Function at 0x4057f0
Capabilities:
Delete directory
Delete file
Delete registry key
Delete registry value
Enumerate files on windows
Get common file path
Persist via run registry key
Query or enumerate registry key
Query or enumerate registry value
Set file attributes

Disassembly:
sub esp, 0xf80
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
xor ebx, ebx
push str.CLSID1CDB2949_8F65_4355_8456_263E7C208A5D
push 0x80000000
mov dword [esp + 0x5c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x405839
mov ecx, dword [esp + 0x10]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call ebp
mov edx, dword [esp + 0xf94]
push edx
push ebx
call fcn.00403a20
add esp, 8
jmp 0x40583f
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.NVIDIA_TwinView_Window
push str.NVIDIA_TwinView_Window
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x40587c
push 1
call fcn.00402e10
mov eax, dword [0x40fd24]
add esp, 4
cmp eax, ebx
mov dword [esp + 0x1c], ebx
je 0x405873
lea ecx, [esp + 0x1c]
push ecx
push 2
call eax
push ebx
call fcn.00402e10
add esp, 4
mov edx, dword [esp + 0xf94]
push edx
call fcn.00402d80
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
add esp, 4
lea eax, [esp + 0x10]
push eax
push 0xf003f
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionRun_nView
push 0x80000002
call esi
test eax, eax
jne 0x4058c6
mov ecx, dword [esp + 0x10]
push ecx
call ebp
push str.SoftwareMicrosoftWindowsCurrentVersionRun_nView
push 0x80000002
call fcn.00403ee0
add esp, 8
lea edx, [esp + 0x10]
push edx
push 0xf003f
push ebx
push 0x40ef18
push 0x80000002
call esi
test eax, eax
jne 0x405908
mov eax, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push str.NVIEW
push eax
call edi
mov ecx, dword [esp + 0x10]
push str.nwiz
push ecx
call edi
mov edx, dword [esp + 0x10]
push edx
call ebp
jmp 0x40590e
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea eax, [esp + 0x10]
push eax
push 0xf003f
push ebx
push str.SoftwareNVIDIA_CorporationGlobal_nView
push 0x80000002
call esi
test eax, eax
jne 0x405942
mov ecx, dword [esp + 0x10]
push ecx
call ebp
push str.SoftwareNVIDIA_CorporationGlobal_nView
push 0x80000002
call fcn.00403ee0
add esp, 8
lea edx, [esp + 0x10]
push edx
push 0xf003f
push ebx
push str.SoftwareNVIDIA_CorporationGlobal_nViewInstalled
push 0x80000001
call esi
test eax, eax
jne 0x40597e
mov eax, dword [esp + 0x10]
mov dword [esp + 0x50], 1
push eax
call ebp
push str.SoftwareNVIDIA_CorporationGlobal_nViewInstalled
push 0x80000001
call fcn.00403ee0
add esp, 8
push 0x80000001
mov dword [esp + 0x58], ebx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x24], 0x1fe
mov dword [esp + 0x34], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x38], ebx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
cmp dword [0x40fcf0], 1
je 0x405a2b
lea ecx, [esp + 0x1c]
push ecx
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea edx, [esp + 0x24]
push edx
push str.SeRestorePrivilege
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov ecx, dword [esp + 0x28]
mov ebp, eax
mov eax, dword [esp + 0x24]
push ebx
push ebx
lea edx, [esp + 0x64]
neg ebp
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x24]
push 0x10
push edx
sbb ebp, ebp
push ebx
push eax
inc ebp
mov dword [esp + 0x74], 1
mov dword [esp + 0x7c], ecx
mov dword [esp + 0x80], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
neg eax
sbb eax, eax
inc eax
or ebp, eax
mov eax, dword [0x40fcf0]
cmp eax, 1
mov dword [esp + 0x1c], ebp
jne 0x405a3d
lea ecx, [esp + 0x2c]
push ecx
push 0x20019
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionProfileList
jmp 0x405a4d
lea edx, [esp + 0x2c]
push edx
push 0x20019
push ebx
push str.SoftwareMicrosoftWindows_NTCurrentVersionProfileList
push 0x80000002
call esi
mov ebp, dword [sym.imp.USER32.dll_wsprintfW]
cmp eax, ebx
jne 0x405ed6
lea eax, [esp + 0x54]
lea ecx, [esp + 0x20]
push eax
mov eax, dword [esp + 0x30]
push ebx
push ebx
push ebx
lea edx, [esp + 0x3c4]
push ecx
push edx
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
je 0x405ec6
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x38]
push ecx
push 0x20019
lea edx, [esp + 0x3bc]
push ebx
push edx
push eax
call esi
test eax, eax
jne 0x405e89
lea ecx, [esp + 0x40]
lea edx, [esp + 0x980]
push ecx
mov ecx, dword [esp + 0x3c]
lea eax, [esp + 0x40]
push edx
push eax
push ebx
push str.ProfileImagePath
push ecx
mov dword [esp + 0x54], 1
mov dword [esp + 0x58], 0x208
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x405bc2
lea edx, [esp + 0x54]
lea eax, [esp + 0x20]
push edx
mov edx, dword [esp + 0x34]
push ebx
push ebx
push ebx
lea ecx, [esp + 0x3c4]
push eax
mov eax, dword [esp + 0x4c]
push ecx
push edx
push eax
mov dword [esp + 0x40], 0x1fe
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
je 0x405bbc
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
dec edx
mov eax, dword [esp + 0x38]
inc ecx
mov dword [esp + 0x34], edx
mov dword [esp + 0x30], ecx
lea ecx, [esp + 0x48]
push ecx
push 0x20019
lea edx, [esp + 0x3bc]
push ebx
push edx
push eax
call esi
test eax, eax
jne 0x405be1
lea ecx, [esp + 0x40]
lea edx, [esp + 0x980]
push ecx
mov ecx, dword [esp + 0x4c]
lea eax, [esp + 0x40]
push edx
push eax
push ebx
push str.ProfileImagePath
push ecx
mov dword [esp + 0x54], 1
mov dword [esp + 0x58], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x405baf
lea edx, [esp + 0x3b4]
lea eax, [esp + 0xd88]
push edx
push 0x40f318
push eax
mov edi, 1
call ebp
add esp, 0xc
mov ecx, dword [esp + 0x48]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x405be1
mov dword [esp + 0x30], ebx
jmp 0x405be1
lea edx, [esp + 0x3b4]
lea eax, [esp + 0xd88]
push edx
push 0x40f318
push eax
mov edi, 1
call ebp
add esp, 0xc
lea ecx, [esp + 0x14]
lea edx, [esp + 0xd88]
push ecx
push 0xf003f
push ebx
push edx
push 0x80000003
mov dword [esp + 0x60], ebx
call esi
test eax, eax
jne 0x405c16
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x4c], 1
cmp edi, ebx
je 0x405e7e
mov eax, dword [0x40fcf0]
cmp eax, 1
je 0x405ce6
cmp eax, 2
je 0x405c99
mov ecx, dword [esp + 0xf94]
lea edx, [esp + 0xb88]
push ecx
push 0x40f308
push edx
call ebp
mov ax, word [0x40f304]
lea ecx, [esp + 0xb94]
push eax
push ecx
call fcn.004069c0
mov word [eax], bx
mov dx, word [0x40f2fc]
lea eax, [esp + 0x996]
push edx
push eax
call fcn.004069c0
add eax, 2
push str.Ntuser.dat
lea ecx, [esp + 0xba8]
push eax
push ecx
lea edx, [esp + 0x94]
push str._s_s_s
push edx
call ebp
add esp, 0x30
jmp 0x405d02
lea eax, [esp + 0xb88]
push 0xff
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov cx, word [0x40f2fc]
lea edx, [esp + 0x982]
push ecx
push edx
call fcn.004069c0
add eax, 2
push str.Ntuser.dat
push eax
lea eax, [esp + 0xb98]
push eax
lea ecx, [esp + 0x80]
push str._s_s_s
push ecx
call ebp
add esp, 0x1c
jmp 0x405d02
lea edx, [esp + 0x980]
push str.User.dat
push edx
lea eax, [esp + 0x74]
push str._s_s
push eax
call ebp
add esp, 0x10
mov edi, dword [esp + 0x4c]
cmp edi, ebx
jne 0x405d2a
lea ecx, [esp + 0x6c]
lea edx, [esp + 0xd88]
push ecx
push edx
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
cmp eax, ebx
jne 0x405e74
lea eax, [esp + 0x14]
lea ecx, [esp + 0xd88]
push eax
push 0xf003f
push ebx
push ecx
push 0x80000003
call esi
test eax, eax
jne 0x405e51
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x10]
push edx
push 0xf003f
push ebx
push str.SoftwareNVIDIA_CorporationGlobal
push eax
call esi
test eax, eax
jne 0x405d9e
mov ecx, dword [esp + 0x10]
push str.nView
push ecx
call fcn.00403ee0
mov edx, dword [esp + 0x18]
push str.TABView
push edx
call fcn.00403ee0
mov eax, dword [esp + 0x20]
add esp, 0x10
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x14]
push str.SoftwareNVIDIA_CorporationGlobal_nViewInstalled
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp dword [0x40fcf0], 1
jne 0x405de5
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x44]
push eax
push 0xf003f
push ebx
push 0x40ef18
push ecx
call esi
mov edx, dword [esp + 0x44]
push str.NVIEW
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [esp + 0x44]
push eax
jmp 0x405e23
mov ecx, dword [esp + 0x14]
push str.SoftwareMicrosoftWindowsCurrentVersionRun_nView
push ecx
call fcn.00403ee0
mov eax, dword [esp + 0x1c]
add esp, 8
lea edx, [esp + 0x24]
push edx
push 0xf003f
push ebx
push 0x40ef18
push eax
call esi
mov ecx, dword [esp + 0x24]
push str.NVIEW
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov edx, dword [esp + 0x24]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov ecx, dword [esp + 0x18]
neg eax
sbb eax, eax
neg eax
or ecx, eax
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x405e5b
mov eax, dword [esp + 0x18]
or al, 1
mov dword [esp + 0x18], eax
cmp edi, ebx
jne 0x405e7e
lea edx, [esp + 0xd88]
push edx
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
jmp 0x405e7e
mov eax, dword [esp + 0x18]
or al, 1
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x38]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x54]
push ecx
push ebx
push ebx
lea edx, [esp + 0x2c]
push ebx
lea ecx, [esp + 0x3c4]
inc eax
push edx
mov edx, dword [esp + 0x40]
push ecx
push eax
push edx
mov dword [esp + 0x40], 0x1fe
mov dword [esp + 0x54], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
jne 0x405a8e
mov eax, dword [esp + 0x2c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x405fb5
lea ecx, [esp + 0x10]
push ecx
push 0xf003f
push ebx
push str.SoftwareNVIDIA_CorporationGlobal
push 0x80000001
call esi
test eax, eax
jne 0x405f28
mov edx, dword [esp + 0x10]
push str.nView
push edx
call fcn.00403ee0
mov eax, dword [esp + 0x18]
push str.TABView
push eax
call fcn.00403ee0
mov ecx, dword [esp + 0x20]
add esp, 0x10
push ecx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.SoftwareNVIDIA_CorporationGlobal_nViewInstalled
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp dword [0x40fcf0], 1
jne 0x405f6a
lea eax, [esp + 0x24]
push eax
push 0xf003f
push ebx
push 0x40ef18
push 0x80000001
call esi
mov ecx, dword [esp + 0x24]
push str.NVIEW
push ecx
call edi
mov edx, dword [esp + 0x24]
jmp 0x405fa3
push str.SoftwareMicrosoftWindowsCurrentVersionRun_nView
push 0x80000001
call fcn.00403ee0
add esp, 8
lea eax, [esp + 0x24]
push eax
push 0xf003f
push ebx
push 0x40ef18
push 0x80000001
call esi
mov ecx, dword [esp + 0x24]
push str.NVIEW
push ecx
call edi
mov edx, dword [esp + 0x24]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov eax, dword [esp + 0x1c]
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
mov edi, dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, ebx
je 0x40600f
mov ecx, dword [0x40fcdc]
lea eax, [esp + 0x91c]
push 0x32
push eax
push 0x15ef
push ecx
call esi
mov eax, dword [0x40fcdc]
lea edx, [esp + 0xb88]
push 0xc8
push edx
push 0x7fa
push eax
call esi
lea ecx, [esp + 0x91c]
push ebx
lea edx, [esp + 0xb8c]
push ecx
push edx
push ebx
call edi
mov eax, dword [esp + 0xf94]
push str.dmcpl.exe
push eax
lea ecx, [esp + 0x704]
push str._s_s
push ecx
call ebp
add esp, 0x10
lea edx, [esp + 0x6fc]
push ebx
push edx
call fcn.00403cf0
mov eax, dword [esp + 0xf94]
push str.nvTUICpl.cpl
push eax
lea ecx, [esp + 0x704]
push str._s_s
push ecx
call ebp
add esp, 0x10
lea edx, [esp + 0x6fc]
push ebx
push edx
call fcn.00403cf0
mov eax, dword [esp + 0xf94]
push str.nview.dll
push eax
lea ecx, [esp + 0x704]
push str._s_s
push ecx
call ebp
add esp, 0x10
lea edx, [esp + 0x6fc]
push ebx
push edx
call fcn.00403cf0
mov eax, dword [esp + 0xf94]
push str.nvshell.dll
push eax
lea ecx, [esp + 0x704]
push str._s_s
push ecx
call ebp
add esp, 0x10
lea edx, [esp + 0x6fc]
push ebx
push edx
call fcn.00403cf0
mov eax, dword [esp + 0xf94]
push str.nviewimg.dll
push eax
lea ecx, [esp + 0x704]
push str._s_s
push ecx
call ebp
add esp, 0x10
lea edx, [esp + 0x6fc]
push ebx
push edx
call fcn.00403cf0
cmp dword [esp + 0x50], ebx
je 0x406149
mov ecx, dword [0x40fcdc]
lea eax, [esp + 0xb88]
push 0xc8
push eax
push 0x7f9
push ecx
call esi
mov eax, dword [0x40fcdc]
lea edx, [esp + 0x91c]
push 0x32
push edx
push 0x15f0
push eax
call esi
lea ecx, [esp + 0x91c]
push 0x40004
lea edx, [esp + 0xb8c]
push ecx
push edx
push ebx
call edi
cmp eax, 6
jne 0x4062c8
lea eax, [esp + 0x980]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea ecx, [esp + 0x980]
push str.nview.tvp
push ecx
lea edx, [esp + 0x704]
push str._s_s
push edx
call ebp
add esp, 0x10
lea eax, [esp + 0x6c]
lea ecx, [esp + 0x6fc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x406282
lea edx, [esp + 0x98]
lea eax, [esp + 0x980]
push edx
push str.nview
push eax
lea ecx, [esp + 0x708]
push 0x40f208
push ecx
call ebp
mov eax, dword [0x40fcf0]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esp, 0x14
cmp eax, 1
jne 0x4061ef
lea edx, [esp + 0x6fc]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [esp + 0x6fc]
push eax
call edi
jmp 0x4061fd
lea ecx, [esp + 0x6fc]
push ebx
push ecx
call fcn.00403cf0
lea edx, [esp + 0x6c]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x40627b
lea eax, [esp + 0x98]
lea ecx, [esp + 0x980]
push eax
push str.nview
push ecx
lea edx, [esp + 0x708]
push 0x40f208
push edx
call ebp
mov eax, dword [0x40fcf0]
add esp, 0x14
cmp eax, 1
jne 0x40625d
lea eax, [esp + 0x6fc]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [esp + 0x6fc]
push ecx
call edi
jmp 0x40626b
lea edx, [esp + 0x6fc]
push ebx
push edx
call fcn.00403cf0
lea eax, [esp + 0x6c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40620d
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [0x40fcf0], 1
jne 0x40629b
lea ecx, [esp + 0x6fc]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x4062c8
lea edx, [esp + 0x980]
push str.nview
push edx
lea eax, [esp + 0x704]
push str._s_s
push eax
call ebp
add esp, 0x10
lea ecx, [esp + 0x6fc]
push ebx
push ecx
call fcn.00403cf0
mov eax, dword [0x40fcdc]
cmp eax, ebx
je 0x4062e0
cmp eax, dword [0x40fd0c]
je 0x4062e0
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, 6
mov esi, str.NVWRSAR.DLL
lea edi, [esp + 0x6c]
rep movsd dword es:[edi], dword [esi]
mov ecx, 6
mov esi, str.NVWRSCS.DLL
lea edi, [esp + 0x88]
mov dword [esp + 0x84], ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, 6
mov esi, str.NVWRSDA.DLL
lea edi, [esp + 0xa4]
mov dword [esp + 0xa0], ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, 6
mov esi, str.NVWRSDE.DLL
lea edi, [esp + 0xc0]
mov dword [esp + 0xbc], ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, 6
mov esi, str.NVWRSENG.DLL
lea edi, [esp + 0xdc]
mov dword [esp + 0xd8], ebx
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, 6
mov esi, str.NVWRSES.DLL
lea edi, [esp + 0xf8]
mov word [esp + 0xf6], bx
rep movsd dword es:[edi], dword [esi]
mov ecx, 6
mov esi, str.NVWRSESM.DLL
lea edi, [esp + 0x114]
mov dword [esp + 0x110], ebx
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, 6
mov esi, str.NVWRSES.DLL
lea edi, [esp + 0x130]
mov word [esp + 0x12e], bx
rep movsd dword es:[edi], dword [esi]
mov ecx, 6
mov esi, str.NVWRSFI.DLL
lea edi, [esp + 0x14c]
mov dword [esp + 0x148], ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, 6
mov esi, str.NVWRSFR.DLL
lea edi, [esp + 0x168]
mov dword [esp + 0x164], ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, 6
mov esi, str.NVWRSFR.DLL
lea edi, [esp + 0x184]
mov dword [esp + 0x180], ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, 6
mov esi, str.NVWRSEL.DLL
lea edi, [esp + 0x1a0]
mov dword [esp + 0x19c], ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, 6
mov esi, str.NVWRSHE.DLL
lea edi, [esp + 0x1bc]
mov dword [esp + 0x1b8], ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, 6
mov esi, str.NVWRSHU.DLL
lea edi, [esp + 0x1d8]
mov dword [esp + 0x1d4], ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, 6
mov esi, str.NVWRSIT.DLL
lea edi, [esp + 0x1f4]
mov dword [esp + 0x1f0], ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, 6
mov esi, str.NVWRSJA.DLL
lea edi, [esp + 0x210]
mov dword [esp + 0x20c], ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, 6
mov esi, str.NVWRSKO.DLL
lea edi, [esp + 0x22c]
mov dword [esp + 0x228], ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, 6
mov esi, str.NVWRSNL.DLL
lea edi, [esp + 0x248]
mov dword [esp + 0x244], ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, 6
mov esi, str.NVWRSNO.DLL
lea edi, [esp + 0x264]
mov dword [esp + 0x260], ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, 6
mov esi, str.NVWRSPL.DLL
lea edi, [esp + 0x280]
mov dword [esp + 0x27c], ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, 6
mov esi, str.NVWRSPT.DLL
lea edi, [esp + 0x29c]
mov dword [esp + 0x298], ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, 6
mov esi, str.NVWRSPTB.DLL
lea edi, [esp + 0x2b8]
mov dword [esp + 0x2b4], ebx
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, 6
mov esi, str.NVWRSRU.DLL
lea edi, [esp + 0x2d4]
mov word [esp + 0x2d2], bx
rep movsd dword es:[edi], dword [esi]
mov ecx, 6
mov esi, str.NVWRSSK.DLL
lea edi, [esp + 0x2f0]
mov dword [esp + 0x2ec], ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, 6
mov esi, str.NVWRSSL.DLL
lea edi, [esp + 0x30c]
mov dword [esp + 0x308], ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, 6
mov esi, str.NVWRSSV.DLL
lea edi, [esp + 0x328]
mov dword [esp + 0x324], ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, 6
mov esi, str.NVWRSTH.DLL
lea edi, [esp + 0x344]
mov dword [esp + 0x340], ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, 6
mov esi, str.NVWRSTR.DLL
lea edi, [esp + 0x360]
mov dword [esp + 0x35c], ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, 6
mov esi, str.NVWRSZHC.DLL
lea edi, [esp + 0x37c]
mov dword [esp + 0x378], ebx
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, 6
mov esi, str.NVWRSZHT.DLL
lea edi, [esp + 0x398]
mov word [esp + 0x396], bx
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov word [esp + 0x3b2], bx
lea esi, [esp + 0x6c]
mov edi, 0x1e
mov edx, dword [esp + 0xf94]
push esi
push edx
lea eax, [esp + 0x704]
push str._s_s
push eax
call ebp
add esp, 0x10
lea ecx, [esp + 0x6fc]
push ebx
push ecx
call fcn.00403cf0
add esi, 0x1c
dec edi
jne 0x406601
mov ecx, 6
mov esi, str.NVWCPAR.HLP
lea edi, [esp + 0x3b4]
rep movsd dword es:[edi], dword [esi]
mov ecx, 6
mov esi, str.NVWCPCS.HLP
lea edi, [esp + 0x3d0]
mov dword [esp + 0x3cc], ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, 6
mov esi, str.NVWCPDA.HLP
lea edi, [esp + 0x3ec]
mov dword [esp + 0x3e8], ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, 6
mov esi, str.NVWCPDE.HLP
lea edi, [esp + 0x408]
mov dword [esp + 0x404], ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, 6
mov esi, str.NVWCPENG.HLP
lea edi, [esp + 0x424]
mov dword [esp + 0x420], ebx
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, 6
mov esi, str.NVWCPES.HLP
lea edi, [esp + 0x440]
mov word [esp + 0x43e], bx
rep movsd dword es:[edi], dword [esi]
mov ecx, 6
mov esi, str.NVWCPESM.HLP
lea edi, [esp + 0x45c]
mov dword [esp + 0x458], ebx
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, 6
mov esi, str.NVWCPES.HLP
lea edi, [esp + 0x478]
mov word [esp + 0x476], bx
rep movsd dword es:[edi], dword [esi]
mov ecx, 6
mov esi, str.NVWCPFI.HLP
lea edi, [esp + 0x494]
mov dword [esp + 0x490], ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, 6
mov esi, str.NVWCPFR.HLP
lea edi, [esp + 0x4b0]
mov dword [esp + 0x4ac], ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, 6
mov esi, str.NVWCPFR.HLP
lea edi, [esp + 0x4cc]
mov dword [esp + 0x4c8], ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, 6
mov esi, str.NVWCPEL.HLP
lea edi, [esp + 0x4e8]
mov dword [esp + 0x4e4], ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, 6
mov esi, str.NVWCPHE.HLP
lea edi, [esp + 0x504]
mov dword [esp + 0x500], ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, 6
mov esi, str.NVWCPHU.HLP
lea edi, [esp + 0x520]
mov dword [esp + 0x51c], ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, 6
mov esi, str.NVWCPIT.HLP
lea edi, [esp + 0x53c]
mov dword [esp + 0x538], ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, 6
mov esi, str.NVWCPJA.HLP
lea edi, [esp + 0x558]
mov dword [esp + 0x554], ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, 6
mov esi, str.NVWCPKO.HLP
lea edi, [esp + 0x574]
mov dword [esp + 0x570], ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, 6
mov esi, str.NVWCPNL.HLP
lea edi, [esp + 0x590]
mov dword [esp + 0x58c], ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, 6
mov esi, str.NVWCPNO.HLP
lea edi, [esp + 0x5ac]
mov dword [esp + 0x5a8], ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, 6
mov esi, str.NVWCPPL.HLP
lea edi, [esp + 0x5c8]
mov dword [esp + 0x5c4], ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, 6
mov esi, str.NVWCPPT.HLP
lea edi, [esp + 0x5e4]
mov dword [esp + 0x5e0], ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, 6
mov esi, str.NVWCPPTB.HLP
lea edi, [esp + 0x600]
mov dword [esp + 0x5fc], ebx
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, 6
mov esi, str.NVWCPRU.HLP
lea edi, [esp + 0x61c]
mov word [esp + 0x61a], bx
rep movsd dword es:[edi], dword [esi]
mov ecx, 6
mov esi, str.NVWCPSK.HLP
lea edi, [esp + 0x638]
mov dword [esp + 0x634], ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, 6
mov esi, str.NVWCPSL.HLP
lea edi, [esp + 0x654]
mov dword [esp + 0x650], ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, 6
mov esi, str.NVWCPSV.HLP
lea edi, [esp + 0x670]
mov dword [esp + 0x66c], ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, 6
mov esi, str.NVWCPTH.HLP
lea edi, [esp + 0x68c]
mov dword [esp + 0x688], ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, 6
mov esi, str.NVWCPTR.HLP
lea edi, [esp + 0x6a8]
mov dword [esp + 0x6a4], ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, 6
mov esi, str.NVWCPZHC.HLP
lea edi, [esp + 0x6c4]
mov dword [esp + 0x6c0], ebx
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, 6
mov esi, str.NVWCPZHT.HLP
lea edi, [esp + 0x6e0]
mov word [esp + 0x6de], bx
rep movsd dword es:[edi], dword [esi]
lea edx, [esp + 0x980]
push 0x104
movsw word es:[edi], word [esi]
push edx
mov word [esp + 0x702], bx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [esp + 0x980]
push eax
push str._sHelp
lea ecx, [esp + 0xd90]
push ecx
call ebp
add esp, 0xc
lea esi, [esp + 0x3b4]
mov edi, 0x1e
lea edx, [esp + 0xd88]
push esi
push edx
lea eax, [esp + 0x704]
push str._s_s
push eax
call ebp
add esp, 0x10
lea ecx, [esp + 0x6fc]
push ebx
push ecx
call fcn.00403cf0
add esi, 0x1c
dec edi
jne 0x406984
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf80
ret