Function at 0x416db9
Capabilities:
Delete registry value
Persist via run registry key
Query or enumerate registry value

Disassembly:
mov eax, 0x476982
call fcn.004461a8
sub esp, 0x54c
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
xor edi, edi
mov ebx, 0x47e5e0
mov esi, 0x47e5d8
cmp eax, edi
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x38], esi
jne 0x416dea
mov eax, 0x49cc4c
lea ecx, [ebp - 0x1e]
push edi
push ecx
push eax
lea ecx, [ebp - 0x58]
call fcn.00403c0d
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], edi
movzx eax, word [eax]
add eax, 0xffffffbf
cmp eax, 0x39
ja case.0x416e0d.71
jmp dword [eax*4 + 0x417c28]
push 0x493434
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x416e3c
push edi
push edi
mov dword [0x4a1c10], 1
push str._auto
jmp 0x417be9
mov eax, dword [ebp + 8]
cmp dword [eax + 0x24], edi
je 0x416e50
push eax
call fcn.00416641
pop ecx
jmp 0x416f83
mov ecx, dword [ebp + 8]
push edi
push edi
push 0x493420
mov dword [ecx + 0x24], 1
call fcn.0043201b
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_CharNextW]
cmp eax, edi
mov dword [ebp - 0x210], ebx
mov dword [ebp - 0x1f0], esi
jne 0x416e84
mov eax, 0x49cc4c
lea ecx, [ebp - 0x23]
push edi
push ecx
push eax
lea ecx, [ebp - 0x210]
call fcn.00403c0d
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x210]
push edi
push eax
push 0x10
mov byte [ebp - 4], 1
call fcn.004082ae
and byte [ebp - 4], 0
lea ecx, [ebp - 0x210]
jmp 0x4178a9
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_CharNextW]
cmp eax, edi
mov dword [ebp - 0x328], ebx
mov dword [ebp - 0x308], esi
jne 0x416ed8
mov eax, 0x49cc4c
lea ecx, [ebp - 0x25]
push edi
push ecx
push eax
lea ecx, [ebp - 0x328]
call fcn.00403c0d
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x328]
push edi
push eax
push 0xd
mov byte [ebp - 4], 2
call fcn.004082ae
and byte [ebp - 4], 0
lea ecx, [ebp - 0x328]
jmp 0x4178a9
mov esi, dword [ebp + 8]
push 1
pop edi
mov ecx, esi
push edi
call fcn.0042e858
mov dword [esi + 0x5c], edi
jmp 0x417bf1
mov eax, str.debuglog
mov dword [ebp - 0x120], ebx
mov ecx, eax
mov dword [ebp - 0x100], esi
test ecx, ecx
jne 0x416f40
mov eax, 0x49cc4c
lea ecx, [ebp - 0x26]
push edi
push ecx
push eax
lea ecx, [ebp - 0x120]
call fcn.00403c0d
lea eax, [ebp - 0x120]
push edi
push eax
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 3
call fcn.004049d2
mov ebx, eax
lea ecx, [ebp - 0x120]
neg ebx
sbb bl, bl
and byte [ebp - 4], 0
inc bl
call fcn.00401f6c
test bl, bl
push 1
je 0x416f96
pop edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.00401f6c
mov eax, edi
jmp 0x417c19
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_CharNextW]
push eax
push 0x493404
jmp 0x417be9
mov eax, 0x4933f4
mov dword [ebp - 0x170], ebx
mov ecx, eax
mov dword [ebp - 0x150], esi
test ecx, ecx
jne 0x416fc6
mov eax, 0x49cc4c
lea ecx, [ebp - 0x18]
push edi
push ecx
push eax
lea ecx, [ebp - 0x170]
call fcn.00403c0d
lea eax, [ebp - 0x170]
push edi
push eax
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 4
call fcn.004049d2
test eax, eax
jne 0x417048
mov eax, 0x4933f0
mov dword [ebp - 0x260], ebx
mov ecx, eax
mov dword [ebp - 0x240], esi
test ecx, ecx
jne 0x41700b
mov eax, 0x49cc4c
lea ecx, [ebp - 0x20]
push edi
push ecx
push eax
lea ecx, [ebp - 0x260]
call fcn.00403c0d
lea eax, [ebp - 0x260]
lea ecx, [ebp - 0x58]
push eax
mov byte [ebp - 4], 5
call fcn.00414c09
lea ecx, [ebp - 0x260]
mov bl, al
mov byte [ebp - 4], 4
call fcn.00401f6c
test bl, bl
je 0x417048
mov bl, 1
jmp 0x41704a
xor bl, bl
and byte [ebp - 4], 0
lea ecx, [ebp - 0x170]
call fcn.00401f6c
test bl, bl
je 0x41708f
push 0xffffffffffffffff
lea eax, [ebp - 0x350]
push 5
push eax
lea ecx, [ebp - 0x58]
call fcn.00402c05
mov ecx, dword [ebp + 8]
push edi
push eax
push 0x13
mov byte [ebp - 4], 6
call fcn.004082ae
and byte [ebp - 4], 0
lea ecx, [ebp - 0x350]
jmp 0x4178a9
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_CharNextW]
mov ebx, eax
push str._IS_E_
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x4170bc
mov esi, 0x4a140c
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x41715e
mov dword [ebp + 0xc], edi
push 0xf003f
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 7
call fcn.00417d10
test eax, eax
jne 0x417266
xor edx, edx
mov ecx, 0x81
lea edi, [ebp - 0x556]
mov word [ebp - 0x558], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x104
push eax
lea eax, [ebp - 0x558]
push eax
lea eax, [ebp - 0x10]
push eax
push edx
push ebx
mov dword [ebp - 0x10], edx
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x558]
mov esi, 0x4a140c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
je 0x417150
push dword [ebp + 0xc]
call edi
mov dword [ebp + 0xc], ebx
and byte [ebp - 4], 0
cmp dword [ebp + 0xc], ebx
je 0x41715e
push dword [ebp + 0xc]
call edi
push esi
call fcn.004418af
mov eax, dword [ebp + 8]
mov dword [eax + 0x5c], 1
mov eax, dword [0x4a0be0]
test eax, eax
jne 0x41717c
mov eax, 0x47e5b8
push eax
push esi
push 0x49f5e0
call fcn.004419d2
lea eax, [ebp - 0x1a]
push 0
mov ebx, 0x49cc4c
mov edi, 0x47e5a0
mov esi, 0x47e598
push eax
push ebx
lea ecx, [ebp - 0x2b0]
mov dword [ebp - 0x2b0], edi
mov dword [ebp - 0x290], esi
call fcn.00408d43
mov eax, dword [str.PackageName]
mov byte [ebp - 4], 8
test eax, eax
mov dword [ebp - 0x1c0], edi
mov dword [ebp - 0x1a0], esi
jne 0x4171d0
mov eax, ebx
lea ecx, [ebp - 0x24]
push 0
push ecx
push eax
lea ecx, [ebp - 0x1c0]
call fcn.00408d43
mov eax, dword [str.Startup]
mov byte [ebp - 4], 9
test eax, eax
mov dword [ebp - 0x300], edi
mov dword [ebp - 0x2e0], esi
je 0x4171fd
mov ebx, eax
lea eax, [ebp - 0x1c]
push 0
push eax
push ebx
lea ecx, [ebp - 0x300]
call fcn.00408d43
lea eax, [ebp - 0x2b0]
mov ecx, dword [ebp + 8]
push eax
lea eax, [ebp - 0x1c0]
push eax
lea eax, [ebp - 0x300]
push eax
push 6
mov byte [ebp - 4], 0xa
call fcn.004083ce
lea ecx, [ebp - 0x300]
call fcn.00401bc7
lea ecx, [ebp - 0x1c0]
call fcn.00401bc7
and byte [ebp - 4], 0
lea ecx, [ebp - 0x2b0]
call fcn.00401bc7
mov ecx, dword [ebp + 8]
push 2
call fcn.0042e87a
jmp 0x417bf1
push dword [ebp + 8]
call fcn.00416641
cmp dword [ebp + 0xc], edi
pop ecx
je 0x417c0b
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 0xc], edi
jmp 0x417c0b
mov ebx, dword [ebp + 0xc]
mov esi, dword [sym.imp.USER32.dll_CharNextW]
push ebx
call esi
movzx eax, word [eax]
sub eax, 0x31
je 0x4172e1
dec eax
je 0x4172cf
dec eax
je 0x4172b2
push edi
push ebx
call esi
push eax
push 0x4933d8
jmp 0x417be9
mov edi, dword [ebp + 8]
push ebx
mov byte [edi + 0x280], 1
call esi
push eax
call esi
push eax
mov ecx, edi
call fcn.0042e778
jmp 0x417bf1
push edi
push ebx
call esi
push eax
call esi
push eax
push 0x4933d0
jmp 0x417be9
push edi
push ebx
call esi
push eax
call esi
mov esi, dword [ebp + 8]
push eax
push 0x492ee4
mov ecx, esi
call fcn.0043201b
mov dword [esi + 0x64], 1
jmp 0x417bf1
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str.hide_progress
push dword [ebp + 0xc]
call esi
mov edi, dword [ebp + 8]
test eax, eax
jne 0x417322
mov byte [edi + 0x27a], 1
push str.hide_splash
push dword [ebp + 0xc]
call esi
test eax, eax
jne 0x417bf1
mov byte [edi + 0x27b], 1
jmp 0x417bf1
mov eax, str.instance
mov dword [ebp - 0xa8], ebx
mov ecx, eax
mov dword [ebp - 0x88], esi
test ecx, ecx
jne 0x41735c
mov eax, 0x49cc4c
lea ecx, [ebp - 0x22]
push edi
push ecx
push eax
lea ecx, [ebp - 0xa8]
call fcn.00403c0d
lea eax, [ebp - 0xa8]
push edi
push eax
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0xb
call fcn.004049d2
mov ebx, eax
lea ecx, [ebp - 0xa8]
neg ebx
sbb bl, bl
and byte [ebp - 4], 0
inc bl
call fcn.00401f6c
test bl, bl
je 0x417bf1
mov eax, dword [ebp + 8]
push 0xfffffffffffffffd
pop edi
lea ecx, [ebp - 0x58]
lea esi, [eax + 0x27c]
push 0xffffffffffffffff
lea eax, [ebp - 0xd0]
push 9
push eax
mov dword [esi], edi
call fcn.00402c05
lea eax, [ebp - 0xd0]
lea ecx, [ebp - 0xcc]
neg eax
sbb eax, eax
push str.default
and eax, ecx
mov byte [ebp - 4], 0xc
push eax
call fcn.00417f26
pop ecx
test al, al
pop ecx
je 0x4173ed
or dword [esi], 0xffffffff
jmp 0x417401
push 0xa
push esi
lea ecx, [ebp - 0xd0]
call fcn.00417e04
test al, al
jne 0x417401
mov dword [esi], edi
and byte [ebp - 4], 0
lea ecx, [ebp - 0xd0]
jmp 0x4178a9
mov eax, dword [ebp + 8]
cmp dword [eax + 0x24], edi
jne case.0x416e0d.71
push dword [ebp + 0xc]
mov dword [eax + 0x24], 3
call dword [sym.imp.USER32.dll_CharNextW]
cmp eax, edi
mov dword [ebp + 0xc], eax
mov dword [ebp - 0xf8], ebx
mov dword [ebp - 0xd8], esi
jne 0x417444
mov eax, 0x49cc4c
lea ecx, [ebp - 0x15]
push edi
push ecx
push eax
lea ecx, [ebp - 0xf8]
call fcn.00403c0d
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0xf8]
push edi
push eax
push 9
mov byte [ebp - 4], 0xd
call fcn.004082ae
and byte [ebp - 4], 0
lea ecx, [ebp - 0xf8]
call fcn.00401f6c
push edi
push dword [ebp + 0xc]
push 0x493370
jmp 0x417be9
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push esi
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x14], edi
call dword [sym.imp.USER32.dll_CharNextW]
push eax
call fcn.00417f49
add esp, 0xc
test eax, eax
je 0x4174b9
mov eax, dword [ebp - 0x14]
mov dword [esi + 0x60], eax
mov dword [0x4a0208], eax
jmp 0x417bf1
push esi
jmp 0x417c05
push dword [ebp + 0xc]
mov esi, dword [sym.imp.USER32.dll_CharNextW]
call esi
movzx ecx, word [eax]
sub ecx, 0x31
je 0x4174ee
dec ecx
push edi
push eax
je 0x4174e1
push 0x493368
jmp 0x417be9
call esi
push eax
push 0x493360
jmp 0x417be9
push edi
push eax
call esi
push eax
push 0x493358
jmp 0x417be9
push str.noscript_uninst
push dword [ebp + 0xc]
call fcn.00447336
pop ecx
test eax, eax
pop ecx
jne 0x41751c
push edi
push edi
push str._noscript_uninst
jmp 0x417be9
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_CharNextW]
cmp eax, edi
mov dword [ebp - 0x148], ebx
mov dword [ebp - 0x128], esi
jne 0x41753a
mov eax, 0x49cc4c
lea ecx, [ebp - 0x16]
push edi
push ecx
push eax
lea ecx, [ebp - 0x148]
call fcn.00403c0d
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x148]
push edi
push eax
push 6
mov ecx, esi
mov byte [ebp - 4], 0xe
call fcn.004082ae
and byte [ebp - 4], 0
lea ecx, [ebp - 0x148]
call fcn.00401f6c
push 2
mov ecx, esi
call fcn.0042e87a
mov dword [esi + 0x5c], 1
jmp 0x417bf1
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_CharNextW]
push eax
push 0x49ccbc
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x417bf1
mov eax, dword [ebp + 8]
mov byte [eax + 0x281], 1
jmp 0x417bf1
push str.removeonly
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4175ce
push edi
push edi
push str._removeonly
jmp 0x417be9
push 0x492bc0
push dword [ebp + 0xc]
call fcn.00447336
pop ecx
test eax, eax
pop ecx
je 0x417bf1
push str.runfromtemp
push dword [ebp + 0xc]
call fcn.00447336
pop ecx
test eax, eax
pop ecx
je 0x417bf1
mov eax, str.runprerequisites
mov dword [ebp - 0x198], ebx
mov ecx, eax
mov dword [ebp - 0x178], esi
test ecx, ecx
jne 0x417618
mov eax, 0x49cc4c
lea ecx, [ebp - 0x17]
push edi
push ecx
push eax
lea ecx, [ebp - 0x198]
call fcn.00403c0d
lea eax, [ebp - 0x198]
push edi
push eax
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 0xf
call fcn.004049d2
mov ebx, eax
lea ecx, [ebp - 0x198]
neg ebx
sbb bl, bl
and byte [ebp - 4], 0
inc bl
call fcn.00401f6c
test bl, bl
jne 0x417bf1
push 6
push str.reboot
push dword [ebp + 0xc]
call fcn.00446bd7
add esp, 0xc
test eax, eax
je 0x417bf1
push str.removeasmajorupgrade
push dword [ebp + 0xc]
call fcn.00447336
pop ecx
test eax, eax
pop ecx
je 0x417bf1
push edi
push edi
push 0x493264
jmp 0x417be9
push 0x49325c
push dword [ebp + 0xc]
call fcn.00447336
pop ecx
test eax, eax
pop ecx
je 0x4176c2
push edi
push edi
mov dword [0x4a1c14], 1
push 0x493254
jmp 0x417be9
push edi
push edi
push str._SMS
jmp 0x417be9
mov esi, str.tempdisk1folder
push esi
call fcn.004468ff
pop ecx
push eax
push edi
push esi
lea ecx, [ebp - 0x54]
call fcn.00402abf
cmp eax, edi
je 0x417bf1
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_CharNextW]
mov esi, eax
push str._IS_T_
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x417716
mov ecx, dword [ebp + 8]
push esi
call fcn.0042e72a
jmp 0x4177be
mov dword [ebp + 0xc], edi
push 0xf003f
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 0x10
call fcn.00417d10
test eax, eax
jne 0x4177d7
xor ebx, ebx
mov ecx, 0x81
lea edi, [ebp - 0x556]
mov word [ebp - 0x558], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x104
push eax
lea eax, [ebp - 0x558]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push esi
mov dword [ebp - 0x10], ebx
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x558]
push eax
call fcn.004418af
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x558]
push eax
call fcn.0042e72a
push esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp dword [ebp + 0xc], ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x4177b0
push dword [ebp + 0xc]
call esi
mov dword [ebp + 0xc], ebx
and byte [ebp - 4], 0
cmp dword [ebp + 0xc], ebx
je 0x4177be
push dword [ebp + 0xc]
call esi
mov ecx, dword [ebp + 8]
push 3
call fcn.0042e87a
mov eax, dword [ebp + 8]
mov dword [eax + 0x5c], 1
jmp 0x417bf1
push dword [ebp + 8]
call fcn.00416641
cmp dword [ebp + 0xc], edi
pop ecx
je 0x417c0b
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 0xc], edi
jmp 0x417c0b
push dword [ebp + 0xc]
mov edi, dword [sym.imp.USER32.dll_CharNextW]
call edi
movzx eax, word [eax]
cmp eax, 0x41
je 0x417905
cmp eax, 0x4d
je 0x4178b3
cmp eax, 0x57
je 0x417859
cmp eax, 0x61
je 0x417905
cmp eax, 0x6d
je 0x4178b3
cmp eax, 0x77
je 0x417859
push str.uninst
push dword [ebp + 0xc]
call fcn.00447336
pop ecx
test eax, eax
pop ecx
jne 0x417bf1
push eax
push eax
push str._uninst
jmp 0x417be9
push dword [ebp + 0xc]
call edi
push eax
call edi
test eax, eax
mov dword [ebp - 0x1e8], ebx
mov dword [ebp - 0x1c8], esi
jne 0x417876
mov eax, 0x49cc4c
lea ecx, [ebp - 0x19]
push 0
push ecx
push eax
lea ecx, [ebp - 0x1e8]
call fcn.00403c0d
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x1e8]
push 0
push eax
push 0xb
mov byte [ebp - 4], 0x12
call fcn.004082ae
and byte [ebp - 4], 0
lea ecx, [ebp - 0x1e8]
call fcn.00401f6c
jmp 0x417bf1
push dword [ebp + 0xc]
call edi
push eax
call edi
test eax, eax
mov dword [ebp - 0x238], ebx
mov dword [ebp - 0x218], esi
jne 0x4178d0
mov eax, 0x49cc4c
lea ecx, [ebp - 0x1b]
push 0
push ecx
push eax
lea ecx, [ebp - 0x238]
call fcn.00403c0d
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x238]
push 0
push eax
push 0xc
mov byte [ebp - 4], 0x13
call fcn.004082ae
and byte [ebp - 4], 0
lea ecx, [ebp - 0x238]
jmp 0x4178a9
push dword [ebp + 0xc]
call edi
push eax
call edi
test eax, eax
mov dword [ebp - 0x288], ebx
mov dword [ebp - 0x268], esi
jne 0x417922
mov eax, 0x49cc4c
lea ecx, [ebp - 0x1d]
push 0
push ecx
push eax
lea ecx, [ebp - 0x288]
call fcn.00403c0d
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x288]
push 0
push eax
push 0xa
mov byte [ebp - 4], 0x11
call fcn.004082ae
and byte [ebp - 4], 0
lea ecx, [ebp - 0x288]
jmp 0x4178a9
mov dword [ebp - 0x10], edi
push 0xf003f
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x14
call fcn.00417d10
test eax, eax
jne 0x41799b
push str.ISSetup
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp dword [ebp - 0x10], edi
je 0x41799b
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], edi
push 7
push str.verbose
push dword [ebp + 0xc]
call fcn.00446bd7
add esp, 0xc
test eax, eax
je 0x417b77
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_CharNextW]
push str._IS_V_
push eax
mov dword [ebp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x417a69
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 8
push eax
mov eax, dword [ebp + 8]
lea ecx, [eax + 0x14]
call fcn.00408c0c
cmp dword [eax + 0xc], edi
mov dword [ebp - 0x14], eax
je 0x417a0f
push 0x492bbc
call fcn.004468ff
pop ecx
push eax
mov eax, dword [ebp - 0x14]
push 0x492bbc
lea ecx, [eax + 4]
call fcn.004152f5
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x80], ebx
cmp eax, edi
mov dword [ebp - 0x60], esi
jne 0x417a21
mov eax, 0x49cc4c
lea ecx, [ebp - 0x1f]
push edi
push ecx
push eax
lea ecx, [ebp - 0x80]
call fcn.00403c0d
push dword [0x47e5e8]
lea eax, [ebp - 0x80]
neg eax
sbb eax, eax
lea ecx, [ebp - 0x7c]
and eax, ecx
push edi
push eax
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 0x15
lea ecx, [eax + 4]
call fcn.004102b9
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 0x14
call fcn.00401f6c
mov esi, dword [ebp + 0xc]
push 1
push esi
jmp 0x417b4d
push 0xf003f
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x10]
call fcn.00417d10
test eax, eax
jne 0x417b54
xor edx, edx
mov ecx, 0x81
lea edi, [ebp - 0x556]
mov word [ebp - 0x558], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x104
push eax
lea eax, [ebp - 0x558]
push eax
lea eax, [ebp - 0x30]
push eax
push edx
push dword [ebp + 0xc]
mov dword [ebp - 0x30], edx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp dword [ebp - 0x10], 0
je 0x417ae5
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x558]
mov dword [ebp - 0x2d8], ebx
test eax, eax
mov dword [ebp - 0x2b8], esi
lea eax, [ebp - 0x558]
jne 0x417b06
mov eax, 0x49cc4c
lea ecx, [ebp - 0x21]
push 0
push ecx
push eax
lea ecx, [ebp - 0x2d8]
call fcn.00403c0d
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x2d8]
push 0
push eax
push 8
mov byte [ebp - 4], 0x16
call fcn.004082ae
lea ecx, [ebp - 0x2d8]
mov byte [ebp - 4], 0x14
call fcn.00401f6c
lea eax, [ebp - 0x558]
push 1
lea esi, [ebp - 0x558]
push eax
push 0x492410
jmp 0x417b85
push dword [ebp + 8]
call fcn.00416641
cmp dword [ebp - 0x10], edi
pop ecx
je 0x417c0b
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], edi
jmp 0x417c0b
mov eax, dword [ebp + 0xc]
push 1
lea esi, [eax + 0xe]
push esi
push str._verbose
mov ecx, dword [ebp + 8]
call fcn.0043201b
test esi, esi
je 0x417ba4
push esi
push 0x49cd84
mov byte [0x49ed88], 1
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp dword [ebp - 0x10], 0
je 0x417bf1
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x10], 0
jmp 0x417bf1
mov eax, dword [ebp + 8]
mov dword [eax + 0x4c], 1
jmp 0x417bf1
mov eax, dword [ebp + 8]
cmp dword [eax + 0x24], edi
je 0x417bd0
push eax
jmp 0x417c05
mov dword [eax + 0x24], 4
jmp 0x417bf1
push edi
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_CharNextW]
push eax
push 0x493150
mov ecx, dword [ebp + 8]
call fcn.0043201b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.00401f6c
push 1
pop eax
jmp 0x417c19
push dword [ebp + 8]
call fcn.00416641
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.00401f6c
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret