Function at 0x420800
Capabilities:
Delete registry value
Persist via run registry key
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x449807
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xb94
push ebx
push ebp
mov ebp, 1
push esi
mov ebx, ecx
xor esi, esi
push edi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x9c], ebp
mov dword [esp + 0x8c], ebp
mov dword [esp + 0x6c], ebp
mov dword [esp + 0x60], ebp
mov dword [esp + 0xb4], ebp
mov dword [esp + 0x98], esi
mov dword [esp + 0xa4], esi
call fcn.0043cb83
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x64], eax
mov dword [esp + 0xbac], esi
call fcn.0044608e
mov edi, dword [eax + 4]
mov dword [esp + 0x70], edi
call fcn.00404100
lea ecx, [esp + 0x1e8]
mov dword [esp + 0xa0], eax
call fcn.0042ad30
mov byte [esp + 0xbac], 1
call fcn.0044608e
mov ecx, dword [eax + 4]
call fcn.0044181e
push ebp
push esi
mov ecx, ebx
mov byte [esp + 0xbb4], 2
mov dword [edi + 0x214], ebp
call fcn.0041e900
call fcn.0044608e
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x1c]
push 0x20
push eax
push 0x466dcc
call fcn.00427ac0
mov ecx, dword [ebx + 0x1c]
add esp, 0xc
push ecx
mov esi, eax
call dword [sym.imp.USER32.dll_UpdateWindow]
cmp esi, 7
jne 0x420949
push ebp
push ebp
mov ecx, ebx
call fcn.0041e900
mov byte [esp + 0xbac], 1
call fcn.0044608e
mov ecx, dword [eax + 4]
call fcn.00441833
lea ecx, [esp + 0x1e8]
mov byte [esp + 0xbac], 0
call fcn.00429530
mov eax, dword [esp + 0x64]
add eax, 0xfffffff0
mov dword [esp + 0xbac], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x422032
xor esi, esi
push esi
lea ecx, [esp + 0xcc]
mov dword [esp + 0x40], esi
mov dword [esp + 0x28], esi
call fcn.00403f80
cmp dword [0x466c80], esi
mov byte [esp + 0xbac], 3
je 0x4209a5
mov eax, dword [edi + 0x1c]
push eax
mov eax, dword [esp + 0xcc]
push 0x82
lea ecx, [esp + 0xd0]
call dword [eax + 0x134]
test eax, eax
jne 0x420997
mov dword [0x466c80], esi
push 5
lea ecx, [esp + 0xcc]
call fcn.0044142f
call fcn.0043cb83
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x50], eax
mov byte [esp + 0xbac], 4
call fcn.0043cb83
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x44], eax
mov byte [esp + 0xbac], 5
call fcn.0043cb83
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x48], eax
mov byte [esp + 0xbac], 6
call fcn.0043cb83
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x30], eax
mov byte [esp + 0xbac], 7
call fcn.0043cb83
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x68], eax
push 0x3e
mov byte [esp + 0xbb0], 8
call fcn.0043cb78
cmp eax, esi
je 0x420a43
push 0x3e
push eax
lea ecx, [esp + 0x58]
call fcn.00401860
push 0x3f
call fcn.0043cb78
cmp eax, esi
je 0x420a5a
push 0x3f
push eax
lea ecx, [esp + 0x4c]
call fcn.00401860
push 0x40
call fcn.0043cb78
cmp eax, esi
je 0x420a71
push 0x40
push eax
lea ecx, [esp + 0x50]
call fcn.00401860
push 0x41
call fcn.0043cb78
cmp eax, esi
je 0x420a88
push 0x41
push eax
lea ecx, [esp + 0x38]
call fcn.00401860
cmp dword [0x466c80], esi
je 0x420ac3
mov eax, dword [0x466e58]
push eax
lea ecx, [esp + 0xcc]
call fcn.0044140e
push 0x3f2
lea ecx, [esp + 0xcc]
call fcn.00441335
mov ecx, dword [esp + 0x50]
push ecx
mov ecx, eax
mov dword [esp + 0x3c], eax
call fcn.0044140e
mov edx, dword [esp + 0x1c]
mov eax, dword [edx + 0x8c]
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
xor edi, edi
push edi
push edi
push 0x1004
push eax
call ebx
mov ebp, eax
cmp dword [0x466c80], edi
mov dword [esp + 0x74], ebp
je 0x420b52
mov ecx, dword [esp + 0x154]
push edi
push 1
push 0x402
push ecx
call ebx
cmp ebp, edi
mov eax, 0x14
jle 0x420b3d
cdq
idiv ebp
cmp eax, edi
jg 0x420b41
mov eax, 0x66666667
imul ebp
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 1
mov dword [esp + 0x3c], eax
jg 0x420b32
mov eax, 2
mov dword [esp + 0x3c], eax
mov dword [esp + 0x24], eax
mov eax, 1
jmp 0x420b41
mov dword [esp + 0x24], edi
mov edx, dword [esp + 0x154]
push edi
push eax
push 0x404
push edx
call ebx
cmp ebp, edi
jle 0x420bf3
lea ebx, [ebx]
mov ecx, dword [esp + 0x1c]
push edi
add ecx, 0x70
call fcn.0043baea
mov esi, eax
mov eax, dword [esi + 4]
test eax, eax
je 0x420be8
mov ecx, dword [esp + 0x1c]
push eax
call fcn.0041a010
mov ebp, eax
mov eax, dword [0x466c80]
test eax, eax
je 0x420bdb
mov eax, dword [esp + 0x24]
test eax, eax
jg 0x420bd2
mov eax, dword [esp + 0x154]
push 0
push 0
push 0x408
push eax
call ebx
cmp eax, 0x14
jge 0x420bdb
mov ecx, dword [esp + 0x154]
push 0
push 0
push 0x405
push ecx
call ebx
mov edx, dword [esp + 0x50]
mov ecx, dword [esp + 0x38]
push edx
call fcn.0044140e
mov eax, dword [esp + 0x3c]
jmp 0x420bd7
mov eax, dword [esp + 0x24]
dec eax
mov dword [esp + 0x24], eax
cmp ebp, 2
je 0x420c8d
mov ebp, dword [esp + 0x74]
inc edi
cmp edi, ebp
jl 0x420b60
xor edi, edi
cmp dword [0x466c80], edi
je 0x420c1b
mov eax, dword [esp + 0x154]
push edi
push 0x14
push 0x402
push eax
call ebx
mov ecx, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x3c]
call fcn.0044140e
cmp dword [0x466c80], edi
mov dword [esp + 0x90], edi
mov dword [esp + 0x40], ebp
mov dword [esp + 0x94], edi
mov dword [esp + 0x58], edi
mov dword [esp + 0xa8], edi
je 0x420db7
cmp ebp, edi
mov eax, 0x14
jle 0x420d8f
cdq
idiv ebp
cmp eax, edi
jg 0x420d93
mov eax, 0x66666667
imul ebp
sar edx, 3
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 1
mov dword [esp + 0x3c], eax
jg 0x420c7f
mov eax, 2
mov dword [esp + 0x3c], eax
mov dword [esp + 0x24], eax
mov eax, 1
jmp 0x420d93
movzx ecx, word [esi + 2]
shl ecx, 0x10
or ecx, 1
push 1
mov dword [esi], ecx
mov ecx, dword [esp + 0x20]
push 1
call fcn.0041e900
call fcn.0044608e
mov eax, dword [eax + 4]
mov dword [eax + 0x128], 1
mov eax, dword [esp + 0x68]
add eax, 0xfffffff0
mov byte [esp + 0xbac], 7
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x420cde
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
mov byte [esp + 0xbac], 6
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x420d04
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
mov byte [esp + 0xbac], 5
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x420d2a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x44]
add eax, 0xfffffff0
mov byte [esp + 0xbac], 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x420d50
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x50]
add eax, 0xfffffff0
mov byte [esp + 0xbac], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x420d76
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea ecx, [esp + 0xc8]
mov byte [esp + 0xbac], 2
call fcn.00404020
jmp 0x421fea
mov dword [esp + 0x24], edi
mov edx, dword [esp + 0x154]
push edi
push eax
push 0x404
push edx
call ebx
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call fcn.0043f468
mov dword [esp + 0xb8], eax
cmp ebp, edi
mov dword [esp + 0x54], edi
jle 0x42174b
mov edi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x54]
add edi, 0x70
mov edi, edi
push ebp
mov ecx, edi
call fcn.0043baea
mov ecx, dword [esp + 0x40]
mov ebx, eax
mov esi, dword [ebx + 4]
dec ecx
test esi, esi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x40], ecx
je 0x421627
mov edi, dword [ebx]
call fcn.0044608e
mov ecx, dword [eax + 4]
call fcn.0044181e
xor eax, eax
mov byte [esp + 0xbac], 9
mov dword [esp + 0x2c], eax
mov dword [esp + 0x5c], eax
call fcn.00404100
push 0
mov ebp, eax
push 1
push esi
mov dword [esp + 0x58], ebp
call fcn.0040a6e0
add esp, 0xc
cmp eax, 1
jne 0x420f2e
mov byte [esp + 0xbac], 8
call fcn.0044608e
mov ecx, dword [eax + 4]
call fcn.00441833
mov esi, 3
mov ecx, dword [esp + 0x1c]
push 1
push 1
call fcn.0041e900
call fcn.0044608e
mov eax, dword [eax + 4]
mov dword [eax + 0x128], 1
call fcn.0043cb83
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x34], eax
mov byte [esp + 0xbac], 0xb
call fcn.0043cb83
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea ebp, [eax + 0x10]
mov dword [esp + 0x4c], ebp
mov byte [esp + 0xbac], 0xc
call fcn.0043cb83
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea edi, [eax + 0x10]
mov dword [esp + 0x20], edi
movzx eax, word [ebx + 2]
mov ecx, dword [esp + 0x54]
push ebx
push 0
push 0
push 0
push 0
push 4
push 0
push ecx
mov ecx, dword [esp + 0x3c]
shl eax, 0x10
or eax, 1
add ecx, 0x70
mov byte [esp + 0xbcc], 0xd
mov dword [ebx], eax
call fcn.0043bbb9
cmp esi, 3
mov dword [esp + 0x90], 1
jne 0x421461
push 0xb
call fcn.0043cb78
test eax, eax
je 0x420f17
push 0xb
push eax
lea ecx, [esp + 0x28]
call fcn.00401860
mov edi, dword [esp + 0x20]
mov edx, dword [ebx + 8]
push edx
lea eax, [esp + 0x38]
push edi
push eax
call fcn.00401d20
add esp, 0xc
jmp 0x4214bc
push esi
call fcn.0040a940
add esp, 4
push esi
lea ecx, [esp + 0x2c]
mov dword [esp + 0xb4], eax
call fcn.00402470
push 2
push 0x44c1e4
push esi
mov byte [esp + 0xbb8], 0xa
call fcn.0042fa90
add esp, 0xc
test eax, eax
jne 0x421027
shr edi, 0x10
cmp edi, 0x1000
jne 0x421027
mov ecx, 0x41
lea edi, [esp + 0x460]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x460]
push eax
push esi
call fcn.00403830
add esp, 8
push esi
mov edi, eax
call sub.WINSPOOL.DRV_DeletePrinterConnectionA
test eax, eax
jne 0x420ff6
call dword [sym.imp.KERNEL32.dll_GetLastError]
or edx, 0xffffffff
cmp eax, 5
mov eax, dword [esp + 0x28]
mov byte [esp + 0xbac], 9
je 0x421074
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x420fd7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov byte [esp + 0xbac], 8
call fcn.0044608e
mov ecx, dword [eax + 4]
call fcn.00441833
mov esi, 1
jmp 0x420e4e
test edi, edi
je 0x42100b
lea eax, [esp + 0x460]
push eax
push esi
call fcn.00411820
add esp, 8
mov ecx, dword [esp + 0x1c]
push esi
call fcn.0041c960
call fcn.0044608e
mov ecx, dword [eax + 4]
call fcn.00441848
jmp 0x421395
lea ecx, [esp + 0x78]
push ecx
lea edx, [esp + 0x30]
push edx
xor edi, edi
push esi
mov dword [esp + 0x84], edi
mov dword [esp + 0x88], edi
mov dword [esp + 0x8c], 0xf000c
call sub.WINSPOOL.DRV_OpenPrinterA
cmp eax, edi
jne 0x4210aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
or edx, 0xffffffff
cmp eax, 5
mov eax, dword [esp + 0x28]
mov byte [esp + 0xbac], 9
jne 0x420fc0
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42108b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov byte [esp + 0xbac], 8
call fcn.0044608e
mov ecx, dword [eax + 4]
call fcn.00441833
mov esi, 4
jmp 0x420e4e
cmp ebp, 2
je 0x4210c4
cmp ebp, 3
je 0x4210c4
lea eax, [esp + 0x568]
push eax
push esi
call fcn.0040e220
jmp 0x4210d6
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 0x568]
push ecx
push edx
call fcn.0040afc0
mov ebx, eax
add esp, 8
cmp ebx, 0xffffffff
jne 0x421119
mov eax, dword [esp + 0x2c]
push eax
call sub.WINSPOOL.DRV_ClosePrinter
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
mov byte [esp + 0xbac], 9
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42129c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
jmp 0x42129c
mov ecx, dword [esp + 0x2c]
lea eax, [esp + 0x5c]
push eax
push 0
push 0
push 3
push 0
push ecx
mov dword [esp + 0x74], 0
call sub.WINSPOOL.DRV_GetPrinterDriverA
test eax, eax
jne 0x42114e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x42114e
mov edx, dword [esp + 0x2c]
push edx
jmp 0x4210e5
mov eax, dword [esp + 0x5c]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x42118c
mov ecx, dword [esp + 0x2c]
push ecx
call sub.WINSPOOL.DRV_ClosePrinter
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
mov byte [esp + 0xbac], 9
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x421106
mov ecx, dword [esp + 0x5c]
mov edx, dword [esp + 0x2c]
lea eax, [esp + 0x5c]
push eax
push ecx
push ebp
push 3
push 0
push edx
call sub.WINSPOOL.DRV_GetPrinterDriverA
test eax, eax
jne 0x4211b5
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x4210e0
mov ecx, dword [ebp + 0xc]
push 1
lea eax, [esp + 0x1ac]
push eax
push ecx
call fcn.004041b0
add esp, 0xc
test eax, eax
jne 0x4211e0
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov edx, dword [esp + 0x2c]
push edx
jmp 0x4210e5
lea eax, [esp + 0x568]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4211f0
sub eax, edx
mov dword [esp + 0x34], eax
je 0x42122d
test bl, 8
je 0x42122d
lea eax, [esp + 0x568]
push eax
push 0
call fcn.00409ca0
add esp, 8
test eax, eax
jne 0x42122d
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [esp + 0x2c]
push ecx
call sub.WINSPOOL.DRV_ClosePrinter
jmp 0x421293
lea edx, [esp + 0x358]
push edx
xor eax, eax
mov ecx, 0x41
lea edi, [esp + 0x35c]
push esi
rep stosd dword es:[edi], eax
call fcn.00403830
mov dword [esp + 0x3c], eax
lea ecx, [esp + 0x8c]
xor eax, eax
push ecx
mov dword [esp + 0x90], eax
push esi
mov byte [esp + 0x98], al
call fcn.00403350
mov edx, dword [esp + 0x3c]
add esp, 0x10
push edx
mov ebx, eax
call sub.WINSPOOL.DRV_DeletePrinter
mov edi, eax
mov eax, dword [esp + 0x2c]
push eax
call sub.WINSPOOL.DRV_ClosePrinter
test edi, edi
jne 0x4212bf
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea ecx, [esp + 0x28]
call fcn.00401400
mov byte [esp + 0xbac], 8
call fcn.0044608e
mov ecx, dword [eax + 4]
call fcn.00441833
mov ebx, dword [esp + 0x20]
mov esi, 1
jmp 0x420e4e
mov edi, dword [esp + 0x4c]
cmp edi, 2
je 0x4212cd
cmp edi, 3
jne 0x4212e2
cmp ebx, 1
jne 0x4212e2
lea ecx, [esp + 0x84]
push ecx
call fcn.004034f0
add esp, 4
cmp edi, 6
je 0x4212ec
cmp edi, 0xa
jne 0x421305
mov eax, dword [esp + 0x34]
test eax, eax
je 0x421305
lea edx, [esp + 0x358]
push edx
push esi
call fcn.00411820
add esp, 8
mov ecx, dword [ebp + 4]
lea eax, [esp + 0x1a8]
push eax
push ecx
mov ecx, dword [esp + 0x24]
push esi
call fcn.0041c280
cmp edi, 2
je 0x421325
cmp edi, 3
jne 0x42138a
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
push 1
push 0
push 0
push 0
lea edx, [esp + 0x19c]
push edx
call esi
test eax, eax
je 0x42138a
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x421360
lea eax, [esp + 0x18c]
push eax
call edi
lea ecx, [esp + 0x18c]
push ecx
call ebx
push 1
push 0
push 0
push 0
lea edx, [esp + 0x19c]
push edx
call esi
test eax, eax
jne 0x421360
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ebx, dword [esp + 0x20]
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
mov byte [esp + 0xbac], 9
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4213bb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov byte [esp + 0xbac], 8
call fcn.0044608e
mov ecx, dword [eax + 4]
call fcn.00441833
movzx eax, word [ebx + 2]
mov ecx, dword [esp + 0xb0]
shl eax, 0x10
or eax, 0x10
mov dword [ebx], eax
mov eax, 1
cmp ecx, eax
jne 0x4213f3
mov dword [esp + 0x98], eax
mov eax, dword [0x466c80]
test eax, eax
je 0x421603
mov eax, dword [esp + 0x24]
test eax, eax
jg 0x421458
mov ecx, dword [esp + 0x154]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0x408
push ecx
call esi
cmp eax, 0x28
jge 0x421603
mov edx, dword [esp + 0x154]
push 0
push 0
push 0x405
push edx
call esi
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x38]
push eax
call fcn.0044140e
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x24], ecx
jmp 0x421603
dec dword [esp + 0x24]
jmp 0x421603
cmp esi, 4
jne 0x42148e
push 0x10
call fcn.0043cb78
test eax, eax
je 0x421481
push 0x10
push eax
lea ecx, [esp + 0x28]
call fcn.00401860
mov edi, dword [esp + 0x20]
mov eax, dword [ebx + 8]
push eax
push eax
push edi
lea ecx, [esp + 0x40]
push ecx
jmp 0x4214b4
push 4
call fcn.0043cb78
test eax, eax
je 0x4214a9
push 4
push eax
lea ecx, [esp + 0x28]
call fcn.00401860
mov edi, dword [esp + 0x20]
mov eax, dword [ebx + 8]
push eax
push eax
push edi
lea edx, [esp + 0x40]
push edx
call fcn.00401d20
add esp, 0x10
mov eax, dword [esp + 0x40]
test eax, eax
push 3
jle 0x42164a
call fcn.0043cb78
test eax, eax
je 0x4214e3
push 3
push eax
lea ecx, [esp + 0x54]
call fcn.00401860
mov ebp, dword [esp + 0x4c]
push 0x12
call fcn.0043cb78
test eax, eax
je 0x4214fe
push 0x12
push eax
lea ecx, [esp + 0x28]
call fcn.00401860
mov edi, dword [esp + 0x20]
mov eax, dword [edi - 0xc]
push eax
push edi
lea ecx, [esp + 0x3c]
call fcn.00401b10
mov esi, dword [esp + 0x34]
mov ecx, dword [esp + 0x1c]
push 0x34
push ebp
push esi
call fcn.0041d5d0
cmp eax, 7
je 0x42163d
mov eax, dword [0x466c80]
test eax, eax
je 0x42159d
mov eax, dword [esp + 0xb8]
mov ecx, dword [eax + 0x1c]
push ecx
call dword [sym.imp.USER32.dll_SetActiveWindow]
push eax
call fcn.0043f468
mov eax, dword [esp + 0x24]
test eax, eax
jg 0x421599
mov edx, dword [esp + 0x154]
push 0
push 0
push 0x408
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, 0x28
jge 0x42159d
mov eax, dword [esp + 0x154]
push 0
push 0
push 0x405
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x3c]
call fcn.0044140e
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x24], edx
jmp 0x42159d
dec dword [esp + 0x24]
lea eax, [edi - 0x10]
mov byte [esp + 0xbac], 0xc
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4215bf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea eax, [ebp - 0x10]
mov byte [esp + 0xbac], 0xb
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4215e1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea eax, [esi - 0x10]
mov byte [esp + 0xbac], 8
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x421603
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x54]
push ebx
push 0
push 0
push 0
push 0
push 4
push 0
add edi, 0x70
push eax
mov ecx, edi
call fcn.0043bbb9
mov ebp, dword [esp + 0x54]
mov eax, dword [esp + 0x74]
inc ebp
cmp ebp, eax
mov dword [esp + 0x54], ebp
jl 0x420dd0
jmp 0x4216e2
mov dword [esp + 0x94], 1
jmp 0x42167c
call fcn.0043cb78
test eax, eax
je 0x421663
push 3
push eax
lea ecx, [esp + 0x54]
call fcn.00401860
mov ebp, dword [esp + 0x4c]
mov esi, dword [esp + 0x34]
mov ecx, dword [esp + 0x1c]
push 0x30
push ebp
push esi
call fcn.0041d5d0
mov dword [esp + 0x58], 1
lea eax, [edi - 0x10]
mov byte [esp + 0xbac], 0xc
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42169e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea eax, [ebp - 0x10]
mov byte [esp + 0xbac], 0xb
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4216c0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea eax, [esi - 0x10]
mov byte [esp + 0xbac], 8
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4216e2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x54]
mov edi, 1
cmp eax, edi
mov esi, edi
jge 0x4216f8
mov esi, dword [esp + 0xa8]
cmp dword [esp + 0x98], edi
jne 0x421728
lea eax, [esp + 0x770]
push eax
call fcn.0040aaa0
add esp, 4
cmp eax, edi
jne 0x421728
push 0
lea ecx, [esp + 0x774]
push edi
push ecx
call fcn.0040a4e0
add esp, 0xc
mov eax, dword [esp + 0x94]
test eax, eax
jne 0x421d35
mov eax, dword [esp + 0x58]
test eax, eax
jne 0x421d35
test esi, esi
jne 0x421861
mov ecx, dword [esp + 0x1c]
call fcn.0041b680
test eax, eax
jne 0x421861
call fcn.0044608e
mov eax, dword [eax + 4]
mov edx, dword [eax + 0x1c]
push 2
push edx
push 0x466dcc
call fcn.00427ac0
mov ecx, dword [esp + 0x28]
add esp, 0xc
push 1
push 1
call fcn.0041e900
call fcn.0044608e
mov eax, dword [eax + 4]
mov dword [eax + 0x128], 1
mov eax, dword [esp + 0x68]
add eax, 0xfffffff0
mov byte [esp + 0xbac], 7
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4217bc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
mov byte [esp + 0xbac], 6
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4217e2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
mov byte [esp + 0xbac], 5
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x421808
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x44]
add eax, 0xfffffff0
mov byte [esp + 0xbac], 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42182e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x50]
add eax, 0xfffffff0
mov byte [esp + 0xbac], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x421854
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov byte [esp + 0xbac], 0xe
jmp 0x421fca
mov eax, dword [0x466c80]
test eax, eax
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
je 0x4218a8
mov eax, dword [esp + 0x154]
push 0
push 0x28
push 0x402
push eax
call ebp
mov ecx, dword [esp + 0x48]
mov ebx, dword [esp + 0x38]
push ecx
mov ecx, ebx
call fcn.0044140e
mov edx, dword [esp + 0x154]
push 0
push 0x14
push 0x404
push edx
call ebp
jmp 0x4218ac
mov ebx, dword [esp + 0x38]
mov esi, dword [esp + 0x1c]
mov ecx, esi
call fcn.0041cd00
mov dword [esp + 0x8c], eax
mov eax, dword [0x466c80]
test eax, eax
je 0x4218e6
mov eax, dword [esp + 0x154]
push 0
push 0
push 0x405
push eax
call ebp
mov ecx, dword [esp + 0x48]
push ecx
mov ecx, ebx
call fcn.0044140e
call fcn.0040c850
lea edx, [esp + 0xc8]
push edx
mov ecx, esi
call fcn.0041f450
mov dword [esp + 0x9c], eax
mov eax, dword [0x466c80]
test eax, eax
je 0x42193e
mov eax, dword [esp + 0x154]
push 0
push 0x50
push 0x402
push eax
call ebp
mov esi, dword [esp + 0x30]
push esi
mov ecx, ebx
call fcn.0044140e
mov ecx, dword [esp + 0x154]
push 0
push 4
push 0x404
push ecx
call ebp
jmp 0x421942
mov esi, dword [esp + 0x30]
cmp dword [esp + 0xa0], 3
jne 0x421959
push str.Enum
call fcn.004092d0
add esp, 4
mov eax, dword [0x466c80]
test eax, eax
je 0x42197d
mov edx, dword [esp + 0x154]
push 0
push 0
push 0x405
push edx
call ebp
push esi
mov ecx, ebx
call fcn.0044140e
call fcn.0040ef70
test eax, eax
jne 0x42198f
call fcn.00407b50
mov dword [esp + 0x60], eax
mov eax, dword [0x466c80]
test eax, eax
je 0x4219b3
mov eax, dword [esp + 0x154]
push 0
push 0
push 0x405
push eax
call ebp
push esi
mov ecx, ebx
call fcn.0044140e
call fcn.0043cb83
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x40], eax
mov esi, dword [esp + 0x70]
lea eax, [esi + 0xf8]
push eax
lea ecx, [esp + 0x44]
mov byte [esp + 0xbb0], 0xf
call fcn.00401e30
mov ecx, dword [esp + 0x40]
push 0x44cadc
push ecx
call fcn.0042f5a3
add esp, 8
test eax, eax
jne 0x421a70
call fcn.00407750
mov edi, eax
mov dword [esp + 0x6c], edi
call fcn.00408710
test edi, edi
je 0x421a78
test eax, eax
je 0x421a78
xor eax, eax
mov ecx, 0x10
lea edi, [esp + 0x1a8]
rep stosd dword es:[edi], eax
mov eax, dword [esi + 0xd0]
push eax
lea edx, [esp + 0x1ac]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0xac]
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x421a78
mov edx, dword [esp + 0xac]
lea ecx, [esp + 0x1a8]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x421a78
mov dword [esp + 0x6c], 1
mov eax, dword [0x466c80]
test eax, eax
je 0x421aa0
mov eax, dword [esp + 0x154]
push 0
push 0
push 0x405
push eax
call ebp
mov ecx, dword [esp + 0x30]
push ecx
mov ecx, ebx
call fcn.0044140e
call fcn.00410780
lea ecx, [esp + 0x1e8]
mov edi, eax
call fcn.00428d00
lea ecx, [esp + 0x1e8]
call fcn.00428e50
lea ecx, [esp + 0x1e8]
call fcn.004284b0
lea ecx, [esp + 0x1e8]
call fcn.00428440
lea ecx, [esp + 0x1e8]
call fcn.00428060
lea ecx, [esp + 0x1e8]
call fcn.00428db0
mov edx, dword [0x466dec]
push 5
push edx
lea eax, [esp + 0xc4]
push eax
call fcn.004300c9
add esp, 0xc
lea ecx, [esp + 0x78]
mov word [esp + 0xc6], 0
call fcn.0042c030
lea ecx, [esp + 0x78]
mov byte [esp + 0xbac], 0x10
call fcn.0042bf80
test al, al
je 0x421c84
lea ecx, [esp + 0xbc]
push ecx
lea ecx, [esp + 0x7c]
call fcn.0042c250
cmp eax, 1
je 0x421b53
cmp eax, 2
jne 0x421c84
lea edx, [esp + 0xbc]
push edx
lea ecx, [esp + 0x7c]
call fcn.0042c430
test al, al
jne 0x421c84
call fcn.0044608e
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x120]
mov ecx, dword [eax + 0x24]
test ecx, ecx
je 0x421bf6
call fcn.0043cb83
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea esi, [eax + 0x10]
mov dword [esp + 0x58], esi
push 0x454
mov byte [esp + 0xbb0], 0x11
call fcn.0043cb78
test eax, eax
je 0x421bbd
push 0x454
push eax
lea ecx, [esp + 0x60]
call fcn.00401860
mov esi, dword [esp + 0x58]
mov ecx, dword [esp + 0x1c]
push 0
push 0
push esi
call fcn.0041d5d0
lea eax, [esi - 0x10]
mov byte [esp + 0xbac], 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x421c84
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
jmp 0x421c84
mov eax, dword [0x466c80]
test eax, eax
je 0x421c0d
push 0
lea ecx, [esp + 0xcc]
call fcn.0044142f
lea eax, [esp + 0x70]
push eax
lea ecx, [esp + 0x7c]
call fcn.0042c0a0
mov esi, dword [eax]
mov byte [esp + 0xbac], 0x12
call fcn.0044608e
mov eax, dword [eax + 4]
mov ecx, dword [eax + 0x1c]
push esi
push 0x454
push ecx
push 0x466dcc
call fcn.00427ac0
mov eax, dword [esp + 0x80]
add eax, 0xfffffff0
add esp, 0x10
mov byte [esp + 0xbac], 0x10
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x421c6d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [0x466c80]
test eax, eax
je 0x421c84
push 5
lea ecx, [esp + 0xcc]
call fcn.0044142f
lea ecx, [esp + 0x1e8]
call fcn.00428ee0
lea ecx, [esp + 0x1e8]
call fcn.0042a330
lea ecx, [esp + 0x1e8]
call fcn.004291e0
lea ecx, [esp + 0x1e8]
call fcn.004292b0
mov eax, dword [0x466c80]
test eax, eax
je 0x421cdc
mov eax, dword [esp + 0x154]
push 0
push 0
push 0x405
push eax
call ebp
mov ecx, dword [esp + 0x30]
push ecx
mov ecx, ebx
call fcn.0044140e
call fcn.0044608e
mov eax, dword [eax + 4]
mov ecx, dword [eax + 0x20c]
test ecx, ecx
je 0x421cf5
call fcn.00405940
jmp 0x421cfa
mov eax, 1
lea ecx, [esp + 0x78]
mov esi, eax
mov byte [esp + 0xbac], 0xf
call fcn.0042bfe0
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
mov byte [esp + 0xbac], 8
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x421d4d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
jmp 0x421d4d
mov edi, dword [esp + 0xb4]
mov esi, dword [esp + 0xa4]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, dword [esp + 0x38]
mov eax, dword [0x466c80]
test eax, eax
je 0x421d75
mov eax, dword [esp + 0x154]
push 0
push 0x64
push 0x402
push eax
call ebp
mov ecx, dword [esp + 0x30]
push ecx
mov ecx, ebx
call fcn.0044140e
lea ecx, [esp + 0x1e8]
call fcn.00429a90
lea ecx, [esp + 0x1e8]
call fcn.00429cb0
lea ecx, [esp + 0x1e8]
call fcn.00429e10
mov eax, dword [esp + 0x90]
mov ebx, 1
cmp eax, ebx
je 0x421dd7
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x421dd7
mov eax, dword [esp + 0x9c]
test eax, eax
je 0x421dd7
mov eax, dword [esp + 0x6c]
test eax, eax
je 0x421dd7
mov eax, dword [esp + 0x60]
test eax, eax
je 0x421dd7
test edi, edi
je 0x421dd7
test esi, esi
jne 0x421e05
mov eax, dword [0x466c80]
test eax, eax
je 0x421dec
lea ecx, [esp + 0xc8]
call fcn.0043f6be
mov ecx, dword [esp + 0x1c]
push ebx
push ebx
call fcn.0041e900
call fcn.0044608e
mov eax, dword [eax + 4]
mov dword [eax + 0x128], ebx
mov edi, dword [esp + 0x1c]
mov edx, dword [edi + 0x8c]
push 0
push 0
push 0xb
push edx
call ebp
mov ebx, dword [esp + 0x74]
xor esi, esi
test ebx, ebx
jle 0x421e5c
add edi, 0x70
push esi
mov ecx, edi
call fcn.0043baea
cmp word [eax], 0x10
jne 0x421e53
push eax
call fcn.0043cc88
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x8c]
add esp, 4
push 0
push esi
push 0x1008
push ecx
call ebp
dec esi
dec ebx
inc esi
cmp esi, ebx
jl 0x421e25
mov edi, dword [esp + 0x1c]
mov edx, dword [edi + 0x8c]
push 0
push 1
push 0xb
push edx
call ebp
call fcn.0044608e
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x120]
mov ecx, dword [eax + 0x24]
test ecx, ecx
je 0x421ee4
call fcn.0043cb83
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea esi, [eax + 0x10]
mov dword [esp + 0x60], esi
push 0x38
mov byte [esp + 0xbb0], 0x13
call fcn.0043cb78
test eax, eax
je 0x421eb6
push 0x38
push eax
lea ecx, [esp + 0x68]
call fcn.00401860
mov esi, dword [esp + 0x60]
push 0
push 0
push esi
mov ecx, edi
call fcn.0041d5d0
lea eax, [esi - 0x10]
mov byte [esp + 0xbac], 8
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x421ee4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push 1
push 1
mov ecx, edi
call fcn.0041e900
push 0
push 0x3eb
mov ecx, edi
call fcn.00441335
mov ecx, eax
call fcn.0044146b
mov eax, dword [esp + 0x68]
add eax, 0xfffffff0
mov byte [esp + 0xbac], 7
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x421f2a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
mov byte [esp + 0xbac], 6
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x421f50
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x48]
add eax, 0xfffffff0
mov byte [esp + 0xbac], 5
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x421f76
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x44]
add eax, 0xfffffff0
mov byte [esp + 0xbac], 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x421f9c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x50]
add eax, 0xfffffff0
mov byte [esp + 0xbac], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x421fc2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov byte [esp + 0xbac], 0x14
lea ecx, [esp + 0x138]
call fcn.0043bb81
lea ecx, [esp + 0xc8]
mov byte [esp + 0xbac], 2
call fcn.0043d5c0
mov byte [esp + 0xbac], 1
call fcn.0044608e
mov ecx, dword [eax + 4]
call fcn.00441833
lea ecx, [esp + 0x1e8]
mov byte [esp + 0xbac], 0
call fcn.00429530
mov eax, dword [esp + 0x64]
add eax, 0xfffffff0
mov dword [esp + 0xbac], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x42203c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0xba4]
pop edi
mov dword fs:[0], ecx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret