Function at 0x4022a0
Capabilities:
Get common file path
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45048b
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xb48
mov eax, dword [0x45e024]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0xb54], esi
lea eax, [ebp - 0xb40]
mov dword [ebp - 0xb4c], 0
push eax
push 0x20019
push 0
push str.SOFTWARECanonCBTSETUP
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4026dd
lea eax, [ebp - 0xb3c]
mov dword [ebp - 0xb3c], 0x114
push eax
lea eax, [ebp - 0x468]
push eax
lea eax, [ebp - 0xb44]
push eax
push 0
push str.Path
push dword [ebp - 0xb40]
call edi
test eax, eax
jne 0x40243e
lea ecx, [ebp - 0x468]
mov dword [ebp - 0xa90], eax
mov dword [ebp - 0xa8c], 0xf
lea edx, [ecx + 1]
mov byte [ebp - 0xaa0], al
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402374
sub ecx, edx
lea eax, [ebp - 0x468]
push ecx
push eax
lea ecx, [ebp - 0xaa0]
call fcn.00409910
lea eax, [ebp - 0xaa0]
add esi, 0x4c
push eax
mov ecx, esi
call fcn.00408fa0
mov edx, dword [ebp - 0xa8c]
cmp edx, 0x10
jb 0x4023db
mov ecx, dword [ebp - 0xaa0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4023d1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403b80
push edx
push ecx
call fcn.004120fb
add esp, 8
push esi
mov edx, str.__CBT_installation_path:
lea ecx, [ebp - 0xab8]
call fcn.0040a3a0
add esp, 4
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.00401ca0
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0xaa4]
cmp edx, 0x10
jb 0x40243e
mov ecx, dword [ebp - 0xab8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x402434
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403b85
push edx
push ecx
call fcn.004120fb
add esp, 8
lea eax, [ebp - 0xb3c]
mov dword [ebp - 0xb3c], 0x114
push eax
lea eax, [ebp - 0x688]
push eax
lea eax, [ebp - 0xb44]
push eax
push 0
push str.Dependent_files
push dword [ebp - 0xb40]
call edi
test eax, eax
jne 0x4026d1
mov edi, dword [ebp - 0xb3c]
lea esi, [ebp - 0x688]
test edi, edi
je 0x4026d1
nop dword [eax + eax]
mov ecx, esi
mov dword [ebp - 0xa90], 0
mov dword [ebp - 0xa8c], 0xf
mov byte [ebp - 0xaa0], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4024b0
sub ecx, edx
push ecx
push esi
lea ecx, [ebp - 0xaa0]
call fcn.00409910
mov edx, dword [ebp - 0xa8c]
cmp edx, 0x10
jb 0x402500
mov ecx, dword [ebp - 0xaa0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4024f6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403b80
push edx
push ecx
call fcn.004120fb
add esp, 8
cmp dword [ebp - 0xa90], 0
je 0x4026d1
mov ecx, esi
mov dword [ebp - 0xa90], 0
mov dword [ebp - 0xa8c], 0xf
mov byte [ebp - 0xaa0], 0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402530
sub ecx, edx
push ecx
push esi
lea ecx, [ebp - 0xaa0]
call fcn.00409910
mov ecx, dword [ebp - 0xb54]
add ecx, 0x7c
mov dword [ebp - 4], 1
mov eax, dword [ecx + 4]
cmp dword [ecx + 8], eax
je 0x402587
movups xmm0, xmmword [ebp - 0xaa0]
mov edx, 0xf
mov byte [ebp - 0xaa0], 0
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0xa90]
movq qword [eax + 0x10], xmm0
add dword [ecx + 4], 0x18
jmp 0x40259a
lea edx, [ebp - 0xaa0]
push edx
push eax
call fcn.0040abc0
mov edx, dword [ebp - 0xa8c]
mov dword [ebp - 4], 0xffffffff
cmp edx, 0x10
jb 0x4025d5
mov ecx, dword [ebp - 0xaa0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4025cb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403b80
push edx
push ecx
call fcn.004120fb
add esp, 8
mov ecx, esi
mov dword [ebp - 0xa90], 0
mov dword [ebp - 0xa8c], 0xf
mov byte [ebp - 0xaa0], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4025f5
sub ecx, edx
push ecx
push esi
lea ecx, [ebp - 0xaa0]
call fcn.00409910
mov edx, dword [ebp - 0xa8c]
or eax, 0xffffffff
sub eax, dword [ebp - 0xa90]
add edi, eax
cmp edx, 0x10
jb 0x402650
mov ecx, dword [ebp - 0xaa0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x402646
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403b80
push edx
push ecx
call fcn.004120fb
add esp, 8
mov ecx, esi
mov dword [ebp - 0xa90], 0
mov dword [ebp - 0xa8c], 0xf
mov byte [ebp - 0xaa0], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402670
sub ecx, edx
push ecx
push esi
lea ecx, [ebp - 0xaa0]
call fcn.00409910
mov eax, dword [ebp - 0xa90]
mov edx, dword [ebp - 0xa8c]
inc eax
add esi, eax
cmp edx, 0x10
jb 0x4026c9
mov ecx, dword [ebp - 0xaa0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4026bf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403b80
push edx
push ecx
call fcn.004120fb
add esp, 8
test edi, edi
jne 0x402490
push dword [ebp - 0xb40]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0xb40]
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0x20019
push 0
push str.SOFTWARECanonCBTSETUPCBTUser
push reloc.OLEAUT32.dll_SysReAllocString
call eax
test eax, eax
jne 0x40288b
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
lea eax, [ebp - 0xb58]
push eax
lea eax, [ebp - 0x570]
mov dword [ebp - 0xb3c], 0x104
push eax
lea eax, [ebp - 0xb44]
mov dword [ebp - 0xb58], 0x104
push eax
xor esi, esi
lea eax, [ebp - 0xb3c]
push esi
push eax
lea eax, [ebp - 0x350]
push eax
push esi
push dword [ebp - 0xb40]
call edi
test eax, eax
jne 0x40288b
nop word [eax + eax]
cmp byte [ebp - 0x350], 0
je 0x40288b
lea ecx, [ebp - 0x350]
mov dword [ebp - 0xa90], 0
mov dword [ebp - 0xa8c], 0xf
lea edx, [ecx + 1]
mov byte [ebp - 0xaa0], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402791
sub ecx, edx
lea eax, [ebp - 0x350]
push ecx
push eax
lea ecx, [ebp - 0xaa0]
call fcn.00409910
mov dword [ebp - 4], 2
mov eax, dword [0x45e95c]
cmp dword [0x45e960], eax
je 0x4027ed
movups xmm0, xmmword [ebp - 0xaa0]
mov edx, 0xf
mov byte [ebp - 0xaa0], 0
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0xa90]
movq qword [eax + 0x10], xmm0
add dword [0x45e95c], 0x18
jmp 0x402805
lea ecx, [ebp - 0xaa0]
push ecx
push eax
mov ecx, 0x45e958
call fcn.0040abc0
mov edx, dword [ebp - 0xa8c]
mov dword [ebp - 4], 0xffffffff
cmp edx, 0x10
jb 0x402840
mov ecx, dword [ebp - 0xaa0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x402836
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403b80
push edx
push ecx
call fcn.004120fb
add esp, 8
lea eax, [ebp - 0xb58]
mov dword [ebp - 0xb3c], 0x104
push eax
lea eax, [ebp - 0x570]
mov dword [ebp - 0xb58], 0x104
push eax
lea eax, [ebp - 0xb44]
inc esi
push eax
push 0
lea eax, [ebp - 0xb3c]
push eax
lea eax, [ebp - 0x350]
push eax
push esi
push dword [ebp - 0xb40]
call edi
test eax, eax
je 0x402760
push dword [ebp - 0xb40]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0xb54]
cmp dword [edi + 0x5c], 0
jne 0x402a00
push 0x400
lea eax, [ebp - 0xa88]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0xa88]
mov dword [ebp - 0xa90], 0
mov dword [ebp - 0xa8c], 0xf
lea edx, [ecx + 1]
mov byte [ebp - 0xaa0], 0
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4028e0
sub ecx, edx
lea eax, [ebp - 0xa88]
push ecx
push eax
lea ecx, [ebp - 0xaa0]
call fcn.00409910
lea esi, [edi + 0x4c]
lea eax, [ebp - 0xaa0]
cmp esi, eax
je 0x402963
mov ecx, dword [esi + 0x14]
cmp ecx, 0x10
jb 0x40293c
mov eax, dword [esi]
inc ecx
cmp ecx, 0x1000
jb 0x402932
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403b80
mov eax, edx
push ecx
push eax
call fcn.004120fb
add esp, 8
movups xmm0, xmmword [ebp - 0xaa0]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0xa90]
movq qword [esi + 0x10], xmm0
jmp 0x40299d
mov edx, dword [ebp - 0xa8c]
cmp edx, 0x10
jb 0x40299d
mov ecx, dword [ebp - 0xaa0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x402993
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403b8a
push edx
push ecx
call fcn.004120fb
add esp, 8
push esi
mov edx, str.__CBT_installation_path:
lea ecx, [ebp - 0xab8]
call fcn.0040a3a0
add esp, 4
mov ecx, eax
mov dword [ebp - 4], 3
call fcn.00401ca0
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0xaa4]
cmp edx, 0x10
jb 0x402a00
mov ecx, dword [ebp - 0xab8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4029f6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403b8f
push edx
push ecx
call fcn.004120fb
add esp, 8
mov eax, dword [edi + 0x7c]
cmp eax, dword [edi + 0x80]
jne 0x402df6
push 0x56
push str.NBCBT95.dll_NBPORT95.exe_NBLOCALT.dll_NBPORTNT.exe_NBCBTNT.dll_NBCBTSPT.dat_AUPORT.exe
lea ecx, [ebp - 0xad0]
mov dword [ebp - 0xac0], 0
mov dword [ebp - 0xabc], 0xf
mov byte [ebp - 0xad0], 0
call fcn.00409910
mov dword [ebp - 4], 4
mov ecx, 0xf
mov dword [ebp - 0xaf0], 0
mov dword [ebp - 0xaec], ecx
mov byte [ebp - 0xb00], 0
mov byte [ebp - 4], 5
mov edi, dword [ebp - 0xb00]
nop dword [eax]
push dword [ebp - 0xb58]
cmp dword [ebp - 0xabc], 0x10
lea ecx, [ebp - 0xad0]
mov esi, dword [ebp - 0xac0]
mov edx, esi
cmovae ecx, dword [ebp - 0xad0]
push 1
push 0x459b20
push ecx
call fcn.0040b1b0
mov ecx, eax
add esp, 0x10
cmp ecx, 0xffffffff
jne 0x402acf
cmp dword [ebp - 0xabc], 0x10
lea eax, [ebp - 0xad0]
push esi
cmovae eax, dword [ebp - 0xad0]
lea ecx, [ebp - 0xb00]
push eax
call fcn.00409910
jmp 0x402b73
mov dword [ebp - 0xa90], 0
mov dword [ebp - 0xa8c], 0xf
mov byte [ebp - 0xaa0], 0
test ecx, ecx
je 0x402ce4
cmp esi, ecx
lea eax, [ebp - 0xad0]
cmovb ecx, esi
cmp dword [ebp - 0xabc], 0x10
push ecx
cmovae eax, dword [ebp - 0xad0]
lea ecx, [ebp - 0xaa0]
push eax
call fcn.00409910
or dword [ebp - 0xb4c], 1
mov eax, dword [ebp - 0xaec]
cmp eax, 0x10
jb 0x402b55
lea ecx, [eax + 1]
mov eax, edi
cmp ecx, 0x1000
jb 0x402b4b
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403b80
push ecx
push edi
call fcn.004120fb
add esp, 8
movups xmm0, xmmword [ebp - 0xaa0]
movups xmmword [ebp - 0xb00], xmm0
movq xmm0, qword [ebp - 0xa90]
movq qword [ebp - 0xaf0], xmm0
mov edi, dword [ebp - 0xaf0]
mov edx, dword [ebp - 0xb00]
test edi, edi
je 0x402d75
cmp dword [ebp - 0xaec], 0x10
lea ecx, [ebp - 0xb00]
mov esi, edi
mov eax, 1
cmovae ecx, edx
cmp edi, 1
mov edx, 0x459b20
cmova esi, eax
sub esi, 4
jb 0x402bc1
nop
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x402bc6
add ecx, 4
add edx, 4
sub esi, 4
jae 0x402bb0
cmp esi, 0xfffffffc
je 0x402bfa
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x402bf3
cmp esi, 0xfffffffd
je 0x402bfa
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x402bf3
cmp esi, 0xfffffffe
je 0x402bfa
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x402bf3
cmp esi, 0xffffffff
je 0x402bfa
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x402bfa
sbb eax, eax
or eax, 1
jmp 0x402bfc
xor eax, eax
test eax, eax
jne 0x402c0b
cmp edi, 1
jb 0x402c0b
jbe 0x402d6f
mov eax, dword [0x45e950]
lea ecx, [ebp - 0xb00]
push ecx
cmp dword [0x45e954], eax
je 0x402c2f
mov ecx, eax
call fcn.004090c0
add dword [0x45e950], 0x18
jmp 0x402c3a
push eax
mov ecx, 0x45e94c
call fcn.0040adb0
cmp dword [ebp - 0xaec], 0x10
lea eax, [ebp - 0xb00]
push dword [ebp - 0xb58]
mov edi, dword [ebp - 0xb00]
lea ecx, [ebp - 0xad0]
mov esi, dword [ebp - 0xaf0]
cmovae eax, edi
cmp dword [ebp - 0xabc], 0x10
mov edx, dword [ebp - 0xac0]
cmovae ecx, dword [ebp - 0xad0]
push esi
push eax
push ecx
call fcn.0040b1b0
add esp, 0x10
mov dword [ebp - 0xa90], 0
mov dword [ebp - 0xa8c], 0xf
mov byte [ebp - 0xaa0], 0
lea edx, [esi + eax]
mov eax, dword [ebp - 0xac0]
cmp eax, edx
jb 0x403b94
sub eax, edx
or ecx, 0xffffffff
cmp eax, 0xffffffff
cmovb ecx, eax
cmp dword [ebp - 0xabc], 0x10
lea eax, [ebp - 0xad0]
cmovae eax, dword [ebp - 0xad0]
push ecx
add eax, edx
lea ecx, [ebp - 0xaa0]
push eax
call fcn.00409910
or dword [ebp - 0xb4c], 4
jmp 0x402d12
cmp esi, 1
jb 0x403b94
cmp dword [ebp - 0xabc], 0x10
lea eax, [ebp - 0xad0]
lea ecx, [esi - 1]
cmovae eax, dword [ebp - 0xad0]
push ecx
inc eax
lea ecx, [ebp - 0xaa0]
push eax
call fcn.00409910
mov edx, dword [ebp - 0xabc]
cmp edx, 0x10
jb 0x402d4c
mov ecx, dword [ebp - 0xad0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x402d42
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403b80
push edx
push ecx
call fcn.004120fb
add esp, 8
movups xmm0, xmmword [ebp - 0xaa0]
movups xmmword [ebp - 0xad0], xmm0
movq xmm0, qword [ebp - 0xa90]
movq qword [ebp - 0xac0], xmm0
jmp 0x402a70
mov edx, dword [ebp - 0xb00]
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0xaec]
cmp eax, 0x10
jb 0x402daf
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x402da5
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403b99
push ecx
push edx
call fcn.004120fb
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0xabc]
cmp edx, 0x10
jb 0x402df0
mov ecx, dword [ebp - 0xad0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x402de6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403b9e
push edx
push ecx
call fcn.004120fb
add esp, 8
mov edi, dword [ebp - 0xb54]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0xb40]
push eax
push 0x20019
push 0
push str.SOFTWARECanonDIASSETUP
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x403482
lea eax, [ebp - 0xb3c]
mov dword [ebp - 0xb3c], 0x114
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0xb44]
push eax
push 0
push str.Path
push dword [ebp - 0xb40]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40317b
lea ecx, [ebp - 0x248]
mov dword [ebp - 0xa90], eax
mov dword [ebp - 0xa8c], 0xf
lea edx, [ecx + 1]
mov byte [ebp - 0xaa0], al
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402e77
sub ecx, edx
lea eax, [ebp - 0x248]
push ecx
push eax
lea ecx, [ebp - 0xaa0]
call fcn.00409910
mov dword [ebp - 4], 6
mov edx, dword [ebp - 0xa8c]
mov eax, edx
mov ecx, dword [ebp - 0xa90]
sub eax, ecx
push 1
push 0x459a2c
cmp eax, 1
jb 0x402ee6
cmp edx, 0x10
lea esi, [ebp - 0xaa0]
lea eax, [ecx + 1]
cmovae esi, dword [ebp - 0xaa0]
add esi, ecx
mov dword [ebp - 0xa90], eax
push esi
call fcn.0041b280
add esp, 0xc
mov byte [esi + 1], 0
lea eax, [ebp - 0xaa0]
jmp 0x402f00
mov byte [ebp - 0xb4c], 0
lea ecx, [ebp - 0xaa0]
push dword [ebp - 0xb4c]
push 1
call fcn.0040b490
mov dword [ebp - 0xad8], 0
mov dword [ebp - 0xad4], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0xae8], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0xad8], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 7
mov edx, dword [ebp - 0xad4]
mov eax, edx
mov ecx, dword [ebp - 0xad8]
sub eax, ecx
push 0xb
push str.CnxDias.exe
cmp eax, 0xb
jb 0x402f8c
cmp edx, 0x10
lea esi, [ebp - 0xae8]
lea eax, [ecx + 0xb]
cmovae esi, dword [ebp - 0xae8]
add esi, ecx
mov dword [ebp - 0xad8], eax
push esi
call fcn.0041b280
add esp, 0xc
mov byte [esi + 0xb], 0
lea eax, [ebp - 0xae8]
jmp 0x402fa6
mov byte [ebp - 0xb4c], 0
lea ecx, [ebp - 0xae8]
push dword [ebp - 0xb4c]
push 0xb
call fcn.0040b490
movups xmm0, xmmword [eax]
lea esi, [edi + 0x1c]
movq xmm1, qword [eax + 0x10]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0xab8]
movq qword [ebp - 0xb50], xmm1
movq qword [ebp - 0xaa8], xmm1
movups xmmword [ebp - 0xb30], xmm0
movups xmmword [ebp - 0xab8], xmm0
cmp esi, eax
je 0x403044
mov ecx, dword [esi + 0x14]
cmp ecx, 0x10
jb 0x40302c
mov eax, dword [esi]
inc ecx
cmp ecx, 0x1000
jb 0x403013
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403b80
mov eax, edx
push ecx
push eax
call fcn.004120fb
movups xmm0, xmmword [ebp - 0xb30]
add esp, 8
movq xmm1, qword [ebp - 0xb50]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
movups xmmword [esi], xmm0
movq qword [esi + 0x10], xmm1
jmp 0x40307e
mov edx, dword [ebp - 0xaa4]
cmp edx, 0x10
jb 0x40307e
mov ecx, dword [ebp - 0xab8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x403074
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403ba3
push edx
push ecx
call fcn.004120fb
add esp, 8
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0xad4]
cmp edx, 0x10
jb 0x4030bc
mov ecx, dword [ebp - 0xae8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4030b2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403ba8
push edx
push ecx
call fcn.004120fb
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0xa8c]
mov dword [ebp - 0xad8], 0
mov dword [ebp - 0xad4], 0xf
mov byte [ebp - 0xae8], 0
cmp edx, 0x10
jb 0x403118
mov ecx, dword [ebp - 0xaa0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40310e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403bad
push edx
push ecx
call fcn.004120fb
add esp, 8
push esi
mov edx, str.__Dias_installation_path:
lea ecx, [ebp - 0xab8]
call fcn.0040a3a0
add esp, 4
mov ecx, eax
mov dword [ebp - 4], 8
call fcn.00401ca0
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0xaa4]
cmp edx, 0x10
jb 0x40317b
mov ecx, dword [ebp - 0xab8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x403171
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403bb2
push edx
push ecx
call fcn.004120fb
add esp, 8
lea eax, [ebp - 0xb3c]
mov dword [ebp - 0xb3c], 0x114
push eax
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0xb44]
push eax
push 0
push str.AppPath
push dword [ebp - 0xb40]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4032f4
lea ecx, [ebp - 0x130]
mov dword [ebp - 0xa90], eax
mov dword [ebp - 0xa8c], 0xf
lea edx, [ecx + 1]
mov byte [ebp - 0xaa0], al
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4031d4
sub ecx, edx
lea eax, [ebp - 0x130]
push ecx
push eax
lea ecx, [ebp - 0xaa0]
call fcn.00409910
lea esi, [edi + 0x34]
lea eax, [ebp - 0xaa0]
cmp esi, eax
je 0x403257
mov ecx, dword [esi + 0x14]
cmp ecx, 0x10
jb 0x403230
mov eax, dword [esi]
inc ecx
cmp ecx, 0x1000
jb 0x403226
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403b80
mov eax, edx
push ecx
push eax
call fcn.004120fb
add esp, 8
movups xmm0, xmmword [ebp - 0xaa0]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0xa90]
movq qword [esi + 0x10], xmm0
jmp 0x403291
mov edx, dword [ebp - 0xa8c]
cmp edx, 0x10
jb 0x403291
mov ecx, dword [ebp - 0xaa0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x403287
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403bb7
push edx
push ecx
call fcn.004120fb
add esp, 8
push esi
mov edx, str.__Dias_data_path:
lea ecx, [ebp - 0xab8]
call fcn.0040a3a0
add esp, 4
mov ecx, eax
mov dword [ebp - 4], 9
call fcn.00401ca0
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0xaa4]
cmp edx, 0x10
jb 0x4032f4
mov ecx, dword [ebp - 0xab8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4032ea
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403bbc
push edx
push ecx
call fcn.004120fb
add esp, 8
lea eax, [ebp - 0xb3c]
mov dword [ebp - 0xb3c], 0x114
push eax
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0xb44]
push eax
push 0
push str.BuildNumber
push dword [ebp - 0xb40]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x403470
lea ecx, [ebp - 0x130]
mov dword [ebp - 0xa90], eax
mov dword [ebp - 0xa8c], 0xf
lea edx, [ecx + 1]
mov byte [ebp - 0xaa0], al
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x403350
sub ecx, edx
lea eax, [ebp - 0x130]
push ecx
push eax
lea ecx, [ebp - 0xaa0]
call fcn.00409910
lea esi, [edi + 0x64]
lea eax, [ebp - 0xaa0]
cmp esi, eax
je 0x4033d3
mov ecx, dword [esi + 0x14]
cmp ecx, 0x10
jb 0x4033ac
mov eax, dword [esi]
inc ecx
cmp ecx, 0x1000
jb 0x4033a2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403b80
mov eax, edx
push ecx
push eax
call fcn.004120fb
add esp, 8
movups xmm0, xmmword [ebp - 0xaa0]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
movups xmmword [esi], xmm0
movq xmm0, qword [ebp - 0xa90]
movq qword [esi + 0x10], xmm0
jmp 0x40340d
mov edx, dword [ebp - 0xa8c]
cmp edx, 0x10
jb 0x40340d
mov ecx, dword [ebp - 0xaa0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x403403
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403bc1
push edx
push ecx
call fcn.004120fb
add esp, 8
push esi
mov edx, str.__Dias_build_ver:
lea ecx, [ebp - 0xab8]
call fcn.0040a3a0
add esp, 4
mov ecx, eax
mov dword [ebp - 4], 0xa
call fcn.00401ca0
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0xaa4]
cmp edx, 0x10
jb 0x403470
mov ecx, dword [ebp - 0xab8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x403466
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403bc6
push edx
push ecx
call fcn.004120fb
add esp, 8
push dword [ebp - 0xb40]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
add edi, 0x1c
cmp dword [edi + 0x10], 0
jne 0x4037bc
lea eax, [ebp - 0xb40]
mov dword [ebp - 0xb3c], 0x114
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x4038cf
lea eax, [ebp - 0xb3c]
push eax
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0xb44]
push eax
push 0
push str.ProgramFilesDir
push dword [ebp - 0xb40]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0xb40]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4038cf
lea ecx, [ebp - 0x130]
mov dword [ebp - 0xa90], esi
mov dword [ebp - 0xa8c], 0xf
lea edx, [ecx + 1]
mov byte [ebp - 0xaa0], 0
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x403520
sub ecx, edx
lea eax, [ebp - 0x130]
push ecx
push eax
lea ecx, [ebp - 0xaa0]
call fcn.00409910
mov dword [ebp - 4], 0xb
mov edx, dword [ebp - 0xa8c]
mov eax, edx
mov ecx, dword [ebp - 0xa90]
sub eax, ecx
push 0xc
push str.CanonDIAS_
cmp eax, 0xc
jb 0x40358f
cmp edx, 0x10
lea esi, [ebp - 0xaa0]
lea eax, [ecx + 0xc]
cmovae esi, dword [ebp - 0xaa0]
add esi, ecx
mov dword [ebp - 0xa90], eax
push esi
call fcn.0041b280
add esp, 0xc
mov byte [esi + 0xc], 0
lea eax, [ebp - 0xaa0]
jmp 0x4035a9
mov byte [ebp - 0xb4c], 0
lea ecx, [ebp - 0xaa0]
push dword [ebp - 0xb4c]
push 0xc
call fcn.0040b490
mov dword [ebp - 0xad8], 0
mov dword [ebp - 0xad4], 0
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0xae8], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0xad8], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov byte [ebp - 4], 0xc
mov edx, dword [ebp - 0xad4]
mov eax, edx
mov ecx, dword [ebp - 0xad8]
sub eax, ecx
push 0xb
push str.CnxDias.exe
cmp eax, 0xb
jb 0x403635
cmp edx, 0x10
lea esi, [ebp - 0xae8]
lea eax, [ecx + 0xb]
cmovae esi, dword [ebp - 0xae8]
add esi, ecx
mov dword [ebp - 0xad8], eax
push esi
call fcn.0041b280
add esp, 0xc
mov byte [esi + 0xb], 0
lea eax, [ebp - 0xae8]
jmp 0x40364f
mov byte [ebp - 0xb4c], 0
lea ecx, [ebp - 0xae8]
push dword [ebp - 0xb4c]
push 0xb
call fcn.0040b490
movups xmm0, xmmword [eax]
mov ecx, edi
movups xmmword [ebp - 0xab8], xmm0
movq xmm0, qword [eax + 0x10]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0xab8]
push eax
movq qword [ebp - 0xaa8], xmm0
call fcn.00408fa0
mov edx, dword [ebp - 0xaa4]
cmp edx, 0x10
jb 0x4036bf
mov ecx, dword [ebp - 0xab8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4036b5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403bcb
push edx
push ecx
call fcn.004120fb
add esp, 8
mov byte [ebp - 4], 0xb
mov edx, dword [ebp - 0xad4]
cmp edx, 0x10
jb 0x4036fd
mov ecx, dword [ebp - 0xae8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4036f3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403bd0
push edx
push ecx
call fcn.004120fb
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0xa8c]
mov dword [ebp - 0xad8], 0
mov dword [ebp - 0xad4], 0xf
mov byte [ebp - 0xae8], 0
cmp edx, 0x10
jb 0x403759
mov ecx, dword [ebp - 0xaa0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x40374f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403bd5
push edx
push ecx
call fcn.004120fb
add esp, 8
push edi
mov edx, str.__Dias_installation_path:
lea ecx, [ebp - 0xab8]
call fcn.0040a3a0
add esp, 4
mov ecx, eax
mov dword [ebp - 4], 0xd
call fcn.00401ca0
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0xaa4]
cmp edx, 0x10
jb 0x4037bc
mov ecx, dword [ebp - 0xab8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4037b2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403bda
push edx
push ecx
call fcn.004120fb
add esp, 8
mov edi, dword [ebp - 0xb54]
add edi, 0x34
cmp dword [edi + 0x10], 0
jne 0x403a04
lea eax, [ebp - 0xb40]
mov dword [ebp - 0xb3c], 0x114
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.OLEAUT32.dll_SysReAllocString
call eax
test eax, eax
jne 0x4038cf
lea eax, [ebp - 0xb3c]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0xb44]
push eax
push 0
push str.Common_AppData
push dword [ebp - 0xb40]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0xb40]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4038cf
lea ecx, [ebp - 0x248]
mov dword [ebp - 0xa90], esi
mov dword [ebp - 0xa8c], 0xf
lea edx, [ecx + 1]
mov byte [ebp - 0xaa0], 0
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x403860
sub ecx, edx
lea eax, [ebp - 0x248]
push ecx
push eax
lea ecx, [ebp - 0xaa0]
call fcn.00409910
mov dword [ebp - 4], 0xe
mov edx, dword [ebp - 0xa8c]
mov eax, edx
mov ecx, dword [ebp - 0xa90]
sub eax, ecx
push 6
push str.Canon
cmp eax, 6
jb 0x4038d6
cmp edx, 0x10
lea esi, [ebp - 0xaa0]
lea eax, [ecx + 6]
cmovae esi, dword [ebp - 0xaa0]
add esi, ecx
mov dword [ebp - 0xa90], eax
push esi
call fcn.0041b280
add esp, 0xc
mov byte [esi + 6], 0
lea eax, [ebp - 0xaa0]
jmp 0x4038f0
xor al, al
jmp 0x403b62
mov byte [ebp - 0xb4c], 0
lea ecx, [ebp - 0xaa0]
push dword [ebp - 0xb4c]
push 6
call fcn.0040b490
movups xmm0, xmmword [eax]
mov ecx, edi
movups xmmword [ebp - 0xab8], xmm0
movq xmm0, qword [eax + 0x10]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
lea eax, [ebp - 0xab8]
push eax
movq qword [ebp - 0xaa8], xmm0
call fcn.00408fa0
mov edx, dword [ebp - 0xaa4]
cmp edx, 0x10
jb 0x403960
mov ecx, dword [ebp - 0xab8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x403956
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403bdf
push edx
push ecx
call fcn.004120fb
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0xa8c]
cmp edx, 0x10
jb 0x4039a1
mov ecx, dword [ebp - 0xaa0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x403997
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403be4
push edx
push ecx
call fcn.004120fb
add esp, 8
push edi
mov edx, str.__Dias_data_path:
lea ecx, [ebp - 0xab8]
call fcn.0040a3a0
add esp, 4
mov ecx, eax
mov dword [ebp - 4], 0xf
call fcn.00401ca0
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0xaa4]
cmp edx, 0x10
jb 0x403a04
mov ecx, dword [ebp - 0xab8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4039fa
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403be9
push edx
push ecx
call fcn.004120fb
add esp, 8
mov dword [ebp - 0xb08], 0
mov dword [ebp - 0xb04], 0xf
mov byte [ebp - 0xb18], 0
mov dword [ebp - 4], 0x10
lea ecx, [ebp - 0xab8]
push str.DIASLog
mov edx, 0x45e904
mov dword [ebp - 0xb1c], 2
call fcn.0040a590
lea ecx, [ebp - 0xb18]
add esp, 4
cmp ecx, eax
je 0x403a7a
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0xb18], xmm0
movq xmm0, qword [eax + 0x10]
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
movq qword [ebp - 0xb08], xmm0
mov byte [eax], 0
lea ecx, [ebp - 0xab8]
call fcn.00408f50
lea eax, [ebp - 0xb1c]
mov ecx, 0x45e964
push eax
call fcn.004086e0
push str.DIASCfg
mov edx, 0x45e904
mov dword [ebp - 0xb1c], 1
lea ecx, [ebp - 0xab8]
call fcn.0040a590
add esp, 4
lea ecx, [ebp - 0xb18]
push eax
call fcn.00408fa0
lea ecx, [ebp - 0xab8]
call fcn.00408f50
lea eax, [ebp - 0xb1c]
mov ecx, 0x45e964
push eax
call fcn.004086e0
push 0x459c74
mov edx, 0x45e904
mov dword [ebp - 0xb1c], 1
lea ecx, [ebp - 0xb38]
call fcn.0040a590
add esp, 4
lea ecx, [ebp - 0xb18]
push eax
call fcn.00408fa0
lea ecx, [ebp - 0xb38]
call fcn.00408f50
lea eax, [ebp - 0xb1c]
mov ecx, 0x45e964
push eax
call fcn.004086e0
push 0x45e904
lea ecx, [ebp - 0xb18]
mov dword [ebp - 0xb1c], 1
call fcn.00408f20
lea eax, [ebp - 0xb1c]
mov ecx, 0x45e964
push eax
call fcn.004086e0
lea ecx, [ebp - 0xb18]
call fcn.00408f50
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00411cb8
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.0041c6cd
call fcn.0041c6cd
call fcn.0041c6cd
call fcn.0041c6cd
call fcn.0040a330
call fcn.0041c6cd
call fcn.0041c6cd
call fcn.0041c6cd
call fcn.0041c6cd
call fcn.0041c6cd
call fcn.0041c6cd
call fcn.0041c6cd
call fcn.0041c6cd
call fcn.0041c6cd
call fcn.0041c6cd
call fcn.0041c6cd
call fcn.0041c6cd
call fcn.0041c6cd
call fcn.0041c6cd
call fcn.0041c6cd
call fcn.0041c6cd
call fcn.0041c6cd
int3