Function at 0x40b1a0
Capabilities:
Copy file
Create directory
Delete file
Get common file path
Get installed programs
Get startup folder
Persist via lnk shortcut
Query or enumerate registry value
Set registry value
Write file to startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x417395
mov eax, dword fs:[0]
push eax
sub esp, 0xe64
mov eax, dword [0x424d78]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0x14]
lea edx, [ebp - 0xb4c]
push edx
xor edi, edi
push 0x20119
push edi
mov dword [ebp - 0xb44], edi
push str.SoftwareConexant
xor ecx, ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xb5c], eax
mov word [eax], cx
mov dword [ebp - 4], edi
lea esi, [edi + 1]
mov dword [ebp - 0xb60], 0xff
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40b26a
mov edx, dword [ebp - 0xb4c]
lea eax, [ebp - 0xb58]
push eax
lea ecx, [ebp - 0xb60]
push ecx
push edi
push edi
push str.SetCOMMBranding
push edx
mov dword [ebp - 0xb58], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40b255
mov eax, dword [ebp - 0xb60]
cmp eax, dword [ebp + 0xc]
jne 0x40b255
xor esi, esi
mov ecx, dword [ebp - 0xb4c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, edi
je 0x40cf04
call fcn.00408ee0
cmp eax, 1
jne 0x40cf04
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [str.SAConfig.HP.Slice.xml]
mov eax, dword [0x41e440]
mov dword [ebp - 0x320], edx
mov edx, dword [0x41e448]
mov ecx, 6
mov esi, str.SAConfig.BandO.Slice.xml
lea edi, [ebp - 0x62c]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x41e444]
mov dword [ebp - 0x314], edx
lea edx, [ebp - 0xb4c]
push edx
push 0x20119
push 0
mov dword [ebp - 0x31c], eax
mov eax, dword [0x41e44c]
mov dword [ebp - 0x318], ecx
mov cx, word [0x41e450]
push str.SOFTWAREConexantSA3
push reloc.OLEAUT32.dll_SysReAllocString
movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x310], eax
mov word [ebp - 0x30c], cx
xor bl, bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40b380
mov edx, dword [ebp - 0xb4c]
mov dword [ebp - 0xb54], eax
lea eax, [ebp - 0xb58]
push eax
lea ecx, [ebp - 0xb54]
push ecx
push 0
push 0
push str.FeatureByteBrandingStatus
push edx
mov dword [ebp - 0xb58], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40b36b
cmp dword [ebp - 0xb54], eax
je 0x40b36b
mov ecx, 7
mov esi, str.SAConfig.BandO.FeatureByte.xml
lea edi, [ebp - 0x62c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 7
mov esi, str.SAConfig.HP.FeatureByte.xml
lea edi, [ebp - 0x320]
rep movsd dword es:[edi], dword [esi]
mov bl, 1
mov eax, dword [ebp - 0xb4c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
jne 0x40b416
lea ecx, [ebp - 0xb4c]
push ecx
push 0x20119
push 0
push str.SOFTWAREConexantSA3HP_NB_AIO
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40b416
mov ecx, dword [ebp - 0xb4c]
lea edx, [ebp - 0xb58]
push edx
mov dword [ebp - 0xb54], eax
lea eax, [ebp - 0xb54]
push eax
push 0
push 0
push str.FeatureByteBrandingStatus
push ecx
mov dword [ebp - 0xb58], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40b409
cmp dword [ebp - 0xb54], eax
je 0x40b409
mov ecx, 7
mov esi, str.SAConfig.BandO.FeatureByte.xml
lea edi, [ebp - 0x62c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 7
mov esi, str.SAConfig.HP.FeatureByte.xml
lea edi, [ebp - 0x320]
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp - 0xb4c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0xc]
cmp eax, 4
ja case.default.0x40b422
jmp dword [eax*4 + 0x40cf2c]
mov eax, dword [str.BandOPlay.ico]
mov ecx, 8
mov esi, str.Bang__Olufsen_Audio_Control_Panel
lea edi, [ebp - 0x424]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x41e384]
mov edx, dword [0x41e388]
movsw word es:[edi], word [esi]
mov dword [ebp - 0xd68], ecx
movzx ecx, byte [0x41e35b]
movsb byte es:[edi], byte [esi]
mov byte [ebp - 0x528], cl
mov ecx, 9
mov esi, str.Bang__Olufsen_Audio_Control_Panel.lnk
lea edi, [ebp - 0xe70]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x41e328]
mov dword [ebp - 0xd6c], eax
movzx eax, word [0x41e38c]
mov dword [ebp - 0xd64], edx
mov edx, dword [str.Audio_Controls.lnk]
mov word [ebp - 0xd60], ax
mov eax, dword [0x41e324]
mov dword [ebp - 0xc60], ecx
movzx ecx, byte [0x41e332]
movsw word es:[edi], word [esi]
mov dword [ebp - 0xc68], edx
mov edx, dword [0x41e32c]
mov dword [ebp - 0xc64], eax
movzx eax, word [0x41e330]
mov dword [ebp - 0xc5c], edx
mov byte [ebp - 0xc56], cl
movsb byte es:[edi], byte [esi]
mov word [ebp - 0xc58], ax
lea ecx, [ebp - 0x62c]
lea edx, [ebp - 0x834]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40b4e7
lea ecx, [ebp - 0x320]
lea edx, [ebp - 0x938]
lea ecx, [ecx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40b500
jmp case.default.0x40b422
mov cl, byte [0x41e31c]
mov byte [ebp - 0x41c], cl
mov ecx, dword [0x41e388]
mov edx, dword [str.BO_Play]
mov dword [ebp - 0xd64], ecx
mov eax, dword [0x41e318]
mov ecx, 7
mov esi, str.BO_Play_Control_Audio_Panel
lea edi, [ebp - 0x528]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 9
mov esi, str.Bang__Olufsen_Audio_Control_Panel.lnk
lea edi, [ebp - 0xe70]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x41e324]
mov dword [ebp - 0x424], edx
mov edx, dword [str.BandOPlay.ico]
mov dword [ebp - 0xd6c], edx
mov dx, word [0x41e38c]
mov dword [ebp - 0x420], eax
mov eax, dword [0x41e384]
mov word [ebp - 0xd60], dx
mov edx, dword [0x41e328]
mov dword [ebp - 0xd68], eax
mov eax, dword [str.Audio_Controls.lnk]
movsw word es:[edi], word [esi]
mov dword [ebp - 0xc64], ecx
mov cx, word [0x41e330]
mov dword [ebp - 0xc60], edx
mov dl, byte [0x41e332]
mov dword [ebp - 0xc68], eax
mov eax, dword [0x41e32c]
mov word [ebp - 0xc58], cx
mov byte [ebp - 0xc56], dl
movsb byte es:[edi], byte [esi]
mov dword [ebp - 0xc5c], eax
lea ecx, [ebp - 0x62c]
lea edx, [ebp - 0x834]
nop
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40b5e0
lea ecx, [ebp - 0x320]
lea edx, [ebp - 0x938]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40b5f6
jmp case.default.0x40b422
mov eax, dword [str.BandOPlay.ico]
mov ecx, 8
mov esi, str.Bang__Olufsen_Audio_Control_Panel
lea edi, [ebp - 0x424]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x41e384]
mov edx, dword [0x41e388]
movsw word es:[edi], word [esi]
mov dword [ebp - 0xd68], ecx
movzx ecx, byte [0x41e35b]
movsb byte es:[edi], byte [esi]
mov byte [ebp - 0x528], cl
mov ecx, 9
mov esi, str.Bang__Olufsen_Audio_Control_Panel.lnk
lea edi, [ebp - 0xe70]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x41e328]
mov dword [ebp - 0xd6c], eax
movzx eax, word [0x41e38c]
mov dword [ebp - 0xd64], edx
mov edx, dword [str.Audio_Controls.lnk]
mov word [ebp - 0xd60], ax
mov eax, dword [0x41e324]
mov dword [ebp - 0xc60], ecx
movzx ecx, byte [0x41e332]
movsw word es:[edi], word [esi]
mov dword [ebp - 0xc68], edx
mov edx, dword [0x41e32c]
mov dword [ebp - 0xc64], eax
movzx eax, word [0x41e330]
mov dword [ebp - 0xc5c], edx
mov byte [ebp - 0xc56], cl
movsb byte es:[edi], byte [esi]
mov word [ebp - 0xc58], ax
lea ecx, [ebp - 0x62c]
lea edx, [ebp - 0x834]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40b6c3
lea ecx, [ebp - 0x320]
lea edx, [ebp - 0x938]
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40b6e0
jmp case.default.0x40b422
mov ecx, dword [0x41e2e0]
mov esi, dword [0x41e2e8]
mov edi, dword [0x41e2ec]
mov edx, dword [0x41e2e4]
mov ebx, dword [0x41e2f0]
mov eax, dword [str.DTS_Audio_Control_Panel]
mov dword [ebp - 0x420], ecx
mov dword [ebp - 0x524], ecx
mov ecx, dword [0x41e324]
mov dword [ebp - 0xe6c], ecx
mov cx, word [0x41e330]
mov dword [ebp - 0x418], esi
mov dword [ebp - 0x414], edi
mov dword [ebp - 0x51c], esi
mov dword [ebp - 0x518], edi
mov word [ebp - 0xe60], cx
mov ecx, 9
mov esi, str.Bang__Olufsen_Audio_Control_Panel.lnk
lea edi, [ebp - 0xc68]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x41c], edx
mov dword [ebp - 0x520], edx
mov edx, dword [0x41e2f0]
mov dword [ebp - 0x410], ebx
mov ebx, dword [str.HPAudio.ico]
mov dword [ebp - 0x514], edx
mov edx, dword [0x41e328]
mov dword [ebp - 0x424], eax
mov dword [ebp - 0xd6c], ebx
mov ebx, dword [0x41e2d4]
mov dword [ebp - 0x528], eax
mov eax, dword [str.Audio_Controls.lnk]
mov dword [ebp - 0xe68], edx
mov dl, byte [0x41e332]
movsw word es:[edi], word [esi]
mov dword [ebp - 0xd68], ebx
mov ebx, dword [0x41e2d8]
mov dword [ebp - 0xe70], eax
mov eax, dword [0x41e32c]
mov byte [ebp - 0xe5e], dl
mov dword [ebp - 0xd64], ebx
mov dword [ebp - 0xe64], eax
movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x320]
lea edx, [ebp - 0x834]
lea ecx, [ecx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40b7f0
lea ecx, [ebp - 0x62c]
lea edx, [ebp - 0x938]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40b806
jmp case.default.0x40b422
mov ecx, dword [0x41e2c4]
mov eax, dword [str.Audio_Controls]
mov edx, dword [0x41e2c8]
mov dword [ebp - 0x420], ecx
movzx ecx, byte [0x41e2ce]
mov byte [ebp - 0x416], cl
mov ecx, dword [0x41e2d8]
mov dword [ebp - 0xd64], ecx
mov ecx, dword [0x41e2b0]
mov dword [ebp - 0x520], ecx
movzx ecx, byte [0x41e2bc]
mov byte [ebp - 0x514], cl
mov ecx, dword [0x41e328]
mov dword [ebp - 0x424], eax
movzx eax, word [0x41e2cc]
mov dword [ebp - 0xe68], ecx
movzx ecx, byte [0x41e332]
mov dword [ebp - 0x41c], edx
mov edx, dword [str.HPAudio.ico]
mov word [ebp - 0x418], ax
mov eax, dword [0x41e2d4]
mov byte [ebp - 0xe5e], cl
mov dword [ebp - 0xd6c], edx
mov edx, dword [str.Audio_Controls_Panel]
mov dword [ebp - 0xd68], eax
mov eax, dword [0x41e2ac]
mov ecx, 8
mov esi, str.Bang__Olufsen_Audio_Control.lnk
lea edi, [ebp - 0xc68]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x528], edx
mov edx, dword [0x41e2b4]
mov dword [ebp - 0x524], eax
mov eax, dword [0x41e2b8]
mov dword [ebp - 0x51c], edx
mov edx, dword [str.Audio_Controls.lnk]
mov dword [ebp - 0x518], eax
mov eax, dword [0x41e324]
mov dword [ebp - 0xe70], edx
mov edx, dword [0x41e32c]
mov dword [ebp - 0xe6c], eax
movzx eax, word [0x41e330]
mov dword [ebp - 0xe64], edx
mov word [ebp - 0xe60], ax
movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x320]
lea edx, [ebp - 0x834]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40b926
lea ecx, [ebp - 0x62c]
lea edx, [ebp - 0x938]
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40b940
mov eax, dword [ebp - 0xb5c]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [ebp - 0xb4c]
push ecx
push 0x20119
push 0
push str.SoftwareMicrosoftWindowsCurrentVersion
or edx, 0xffffffff
push reloc.OLEAUT32.dll_SysReAllocString
mov word [eax], dx
call ebx
test eax, eax
jne 0x40ceff
mov ecx, dword [ebp - 0xb4c]
lea edx, [ebp - 0xb58]
push edx
lea eax, [ebp - 0xa3c]
push eax
push 0
push 0
push str.ProgramFilesDir
push ecx
mov dword [ebp - 0xb58], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40ceff
lea ecx, [ebp - 0xa3c]
lea edx, [ebp - 0x62c]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40b9c0
lea edi, [ebp - 0x62c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40b9d1
lea edx, [ebp - 0xb40]
push edx
push 0
push 0
push 0x17
mov ecx, 7
mov esi, str.CONEXANTSA3HP_NB_AIOUX_
push 0
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea ecx, [ebp - 0xb40]
lea edx, [ebp - 0x320]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40ba06
lea edi, [ebp - 0x320]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40ba17
mov ax, word [0x41deac]
mov word [edi], ax
lea ecx, [ebp - 0xb40]
lea edx, [ebp - 0x730]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40ba34
lea edi, [ebp - 0x730]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40ba45
mov ecx, 6
mov esi, str.Music__Photos_and_Videos_
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0xb4c]
push ecx
push 0x20106
push 0
movsw word es:[edi], word [esi]
push str.CLSIDD3CD8822_6943_4214_90EE_12F40BEA126F
push SysReAllocString
movsb byte es:[edi], byte [esi]
call ebx
test eax, eax
jne 0x40bae4
lea eax, [ebp - 0x424]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40ba83
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
sub eax, edx
push eax
mov eax, dword [ebp - 0xb4c]
lea edx, [ebp - 0x424]
push edx
push 1
push 0
push 0
push eax
call ebx
lea eax, [ebp - 0x528]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40bab2
sub eax, edx
mov edx, dword [ebp - 0xb4c]
push eax
lea ecx, [ebp - 0x528]
push ecx
push 1
push 0
push str.InfoTip
push edx
call ebx
mov eax, dword [ebp - 0xb4c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40baea
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [ebp - 0xb4c]
push ecx
push 0x20106
push 0
push str.CLSIDD3CD8822_6943_4214_90EE_12F40BEA126FDefaultIcon
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40bb90
lea ecx, [ebp - 0x62c]
lea edx, [ebp - 0x21c]
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40bb20
lea eax, [ebp - 0xd6c]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40bb32
lea edi, [ebp - 0x21c]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40bb42
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x21c]
rep movsb byte es:[edi], byte [esi]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40bb63
sub eax, edx
push eax
mov eax, dword [ebp - 0xb4c]
lea edx, [ebp - 0x21c]
push edx
push 1
push 0
push 0
push eax
call ebx
mov ecx, dword [ebp - 0xb4c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0xb4c]
push edx
push 0x20106
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallCNXT_AUDIO_HDA
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40bc35
lea ecx, [ebp - 0x62c]
lea edx, [ebp - 0x21c]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40bbc2
lea eax, [ebp - 0xd6c]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40bbd4
lea edi, [ebp - 0x21c]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40bbe4
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x21c]
rep movsb byte es:[edi], byte [esi]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40bc05
mov ecx, dword [ebp - 0xb4c]
sub eax, edx
push eax
lea eax, [ebp - 0x21c]
push eax
push 1
push 0
push str.DisplayIcon
push ecx
call ebx
mov edx, dword [ebp - 0xb4c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp + 0x10], 0
je 0x40bd65
mov eax, dword [0x424d5c]
mov edx, dword [eax + 0xc]
mov ecx, 0x424d5c
call edx
lea edi, [eax + 0x10]
mov dword [ebp - 0xb48], edi
lea eax, [ebp - 0x730]
mov byte [ebp - 4], 1
push 0
test eax, 0xffff0000
jne 0x40bc98
mov ecx, eax
movzx esi, cx
push esi
call fcn.00408d30
add esp, 8
test eax, eax
je 0x40bd4f
push esi
push eax
lea ecx, [ebp - 0xb48]
call fcn.0040a590
mov edi, dword [ebp - 0xb48]
jmp 0x40bd4f
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0xffffffffffffffff
lea edx, [ebp - 0x730]
push edx
push 0
push 3
call ebx
lea esi, [eax - 1]
test esi, esi
jle 0x40bcfa
mov eax, dword [edi - 8]
mov ecx, 1
sub ecx, dword [edi - 4]
sub eax, esi
or eax, ecx
jge 0x40bcd9
push esi
lea ecx, [ebp - 0xb48]
call fcn.00409420
mov edi, dword [ebp - 0xb48]
push esi
push edi
push 0xffffffffffffffff
lea eax, [ebp - 0x730]
push eax
push 0
push 3
call ebx
cmp esi, dword [edi - 8]
jg 0x40bd15
xor ecx, ecx
mov dword [edi - 0xc], esi
mov word [edi + esi*2], cx
jmp 0x40bd4f
cmp dword [edi - 0xc], 0
mov esi, dword [edi - 0x10]
lea eax, [edi - 0x10]
je 0x40bd4f
cmp dword [eax + 0xc], 0
lea ecx, [eax + 0xc]
jge 0x40bd2d
cmp dword [edi - 8], 0
jge 0x40bd1f
push 0x80070057
call fcn.00401270
xor edx, edx
mov dword [edi - 0xc], 0
mov word [edi], dx
jmp 0x40bd4f
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40bd43
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0xc]
mov ecx, esi
call eax
lea edi, [eax + 0x10]
or dword [ebp - 0xb44], 1
push 0
push edi
mov byte [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x40bd6b
mov edi, dword [ebp - 0xb48]
test byte [ebp - 0xb44], 1
je 0x40bd90
add edi, 0xfffffff0
lea ecx, [edi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40bd90
mov ecx, dword [edi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push edi
call edx
lea ecx, [ebp - 0x320]
lea edx, [ebp - 0x118]
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40bda0
lea eax, [ebp - 0xc68]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40bdb2
lea edi, [ebp - 0x118]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40bdc2
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [0x424d5c]
mov edx, dword [eax + 0xc]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x424d5c
call edx
lea edi, [eax + 0x10]
mov dword [ebp - 0xb48], edi
lea eax, [ebp - 0x118]
mov byte [ebp - 4], 2
push 0
test eax, 0xffff0000
jne 0x40be33
mov ecx, eax
movzx esi, cx
push esi
call fcn.00408d30
add esp, 8
test eax, eax
je 0x40beee
push esi
push eax
lea ecx, [ebp - 0xb48]
call fcn.0040a590
mov edi, dword [ebp - 0xb48]
jmp 0x40beee
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0xffffffffffffffff
lea edx, [ebp - 0x118]
push edx
push 0
push 3
call ebx
lea esi, [eax - 1]
test esi, esi
jle 0x40be99
mov eax, dword [edi - 8]
mov ecx, 1
sub ecx, dword [edi - 4]
sub eax, esi
or eax, ecx
jge 0x40be74
push esi
lea ecx, [ebp - 0xb48]
call fcn.00409420
mov edi, dword [ebp - 0xb48]
push esi
push edi
push 0xffffffffffffffff
lea eax, [ebp - 0x118]
push eax
push 0
push 3
call ebx
cmp esi, dword [edi - 8]
jg 0x40bd15
xor ecx, ecx
mov dword [edi - 0xc], esi
mov word [edi + esi*2], cx
jmp 0x40beee
cmp dword [edi - 0xc], 0
mov esi, dword [edi - 0x10]
lea eax, [edi - 0x10]
je 0x40beee
cmp dword [eax + 0xc], 0
lea ecx, [eax + 0xc]
jge 0x40becc
cmp dword [edi - 8], 0
jge 0x40bebe
push 0x80070057
call fcn.00401270
xor edx, edx
mov dword [edi - 0xc], 0
mov word [edi], dx
jmp 0x40beee
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40bee2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0xc]
mov ecx, esi
call eax
lea edi, [eax + 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
mov byte [ebp - 4], 0
call ebx
add edi, 0xfffffff0
lea ecx, [edi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40bf17
mov ecx, dword [edi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push edi
call edx
cmp dword [ebp + 0x10], 0
je 0x40c0a3
lea ecx, [ebp - 0x730]
lea edx, [ebp - 0x118]
lea ecx, [ecx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40bf30
lea eax, [ebp - 0xc68]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40bf42
lea edi, [ebp - 0x118]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40bf52
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [0x424d5c]
mov edx, dword [eax + 0xc]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x424d5c
call edx
lea esi, [eax + 0x10]
mov dword [ebp - 0xb48], esi
lea eax, [ebp - 0x118]
mov byte [ebp - 4], 3
push 0
test eax, 0xffff0000
jne 0x40bfc3
mov ecx, eax
movzx edi, cx
push edi
call fcn.00408d30
add esp, 8
test eax, eax
je 0x40c080
push edi
push eax
lea ecx, [ebp - 0xb48]
call fcn.0040a590
mov esi, dword [ebp - 0xb48]
jmp 0x40c080
push 0
push 0xffffffffffffffff
lea edx, [ebp - 0x118]
push edx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea edi, [eax - 1]
test edi, edi
jle 0x40c02b
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x40c002
push edi
lea ecx, [ebp - 0xb48]
call fcn.00409420
mov esi, dword [ebp - 0xb48]
push edi
push esi
push 0xffffffffffffffff
lea eax, [ebp - 0x118]
push eax
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp edi, dword [esi - 8]
jg 0x40bd15
xor ecx, ecx
mov dword [esi - 0xc], edi
mov word [esi + edi*2], cx
jmp 0x40c080
cmp dword [esi - 0xc], 0
mov edi, dword [esi - 0x10]
lea eax, [esi - 0x10]
je 0x40c080
cmp dword [eax + 0xc], 0
lea ecx, [eax + 0xc]
jge 0x40c05e
cmp dword [esi - 8], 0
jge 0x40c050
push 0x80070057
call fcn.00401270
xor edx, edx
mov dword [esi - 0xc], 0
mov word [esi], dx
jmp 0x40c080
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c074
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [edi]
mov eax, dword [edx + 0xc]
mov ecx, edi
call eax
lea esi, [eax + 0x10]
push esi
mov byte [ebp - 4], 0
call ebx
add esi, 0xfffffff0
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c0a3
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
lea ecx, [ebp - 0x62c]
lea edx, [ebp - 0x21c]
nop
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40c0b0
lea eax, [ebp - 0xe70]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c0c2
lea edi, [ebp - 0x21c]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40c0d2
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
cmp dword [ebp + 0x10], 0
rep movsb byte es:[edi], byte [esi]
lea edx, [ebp - 0x118]
je 0x40c10c
lea ecx, [ebp - 0x730]
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40c100
jmp 0x40c11c
lea ecx, [ebp - 0x320]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40c112
lea eax, [ebp - 0xe70]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c124
lea edi, [ebp - 0x118]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40c134
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [0x424d5c]
mov edx, dword [eax + 0xc]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x424d5c
call edx
lea ebx, [eax + 0x10]
mov dword [ebp - 0xb48], ebx
lea eax, [ebp - 0x118]
mov byte [ebp - 4], 4
push 0
test eax, 0xffff0000
jne 0x40c1a5
mov ecx, eax
movzx esi, cx
push esi
call fcn.00408d30
add esp, 8
test eax, eax
je 0x40c266
push esi
push eax
lea ecx, [ebp - 0xb48]
call fcn.0040a590
mov ebx, dword [ebp - 0xb48]
jmp 0x40c266
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0xffffffffffffffff
lea edx, [ebp - 0x118]
push edx
push 0
push 3
call edi
lea esi, [eax - 1]
test esi, esi
jle 0x40c20b
mov eax, dword [ebx - 8]
mov ecx, 1
sub ecx, dword [ebx - 4]
sub eax, esi
or eax, ecx
jge 0x40c1e6
push esi
lea ecx, [ebp - 0xb48]
call fcn.00409420
mov ebx, dword [ebp - 0xb48]
push esi
push ebx
push 0xffffffffffffffff
lea eax, [ebp - 0x118]
push eax
push 0
push 3
call edi
cmp esi, dword [ebx - 8]
jg 0x40bd15
xor ecx, ecx
mov dword [ebx - 0xc], esi
mov word [ebx + esi*2], cx
jmp 0x40c266
cmp dword [ebx - 0xc], 0
mov esi, dword [ebx - 0x10]
lea eax, [ebx - 0x10]
je 0x40c266
cmp dword [eax + 0xc], 0
lea ecx, [eax + 0xc]
jge 0x40c23e
cmp dword [ebx - 8], 0
jge 0x40c230
push 0x80070057
call fcn.00401270
xor edx, edx
mov dword [ebx - 0xc], 0
mov word [ebx], dx
jmp 0x40c266
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c254
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0xc]
mov ecx, esi
call eax
lea ebx, [eax + 0x10]
mov dword [ebp - 0xb48], ebx
mov edx, dword [0x424d5c]
mov eax, dword [edx + 0xc]
mov ecx, 0x424d5c
mov byte [ebp - 4], 5
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0xb44], esi
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 6
push 0
test ecx, 0xffff0000
jne 0x40c2c5
mov edx, ecx
movzx edi, dx
push edi
call fcn.00408d30
add esp, 8
test eax, eax
je 0x40c382
push edi
push eax
lea ecx, [ebp - 0xb44]
call fcn.0040a590
mov esi, dword [ebp - 0xb44]
jmp 0x40c382
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x21c]
push eax
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea edi, [eax - 1]
test edi, edi
jle 0x40c32d
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x40c304
push edi
lea ecx, [ebp - 0xb44]
call fcn.00409420
mov esi, dword [ebp - 0xb44]
push edi
push esi
push 0xffffffffffffffff
lea ecx, [ebp - 0x21c]
push ecx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp edi, dword [esi - 8]
jg 0x40bd15
xor edx, edx
mov dword [esi - 0xc], edi
mov word [esi + edi*2], dx
jmp 0x40c382
cmp dword [esi - 0xc], 0
mov edi, dword [esi - 0x10]
lea eax, [esi - 0x10]
je 0x40c382
cmp dword [eax + 0xc], 0
lea ecx, [eax + 0xc]
jge 0x40c360
cmp dword [esi - 8], 0
jge 0x40c352
push 0x80070057
call fcn.00401270
xor eax, eax
mov dword [esi - 0xc], 0
mov word [esi], ax
jmp 0x40c382
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c376
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [edi]
mov eax, dword [edx + 0xc]
mov ecx, edi
call eax
lea esi, [eax + 0x10]
push 1
push ebx
push esi
mov byte [ebp - 4], 5
call dword [sym.imp.KERNEL32.dll_CopyFileW]
add esi, 0xfffffff0
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c3ac
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
add ebx, 0xfffffff0
mov byte [ebp - 4], 0
lea eax, [ebx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40c3cc
mov ecx, dword [ebx]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push ebx
call eax
lea ecx, [ebp - 0xa3c]
lea edx, [ebp - 0x320]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40c3d8
lea edi, [ebp - 0x320]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40c3f0
mov ecx, 6
mov esi, str.CONEXANTSA3HP_NB_AIO_
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x320]
lea edx, [ebp - 0x118]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40c411
lea eax, [ebp - 0x938]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c423
lea edi, [ebp - 0x118]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40c433
mov ecx, eax
shr ecx, 2
mov esi, edx
mov edx, dword [0x424d5c]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [edx + 0xc]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x424d5c
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0xb44], esi
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 7
push 0
test ecx, 0xffff0000
jne 0x40c5d1
mov edx, ecx
movzx edi, dx
push edi
call fcn.00408d30
add esp, 8
test eax, eax
je 0x40c4a1
push edi
push eax
lea ecx, [ebp - 0xb44]
call fcn.0040a590
mov esi, dword [ebp - 0xb44]
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push esi
mov byte [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esi, 0xfffffff0
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c4ce
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
mov dword [ebp - 0xb5c], 1
lea ecx, [ebp - 0x62c]
lea edx, [ebp - 0x21c]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40c4e4
lea eax, [ebp - 0x834]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c4f6
lea edi, [ebp - 0x21c]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40c506
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x320]
lea edx, [ebp - 0x118]
lea ebx, [ebx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40c530
lea eax, [ebp - 0x834]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c542
lea edi, [ebp - 0x118]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40c552
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [0x424d5c]
mov edx, dword [eax + 0xc]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x424d5c
call edx
lea esi, [eax + 0x10]
mov dword [ebp - 0xb44], esi
lea eax, [ebp - 0x118]
shr eax, 0x10
mov byte [ebp - 4], 8
mov dword [ebp - 0xb54], eax
push 0
test eax, eax
jne 0x40c69b
lea eax, [ebp - 0x118]
movzx edi, ax
push edi
call fcn.00408d30
add esp, 8
test eax, eax
je 0x40c750
push edi
push eax
lea ecx, [ebp - 0xb44]
call fcn.0040a590
mov esi, dword [ebp - 0xb44]
jmp 0x40c750
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x118]
push eax
push 0
push 3
call ebx
lea edi, [eax - 1]
test edi, edi
jle 0x40c63a
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x40c612
push edi
lea ecx, [ebp - 0xb44]
call fcn.00409420
mov esi, dword [ebp - 0xb44]
push edi
push esi
push 0xffffffffffffffff
lea ecx, [ebp - 0x118]
push ecx
push 0
push 3
call ebx
cmp edi, dword [esi - 8]
jg 0x40bd15
xor edx, edx
mov dword [esi - 0xc], edi
mov word [esi + edi*2], dx
jmp 0x40c4a7
cmp dword [esi - 0xc], 0
mov edi, dword [esi - 0x10]
lea eax, [esi - 0x10]
je 0x40c4a7
cmp dword [eax + 0xc], 0
lea ecx, [eax + 0xc]
jge 0x40c674
cmp dword [esi - 8], 0
jge 0x40c663
push 0x80070057
call fcn.00401270
xor eax, eax
mov dword [esi - 0xc], 0
mov word [esi], ax
jmp 0x40c4a7
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c68a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [edi]
mov eax, dword [edx + 0xc]
mov ecx, edi
call eax
lea esi, [eax + 0x10]
jmp 0x40c4a7
push 0
push 0xffffffffffffffff
lea ecx, [ebp - 0x118]
push ecx
push 0
push 3
call ebx
lea edi, [eax - 1]
test edi, edi
jle 0x40c6fb
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x40c6d6
push edi
lea ecx, [ebp - 0xb44]
call fcn.00409420
mov esi, dword [ebp - 0xb44]
push edi
push esi
push 0xffffffffffffffff
lea edx, [ebp - 0x118]
push edx
push 0
push 3
call ebx
cmp edi, dword [esi - 8]
jg 0x40bd15
xor eax, eax
mov dword [esi - 0xc], edi
mov word [esi + edi*2], ax
jmp 0x40c750
cmp dword [esi - 0xc], 0
mov edi, dword [esi - 0x10]
lea eax, [esi - 0x10]
je 0x40c750
cmp dword [eax + 0xc], 0
lea ecx, [eax + 0xc]
jge 0x40c72e
cmp dword [esi - 8], 0
jge 0x40c720
push 0x80070057
call fcn.00401270
xor ecx, ecx
mov dword [esi - 0xc], 0
mov word [esi], cx
jmp 0x40c750
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c744
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [edi]
mov eax, dword [edx + 0xc]
mov ecx, edi
call eax
lea esi, [eax + 0x10]
push esi
mov byte [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esi, 0xfffffff0
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c777
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
mov eax, dword [0x424d5c]
mov edx, dword [eax + 0xc]
mov ecx, 0x424d5c
call edx
lea ebx, [eax + 0x10]
mov dword [ebp - 0xb48], ebx
cmp dword [ebp - 0xb54], 0
mov byte [ebp - 4], 9
push 0
jne 0x40c7d0
lea eax, [ebp - 0x118]
movzx esi, ax
push esi
call fcn.00408d30
add esp, 8
test eax, eax
je 0x40c891
push esi
push eax
lea ecx, [ebp - 0xb48]
call fcn.0040a590
mov ebx, dword [ebp - 0xb48]
jmp 0x40c891
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0xffffffffffffffff
lea ecx, [ebp - 0x118]
push ecx
push 0
push 3
call edi
lea esi, [eax - 1]
test esi, esi
jle 0x40c836
mov eax, dword [ebx - 8]
mov ecx, 1
sub ecx, dword [ebx - 4]
sub eax, esi
or eax, ecx
jge 0x40c811
push esi
lea ecx, [ebp - 0xb48]
call fcn.00409420
mov ebx, dword [ebp - 0xb48]
push esi
push ebx
push 0xffffffffffffffff
lea edx, [ebp - 0x118]
push edx
push 0
push 3
call edi
cmp esi, dword [ebx - 8]
jg 0x40bd15
xor eax, eax
mov dword [ebx - 0xc], esi
mov word [ebx + esi*2], ax
jmp 0x40c891
cmp dword [ebx - 0xc], 0
mov esi, dword [ebx - 0x10]
lea eax, [ebx - 0x10]
je 0x40c891
cmp dword [eax + 0xc], 0
lea ecx, [eax + 0xc]
jge 0x40c869
cmp dword [ebx - 8], 0
jge 0x40c85b
push 0x80070057
call fcn.00401270
xor ecx, ecx
mov dword [ebx - 0xc], 0
mov word [ebx], cx
jmp 0x40c891
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c87f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0xc]
mov ecx, esi
call eax
lea ebx, [eax + 0x10]
mov dword [ebp - 0xb48], ebx
mov edx, dword [0x424d5c]
mov eax, dword [edx + 0xc]
mov ecx, 0x424d5c
mov byte [ebp - 4], 0xa
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0xb44], esi
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 0xb
push 0
test ecx, 0xffff0000
jne 0x40c8f0
mov edx, ecx
movzx edi, dx
push edi
call fcn.00408d30
add esp, 8
test eax, eax
je 0x40c9ad
push edi
push eax
lea ecx, [ebp - 0xb44]
call fcn.0040a590
mov esi, dword [ebp - 0xb44]
jmp 0x40c9ad
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x21c]
push eax
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea edi, [eax - 1]
test edi, edi
jle 0x40c958
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x40c92f
push edi
lea ecx, [ebp - 0xb44]
call fcn.00409420
mov esi, dword [ebp - 0xb44]
push edi
push esi
push 0xffffffffffffffff
lea ecx, [ebp - 0x21c]
push ecx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp edi, dword [esi - 8]
jg 0x40bd15
xor edx, edx
mov dword [esi - 0xc], edi
mov word [esi + edi*2], dx
jmp 0x40c9ad
cmp dword [esi - 0xc], 0
mov edi, dword [esi - 0x10]
lea eax, [esi - 0x10]
je 0x40c9ad
cmp dword [eax + 0xc], 0
lea ecx, [eax + 0xc]
jge 0x40c98b
cmp dword [esi - 8], 0
jge 0x40c97d
push 0x80070057
call fcn.00401270
xor eax, eax
mov dword [esi - 0xc], 0
mov word [esi], ax
jmp 0x40c9ad
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c9a1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [edi]
mov eax, dword [edx + 0xc]
mov ecx, edi
call eax
lea esi, [eax + 0x10]
push 1
push ebx
push esi
mov byte [ebp - 4], 0xa
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
sete byte [ebp - 0xb4d]
add esi, 0xfffffff0
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c9e0
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
add ebx, 0xfffffff0
mov byte [ebp - 4], 0
lea eax, [ebx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40ca00
mov ecx, dword [ebx]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push ebx
call eax
cmp byte [ebp - 0xb4d], 0
je 0x40ca13
mov dword [ebp - 0xb5c], 0
mov dword [ebp - 0xb64], 1
lea ecx, [ebp - 0x62c]
lea edx, [ebp - 0x21c]
lea esp, [esp]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40ca30
lea eax, [ebp - 0xd6c]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40ca42
lea edi, [ebp - 0x21c]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x40ca52
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x320]
lea edx, [ebp - 0x118]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x40ca76
lea eax, [ebp - 0x118]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x40ca87
mov ecx, dword [str.SADefaultIcon.ico]
mov edx, dword [0x41e11c]
mov dword [eax], ecx
mov ecx, dword [0x41e120]
mov dword [eax + 4], edx
mov edx, dword [0x41e124]
mov dword [eax + 8], ecx
mov cx, word [0x41e128]
mov dword [eax + 0xc], edx
mov edx, dword [0x424d5c]
mov word [eax + 0x10], cx
mov eax, dword [edx + 0xc]
mov ecx, 0x424d5c
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0xb44], esi
lea eax, [ebp - 0x118]
shr eax, 0x10
mov byte [ebp - 4], 0xc
mov dword [ebp - 0xb54], eax
push 0
test eax, eax
jne 0x40cb21
lea ecx, [ebp - 0x118]
movzx edi, cx
push edi
call fcn.00408d30
add esp, 8
test eax, eax
je 0x40cbdc
push edi
push eax
lea ecx, [ebp - 0xb44]
call fcn.0040a590
mov esi, dword [ebp - 0xb44]
jmp 0x40cbdc
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0xffffffffffffffff
lea edx, [ebp - 0x118]
push edx
push 0
push 3
call ebx
lea edi, [eax - 1]
test edi, edi
jle 0x40cb87
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x40cb62
push edi
lea ecx, [ebp - 0xb44]
call fcn.00409420
mov esi, dword [ebp - 0xb44]
push edi
push esi
push 0xffffffffffffffff
lea eax, [ebp - 0x118]
push eax
push 0
push 3
call ebx
cmp edi, dword [esi - 8]
jg 0x40bd15
xor ecx, ecx
mov dword [esi - 0xc], edi
mov word [esi + edi*2], cx
jmp 0x40cbdc
cmp dword [esi - 0xc], 0
mov edi, dword [esi - 0x10]
lea eax, [esi - 0x10]
je 0x40cbdc
cmp dword [eax + 0xc], 0
lea ecx, [eax + 0xc]
jge 0x40cbba
cmp dword [esi - 8], 0
jge 0x40cbac
push 0x80070057
call fcn.00401270
xor edx, edx
mov dword [esi - 0xc], 0
mov word [esi], dx
jmp 0x40cbdc
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40cbd0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [edi]
mov eax, dword [edx + 0xc]
mov ecx, edi
call eax
lea esi, [eax + 0x10]
push esi
mov byte [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esi, 0xfffffff0
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40cc03
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
mov eax, dword [0x424d5c]
mov edx, dword [eax + 0xc]
mov ecx, 0x424d5c
call edx
lea ebx, [eax + 0x10]
mov dword [ebp - 0xb48], ebx
cmp dword [ebp - 0xb54], 0
mov byte [ebp - 4], 0xd
push 0
jne 0x40cc5c
lea eax, [ebp - 0x118]
movzx esi, ax
push esi
call fcn.00408d30
add esp, 8
test eax, eax
je 0x40cd1d
push esi
push eax
lea ecx, [ebp - 0xb48]
call fcn.0040a590
mov ebx, dword [ebp - 0xb48]
jmp 0x40cd1d
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0xffffffffffffffff
lea ecx, [ebp - 0x118]
push ecx
push 0
push 3
call edi
lea esi, [eax - 1]
test esi, esi
jle 0x40ccc2
mov eax, dword [ebx - 8]
mov ecx, 1
sub ecx, dword [ebx - 4]
sub eax, esi
or eax, ecx
jge 0x40cc9d
push esi
lea ecx, [ebp - 0xb48]
call fcn.00409420
mov ebx, dword [ebp - 0xb48]
push esi
push ebx
push 0xffffffffffffffff
lea edx, [ebp - 0x118]
push edx
push 0
push 3
call edi
cmp esi, dword [ebx - 8]
jg 0x40bd15
xor eax, eax
mov dword [ebx - 0xc], esi
mov word [ebx + esi*2], ax
jmp 0x40cd1d
cmp dword [ebx - 0xc], 0
mov esi, dword [ebx - 0x10]
lea eax, [ebx - 0x10]
je 0x40cd1d
cmp dword [eax + 0xc], 0
lea ecx, [eax + 0xc]
jge 0x40ccf5
cmp dword [ebx - 8], 0
jge 0x40cce7
push 0x80070057
call fcn.00401270
xor ecx, ecx
mov dword [ebx - 0xc], 0
mov word [ebx], cx
jmp 0x40cd1d
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40cd0b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0xc]
mov ecx, esi
call eax
lea ebx, [eax + 0x10]
mov dword [ebp - 0xb48], ebx
mov edx, dword [0x424d5c]
mov eax, dword [edx + 0xc]
mov ecx, 0x424d5c
mov byte [ebp - 4], 0xe
call eax
lea esi, [eax + 0x10]
mov dword [ebp - 0xb44], esi
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 0xf
push 0
test ecx, 0xffff0000
jne 0x40cd7c
mov edx, ecx
movzx edi, dx
push edi
call fcn.00408d30
add esp, 8
test eax, eax
je 0x40ce39
push edi
push eax
lea ecx, [ebp - 0xb44]
call fcn.0040a590
mov esi, dword [ebp - 0xb44]
jmp 0x40ce39
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x21c]
push eax
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea edi, [eax - 1]
test edi, edi
jle 0x40cde4
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x40cdbb
push edi
lea ecx, [ebp - 0xb44]
call fcn.00409420
mov esi, dword [ebp - 0xb44]
push edi
push esi
push 0xffffffffffffffff
lea ecx, [ebp - 0x21c]
push ecx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp edi, dword [esi - 8]
jg 0x40bd15
xor edx, edx
mov dword [esi - 0xc], edi
mov word [esi + edi*2], dx
jmp 0x40ce39
cmp dword [esi - 0xc], 0
mov edi, dword [esi - 0x10]
lea eax, [esi - 0x10]
je 0x40ce39
cmp dword [eax + 0xc], 0
lea ecx, [eax + 0xc]
jge 0x40ce17
cmp dword [esi - 8], 0
jge 0x40ce09
push 0x80070057
call fcn.00401270
xor eax, eax
mov dword [esi - 0xc], 0
mov word [esi], ax
jmp 0x40ce39
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ce2d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [edi]
mov eax, dword [edx + 0xc]
mov ecx, edi
call eax
lea esi, [eax + 0x10]
push 1
push ebx
push esi
mov byte [ebp - 4], 0xe
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
sete byte [ebp - 0xb4d]
add esi, 0xfffffff0
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40ce6c
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
add ebx, 0xfffffff0
mov byte [ebp - 4], 0
lea eax, [ebx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40ce8c
mov ecx, dword [ebx]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push ebx
call eax
cmp byte [ebp - 0xb4d], 0
je 0x40ce99
xor eax, eax
jmp 0x40ce9f
mov eax, dword [ebp - 0xb64]
cmp dword [ebp - 0xb5c], 1
jne 0x40ceff
cmp eax, 1
jne 0x40ceff
push 0
lea ecx, [ebp - 0xb4c]
push ecx
push 0
push 0x20106
push 0
push 0
push 0
push str.SoftwareConexant
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40ceff
push 4
lea edx, [ebp + 0xc]
push edx
push 4
push eax
mov eax, dword [ebp - 0xb4c]
push str.SetCOMMBranding
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0xb4c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00408fc0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040d680
mov esp, ebp
pop ebp
ret 0x10