Function at 0x41d6b9
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ebp
sub esp, 0x270
lea ebp, [esp - 4]
mov eax, dword [0x4db020]
xor eax, ebp
mov dword [ebp + 0x270], eax
push 0x3c0
mov eax, 0x4a3df1
call fcn.004674a0
mov eax, dword [ebp + 0x280]
mov esi, dword [ebp + 0x27c]
xor edi, edi
inc edi
push edi
lea ecx, [ebp - 0xd]
push ecx
xor ebx, ebx
push eax
lea ecx, [ebp + 0x34]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x24], ebx
call fcn.00409071
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x14]
movzx eax, word [eax]
add eax, 0xffffffbf
cmp eax, 0x39
ja case.0x41d721.71
movzx eax, byte [eax + 0x41e3a9]
jmp dword [eax*4 + 0x41e34d]
push 0x4b0c04
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x41d75f
push ebx
lea edi, [esi + 0x294]
mov eax, dword [edi]
push ebx
push str._auto
mov ecx, esi
mov byte [eax + 2], 1
call fcn.0043a7a6
mov eax, dword [edi]
mov byte [eax + 2], 1
jmp 0x41e301
cmp dword [esi + 0x24], ebx
jne case.0x41d721.71
mov ecx, esi
call fcn.004364e7
test eax, eax
je 0x41d7ae
push edi
lea eax, [ebp - 0xd]
push eax
push str._This_setup_was_created_with_an_EVALUATION_VERSION_of__s__which_does_not_support_extraction_of_the_internal_MSI_file._The_full_version_of_InstallShield_supports_this_functionality.
lea ecx, [ebp - 0x364]
call fcn.00409071
mov byte [ebp - 4], 1
push eax
push 0x86d
push esi
call fcn.0041d628
add esp, 0xc
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x364]
call fcn.00401660
jmp 0x41e319
fldz
lea eax, [ebp - 0x1c]
push eax
fstp qword [ebp - 0x1c]
mov ecx, esi
call fcn.004398af
test eax, eax
je 0x41d7ed
fld qword [ebp - 0x1c]
push ecx
push ecx
fstp qword [esp]
push 0x86f
push esi
call fcn.0041d66f
add esp, 0x10
xor edi, edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x34]
call fcn.00401660
mov eax, edi
jmp 0x41e327
push ebx
push ebx
push 0x4b1c0c
mov ecx, esi
mov dword [esi + 0x24], edi
call fcn.0043a7a6
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_CharNextW]
push edi
lea ecx, [ebp - 0xd]
push ecx
push eax
lea ecx, [ebp - 0x2c8]
call fcn.00409071
mov byte [ebp - 4], 2
push ebx
lea eax, [ebp - 0x2c8]
push eax
push 0xe
mov ecx, esi
call fcn.0041115b
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x2c8]
call fcn.00401660
jmp 0x41e301
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_CharNextW]
push edi
lea ecx, [ebp - 0xd]
push ecx
push eax
lea ecx, [ebp - 0x2fc]
call fcn.00409071
mov byte [ebp - 4], 3
push ebx
lea eax, [ebp - 0x2fc]
push eax
push 0xc
mov ecx, esi
call fcn.0041115b
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x2fc]
jmp 0x41d836
push edi
mov ecx, esi
call fcn.00435f55
mov dword [esi + 0x70], edi
jmp 0x41e301
push edi
lea eax, [ebp - 0xd]
push eax
push str.debuglog
lea ecx, [ebp - 0xc0]
call fcn.00409071
mov byte [ebp - 4], 4
push ebx
lea eax, [ebp - 0xbc]
push eax
lea ecx, [ebp + 0x38]
call fcn.00406d00
neg eax
sbb al, al
inc al
mov byte [ebp - 0xd], al
mov byte [ebp - 4], bl
lea ecx, [ebp - 0xc0]
call fcn.00401660
cmp byte [ebp - 0xd], bl
jne 0x41d7da
push edi
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_CharNextW]
push eax
push 0x4b1bf0
jmp 0x41e2fa
push edi
lea eax, [ebp - 0xd]
push eax
push 0x4b1be0
lea ecx, [ebp - 0x128]
call fcn.00409071
mov byte [ebp - 4], 5
push ebx
lea eax, [ebp - 0x124]
push eax
lea ecx, [ebp + 0x38]
mov dword [ebp - 0x24], edi
call fcn.00406d00
test eax, eax
jne 0x41d952
push edi
lea eax, [ebp - 0xd]
push eax
push 0x4b1bdc
lea ecx, [ebp - 0x260]
call fcn.00409071
mov dword [ebp - 4], 6
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp + 0x34]
mov dword [ebp - 0x24], 3
call fcn.0041c579
mov byte [ebp - 0xd], 1
test al, al
jne 0x41d955
mov byte [ebp - 0xd], bl
mov dword [ebp - 4], 5
test byte [ebp - 0x24], 2
je 0x41d971
and dword [ebp - 0x24], 0xfffffffd
lea ecx, [ebp - 0x260]
call fcn.00401660
mov dword [ebp - 4], ebx
test byte [ebp - 0x24], 1
je 0x41d989
and dword [ebp - 0x24], 0xfffffffe
lea ecx, [ebp - 0x128]
call fcn.00401660
cmp byte [ebp - 0xd], bl
je 0x41d9be
push 0xffffffffffffffff
push 5
lea eax, [ebp - 0x3cc]
push eax
lea ecx, [ebp + 0x34]
call fcn.004090ba
mov byte [ebp - 4], 7
push ebx
push eax
push 0x10
mov ecx, esi
call fcn.0041115b
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x3cc]
jmp 0x41d836
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_CharNextW]
push str._IS_E_
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x41d9ed
push dword [ebp - 0x14]
push 0x4dfe70
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x41da74
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov byte [ebp - 4], 8
push 0x2001f
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x1c]
call fcn.00401470
test eax, eax
jne 0x41db40
push 0x206
mov word [ebp + 0x68], ax
lea eax, [ebp + 0x6a]
push ebx
push eax
call fcn.00468830
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp + 0x68]
push eax
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x20], 0x104
call fcn.00401540
lea eax, [ebp + 0x68]
push eax
push 0x4dfe70
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [ebp - 0x14]
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea ecx, [ebp - 0x1c]
call fcn.00401420
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x1c]
call fcn.00401420
push 0x4dfe70
call fcn.00442f14
mov dword [esi + 0x70], edi
cmp dword [0x4dfd50], 8
mov eax, dword [0x4dfd3c]
jae 0x41da94
mov eax, 0x4dfd3c
push eax
push 0x4dfe70
push 0x4decc8
call fcn.004435cf
push edi
lea eax, [ebp - 0xd]
push eax
push 0x4c1ca0
lea ecx, [ebp - 0x330]
call fcn.00401850
mov byte [ebp - 4], 9
push edi
lea eax, [ebp - 0xd]
push eax
push dword [0x4b09d4]
lea ecx, [ebp - 0x190]
call fcn.00401850
mov byte [ebp - 4], 0xa
push edi
lea eax, [ebp - 0xd]
push eax
push dword [0x4b09cc]
lea ecx, [ebp - 0x58]
call fcn.00401850
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x330]
push eax
lea eax, [ebp - 0x190]
push eax
lea eax, [ebp - 0x58]
push eax
push 5
mov ecx, esi
call fcn.004111cb
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x58]
call fcn.00401600
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x190]
call fcn.00401600
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x330]
call fcn.00401600
push 2
mov ecx, esi
call fcn.00435f77
jmp 0x41e301
push esi
call fcn.0041cfc2
pop ecx
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x1c]
call fcn.00401420
jmp 0x41d7d8
push dword [ebp - 0x14]
mov edi, dword [sym.imp.USER32.dll_CharNextW]
call edi
movzx eax, word [eax]
sub eax, 0x31
je 0x41dbb1
dec eax
je 0x41db9d
dec eax
je 0x41db81
push ebx
push dword [ebp - 0x14]
call edi
push eax
push 0x4b1b70
jmp 0x41e2fa
push dword [ebp - 0x14]
mov byte [esi + 0x290], 1
call edi
push eax
call edi
push eax
mov ecx, esi
call fcn.004378dd
jmp 0x41e301
push ebx
push dword [ebp - 0x14]
call edi
push eax
call edi
push eax
push 0x4b1b68
jmp 0x41e2fa
push ebx
push dword [ebp - 0x14]
call edi
push eax
call edi
push eax
push 0x4b1b60
mov ecx, esi
call fcn.0043a7a6
mov dword [esi + 0x74], 1
jmp 0x41e301
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str.hide_progress
push dword [ebp - 0x14]
call edi
test eax, eax
jne 0x41dbee
mov byte [esi + 0x28a], 1
push str.hide_splash
push dword [ebp - 0x14]
call edi
test eax, eax
jne 0x41e301
mov byte [esi + 0x28b], 1
jmp 0x41e301
push edi
lea eax, [ebp - 0xd]
push eax
push str.instance
lea ecx, [ebp - 0x1f8]
call fcn.00409071
mov byte [ebp - 4], 0xc
push ebx
lea eax, [ebp - 0x1f4]
push eax
lea ecx, [ebp + 0x38]
call fcn.00406d00
neg eax
sbb al, al
inc al
mov byte [ebp - 0xd], al
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x1f8]
call fcn.00401660
cmp byte [ebp - 0xd], bl
je 0x41e301
push 0xfffffffffffffffd
pop edi
push 0xffffffffffffffff
push 9
lea eax, [ebp]
add esi, 0x28c
push eax
lea ecx, [ebp + 0x34]
mov dword [esi], edi
call fcn.004090ba
mov byte [ebp - 4], 0xd
push str.default
lea ecx, [ebp + 4]
call fcn.0040e781
test eax, eax
jne 0x41dc8a
or dword [esi], 0xffffffff
jmp 0x41dc9b
push 0xa
push esi
lea ecx, [ebp]
call fcn.0041c478
test al, al
jne 0x41dc9b
mov dword [esi], edi
mov byte [ebp - 4], bl
lea ecx, [ebp]
jmp 0x41d836
cmp dword [esi + 0x24], ebx
je 0x41dcb7
push esi
call fcn.0041cfc2
pop ecx
jmp 0x41d7d8
push dword [ebp - 0x14]
mov dword [esi + 0x24], 3
call dword [sym.imp.USER32.dll_CharNextW]
push edi
lea ecx, [ebp - 0xd]
push ecx
push eax
lea ecx, [ebp - 0x294]
mov dword [ebp - 0x14], eax
call fcn.00409071
mov byte [ebp - 4], 0xe
push ebx
lea eax, [ebp - 0x294]
push eax
push 8
mov ecx, esi
call fcn.0041115b
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x294]
call fcn.00401660
push ebx
push dword [ebp - 0x14]
push 0x4b1b34
jmp 0x41e2fa
push esi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x14]
mov dword [ebp - 0x20], ebx
call dword [sym.imp.USER32.dll_CharNextW]
push eax
call fcn.0041c397
add esp, 0xc
test eax, eax
je 0x41dcab
mov eax, dword [esi + 0x294]
mov cx, word [ebp - 0x20]
mov word [eax + 0x52], cx
jmp 0x41e301
push dword [ebp - 0x14]
mov edi, dword [sym.imp.USER32.dll_CharNextW]
call edi
movzx ecx, word [eax]
sub ecx, 0x31
push ebx
push eax
je 0x41dd6c
dec ecx
je 0x41dd5f
push 0x4b1b2c
jmp 0x41e2fa
call edi
push eax
push 0x4b1b24
jmp 0x41e2fa
call edi
push eax
push 0x4b1b1c
jmp 0x41e2fa
push str.noscript_uninst
push dword [ebp - 0x14]
call fcn.00469936
pop ecx
pop ecx
test eax, eax
jne 0x41dd98
push ebx
push ebx
push str._noscript_uninst
jmp 0x41e2fa
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_CharNextW]
push edi
lea ecx, [ebp - 0xd]
push ecx
push eax
lea ecx, [ebp - 0x8c]
call fcn.00409071
mov byte [ebp - 4], 0xf
push ebx
lea eax, [ebp - 0x8c]
push eax
push 5
mov ecx, esi
call fcn.0041115b
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x8c]
call fcn.00401660
push 2
mov ecx, esi
call fcn.00435f77
jmp 0x41d882
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_CharNextW]
push eax
push 0x4dc8d8
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x41e301
mov byte [esi + 0x291], 1
jmp 0x41e301
mov edi, dword [ebp - 0x14]
push str.removeonly
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x41de28
push ebx
push ebx
push str._removeonly
jmp 0x41e2fa
push str.runas
push edi
call fcn.00469936
pop ecx
pop ecx
test eax, eax
je 0x41e301
push 0x4b0a0c
push edi
call fcn.00469936
pop ecx
pop ecx
test eax, eax
je 0x41e301
push 6
push str.reboot
push edi
call fcn.0046820c
add esp, 0xc
test eax, eax
je 0x41e301
push str.removeasmajorupgrade
push edi
call fcn.00469936
pop ecx
pop ecx
test eax, eax
je 0x41e301
push ebx
push ebx
push 0x4b1a68
jmp 0x41e2fa
mov edi, dword [ebp - 0x14]
push 0x4b1a60
push edi
call fcn.00469936
pop ecx
pop ecx
test eax, eax
jne 0x41deab
push ebx
push ebx
push str._SMS
jmp 0x41e2fa
push str.show_eval_msg
push edi
call fcn.00469936
pop ecx
pop ecx
test eax, eax
jne 0x41decb
mov eax, dword [esi + 0x294]
mov byte [eax + 0x17], 1
jmp 0x41e301
push str.show_beta_msg
push edi
call fcn.00469936
pop ecx
pop ecx
test eax, eax
jne 0x41deeb
mov eax, dword [esi + 0x294]
mov byte [eax + 0x18], 1
jmp 0x41e301
push str.show_reboot_msg
push edi
call fcn.00469936
pop ecx
pop ecx
test eax, eax
jne 0x41df0b
mov eax, dword [esi + 0x294]
mov byte [eax + 0x1c], 1
jmp 0x41e301
push ebx
lea edi, [esi + 0x294]
mov eax, dword [edi]
push ebx
push 0x4b1a2c
mov ecx, esi
mov byte [eax + 1], 1
call fcn.0043a7a6
mov eax, dword [edi]
mov byte [eax + 1], 1
jmp 0x41e301
push ebx
push str.tempdisk1folder
lea ecx, [ebp + 0x38]
call fcn.0040712d
test eax, eax
je 0x41e301
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_CharNextW]
push str._IS_T_
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x41df71
push dword [ebp - 0x14]
mov ecx, esi
call fcn.00438383
jmp 0x41dffd
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov byte [ebp - 4], 0x10
push 0x2001f
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x1c]
call fcn.00401470
test eax, eax
jne 0x41db40
push 0x206
mov word [ebp + 0x68], ax
lea eax, [ebp + 0x6a]
push ebx
push eax
call fcn.00468830
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp + 0x68]
push eax
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x20], 0x104
call fcn.00401540
lea eax, [ebp + 0x68]
push eax
call fcn.00442f14
lea eax, [ebp + 0x68]
push eax
mov ecx, esi
call fcn.00438383
push dword [ebp - 0x14]
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea ecx, [ebp - 0x1c]
call fcn.00401420
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x1c]
call fcn.00401420
push 3
jmp 0x41ddd7
push dword [ebp - 0x14]
mov edi, dword [sym.imp.USER32.dll_CharNextW]
call edi
movzx eax, word [eax]
cmp eax, 0x41
je 0x41e0d5
cmp eax, 0x4d
je 0x41e098
cmp eax, 0x57
je 0x41e05b
cmp eax, 0x61
je 0x41e0d5
cmp eax, 0x6d
je 0x41e098
cmp eax, 0x77
je 0x41e05b
push str.uninst
push dword [ebp - 0x14]
call fcn.00469936
pop ecx
pop ecx
test eax, eax
jne 0x41e301
push ebx
push ebx
push str._uninst
jmp 0x41e2fa
push dword [ebp - 0x14]
call edi
push eax
call edi
push 1
lea ecx, [ebp - 0xd]
push ecx
push eax
lea ecx, [ebp - 0xf4]
call fcn.00409071
mov byte [ebp - 4], 0x12
push ebx
lea eax, [ebp - 0xf4]
push eax
push 0xa
mov ecx, esi
call fcn.0041115b
mov byte [ebp - 4], bl
lea ecx, [ebp - 0xf4]
jmp 0x41d836
push dword [ebp - 0x14]
call edi
push eax
call edi
push 1
lea ecx, [ebp - 0xd]
push ecx
push eax
lea ecx, [ebp - 0x15c]
call fcn.00409071
mov byte [ebp - 4], 0x13
push ebx
lea eax, [ebp - 0x15c]
push eax
push 0xb
mov ecx, esi
call fcn.0041115b
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x15c]
jmp 0x41d836
push dword [ebp - 0x14]
call edi
push eax
call edi
push 1
lea ecx, [ebp - 0xd]
push ecx
push eax
lea ecx, [ebp - 0x1c4]
call fcn.00409071
mov byte [ebp - 4], 0x11
push ebx
lea eax, [ebp - 0x1c4]
push eax
push 9
mov ecx, esi
call fcn.0041115b
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x1c4]
jmp 0x41d836
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov byte [ebp - 4], 0x14
push 0x2001f
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x1c]
call fcn.00401470
test eax, eax
jne 0x41e14d
push str.ISSetup
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea ecx, [ebp - 0x1c]
call fcn.00401420
push 7
push str.verbose
push dword [ebp - 0x14]
call fcn.0046820c
add esp, 0xc
test eax, eax
je 0x41e295
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_CharNextW]
push str._IS_V_
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x41e1eb
lea eax, [ebp - 0x20]
push eax
lea ecx, [esi + 4]
mov dword [ebp - 0x20], 7
call fcn.00410bd5
mov dword [ebp - 0x20], eax
cmp dword [eax + 0x18], ebx
je 0x41e1ad
mov ecx, eax
push 0x4b0a08
add ecx, 4
call fcn.00415b0e
push edi
lea eax, [ebp - 0xd]
push eax
push dword [ebp - 0x14]
lea ecx, [ebp - 0x398]
call fcn.00409071
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x20]
push eax
call fcn.0040f009
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x398]
call fcn.00401660
mov eax, dword [ebp - 0x14]
push edi
push eax
push 0x4b0f9c
jmp 0x41e2a2
push 0x2001f
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x1c]
call fcn.00401470
test eax, eax
jne 0x41db40
push 0x206
mov word [ebp + 0x68], ax
lea eax, [ebp + 0x6a]
push ebx
push eax
call fcn.00468830
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp + 0x68]
push eax
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x20], 0x104
call fcn.00401540
push dword [ebp - 0x14]
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea ecx, [ebp - 0x1c]
call fcn.00401420
push edi
lea eax, [ebp - 0xd]
push eax
lea eax, [ebp + 0x68]
push eax
lea ecx, [ebp - 0x22c]
call fcn.00409071
mov byte [ebp - 4], 0x16
push ebx
lea eax, [ebp - 0x22c]
push eax
push 7
mov ecx, esi
call fcn.0041115b
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x22c]
call fcn.00401660
lea eax, [ebp + 0x68]
push edi
push eax
mov dword [ebp - 0x14], eax
push 0x4b0f9c
jmp 0x41e2a5
mov eax, dword [ebp - 0x14]
push edi
add eax, 0xe
push eax
push str._verbose
mov dword [ebp - 0x14], eax
mov ecx, esi
call fcn.0043a7a6
cmp dword [ebp - 0x14], ebx
je 0x41e2c6
push dword [ebp - 0x14]
mov byte [0x4de9a4], 1
push 0x4dc9a0
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x1c]
call fcn.00401420
jmp 0x41e301
mov dword [esi + 0x68], edi
jmp 0x41e301
cmp dword [esi + 0x24], ebx
jne 0x41dcab
mov dword [esi + 0x24], 4
jmp 0x41e301
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_CharNextW]
push eax
push 0x4b1934
mov ecx, esi
call fcn.0043a7a6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x34]
call fcn.00401660
xor eax, eax
inc eax
jmp 0x41e327
push esi
call fcn.0041cfc2
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x34]
call fcn.00401660
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x270]
xor ecx, ebp
call fcn.00467491
add ebp, 0x274
leave
ret