Function at 0x41ba57
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push 0x5e8
mov eax, 0x465e3c
call fcn.00443729
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
push 1
lea eax, [ebp - 0x5d9]
push eax
xor ebx, ebx
push esi
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x5f4], ebx
call fcn.0040ca90
mov dword [ebp - 4], ebx
movzx eax, word [esi]
add eax, 0xffffffbf
cmp eax, 0x39
ja case.0x41baa2.71
movzx eax, byte [eax + 0x41c8c3]
jmp dword [eax*4 + 0x41c867]
push 0x477d28
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x41bae0
mov eax, dword [edi + 0x260]
push ebx
push ebx
push str._auto
mov ecx, edi
mov byte [eax + 2], 1
call fcn.00434a8b
mov eax, dword [edi + 0x260]
mov byte [eax + 2], 1
jmp 0x41bc7b
cmp dword [edi + 0xc], 0
jne case.0x41baa2.71
mov ecx, edi
call fcn.00437a7d
test eax, eax
je 0x41bb34
push 1
lea eax, [ebp - 0x5d9]
push eax
push str._This_setup_was_created_with_an_EVALUATION_VERSION_of__s__which_does_not_support_extraction_of_the_internal_MSI_file._The_full_version_of_InstallShield_supports_this_functionality.
lea ecx, [ebp - 0x5a8]
call fcn.0040ca90
mov byte [ebp - 4], 2
push eax
push 0x86d
push edi
call fcn.0041d14a
add esp, 0xc
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x5a8]
call fcn.00401580
jmp 0x41c84e
fldz
lea eax, [ebp - 0x5f0]
push eax
fstp qword [ebp - 0x5f0]
mov ecx, edi
call fcn.00437a88
test eax, eax
je 0x41bb6c
fld qword [ebp - 0x5f0]
push ecx
push ecx
fstp qword [esp]
push 0x86f
push edi
call fcn.0041d191
add esp, 0x10
jmp 0x41c84e
push ebx
push ebx
push 0x478b14
mov ecx, edi
mov dword [edi + 0xc], 1
call fcn.00434a8b
push esi
call dword [sym.imp.USER32.dll_CharNextW]
push 1
lea ecx, [ebp - 0x5d9]
push ecx
push eax
lea ecx, [ebp - 0x3c8]
call fcn.0040ca90
mov byte [ebp - 4], 6
push ebx
lea eax, [ebp - 0x3c8]
push eax
push 0xe
mov ecx, edi
call fcn.00414987
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x3c8]
call fcn.00401580
jmp 0x41bc7b
push esi
call dword [sym.imp.USER32.dll_CharNextW]
push 1
lea ecx, [ebp - 0x5d9]
push ecx
push eax
lea ecx, [ebp - 0x428]
call fcn.0040ca90
mov byte [ebp - 4], 8
push ebx
lea eax, [ebp - 0x428]
push eax
push 0xc
mov ecx, edi
call fcn.00414987
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x428]
jmp 0x41bbbb
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 1
jne 0x41bc7b
push eax
mov ecx, edi
call fcn.00438fa6
mov dword [edi + 0x3c], 1
jmp 0x41bc7b
push 1
lea eax, [ebp - 0x5d9]
push eax
push str.debuglog
lea ecx, [ebp - 0x278]
call fcn.0040ca90
mov byte [ebp - 4], 0xa
push dword [ebp - 0x264]
cmp dword [ebp - 0x260], 8
lea eax, [ebp - 0x274]
cmovae eax, dword [ebp - 0x274]
push ebx
push eax
lea ecx, [ebp - 0x244]
call fcn.0040f44d
mov ebx, eax
neg ebx
sbb bl, bl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x278]
call fcn.00401580
inc bl
je 0x41bc83
xor ebx, ebx
inc ebx
jmp 0x41c84e
push 1
push esi
call dword [sym.imp.USER32.dll_CharNextW]
push eax
push 0x478b30
jmp 0x41c83b
push 1
lea eax, [ebp - 0x5d9]
push eax
push str.embed
lea ecx, [ebp - 0x2d8]
call fcn.0040ca90
mov byte [ebp - 4], 0xd
xor eax, eax
inc eax
mov dword [ebp - 0x5f4], eax
push dword [ebp - 0x2c4]
cmp dword [ebp - 0x2c0], 8
lea eax, [ebp - 0x2d4]
cmovae eax, dword [ebp - 0x2d4]
push ebx
push eax
lea ecx, [ebp - 0x244]
call fcn.0040f44d
test eax, eax
jne 0x41bd2e
push 1
lea eax, [ebp - 0x5d9]
push eax
push 0x478b48
lea ecx, [ebp - 0x548]
call fcn.0040ca90
mov dword [ebp - 4], 0xe
push 3
pop eax
mov dword [ebp - 0x5f4], eax
lea eax, [ebp - 0x548]
push eax
lea ecx, [ebp - 0x248]
call fcn.0041e050
mov byte [ebp - 0x5d9], 1
test al, al
jne 0x41bd34
mov byte [ebp - 0x5d9], bl
push 0xd
pop ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 0x5f4]
test al, 2
je 0x41bd61
and eax, 0xfffffffd
mov dword [ebp - 0x5f4], eax
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0x548]
call fcn.00401580
mov eax, dword [ebp - 0x5f4]
mov dword [ebp - 4], ebx
test al, 1
je 0x41bd7f
and eax, 0xfffffffe
mov dword [ebp - 0x5f4], eax
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x2d8]
call fcn.00401580
cmp byte [ebp - 0x5d9], 0
je 0x41bdbb
push 0xffffffffffffffff
push 5
lea eax, [ebp - 0x5d8]
push eax
lea ecx, [ebp - 0x248]
call fcn.0041017c
mov byte [ebp - 4], 0x11
push ebx
push eax
push 0x10
mov ecx, edi
call fcn.00414987
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x5d8]
jmp 0x41bbbb
push 0x478b4c
lea ecx, [ebp - 0x244]
call fcn.004395e6
test eax, eax
je 0x41bc7b
push esi
call dword [sym.imp.USER32.dll_CharNextW]
mov esi, eax
push str._IS_E_
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x41bdfe
push esi
mov esi, 0x4a6000
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x41beb3
mov dword [ebp - 0x5e8], ebx
mov dword [ebp - 0x5e4], ebx
mov dword [ebp - 0x5e0], ebx
mov byte [ebp - 4], 0x13
push 0x2001f
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x5e8]
call fcn.00401410
test eax, eax
jne 0x41c7bc
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push ebx
push eax
call fcn.00442700
add esp, 0xc
lea eax, [ebp - 0x5ec]
push eax
lea eax, [ebp - 0x218]
push eax
push esi
lea ecx, [ebp - 0x5e8]
mov dword [ebp - 0x5ec], 0x104
call fcn.00401500
lea eax, [ebp - 0x218]
push eax
push 0x4a6000
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
push dword [ebp - 0x5e8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea ecx, [ebp - 0x5e8]
call fcn.004013e0
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x5e8]
call fcn.004013e0
mov esi, 0x4a6000
push esi
call fcn.00441a80
mov dword [edi + 0x3c], 1
cmp dword [0x4a5ef0], 8
mov eax, 0x4a5edc
cmovae eax, dword [0x4a5edc]
push eax
push esi
push 0x4a5648
call fcn.00440590
push 1
lea eax, [ebp - 0x5d9]
push eax
push 0x485198
lea ecx, [ebp - 0x4e8]
call fcn.004025e0
mov byte [ebp - 4], 0x15
push 1
lea eax, [ebp - 0x5d9]
push eax
push dword [0x477ba0]
lea ecx, [ebp - 0x488]
call fcn.004025e0
mov byte [ebp - 4], 0x16
push 1
lea eax, [ebp - 0x5d9]
push eax
push dword [0x477b9c]
lea ecx, [ebp - 0x338]
call fcn.004025e0
mov byte [ebp - 4], 0x17
lea eax, [ebp - 0x4e8]
push eax
lea eax, [ebp - 0x488]
push eax
lea eax, [ebp - 0x338]
push eax
push 5
mov ecx, edi
call fcn.004149da
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x338]
call fcn.00401580
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x488]
call fcn.00401580
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x4e8]
call fcn.00401580
push 2
mov ecx, edi
call fcn.00438ba2
jmp 0x41bc7b
push esi
call dword [sym.imp.USER32.dll_CharNextW]
movzx eax, word [eax]
sub eax, 0x31
je 0x41bff2
dec eax
je 0x41bfda
dec eax
je 0x41bfba
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_CharNextW]
call esi
push eax
push 0x478bc4
jmp 0x41c83b
push esi
mov esi, dword [sym.imp.USER32.dll_CharNextW]
mov byte [edi + 0x25c], 1
call esi
push eax
call esi
push eax
mov ecx, edi
call fcn.00438e6a
jmp 0x41bc7b
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_CharNextW]
call esi
push eax
call esi
push eax
push 0x478bbc
jmp 0x41c83b
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_CharNextW]
call esi
push eax
call esi
push eax
push 0x47890c
mov ecx, edi
call fcn.00434a8b
mov dword [edi + 0x40], 1
jmp 0x41bc7b
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str.hide_progress
push esi
call ebx
test eax, eax
jne 0x41c031
mov byte [edi + 0x256], 1
push str.hide_splash
push esi
call ebx
test eax, eax
jne 0x41bc7b
mov byte [edi + 0x257], 1
jmp 0x41bc7b
push 1
lea eax, [ebp - 0x5d9]
push eax
push str.instance
lea ecx, [ebp - 0x2a8]
call fcn.0040ca90
mov byte [ebp - 4], 0x1b
push dword [ebp - 0x294]
cmp dword [ebp - 0x290], 8
lea eax, [ebp - 0x2a4]
cmovae eax, dword [ebp - 0x2a4]
push ebx
push eax
lea ecx, [ebp - 0x244]
call fcn.0040f44d
mov ebx, eax
neg ebx
sbb bl, bl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2a8]
call fcn.00401580
inc bl
je 0x41c10b
push 0xfffffffffffffffd
pop esi
push 0xffffffffffffffff
push 9
lea eax, [ebp - 0x308]
add edi, 0x258
push eax
lea ecx, [ebp - 0x248]
mov dword [edi], esi
call fcn.0041017c
mov byte [ebp - 4], 0x1d
push 0x478be0
lea ecx, [ebp - 0x304]
call fcn.004395e6
test eax, eax
jne 0x41c0e8
or dword [edi], 0xffffffff
jmp 0x41c0fc
push 0xa
push edi
lea ecx, [ebp - 0x308]
call fcn.0041e48b
test al, al
jne 0x41c0fc
mov dword [edi], esi
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x308]
jmp 0x41bbbb
push str.IS_temp
lea ecx, [ebp - 0x244]
call fcn.004395e6
test eax, eax
jne 0x41bc7b
mov byte [edi + 0x25e], 1
jmp 0x41bc7b
cmp dword [edi + 0xc], 0
jne case.0x41baa2.71
push esi
mov dword [edi + 0xc], 3
call dword [sym.imp.USER32.dll_CharNextW]
mov esi, eax
push 1
lea eax, [ebp - 0x5d9]
push eax
push esi
lea ecx, [ebp - 0x368]
call fcn.0040ca90
mov byte [ebp - 4], 0x20
push ebx
lea eax, [ebp - 0x368]
push eax
push 8
mov ecx, edi
call fcn.00414987
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x368]
call fcn.00401580
push ebx
push esi
push 0x478bf0
jmp 0x41c83b
push edi
lea eax, [ebp - 0x5ec]
push eax
push esi
mov dword [ebp - 0x5ec], ebx
call dword [sym.imp.USER32.dll_CharNextW]
push eax
call fcn.0041c8fd
add esp, 0xc
test eax, eax
je case.0x41baa2.71
mov ecx, dword [edi + 0x260]
mov ax, word [ebp - 0x5ec]
mov word [ecx + 0x52], ax
jmp 0x41bc7b
push esi
mov esi, dword [sym.imp.USER32.dll_CharNextW]
call esi
movzx ecx, word [eax]
push ebx
push eax
sub ecx, 0x31
je 0x41c1f6
dec ecx
je 0x41c1e9
push 0x478c08
jmp 0x41c83b
call esi
push eax
push 0x478c00
jmp 0x41c83b
call esi
push eax
push 0x478bf8
jmp 0x41c83b
push str.noscript_uninst
push esi
call fcn.00444c45
pop ecx
pop ecx
test eax, eax
jne 0x41c220
push ebx
push ebx
push str._noscript_uninst
jmp 0x41c83b
push esi
call dword [sym.imp.USER32.dll_CharNextW]
push 1
lea ecx, [ebp - 0x5d9]
push ecx
push eax
lea ecx, [ebp - 0x398]
call fcn.0040ca90
mov byte [ebp - 4], 0x23
push ebx
lea eax, [ebp - 0x398]
push eax
push 5
mov ecx, edi
call fcn.00414987
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x398]
call fcn.00401580
push 2
mov ecx, edi
call fcn.00438ba2
jmp 0x41bc15
push esi
call dword [sym.imp.USER32.dll_CharNextW]
push eax
push 0x4a2628
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x41bc7b
mov byte [edi + 0x25d], 1
jmp 0x41bc7b
push str.removeonly
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x41c2ad
push ebx
push ebx
push str._removeonly
jmp 0x41c83b
push str.runas
push esi
call fcn.00444c45
pop ecx
pop ecx
test eax, eax
je 0x41bc7b
push str.runfromtemp
push esi
call fcn.00444c45
pop ecx
pop ecx
test eax, eax
je 0x41bc7b
push 6
push str.reboot
push esi
call fcn.00444336
add esp, 0xc
test eax, eax
je 0x41bc7b
push str.removeasmajorupgrade
push esi
call fcn.00444c45
pop ecx
pop ecx
test eax, eax
je 0x41bc7b
push ebx
push ebx
push 0x478cbc
jmp 0x41c83b
push str.skip_clone_wait
push esi
call fcn.00444c45
pop ecx
pop ecx
test eax, eax
je 0x41bc7b
push 0x478ce4
push esi
call fcn.00444c45
pop ecx
pop ecx
test eax, eax
jne 0x41c342
push ebx
push ebx
push str._SMS
jmp 0x41c83b
push str.show_eval_msg
push esi
call fcn.00444c45
pop ecx
pop ecx
test eax, eax
jne 0x41c362
mov eax, dword [edi + 0x260]
mov byte [eax + 0x18], 1
jmp 0x41bc7b
push str.show_beta_msg
push esi
call fcn.00444c45
pop ecx
pop ecx
test eax, eax
jne 0x41c382
mov eax, dword [edi + 0x260]
mov byte [eax + 0x19], 1
jmp 0x41bc7b
push str.show_reboot_msg
push esi
call fcn.00444c45
pop ecx
test eax, eax
mov eax, dword [edi + 0x260]
pop ecx
jne 0x41c3a2
mov byte [eax + 0x1d], 1
jmp 0x41bc7b
push ebx
push ebx
push 0x478d18
mov ecx, edi
mov byte [eax + 1], 1
call fcn.00434a8b
mov eax, dword [edi + 0x260]
mov byte [eax + 1], 1
jmp 0x41bc7b
push str.tempdisk1folder
call fcn.00416f8b
pop ecx
push eax
push ebx
push str.tempdisk1folder
lea ecx, [ebp - 0x244]
call fcn.0040f44d
test eax, eax
je 0x41bc7b
push esi
call dword [sym.imp.USER32.dll_CharNextW]
mov esi, eax
push str._IS_T_
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x41c40e
push esi
mov ecx, edi
call fcn.00438f23
jmp 0x41c4c6
mov dword [ebp - 0x5e8], ebx
mov dword [ebp - 0x5e4], ebx
mov dword [ebp - 0x5e0], ebx
mov byte [ebp - 4], 0x25
push 0x2001f
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x5e8]
call fcn.00401410
test eax, eax
jne 0x41c7bc
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push ebx
push eax
call fcn.00442700
add esp, 0xc
lea eax, [ebp - 0x5ec]
push eax
lea eax, [ebp - 0x218]
push eax
push esi
lea ecx, [ebp - 0x5e8]
mov dword [ebp - 0x5ec], 0x104
call fcn.00401500
lea eax, [ebp - 0x218]
push eax
call fcn.00441a80
lea eax, [ebp - 0x218]
push eax
mov ecx, edi
call fcn.00438f23
push esi
push dword [ebp - 0x5e8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea ecx, [ebp - 0x5e8]
call fcn.004013e0
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x5e8]
call fcn.004013e0
push 3
jmp 0x41c261
push esi
call dword [sym.imp.USER32.dll_CharNextW]
movzx eax, word [eax]
cmp eax, 0x41
je 0x41c5a6
cmp eax, 0x4d
je 0x41c562
cmp eax, 0x57
je 0x41c51e
cmp eax, 0x61
je 0x41c5a6
cmp eax, 0x6d
je 0x41c562
cmp eax, 0x77
je 0x41c51e
push str.uninst
push esi
call fcn.00444c45
pop ecx
pop ecx
test eax, eax
jne 0x41bc7b
push ebx
push ebx
push str._uninst
jmp 0x41c83b
push esi
mov esi, dword [sym.imp.USER32.dll_CharNextW]
call esi
push eax
call esi
push 1
lea ecx, [ebp - 0x5d9]
push ecx
push eax
lea ecx, [ebp - 0x3f8]
call fcn.0040ca90
mov byte [ebp - 4], 0x29
push ebx
lea eax, [ebp - 0x3f8]
push eax
push 0xa
mov ecx, edi
call fcn.00414987
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x3f8]
jmp 0x41bbbb
push esi
mov esi, dword [sym.imp.USER32.dll_CharNextW]
call esi
push eax
call esi
push 1
lea ecx, [ebp - 0x5d9]
push ecx
push eax
lea ecx, [ebp - 0x458]
call fcn.0040ca90
mov byte [ebp - 4], 0x2b
push ebx
lea eax, [ebp - 0x458]
push eax
push 0xb
mov ecx, edi
call fcn.00414987
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x458]
jmp 0x41bbbb
push esi
mov esi, dword [sym.imp.USER32.dll_CharNextW]
call esi
push eax
call esi
push 1
lea ecx, [ebp - 0x5d9]
push ecx
push eax
lea ecx, [ebp - 0x4b8]
call fcn.0040ca90
mov byte [ebp - 4], 0x27
push ebx
lea eax, [ebp - 0x4b8]
push eax
push 9
mov ecx, edi
call fcn.00414987
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x4b8]
jmp 0x41bbbb
mov dword [ebp - 0x5e8], ebx
mov dword [ebp - 0x5e4], ebx
mov dword [ebp - 0x5e0], ebx
mov byte [ebp - 4], 0x2d
push 0x2001f
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x5e8]
call fcn.00401410
test eax, eax
jne 0x41c63a
push str.ISSetup
push dword [ebp - 0x5e8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea ecx, [ebp - 0x5e8]
call fcn.004013e0
push 7
push str.verbose
push esi
call fcn.00444336
add esp, 0xc
test eax, eax
je 0x41c7d3
push esi
call dword [sym.imp.USER32.dll_CharNextW]
mov esi, eax
push str._IS_V_
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x41c6f3
lea eax, [ebp - 0x5ec]
push eax
lea ecx, [edi + 4]
mov dword [ebp - 0x5ec], 7
call fcn.00411795
mov dword [ebp - 0x5ec], eax
cmp dword [eax + 0x14], ebx
je 0x41c6b2
push 0x477c9c
call fcn.00416f8b
pop ecx
mov ecx, dword [ebp - 0x5ec]
push eax
push 0x477c9c
add ecx, 4
call fcn.00410926
push 1
lea eax, [ebp - 0x5d9]
push eax
push esi
lea ecx, [ebp - 0x578]
call fcn.0040ca90
mov byte [ebp - 4], 0x2e
mov ecx, dword [ebp - 0x5ec]
push eax
call fcn.00410807
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x578]
call fcn.00401580
push 1
push esi
push 0x4783cc
jmp 0x41c7de
push 0x2001f
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x5e8]
call fcn.00401410
test eax, eax
jne 0x41c7bc
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push ebx
push eax
call fcn.00442700
add esp, 0xc
lea eax, [ebp - 0x5ec]
push eax
lea eax, [ebp - 0x218]
push eax
push esi
lea ecx, [ebp - 0x5e8]
mov dword [ebp - 0x5ec], 0x104
call fcn.00401500
push esi
push dword [ebp - 0x5e8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea ecx, [ebp - 0x5e8]
call fcn.004013e0
push 1
lea eax, [ebp - 0x5d9]
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x518]
call fcn.0040ca90
mov byte [ebp - 4], 0x30
push ebx
lea eax, [ebp - 0x518]
push eax
push 7
mov ecx, edi
call fcn.00414987
mov byte [ebp - 4], 0x2d
lea ecx, [ebp - 0x518]
call fcn.00401580
lea esi, [ebp - 0x218]
push 1
mov eax, esi
push eax
jmp 0x41c6e9
push edi
call fcn.0041cda6
pop ecx
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x5e8]
call fcn.004013e0
jmp 0x41c84e
push 1
add esi, 0xe
push esi
push str._verbose
mov ecx, edi
call fcn.00434a8b
test esi, esi
je 0x41c7fc
push esi
push 0x4a0628
mov byte [0x4a061c], 1
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x5e8]
call fcn.004013e0
jmp 0x41bc7b
mov dword [edi + 0x34], 1
jmp 0x41bc7b
cmp dword [edi + 0xc], 0
jne case.0x41baa2.71
mov dword [edi + 0xc], 4
jmp 0x41bc7b
push ebx
push esi
call dword [sym.imp.USER32.dll_CharNextW]
push eax
push 0x478e10
mov ecx, edi
call fcn.00434a8b
jmp 0x41bc7b
push edi
call fcn.0041cda6
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x248]
call fcn.00401580
mov eax, ebx
call fcn.004436d8
ret