Function at 0x418540
Capabilities:
Delete registry value
Get session user name
Parse pe header
Persist via run registry key
Schedule task via itaskservice

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50a85c
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xc8
push esi
push edi
mov eax, dword [0x546330]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jns 0x418591
xor eax, eax
jmp 0x419877
push 0
push 0
push 0
push 3
push 6
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0
push eax
push 0x5350e4
push 1
push 0
push 0x523b20
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x4185ee
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4185e7
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor esi, esi
jmp 0x41986f
mov esi, dword [ebp - 0x14]
xorps xmm0, xmm0
mov eax, dword [esi]
movups xmmword [ebp - 0x98], xmm0
mov edi, dword [eax + 0x28]
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
movups xmm0, xmmword [ebp - 0x98]
lea eax, [ebp - 0x88]
push eax
movups xmmword [ebp - 0xb8], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0x88], xmm0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
movups xmm0, xmmword [ebp - 0x88]
lea eax, [ebp - 0xa8]
push eax
movups xmmword [ebp - 0xc8], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0xa8], xmm0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
movups xmm0, xmmword [ebp - 0xa8]
lea eax, [ebp - 0x78]
push eax
movups xmmword [ebp - 0xd8], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0x78], xmm0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov byte [ebp - 4], 5
sub esp, 0x10
movups xmm0, xmmword [ebp - 0xb8]
mov eax, esp
sub esp, 0x10
movups xmmword [eax], xmm0
mov eax, esp
sub esp, 0x10
movups xmm0, xmmword [ebp - 0xc8]
movups xmmword [eax], xmm0
mov eax, esp
sub esp, 0x10
movups xmm0, xmmword [ebp - 0xd8]
movups xmmword [eax], xmm0
mov eax, esp
movups xmm0, xmmword [ebp - 0x78]
push esi
movups xmmword [eax], xmm0
call edi
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov esi, eax
lea eax, [ebp - 0x78]
push eax
call edi
lea eax, [ebp - 0xa8]
push eax
call edi
lea eax, [ebp - 0x88]
push eax
call edi
lea eax, [ebp - 0x98]
push eax
call edi
test esi, esi
jns 0x4186ef
mov dword [ebp - 4], 6
jmp 0x4185da
mov dword [ebp - 0x2c], 0
mov byte [ebp - 4], 7
mov esi, dword [ebp - 0x14]
push 0x533a50
mov eax, dword [esi]
mov eax, dword [eax + 0x1c]
mov dword [ebp - 0x34], eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov dword [ebp - 0x64], edi
test edi, edi
je 0x41988d
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 8
push eax
push edi
push esi
call dword [ebp - 0x34]
push edi
mov esi, eax
mov byte [ebp - 4], 7
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
test esi, esi
jns 0x418758
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x41874c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], 0xa
jmp 0x4185da
mov edi, dword [ebp - 0x2c]
mov eax, dword [edi]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebx + 8]
test eax, eax
jne 0x418771
xor esi, esi
mov dword [ebp - 0x34], esi
jmp 0x418785
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x34], esi
test esi, esi
je 0x41988d
push 0
push eax
push edi
mov byte [ebp - 4], 0xb
call dword [ebp - 0x30]
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [ebp - 0x18], 0
mov byte [ebp - 4], 0xc
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 0x14]
push edx
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
test eax, eax
jns 0x4187e3
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x4187c6
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x4187d7
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], 0xf
jmp 0x4185da
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x4187fb
mov dword [ebp - 0x14], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 0x28], 0
mov byte [ebp - 4], 0x11
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0x18]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
jns 0x418856
mov byte [ebp - 4], 0x12
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x418828
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x13
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x418839
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x14
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x41884a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], 0x15
jmp 0x4185da
mov edi, dword [ebp - 0x28]
mov eax, dword [edi]
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00419b30
mov byte [ebp - 4], 0x16
mov eax, dword [eax]
test eax, eax
jne 0x4188c4
xor esi, esi
mov dword [ebp - 0x34], esi
push eax
push edi
mov byte [ebp - 4], 0x17
call dword [ebp - 0x30]
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov byte [ebp - 4], 0x11
or eax, 0xffffffff
mov edx, dword [ebp - 0x1c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4188a8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x28]
mov eax, dword [edi]
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x34], eax
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 0xc]
test eax, eax
jne 0x4188da
xor esi, esi
mov dword [ebp - 0x1c], esi
jmp 0x4188ee
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x34], esi
test esi, esi
je 0x41988d
jmp 0x418879
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x41988d
push eax
push edi
mov byte [ebp - 4], 0x18
call dword [ebp - 0x34]
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push esi
call edi
mov byte [ebp - 4], 0x19
mov ecx, dword [ebp - 0x28]
test ecx, ecx
je 0x418918
mov dword [ebp - 0x28], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 0x24], 0
mov byte [ebp - 4], 0x1a
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0x18]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
test eax, eax
jns 0x418984
mov byte [ebp - 4], 0x1b
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x418945
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x1c
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x418956
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x1d
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x418967
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x1e
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x418978
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], 0x1f
jmp 0x4185da
mov dword [ebp - 0x40], 0
mov byte [ebp - 4], 0x20
lea edx, [ebp - 0x40]
mov eax, dword [ebp - 0x24]
push edx
push 9
push eax
mov ecx, dword [eax]
call dword [ecx + 0x28]
mov esi, eax
mov byte [ebp - 4], 0x21
mov edx, dword [ebp - 0x24]
test edx, edx
je 0x4189bb
mov dword [ebp - 0x24], 0
mov ecx, dword [edx]
push edx
call dword [ecx + 8]
mov edx, dword [ebp - 0x24]
test esi, esi
jns 0x418a20
mov byte [ebp - 4], 0x22
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x4189d3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edx, dword [ebp - 0x24]
mov byte [ebp - 4], 0x23
test edx, edx
je 0x4189e1
mov eax, dword [edx]
push edx
call dword [eax + 8]
mov byte [ebp - 4], 0x24
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x4189f2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x25
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x418a03
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x26
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x418a14
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], 0x27
jmp 0x4185da
mov byte [ebp - 4], 0x28
xor ecx, ecx
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x38], ecx
test eax, eax
je 0x418a52
mov ecx, dword [eax]
lea edx, [ebp - 0x38]
push edx
push 0x5350d4
push eax
call dword [ecx]
mov edx, dword [ebp - 0x24]
test eax, eax
mov eax, dword [ebp - 0x40]
jns 0x418a4f
xor ecx, ecx
mov dword [ebp - 0x38], ecx
jmp 0x418a52
mov ecx, dword [ebp - 0x38]
mov byte [ebp - 4], 0x29
test ecx, ecx
jne 0x418ab8
mov byte [ebp - 4], 0x2b
test eax, eax
je 0x418a6b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edx, dword [ebp - 0x24]
mov byte [ebp - 4], 0x2c
test edx, edx
je 0x418a79
mov eax, dword [edx]
push edx
call dword [eax + 8]
mov byte [ebp - 4], 0x2d
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x418a8a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x2e
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x418a9b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x2f
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x418aac
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], 0x30
jmp 0x4185da
mov eax, dword [ecx]
push 0xffffffffffffffff
push ecx
call dword [eax + 0x4c]
mov esi, dword [ebp - 0x38]
push str.Trigger1
mov eax, dword [esi]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x1c], eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x34], eax
test eax, eax
je 0x41988d
push eax
push esi
mov byte [ebp - 4], 0x31
call dword [ebp - 0x1c]
mov byte [ebp - 4], 0x29
push dword [ebp - 0x34]
call edi
cmp word [0x5505f0], 0
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
mov eax, dword [eax]
mov eax, dword [eax + 0x5c]
mov dword [ebp - 0x20], eax
jne 0x418b23
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x100
push eax
push 0x5505f0
push 2
call dword [sym.imp.Secur32.dll_GetUserNameExW]
call fcn.0040e960
mov ecx, eax
test ecx, ecx
je 0x419897
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x30], eax
mov eax, 0x5505f0
mov byte [ebp - 4], 0x32
test eax, 0xffff0000
jne 0x418b5d
movzx eax, ax
lea ecx, [ebp - 0x30]
push eax
call fcn.00419c30
jmp 0x418b82
mov ecx, 0x5505f0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x418b65
sub ecx, edx
sar ecx, 1
push ecx
push 0x5505f0
lea ecx, [ebp - 0x30]
call fcn.00419e10
mov byte [ebp - 4], 0x33
mov edi, dword [ebp - 0x30]
test edi, edi
jne 0x418bd3
xor esi, esi
xor eax, eax
mov dword [ebp - 0x34], esi
push eax
mov byte [ebp - 4], 0x34
push dword [ebp - 0x44]
call dword [ebp - 0x20]
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x418bbe
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x35
call fcn.0040e960
mov ecx, eax
test ecx, ecx
je 0x4198a1
jmp 0x418be9
push edi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
mov dword [ebp - 0x34], esi
test esi, esi
je 0x4198ab
jmp 0x418b94
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x34], eax
mov eax, dword [ebx + 0xc]
mov ecx, 0x3c
mov byte [ebp - 4], 0x36
mov eax, dword [eax + 0x10]
cdq
idiv ecx
push edx
push eax
lea eax, [ebp - 0x34]
push str.PT_dM_dS
push eax
call fcn.0041a230
mov eax, dword [ebp - 0x38]
add esp, 0x10
mov esi, dword [ebp - 0x34]
mov dword [ebp - 0x44], eax
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x54]
mov dword [ebp - 0x1c], ecx
test esi, esi
jne 0x418c39
xor edi, edi
xor ecx, ecx
mov dword [ebp - 0x20], edi
jmp 0x418c52
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov dword [ebp - 0x20], edi
mov ecx, edi
test edi, edi
je 0x4198b5
mov eax, dword [ebp - 0x44]
push ecx
push eax
mov byte [ebp - 4], 0x37
call dword [ebp - 0x1c]
push edi
mov dword [ebp - 0x20], eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov byte [ebp - 4], 0x38
mov ecx, dword [ebp - 0x38]
test ecx, ecx
je 0x418c7d
mov dword [ebp - 0x38], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
cmp dword [ebp - 0x20], 0
jge 0x418d11
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x418c9f
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x39
mov eax, dword [ebp - 0x38]
test eax, eax
je 0x418cb0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x3a
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x418cc1
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x3b
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x418cd2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x3c
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x418ce3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x3d
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x418cf4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x3e
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x418d05
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], 0x3f
jmp 0x4185da
mov dword [ebp - 0x3c], 0
mov byte [ebp - 4], 0x40
lea edx, [ebp - 0x3c]
mov eax, dword [ebp - 0x18]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x44]
test eax, eax
jns 0x418dcc
mov byte [ebp - 4], 0x41
mov eax, dword [ebp - 0x3c]
test eax, eax
je 0x418d42
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x418d5a
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x42
mov eax, dword [ebp - 0x38]
test eax, eax
je 0x418d6b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x43
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x418d7c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x44
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x418d8d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x45
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x418d9e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x46
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x418daf
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x47
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x418dc0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], 0x48
jmp 0x4185da
mov dword [ebp - 0x54], 0
mov byte [ebp - 4], 0x49
lea edx, [ebp - 0x54]
mov eax, dword [ebp - 0x3c]
push edx
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov edi, eax
mov byte [ebp - 4], 0x4a
mov edx, dword [ebp - 0x3c]
test edx, edx
je 0x418e03
mov dword [ebp - 0x3c], 0
mov ecx, dword [edx]
push edx
call dword [ecx + 8]
mov edx, dword [ebp - 0x3c]
test edi, edi
jns 0x418eb7
mov byte [ebp - 4], 0x4b
mov eax, dword [ebp - 0x54]
test eax, eax
je 0x418e1f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edx, dword [ebp - 0x3c]
mov byte [ebp - 4], 0x4c
test edx, edx
je 0x418e2d
mov eax, dword [edx]
push edx
call dword [eax + 8]
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x418e45
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x4d
mov eax, dword [ebp - 0x38]
test eax, eax
je 0x418e56
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x4e
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x418e67
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x4f
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x418e78
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x50
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x418e89
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x51
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x418e9a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x52
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x418eab
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], 0x53
jmp 0x4185da
mov byte [ebp - 4], 0x54
xor ecx, ecx
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x48], ecx
test eax, eax
je 0x418ee9
mov ecx, dword [eax]
lea edx, [ebp - 0x48]
push edx
push str.MbLk
push eax
call dword [ecx]
mov edx, dword [ebp - 0x3c]
test eax, eax
mov eax, dword [ebp - 0x54]
jns 0x418ee6
xor ecx, ecx
mov dword [ebp - 0x48], ecx
jmp 0x418ee9
mov ecx, dword [ebp - 0x48]
mov byte [ebp - 4], 0x55
test ecx, ecx
jne 0x418f9e
mov byte [ebp - 4], 0x57
test eax, eax
je 0x418f06
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edx, dword [ebp - 0x3c]
mov byte [ebp - 4], 0x58
test edx, edx
je 0x418f14
mov eax, dword [edx]
push edx
call dword [eax + 8]
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x418f2c
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x59
mov eax, dword [ebp - 0x38]
test eax, eax
je 0x418f3d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x5a
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x418f4e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x5b
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x418f5f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x5c
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x418f70
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x5d
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x418f81
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x5e
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x418f92
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], 0x5f
jmp 0x4185da
call fcn.0040e960
mov ecx, eax
test ecx, ecx
je 0x4198bf
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x30], eax
mov eax, 0x53465c
mov byte [ebp - 4], 0x60
lea ecx, [ebp - 0x30]
test eax, 0xffff0000
jne 0x418fd8
movzx eax, ax
push eax
call fcn.00419c30
jmp 0x418fe4
push 1
push 0x53465c
call fcn.00419e10
mov eax, dword [ebx + 0xc]
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x61
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.00419fd0
push 1
push 0x53465c
lea ecx, [ebp - 0x30]
call fcn.00419fd0
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x44], eax
mov eax, dword [eax]
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x30]
test eax, eax
jne 0x419024
xor edi, edi
mov dword [ebp - 0x20], edi
jmp 0x419038
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov dword [ebp - 0x20], edi
test edi, edi
je 0x41988d
push eax
mov byte [ebp - 4], 0x62
push dword [ebp - 0x44]
call dword [ebp - 0x1c]
push edi
mov byte [ebp - 4], 0x61
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x44], eax
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x3c]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebx + 0xc]
mov ecx, dword [ecx + 4]
test ecx, ecx
jne 0x41906d
xor edi, edi
mov dword [ebp - 0x20], edi
jmp 0x419086
push ecx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov dword [ebp - 0x20], edi
mov ecx, edi
test edi, edi
je 0x41988d
mov eax, dword [ebp - 0x44]
push ecx
push eax
mov byte [ebp - 4], 0x63
call dword [ebp - 0x1c]
push edi
mov byte [ebp - 4], 0x61
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x44], eax
mov ecx, dword [eax]
mov ecx, dword [ecx + 0x34]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebx + 0xc]
mov ecx, dword [ecx + 8]
test ecx, ecx
jne 0x4190b9
xor edi, edi
mov dword [ebp - 0x20], edi
jmp 0x4190d2
push ecx
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov dword [ebp - 0x20], edi
mov ecx, edi
test edi, edi
je 0x41988d
mov eax, dword [ebp - 0x44]
push ecx
push eax
mov byte [ebp - 4], 0x64
call dword [ebp - 0x1c]
push edi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [ebp - 0x58], 0
mov byte [ebp - 4], 0x65
lea edx, [ebp - 0x58]
mov eax, dword [ebp - 0x18]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x3c]
test eax, eax
jns 0x4191ea
mov byte [ebp - 4], 0x66
mov eax, dword [ebp - 0x58]
test eax, eax
je 0x419113
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edx, dword [ebp - 0x30]
or edi, 0xffffffff
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x419130
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x67
mov eax, dword [ebp - 0x48]
test eax, eax
je 0x419141
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x68
mov eax, dword [ebp - 0x54]
test eax, eax
je 0x419152
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x69
mov eax, dword [ebp - 0x3c]
test eax, eax
je 0x419163
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x419178
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x6a
mov eax, dword [ebp - 0x38]
test eax, eax
je 0x419189
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x6b
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x41919a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x6c
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x4191ab
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x6d
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x4191bc
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x6e
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x4191cd
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x6f
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x4191de
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], 0x70
jmp 0x4185da
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x44], eax
mov eax, dword [eax]
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x50]
push eax
call fcn.00419b30
mov byte [ebp - 4], 0x71
mov eax, dword [eax]
test eax, eax
jne 0x4193b8
xor edi, edi
mov dword [ebp - 0x20], edi
push eax
mov byte [ebp - 4], 0x72
push dword [ebp - 0x44]
call dword [ebp - 0x1c]
push edi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov byte [ebp - 4], 0x65
or eax, 0xffffffff
mov edx, dword [ebp - 0x50]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x419245
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x58]
push str.BUILTINAdministrators
mov eax, dword [edi]
mov eax, dword [eax + 0x40]
mov dword [ebp - 0x50], eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x20], eax
test eax, eax
je 0x41988d
push eax
push edi
mov byte [ebp - 4], 0x73
call dword [ebp - 0x50]
mov byte [ebp - 4], 0x65
push dword [ebp - 0x20]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x58]
push 1
push eax
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov byte [ebp - 4], 0x74
mov ecx, dword [ebp - 0x48]
test ecx, ecx
je 0x41929f
mov dword [ebp - 0x48], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 0x4c], 0
mov byte [ebp - 4], 0x75
lea edx, [ebp - 0x4c]
mov eax, dword [ebp - 0x18]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
test eax, eax
jns 0x4193d1
mov byte [ebp - 4], 0x76
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x4192d0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x77
mov eax, dword [ebp - 0x58]
test eax, eax
je 0x4192e1
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edx, dword [ebp - 0x30]
or edi, 0xffffffff
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4192fe
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x78
mov eax, dword [ebp - 0x48]
test eax, eax
je 0x41930f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x79
mov eax, dword [ebp - 0x54]
test eax, eax
je 0x419320
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x7a
mov eax, dword [ebp - 0x3c]
test eax, eax
je 0x419331
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x419346
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x7b
mov eax, dword [ebp - 0x38]
test eax, eax
je 0x419357
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x7c
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x419368
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x7d
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x419379
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x7e
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x41938a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x7f
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x41939b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x80
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x4193ac
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], 0x81
jmp 0x4185da
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov dword [ebp - 0x20], edi
test edi, edi
je 0x4198c9
jmp 0x419214
mov eax, dword [ebp - 0x4c]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov eax, dword [ebp - 0x4c]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x48]
mov eax, dword [ebp - 0x4c]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov edi, dword [ebp - 0x4c]
push str.PT0S
mov eax, dword [edi]
mov eax, dword [eax + 0x70]
mov dword [ebp - 0x50], eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x20], eax
test eax, eax
je 0x41988d
push eax
push edi
mov byte [ebp - 4], 0x82
call dword [ebp - 0x50]
push dword [ebp - 0x20]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [ebp - 0x60], 0
mov byte [ebp - 4], 0x83
lea edx, [ebp - 0x60]
mov eax, dword [ebp - 0x4c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x9c]
test eax, eax
js 0x41944f
mov eax, dword [ebp - 0x60]
push 0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x30]
mov byte [ebp - 4], 0x84
mov ecx, dword [ebp - 0x4c]
test ecx, ecx
je 0x419467
mov dword [ebp - 0x4c], 0
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [ebp - 0x5c], 0
mov eax, dword [ebp - 0x2c]
xorps xmm0, xmm0
mov edi, dword [sym.imp.OLEAUT32.dll_VariantClear]
mov dword [ebp - 0x44], eax
mov eax, dword [eax]
movups xmmword [ebp - 0x88], xmm0
mov eax, dword [eax + 0x44]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x88]
push eax
call edi
movups xmm0, xmmword [ebp - 0x88]
lea eax, [ebp - 0x98]
push eax
movups xmmword [ebp - 0xc8], xmm0
xorps xmm0, xmm0
movups xmmword [ebp - 0x98], xmm0
call edi
mov byte [ebp - 4], 0x87
lea eax, [ebp - 0x64]
movups xmm0, xmmword [ebp - 0x98]
push eax
movups xmmword [ebp - 0xb8], xmm0
call fcn.00419b30
mov byte [ebp - 4], 0x88
mov edi, dword [eax]
xor eax, eax
mov word [ebp - 0x78], ax
lea eax, [ebp - 0x78]
push eax
mov dword [ebp - 0x50], edi
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
test eax, eax
js 0x4198d3
mov eax, 8
push edi
mov edi, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov word [ebp - 0x78], ax
call edi
mov dword [ebp - 0x70], eax
test eax, eax
jne 0x419514
cmp dword [ebp - 0x50], eax
jne 0x4198d9
mov byte [ebp - 4], 0x89
mov eax, dword [ebp - 0x18]
movups xmm0, xmmword [ebp - 0x78]
mov dword [ebp - 0x20], eax
mov eax, dword [ebx + 8]
movups xmmword [ebp - 0xd8], xmm0
test eax, eax
jne 0x419539
xor edi, edi
xor ecx, ecx
mov dword [ebp - 0x50], edi
jmp 0x419552
push eax
call edi
mov edi, eax
mov dword [ebp - 0x50], edi
mov ecx, edi
test edi, edi
je 0x4198f3
movups xmm0, xmmword [ebp - 0xd8]
lea eax, [ebp - 0x5c]
mov byte [ebp - 4], 0x8a
movups xmm1, xmmword [ebp - 0xc8]
push eax
sub esp, 0x10
mov eax, esp
push 3
sub esp, 0x10
movups xmmword [eax], xmm1
mov eax, esp
sub esp, 0x10
movups xmm1, xmmword [ebp - 0xb8]
movups xmmword [eax], xmm1
mov eax, esp
push 6
push dword [ebp - 0x20]
push ecx
push dword [ebp - 0x44]
movups xmmword [eax], xmm0
call dword [ebp - 0x1c]
push edi
mov dword [ebp - 0x50], eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov edx, dword [ebp - 0x64]
or edi, 0xffffffff
add edx, 0xfffffff0
mov ecx, edi
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x4195bf
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x88]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
cmp dword [ebp - 0x50], 0
jge 0x4196fb
mov byte [ebp - 4], 0x8b
mov eax, dword [ebp - 0x5c]
test eax, eax
je 0x4195f4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x8c
mov eax, dword [ebp - 0x60]
test eax, eax
je 0x419605
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x8d
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x419616
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x8e
mov eax, dword [ebp - 0x58]
test eax, eax
je 0x419627
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edx, dword [ebp - 0x30]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x419641
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x8f
mov eax, dword [ebp - 0x48]
test eax, eax
je 0x419652
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x90
mov eax, dword [ebp - 0x54]
test eax, eax
je 0x419663
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x91
mov eax, dword [ebp - 0x3c]
test eax, eax
je 0x419674
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x419689
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x92
mov eax, dword [ebp - 0x38]
test eax, eax
je 0x41969a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x93
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x4196ab
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x94
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x4196bc
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x95
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x4196cd
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x96
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x4196de
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x97
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x4196ef
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], 0x98
jmp 0x4185da
mov byte [ebp - 4], 0x99
mov eax, dword [ebp - 0x5c]
test eax, eax
je 0x41970c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x9a
mov eax, dword [ebp - 0x60]
test eax, eax
je 0x41971d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x9b
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x41972e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x9c
mov eax, dword [ebp - 0x58]
test eax, eax
je 0x41973f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edx, dword [ebp - 0x30]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x419759
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x9d
mov eax, dword [ebp - 0x48]
test eax, eax
je 0x41976a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x9e
mov eax, dword [ebp - 0x54]
test eax, eax
je 0x41977b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0x9f
mov eax, dword [ebp - 0x3c]
test eax, eax
je 0x41978c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x4197a1
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xa0
mov eax, dword [ebp - 0x38]
test eax, eax
je 0x4197b2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0xa1
mov eax, dword [ebp - 0x40]
test eax, eax
je 0x4197c3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0xa2
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x4197d4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0xa3
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x4197e5
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0xa4
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x4197f6
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov byte [ebp - 4], 0xa5
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x419807
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], 0xa6
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x41981b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 0
push eax
push 0x2001f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, 1
test eax, eax
jne 0x41986f
push dword [ebx + 8]
mov esi, dword [ebp - 0x34]
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 0x5c], 1
test esi, esi
je 0x41986c
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x5c], 1
mov esi, dword [ebp - 0x5c]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8
push 0x8007000e
call fcn.0040e830
push 0x80004005
call fcn.0040e830
push 0x80004005
call fcn.0040e830
push 0x8007000e
call fcn.0040e830
push 0x8007000e
call fcn.0040e830
push 0x80004005
call fcn.0040e830
push 0x8007000e
call fcn.0040e830
push eax
call fcn.0040e830
mov eax, 0xa
mov dword [ebp - 0x70], 0x8007000e
push 0x8007000e
mov word [ebp - 0x78], ax
call fcn.0040e830
push 0x8007000e
call fcn.0040e830
int3