
add esp, 0xc
jmp 0x40703d
mov eax, dword [0x41784c]
mov cx, word [0x417cd4]
shl edi, 2
mov eax, dword [edi + eax]
mov word [eax + 0x268], cx
lea eax, [ebp - 0xd0]
push eax
mov eax, dword [0x41784c]
mov eax, dword [edi + eax]
add eax, 0x208
push eax
call esi
cmp byte [ebp - 0x13d0], 0
je 0x40703d
lea eax, [ebp - 0x13d0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
call fcn.0040bf28
pop ecx
mov ecx, dword [0x41784c]
mov ecx, dword [edi + ecx]
mov dword [ecx + 0x258], eax
lea eax, [ebp - 0x13d0]
push eax
mov eax, dword [0x41784c]
jmp 0x407032
cmp byte [ebp - 0xd0], 0
jne 0x406ead
cmp byte [ebp - 0x13d0], 0
je 0x40703d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea eax, [ebp - 0x1ae0]
push eax
lea eax, [ebp - 0xbd0]
push eax
call ebx
test eax, eax
je 0x406f94
lea eax, [ebp - 0x15d4]
push eax
lea eax, [ebp - 0xbd0]
push eax
call ebx
test eax, eax
je 0x406f94
push dword [0x417888]
lea eax, [ebp - 0xbd0]
push eax
call ebx
test eax, eax
je 0x406f94
lea eax, [ebp - 0x18d8]
push eax
lea eax, [ebp - 0xbd0]
push eax
call ebx
test eax, eax
je 0x406f94
xor ebx, ebx
lea eax, [ebp - 0x9d0]
push ebx
push ebx
push eax
mov eax, dword [0x417830]
push dword [0x417bfc]
push 0x27c
push dword [eax]
push ebx
call fcn.0040c04a
mov edi, eax
add esp, 0x1c
cmp edi, ebx
je 0x406e03
mov ax, word [0x417cd4]
mov word [edi + 0x274], ax
lea eax, [ebp - 0xd0]
push eax
lea eax, [edi + 0x210]
push eax
call esi
cmp byte [ebp - 0x13d0], 0
je 0x40703d
lea eax, [ebp - 0x13d0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
call fcn.0040bf28
pop ecx
mov dword [edi + 0x260], eax
lea ecx, [ebp - 0x13d0]
push ecx
push eax
jmp 0x40703b
xor edi, edi
cmp dword [0x4178b8], edi
jle 0x406e03
mov eax, dword [0x417c58]
push dword [eax + edi*4]
lea eax, [ebp - 0x9d0]
push eax
call ebx
test eax, eax
mov eax, dword [0x4178b8]
je 0x406fc1
inc edi
cmp edi, eax
jl 0x406fa2
cmp edi, eax
jge 0x406e03
mov eax, dword [0x417c58]
mov cx, word [0x417cd4]
shl edi, 2
mov eax, dword [edi + eax]
mov word [eax + 0x26c], cx
lea eax, [ebp - 0xd0]
push eax
mov eax, dword [0x417c58]
mov eax, dword [edi + eax]
add eax, 0x208
push eax
call esi
cmp byte [ebp - 0x13d0], 0
je 0x40703d
lea eax, [ebp - 0x13d0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
call fcn.0040bf28
pop ecx
mov ecx, dword [0x417c58]
mov ecx, dword [edi + ecx]
mov dword [ecx + 0x258], eax
lea eax, [ebp - 0x13d0]
push eax
mov eax, dword [0x417c58]
mov eax, dword [edi + eax]
push dword [eax + 0x258]
call esi
cmp dword [ebp - 8], 0
je 0x40705c
push 0
lea eax, [ebp - 0x8d0]
push dword [ebp + 8]
push 0x800
push eax
call fcn.004071cb
add esp, 0x10
cmp byte [ebp - 0x8d0], 0
jne 0x40477c
xor ebx, ebx
jmp 0x4070ca
mov esi, 0x100
lea eax, [ebp - 0x1de4]
push esi
push eax
push 0x19
push dword [0x417bd4]
call fcn.0040b454
lea eax, [ebp - 0x1ce4]
push esi
push eax
push 0x43
push dword [0x417bd4]
call fcn.0040b454
mov eax, dword [0x4177cc]
add esp, 0x20
cmp eax, edi
je 0x4070af
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
lea eax, [ebp - 0x1de4]
push edi
push eax
lea eax, [ebp - 0x1ce4]
push eax
push dword [0x4177d0]
call dword [sym.imp.USER32.dll_MessageBoxA]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll__lclose]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret