Function at 0x401000
Capabilities:
Allocate thread local storage
Set registry value

Disassembly:
push 0xc4
push 0
push 0x4194c4
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.dll_GetModuleHandleW
mov dword [0x4194c8], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.dll_HeapCreate
mov dword [0x4194c4], eax
call fcn.00413160
call fcn.00411fee
call fcn.00411a27
call fcn.00411580
call fcn.00410f01
call fcn.00410ef5
call fcn.00410bf0
call fcn.0040fe90
call fcn.0040dfc4
call fcn.0040d750
call fcn.0040cc1b
call fcn.0040c5f1
call fcn.0040c2c0
call fcn.0040a5c0
call fcn.00406fea
call fcn.00406b93
call fcn.00405f43
call fcn.0040561d
call fcn.00405409
mov eax, 0x200
push eax
lea eax, [0x419584]
push eax
xor eax, eax
push eax
push 5
push 4
call fcn.0041200d
push 4
call sub.USER32.DLL_GetSystemMetrics
mov dword [0x419520], eax
push 0x20
call sub.USER32.DLL_GetSystemMetrics
mov ebx, eax
add ebx, ebx
mov dword [0x419500], ebx
push 0x21
call sub.USER32.DLL_GetSystemMetrics
mov ebx, eax
add ebx, ebx
add ebx, dword [0x419520]
mov dword [0x419504], ebx
push dword [0x419574]
call fcn.0040cccc
push 8
push 0x4171bc
lea eax, [0x419574]
push eax
push 4
call fcn.0040cc3a
push dword [0x41957c]
call fcn.0040cccc
push 0x15
xor eax, eax
push eax
lea eax, [0x41957c]
push eax
push 4
call fcn.0040cc3a
mov edx, str.cmd.exe
lea ecx, [0x4194e4]
call fcn.00405008
mov edx, dword [0x4199cc]
push edx
push edx
push 3
mov edx, dword [0x4199cc]
push edx
push edx
push 1
call fcn.00411096
mov edx, dword [0x417b40]
add dword [esp], edx
call fcn.00410140
push 0x41951c
call fcn.004131e0
push dword [0x4199cc]
mov edx, dword [0x41951c]
push dword [0x4199cc]
push edx
call fcn.00413260
mov edx, str.WindowsSysWOW64cmd64.exe
push edx
call fcn.00413260
mov edx, dword [0x417b40]
add dword [esp], edx
call fcn.004111b6
pop dword [0x4199cc]
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x4011d6
jl 0x4011d2
cmp ebx, 0
ja 0x4011d6
xor eax, eax
jmp 0x4011db
mov eax, 1
or eax, eax
je 0x4011f4
mov edx, str.cmd64.exe
lea ecx, [0x4194e4]
call fcn.00405008
jmp 0x4012ce
push dword [0x4199cc]
mov edx, dword [0x41951c]
push dword [0x4199cc]
push edx
call fcn.00413260
mov edx, str.WindowsSysWOW64cmd.exe
push edx
call fcn.00413260
mov edx, dword [0x417b40]
add dword [esp], edx
call fcn.004111b6
pop dword [0x4199cc]
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x40123f
jl 0x40123b
cmp ebx, 1
ja 0x40123f
xor eax, eax
jmp 0x401244
mov eax, 1
or eax, eax
je 0x4012a1
push dword [0x4199cc]
mov edx, dword [0x41951c]
push dword [0x4199cc]
push edx
call fcn.00413260
mov edx, str.WindowsSysWOW64chkdsk.exe
push edx
call fcn.00413260
mov edx, dword [0x417b40]
add dword [esp], edx
call fcn.004111b6
pop dword [0x4199cc]
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xffffffff
jne 0x40128d
cmp edi, 0xffffffff
je 0x401291
xor eax, eax
jmp 0x401296
mov eax, 1
or eax, eax
je 0x4012a1
mov eax, 1
jmp 0x4012a3
xor eax, eax
and eax, eax
je 0x4012ce
mov edx, dword [0x41951c]
push dword [0x4199cc]
push edx
call fcn.00413260
mov edx, str.WindowsSysNativecmd.exe
push edx
call fcn.00413260
push 0x4194e4
call fcn.004131e0
push dword [0x419574]
call fcn.00402ec0
push dword [0x419574]
call fcn.0040cd35
mov dword [0x4194dc], eax
cmp dword [0x4194dc], 0
je 0x4012f6
xor eax, eax
jmp 0x4012fb
mov eax, 1
and eax, eax
je 0x401315
mov eax, 0x41676e
push eax
mov eax, 0x41619e
push eax
call fcn.00405473
jmp 0x4028db
lea ebp, [0x419534]
mov dword [ebp], 1
mov edx, dword [0x4199cc]
push edx
push edx
mov edx, dword [0x4199cc]
push edx
push edx
call fcn.0040564c
mov edx, dword [0x417b40]
add dword [esp], edx
call fcn.00411300
mov edx, dword [0x4199cc]
push edx
push edx
push 1
mov edx, dword [0x4199cc]
push edx
push edx
call fcn.0040564c
mov edx, dword [0x417b40]
add dword [esp], edx
call fcn.0041137f
pop eax
mov edx, str..ini
push edx
call fcn.00413260
push 0x41950c
call fcn.004131e0
call fcn.00412e19
push dword [0x41950c]
call fcn.004111b6
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x4013a7
jl 0x4013a3
cmp ebx, 3
ja 0x4013a7
xor eax, eax
jmp 0x4013ac
mov eax, 1
or eax, eax
je 0x4013d5
push dword [0x41950c]
call fcn.00406340
and eax, eax
je 0x4013d5
mov eax, 0x416158
push eax
call fcn.0040637e
and eax, eax
je 0x4013d5
mov eax, 1
jmp 0x4013d7
xor eax, eax
and eax, eax
je 0x40168d
push 0
mov eax, str.StartDisk
push eax
call fcn.00406472
mov dword [0x4194d8], eax
mov ebx, dword [0x4194d8]
cmp ebx, 0x19
jg 0x40140b
mov ebx, dword [0x4194d8]
and ebx, ebx
jl 0x40140b
jmp 0x401412
mov eax, 1
jmp 0x401414
xor eax, eax
and eax, eax
je 0x401432
mov dword [0x4194d8], 0
push 0
mov eax, str.StartDisk
push eax
call fcn.004064a7
push 9
mov eax, str.FontSize
push eax
call fcn.00406472
mov dword [0x4194ec], eax
mov ebx, dword [0x4194ec]
cmp ebx, 0xf
jg 0x40145f
mov ebx, dword [0x4194ec]
cmp ebx, 7
jl 0x40145f
jmp 0x401466
mov eax, 1
jmp 0x401468
xor eax, eax
and eax, eax
je 0x401486
mov dword [0x4194ec], 9
push 9
mov eax, str.FontSize
push eax
call fcn.004064a7
mov edx, dword [0x4199cc]
push edx
push edx
mov eax, 0x4163e8
push eax
mov eax, str.Color
push eax
call fcn.004064e0
push 0x419514
call fcn.004131e0
mov edx, dword [0x4199cc]
push edx
push edx
mov edx, 0x41609a
push edx
call fcn.00413260
mov edx, dword [0x419514]
push edx
call fcn.00413260
mov edx, dword [0x417b40]
add dword [esp], edx
call fcn.004101b0
pop dword [0x4199cc]
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x4014f3
jl 0x4014ef
cmp ebx, 0xff
ja 0x4014f3
xor eax, eax
jmp 0x4014f8
mov eax, 1
or eax, eax
jne 0x40154e
mov edx, dword [0x4199cc]
push edx
push edx
mov edx, 0x41609a
push edx
call fcn.00413260
mov edx, dword [0x419514]
push edx
call fcn.00413260
mov edx, dword [0x417b40]
add dword [esp], edx
call fcn.004101b0
pop dword [0x4199cc]
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jl 0x401543
jg 0x40153f
cmp ebx, 1
jb 0x401543
xor eax, eax
jmp 0x401548
mov eax, 1
or eax, eax
jne 0x40154e
jmp 0x401555
mov eax, 1
jmp 0x401557
xor eax, eax
and eax, eax
je 0x40157c
mov edx, 0x4163e8
lea ecx, [0x419514]
call fcn.00405008
mov eax, 0x4163e8
push eax
mov eax, str.Color
push eax
call fcn.004065d4
mov edx, dword [0x4199cc]
push edx
push edx
mov eax, str.Consolas
push eax
mov eax, str.Font1
push eax
call fcn.004064e0
push 0x4194f0
call fcn.004131e0
mov edx, dword [0x4199cc]
push edx
push edx
mov eax, str.Segoe_UI
push eax
mov eax, str.Font2
push eax
call fcn.004064e0
push 0x4194fc
call fcn.004131e0
push 0
mov eax, str.WinM
push eax
call fcn.00406472
push eax
lea ebp, [0x419560]
pop dword [ebp]
push 0
call fcn.00413081
mov ebx, eax
add ebx, 0xfffffe20
mov eax, ebx
mov ecx, 2
cdq
idiv ecx
mov ebx, eax
push ebx
mov eax, str.WinX
push eax
call fcn.00406472
push eax
pop dword [ebp + 4]
push 0
call fcn.004130a4
mov ebx, eax
add ebx, 0xffffff2e
mov eax, ebx
mov ecx, 2
cdq
idiv ecx
mov ebx, eax
push ebx
mov eax, str.WinY
push eax
call fcn.00406472
push eax
pop dword [ebp + 8]
push 0x1e0
mov eax, str.WinW
push eax
call fcn.00406472
push eax
pop dword [ebp + 0xc]
push 0xd2
mov eax, str.WinH
push eax
call fcn.00406472
push eax
pop dword [ebp + 0x10]
call fcn.00406630
push 0
push 0
push 3
push 0xd2
push 0x1e0
push 0x419560
call fcn.00403f93
jmp 0x401731
mov dword [0x4194d8], 0
mov dword [0x4194ec], 9
mov edx, 0x4163e8
lea ecx, [0x419514]
call fcn.00405008
mov edx, str.Consolas
lea ecx, [0x4194f0]
call fcn.00405008
mov edx, str.Segoe_UI
lea ecx, [0x4194fc]
call fcn.00405008
mov ebx, dword [0x4194dc]
imul ebx, ebx, 0x12
add ebx, 0x7c
push ebx
lea ebp, [0x419560]
pop dword [ebp + 0x10]
mov dword [ebp + 0xc], 0x1e0
push 0
call fcn.00413081
mov ebx, eax
sub ebx, dword [ebp + 0xc]
mov eax, ebx
mov ecx, 2
cdq
idiv ecx
mov ebx, eax
mov dword [ebp + 4], ebx
push 0
call fcn.004130a4
mov ebx, eax
sub ebx, dword [ebp + 0x10]
mov eax, ebx
mov ecx, 2
cdq
idiv ecx
mov ebx, eax
mov dword [ebp + 8], ebx
mov dword [ebp], 0
push 0xcf0000
mov eax, str.ChkDskGui
push eax
lea ebp, [0x419560]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp + 4]
push 0
call fcn.0040a62b
mov dword [0x4194cc], eax
cmp dword [0x4194cc], 0
je 0x4028db
mov ebp, 0x4171c4
push ebp
push 0
call fcn.0040c770
mov ebp, 0x417642
push ebp
push 1
call fcn.0040c770
push 0x40000001
push 0x3c
mov eax, 0x4165c0
push eax
lea ebp, [0x419560]
mov ebx, dword [ebp + 0x10]
add ebx, 0xffffffa6
push ebx
mov ebx, dword [ebp + 0xc]
add ebx, 0xfffffff6
push ebx
push 5
push 5
push 0
call fcn.00407ac2
mov dword [0x419528], eax
call fcn.0040a398
mov ebx, eax
cmp ebx, 0x50
jl 0x401835
push dword [0x4194ec]
push dword [0x4194f0]
push 0
call fcn.00411017
and eax, eax
je 0x401804
push 0
call fcn.0041102d
push eax
push 0
call fcn.00408497
jmp 0x401833
push dword [0x4194ec]
mov eax, str.Courier_New
push eax
push 0
call fcn.00411017
and eax, eax
je 0x401833
push 0
call fcn.0041102d
push eax
push 0
call fcn.00408497
jmp 0x401864
push dword [0x4194ec]
mov eax, str.Courier_New
push eax
push 0
call fcn.00411017
and eax, eax
je 0x401864
push 0
call fcn.0041102d
push eax
push 0
call fcn.00408497
push 3
push 2
push 0
call fcn.00408506
push 0x32
mov eax, 0x416fb4
push eax
push 1
push 0
call fcn.00408531
push 0x34
mov eax, 0x416ecc
push eax
push 2
push 0
call fcn.00408531
push 0x7d
mov eax, 0x416c28
push eax
push 3
push 0
call fcn.00408531
push 0x37
mov eax, str._FS_
push eax
push 4
push 0
call fcn.00408531
push 0x64
mov eax, 0x416ae6
push eax
push 5
push 0
call fcn.00408531
push dword [0x419574]
call fcn.0040cd3f
push dword [0x419574]
call fcn.0040cd54
or eax, eax
je 0x4019a5
mov edx, dword [0x4199cc]
push edx
push edx
push 3
push 0xa
mov ebp, dword [0x419578]
push dword [ebp + 8]
call fcn.004102f0
add dword [0x4199cc], 2
mov edx, 0x417044
pop ecx
mov dword [0x4199cc], ecx
add ecx, dword [0x417b40]
call fcn.00405110
je 0x40197d
push 0
call fcn.0040c787
push eax
mov ebp, dword [0x419578]
push dword [ebp + 8]
push 0xffffffff
push 0
call fcn.0040856c
jmp 0x4019a0
push 1
call fcn.0040c787
push eax
mov ebp, dword [0x419578]
push dword [ebp + 8]
push 0xffffffff
push 0
call fcn.0040856c
jmp 0x401905
push dword [0x419574]
call fcn.0040cd88
call fcn.00403749
push dword [0x4194ec]
push dword [0x4194fc]
push 1
call fcn.00411017
and eax, eax
je 0x4019e4
push 1
call fcn.0041102d
push eax
push 0xffffffff
call fcn.00408497
mov eax, str.F______
push eax
push 0x14
lea ebp, [0x419560]
mov ebx, dword [ebp + 0xc]
add ebx, 0xffffff42
push ebx
mov ebx, dword [ebp + 0x10]
add ebx, 0xffffffb0
push ebx
push 0xa
push 1
call fcn.00408816
push 1
push 1
call fcn.00408875
mov eax, str.R_____
push eax
push 0x14
mov ebx, dword [ebp + 0xc]
add ebx, 0xffffff42
push ebx
mov ebx, dword [ebp + 0x10]
add ebx, 0xffffffc4
push ebx
push 0xa
push 2
call fcn.00408816
mov eax, str.X_____
push eax
push 0x14
mov ebx, dword [ebp + 0xc]
add ebx, 0xffffff42
push ebx
mov ebx, dword [ebp + 0x10]
add ebx, 0xffffffd8
push ebx
push 0xa
push 3
call fcn.00408816
push 1
push 3
call fcn.00408875
push 0xff0000
mov eax, 0x416026
push eax
push 0x11
mov ebx, dword [ebp + 0xc]
add ebx, 0xffffff38
push ebx
mov ebx, dword [ebp + 0x10]
add ebx, 0xffffffef
push ebx
push 0x14
push 4
call fcn.00408e60
mov eax, 0x416ed8
push eax
push 0x14
push 0xaa
mov ebx, dword [ebp + 0x10]
add ebx, 0xffffffb0
push ebx
mov ebx, dword [ebp + 0xc]
add ebx, 0xffffff4d
push ebx
push 8
call fcn.00408816
mov ebx, dword [0x4194ec]
add ebx, 3
push ebx
push dword [0x4194fc]
push 2
call fcn.00411017
and eax, eax
je 0x401b17
push 2
call fcn.0041102d
push eax
push 0xffffffff
call fcn.00408497
mov eax, 0x4166c8
push eax
push 0x18
push 0x18
lea ebp, [0x419560]
mov ebx, dword [ebp + 0x10]
add ebx, 0xffffffcc
push ebx
mov ebx, dword [ebp + 0xc]
add ebx, 0xffffff77
push ebx
push 5
call fcn.00409052
mov eax, 0x41640c
push eax
push 0x2a
push 0x64
mov ebx, dword [ebp + 0x10]
add ebx, 0xffffffcc
push ebx
mov ebx, dword [ebp + 0xc]
add ebx, 0xffffff92
push ebx
push 6
call fcn.00409052
mov edx, dword [0x4199cc]
push edx
push edx
mov edx, str.chkdsk.exe
push edx
call fcn.00413260
mov edx, dword [0x4194e8]
push edx
call fcn.00413260
push dword [0x4199cc]
call fcn.00402a62
pop eax
add dword [0x4199cc], 2
push 4
mov edx, dword [0x417b40]
add dword [esp + 4], edx
call fcn.00409095
pop dword [0x4199cc]
push 0xffffffff
push 0
push 0x12c
mov eax, 0x416418
push eax
push 4
call fcn.004037bb
push 0xffffffff
push 0
push 0x12c
mov eax, 0x4169b8
push eax
push 5
call fcn.004037bb
push 0xffffffff
push 0
push 0x12c
mov eax, 0x416a94
push eax
push 6
call fcn.004037bb
push 0xffffffff
push 0
push 0x12c
mov eax, 0x416fc0
push eax
push 8
call fcn.004037bb
push 0
call fcn.00406bba
and eax, eax
je 0x401d0a
mov eax, 0x416928
push eax
call fcn.00406cc8
mov eax, 0x416462
push eax
push 1
call fcn.00406d7f
mov eax, 0x4166a4
push eax
push 2
call fcn.00406d7f
mov eax, 0x416f36
push eax
push 8
call fcn.00406d7f
call fcn.00406d91
mov eax, 0x416696
push eax
call fcn.00406cc8
mov eax, 0x4167be
push eax
push 6
call fcn.00406d7f
mov eax, 0x41626a
push eax
push 4
call fcn.00406d7f
mov eax, str.eventvwr.exe__
push eax
push 3
call fcn.00406d7f
mov eax, 0x416032
push eax
push 0xa
call fcn.00406d7f
call fcn.00406d91
mov eax, 0x416978
push eax
push 9
call fcn.00406d7f
mov eax, 0x416f5c
push eax
push 5
call fcn.00406d7f
mov eax, 0x416954
push eax
push 7
call fcn.00406d7f
mov edx, dword [0x4199cc]
push edx
push edx
mov edx, dword [0x4199cc]
push edx
push edx
push dword [0x4199cc]
call fcn.0040564c
mov edx, dword [0x417b40]
add dword [esp], edx
call fcn.00411300
mov edx, str.ChkDskGui.chm
push edx
call fcn.00413260
mov edx, dword [0x417b40]
add dword [esp], edx
call fcn.004111b6
pop dword [0x4199cc]
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jl 0x401d66
jg 0x401d62
cmp ebx, 1
jb 0x401d66
xor eax, eax
jmp 0x401d6b
mov eax, 1
or eax, eax
je 0x401d84
mov eax, 0x416a10
push eax
push 7
push 0
call fcn.00406db5
call sub.SETUPAPI.DLL_IsUserAdmin
and eax, eax
je 0x401d91
xor eax, eax
jmp 0x401d96
mov eax, 1
and eax, eax
je 0x401dec
mov eax, 0x416d7e
push eax
push 6
push 0
call fcn.00406db5
push 1
push 6
push 0
call fcn.00406eaa
mov eax, 0x416b6c
push eax
push 0xa
push 0
call fcn.00406db5
push 1
push 0xa
push 0
call fcn.00406eaa
lea eax, [0x4032f2]
push eax
call fcn.0040a977
lea ebp, [0x419560]
cmp dword [ebp], 0
je 0x401e13
push 0x1000000
push 0
call fcn.0040a98c
call fcn.00405812
mov dword [0x419524], eax
cmp dword [0x419524], 0
je 0x401ed3
mov edx, dword [0x4199cc]
push edx
push edx
push 2
mov edx, dword [0x4199cc]
push edx
push edx
call fcn.00405826
mov edx, dword [0x417b40]
add dword [esp], edx
call fcn.00410140
push 0x419530
call fcn.004131e0
mov dword [0x4194f4], 0
jmp 0x401e68
push 0
call fcn.004090e0
mov ebx, eax
dec ebx
cmp ebx, dword [0x4194f4]
jl 0x401ed3
mov edx, dword [0x4199cc]
push edx
push edx
push dword [0x4194f4]
push 0
call fcn.00409143
add dword [0x4199cc], 2
mov edx, dword [0x419530]
pop ecx
mov dword [0x4199cc], ecx
add ecx, dword [0x417b40]
call fcn.00405110
je 0x401ecb
push 2
push dword [0x4194f4]
push 0
call fcn.00409159
inc dword [0x4194f4]
jno 0x401e68
call fcn.0040ab32
push eax
mov ebx, 0x3337
cmp ebx, dword [esp]
jne 0x401efd
push 0
call fcn.0040ab3a
push eax
push 0
call fcn.00406ed6
jmp 0x4028d5
mov ebx, 0x3335
cmp ebx, dword [esp]
jne 0x401f19
lea ebp, [0x419560]
mov dword [ebp], 0
jmp 0x4028d5
mov ebx, 0x3334
cmp ebx, dword [esp]
jne 0x401f35
lea ebp, [0x419560]
mov dword [ebp], 1
jmp 0x4028d5
mov ebx, 0x332c
cmp ebx, dword [esp]
jne 0x402354
call fcn.00411b44
push eax
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x40200b
mov dword [0x4194f4], 0
jmp 0x401f60
push 0
call fcn.004090e0
mov ebx, eax
dec ebx
cmp ebx, dword [0x4194f4]
jl 0x401fba
push dword [0x4194f4]
push 0
call fcn.00409195
mov ebx, eax
and ebx, 1
and ebx, ebx
je 0x401fb2
mov edx, dword [0x4199cc]
push edx
push edx
push dword [0x4194f4]
push 0
call fcn.00409143
push 0x4194e8
call fcn.004131e0
jmp 0x401fba
inc dword [0x4194f4]
jno 0x401f60
mov edx, dword [0x4199cc]
push edx
push edx
mov edx, str.chkdsk.exe
push edx
call fcn.00413260
mov edx, dword [0x4194e8]
push edx
call fcn.00413260
push dword [0x4199cc]
call fcn.00402a62
pop eax
add dword [0x4199cc], 2
push 4
mov edx, dword [0x417b40]
add dword [esp + 4], edx
call fcn.00409095
pop dword [0x4199cc]
jmp 0x40234e
mov ebx, 1
cmp ebx, dword [esp]
jne 0x402094
push 1
call fcn.004091c6
mov ebx, eax
and ebx, ebx
jne 0x402043
push 0
push 2
call fcn.00408875
push 0
push 3
call fcn.00408875
mov edx, dword [0x4199cc]
push edx
push edx
mov edx, str.chkdsk.exe
push edx
call fcn.00413260
mov edx, dword [0x4194e8]
push edx
call fcn.00413260
push dword [0x4199cc]
call fcn.00402a62
pop eax
add dword [0x4199cc], 2
push 4
mov edx, dword [0x417b40]
add dword [esp + 4], edx
call fcn.00409095
pop dword [0x4199cc]
jmp 0x40234e
mov ebx, 2
cmp ebx, dword [esp]
jne 0x4020fe
push 1
push 1
call fcn.00408875
mov edx, dword [0x4199cc]
push edx
push edx
mov edx, str.chkdsk.exe
push edx
call fcn.00413260
mov edx, dword [0x4194e8]
push edx
call fcn.00413260
push dword [0x4199cc]
call fcn.00402a62
pop eax
add dword [0x4199cc], 2
push 4
mov edx, dword [0x417b40]
add dword [esp + 4], edx
call fcn.00409095
pop dword [0x4199cc]
jmp 0x40234e
mov ebx, 3
cmp ebx, dword [esp]
jne 0x402179
push 3
call fcn.004091c6
mov ebx, eax
cmp ebx, 1
jne 0x402128
push 1
push 1
call fcn.00408875
mov edx, dword [0x4199cc]
push edx
push edx
mov edx, str.chkdsk.exe
push edx
call fcn.00413260
mov edx, dword [0x4194e8]
push edx
call fcn.00413260
push dword [0x4199cc]
call fcn.00402a62
pop eax
add dword [0x4199cc], 2
push 4
mov edx, dword [0x417b40]
add dword [esp + 4], edx
call fcn.00409095
pop dword [0x4199cc]
jmp 0x40234e
mov ebx, 4
cmp ebx, dword [esp]
jne 0x4021dd
push dword [0x4199cc]
mov edx, dword [0x4194e4]
push dword [0x4199cc]
push edx
call fcn.00413260
mov edx, str.__c__
push edx
call fcn.00413260
mov edx, dword [0x4199cc]
push edx
push edx
push 4
call fcn.004091f3
pop eax
mov edx, str.__Pause_
push edx
call fcn.00413260
mov edx, dword [0x417b40]
add dword [esp], edx
call fcn.004130d8
pop dword [0x4199cc]
jmp 0x40234e
mov ebx, 5
cmp ebx, dword [esp]
jne 0x402201
push 0
call fcn.0040ab3a
push eax
push 0
call fcn.00406ed6
jmp 0x40234e
mov ebx, 6
cmp ebx, dword [esp]
jne 0x4022e0
push dword [0x4199cc]
push 0
call fcn.00403b34
push 0x41952c
call fcn.004131e0
mov edx, dword [0x41952c]
xor ecx, ecx
call fcn.00405110
jne 0x40223f
mov eax, 1
jmp 0x402241
xor eax, eax
and eax, eax
je 0x402249
xor eax, eax
jmp 0x40224e
mov eax, 1
and eax, eax
je 0x40225a
add esp, 8
jmp 0x4028d6
mov edx, dword [0x4199cc]
push edx
push edx
mov edx, dword [0x4199cc]
push edx
push edx
push dword [0x4199cc]
call fcn.0040564c
mov edx, dword [0x417b40]
add dword [esp], edx
call fcn.00411300
add dword [0x4199cc], 2
push dword [0x4199cc]
mov edx, str._c__
push edx
call fcn.00413260
mov edx, dword [0x41952c]
push edx
call fcn.00413260
mov edx, str._set__p_Ok___
push edx
call fcn.00413260
add dword [0x4199cc], 2
push dword [0x4194e4]
mov edx, dword [0x417b40]
add dword [esp + 4], edx
mov edx, dword [0x417b40]
add dword [esp + 8], edx
call fcn.0040589e
pop dword [0x4199cc]
jmp 0x40234e
mov ebx, 8
cmp ebx, dword [esp]
jne 0x40234e
mov dword [0x419524], 0
push 8
call fcn.004091c6
mov ebx, eax
cmp ebx, 1
jne 0x40230f
mov dword [0x419524], 2
mov dword [0x4194f4], 0
jmp 0x40231b
push 0
call fcn.004090e0
mov ebx, eax
dec ebx
cmp ebx, dword [0x4194f4]
jl 0x40234e
push dword [0x419524]
push dword [0x4194f4]
push 0
call fcn.00409159
inc dword [0x4194f4]
jno 0x40231b
pop eax
jmp 0x4028d5
mov ebx, 0x332d
cmp ebx, dword [esp]
jne 0x4028c4
call fcn.00411b53
push eax
mov ebx, 1
cmp ebx, dword [esp]
jne 0x402381
push 1
call fcn.0040433e
jmp 0x4028c1
mov ebx, 2
cmp ebx, dword [esp]
jne 0x40239a
push 2
call fcn.0040433e
jmp 0x4028c1
mov ebx, 3
cmp ebx, dword [esp]
jne 0x4023bf
mov eax, str.eventvwr.exe
push eax
call fcn.00405dfd
mov eax, str.Wininit
push eax
call fcn.004130d8
jmp 0x4028c1
mov ebx, 4
cmp ebx, dword [esp]
jne 0x4023d9
mov eax, 0x416dd4
push eax
call fcn.00402db0
jmp 0x4028c1
mov ebx, 5
cmp ebx, dword [esp]
jne 0x4023ed
call fcn.00404504
jmp 0x4028c1
mov ebx, 6
cmp ebx, dword [esp]
jne 0x402671
mov dword [0x4194d4], 0
mov edx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZ
lea ecx, [0x4194d0]
call fcn.00405008
mov dword [0x4194f4], 0
jmp 0x402421
push 0
call fcn.004090e0
mov ebx, eax
dec ebx
cmp ebx, dword [0x4194f4]
jl 0x4024cc
push dword [0x4194f4]
push 0
call fcn.00409195
mov ebx, eax
and ebx, 2
and ebx, ebx
je 0x4024c0
mov edx, dword [0x4199cc]
push edx
push edx
mov eax, 0x416026
push eax
mov edx, dword [0x4199cc]
push edx
push edx
push 1
mov edx, dword [0x4199cc]
push edx
push edx
push dword [0x4194f4]
push 0
call fcn.00409143
mov edx, dword [0x417b40]
add dword [esp], edx
call fcn.00410140
add dword [0x4199cc], 2
push dword [0x4194d0]
mov edx, dword [0x417b40]
add dword [esp + 4], edx
call fcn.004106c0
push 0x4194d0
call fcn.004131e0
inc dword [0x4194d4]
inc dword [0x4194f4]
jno 0x402421
cmp dword [0x4194d4], 0
je 0x4024d9
xor eax, eax
jmp 0x4024de
mov eax, 1
and eax, eax
je 0x4024ff
call sub.SETUPAPI.DLL_IsUserAdmin
and eax, eax
je 0x4024ef
xor eax, eax
jmp 0x4024f4
mov eax, 1
and eax, eax
je 0x4024ff
mov eax, 1
jmp 0x402501
xor eax, eax
and eax, eax
je 0x402520
mov eax, 0x4162c8
push eax
mov eax, 0x41659a
push eax
call fcn.00405473
add esp, 8
jmp 0x4028d6
call sub.SETUPAPI.DLL_IsUserAdmin
and eax, eax
je 0x40252d
xor eax, eax
jmp 0x402532
mov eax, 1
and eax, eax
je 0x402551
mov eax, 0x416b00
push eax
mov eax, 0x41659a
push eax
call fcn.00405473
add esp, 8
jmp 0x4028d6
cmp dword [0x4194d4], 0
je 0x40255e
xor eax, eax
jmp 0x402563
mov eax, 1
and eax, eax
je 0x402580
mov eax, 0x4169ea
push eax
mov eax, 0x41659a
push eax
call fcn.00405473
add esp, 8
jmp 0x4028d6
push 0x419510
push 0x20006
push 0
mov eax, str.SYSTEMCurrentControlSetControlSession_Manager
push eax
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExW
mov ebx, eax
and ebx, ebx
jne 0x40265b
push dword [0x4199cc]
mov edx, str.autocheck_autochk__p__K:
push edx
call fcn.00413260
mov edx, dword [0x4194d0]
push edx
call fcn.00413260
mov edx, 0x41602c
push edx
call fcn.00413260
push 0x4194f8
call fcn.004131e0
push 0x19
push dword [0x4194f8]
call fcn.004106e0
push eax
mov eax, dword [0x4194f8]
push eax
push 2
push 0
mov eax, str.BootExecute
push eax
push dword [0x419510]
call sub.ADVAPI32.DLL_RegSetValueExW
push dword [0x419510]
call sub.ADVAPI32.DLL_RegCloseKey
mov edx, dword [0x4199cc]
push edx
push edx
mov edx, 0x416646
push edx
call fcn.00413260
mov edx, dword [0x4194f8]
push edx
call fcn.00413260
add dword [0x4199cc], 2
mov eax, 0x41659a
push eax
mov edx, dword [0x417b40]
add dword [esp + 4], edx
call fcn.00405473
pop dword [0x4199cc]
jmp 0x40266c
mov eax, 0x417120
push eax
mov eax, 0x41659a
push eax
call fcn.00405473
jmp 0x4028c1
mov ebx, 7
cmp ebx, dword [esp]
jne 0x40276a
mov edx, dword [0x4199cc]
push edx
push edx
mov edx, dword [0x4199cc]
push edx
push edx
call fcn.0040564c
mov edx, dword [0x417b40]
add dword [esp], edx
call fcn.00411300
mov edx, str.ChkDskGui.chm
push edx
call fcn.00413260
push 0x41952c
call fcn.004131e0
push dword [0x41952c]
call fcn.004111b6
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x4026d6
jl 0x4026d2
cmp ebx, 0xb
ja 0x4026d6
xor eax, eax
jmp 0x4026db
mov eax, 1
or eax, eax
je 0x40275a
mov edx, dword [0x4199cc]
push edx
push edx
mov edx, dword [0x4199cc]
push edx
push edx
push dword [0x4199cc]
call fcn.0040564c
mov edx, dword [0x417b40]
add dword [esp], edx
call fcn.00411300
add dword [0x4199cc], 2
mov edx, dword [0x41952c]
push dword [0x4199cc]
push edx
call fcn.00413260
mov edx, str.::_html_control.htm
push edx
call fcn.00413260
add dword [0x4199cc], 2
mov eax, 0x41608c
push eax
mov edx, dword [0x417b40]
add dword [esp + 4], edx
mov edx, dword [0x417b40]
add dword [esp + 8], edx
call fcn.0040589e
pop dword [0x4199cc]
jmp 0x402765
mov eax, str.https:__yadi.sk_d_XFgMC4xByJKRiA
push eax
call fcn.00405dfd
jmp 0x4028c1
mov ebx, 8
cmp ebx, dword [esp]
jne 0x40283e
push dword [0x4199cc]
push 3
call fcn.00403b34
push 0x41952c
call fcn.004131e0
mov edx, dword [0x41952c]
xor ecx, ecx
call fcn.00405110
jne 0x4027a8
mov eax, 1
jmp 0x4027aa
xor eax, eax
and eax, eax
je 0x4027b2
xor eax, eax
jmp 0x4027b7
mov eax, 1
and eax, eax
je 0x4027c3
add esp, 8
jmp 0x4028d6
mov edx, dword [0x41952c]
push dword [0x4199cc]
push edx
call fcn.00413260
mov edx, str.set__p_Ok__
push edx
call fcn.00413260
push 0x41952c
call fcn.004131e0
mov edx, dword [0x4199cc]
push edx
push edx
mov eax, 0x416e5c
push eax
mov eax, 0x41609e
push eax
push dword [0x41952c]
call fcn.004106c0
push 0x41952c
call fcn.004131e0
push dword [0x4199cc]
push dword [0x41952c]
call fcn.00402f92
push 0x41952c
call fcn.004131e0
push dword [0x41952c]
call fcn.004130d8
jmp 0x4028c1
mov ebx, 9
cmp ebx, dword [esp]
jne 0x4028b2
push dword [0x41950c]
call fcn.004111b6
push edx
push eax
pop ebx
pop edi
cmp ebx, 0xffffffff
jne 0x402865
cmp edi, 0xffffffff
jne 0x402865
xor eax, eax
jmp 0x40286a
mov eax, 1
or eax, eax
je 0x402890
push 0x124
mov eax, 0x416d5a
push eax
mov eax, 0x41659a
push eax
call fcn.00405442
mov ebx, eax
cmp ebx, 7
jne 0x402890
add esp, 8
jmp 0x4028d6
mov ebp, 0x417b40
mov ebx, ebp
mov ebp, 0x417ac0
sub ebx, ebp
push ebx
mov ebp, 0x417ac0
push ebp
push dword [0x41950c]
call fcn.0040293c
jmp 0x4028c1
mov ebx, 0xa
cmp ebx, dword [esp]
jne 0x4028c1
call fcn.00402b45
pop eax
jmp 0x4028d5
mov ebx, 0x333c
cmp ebx, dword [esp]
jne 0x4028d5
call fcn.004036c8
jmp 0x4028db
pop eax
jmp 0x401ed3
push 0
call 0x4028fa
call fcn.004131b0
push dword [0x4194c4]
call sub.KERNEL32.dll_HeapDestroy
call sub.KERNEL32.dll_ExitProcess
call fcn.00405f31
call fcn.00406fcf
call fcn.0040a59d
call fcn.0040c2b3
call fcn.0040c5e5
call fcn.0040feb0
call fcn.0041108a
call fcn.0041143c
call fcn.00411570
call fcn.00411a09
call fcn.004125d5
call fcn.004130c7
call fcn.00410be0
ret