Function at 0x401000
Capabilities:
Copy file
Create process on windows
Delete file
Delete registry key
Delete registry value
Get common file path
Set registry value
Shutdown system

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2ab0
call fcn.00404150
and byte [ebp - 0x20b0], 0
push ebx
push esi
push edi
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x20af]
xor esi, esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x60
lea eax, [ebp - 0x2ab0]
push esi
push eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], esi
call sub.MSVCRT.dll_memset
and byte [ebp - 0x59c], 0
add esp, 0xc
xor eax, eax
lea edi, [ebp - 0x59b]
push 0x40
and byte [ebp - 0x10a8], 0
pop ecx
mov dword [ebp - 0x20], esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x201
xor eax, eax
lea edi, [ebp - 0x10a7]
push 0x1f
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, 0x408634
mov dword [ebp - 0x1c], esi
push edi
push 1
push dword [0x408c64]
call dword [sym.imp.USER32.dll_LoadStringA]
test eax, eax
jne 0x4010a6
push str.Install
push edi
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
call fcn.0040409d
cmp eax, esi
mov dword [ebp - 0x34], eax
jne 0x4010c6
push 0x30
push edi
push str.You_need_to_have_Administrator_privileges_on_your_computer_to_install_Comet_Cursor_3.0._Please_contact_your_Systems_Administrator.
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x401de1
push str.Comet_Systems_UnLoad_Platform
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00403ee6
push esi
mov dword [0x4072e8], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp eax, esi
mov dword [0x408c64], eax
jne 0x40110f
push esi
push 1
push str.Error_in_GetModuleHandle
call fcn.00401dea
add esp, 0xc
mov esi, 0x103
lea eax, [ebp - 0x59c]
push esi
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x59c]
mov edi, 0x408530
push eax
push edi
call sub.MSVCRT.dll_strcpy
push 0x5c
push edi
call dword [sym.imp.MSVCRT.dll_strrchr]
and byte [eax + 1], 0
add esp, 0x10
push esi
push 0x408224
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov ebx, 0x4066b4
push ebx
push 0x408224
call sub.MSVCRT.dll_strcat
pop ecx
pop ecx
push esi
mov esi, 0x408328
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push ebx
push esi
call sub.MSVCRT.dll_strcat
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
pop ecx
pop ecx
mov ebx, str._s_s
push str.Comet
push 0x408224
push ebx
push 0x40842c
call esi
push str.csbho.dll
push 0x406dd8
call sub.MSVCRT.dll_strcpy
push str.cscore.dll
push 0x406f1c
call sub.MSVCRT.dll_strcpy
push str.comet.exe
push 0x407060
call sub.MSVCRT.dll_strcpy
push str.CC_Conv.inf
push 0x4071a4
call sub.MSVCRT.dll_strcpy
add esp, 0x30
push str.CC_Conv.inf
push edi
push ebx
push 0x4071e4
call esi
push str.cseng.dll
push 0x4072f0
call sub.MSVCRT.dll_strcpy
add esp, 0x18
push str.cseng.dll
push edi
push ebx
push 0x407330
call esi
push str.csip.dll
push 0x407434
call sub.MSVCRT.dll_strcpy
add esp, 0x18
push str.csip.dll
push edi
push ebx
push 0x407474
call esi
push str.skinui.dll
push 0x407578
call sub.MSVCRT.dll_strcpy
add esp, 0x18
push str.skinui.dll
push edi
push ebx
push 0x4075b8
call esi
push str.csctb.dll
push 0x4076bc
call sub.MSVCRT.dll_strcpy
add esp, 0x18
push str.csctb.dll
push edi
push ebx
push 0x4076fc
call esi
push str.csietb.dll
push 0x407800
call sub.MSVCRT.dll_strcpy
add esp, 0x18
push str.csietb.dll
push edi
push ebx
push 0x407840
call esi
add esp, 0x10
push str.csbho.dll
push edi
push ebx
push 0x406e18
call esi
add esp, 0x10
push str.cscore.dll
push edi
push ebx
push 0x406f5c
call esi
add esp, 0x10
push str.comet.exe
push edi
push ebx
push 0x4070a0
call esi
add esp, 0x10
lea eax, [ebp - 0x3c]
mov edi, 0x20019
push eax
push edi
push 0
push str.SoftwareCometSystems
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40130f
push 0x2f
mov esi, str.You_currently_have_a_earlier_beta_version_of_Comet_Cursor_3.0_r_nClose_your_browser_and_all_Explorer_windows__use__Add_Remove_Programs__to_uninstall._r_nThen_return_to_this_page_to_re_install.
pop ecx
lea edi, [ebp - 0x10c]
rep movsd dword es:[edi], dword [esi]
push 0x10
lea eax, [ebp - 0x10c]
push 0x408634
push eax
push 0
movsb byte es:[edi], byte [esi]
call dword [sym.imp.USER32.dll_MessageBoxA]
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x401de1
lea eax, [ebp - 0x30]
push eax
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call edi
test eax, eax
jne 0x401388
lea eax, [ebp - 4]
push eax
push 2
push 0
push str.RunOnce
push dword [ebp - 0x30]
call edi
test eax, eax
jne 0x401352
push str.CCclean
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x401376
lea eax, [ebp - 4]
push eax
push 2
push 0
push str.RunOnceEx
push dword [ebp - 0x30]
call edi
test eax, eax
jne 0x40137f
push str.CCUp
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00402e9b
cmp eax, 3
mov dword [ebp - 0x38], eax
jne 0x4013a6
push 0
push 1
push str.NoncompatibleOS
call fcn.00401dea
add esp, 0xc
lea eax, [ebp - 0x20b0]
push 0x7ff
push eax
call fcn.00401f3c
pop ecx
test eax, eax
pop ecx
jne 0x4013cf
push eax
lea eax, [ebp - 0x20b0]
push 1
push eax
call fcn.00401dea
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00402013
add esp, 0xc
cmp dword [ebp - 0x14], 0
jne 0x4013ef
cmp dword [ebp - 0x18], 0
je 0x401456
cmp dword [ebp - 0x14], 0
mov dword [0x408a54], 1
je 0x401456
lea eax, [ebp - 0xc]
push eax
push 0x20006
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects
push 0x80000002
call edi
test eax, eax
je 0x40144d
cmp eax, 2
jne 0x401436
lea eax, [ebp - 0xc]
push eax
push 0x20006
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorer
push 0x80000002
call edi
test eax, eax
je 0x40144d
push 0
push 1
push str.You_need_to_have_Administrator_privileges_on_your_computer_to_install_Comet_Cursor_3.0._Please_contact_your_Systems_Administrator.
call fcn.00401dea
add esp, 0xc
jmp 0x401456
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and byte [ebp - 0x8a0], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x89f]
cmp dword [ebp - 0x24], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
je 0x4014e0
lea eax, [ebp - 0x8a0]
push 0x104
push eax
call fcn.004034f5
pop ecx
test eax, eax
pop ecx
jne 0x4014e0
lea eax, [ebp - 0x10a8]
push 0x807
push eax
push 0xd
push dword [0x408c64]
call dword [sym.imp.USER32.dll_LoadStringA]
test eax, eax
jne 0x4014bb
lea eax, [ebp - 0x10a8]
push str.Error_loading_string
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
push 0x10
lea eax, [ebp - 0x10a8]
push 0x408634
xor edi, edi
push eax
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
push edi
push 1
push edi
call fcn.00401dea
add esp, 0xc
jmp 0x4014e2
xor edi, edi
call fcn.0040344d
cmp eax, edi
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], edi
jne 0x4014f7
push 3
pop eax
mov dword [ebp - 0x2c], eax
cmp eax, 2
jne 0x401537
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 1
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x2ab0]
push eax
call fcn.00403128
add esp, 0xc
cmp dword [ebp - 0x20], edi
mov dword [ebp - 0x28], eax
jle 0x401537
cmp dword [ebp - 0x34], edi
jne 0x401537
push edi
push 1
push str.You_need_to_have_Administrator_privileges_on_your_computer_to_install_Comet_Cursor_3.0._Please_contact_your_Systems_Administrator.
call fcn.00401dea
add esp, 0xc
and byte [ebp - 0x18b0], 0
mov ecx, 0x201
xor eax, eax
lea edi, [ebp - 0x18af]
rep stosd dword es:[edi], eax
cmp dword [0x4072e8], 1
stosw word es:[edi], ax
stosb byte es:[edi], al
je 0x40162d
cmp dword [ebp - 0x28], 0
je 0x40162d
mov edi, 0x808
lea eax, [ebp - 0x18b0]
push edi
push eax
push 4
push dword [0x408c64]
call dword [sym.imp.USER32.dll_LoadStringA]
test eax, eax
jne 0x401599
lea eax, [ebp - 0x18b0]
push str.Error_loading_string
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
push dword [ebp - 0x20]
lea eax, [ebp - 0x18b0]
push eax
lea eax, [ebp - 0x10a8]
push str._s__d
push eax
call esi
push edi
lea eax, [ebp - 0x18b0]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0x1c
lea eax, [ebp - 0x18b0]
push edi
push eax
push 5
push dword [0x408c64]
call dword [sym.imp.USER32.dll_LoadStringA]
test eax, eax
jne 0x4015f0
lea eax, [ebp - 0x18b0]
push str.Error_loading_string
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
lea eax, [ebp - 0x18b0]
push eax
lea eax, [ebp - 0x10a8]
push eax
call sub.MSVCRT.dll_strcat
pop ecx
lea eax, [ebp - 0x10a8]
pop ecx
xor edi, edi
push 0x21
push 0x408634
push eax
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 2
jne 0x40162d
push edi
push 1
push edi
call fcn.00401dea
add esp, 0xc
xor edi, edi
cmp dword [ebp - 0x24], edi
je 0x4016c3
lea eax, [ebp - 0x8a0]
push eax
call fcn.00402ef1
cmp eax, edi
pop ecx
je 0x4016c3
cmp eax, 1
jne 0x401657
push edi
push eax
push str.UninstallMCC
jmp 0x4016bb
cmp eax, 3
jne 0x4016b7
push 0x808
lea eax, [ebp - 0x10a8]
push edi
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x10a8]
push 0x807
push eax
push 0xa
push dword [0x408c64]
call dword [sym.imp.USER32.dll_LoadStringA]
test eax, eax
jne 0x4016a2
lea eax, [ebp - 0x10a8]
push str.Error_loading_string
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
push 0x11
lea eax, [ebp - 0x10a8]
push 0x408634
push eax
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
push edi
push 1
push edi
call fcn.00401dea
add esp, 0xc
cmp dword [ebp - 0x18], edi
je 0x4016d3
call fcn.00403641
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x20b0]
push 0x7ff
push eax
push dword [ebp - 0x10]
call fcn.00402421
add esp, 0xc
test eax, eax
jne 0x401700
push edi
lea eax, [ebp - 0x20b0]
push 1
push eax
call fcn.00401dea
add esp, 0xc
cmp dword [ebp - 0x14], edi
je 0x40175a
and byte [ebp - 0x298], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x297]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.00403b10
call fcn.00402d3d
push str.comet.dll
push 0x408224
lea eax, [ebp - 0x298]
push ebx
push eax
call esi
lea eax, [ebp - 0x298]
push eax
call fcn.00402caf
add esp, 0x14
test eax, eax
jne 0x401756
mov dword [ebp - 0x10], 1
jmp 0x40175a
and dword [ebp - 0x14], 0
push 1
xor ebx, ebx
cmp dword [ebp - 0x1c], ebx
pop edi
mov dword [ebp - 0xc], edi
jne 0x401aed
push str.CleanInstall
call fcn.004037c8
test eax, eax
pop ecx
jne 0x40178f
push str.You_need_to_have_Administrator_privileges_on_your_computer_to_install_Comet_Cursor_3.0._Please_contact_your_Systems_Administrator.
call fcn.004033a0
push ebx
push edi
push ebx
call fcn.00401dea
add esp, 0x10
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
and byte [ebp - 0x150], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x14f]
push 0x406f5c
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x150]
mov dword [ebp - 4], ebx
push eax
call sub.MSVCRT.dll_strcpy
cmp dword [ebp - 0x2c], 1
pop ecx
pop ecx
mov dword [ebp - 8], 7
jne 0x4017d7
mov dword [ebp - 8], 6
mov ebx, 0x406430
mov edi, str._s_s_s
inc dword [ebp - 4]
lea eax, [ebp - 0x150]
push 1
push eax
call fcn.00402c69
pop ecx
test eax, eax
pop ecx
jne 0x401830
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x20b0]
push str.Error_registering__s_t_d
push eax
call esi
add esp, 0x10
call dword [sym.imp.ole32.dll_CoUninitialize]
push 0
lea eax, [ebp - 0x20b0]
push 1
push eax
call fcn.00401dea
add esp, 0xc
mov eax, dword [ebp - 4]
cmp eax, 1
jne 0x40184d
lea eax, [ebp - 0x150]
push 0x406e18
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
jmp 0x40189a
cmp eax, 2
jne 0x401859
push str.cseng.dll
jmp 0x401887
cmp eax, 3
jne 0x401865
push str.csip.dll
jmp 0x401887
cmp eax, 4
jne 0x401871
push str.skinui.dll
jmp 0x401887
cmp eax, 5
jne 0x40187d
push str.csctb.dll
jmp 0x401887
cmp eax, 6
jne 0x40189a
push str.csietb.dll
push ebx
push 0x40842c
lea eax, [ebp - 0x150]
push edi
push eax
call esi
add esp, 0x14
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jl 0x4017e1
cmp dword [ebp - 0x28], 0
je 0x4018d1
push dword [ebp - 0x10]
lea eax, [ebp - 0x2ab0]
push dword [ebp - 0x20]
push eax
call fcn.004038be
add esp, 0xc
test eax, eax
jne 0x4018d1
push eax
push 1
push eax
call fcn.00401dea
add esp, 0xc
call dword [sym.imp.ole32.dll_CoUninitialize]
cmp dword [0x408a54], 0
je 0x401925
lea eax, [ebp - 8]
push eax
push 2
push 0
push str.SoftwareComet_SystemsCoreInstallInfo
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401925
mov edi, 0x408654
push edi
call sub.MSVCRT.dll_strlen
pop ecx
push eax
push edi
push 1
push 0
push str.Value2
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and byte [ebp - 0x298], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x297]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x298]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x401972
lea eax, [ebp - 0x298]
push str.CSLog.txt
push eax
call sub.MSVCRT.dll_strcat
pop ecx
lea eax, [ebp - 0x298]
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [ebp - 0x2c], 1
jne 0x4019bf
lea eax, [ebp - 8]
push eax
push 2
push 0
push str.SoftwareComet_SystemsIEToolbar
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4019bf
mov ax, word [0x4063a8]
push 2
mov word [ebp - 2], ax
lea eax, [ebp - 2]
push eax
push 1
push 0
push str.initialDisplay
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x4072e8], 1
je 0x401aeb
and dword [ebp - 0x194], 0
push 0x10
pop ecx
xor eax, eax
and dword [ebp - 0x4c], eax
lea edi, [ebp - 0x190]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x48]
and byte [ebp - 0x39c], 0
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x39b]
rep stosd dword es:[edi], eax
and byte [ebp - 0x6a0], 0
push 0x40
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x69f]
push ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40842c
lea eax, [ebp - 0x6a0]
push 0x406390
push eax
call esi
lea eax, [ebp - 0x39c]
push 0x4070a0
push eax
call sub.MSVCRT.dll_strcpy
add esp, 0x18
lea eax, [ebp - 0x4c]
lea ecx, [ebp - 0x39c]
mov dword [ebp - 0x194], 0x44
push eax
lea eax, [ebp - 0x194]
push eax
lea eax, [ebp - 0x6a0]
push eax
xor eax, eax
push eax
push eax
push 1
push eax
push eax
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push dword [ebp - 0x48]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x4c]
call edi
lea eax, [ebp - 8]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objectsc900b400_cdfe_11d3_976a_00e02913a9e0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x401aeb
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and byte [ebp - 0x24b0], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x24af]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x24b0]
push 0x400
push eax
push 0xe
push dword [0x408c64]
call dword [sym.imp.USER32.dll_LoadStringA]
push 0x30
lea eax, [ebp - 0x24b0]
push 0x408634
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor ebx, ebx
cmp dword [ebp - 0x10], ebx
je 0x401dc1
lea eax, [ebp - 4]
push eax
call fcn.00403a3b
cmp eax, 2
pop ecx
mov dword [ebp - 8], eax
jne 0x401b18
push ebx
push 1
push str.Error_Checking_for_RunOnce
call fcn.00401dea
add esp, 0xc
and byte [ebp - 0x79c], 0
push 0x7f
pop ecx
xor eax, eax
lea edi, [ebp - 0x79b]
and byte [ebp - 0x498], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x7f
xor eax, eax
pop ecx
lea edi, [ebp - 0x497]
rep stosd dword es:[edi], eax
cmp dword [ebp - 8], 1
stosw word es:[edi], ax
stosb byte es:[edi], al
jne 0x401b5f
lea eax, [ebp - 0x79c]
push 0x4062fc
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
cmp dword [ebp - 0x14], ebx
je 0x401bbb
lea eax, [ebp - 0x79c]
push 0x4071e4
push eax
lea eax, [ebp - 0x498]
push str._sRundll32.exe_advpack.dll_LaunchINFSection__s_Unins.Comet
push eax
call esi
lea eax, [ebp - 0x498]
push eax
call sub.MSVCRT.dll_strlen
add esp, 0x14
inc eax
push eax
lea eax, [ebp - 0x498]
push eax
push 1
push ebx
push str.CometA
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x401bbb
push ebx
push 1
push str.Error_creating_UninsCC_RunOnce
call fcn.00401dea
add esp, 0xc
cmp dword [ebp - 0x18], ebx
je 0x401cb8
cmp dword [ebp - 0x1c], ebx
je 0x401cb8
and byte [ebp - 0x14c], 0
push 0x3f
pop ecx
xor eax, eax
lea edi, [ebp - 0x14b]
push str.instshop.exe
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push str.Install
push 0x40842c
lea eax, [ebp - 0x498]
push str._s_s_s
push eax
call esi
add esp, 0x14
lea eax, [ebp - 0x498]
push ebx
push eax
lea eax, [ebp - 0x59c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea eax, [ebp - 0x498]
push eax
lea eax, [ebp - 0x79c]
push eax
lea eax, [ebp - 0x14c]
push str._s_s__reboot
push eax
call esi
lea eax, [ebp - 0x14c]
push eax
call sub.MSVCRT.dll_strlen
add esp, 0x14
inc eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push eax
lea eax, [ebp - 0x14c]
push eax
push 1
push ebx
push str.CometC
push dword [ebp - 4]
call edi
push str.CC_Conv.inf
lea eax, [ebp - 0x79c]
push 0x408328
push eax
lea eax, [ebp - 0x498]
push str._sRundll32.exe_advpack.dll_LaunchINFSection__sinf_s_CleanRebootInstall
push eax
call esi
lea eax, [ebp - 0x498]
push eax
call sub.MSVCRT.dll_strlen
add esp, 0x18
inc eax
push eax
lea eax, [ebp - 0x498]
push eax
push 1
push ebx
push str.CometD
push dword [ebp - 4]
call edi
test eax, eax
je 0x401cb8
push ebx
push 1
push str.Error_creating_Clean_RunOnce
call fcn.00401dea
add esp, 0xc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x14], ebx
je 0x401cd8
cmp dword [ebp - 0x18], ebx
je 0x401cd0
cmp dword [ebp - 0x1c], ebx
jne 0x401cd8
mov dword [ebp - 0x10], ebx
jmp 0x401dc1
cmp dword [ebp - 0x38], 1
je 0x401ce4
cmp dword [ebp - 0x38], 2
jne 0x401cec
call fcn.004033c7
mov dword [ebp - 0xc], eax
mov esi, 0x808
lea eax, [ebp - 0x10a8]
push esi
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
cmp dword [ebp - 0xc], ebx
je 0x401d5a
lea eax, [ebp - 0x10a8]
push 0x807
push eax
push 0xb
push dword [0x408c64]
call dword [sym.imp.USER32.dll_LoadStringA]
test eax, eax
jne 0x401d38
lea eax, [ebp - 0x10a8]
push str.Error_loading_string
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
push 0x21
lea eax, [ebp - 0x10a8]
push 0x408634
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 2
jne 0x401d55
mov dword [ebp - 0xc], ebx
cmp dword [ebp - 0xc], ebx
jne 0x401dc1
push esi
lea eax, [ebp - 0x10a8]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x10a8]
push 0x807
push eax
push 0xc
push dword [0x408c64]
call dword [sym.imp.USER32.dll_LoadStringA]
test eax, eax
jne 0x401d9c
lea eax, [ebp - 0x10a8]
push str.Error_loading_string
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
push 0x30
lea eax, [ebp - 0x10a8]
push 0x408634
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp dword [ebp - 0x18], ebx
jne 0x401dc1
push str.Register.BHOCLSID
call fcn.004037c8
pop ecx
push dword [ebp - 0x10]
push ebx
push ebx
call fcn.00401dea
add esp, 0xc
cmp dword [ebp - 0x10], ebx
je 0x401de1
cmp dword [ebp - 0xc], ebx
je 0x401de1
push ebx
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10