Function at 0x4b9a97
Capabilities:
Persist via run registry key
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x574889
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x41964
call fcn.005374e0
mov dword [ebp - 0x41964], ecx
push 0x800
push 0
lea eax, [ebp - 0x810]
push eax
call fcn.005370b0
add esp, 0xc
mov ecx, dword [ebp - 0x41964]
mov edx, dword [ecx + 0x138]
mov dword [ebp - 0x41894], edx
mov eax, dword [ebp - 0x41894]
push eax
push 1
push 0x5b89ac
push 0x5b89bc
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp - 0x41964]
mov dword [ecx + 0x58c], eax
mov edx, dword [ebp - 0x41964]
mov eax, dword [edx + 0x138]
mov dword [ebp - 0x41898], eax
mov ecx, dword [ebp - 0x41898]
push ecx
push 1
push 0x5b89dc
push 0x5b89f8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edx, dword [ebp - 0x41964]
mov dword [edx + 0x590], eax
mov eax, dword [ebp - 0x41964]
mov ecx, dword [eax + 0x138]
mov dword [ebp - 0x4189c], ecx
mov edx, dword [ebp - 0x4189c]
push edx
push 1
push 0x5b8a18
push 0x5b8a34
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp - 0x41964]
mov dword [ecx + 0x594], eax
mov edx, dword [ebp - 0x41964]
mov eax, dword [edx + 0x138]
mov dword [ebp - 0x418a0], eax
mov ecx, dword [ebp - 0x418a0]
push ecx
push 1
push 0x5b8a54
push 0x5b8a70
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edx, dword [ebp - 0x41964]
mov dword [edx + 0x598], eax
mov eax, dword [ebp - 0x41964]
mov ecx, dword [eax + 0x138]
mov dword [ebp - 0x418a4], ecx
mov edx, dword [ebp - 0x418a4]
push edx
push 1
push 0x5b8a90
push 0x5b8aac
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp - 0x41964]
mov dword [ecx + 0x59c], eax
mov edx, dword [ebp - 0x41964]
mov eax, dword [edx + 0x138]
mov dword [ebp - 0x418a8], eax
mov ecx, dword [ebp - 0x418a8]
push ecx
push 1
push 0x5b8acc
push 0x5b8ae4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edx, dword [ebp - 0x41964]
mov dword [edx + 0x5a0], eax
mov eax, dword [ebp - 0x41964]
mov ecx, dword [eax + 0x138]
mov dword [ebp - 0x418ac], ecx
mov edx, dword [ebp - 0x418ac]
push edx
push 1
push 0x5b8b04
push 0x5b8b18
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp - 0x41964]
mov dword [ecx + 0x5a4], eax
mov edx, dword [ebp - 0x41964]
mov eax, dword [edx + 0x138]
mov dword [ebp - 0x418b0], eax
mov ecx, dword [ebp - 0x418b0]
push ecx
push 1
push 0x5b8b38
push 0x5b8b54
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edx, dword [ebp - 0x41964]
mov dword [edx + 0x5a8], eax
mov eax, dword [ebp - 0x41964]
mov ecx, dword [eax + 0x138]
mov dword [ebp - 0x418b4], ecx
mov edx, dword [ebp - 0x418b4]
push edx
push 1
push 0x5b8b74
push 0x5b8b8c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp - 0x41964]
mov dword [ecx + 0x5ac], eax
mov edx, dword [ebp - 0x41964]
mov eax, dword [edx + 0x138]
mov dword [ebp - 0x418b8], eax
mov ecx, dword [ebp - 0x418b8]
push ecx
push 1
push 0x5b8bac
push 0x5b8bc4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edx, dword [ebp - 0x41964]
mov dword [edx + 0x5b0], eax
mov eax, dword [ebp - 0x41964]
mov ecx, dword [eax + 0x138]
mov dword [ebp - 0x418bc], ecx
mov edx, dword [ebp - 0x418bc]
push edx
push 1
push 0x5b8be4
push 0x5b8c00
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp - 0x41964]
mov dword [ecx + 0x5b4], eax
mov edx, dword [ebp - 0x41964]
mov eax, dword [edx + 0x138]
mov dword [ebp - 0x418c0], eax
mov ecx, dword [ebp - 0x418c0]
push ecx
push 1
push 0x5b8c20
push 0x5b8c34
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edx, dword [ebp - 0x41964]
mov dword [edx + 0x5b8], eax
mov eax, dword [ebp - 0x41964]
mov ecx, dword [eax + 0x138]
mov dword [ebp - 0x418c4], ecx
mov edx, dword [ebp - 0x418c4]
push edx
push 1
push 0x5b8c54
push 0x5b8c6c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp - 0x41964]
mov dword [ecx + 0x5bc], eax
mov edx, dword [ebp - 0x41964]
mov eax, dword [edx + 0x138]
mov dword [ebp - 0x418c8], eax
mov ecx, dword [ebp - 0x418c8]
push ecx
push 1
push 0x5b8c8c
push 0x5b8ca4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edx, dword [ebp - 0x41964]
mov dword [edx + 0x5c0], eax
mov eax, dword [ebp - 0x41964]
mov ecx, dword [eax + 0x138]
mov dword [ebp - 0x418cc], ecx
mov edx, dword [ebp - 0x418cc]
push edx
push 1
push 0x5b8cc4
push 0x5b8cd8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp - 0x41964]
mov dword [ecx + 0x5c4], eax
mov edx, dword [ebp - 0x41964]
mov eax, dword [edx + 0x138]
mov dword [ebp - 0x418d0], eax
mov ecx, dword [ebp - 0x418d0]
push ecx
push 0
push 0x5b8cf8
push 0x5b8d18
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edx, dword [ebp - 0x41964]
mov dword [edx + 0x188], eax
mov eax, dword [ebp - 0x41964]
mov ecx, dword [eax + 0x138]
mov dword [ebp - 0x418d4], ecx
mov edx, dword [ebp - 0x418d4]
push edx
push 0
push 0x5b8d3c
push 0x5b8d54
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp - 0x41964]
mov dword [ecx + 0x18c], eax
mov edx, dword [ebp - 0x41964]
mov eax, dword [edx + 0x138]
mov dword [ebp - 0x418d8], eax
mov ecx, dword [ebp - 0x418d8]
push ecx
push 0
push 0x5b8d78
push 0x5b8d90
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edx, dword [ebp - 0x41964]
mov dword [edx + 0x190], eax
mov eax, dword [ebp - 0x41964]
mov ecx, dword [eax + 0x138]
mov dword [ebp - 0x418dc], ecx
mov edx, dword [ebp - 0x418dc]
push edx
push 0
push 0x5b8db4
push 0x5b8dc4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp - 0x41964]
mov dword [ecx + 0x194], eax
lea ecx, [ebp - 0x41880]
call fcn.004e70a0
mov dword [ebp - 4], 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
lea ecx, [ebp - 0x41884]
call fcn.0054d39c
mov byte [ebp - 4], 1
push 1
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x41888], esp
lea edx, [ebp - 0x41884]
push edx
call fcn.0054d095
mov dword [ebp - 0x41968], eax
push SysReAllocStringLen
lea ecx, [ebp - 0x41880]
call fcn.004e75e4
push ecx
mov ecx, esp
mov dword [ebp - 0x4188c], esp
push 0x5b8e44
call fcn.0054d39c
mov dword [ebp - 0x4196c], eax
lea ecx, [ebp - 0x41880]
call fcn.004e88fa
mov dword [ebp - 0x41970], eax
mov eax, dword [ebp - 0x41964]
mov ecx, dword [ebp - 0x41970]
mov dword [eax + 0x194], ecx
lea edx, [ebp - 0x10]
push edx
call fcn.0054aedf
mov eax, dword [ebp - 0x41964]
mov ecx, dword [eax + 0x138]
mov dword [ebp - 0x418e0], ecx
push 0x5b8e4c
lea edx, [ebp - 0x41890]
push edx
lea ecx, [ebp - 0x10]
call fcn.0054afca
mov dword [ebp - 0x418e4], eax
mov eax, dword [ebp - 0x418e4]
mov ecx, dword [eax]
mov dword [ebp - 0x418e8], ecx
mov edx, dword [ebp - 0x418e0]
push edx
push 0x800
lea eax, [ebp - 0x810]
push eax
mov ecx, dword [ebp - 0x418e8]
push ecx
push 0x5b8e5c
push 0x5b8e78
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x41890]
call fcn.0054d328
lea edx, [ebp - 0x810]
push edx
mov ecx, dword [ebp - 0x41964]
add ecx, 0x50c
call fcn.0054d4bf
mov eax, dword [ebp - 0x41964]
mov ecx, dword [eax + 0x138]
mov dword [ebp - 0x418ec], ecx
mov edx, dword [ebp - 0x418ec]
push edx
push 0
push 0x5b8e88
push 0x5b8e98
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp - 0x41964]
mov dword [ecx + 0x510], eax
mov edx, dword [ebp - 0x41964]
mov eax, dword [edx + 0x138]
mov dword [ebp - 0x418f0], eax
mov ecx, dword [ebp - 0x418f0]
push ecx
push 0
push 0x5b8ea8
push 0x5b8eb8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edx, dword [ebp - 0x41964]
mov dword [edx + 0x514], eax
mov eax, dword [ebp - 0x41964]
mov ecx, dword [eax + 0x138]
mov dword [ebp - 0x418f4], ecx
mov edx, dword [ebp - 0x418f4]
push edx
push 0
push 0x5b8ec8
push 0x5b8ed8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp - 0x41964]
mov dword [ecx + 0x518], eax
mov edx, dword [ebp - 0x41964]
mov eax, dword [edx + 0x138]
mov dword [ebp - 0x418f8], eax
mov ecx, dword [ebp - 0x418f8]
push ecx
push 0
push 0x5b8ee8
push 0x5b8ef8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edx, dword [ebp - 0x41964]
mov dword [edx + 0x51c], eax
mov eax, dword [ebp - 0x41964]
mov ecx, dword [eax + 0x138]
mov dword [ebp - 0x418fc], ecx
mov edx, dword [ebp - 0x418fc]
push edx
push 0
push 0x5b8f08
push 0x5b8f18
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp - 0x41964]
mov dword [ecx + 0x520], eax
mov edx, dword [ebp - 0x41964]
mov eax, dword [edx + 0x138]
mov dword [ebp - 0x41900], eax
mov ecx, dword [ebp - 0x41900]
push ecx
push 0
push 0x5b8f28
push 0x5b8f38
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edx, dword [ebp - 0x41964]
mov dword [edx + 0x524], eax
mov eax, dword [ebp - 0x41964]
mov ecx, dword [eax + 0x138]
mov dword [ebp - 0x41904], ecx
mov edx, dword [ebp - 0x41904]
push edx
push 0
push 0x5b8f48
push 0x5b8f58
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp - 0x41964]
mov dword [ecx + 0x528], eax
mov edx, dword [ebp - 0x41964]
mov eax, dword [edx + 0x138]
mov dword [ebp - 0x41908], eax
mov ecx, dword [ebp - 0x41908]
push ecx
push 0
push 0x5b8f68
push 0x5b8f78
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edx, dword [ebp - 0x41964]
mov dword [edx + 0x52c], eax
mov eax, dword [ebp - 0x41964]
mov ecx, dword [eax + 0x138]
mov dword [ebp - 0x4190c], ecx
mov edx, dword [ebp - 0x4190c]
push edx
push 0
push 0x5b8f88
push 0x5b8f98
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp - 0x41964]
mov dword [ecx + 0x530], eax
mov edx, dword [ebp - 0x41964]
mov eax, dword [edx + 0x138]
mov dword [ebp - 0x41910], eax
mov ecx, dword [ebp - 0x41910]
push ecx
push 0
push 0x5b8fa8
push 0x5b8fb8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edx, dword [ebp - 0x41964]
mov dword [edx + 0x534], eax
mov eax, dword [ebp - 0x41964]
mov ecx, dword [eax + 0x138]
mov dword [ebp - 0x41914], ecx
mov edx, dword [ebp - 0x41914]
push edx
push 0
push 0x5b8fc8
push 0x5b8fd8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp - 0x41964]
mov dword [ecx + 0x538], eax
mov edx, dword [ebp - 0x41964]
mov eax, dword [edx + 0x138]
mov dword [ebp - 0x41918], eax
mov ecx, dword [ebp - 0x41918]
push ecx
push 0
push 0x5b8fe8
push 0x5b8ff8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edx, dword [ebp - 0x41964]
mov dword [edx + 0x53c], eax
mov eax, dword [ebp - 0x41964]
mov ecx, dword [eax + 0x138]
mov dword [ebp - 0x4191c], ecx
mov edx, dword [ebp - 0x4191c]
push edx
push 0
push 0x5b9008
push 0x5b9018
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp - 0x41964]
mov dword [ecx + 0x540], eax
mov edx, dword [ebp - 0x41964]
mov eax, dword [edx + 0x138]
mov dword [ebp - 0x41920], eax
mov ecx, dword [ebp - 0x41920]
push ecx
push 0
push 0x5b9028
push 0x5b9038
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edx, dword [ebp - 0x41964]
mov dword [edx + 0x544], eax
mov eax, dword [ebp - 0x41964]
mov ecx, dword [eax + 0x138]
mov dword [ebp - 0x41924], ecx
mov edx, dword [ebp - 0x41924]
push edx
push 0
push 0x5b9048
push 0x5b9058
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp - 0x41964]
mov dword [ecx + 0x548], eax
mov edx, dword [ebp - 0x41964]
mov eax, dword [edx + 0x138]
mov dword [ebp - 0x41928], eax
mov ecx, dword [ebp - 0x41928]
push ecx
push 0
push 0x5b9068
push 0x5b907c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edx, dword [ebp - 0x41964]
mov dword [edx + 0x54c], eax
mov eax, dword [ebp - 0x41964]
mov ecx, dword [eax + 0x138]
mov dword [ebp - 0x4192c], ecx
mov edx, dword [ebp - 0x4192c]
push edx
push 0
push 0x5b908c
push 0x5b90a0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp - 0x41964]
mov dword [ecx + 0x550], eax
mov edx, dword [ebp - 0x41964]
mov eax, dword [edx + 0x138]
mov dword [ebp - 0x41930], eax
mov ecx, dword [ebp - 0x41930]
push ecx
push 0
push 0x5b90b0
push 0x5b90c4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edx, dword [ebp - 0x41964]
mov dword [edx + 0x554], eax
mov eax, dword [ebp - 0x41964]
mov ecx, dword [eax + 0x138]
mov dword [ebp - 0x41934], ecx
mov edx, dword [ebp - 0x41934]
push edx
push 0
push 0x5b90d4
push 0x5b90e8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp - 0x41964]
mov dword [ecx + 0x558], eax
mov edx, dword [ebp - 0x41964]
mov eax, dword [edx + 0x138]
mov dword [ebp - 0x41938], eax
mov ecx, dword [ebp - 0x41938]
push ecx
push 0
push 0x5b90f8
push 0x5b910c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edx, dword [ebp - 0x41964]
mov dword [edx + 0x55c], eax
mov eax, dword [ebp - 0x41964]
mov ecx, dword [eax + 0x138]
mov dword [ebp - 0x4193c], ecx
mov edx, dword [ebp - 0x4193c]
push edx
push 0
push 0x5b911c
push 0x5b9130
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp - 0x41964]
mov dword [ecx + 0x560], eax
mov edx, dword [ebp - 0x41964]
mov eax, dword [edx + 0x138]
mov dword [ebp - 0x41940], eax
mov ecx, dword [ebp - 0x41940]
push ecx
push 0
push 0x5b9140
push 0x5b9154
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edx, dword [ebp - 0x41964]
mov dword [edx + 0x564], eax
mov eax, dword [ebp - 0x41964]
mov ecx, dword [eax + 0x138]
mov dword [ebp - 0x41944], ecx
mov edx, dword [ebp - 0x41944]
push edx
push 0
push 0x5b9164
push 0x5b9178
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp - 0x41964]
mov dword [ecx + 0x568], eax
mov edx, dword [ebp - 0x41964]
mov eax, dword [edx + 0x138]
mov dword [ebp - 0x41948], eax
mov ecx, dword [ebp - 0x41948]
push ecx
push 0
push 0x5b9188
push 0x5b919c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edx, dword [ebp - 0x41964]
mov dword [edx + 0x56c], eax
mov eax, dword [ebp - 0x41964]
mov ecx, dword [eax + 0x138]
mov dword [ebp - 0x4194c], ecx
mov edx, dword [ebp - 0x4194c]
push edx
push 0
push 0x5b91ac
push 0x5b91c0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp - 0x41964]
mov dword [ecx + 0x570], eax
mov edx, dword [ebp - 0x41964]
mov eax, dword [edx + 0x138]
mov dword [ebp - 0x41950], eax
mov ecx, dword [ebp - 0x41950]
push ecx
push 0
push 0x5b91d0
push 0x5b91e4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edx, dword [ebp - 0x41964]
mov dword [edx + 0x574], eax
mov eax, dword [ebp - 0x41964]
mov ecx, dword [eax + 0x138]
mov dword [ebp - 0x41954], ecx
mov edx, dword [ebp - 0x41954]
push edx
push 0
push 0x5b91f4
push 0x5b9208
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp - 0x41964]
mov dword [ecx + 0x578], eax
mov edx, dword [ebp - 0x41964]
mov eax, dword [edx + 0x138]
mov dword [ebp - 0x41958], eax
mov ecx, dword [ebp - 0x41958]
push ecx
push 0
push 0x5b9218
push 0x5b922c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edx, dword [ebp - 0x41964]
mov dword [edx + 0x57c], eax
mov eax, dword [ebp - 0x41964]
mov ecx, dword [eax + 0x138]
mov dword [ebp - 0x4195c], ecx
mov edx, dword [ebp - 0x4195c]
push edx
push 0
push 0x5b923c
push 0x5b9250
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp - 0x41964]
mov dword [ecx + 0x580], eax
mov edx, dword [ebp - 0x41964]
mov eax, dword [edx + 0x138]
mov dword [ebp - 0x41960], eax
mov ecx, dword [ebp - 0x41960]
push ecx
push 0
push 0x5b9260
push 0x5b9274
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edx, dword [ebp - 0x41964]
mov dword [edx + 0x584], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x41884]
call fcn.0054d328
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x41880]
call fcn.004e71cb
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret