Function at 0x4014f0
Capabilities:
Accept command line arguments
Check mutex on windows
Check os version
Create process on windows
Delete registry key
Delete registry value
Get common file path
Identify system language via api
Persist via run registry key
Query or enumerate registry value
Resolve function by parsing pe exports
Set registry value
Shutdown system

Disassembly:
mov eax, 0x12cc
call fcn.00406af0
push ebx
push ebp
push esi
push edi
xor ebp, ebp
mov ecx, 0xc
xor eax, eax
lea edi, [esp + 0x30]
mov dword [esp + 0x2c], ebp
mov dword [esp + 0xf0], ebp
rep stosd dword es:[edi], eax
mov ecx, 0xd
lea edi, [esp + 0xf4]
rep stosd dword es:[edi], eax
mov ecx, 0xc
lea edi, [esp + 0x140]
mov dword [esp + 0x13c], ebp
mov dword [esp + 0x80], ebp
rep stosd dword es:[edi], eax
mov ecx, 0x1b
lea edi, [esp + 0x84]
rep stosd dword es:[edi], eax
mov ecx, 0x81
lea edi, [esp + 0xcc2]
mov word [esp + 0xcc0], bp
mov word [esp + 0x170], bp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x13
xor eax, eax
lea edi, [esp + 0x172]
mov word [esp + 0x1e8], bp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x1d
xor eax, eax
lea edi, [esp + 0x1ea]
mov word [esp + 0x260], bp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x1d
xor eax, eax
lea edi, [esp + 0x262]
mov dword [esp + 0x18], ebp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x12e0]
lea ecx, [esp + 0x6c4]
push ecx
mov dword [esp + 0x6c], ebp
mov dword [esp + 0x74], ebp
mov dword [0x40fd0c], eax
mov dword [esp + 0x6c8], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov edi, 2
mov eax, dword [esp + 0x6d4]
cmp eax, 1
jne 0x401627
mov dword [0x40fcf0], eax
mov eax, dword [esp + 0x6c8]
cmp eax, 4
ja 0x40165b
jne 0x402d68
cmp dword [esp + 0x6cc], ebp
ja 0x40165b
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x12cc
ret 0x10
cmp eax, edi
jne 0x40165b
mov eax, dword [esp + 0x6c8]
cmp eax, 4
jne 0x40163f
mov dword [0x40fcf0], edi
jmp 0x40165b
cmp eax, 5
jne 0x40165b
mov esi, dword [esp + 0x6cc]
xor edx, edx
cmp edx, esi
sbb eax, eax
neg eax
add eax, 3
mov dword [0x40fcf0], eax
lea ecx, [esp + 0xcc0]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea edx, [esp + 0x8d8]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [esp + 0x260]
lea ecx, [esp + 0x1e8]
push eax
lea edx, [esp + 0x174]
push ecx
lea eax, [esp + 0x10c4]
push edx
push eax
lea ecx, [esp + 0x8e8]
push 0x40ec00
push ecx
call fcn.00406ab6
mov eax, dword [0x40fdd8]
mov ecx, dword [0x40ebfc]
add esp, 0x18
cmp word [esp + 0x1e8], ax
jne 0x4016d5
mov word [esp + 0x1e8], cx
cmp word [esp + 0x260], ax
jne 0x4016e7
mov word [esp + 0x260], cx
call fcn.00401000
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x401725
mov eax, dword [0x40fcdc]
lea edx, [esp + 0x4c4]
push 0xc8
push edx
push 0x7ed
push eax
call esi
push ebp
lea ecx, [esp + 0x4c8]
push str.nView_Localized_Resource_Load_Error
push ecx
push ebp
call dword [sym.imp.USER32.dll_MessageBoxW]
mov edx, dword [0x40fcdc]
push 0x32
push 0x40fd58
push 0x15ee
push edx
call esi
mov eax, dword [0x40fcf0]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
jne 0x401898
lea eax, [esp + 0x170]
push str._uninstall
push eax
call fcn.00406a81
add esp, 8
test eax, eax
je 0x401898
lea ecx, [esp + 0x14]
mov dword [esp + 0x20], ebp
push ecx
push 0x20019
push ebp
push str.SoftwareMicrosoftInternet_Explorer
push 0x80000002
call edi
test eax, eax
jne 0x4017db
lea edx, [esp + 0x28]
lea eax, [esp + 0x1c0]
push edx
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x78]
push eax
push ecx
push ebp
push str.Version
push edx
mov dword [esp + 0x40], 0x28
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [esp + 0x14]
push eax
call ebx
lea ecx, [esp + 0x20]
lea edx, [esp + 0x1c0]
push ecx
push 0x40eb38
push edx
call fcn.00406ab6
add esp, 0xc
cmp dword [esp + 0x20], 4
jae 0x401888
lea eax, [esp + 0x14]
push eax
push 0xf003f
push ebp
push str.SoftwareNVIDIA_CorporationGlobalNT4Asked
push 0x80000001
call edi
test eax, eax
je 0x401872
mov edx, dword [0x40fcdc]
lea ecx, [esp + 0x8d8]
push 0x1f4
push ecx
push 0x15ed
push edx
call esi
push ebp
lea eax, [esp + 0x8dc]
push 0x40fd58
push eax
push ebp
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [esp + 0x60]
lea edx, [esp + 0x14]
push ecx
push edx
push ebp
push 0xf003f
push ebp
push ebp
push ebp
push str.SoftwareNVIDIA_CorporationGlobalNT4Asked
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x402d68
mov eax, dword [esp + 0x14]
push eax
call ebx
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x12cc
ret 0x10
mov ecx, dword [esp + 0x14]
push ecx
call ebx
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x12cc
ret 0x10
push str.SoftwareNVIDIA_CorporationGlobalNT4Asked
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov eax, dword [0x40fcdc]
lea edx, [esp + 0x398]
push 0x96
push edx
push 0x11ce
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
mov ecx, dword [0x40fcdc]
mov esi, dword [sym.imp.COMCTL32.dll_CreatePropertySheetPageW]
lea eax, [esp + 0x2c]
mov ebx, 0x800
lea edx, [esp + 0x80]
push eax
mov dword [esp + 0x30], 0x34
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ecx
mov dword [esp + 0x4c], edx
mov dword [esp + 0x48], 0x403f20
mov dword [esp + 0x3c], 0x83b
call esi
lea ecx, [esp + 0x2c]
mov dword [esp + 0x30], 0x3000
push ecx
mov dword [esp + 0xf4], eax
mov dword [esp + 0x58], 0x7f4
mov dword [esp + 0x5c], 0x7f5
mov dword [esp + 0x3c], 0x859
mov dword [esp + 0x48], 0x404020
call esi
mov edi, 0x3008
lea edx, [esp + 0x398]
mov dword [esp + 0xf4], eax
lea eax, [esp + 0x2c]
push eax
mov dword [esp + 0x34], edi
mov dword [esp + 0x58], 0x7e7
mov dword [esp + 0x5c], 0x7e8
mov dword [esp + 0x3c], 0x855
mov dword [esp + 0x44], edx
mov dword [esp + 0x48], 0x404080
call esi
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x398]
push edx
mov dword [esp + 0xfc], eax
mov dword [esp + 0x34], edi
mov dword [esp + 0x58], 0x7d1
mov dword [esp + 0x5c], 0x7d2
mov dword [esp + 0x3c], 0x83c
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], 0x404110
call esi
lea ecx, [esp + 0x2c]
mov dword [esp + 0x30], edi
mov dword [esp + 0xfc], eax
lea eax, [esp + 0x398]
push ecx
mov dword [esp + 0x58], 0x7d3
mov dword [esp + 0x5c], 0x7d4
mov dword [esp + 0x3c], 0x83d
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], 0x404400
call esi
lea edx, [esp + 0x398]
mov dword [esp + 0x30], edi
mov dword [esp + 0x100], eax
lea eax, [esp + 0x2c]
push eax
mov dword [esp + 0x58], 0x7d5
mov dword [esp + 0x5c], 0x7d6
mov dword [esp + 0x3c], 0x839
mov dword [esp + 0x44], edx
mov dword [esp + 0x48], 0x404540
call esi
lea ecx, [esp + 0x398]
mov dword [esp + 0x30], edi
mov dword [esp + 0x104], eax
mov dword [esp + 0x54], 0x7d7
mov dword [esp + 0x58], 0x7d8
mov dword [esp + 0x38], 0x83a
mov dword [esp + 0x40], ecx
lea edx, [esp + 0x2c]
mov dword [esp + 0x44], 0x404af0
push edx
call esi
lea ecx, [esp + 0x2c]
mov dword [esp + 0x30], edi
mov dword [esp + 0x108], eax
lea eax, [esp + 0x398]
push ecx
mov dword [esp + 0x58], 0x7d9
mov dword [esp + 0x5c], 0x7da
mov dword [esp + 0x3c], 0x83f
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], 0x404bc0
call esi
lea edx, [esp + 0x398]
mov dword [esp + 0x30], edi
mov dword [esp + 0x10c], eax
lea eax, [esp + 0x2c]
push eax
mov dword [esp + 0x58], 0x7db
mov dword [esp + 0x5c], 0x7dc
mov dword [esp + 0x3c], 0x840
mov dword [esp + 0x44], edx
mov dword [esp + 0x48], 0x404ce0
call esi
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x398]
push edx
mov dword [esp + 0x114], eax
mov dword [esp + 0x34], edi
mov dword [esp + 0x58], 0x7dd
mov dword [esp + 0x5c], 0x7de
mov dword [esp + 0x3c], 0x841
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], 0x404f00
call esi
lea ecx, [esp + 0x2c]
mov dword [esp + 0x30], edi
mov dword [esp + 0x114], eax
lea eax, [esp + 0x398]
push ecx
mov dword [esp + 0x58], 0x7df
mov dword [esp + 0x5c], 0x7e0
mov dword [esp + 0x3c], 0x842
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], 0x405160
call esi
lea edx, [esp + 0x398]
mov dword [esp + 0x30], edi
mov dword [esp + 0x118], eax
lea eax, [esp + 0x2c]
push eax
mov dword [esp + 0x58], 0x7e1
mov dword [esp + 0x5c], 0x7e2
mov dword [esp + 0x3c], 0x843
mov dword [esp + 0x44], edx
mov dword [esp + 0x48], 0x4053d0
call esi
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x398]
push edx
mov dword [esp + 0x120], eax
mov dword [esp + 0x34], edi
mov dword [esp + 0x58], 0x7e3
mov dword [esp + 0x5c], 0x7e4
mov dword [esp + 0x3c], 0x844
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], 0x405510
call esi
mov dword [esp + 0x30], ebx
mov dword [esp + 0x38], 0x83e
mov dword [esp + 0x120], eax
lea eax, [esp + 0x2c]
push eax
mov dword [esp + 0x48], 0x4055f0
call esi
mov dword [esp + 0x13c], 0x34
mov ecx, dword [esp + 0x12e0]
mov dword [esp + 0x124], eax
mov dword [esp + 0x148], ecx
mov ecx, 0x7c
xor eax, eax
lea edi, [esp + 0xecc]
push ebp
rep stosd dword es:[edi], eax
lea eax, [esp + 0xecc]
lea edx, [esp + 0xf4]
push eax
push ebp
push 0x29
mov dword [esp + 0x154], ebp
mov dword [esp + 0x16c], edx
mov dword [esp + 0x150], 0x1088000
mov dword [esp + 0x174], 0x837
mov dword [esp + 0x17c], 0x836
mov dword [esp + 0x168], ebp
mov dword [esp + 0x164], 0xe
mov dword [esp + 0xed8], 0x1f4
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov ecx, 0x17
lea esi, [esp + 0x1060]
lea edi, [esp + 0x33c]
push ebp
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x350], 0x2bc
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push 0x5a
push esi
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
lea ecx, [eax + eax*2]
mov eax, 0xc71c71c7
shl ecx, 2
imul ecx
sar edx, 4
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
mov dword [esp + 0x33c], edx
lea edx, [esp + 0x33c]
push edx
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
push esi
push ebp
mov dword [esp + 0x88], eax
call dword [sym.imp.USER32.dll_ReleaseDC]
lea eax, [esp + 0x170]
push str._install
push eax
mov dword [esp + 0xd4], ebp
mov dword [esp + 0xd8], ebp
mov dword [esp + 0xbc], ebp
call fcn.00406a81
add esp, 8
test eax, eax
je 0x401d42
lea ecx, [esp + 0x170]
push str._installquiet
push ecx
call fcn.00406a81
add esp, 8
test eax, eax
jne 0x401dd0
lea edx, [esp + 0x80]
push edx
call fcn.00403700
mov eax, dword [esp + 0xd8]
add esp, 4
cmp eax, ebp
je 0x401dd0
mov edi, dword [sym.imp.USER32.dll_FindWindowW]
push str.NVIDIA_TwinView_Window
push str.NVIDIA_TwinView_Window
xor esi, esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
test eax, eax
jne 0x401da1
cmp esi, 0x28
jae 0x401d9b
push 0x1f4
call ebx
push str.NVIDIA_TwinView_Window
push str.NVIDIA_TwinView_Window
inc esi
call edi
test eax, eax
je 0x401d7b
cmp esi, 0x28
je 0x401e77
push 1
call fcn.00402e10
add esp, 4
xor esi, esi
call dword [0x40fd14]
test eax, eax
jne 0x401dd6
cmp esi, 0xa
jae 0x401dd6
push 0x1f4
call ebx
inc esi
call dword [0x40fd14]
test eax, eax
je 0x401db7
jmp 0x401dd6
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x40fdd4], ebp
jne 0x401de8
push 1
call fcn.00402e10
add esp, 4
lea eax, [esp + 0x170]
push str._uninstall
push eax
call fcn.00406a81
add esp, 8
test eax, eax
je 0x401e95
cmp dword [0x40fdd4], ebp
jne 0x401e95
lea ecx, [esp + 0x170]
push str._install
push ecx
call fcn.00406a81
add esp, 8
test eax, eax
je 0x401e77
lea edx, [esp + 0x170]
push str._installquiet
push edx
call fcn.00406a81
add esp, 8
test eax, eax
je 0x401e77
mov ecx, dword [0x40fcdc]
lea eax, [esp + 0x4c4]
push 0xc8
push eax
push 0x7ef
push ecx
call dword [sym.imp.USER32.dll_LoadStringW]
push ebp
lea edx, [esp + 0x4c8]
push 0x40fd58
push edx
push ebp
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [0x40fcdc]
cmp eax, ebp
je 0x402d68
cmp eax, dword [0x40fd0c]
je 0x402d68
jmp 0x402d61
mov eax, dword [0x40fd14]
cmp eax, ebp
je 0x402d47
call eax
push str.nwiz.exe
push 1
push ebp
mov dword [esp + 0x6c], eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
mov dword [esp + 0x74], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x401f6d
lea eax, [esp + 0x170]
push str._uninstall
push eax
call fcn.00406a81
add esp, 8
test eax, eax
je 0x401f6d
lea ecx, [esp + 0x170]
push str._install
push ecx
call fcn.00406a81
add esp, 8
test eax, eax
je 0x401f3d
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [0x40fcdc]
lea edx, [esp + 0x4c4]
push 0xc8
push edx
push 0x7f2
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
push ebp
lea ecx, [esp + 0x4c8]
push 0x40fd58
push ecx
push ebp
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [0x40fcdc]
cmp eax, ebp
je 0x401f55
cmp eax, dword [0x40fd0c]
je 0x401f55
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebp
call fcn.00402e10
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x12cc
ret 0x10
cmp dword [0x40fcf0], 1
jne 0x401f83
mov dword [esp + 0xe0], 1
jmp 0x401fde
lea edx, [esp + 0x138]
lea eax, [esp + 0x10]
push edx
push eax
push ebp
push 0xf003f
push ebp
push ebp
push ebp
push str.SoftwareNVIDIA_CorporationGlobal_nViewInstalled
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x401fd7
mov ecx, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call edi
push str.SoftwareNVIDIA_CorporationGlobal_nViewInstalled
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [esp + 0xe0], 1
jmp 0x401fe4
mov dword [esp + 0xe0], ebp
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x1f4
call ebx
lea edx, [esp + 0x170]
push str._clear
push edx
call fcn.00406a81
add esp, 8
test eax, eax
jne 0x402089
lea eax, [esp + 0xcc0]
push eax
call fcn.00402d80
add esp, 4
lea ecx, [esp + 0x10]
push ecx
push 0xf003f
push ebp
push str.SoftwareNVIDIA_CorporationGlobal
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40205b
mov edx, dword [esp + 0x10]
push str.nView
push edx
call fcn.00403ee0
mov eax, dword [esp + 0x18]
add esp, 8
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov ecx, dword [esp + 0x10]
push ecx
call edi
mov eax, dword [0x40fcdc]
cmp eax, ebp
je 0x402073
cmp eax, dword [0x40fd0c]
je 0x402073
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x12cc
ret 0x10
lea edx, [esp + 0x170]
push str._uninstall
push edx
call fcn.00406a81
add esp, 8
test eax, eax
jne 0x4020ce
lea eax, [esp + 0xcc0]
push eax
call fcn.004057f0
push ebp
call fcn.00402e10
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x12cc
ret 0x10
lea ecx, [esp + 0x80]
push ebp
push ecx
call fcn.00403b20
lea edx, [esp + 0x178]
push str._install
push edx
mov dword [esp + 0xec], ebp
call fcn.00406a81
add esp, 0x10
test eax, eax
je 0x402119
lea eax, [esp + 0x170]
push str._installquiet
push eax
call fcn.00406a81
add esp, 8
test eax, eax
jne 0x402738
lea ecx, [esp + 0x1e8]
push str._nodetect
push ecx
mov dword [esp + 0x28], ebp
mov dword [esp + 0x30], ebp
mov dword [esp + 0x6c], ebp
call fcn.00406a81
add esp, 8
mov esi, 1
test eax, eax
jne 0x402147
mov dword [esp + 0x68], esi
lea edx, [esp + 0x260]
push str._nodetect
push edx
call fcn.00406a81
add esp, 8
test eax, eax
jne 0x402164
mov dword [esp + 0x68], esi
cmp dword [esp + 0xc0], ebp
je 0x402703
cmp dword [0x40fcf0], esi
jne 0x4021f7
lea eax, [esp + 0x1e8]
push str._noshell
push eax
call fcn.00406a81
add esp, 8
test eax, eax
je 0x4022c0
lea ecx, [esp + 0x260]
push str._noshell
push ecx
call fcn.00406a81
add esp, 8
test eax, eax
je 0x4022c0
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea edx, [esp + 0x10]
push edx
push 0x20019
push ebp
push str.CLSID1CDB2949_8F65_4355_8456_263E7C208A5D
push 0x80000000
call esi
test eax, eax
je 0x4021eb
lea eax, [esp + 0xcc0]
push eax
push 1
call fcn.00403a20
add esp, 8
jmp 0x4022c6
mov ecx, dword [esp + 0x10]
push ecx
call edi
jmp 0x4022c6
cmp dword [esp + 0xe0], ebp
je 0x4022c0
lea edx, [esp + 0x1e8]
push str._noshell
push edx
call fcn.00406a81
add esp, 8
test eax, eax
je 0x402274
lea eax, [esp + 0x260]
push str._noshell
push eax
call fcn.00406a81
add esp, 8
test eax, eax
je 0x402274
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [esp + 0x10]
push ecx
push 0x20019
push ebp
push str.CLSID1CDB2949_8F65_4355_8456_263E7C208A5D
push 0x80000000
call esi
test eax, eax
je 0x40226b
lea edx, [esp + 0xcc0]
push edx
push 1
call fcn.00403a20
add esp, 8
jmp 0x40227a
mov eax, dword [esp + 0x10]
push eax
call edi
jmp 0x40227a
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [esp + 0x10]
push ecx
push 0x20019
push ebp
push str.SoftwareMicrosoftWindowsCurrentVersionRun_nView
push 0x80000002
call esi
test eax, eax
jne 0x4022ac
mov edx, dword [esp + 0x10]
push str.NVIEW
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [esp + 0x10]
push eax
call edi
push str.SoftwareMicrosoftWindowsCurrentVersionRun_nView
push 0x80000001
call fcn.00403ee0
add esp, 8
jmp 0x4022c6
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [esp + 0x10]
mov edi, 4
push ecx
push 0xf003f
push ebp
push str.SOFTWARENVIDIA_CorporationGlobalNVTweak
push 0x80000001
mov dword [esp + 0x30], ebp
mov dword [esp + 0x80], edi
call esi
test eax, eax
jne 0x402342
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edx, [esp + 0x6c]
lea eax, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x7c]
push eax
push ecx
push ebp
push str.DesktopManager
push edx
call ebx
cmp dword [esp + 0x1c], ebp
je 0x402335
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x1c]
push edi
push eax
push edi
push ebp
push str.DesktopManager
push ecx
mov dword [esp + 0x34], ebp
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x402348
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x10]
push eax
push 0xf003f
push ebp
push str.SoftwareNVIDIA_CorporationGlobal_nViewInstalled
push 0x80000001
call esi
test eax, eax
jne 0x402370
mov dword [esp + 0x18], 1
jmp 0x402491
lea edx, [esp + 0x80]
push 1
push edx
call fcn.00403b20
mov eax, dword [esp + 0xc4]
add esp, 8
cmp eax, 1
ja 0x4023a1
cmp dword [esp + 0x68], ebp
jne 0x4023a1
mov dword [esp + 0x18], 1
jmp 0x40249c
lea eax, [esp + 0x7c]
lea ecx, [esp + 0x10]
push eax
push ecx
push ebp
push 0xf003f
push ebp
push ebp
push ebp
push str.SoftwareNVIDIA_CorporationGlobal_nViewInstalled
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4023d3
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x10]
push eax
push 0x20019
push ebp
push str.SoftwareNVIDIA_CorporationGlobal_nView
push 0x80000002
call esi
test eax, eax
jne 0x40249c
lea ecx, [esp + 0x14]
lea edx, [esp + 0x8d8]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x28]
push edx
push eax
push ebp
push str.InitProfile
push ecx
mov dword [esp + 0x2c], 0x208
call ebx
test eax, eax
jne 0x402425
mov dword [esp + 0x20], 1
lea edx, [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x28]
push eax
push ecx
push ebp
push str.CopyKeys
push edx
mov dword [esp + 0x34], ebp
mov dword [esp + 0x2c], edi
call ebx
test eax, eax
jne 0x40245b
cmp dword [esp + 0x1c], ebp
je 0x40245b
mov dword [esp + 0x28], 1
lea eax, [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x28]
push ecx
push edx
push ebp
push str.LoadModes
push eax
mov dword [esp + 0x34], ebp
mov dword [esp + 0x2c], edi
call ebx
test eax, eax
jne 0x402491
cmp dword [esp + 0x1c], ebp
je 0x402491
mov dword [esp + 0x64], 1
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x10]
push edx
push 0x20019
push ebp
push str.SoftwareNVIDIA_CorporationGlobal_nView
push 0x80000002
call esi
test eax, eax
jne 0x402509
mov ecx, dword [esp + 0x10]
push ebp
lea eax, [esp + 0x28]
push ebp
push eax
push ebp
push str.LoadAlways
push ecx
mov dword [esp + 0x2c], 0x208
call ebx
test eax, eax
jne 0x4024fe
lea edx, [esp + 0x14]
lea eax, [esp + 0x8d8]
push edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x28]
push eax
push ecx
push ebp
push str.LoadAlways
push edx
call ebx
mov dword [esp + 0x20], 1
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x20], ebp
je 0x402665
cmp dword [0x40fdd4], ebp
jne 0x40255e
mov edx, dword [0x40fcdc]
lea ecx, [esp + 0x4c4]
push 0xc8
push ecx
push 0x7ef
push edx
call dword [sym.imp.USER32.dll_LoadStringW]
push ebp
lea eax, [esp + 0x4c8]
push 0x40fd58
push eax
push ebp
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x12cc
ret 0x10
mov ebx, 1
call dword [0x40fd14]
test eax, eax
jne 0x4025a2
push 1
xor esi, esi
xor ebx, ebx
call dword [0x40fce8]
call dword [0x40fd14]
test eax, eax
jne 0x4025a2
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, 0xa
jae 0x4025a8
push 0x1f4
call edi
inc esi
call dword [0x40fd14]
test eax, eax
je 0x402589
jmp 0x4025a8
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x3e8
call edi
lea ecx, [esp + 0x6c]
lea edx, [esp + 0x7d8]
push ecx
push edx
push ebp
xor esi, esi
call dword [0x40fd1c]
test eax, eax
je 0x40265a
lea eax, [esp + 0x7d8]
lea ecx, [esp + 0x4c4]
push eax
push str._s.tvp
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
lea edx, [esp + 0x8e4]
push edx
call fcn.004069e9
add esp, 0x10
push eax
lea eax, [esp + 0x4c8]
push eax
call fcn.004069e9
add esp, 4
push eax
call fcn.00406a81
add esp, 8
test eax, eax
je 0x402631
lea ecx, [esp + 0x6c]
lea edx, [esp + 0x7d8]
inc esi
push ecx
push edx
push esi
call dword [0x40fd1c]
test eax, eax
jne 0x4025cd
jmp 0x40265a
cmp dword [esp + 0x64], ebp
je 0x402643
lea eax, [esp + 0x7d8]
push 0x11
push eax
jmp 0x40264d
lea ecx, [esp + 0x7d8]
push 0x10
push ecx
call dword [0x40fdc0]
push 0x1f4
call edi
cmp ebx, ebp
jne 0x402665
push ebp
call dword [0x40fce8]
cmp dword [esp + 0x28], ebp
je 0x402703
mov eax, dword [0x40fd14]
xor esi, esi
cmp eax, ebp
mov dword [esp + 0x20], ebp
je 0x402690
call eax
test eax, eax
je 0x402690
push ebp
call dword [0x40fce8]
mov esi, 1
lea edx, [esp + 0x7c]
lea eax, [esp + 0x20]
push edx
push eax
push ebp
push 0xf003f
push ebp
push ebp
push ebp
push str.SoftwareNVIDIA_CorporationGlobal_nView
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4026e8
push str.SHLWAPI
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, ebp
je 0x4026e8
push str.SHCopyKeyW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebp
je 0x4026e8
mov ecx, dword [esp + 0x20]
push ebp
push ecx
push str.SoftwareNVIDIA_CorporationGlobal_nView
push 0x80000002
call eax
mov eax, dword [esp + 0x20]
cmp eax, ebp
je 0x4026f7
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebp
je 0x402703
push 1
call dword [0x40fce8]
lea edx, [esp + 0x170]
push str._installquiet
push edx
call fcn.00406a81
mov ecx, dword [esp + 0x20]
add esp, 8
neg eax
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [esp + 0xdc], 1
sbb eax, eax
inc eax
or ecx, eax
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x60]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x18]
cmp eax, ebp
jne 0x402959
cmp dword [esp + 0xc0], ebp
jne 0x40275f
cmp dword [esp + 0x68], ebp
je 0x402959
cmp dword [0x40fdd4], ebp
jne 0x4027bd
push 1
call fcn.00402e10
mov eax, dword [0x40fdd4]
add esp, 4
cmp eax, ebp
jne 0x4027bd
mov edx, dword [0x40fcdc]
lea ecx, [esp + 0x4c4]
push 0xc8
push ecx
push 0x7ef
push edx
call dword [sym.imp.USER32.dll_LoadStringW]
push ebp
lea eax, [esp + 0x4c8]
push 0x40fd58
push eax
push ebp
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x12cc
ret 0x10
call dword [0x40fd14]
test eax, eax
jne 0x4027fb
cmp dword [esp + 0xc0], ebp
je 0x4027fb
push 1
xor esi, esi
call dword [0x40fce8]
call dword [0x40fd14]
test eax, eax
jne 0x4027fb
cmp esi, 0xa
jae 0x4027fb
push 0x1f4
call ebx
inc esi
call dword [0x40fd14]
test eax, eax
je 0x4027e4
lea ecx, [esp + 0x13c]
push ecx
call dword [sym.imp.COMCTL32.dll_PropertySheetW]
cmp dword [esp + 0x84], ebp
je 0x40283e
cmp dword [esp + 0xd0], ebp
jne 0x4028b6
cmp dword [esp + 0xcc], ebp
je 0x402847
cmp dword [esp + 0xc0], ebp
je 0x402847
push 0x10
push str.nvwiztmp
call dword [0x40fdc0]
cmp dword [esp + 0xd0], ebp
jne 0x4028b6
mov eax, dword [esp + 0xd4]
cmp eax, ebp
je 0x4028bd
cmp dword [esp + 0xdc], ebp
je 0x4028bd
mov eax, dword [0x40fcdc]
mov ebx, dword [sym.imp.USER32.dll_LoadStringW]
lea edx, [esp + 0x4c4]
push 0xff
push edx
push 0x7f6
push eax
call ebx
push 0x24
lea ecx, [esp + 0x4c8]
push str.NVIEW_WIZARD
push ecx
push ebp
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 7
jne 0x4028ad
lea edx, [esp + 0x80]
mov dword [esp + 0xc4], ebp
push edx
call fcn.004038a0
add esp, 4
mov eax, dword [esp + 0xd4]
jmp 0x4028c3
mov eax, dword [esp + 0xd4]
mov ebx, dword [sym.imp.USER32.dll_LoadStringW]
cmp dword [esp + 0xcc], ebp
je 0x4028e7
cmp dword [esp + 0xc0], ebp
je 0x4028e7
push str.nvwiztmp
call dword [0x40fd20]
mov eax, dword [esp + 0xd4]
cmp dword [esp + 0xdc], ebp
je 0x402935
cmp dword [esp + 0xd0], ebp
jne 0x40291a
mov ecx, dword [esp + 0xc4]
mov edx, dword [esp + 0x80]
neg eax
sbb eax, eax
push edx
and eax, ecx
mov dword [esp + 0x28], eax
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x40295f
mov edx, dword [esp + 0x80]
mov eax, dword [esp + 0xc4]
push edx
mov dword [esp + 0x28], eax
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x40295f
cmp dword [esp + 0xd0], ebp
je 0x402949
mov ecx, dword [esp + 0xc4]
mov dword [esp + 0x24], ecx
mov edx, dword [esp + 0x80]
push edx
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x40295f
mov ebx, dword [sym.imp.USER32.dll_LoadStringW]
cmp dword [esp + 0xec], ebp
je 0x402c28
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
cmp dword [esp + 0xa8], ebp
je 0x402a4a
lea eax, [esp + 0x28]
mov dword [esp + 0x64], ebp
push eax
push 0x20019
push ebp
push str.SoftwareMicrosoftInternet_Explorer
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4029fb
lea ecx, [esp + 0x60]
lea edx, [esp + 0x1c0]
push ecx
mov ecx, dword [esp + 0x2c]
lea eax, [esp + 0x7c]
push edx
push eax
push ebp
push str.Version
push ecx
mov dword [esp + 0x78], 0x28
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [esp + 0x28]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x64]
lea ecx, [esp + 0x1c0]
push eax
push 0x40eb38
push ecx
call fcn.00406ab6
mov eax, dword [esp + 0x70]
add esp, 0xc
cmp eax, 6
jae 0x402a4a
mov eax, dword [0x40fcdc]
lea edx, [esp + 0x2d8]
push 0x32
push edx
push 0x15f1
push eax
call ebx
mov edx, dword [0x40fcdc]
lea ecx, [esp + 0x8d8]
push 0x190
push ecx
push 0x15f2
push edx
call ebx
lea eax, [esp + 0x2d8]
push ebp
lea ecx, [esp + 0x8dc]
push eax
push ecx
push ebp
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x402c28
cmp dword [0x40fcf0], 3
jne 0x402a8f
mov edi, dword [sym.imp.USER32.dll_FindWindowExW]
push ebp
push str.32770
push ebp
push ebp
call edi
mov esi, eax
cmp esi, ebp
je 0x402a8f
push str.NVIDIA_Dualview
push 0x40e6ec
push ebp
push esi
call edi
test eax, eax
jne 0x402bb1
push ebp
push str.32770
push esi
push ebp
call edi
mov esi, eax
cmp esi, ebp
jne 0x402a69
mov ecx, dword [0x40fcdc]
lea eax, [esp + 0x8d8]
push 0x190
push eax
push 0x15f3
push ecx
call ebx
mov eax, dword [0x40fcdc]
lea edx, [esp + 0x2d8]
push 0x32
push edx
push 0x15f1
push eax
call ebx
lea ecx, [esp + 0x2d8]
push 0x34
lea edx, [esp + 0x8dc]
push ecx
push edx
push ebp
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x402c28
mov eax, dword [esp + 0xa8]
lea ecx, [esp + 0x18]
push ecx
push 2
mov dword [esp + 0x20], eax
call dword [0x40fd24]
mov esi, dword [sym.imp.USER32.dll_ExitWindowsEx]
push ebp
push ebp
call esi
test eax, eax
jne 0x402c19
mov eax, dword [0x40fcdc]
lea edx, [esp + 0x8d8]
push 0x190
push edx
push 0x15f4
push eax
call ebx
lea ecx, [esp + 0x2d8]
push 0x31
lea edx, [esp + 0x8dc]
push ecx
push edx
push ebp
call dword [sym.imp.USER32.dll_MessageBoxW]
mov edi, 1
cmp eax, edi
jne 0x402c10
cmp dword [0x40fcf0], edi
je 0x402ba6
lea eax, [esp + 0x60]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea ecx, [esp + 0x12c]
push ecx
push str.SeShutdownPrivilege
push ebp
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push ebp
push ebp
mov eax, dword [esp + 0x68]
lea edx, [esp + 0x130]
push ebp
push edx
push ebp
push eax
mov dword [esp + 0x140], edi
mov dword [esp + 0x14c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push ebp
push 2
call esi
mov dword [esp + 0x70], edi
jmp 0x402c21
mov eax, dword [0x40fcdc]
lea edx, [esp + 0x2d8]
push 0x32
push edx
push 0x15f1
push eax
call ebx
lea ecx, [esp + 0x8d8]
push str.Before_using_the_desktop_explorer_shell_extension__you_must_log_off_and_log_on_again_or_restart_your_system.
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 8
lea edx, [esp + 0x2d8]
lea eax, [esp + 0x8d8]
push ebp
push edx
push eax
push ebp
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [esp + 0xa8]
lea edx, [esp + 0x18]
mov dword [esp + 0x18], ecx
push edx
push 2
call dword [0x40fd24]
jmp 0x402c28
mov ecx, dword [esp + 0xe8]
jmp 0x402bfd
mov dword [esp + 0x70], 1
push ebp
call dword [sym.imp.USER32.dll_PostQuitMessage]
lea eax, [esp + 0x1e8]
push 0x40e5d0
push eax
call fcn.00406a81
add esp, 8
test eax, eax
je 0x402c5a
lea ecx, [esp + 0x260]
push 0x40e5d0
push ecx
call fcn.00406a81
add esp, 8
test eax, eax
jne 0x402c78
lea edx, [esp + 0x80]
mov esi, 1
push edx
mov dword [esp + 0xc8], esi
call fcn.004038a0
add esp, 4
jmp 0x402c7c
mov esi, dword [esp + 0x24]
cmp dword [esp + 0xc0], ebp
je 0x402ca6
cmp esi, ebp
je 0x402c95
call dword [0x40fd14]
test eax, eax
je 0x402c9f
jmp 0x402ca6
call dword [0x40fd14]
test eax, eax
je 0x402ca6
push esi
call dword [0x40fce8]
push ebp
call fcn.00402e10
mov eax, dword [0x40fcdc]
add esp, 4
cmp eax, ebp
je 0x402cc7
cmp eax, dword [0x40fd0c]
je 0x402cc7
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp dword [esp + 0x70], ebp
jne 0x402d68
mov cx, word [0x40e5cc]
lea edx, [esp + 0x170]
push ecx
push edx
call fcn.004069c0
add esp, 8
test eax, eax
je 0x402d68
lea eax, [esp + 0xcc0]
push 1
lea ecx, [esp + 0x1ec]
push eax
lea edx, [esp + 0x178]
push ecx
push edx
push str.open
push ebp
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x21
jae 0x402d68
push ebp
lea eax, [esp + 0x10c0]
push str.ERROR_in_executing_callback_at_end_of_wizard.
push eax
push ebp
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x12cc
ret 0x10
push ebp
call fcn.00402e10
mov eax, dword [0x40fcdc]
add esp, 4
cmp eax, ebp
je 0x402d68
cmp eax, dword [0x40fd0c]
je 0x402d68
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x12cc
ret 0x10