Function at 0x40cae0
Capabilities:
Check if file exists
Check os version
Copy file
Create process on windows
Delete registry value
Get common file path
Get file attributes
Persist via run registry key
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ac873
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x12d8
call fcn.0057ed50
push ebx
push esi
push edi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x40], esi
mov dword [ebp - 4], ebx
call fcn.00433b30
call fcn.00433d00
mov ecx, esi
call fcn.0040ac90
mov ecx, esi
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x90], ebx
call fcn.0040bb70
mov ecx, esi
call fcn.0040c420
lea eax, [ebp - 0x19c]
xor edi, edi
push eax
mov dword [ebp - 0x84], 1
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x19c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x40cbaa
cmp dword [ebp - 0x18c], 2
jne 0x40cbaa
mov eax, dword [ebp - 0x198]
mov edi, 1
cmp eax, 6
mov dword [ebp - 0x34], edi
jb 0x40cbaa
push reloc.WSOCK32.dll_accept
mov dword [ebp - 0x7c], edi
call fcn.0040c6f0
add esp, 4
push reloc.WSOCK32.dll_bind
call fcn.0040c6f0
add esp, 4
cmp edi, ebx
mov dword [ebp - 0x74], 4
je 0x40cc1f
mov eax, dword [0x67a040]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [ebp - 0x74]
lea edx, [ebp - 0x64]
push ecx
push edx
push ebx
push ebx
push str.EnableDriver
push eax
call edi
test eax, eax
jne 0x40cbdc
mov ecx, dword [ebp - 0x64]
mov dword [esi + 0x1c], ecx
mov ecx, dword [0x67a040]
lea edx, [ebp - 0x74]
lea eax, [ebp - 0x64]
push edx
push eax
push ebx
push ebx
push str.AdvancedIntegration
push ecx
call edi
test eax, eax
jne 0x40cc6a
cmp dword [ebp - 0x64], ebx
je 0x40cc6a
lea edx, [ebp - 0x84]
lea eax, [ebp - 0x88]
push edx
push eax
lea ecx, [esi + 4]
call fcn.00409e20
xor ecx, ecx
cmp eax, ebx
sete cl
mov dword [ebp - 0x3c], ecx
jmp 0x40cc6a
mov ecx, dword [0x67a040]
lea edx, [ebp - 0x74]
lea eax, [ebp - 0x64]
push edx
push eax
push ebx
push ebx
push str.AdvancedIntegration
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40cc45
mov edx, dword [ebp - 0x64]
mov dword [esi + 0x1c], edx
cmp dword [esi + 0x1c], ebx
je 0x40cc6a
lea eax, [ebp - 0x84]
lea ecx, [ebp - 0x88]
push eax
push ecx
lea ecx, [esi + 4]
call fcn.00409e20
xor edx, edx
cmp eax, ebx
sete dl
mov dword [ebp - 0x3c], edx
mov ecx, dword [ebp - 0x84]
xor eax, eax
cmp ecx, ebx
sete al
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x34]
cmp eax, ebx
je 0x40cd7c
lea ecx, [ebp - 0x1c]
mov edi, 1
push ecx
push 0x20019
push ebx
push 0x64ee68
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40ccdc
mov ecx, dword [ebp - 0x1c]
lea edx, [ebp - 0x74]
lea eax, [ebp - 0x64]
push edx
push eax
push ebx
push ebx
push str.AdvIntDriverEnabled2
push ecx
mov dword [ebp - 0x74], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40ccd2
mov edi, dword [ebp - 0x64]
mov dword [esi + 0x1c], edi
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esi + 0x1c], ebx
jne 0x40cd38
mov edx, dword [0x67a040]
lea eax, [ebp - 0x74]
lea ecx, [ebp - 0x64]
push eax
push ecx
push ebx
push ebx
push str.bVistaAdvInt
push edx
mov dword [ebp - 0x74], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x40cd30
mov eax, 1
push 4
mov dword [esi + 0x1c], eax
mov ecx, dword [0x67a040]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x38]
push eax
push 4
push ebx
push str.bVistaAdvInt
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x40cd33
mov dword [esi + 0x1c], edi
cmp dword [esi + 0x1c], ebx
je 0x40cd7c
lea edx, [ebp - 0x38]
mov ecx, esi
push edx
call fcn.0040e730
mov edi, dword [ebp - 0x38]
xor ecx, ecx
cmp eax, ebx
lea eax, [ebp - 0x18]
sete cl
push 4
xor edx, edx
push eax
mov dword [ebp - 0x14], ecx
mov ecx, dword [0x67a040]
cmp edi, ebx
push 4
push ebx
sete dl
push str.EnableDriver
push ecx
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x18], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp dword [ebp - 0x78], ebx
jne 0x40cd8a
cmp dword [ebp - 0x54], ebx
je 0x40cf9b
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x50], 1
call fcn.004be2e0
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.004bea30
cmp eax, ebx
jne 0x40cf33
lea ecx, [ebp - 0x18]
call fcn.004be320
lea ecx, [ebp - 0x18]
call fcn.004be980
lea ecx, [ebp - 0x18]
call fcn.004bec00
mov byte [ebp - 0x21], 1
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x58], ebx
mov word [ebp - 0x5c], bx
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.00413760
lea edx, [ebp - 0x38]
lea eax, [ebp - 0x60]
push edx
push eax
mov ecx, esi
call fcn.00412d30
cmp eax, ebx
je 0x40ce5d
mov eax, dword [ebp - 0x38]
cmp eax, 1
je 0x40ce59
cmp ebx, dword [esi + 0x28]
jge 0x40ce5d
mov ecx, dword [esi + 0x24]
mov edx, dword [ecx + ebx*4]
cmp eax, dword [edx + 8]
jne 0x40cf15
xor edi, edi
mov eax, dword [esi + 0x24]
mov eax, dword [eax + ebx*4]
cmp edi, dword [eax + 0x1c]
jge 0x40ce5d
mov ecx, dword [ebp - 0x60]
test ecx, ecx
jne 0x40ce27
lea ecx, [ebp - 0x5c]
mov edx, dword [eax + 0x18]
lea esi, [edi + edi*8]
shl esi, 2
push ecx
mov eax, dword [edx + esi]
push eax
call fcn.00580edc
add esp, 8
test eax, eax
jne 0x40cf0c
mov eax, dword [ebp - 0x40]
mov ecx, dword [eax + 0x24]
mov edx, dword [ecx + ebx*4]
mov eax, dword [edx + 0x18]
mov ecx, dword [eax + esi + 8]
test ecx, ecx
je 0x40ce5d
mov byte [ebp - 0x21], 0
mov al, byte [ebp - 0x21]
xor ebx, ebx
xor edi, edi
test al, al
je 0x40cec9
cmp dword [ebp - 0x34], ebx
jne 0x40cec9
mov ecx, dword [0x6754cc]
mov dword [ebp - 0x1c], ecx
mov edx, dword [0x67a8dc]
mov eax, dword [0x67aa4c]
push edx
push eax
lea ecx, [ebp - 0x1c]
push str._s_r_n_r_n_s
push ecx
mov byte [ebp - 4], 3
call fcn.00593b08
mov edx, dword [0x67aa88]
mov eax, dword [ebp - 0x1c]
add esp, 0x10
push 0x50004
push edx
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x40ceb9
mov edi, 1
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.0059ad3d
cmp edi, ebx
jne 0x40cf1b
mov eax, dword [ebp - 0x34]
mov esi, dword [ebp - 0x40]
cmp eax, ebx
mov dword [ebp - 0x50], ebx
jne 0x40cef7
lea ecx, [ebp - 0x1c]
push 4
push ecx
mov dword [esi + 0x1c], ebx
mov edx, dword [0x67a040]
push 4
push ebx
push str.AdvancedIntegration
push edx
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 1
mov ecx, esi
call fcn.004128a0
mov dword [0x679a5c], 1
jmp 0x40cf25
mov esi, dword [ebp - 0x40]
inc edi
jmp 0x40ce12
inc ebx
jmp 0x40cdfc
mov esi, dword [ebp - 0x40]
mov ecx, esi
call fcn.00416100
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 1
call fcn.00401070
xor ebx, ebx
cmp dword [esi + 0x1c], ebx
je 0x40cf8f
cmp dword [ebp - 0x34], ebx
jne 0x40cf8f
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x38]
push eax
push ecx
push 1
lea ecx, [ebp - 0x18]
call fcn.004bea70
mov ecx, dword [0x67a040]
mov edx, dword [ebp - 0x38]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea eax, [ebp - 0x1c]
push 4
push eax
push 4
push ebx
push str.ClChIDMRes
push ecx
mov dword [ebp - 0x1c], edx
call edi
mov ecx, dword [0x67a040]
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
push 4
push eax
push 4
push ebx
push str.ClChIERes
push ecx
mov dword [ebp - 0x1c], edx
call edi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0
call fcn.004be310
mov eax, dword [esi + 0x1c]
mov edi, dword [ebp - 0x34]
cmp eax, ebx
je 0x40d50a
cmp dword [ebp - 0x3c], ebx
jne 0x40d0c6
cmp dword [ebp - 0x54], ebx
jne 0x40d0c6
cmp edi, ebx
jne 0x40d4f0
lea edx, [ebp - 0x2a0]
push 0x104
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x40d0ad
mov eax, dword [0x6754cc]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x2a0]
push str.idmmbc.dll
push ecx
lea edx, [ebp - 0x14]
push 0x64fa04
push edx
mov byte [ebp - 4], 8
call fcn.00593b08
mov eax, dword [ebp - 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
add esp, 0x10
push eax
call edi
cmp eax, 0xffffffff
jne 0x40d09e
lea ecx, [ebp - 0x2a0]
push 0x104
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x40d09e
lea edx, [ebp - 0x5a0]
lea eax, [ebp - 0x4a0]
push edx
lea ecx, [ebp - 0x3a0]
push eax
lea edx, [ebp - 0x18]
push ecx
lea eax, [ebp - 0x2a0]
push edx
push eax
call fcn.0057f33c
add esp, 0x14
lea ecx, [ebp - 0x3a0]
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x2a0]
push str.idmmbc.dll
push ecx
push edx
push 0x64f9cc
push eax
call fcn.0057f2ea
add esp, 0x14
lea ecx, [ebp - 0x2a0]
push ecx
call edi
cmp eax, 0xffffffff
je 0x40d09e
mov edx, dword [ebp - 0x14]
push ebx
lea eax, [ebp - 0x2a0]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0
call fcn.0059ad3d
mov edi, dword [ebp - 0x34]
cmp dword [ebp - 0x88], ebx
je 0x40d50e
lea ecx, [esi + 4]
call fcn.0040a350
jmp 0x40d50e
mov eax, dword [0x67a040]
lea ecx, [ebp - 0x20]
lea edx, [ebp - 0x8c]
push ecx
push edx
push ebx
push ebx
push str.lastintres
push eax
mov dword [ebp - 0x20], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40d12d
cmp dword [ebp - 0x8c], 1
jne 0x40d12d
cmp edi, ebx
jne 0x40d12d
mov eax, dword [ebp - 0x78]
cmp eax, ebx
mov eax, 0x67aa9c
jne 0x40d10d
mov eax, 0x67aa98
mov ecx, dword [0x67aaa4]
mov eax, dword [eax]
push 0x50004
push ecx
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
je 0x40d12d
mov dword [ebp - 0x3c], ebx
jmp 0x40d132
cmp dword [ebp - 0x3c], ebx
jne 0x40d13b
cmp dword [ebp - 0x54], ebx
je 0x40d4ec
cmp edi, ebx
mov dword [ebp - 0x18], ebx
je 0x40d480
cmp dword [ebp - 0x54], ebx
je 0x40d4ae
mov ecx, esi
call fcn.00411480
cmp dword [ebp - 0x7c], ebx
jne 0x40d194
push 1
mov ecx, esi
call fcn.0040e880
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
cmp eax, ebx
mov dword [0x679a58], 1
mov ecx, esi
je 0x40d187
call fcn.0040e080
mov dword [ebp - 0x14], ebx
jmp 0x40d494
call fcn.0040dfc0
mov dword [ebp - 0x14], ebx
jmp 0x40d494
xor edx, edx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x30], edx
mov word [ebp - 0x2c], bx
mov edi, dword [0x679ff8]
mov byte [ebp - 4], 4
cmp edi, ebx
jne 0x40d1b3
mov edi, 0x679ffc
mov eax, 0x64f028
test eax, eax
je 0x40d2d7
cmp edi, ebx
je 0x40d2d7
mov ecx, str.Uninstall.exe
test ecx, ecx
je 0x40d2d7
push ebx
push eax
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x44], ebx
mov word [ebp - 0x48], bx
call fcn.004028d0
push edi
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 5
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x68], ebx
mov word [ebp - 0x6c], bx
call fcn.00401fb0
push str.Uninstall.exe
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 6
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x58], ebx
mov word [ebp - 0x5c], bx
call fcn.00401fb0
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 7
call fcn.00401070
mov edi, dword [ebp - 0x44]
lea ecx, [ebp - 0x60]
call fcn.00401fa0
push eax
call fcn.0057e90a
add esp, 4
lea ecx, [ebp - 0x70]
mov ebx, eax
call fcn.00401fa0
push eax
call fcn.0057e90a
add edi, ebx
lea ebx, [eax + edi + 3]
lea edi, [ebx + ebx]
push edi
call fcn.005970d9
mov edx, eax
add esp, 8
test edx, edx
mov dword [ebp - 0x30], edx
je 0x40d2ae
mov ecx, edi
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea ecx, [ebp - 0x60]
call fcn.00401fa0
push eax
lea ecx, [ebp - 0x70]
call fcn.00401fa0
push eax
lea ecx, [ebp - 0x4c]
call fcn.00401fa0
push eax
mov eax, dword [ebp - 0x30]
push ebx
push eax
call fcn.0057e89a
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.0057e90a
add esp, 0x18
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 6
call fcn.00401070
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 5
call fcn.00401070
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 4
call fcn.00401070
mov edx, dword [ebp - 0x30]
xor ebx, ebx
mov ecx, 0xf
xor eax, eax
lea edi, [ebp - 0xcc]
cmp edx, ebx
rep stosd dword es:[edi], eax
mov dword [ebp - 0xcc], 0x3c
mov dword [ebp - 0xc8], 0x40
mov dword [ebp - 0xc0], str.open
jne 0x40d30b
lea edx, [ebp - 0x2c]
mov dword [ebp - 0xbc], edx
mov dword [ebp - 0xb4], ebx
mov dword [ebp - 0xb0], 3
mov dword [ebp - 0xac], ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0x30]
cmp eax, ebx
mov dword [ebp - 0xb8], str._instdriv
jne 0x40d347
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40d46b
mov eax, dword [ebp - 0x30]
cmp eax, ebx
jne 0x40d361
lea eax, [ebp - 0x2c]
push ebx
push eax
mov ecx, esi
call fcn.0040c5c0
test al, al
je 0x40d46b
mov ebx, dword [sym.imp.SHELL32.dll_ShellExecuteExW]
lea eax, [ebp - 0xcc]
push eax
call ebx
test eax, eax
je 0x40d465
mov ecx, dword [ebp - 0x94]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, 1
push 0xffffffffffffffff
push ecx
mov dword [ebp - 0x18], edi
call esi
mov eax, dword [ebp - 0x94]
lea edx, [ebp - 0x38]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x40d3bd
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x3c]
mov dword [0x679a58], edi
test eax, eax
jne 0x40d46b
mov ecx, 0xf
xor eax, eax
lea edi, [ebp - 0xcc]
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xcc], 0x3c
test eax, eax
mov dword [ebp - 0xc8], 0x40
mov dword [ebp - 0xc0], str.open
je 0x40d40a
mov dword [ebp - 0xbc], eax
jmp 0x40d413
lea edx, [ebp - 0x2c]
mov dword [ebp - 0xbc], edx
xor eax, eax
mov dword [ebp - 0xb0], 3
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xac], eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0xc4], eax
lea eax, [ebp - 0xcc]
push eax
mov dword [ebp - 0xb8], str._uninstlsp
call ebx
test eax, eax
je 0x40d459
mov ecx, dword [ebp - 0x94]
push 0xffffffffffffffff
push ecx
call esi
mov dword [ebp - 0x90], 1
jmp 0x40d46b
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x14], 0
mov byte [ebp - 4], 0
call fcn.00401070
jmp 0x40d494
cmp dword [ebp - 0x3c], ebx
je 0x40d4ae
mov edx, dword [ebp - 0x78]
lea ecx, [esi + 4]
push edx
call fcn.00408970
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x40d4ae
mov eax, dword [ebp - 0x34]
test eax, eax
jne 0x40d4b5
mov dword [0x679a54], 1
jmp 0x40d4b5
mov dword [ebp - 0x50], 0
mov ecx, dword [ebp - 0x18]
mov edx, dword [0x67a040]
xor eax, eax
push 4
test ecx, ecx
lea ecx, [ebp - 0x8c]
push ecx
push 4
push 0
push str.lastintres
setne al
push edx
mov dword [ebp - 0x8c], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, dword [ebp - 0x40]
mov edi, dword [ebp - 0x34]
xor ebx, ebx
cmp edi, ebx
je 0x40d50e
cmp dword [ebp - 0x14], ebx
je 0x40d4fe
mov ecx, esi
call fcn.0040e080
jmp 0x40d50a
cmp dword [ebp - 0x7c], ebx
jne 0x40d50a
mov ecx, esi
call fcn.0040dfc0
cmp edi, ebx
jne 0x40d564
lea eax, [ebp - 0x14]
push ebx
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40d564
mov ecx, dword [ebp - 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push str.Adsoff_Startup
push ecx
call edi
mov edx, dword [ebp - 0x14]
push str.OSSPoxy
push edx
call edi
mov eax, dword [ebp - 0x14]
push str.New.net_Startup
push eax
call edi
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x34]
mov ecx, esi
call fcn.00411560
cmp dword [0x679a54], ebx
je 0x40d5b8
mov eax, dword [0x67a040]
lea edx, [ebp - 0x20]
push 4
push edx
push 4
push ebx
push str.NeedChAfRb
push eax
mov dword [ebp - 0x20], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [0x67aaa4]
mov edx, dword [0x67aa50]
push 0x50030
push ecx
push edx
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call fcn.0040b5e0
add esp, 4
cmp edi, ebx
jne 0x40d5c1
cmp dword [ebp - 0x50], ebx
jne 0x40d608
mov edx, dword [0x67a040]
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x38]
push eax
push ecx
push ebx
push ebx
push str.NeedChAfRb
push edx
mov dword [ebp - 0x20], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40d830
mov eax, dword [0x67a040]
mov edi, dword [ebp - 0x38]
push str.NeedChAfRb
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test edi, edi
je 0x40d830
mov ecx, dword [0x67a040]
push str.NeedChAfRb
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, dword [0x67a040]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [ebp - 0x78]
lea eax, [ebp - 0x1c]
xor esi, esi
push edx
push eax
push esi
push esi
push str.ClChIDMRes
push ecx
xor ebx, ebx
mov dword [ebp - 0x78], 4
call edi
test eax, eax
jne 0x40d64a
mov esi, dword [ebp - 0x1c]
mov ecx, dword [0x67a040]
lea edx, [ebp - 0x78]
lea eax, [ebp - 0x1c]
push edx
push eax
push 0
push 0
push str.ClChIERes
push ecx
mov dword [ebp - 0x78], 4
call edi
test eax, eax
jne 0x40d679
mov eax, dword [ebp - 0x1c]
cmp eax, 1
mov ebx, eax
je 0x40d682
cmp esi, 1
jne 0x40d830
lea ecx, [ebp - 0x18]
mov edi, 1
call fcn.004be2e0
lea edx, [ebp - 0x54]
lea eax, [ebp - 0x50]
push edx
push eax
push 0
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 9
call fcn.004bea70
cmp ebx, edi
jne 0x40d6b1
cmp dword [ebp - 0x54], 0xffffffff
jne 0x40d6b1
xor edi, edi
cmp esi, 1
jne 0x40d6bc
cmp dword [ebp - 0x50], 0xffffffff
je 0x40d6c4
test edi, edi
jne 0x40d7cf
mov ecx, dword [0x67aa88]
mov edx, dword [0x67aa78]
push 0x50030
push ecx
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov edi, dword [ebp - 0x40]
lea ecx, [edi + 4]
call fcn.00409900
mov ecx, dword [0x67a040]
lea eax, [ebp - 0x14]
push 4
push eax
push 4
push 0
push str.AdvancedIntegration
push ecx
mov dword [ebp - 0x14], 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [ebp - 0x3c]
mov dword [edi + 0x1c], 0
call fcn.004be2e0
lea edx, [ebp - 0x54]
lea eax, [ebp - 0x50]
push edx
push eax
push 0
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0xa
call fcn.004bea70
mov edi, 1
cmp ebx, edi
mov eax, edi
jne 0x40d745
cmp dword [ebp - 0x54], 0xffffffff
jne 0x40d745
xor eax, eax
cmp esi, edi
jne 0x40d74f
cmp dword [ebp - 0x50], 0xffffffff
je 0x40d753
test eax, eax
jne 0x40d7be
mov edx, dword [0x67a040]
lea ecx, [ebp - 0x14]
push 4
push ecx
push 4
push 0
push str.NeedSnRpAfRb
push edx
mov dword [ebp - 0x14], edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [0x67aa88]
mov ecx, dword [0x67aa74]
push 0x50030
push eax
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push edi
call fcn.0040b5e0
add esp, 4
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 9
call fcn.004be310
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0
call fcn.004be310
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x80], edi
mov byte [ebp - 4], 9
call fcn.004be310
jmp 0x40d824
mov eax, dword [ebp - 0x50]
push 0x50000
cmp eax, 1
jne 0x40d7eb
mov edx, dword [0x67aa88]
mov eax, dword [0x67aa48]
push edx
push eax
jmp 0x40d7f9
mov ecx, dword [0x67aa88]
mov edx, dword [0x67aa70]
push ecx
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [0x67a040]
lea eax, [ebp - 0x14]
push 4
push eax
push 4
push 0
push str.AdvancedIntegration
push ecx
mov dword [ebp - 0x14], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0
call fcn.004be310
mov eax, dword [ebp - 0x80]
test eax, eax
jne 0x40d881
mov ecx, dword [0x67a040]
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x80]
push edx
push eax
push 0
push 0
push str.NeedSnRpAfRb
push ecx
mov dword [ebp - 0x20], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40d924
mov edx, dword [0x67a040]
mov edi, dword [ebp - 0x80]
push str.NeedSnRpAfRb
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test edi, edi
je 0x40d924
push 0
lea ecx, [ebp - 0x12e8]
call fcn.004e2250
lea ecx, [ebp - 0x12e8]
mov byte [ebp - 4], 0xb
call fcn.00596cd3
lea ecx, [ebp - 0x5a4]
mov byte [ebp - 4], 0x13
call fcn.0059ad3d
lea ecx, [ebp - 0x1158]
mov byte [ebp - 4], 0x12
call fcn.0054a0f0
lea ecx, [ebp - 0x1160]
mov byte [ebp - 4], 0x11
call fcn.0059ad3d
lea ecx, [ebp - 0x119c]
mov byte [ebp - 4], 0x10
call fcn.005a29d1
lea ecx, [ebp - 0x11d8]
mov byte [ebp - 4], 0xf
call fcn.005a29d1
lea ecx, [ebp - 0x1214]
mov byte [ebp - 4], 0xe
call fcn.005a29d1
lea ecx, [ebp - 0x1250]
mov byte [ebp - 4], 0xd
call fcn.005a2849
lea ecx, [ebp - 0x128c]
mov byte [ebp - 4], 0xc
call fcn.005a2881
lea ecx, [ebp - 0x12e8]
mov byte [ebp - 4], 0
call fcn.00596914
mov ebx, dword [ebp - 0x40]
mov ecx, ebx
call fcn.0040f780
mov ecx, ebx
call fcn.00411480
mov ecx, ebx
call fcn.0040dfa0
xor esi, esi
cmp eax, esi
jne 0x40d96d
push esi
push esi
mov ecx, ebx
call fcn.00410020
push esi
push esi
mov ecx, ebx
call fcn.00410d30
push esi
push esi
mov ecx, ebx
call fcn.00410da0
push esi
push esi
mov ecx, ebx
call fcn.00410410
mov ecx, ebx
call fcn.0040dfb0
cmp dword [ebx + 0x1c], esi
je 0x40d97d
push 1
mov ecx, ebx
call fcn.00416b80
jmp 0x40d990
mov ecx, ebx
call fcn.00412850
cmp eax, esi
jne 0x40d990
push esi
mov ecx, ebx
call fcn.004128a0
cmp dword [0x67a034], esi
je 0x40d99f
mov ecx, ebx
call fcn.00417110
cmp dword [ebp - 0x34], esi
je 0x40de8f
lea eax, [ebp - 0x84]
lea ecx, [ebp - 0x88]
lea edi, [ebx + 4]
push eax
push ecx
mov ecx, edi
call fcn.00409e20
cmp eax, esi
je 0x40dc05
cmp dword [ebp - 0x7c], esi
jne 0x40d9d9
mov ecx, edi
call fcn.00409900
jmp 0x40de9b
xor eax, eax
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x30], eax
mov word [ebp - 0x2c], si
mov edi, dword [0x679ff8]
mov byte [ebp - 4], 0x14
cmp edi, esi
jne 0x40d9f8
mov edi, 0x679ffc
mov edx, 0x64f028
test edx, edx
je 0x40db2c
cmp edi, esi
je 0x40db2c
mov ecx, str.Uninstall.exe
test ecx, ecx
je 0x40db2c
push esi
push edx
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x58], esi
mov word [ebp - 0x5c], si
call fcn.004028d0
push edi
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x68], esi
mov word [ebp - 0x6c], si
call fcn.00401fb0
push str.Uninstall.exe
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0x16
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x44], esi
mov word [ebp - 0x48], si
call fcn.00401fb0
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x17
call fcn.00401070
mov eax, dword [ebp - 0x70]
cmp eax, esi
jne 0x40da76
lea eax, [ebp - 0x6c]
mov ebx, dword [ebp - 0x4c]
cmp ebx, esi
jne 0x40da80
lea ebx, [ebp - 0x48]
mov edi, dword [ebp - 0x58]
push eax
call fcn.0057e90a
mov edx, eax
push ebx
mov dword [ebp - 0x20], edx
call fcn.0057e90a
mov edx, dword [ebp - 0x20]
add edi, edx
lea ebx, [eax + edi + 3]
lea edi, [ebx + ebx]
push edi
call fcn.005970d9
mov edx, eax
add esp, 0xc
cmp edx, esi
mov dword [ebp - 0x30], edx
je 0x40db02
mov ecx, edi
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebp - 0x4c]
cmp eax, esi
mov edx, eax
jne 0x40dad2
lea edx, [ebp - 0x48]
mov ecx, dword [ebp - 0x70]
cmp ecx, esi
jne 0x40dadc
lea ecx, [ebp - 0x6c]
mov eax, dword [ebp - 0x60]
cmp eax, esi
jne 0x40dae6
lea eax, [ebp - 0x5c]
push edx
push ecx
push eax
mov eax, dword [ebp - 0x30]
push ebx
push eax
call fcn.0057e89a
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.0057e90a
add esp, 0x18
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0x16
call fcn.00401070
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0x15
call fcn.00401070
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 0x14
call fcn.00401070
mov eax, dword [ebp - 0x30]
mov ebx, dword [ebp - 0x40]
cmp eax, esi
jne 0x40db33
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40dbf9
mov eax, dword [ebp - 0x30]
cmp eax, esi
jne 0x40db4d
lea eax, [ebp - 0x2c]
push esi
push eax
mov ecx, ebx
call fcn.0040c5c0
test al, al
je 0x40dbf9
mov ecx, 0xf
xor eax, eax
lea edi, [ebp - 0xcc]
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xcc], 0x3c
cmp eax, esi
mov dword [ebp - 0xc8], 0x40
mov dword [ebp - 0xc0], str.open
je 0x40db9a
mov dword [ebp - 0xbc], eax
jmp 0x40dba3
lea edx, [ebp - 0x2c]
mov dword [ebp - 0xbc], edx
mov dword [ebp - 0xb4], esi
mov dword [ebp - 0xb0], 3
mov dword [ebp - 0xac], esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0xc4], eax
lea eax, [ebp - 0xcc]
push eax
mov dword [ebp - 0xb8], str._uninstlsp
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x40dbef
mov ecx, dword [ebp - 0x94]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x90], 1
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0
call fcn.00401070
cmp dword [ebp - 0x7c], esi
je 0x40de8f
push esi
push esi
push 3
push esi
push 3
push 0xc0000000
push str..IDMTDI
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x40dc33
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40dc6e
call fcn.00434b00
neg eax
sbb eax, eax
lea edx, [ebp - 0x20]
and eax, 0x100
push edx
add eax, 0x20019
push eax
push esi
push str.SYSTEMCurrentControlSetServicesIDMTDI
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, esi
jne 0x40de8f
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x4c], eax
mov word [ebp - 0x48], si
mov edi, dword [0x679ff8]
mov byte [ebp - 4], 0x18
cmp edi, esi
jne 0x40dc8d
mov edi, 0x679ffc
mov ecx, 0x64f028
test ecx, ecx
je 0x40ddbe
cmp edi, esi
je 0x40ddbe
mov edx, str.Uninstall.exe
test edx, edx
je 0x40ddbe
push esi
push ecx
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x58], esi
mov word [ebp - 0x5c], si
call fcn.004028d0
push edi
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x19
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x28], esi
mov word [ebp - 0x2c], si
call fcn.00401fb0
push str.Uninstall.exe
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0x1a
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x68], esi
mov word [ebp - 0x6c], si
call fcn.00401fb0
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0x1b
call fcn.00401070
mov eax, dword [ebp - 0x30]
cmp eax, esi
jne 0x40dd0b
lea eax, [ebp - 0x2c]
mov ebx, dword [ebp - 0x70]
cmp ebx, esi
jne 0x40dd15
lea ebx, [ebp - 0x6c]
mov edi, dword [ebp - 0x58]
push eax
call fcn.0057e90a
mov edx, eax
push ebx
mov dword [ebp - 0x20], edx
call fcn.0057e90a
mov ecx, dword [ebp - 0x20]
add edi, ecx
lea ebx, [eax + edi + 3]
lea edi, [ebx + ebx]
push edi
call fcn.005970d9
mov edx, eax
add esp, 0xc
cmp edx, esi
mov dword [ebp - 0x4c], edx
je 0x40dd97
mov ecx, edi
mov edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebp - 0x70]
cmp eax, esi
mov edx, eax
jne 0x40dd67
lea edx, [ebp - 0x6c]
mov ecx, dword [ebp - 0x30]
cmp ecx, esi
jne 0x40dd71
lea ecx, [ebp - 0x2c]
mov eax, dword [ebp - 0x60]
cmp eax, esi
jne 0x40dd7b
lea eax, [ebp - 0x5c]
push edx
push ecx
push eax
mov eax, dword [ebp - 0x4c]
push ebx
push eax
call fcn.0057e89a
mov ecx, dword [ebp - 0x4c]
push ecx
call fcn.0057e90a
add esp, 0x18
mov dword [ebp - 0x44], eax
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0x1a
call fcn.00401070
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x19
call fcn.00401070
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 0x18
call fcn.00401070
mov eax, dword [ebp - 0x4c]
cmp eax, esi
jne 0x40ddc5
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40de83
mov eax, dword [ebp - 0x4c]
cmp eax, esi
jne 0x40dddf
lea eax, [ebp - 0x48]
mov ecx, dword [ebp - 0x40]
push 1
push eax
call fcn.0040c5c0
test al, al
je 0x40de83
mov ecx, 0xf
xor eax, eax
lea edi, [ebp - 0x108]
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x108], 0x3c
cmp eax, esi
mov dword [ebp - 0x104], 0x40
mov dword [ebp - 0xfc], str.open
je 0x40de2e
mov dword [ebp - 0xf8], eax
jmp 0x40de37
lea edx, [ebp - 0x48]
mov dword [ebp - 0xf8], edx
mov dword [ebp - 0xf0], esi
mov dword [ebp - 0xec], 3
mov dword [ebp - 0xe8], esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x100], eax
lea eax, [ebp - 0x108]
push eax
mov dword [ebp - 0xf4], str._uninsttdi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x40de83
mov ecx, dword [ebp - 0xd0]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0
call fcn.00401070
cmp dword [ebp - 0x90], esi
je 0x40d7ad
mov edx, dword [0x67aaa4]
mov eax, dword [0x67aa50]
push 0x50030
push edx
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call fcn.0040b5e0
mov ecx, dword [ebp - 0xc]
add esp, 4
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret