Function at 0x403cd8
Capabilities:
Create directory
Delete directory
Delete registry key
Delete registry value
Move file
Query or enumerate registry key
Query or enumerate registry value
Read .ini file
Set file attributes
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x28c0
call fcn.0040e5f0
push 0x3ed
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp - 0x87c], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x128], ecx
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x12c], 5
lea edx, [ebp - 0x248]
mov dword [ebp - 0x118], edx
mov dword [ebp - 0x114], 0x104
lea eax, [ebp - 0x12c]
push eax
push 0
push 0x1005
mov ecx, dword [ebp - 0x87c]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [ebp - 0x10c]
mov dword [ebp - 0x144], edx
mov eax, dword [ebp - 0x144]
mov ecx, dword [eax + 8]
mov dword [ebp - 0x140], ecx
mov dword [ebp - 0x89c], 0
mov dword [ebp - 0x88c], 0x104
lea edx, [ebp - 0x65c]
mov dword [ebp - 0x890], edx
lea eax, [ebp - 0x8a4]
push eax
mov ecx, dword [ebp - 0x140]
push ecx
push 0x102d
mov edx, dword [ebp - 0x87c]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
cmp dword [ebp - 0x140], 0xffffffff
je 0x403dbb
mov eax, dword [ebp - 0x144]
xor ecx, ecx
mov cl, byte [eax + 4]
test ecx, ecx
je 0x403dc0
jmp case.0x403ea2.6
mov edx, dword [ebp + 0x10]
and edx, 0xff
test edx, edx
je 0x403dd9
mov byte [ebp - 0x130], 1
jmp 0x403e63
push 0xf000
mov eax, dword [ebp + 0xc]
push eax
push 0x102c
mov ecx, dword [ebp - 0x87c]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0x1000
jne 0x403e12
mov dword [ebp - 0x134], 0
jmp 0x403e1c
mov dword [ebp - 0x134], 1
cmp dword [ebp - 0x134], 0
je 0x403e3d
mov edx, dword [ebp - 0x144]
xor eax, eax
mov al, byte [edx + 0xc]
test eax, eax
jne 0x403e3d
mov byte [ebp - 0x130], 1
jmp 0x403e63
cmp dword [ebp - 0x134], 0
jne 0x403e5e
mov ecx, dword [ebp - 0x144]
xor edx, edx
mov dl, byte [ecx + 0xc]
test edx, edx
je 0x403e5e
mov byte [ebp - 0x130], 0
jmp 0x403e63
jmp case.0x403ea2.6
mov eax, dword [ebp - 0x144]
mov cl, byte [ebp - 0x130]
mov byte [eax + 0xc], cl
mov edx, dword [ebp - 0x144]
mov eax, dword [edx]
mov dword [ebp - 0x28ac], eax
mov ecx, dword [ebp - 0x28ac]
sub ecx, 1
mov dword [ebp - 0x28ac], ecx
cmp dword [ebp - 0x28ac], 8
ja case.0x403ea2.6
mov edx, dword [ebp - 0x28ac]
jmp dword [edx*4 + 0x404bac]
lea eax, [ebp - 0x248]
push eax
call fcn.00403bb0
add esp, 4
mov dword [ebp - 0x670], eax
jmp case.0x403ea2.6
mov dword [ebp - 0x670], 0x32
jmp case.0x403ea2.6
push 0x5c
mov ecx, dword [ebp - 0x144]
add ecx, 0x111
push ecx
call fcn.0040e530
add esp, 8
test eax, eax
je 0x403f19
push 0x5c
mov edx, dword [ebp - 0x144]
add edx, 0x111
push edx
call fcn.0040e530
add esp, 8
add eax, 1
push eax
lea eax, [ebp - 0x554]
push eax
call fcn.0040dc70
add esp, 8
jmp 0x403f35
mov ecx, dword [ebp - 0x144]
add ecx, 0x111
push ecx
lea edx, [ebp - 0x554]
push edx
call fcn.0040dc70
add esp, 8
mov eax, dword [ebp - 0x130]
and eax, 0xff
test eax, eax
je 0x404025
push 0x41b608
push 0x104
lea ecx, [ebp - 0x104]
push ecx
push 0
push 0x41b620
push 0x41b628
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [ebp - 0x554]
push edx
lea eax, [ebp - 0x104]
push eax
call fcn.0040de30
add esp, 8
test eax, eax
je 0x403fb5
lea ecx, [ebp - 0x104]
push ecx
push 0x41b630
push 0x41b638
call dword [sym.imp.KERNEL32.dll_WriteProfileStringA]
push 0x41b640
push 0
push 0x41b658
push 0x41b660
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
jmp 0x404020
push 0x41b668
push 0x104
lea edx, [ebp - 0x104]
push edx
push 0
push 0x41b680
push 0x41b684
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x554]
push eax
lea ecx, [ebp - 0x104]
push ecx
call fcn.0040de30
add esp, 8
test eax, eax
je 0x404020
lea edx, [ebp - 0x104]
push edx
push 0x41b68c
push 0x41b690
call dword [sym.imp.KERNEL32.dll_WriteProfileStringA]
push 0x41b698
push 0
push 0x41b6b0
push 0x41b6b4
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
jmp 0x4040f3
push 0x104
lea eax, [ebp - 0x104]
push eax
push 0
push 0x41b6bc
push 0x41b6c4
call dword [sym.imp.KERNEL32.dll_GetProfileStringA]
lea ecx, [ebp - 0x554]
push ecx
lea edx, [ebp - 0x104]
push edx
call fcn.0040de30
add esp, 8
test eax, eax
je 0x40408d
push 0x41b6cc
lea eax, [ebp - 0x104]
push eax
push 0x41b6e4
push 0x41b6ec
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push 0
push 0x41b6f4
push 0x41b6fc
call dword [sym.imp.KERNEL32.dll_WriteProfileStringA]
jmp 0x4040f3
push 0x104
lea ecx, [ebp - 0x104]
push ecx
push 0
push 0x41b704
push 0x41b708
call dword [sym.imp.KERNEL32.dll_GetProfileStringA]
lea edx, [ebp - 0x554]
push edx
lea eax, [ebp - 0x104]
push eax
call fcn.0040de30
add esp, 8
test eax, eax
je 0x4040f3
push 0x41b710
lea ecx, [ebp - 0x104]
push ecx
push 0x41b728
push 0x41b72c
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push 0
push 0x41b734
push 0x41b738
call dword [sym.imp.KERNEL32.dll_WriteProfileStringA]
jmp case.0x403ea2.6
mov edx, dword [ebp - 0x144]
cmp dword [edx], 6
jne 0x40412a
lea eax, [ebp - 0x248]
push eax
mov ecx, dword [ebp - 0x144]
add ecx, 0xd
push ecx
push 0x41b740
lea edx, [ebp - 0x104]
push edx
call fcn.0040dddb
add esp, 0x10
jmp 0x404145
mov eax, dword [ebp - 0x144]
add eax, 0x111
push eax
lea ecx, [ebp - 0x104]
push ecx
call fcn.0040dc70
add esp, 8
lea edx, [ebp - 0x104]
push edx
lea eax, [ebp - 0x878]
push eax
call fcn.0040dc70
add esp, 8
push 0x5c
lea ecx, [ebp - 0x878]
push ecx
call fcn.0040e530
add esp, 8
mov byte [eax + 1], 0
push 0x41b748
lea edx, [ebp - 0x878]
push edx
call fcn.0040dc80
add esp, 8
mov eax, dword [ebp - 0x130]
and eax, 0xff
test eax, eax
je 0x4041a1
lea ecx, [ebp - 0x450]
mov dword [ebp - 0x28b0], ecx
jmp 0x4041ad
lea edx, [ebp - 0x34c]
mov dword [ebp - 0x28b0], edx
lea eax, [ebp - 0x878]
push eax
mov ecx, dword [ebp - 0x28b0]
push ecx
call fcn.0040dc70
add esp, 8
mov edx, dword [ebp - 0x130]
and edx, 0xff
test edx, edx
je 0x4041e1
lea eax, [ebp - 0x450]
mov dword [ebp - 0x28b4], eax
jmp 0x4041ed
lea ecx, [ebp - 0x34c]
mov dword [ebp - 0x28b4], ecx
push 0x41b75c
mov edx, dword [ebp - 0x28b4]
push edx
call fcn.0040dc80
add esp, 8
mov eax, dword [ebp - 0x130]
and eax, 0xff
test eax, eax
je 0x40421e
lea ecx, [ebp - 0x450]
mov dword [ebp - 0x28b8], ecx
jmp 0x40422a
lea edx, [ebp - 0x34c]
mov dword [ebp - 0x28b8], edx
push 0x5c
lea eax, [ebp - 0x104]
push eax
call fcn.0040e530
add esp, 8
add eax, 1
push eax
mov ecx, dword [ebp - 0x28b8]
push ecx
call fcn.0040dc80
add esp, 8
mov edx, dword [ebp - 0x130]
and edx, 0xff
test edx, edx
je 0x40426c
lea eax, [ebp - 0x34c]
mov dword [ebp - 0x28bc], eax
jmp 0x404278
lea ecx, [ebp - 0x450]
mov dword [ebp - 0x28bc], ecx
lea edx, [ebp - 0x104]
push edx
mov eax, dword [ebp - 0x28bc]
push eax
call fcn.0040dc70
add esp, 8
lea ecx, [ebp - 0x34c]
push ecx
lea edx, [ebp - 0x878]
push edx
call fcn.0040dc70
add esp, 8
push 0x5c
lea eax, [ebp - 0x878]
push eax
call fcn.0040e530
add esp, 8
mov byte [eax], 0
push 0
lea ecx, [ebp - 0x878]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 2
lea edx, [ebp - 0x878]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x34c]
push eax
lea ecx, [ebp - 0x450]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x4042fc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x670], eax
jmp 0x404306
mov dword [ebp - 0x670], 0
mov edx, dword [ebp - 0x130]
and edx, 0xff
cmp edx, 1
jne 0x404338
push 0x5c
lea eax, [ebp - 0x450]
push eax
call fcn.0040e530
add esp, 8
mov byte [eax], 0
lea ecx, [ebp - 0x450]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp case.0x403ea2.6
push 0x41b760
call fcn.0040dd60
add esp, 4
push eax
push 0x41b768
mov edx, dword [ebp - 0x144]
add edx, 0xd
push edx
call fcn.0040e320
add esp, 0xc
test eax, eax
jne 0x404373
mov eax, dword [reloc.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x660], eax
jmp 0x40437f
mov ecx, dword [0x41b0bc]
mov dword [ebp - 0x660], ecx
mov edx, dword [ebp - 0x144]
add edx, 0x12
push edx
lea eax, [ebp - 0x774]
push eax
call fcn.0040dc70
add esp, 8
push 0x5c
lea ecx, [ebp - 0x774]
push ecx
call fcn.0040e530
add esp, 8
add eax, 1
push eax
lea edx, [ebp - 0x554]
push edx
call fcn.0040dc70
add esp, 8
push 0x5c
lea eax, [ebp - 0x774]
push eax
call fcn.0040e530
add esp, 8
mov byte [eax], 0
mov ecx, dword [ebp - 0x130]
and ecx, 0xff
cmp ecx, 1
jne 0x404437
lea edx, [ebp - 0x774]
push edx
lea eax, [ebp - 0x450]
push eax
call fcn.0040dc70
add esp, 8
push 0x41b770
lea ecx, [ebp - 0x450]
push ecx
call fcn.0040dc80
add esp, 8
push 0x41b774
lea edx, [ebp - 0x450]
push edx
call fcn.0040dc80
add esp, 8
lea eax, [ebp - 0x774]
push eax
lea ecx, [ebp - 0x34c]
push ecx
call fcn.0040dc70
add esp, 8
jmp 0x40448b
lea edx, [ebp - 0x774]
push edx
lea eax, [ebp - 0x34c]
push eax
call fcn.0040dc70
add esp, 8
push 0x41b788
lea ecx, [ebp - 0x34c]
push ecx
call fcn.0040dc80
add esp, 8
push 0x41b78c
lea edx, [ebp - 0x34c]
push edx
call fcn.0040dc80
add esp, 8
lea eax, [ebp - 0x774]
push eax
lea ecx, [ebp - 0x450]
push ecx
call fcn.0040dc70
add esp, 8
lea edx, [ebp - 0x668]
push edx
lea eax, [ebp - 0x450]
push eax
mov ecx, dword [ebp - 0x660]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0x670], eax
cmp dword [ebp - 0x670], 0
jne case.0x403ea2.6
mov edx, dword [ebp - 0x144]
cmp dword [edx], 2
jne 0x4045bc
push 0x41b7a0
lea eax, [ebp - 0x450]
push eax
call fcn.0040dc80
add esp, 8
lea ecx, [ebp - 0x554]
push ecx
lea edx, [ebp - 0x450]
push edx
call fcn.0040dc80
add esp, 8
push 0x41b7a4
lea eax, [ebp - 0x34c]
push eax
call fcn.0040dc80
add esp, 8
lea ecx, [ebp - 0x554]
push ecx
lea edx, [ebp - 0x34c]
push edx
call fcn.0040dc80
add esp, 8
push 0
lea eax, [ebp - 0x34c]
push eax
lea ecx, [ebp - 0x450]
push ecx
mov edx, dword [ebp - 0x660]
push edx
call fcn.00404bd0
add esp, 0x10
lea eax, [ebp - 0x554]
push eax
mov ecx, dword [ebp - 0x668]
push ecx
call fcn.00402b38
add esp, 8
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x664]
push edx
push 0
push 0
push 0
mov eax, dword [ebp - 0x668]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
cmp dword [ebp - 0x664], 0
jne 0x4045aa
push 0x5c
lea ecx, [ebp - 0x450]
push ecx
call fcn.0040e530
add esp, 8
mov byte [eax], 0
lea edx, [ebp - 0x450]
push edx
mov eax, dword [ebp - 0x660]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ecx, dword [ebp - 0x668]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp case.0x403ea2.6
mov edx, dword [ebp - 0x144]
cmp dword [edx], 1
jne 0x4048de
push 0x41b7a8
lea eax, [ebp - 0x554]
push eax
call fcn.0040e560
add esp, 8
test eax, eax
je 0x4045f1
lea ecx, [ebp - 0x554]
mov dword [ebp - 0x28c0], ecx
jmp 0x4045fb
mov dword [ebp - 0x28c0], 0x420ad8
lea edx, [ebp - 0x138]
push edx
push 0
push 0
push 0
mov eax, dword [ebp - 0x28c0]
push eax
mov ecx, dword [ebp - 0x668]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4048cc
lea edx, [ebp - 0x66c]
push edx
lea eax, [ebp - 0x34c]
push eax
mov ecx, dword [ebp - 0x660]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [ebp - 0x670], eax
cmp dword [ebp - 0x670], 0
jne 0x404887
push 0x41b7b4
lea edx, [ebp - 0x554]
push edx
call fcn.0040e560
add esp, 8
test eax, eax
jne 0x404671
mov byte [ebp - 0x554], 0
mov byte [ebp - 0x18a4], 0
mov eax, dword [ebp - 0x144]
movsx ecx, byte [eax + 0x215]
test ecx, ecx
je 0x404818
mov dword [ebp - 0x13c], 1
mov edx, dword [ebp - 0x144]
mov al, byte [edx + 0x215]
mov byte [ebp - 0x558], al
mov byte [ebp - 0x557], 0
mov dword [ebp - 0x138], 0x1000
lea ecx, [ebp - 0x138]
push ecx
lea edx, [ebp - 0x18a4]
push edx
lea eax, [ebp - 0x13c]
push eax
push 0
lea ecx, [ebp - 0x554]
push ecx
mov edx, dword [ebp - 0x66c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
movsx eax, byte [ebp - 0x18a4]
test eax, eax
je 0x404706
lea ecx, [ebp - 0x558]
push ecx
lea edx, [ebp - 0x18a4]
push edx
call fcn.0040dc80
add esp, 8
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x18a4]
push ecx
call fcn.0040dc80
add esp, 8
lea edx, [ebp - 0x18a4]
push edx
call fcn.0040dd60
add esp, 4
add eax, 1
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x138]
push eax
lea ecx, [ebp - 0x18a4]
push ecx
push 1
push 0
lea edx, [ebp - 0x554]
push edx
mov eax, dword [ebp - 0x66c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x138], 0x1000
lea ecx, [ebp - 0x138]
push ecx
lea edx, [ebp - 0x18a4]
push edx
lea eax, [ebp - 0x13c]
push eax
push 0
lea ecx, [ebp - 0x554]
push ecx
mov edx, dword [ebp - 0x668]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x18a4]
push ecx
call fcn.00402ad7
add esp, 8
lea edx, [ebp - 0x18a4]
push edx
call fcn.0040dd60
add esp, 4
add eax, 1
mov dword [ebp - 0x138], eax
lea eax, [ebp - 0x18a4]
push eax
call fcn.00403b66
add esp, 4
and eax, 0xff
test eax, eax
je 0x404802
mov ecx, dword [ebp - 0x138]
push ecx
lea edx, [ebp - 0x18a4]
push edx
mov eax, dword [ebp - 0x13c]
push eax
push 0
lea ecx, [ebp - 0x554]
push ecx
mov edx, dword [ebp - 0x668]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x404816
lea eax, [ebp - 0x554]
push eax
mov ecx, dword [ebp - 0x668]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x404887
mov dword [ebp - 0x138], 0x1000
lea edx, [ebp - 0x138]
push edx
lea eax, [ebp - 0x18a4]
push eax
lea ecx, [ebp - 0x13c]
push ecx
push 0
lea edx, [ebp - 0x554]
push edx
mov eax, dword [ebp - 0x668]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 0x138]
push ecx
lea edx, [ebp - 0x18a4]
push edx
push 1
push 0
lea eax, [ebp - 0x554]
push eax
mov ecx, dword [ebp - 0x66c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea edx, [ebp - 0x554]
push edx
mov eax, dword [ebp - 0x668]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x664]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
mov edx, dword [ebp - 0x668]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
cmp dword [ebp - 0x664], 0
jne 0x4048cc
lea eax, [ebp - 0x450]
push eax
mov ecx, dword [ebp - 0x660]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov edx, dword [ebp - 0x668]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp case.0x403ea2.6
mov eax, dword [ebp - 0x668]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x668]
push ecx
push 0x2001f
push 0
lea edx, [ebp - 0x450]
push edx
mov eax, dword [ebp - 0x660]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x670], eax
cmp dword [ebp - 0x670], 0
jne case.0x403ea2.6
mov dword [ebp - 0x18a8], 0x1000
mov dword [ebp - 0x18a8], 0x1000
lea ecx, [ebp - 0x18a8]
push ecx
lea edx, [ebp - 0x28a8]
push edx
lea eax, [ebp - 0x13c]
push eax
push 0
lea ecx, [ebp - 0x554]
push ecx
mov edx, dword [ebp - 0x668]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x670], eax
lea eax, [ebp - 0x66c]
push eax
lea ecx, [ebp - 0x34c]
push ecx
mov edx, dword [ebp - 0x660]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov dword [ebp - 0x670], eax
mov dword [ebp - 0x18a8], 0x1000
lea eax, [ebp - 0x18a8]
push eax
lea ecx, [ebp - 0x28a8]
push ecx
push 0
push 0
lea edx, [ebp - 0x554]
push edx
mov eax, dword [ebp - 0x66c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x404a32
mov ecx, dword [ebp - 0x18a8]
add ecx, 1
mov dword [ebp - 0x18a8], ecx
mov dword [ebp - 0x13c], 1
cmp dword [ebp - 0x13c], 0
je 0x404a13
movsx edx, byte [ebp - 0x28a8]
test edx, edx
je 0x4049fb
push 0x41b7c0
lea eax, [ebp - 0x28a8]
push eax
call fcn.0040dc80
add esp, 8
lea ecx, [ebp - 0x248]
push ecx
lea edx, [ebp - 0x28a8]
push edx
call fcn.0040dc80
add esp, 8
jmp 0x404a30
lea eax, [ebp - 0x248]
push eax
mov ecx, dword [ebp - 0x18a8]
lea edx, [ebp + ecx - 0x28a7]
push edx
call fcn.0040dc80
add esp, 8
jmp 0x404a52
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x28a8]
push ecx
call fcn.0040dc70
add esp, 8
mov dword [ebp - 0x18a8], 0
lea edx, [ebp - 0x248]
push edx
call fcn.0040dd60
add esp, 4
mov ecx, dword [ebp - 0x18a8]
add ecx, eax
push ecx
lea edx, [ebp - 0x28a8]
push edx
mov eax, dword [ebp - 0x13c]
push eax
push 0
lea ecx, [ebp - 0x554]
push ecx
mov edx, dword [ebp - 0x66c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x66c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x18a8], 0x1000
lea ecx, [ebp - 0x18a8]
push ecx
lea edx, [ebp - 0x28a8]
push edx
lea eax, [ebp - 0x13c]
push eax
push 0
lea ecx, [ebp - 0x554]
push ecx
mov edx, dword [ebp - 0x668]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x670], eax
cmp dword [ebp - 0x670], 0
jne 0x404b9b
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x28a8]
push ecx
call fcn.00402ad7
add esp, 8
and eax, 0xff
test eax, eax
je 0x404b9b
lea edx, [ebp - 0x28a8]
push edx
call fcn.00403b66
add esp, 4
and eax, 0xff
test eax, eax
je 0x404b5d
lea eax, [ebp - 0x28a8]
push eax
call fcn.0040dd60
add esp, 4
add eax, 1
push eax
lea ecx, [ebp - 0x28a8]
push ecx
mov edx, dword [ebp - 0x13c]
push edx
push 0
lea eax, [ebp - 0x554]
push eax
mov ecx, dword [ebp - 0x668]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x670], eax
jmp 0x404b9b
lea edx, [ebp - 0x554]
push edx
mov eax, dword [ebp - 0x668]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 0x670], eax
mov ecx, dword [ebp - 0x130]
and ecx, 0xff
test ecx, ecx
je 0x404b9b
lea edx, [ebp - 0x450]
push edx
mov eax, dword [ebp - 0x660]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ecx, dword [ebp - 0x668]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret