Function at 0x40a8b0
Capabilities:
Contain obfuscated stackstrings
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4dd999
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1b0
push esi
push edi
mov ecx, 0x510279
mov dword [ebp - 4], 2
call fcn.004b7c9d
lea eax, [ebp + 0x20]
push eax
lea ecx, [ebp - 0x1bc]
call fcn.00403dd0
lea eax, [ebp + 0x20]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x1a4]
call fcn.00403dd0
lea eax, [ebp + 0x20]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x18c]
call fcn.00403dd0
xor eax, eax
mov byte [ebp - 4], 5
mov word [ebp - 0x1c], ax
lea ecx, [ebp - 0x1a]
lea eax, [ebp - 0xd]
mov dword [ebp - 0x44], 0
push eax
push ecx
lea edx, [ebp - 0x34]
mov dword [ebp - 0x34], 0x41005c
push edx
lea ecx, [ebp - 0x98]
mov dword [ebp - 0x30], 0x700070
mov dword [ebp - 0x2c], 0x69006c
mov dword [ebp - 0x28], 0x610063
mov dword [ebp - 0x24], 0x690074
mov dword [ebp - 0x20], 0x6e006f
call fcn.00403f10
push dword [eax]
lea ecx, [ebp - 0x1bc]
mov byte [ebp - 4], 6
call fcn.0040c7a0
cmp dword [eax + 0x14], 8
jb 0x40a981
mov eax, dword [eax]
lea ecx, [ebp - 0x88]
push ecx
lea ecx, [ebp - 0x44]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 5
mov esi, eax
call fcn.0040c550
test esi, esi
jne 0x40b6ca
xor eax, eax
mov dword [ebp - 0xc4], 0x410020
mov word [ebp - 0xb4], ax
lea ecx, [ebp - 0xb2]
mov word [ebp - 0xdc], ax
lea edx, [ebp - 0xc4]
mov word [ebp - 0x90], ax
lea eax, [ebp - 0xd]
push eax
push ecx
push edx
lea ecx, [ebp - 0x174]
mov dword [ebp - 0xc0], 0x740075
mov dword [ebp - 0xbc], 0x6f0068
mov dword [ebp - 0xb8], 0x730072
mov dword [ebp - 0xf0], 0x500047
mov dword [ebp - 0xec], 0x200054
mov dword [ebp - 0xe8], 0x680043
mov dword [ebp - 0xe4], 0x6f0072
mov dword [ebp - 0xe0], 0x65006d
mov dword [ebp - 0x98], 0x680054
mov dword [ebp - 0x94], 0x200065
call fcn.00403f10
mov edi, eax
lea eax, [ebp - 0xd]
mov byte [ebp - 4], 7
push eax
lea ecx, [ebp - 0xda]
push ecx
lea edx, [ebp - 0xf0]
push edx
lea ecx, [ebp - 0x168]
call fcn.00403f10
mov esi, dword [eax]
mov byte [ebp - 4], 8
call fcn.004059f0
mov ecx, eax
test ecx, ecx
je 0x40b713
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x14], eax
push esi
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 9
call fcn.004048d0
test al, al
jne 0x40aadc
test esi, esi
jne 0x40aabe
xor ecx, ecx
jmp 0x40aad2
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40aac3
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x14]
call fcn.00406d70
lea eax, [ebp - 0xd]
mov byte [ebp - 4], 0xa
push eax
lea ecx, [ebp - 0x8e]
push ecx
lea edx, [ebp - 0x98]
push edx
lea ecx, [ebp - 0x15c]
call fcn.00403f10
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0xb
push ecx
push dword [eax]
lea eax, [ebp - 0x124]
push eax
call fcn.00404490
push dword [edi]
mov byte [ebp - 4], 0xc
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.004043c0
add esp, 0x18
mov edx, dword [ebp - 0x124]
or edi, 0xffffffff
mov byte [ebp - 4], 0xe
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40ab4d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x15c]
call fcn.0040c550
mov edx, dword [ebp - 0x14]
mov eax, edi
mov byte [ebp - 4], 0x10
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40ab76
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x168]
call fcn.0040c550
lea ecx, [ebp - 0x174]
mov byte [ebp - 4], 0x12
call fcn.0040c550
xor eax, eax
mov dword [ebp - 0x40], 0x700041
mov word [ebp - 0x1c], ax
lea ecx, [ebp - 0x1a]
lea eax, [ebp - 0xd]
mov dword [ebp - 0x3c], 0x6c0070
push eax
push ecx
lea edx, [ebp - 0x40]
mov dword [ebp - 0x38], 0x630069
push edx
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0x34], 0x740061
mov dword [ebp - 0x30], 0x6f0069
mov dword [ebp - 0x2c], 0x43006e
mov dword [ebp - 0x28], 0x6d006f
mov dword [ebp - 0x24], 0x610070
mov dword [ebp - 0x20], 0x79006e
call fcn.00403f10
mov esi, dword [eax]
mov byte [ebp - 4], 0x13
call fcn.004059f0
mov ecx, eax
test ecx, ecx
je 0x40b71d
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x14], eax
push esi
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x14
call fcn.004048d0
test al, al
jne 0x40ac49
test esi, esi
jne 0x40ac27
xor ecx, ecx
jmp 0x40ac3f
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40ac30
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x14]
call fcn.00406d70
mov eax, dword [ebp - 0x84]
mov esi, dword [ebp - 0x14]
mov byte [ebp - 4], 0x13
mov ecx, dword [eax - 0xc]
lea ecx, [ecx*2 + 2]
push ecx
push eax
push 1
push 0
push esi
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40ac87
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 0x12
call fcn.0040c550
call fcn.004059f0
mov ecx, eax
test ecx, ecx
je 0x40b727
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x14], eax
push 0x4e4930
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x15
call fcn.004048d0
test al, al
jne 0x40acd6
push 5
push 0x4e4930
lea ecx, [ebp - 0x14]
call fcn.00406d70
xor eax, eax
mov byte [ebp - 4], 0x16
mov word [ebp - 0x54], ax
lea ecx, [ebp - 0x52]
lea eax, [ebp - 0xd]
mov dword [ebp - 0x80], 0x700041
push eax
push ecx
lea edx, [ebp - 0x80]
mov dword [ebp - 0x7c], 0x6c0070
push edx
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0x78], 0x630069
mov dword [ebp - 0x74], 0x740061
mov dword [ebp - 0x70], 0x6f0069
mov dword [ebp - 0x6c], 0x44006e
mov dword [ebp - 0x68], 0x730065
mov dword [ebp - 0x64], 0x720063
mov dword [ebp - 0x60], 0x700069
mov dword [ebp - 0x5c], 0x690074
mov dword [ebp - 0x58], 0x6e006f
call fcn.00403f10
mov esi, dword [eax]
mov byte [ebp - 4], 0x17
call fcn.004059f0
mov ecx, eax
test ecx, ecx
je 0x40b731
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x18], eax
push esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x18
call fcn.004048d0
test al, al
jne 0x40ad9d
test esi, esi
jne 0x40ad7f
xor ecx, ecx
jmp 0x40ad93
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40ad84
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x18]
call fcn.00406d70
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
mov byte [ebp - 4], 0x17
mov ecx, dword [eax - 0xc]
lea ecx, [ecx*2 + 2]
push ecx
push eax
push 1
push 0
push esi
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40add8
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 0x16
call fcn.0040c550
cmp dword [ebp + 0x1c], 8
lea esi, [ebp + 8]
cmovae esi, dword [ebp + 8]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x40adf5
sub esi, ecx
mov dword [ebp - 0x38], 0x700041
lea eax, [ebp - 0xd]
sar esi, 1
push eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x34], 0x6c0070
push ecx
lea edx, [ebp - 0x38]
mov dword [ebp - 0x30], 0x630069
push edx
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0x2c], 0x740061
mov dword [ebp - 0x28], 0x6f0069
mov dword [ebp - 0x24], 0x49006e
mov dword [ebp - 0x20], 0x6f0063
mov dword [ebp - 0x1c], 0x6e
call fcn.00403f10
mov eax, dword [eax]
mov byte [ebp - 4], 0x19
mov dword [ebp - 0x48], eax
call fcn.004059f0
mov ecx, eax
test ecx, ecx
je 0x40b73b
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x18], eax
push dword [ebp - 0x48]
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x1a
call fcn.004048d0
test al, al
jne 0x40aeba
mov edx, dword [ebp - 0x48]
test edx, edx
jne 0x40ae96
xor ecx, ecx
jmp 0x40aeb0
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x50], eax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40aea0
sub ecx, dword [ebp - 0x50]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x18]
call fcn.00406d70
cmp dword [ebp + 0x1c], 8
lea eax, [esi*2 + 2]
mov esi, dword [ebp - 0x18]
lea ecx, [ebp + 8]
cmovae ecx, dword [ebp + 8]
push eax
push ecx
push 1
push 0
push esi
push dword [ebp - 0x44]
mov byte [ebp - 4], 0x19
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40aefa
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 0x16
call fcn.0040c550
xor eax, eax
mov dword [ebp - 0x108], 0x500047
mov word [ebp - 0xf4], ax
lea ecx, [ebp - 0xf2]
lea eax, [ebp - 0xd]
mov dword [ebp - 0x104], 0x200054
push eax
push ecx
lea edx, [ebp - 0x108]
mov dword [ebp - 0x100], 0x680043
push edx
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0xfc], 0x6f0072
mov dword [ebp - 0xf8], 0x65006d
call fcn.00403f10
mov esi, dword [eax]
mov byte [ebp - 4], 0x1b
call fcn.004059f0
mov ecx, eax
test ecx, ecx
je 0x40b745
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x18], eax
push esi
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x1c
call fcn.004048d0
test al, al
jne 0x40afba
test esi, esi
jne 0x40af9c
xor ecx, ecx
jmp 0x40afb0
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40afa1
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x18]
call fcn.00406d70
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], 0x1e
call fcn.0040c550
lea eax, [ebp - 0xd]
mov dword [ebp - 0x38], 0x700041
push eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x34], 0x6c0070
push ecx
lea edx, [ebp - 0x38]
mov dword [ebp - 0x30], 0x630069
push edx
lea ecx, [ebp - 0x138]
mov dword [ebp - 0x2c], 0x740061
mov dword [ebp - 0x28], 0x6f0069
mov dword [ebp - 0x24], 0x4e006e
mov dword [ebp - 0x20], 0x6d0061
mov dword [ebp - 0x1c], 0x65
call fcn.00403f10
mov esi, dword [eax]
mov byte [ebp - 4], 0x1f
call fcn.004059f0
mov ecx, eax
test ecx, ecx
je 0x40b74f
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x4c], eax
push esi
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0x20
call fcn.004048d0
test al, al
jne 0x40b079
test esi, esi
jne 0x40b053
xor ecx, ecx
jmp 0x40b06f
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40b060
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x4c]
call fcn.00406d70
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x4c]
mov byte [ebp - 4], 0x1f
mov ecx, dword [eax - 0xc]
lea ecx, [ecx*2 + 2]
push ecx
push eax
push 1
push 0
push esi
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40b0b4
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x138]
mov byte [ebp - 4], 0x1e
call fcn.0040c550
lea eax, [ebp - 0xd]
mov dword [ebp - 0xd8], 0x530054
push eax
lea ecx, [ebp - 0xc4]
mov dword [ebp - 0xd4], 0x720042
push ecx
lea edx, [ebp - 0xd8]
mov dword [ebp - 0xd0], 0x77006f
push edx
lea ecx, [ebp - 0x138]
mov dword [ebp - 0xcc], 0x650073
mov dword [ebp - 0xc8], 0x72
call fcn.00403f10
mov esi, dword [eax]
mov byte [ebp - 4], 0x21
call fcn.004059f0
mov ecx, eax
test ecx, ecx
je 0x40b759
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x4c], eax
push esi
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0x22
call fcn.004048d0
test al, al
jne 0x40b16b
test esi, esi
jne 0x40b14d
xor ecx, ecx
jmp 0x40b161
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40b152
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x4c]
call fcn.00406d70
lea ecx, [ebp - 0x138]
mov byte [ebp - 4], 0x24
call fcn.0040c550
xor eax, eax
mov dword [ebp - 0x38], 0x700041
mov word [ebp - 0x1c], ax
lea ecx, [ebp - 0x1a]
lea eax, [ebp - 0xd]
mov dword [ebp - 0x34], 0x550070
push eax
push ecx
lea edx, [ebp - 0x38]
mov dword [ebp - 0x30], 0x650073
push edx
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x2c], 0x4d0072
mov dword [ebp - 0x28], 0x64006f
mov dword [ebp - 0x24], 0x6c0065
mov dword [ebp - 0x20], 0x640049
call fcn.00403f10
mov esi, dword [eax]
mov byte [ebp - 4], 0x25
call fcn.004059f0
mov ecx, eax
test ecx, ecx
je 0x40b763
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x48], eax
push esi
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x26
call fcn.004048d0
test al, al
jne 0x40b229
test esi, esi
jne 0x40b203
xor ecx, ecx
jmp 0x40b21f
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40b210
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x48]
call fcn.00406d70
mov edi, dword [ebp - 0x4c]
mov esi, dword [ebp - 0x48]
mov byte [ebp - 4], 0x25
mov eax, dword [edi - 0xc]
lea eax, [eax*2 + 2]
push eax
push edi
push 1
push 0
push esi
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x40b265
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0x24
call fcn.0040c550
xor eax, eax
mov dword [ebp - 0x34], 0x44005c
mov word [ebp - 0x1c], ax
lea ecx, [ebp - 0x1a]
lea eax, [ebp - 0xd]
mov dword [ebp - 0x30], 0x660065
push eax
push ecx
lea edx, [ebp - 0x34]
mov dword [ebp - 0x2c], 0x750061
push edx
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x28], 0x74006c
mov dword [ebp - 0x24], 0x630049
mov dword [ebp - 0x20], 0x6e006f
call fcn.00403f10
push dword [eax]
lea ecx, [ebp - 0x1a4]
mov byte [ebp - 4], 0x27
call fcn.0040c7a0
cmp dword [eax + 0x14], 8
jb 0x40b2d4
mov eax, dword [eax]
lea ecx, [ebp - 0x88]
push ecx
lea ecx, [ebp - 0x44]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0x24
mov esi, eax
call fcn.0040c550
test esi, esi
jne 0x40b651
mov esi, dword [ebp + 0x1c]
lea edx, [ebp + 8]
cmp esi, 8
cmovae edx, dword [ebp + 8]
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x40b321
sub edx, ecx
lea ecx, [ebp + 8]
sar edx, 1
cmp esi, 8
cmovae ecx, dword [ebp + 8]
lea eax, [edx*2 + 2]
push eax
push ecx
push 1
push 0
push 0x4e4830
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [ebp - 0xd]
mov dword [ebp - 0x40], 0x73005c
push eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x3c], 0x650068
push ecx
lea edx, [ebp - 0x40]
mov dword [ebp - 0x38], 0x6c006c
push edx
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x34], 0x6f005c
mov dword [ebp - 0x30], 0x650070
mov dword [ebp - 0x2c], 0x5c006e
mov dword [ebp - 0x28], 0x6f0063
mov dword [ebp - 0x24], 0x6d006d
mov dword [ebp - 0x20], 0x6e0061
mov dword [ebp - 0x1c], 0x64
call fcn.00403f10
push dword [eax]
lea ecx, [ebp - 0x18c]
mov byte [ebp - 4], 0x28
call fcn.0040c7a0
cmp dword [eax + 0x14], 8
jb 0x40b3cb
mov eax, dword [eax]
lea ecx, [ebp - 0x88]
push ecx
lea ecx, [ebp - 0x44]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0x24
mov esi, eax
call fcn.0040c550
test esi, esi
jne 0x40b651
lea eax, [ebp - 0xd]
mov dword [ebp - 0x80], 0x2d0020
push eax
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x7c], 0x73002d
push ecx
lea edx, [ebp - 0x80]
mov dword [ebp - 0x78], 0x6e0069
push edx
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x74], 0x6c0067
mov dword [ebp - 0x70], 0x2d0065
mov dword [ebp - 0x6c], 0x720061
mov dword [ebp - 0x68], 0x750067
mov dword [ebp - 0x64], 0x65006d
mov dword [ebp - 0x60], 0x74006e
mov dword [ebp - 0x5c], 0x250020
mov dword [ebp - 0x58], 0x31
call fcn.00403f10
mov dword [ebp - 0x8c], eax
mov edx, dword [ebp + 0x48]
mov ecx, SysReAllocString
sub ecx, edx
mov byte [ebp - 4], 0x29
mov dword [ebp - 0x50], edx
cmp ecx, 1
jb 0x40b76d
cmp dword [ebp + 0x4c], 8
lea eax, [ebp + 0x38]
mov dword [ebp - 0x110], esi
lea ecx, [edx + 1]
cmovae eax, dword [ebp + 0x38]
xorps xmm0, xmm0
mov dword [ebp - 0x10c], esi
mov esi, 7
mov dword [ebp - 0x12c], eax
lea eax, [ebp - 0x120]
mov dword [ebp - 0x128], ecx
mov dword [ebp - 0x48], eax
movups xmmword [ebp - 0x120], xmm0
cmp ecx, esi
jbe 0x40b50d
mov esi, ecx
or esi, 7
cmp esi, 0x7ffffffe
jbe 0x40b4e2
mov esi, SysReAllocString
jmp 0x40b4ec
mov eax, 0xa
cmp esi, eax
cmovb esi, eax
lea eax, [esi + 1]
push eax
lea ecx, [ebp - 0x120]
call fcn.004036a0
mov ecx, dword [ebp - 0x128]
mov edx, dword [ebp - 0x50]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x110], ecx
mov ecx, 0x22
mov dword [ebp - 0x10c], esi
mov word [eax], cx
lea ecx, [eax + 2]
lea eax, [edx + edx]
push eax
push dword [ebp - 0x12c]
push ecx
call fcn.004ba780
mov eax, dword [ebp - 0x48]
xor edx, edx
mov ecx, dword [ebp - 0x50]
mov word [eax + ecx*2 + 2], dx
push 0x4e4904
lea eax, [ebp - 0x120]
mov byte [ebp - 4], 0x2a
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.00403760
mov ecx, dword [ebp - 0x8c]
mov byte [ebp - 4], 0x2b
push dword [ecx]
push eax
lea eax, [ebp - 0x150]
push eax
call fcn.00403760
add esp, 0x24
lea ecx, [ebp - 0x30]
call fcn.00403120
mov ecx, dword [ebp - 0x10c]
mov byte [ebp - 4], 0x29
cmp ecx, 8
jb 0x40b5c2
mov edx, dword [ebp - 0x120]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x40b5b8
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40b772
push ecx
push edx
call fcn.004b7c8f
add esp, 8
xor eax, eax
mov dword [ebp - 0x110], 0
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x10c], 7
mov word [ebp - 0x120], ax
call fcn.0040c550
mov esi, dword [ebp - 0x13c]
lea edx, [ebp - 0x150]
cmp esi, 8
cmovae edx, dword [ebp - 0x150]
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x40b603
sub edx, ecx
lea ecx, [ebp - 0x150]
sar edx, 1
cmp esi, 8
cmovae ecx, dword [ebp - 0x150]
lea eax, [edx*2 + 2]
push eax
push ecx
push 1
push 0
push 0x4e4830
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x150]
call fcn.00403120
or esi, 0xffffffff
mov byte [ebp - 4], 0x1e
mov eax, esi
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x40b66f
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x18]
mov eax, esi
add edx, 0xfffffff0
mov byte [ebp - 4], 0x16
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40b68d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x14]
mov eax, esi
add edx, 0xfffffff0
mov byte [ebp - 4], 0x12
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40b6ab
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x84]
add edx, 0xfffffff0
mov byte [ebp - 4], 5
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x40b6ca
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x18c]
call fcn.00403120
lea ecx, [ebp - 0x1a4]
call fcn.00403120
lea ecx, [ebp - 0x1bc]
call fcn.00403120
lea ecx, [ebp + 8]
call fcn.00403120
lea ecx, [ebp + 0x20]
call fcn.00403120
lea ecx, [ebp + 0x38]
call fcn.00403120
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004048a0
push 0x80004005
call fcn.004048a0
push 0x80004005
call fcn.004048a0
push 0x80004005
call fcn.004048a0
push 0x80004005
call fcn.004048a0
push 0x80004005
call fcn.004048a0
push 0x80004005
call fcn.004048a0
push 0x80004005
call fcn.004048a0
push 0x80004005
call fcn.004048a0
call fcn.00402980
call fcn.004bebbf
int3