Function at 0x428f60
Capabilities:
Check if file exists
Check mutex and terminate process on windows
Check mutex on windows
Create process on windows
Get common file path
Query or enumerate registry value
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42c3f4
mov eax, dword fs:[0]
push eax
mov eax, 0x1830
call fcn.00413700
mov eax, dword [0x43ba24]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x15e8], 0
mov byte [ebp - 0x126], 0
mov byte [ebp - 0x235], 0
mov byte [ebp - 0x11d], 0
mov byte [ebp - 0x11f], 0
mov byte [ebp - 0x11e], 0
mov byte [ebp - 0x125], 0
mov byte [ebp - 0x11c], 0
push 0x103
push 0
lea eax, [ebp - 0x11b]
push eax
call fcn.0040e9c0
add esp, 0xc
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x434230
lea ecx, [ebp - 0x1530]
push ecx
call fcn.00401380
add esp, 8
mov dword [ebp - 0x15ec], eax
mov edx, dword [ebp - 0x15ec]
mov eax, dword [edx]
mov dword [ebp - 0x15f0], eax
mov ecx, dword [ebp - 0x15f0]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 0x124], eax
lea ecx, [ebp - 0x1530]
call fcn.004019a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x429048
mov byte [ebp - 0x126], 1
jmp 0x42904f
mov byte [ebp - 0x126], 0
cmp dword [ebp - 0x124], 0xffffffff
je 0x429065
mov edx, dword [ebp - 0x124]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x43f988
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x42907b
mov byte [ebp - 0x235], 1
push 0x434244
lea eax, [ebp - 0x1538]
push eax
call fcn.00401380
add esp, 8
mov dword [ebp - 0x17c8], eax
mov ecx, dword [ebp - 0x17c8]
mov dword [ebp - 0x15f8], ecx
mov dword [ebp - 4], 0
push 0x434260
lea edx, [ebp - 0x153c]
push edx
call fcn.00401380
add esp, 8
mov dword [ebp - 0x1600], eax
mov eax, dword [ebp - 0x15f8]
mov ecx, dword [eax]
mov dword [ebp - 0x15fc], ecx
mov edx, dword [ebp - 0x1600]
mov eax, dword [edx]
mov dword [ebp - 0x1604], eax
push 0
mov ecx, dword [ebp - 0x15fc]
push ecx
mov edx, dword [ebp - 0x1604]
push edx
push 0x80000001
call fcn.00424850
add esp, 0x10
mov dword [ebp - 0x1534], eax
lea ecx, [ebp - 0x153c]
call fcn.004019a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1538]
call fcn.004019a0
cmp dword [ebp - 0x1534], 0
je 0x42912e
mov byte [ebp - 0x11d], 1
push 0x434284
lea eax, [ebp - 0x1544]
push eax
call fcn.00401380
add esp, 8
mov dword [ebp - 0x17cc], eax
mov ecx, dword [ebp - 0x17cc]
mov dword [ebp - 0x1610], ecx
mov dword [ebp - 4], 1
push 0x4342a4
lea edx, [ebp - 0x1548]
push edx
call fcn.00401380
add esp, 8
mov dword [ebp - 0x1618], eax
mov eax, dword [ebp - 0x1610]
mov ecx, dword [eax]
mov dword [ebp - 0x1614], ecx
mov edx, dword [ebp - 0x1618]
mov eax, dword [edx]
mov dword [ebp - 0x161c], eax
push 0
mov ecx, dword [ebp - 0x1614]
push ecx
mov edx, dword [ebp - 0x161c]
push edx
push 0x80000001
call fcn.00424850
add esp, 0x10
mov dword [ebp - 0x1540], eax
lea ecx, [ebp - 0x1548]
call fcn.004019a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1544]
call fcn.004019a0
cmp dword [ebp - 0x1540], 0
je 0x4291e1
mov byte [ebp - 0x11f], 1
push 0x4342c8
lea eax, [ebp - 0x1550]
push eax
call fcn.00401380
add esp, 8
mov dword [ebp - 0x17d0], eax
mov ecx, dword [ebp - 0x17d0]
mov dword [ebp - 0x1628], ecx
mov dword [ebp - 4], 2
push 0x4342e0
lea edx, [ebp - 0x1554]
push edx
call fcn.00401380
add esp, 8
mov dword [ebp - 0x1630], eax
mov eax, dword [ebp - 0x1628]
mov ecx, dword [eax]
mov dword [ebp - 0x162c], ecx
mov edx, dword [ebp - 0x1630]
mov eax, dword [edx]
mov dword [ebp - 0x1634], eax
push 0
mov ecx, dword [ebp - 0x162c]
push ecx
mov edx, dword [ebp - 0x1634]
push edx
push 0x80000001
call fcn.00424850
add esp, 0x10
mov dword [ebp - 0x154c], eax
lea ecx, [ebp - 0x1554]
call fcn.004019a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1550]
call fcn.004019a0
cmp dword [ebp - 0x154c], 0
je 0x429294
mov byte [ebp - 0x11e], 1
mov byte [ebp - 0x234], 0
push 0x103
push 0
lea eax, [ebp - 0x233]
push eax
call fcn.0040e9c0
add esp, 0xc
push 0x434340
lea ecx, [ebp - 0x155c]
push ecx
call fcn.00401380
add esp, 8
mov dword [ebp - 0x17d4], eax
mov edx, dword [ebp - 0x17d4]
mov dword [ebp - 0x1640], edx
mov dword [ebp - 4], 3
mov eax, dword [ebp - 0x15e8]
or eax, 1
mov dword [ebp - 0x15e8], eax
push 0x434360
lea ecx, [ebp - 0x1560]
push ecx
call fcn.00401380
add esp, 8
mov dword [ebp - 0x17d8], eax
mov edx, dword [ebp - 0x17d8]
mov dword [ebp - 0x1648], edx
mov dword [ebp - 4], 4
mov eax, dword [ebp - 0x15e8]
or eax, 2
mov dword [ebp - 0x15e8], eax
mov ecx, dword [ebp - 0x1640]
mov edx, dword [ecx]
mov dword [ebp - 0x1644], edx
mov eax, dword [ebp - 0x1648]
mov ecx, dword [eax]
mov dword [ebp - 0x164c], ecx
push 0
mov edx, dword [ebp - 0x1644]
push edx
mov eax, dword [ebp - 0x164c]
push eax
mov ecx, dword [0x43ce14]
push ecx
call fcn.00424850
add esp, 0x10
test eax, eax
je 0x429433
push 0x4343dc
lea edx, [ebp - 0x1564]
push edx
call fcn.00401380
add esp, 8
mov dword [ebp - 0x17dc], eax
mov eax, dword [ebp - 0x17dc]
mov dword [ebp - 0x1650], eax
mov dword [ebp - 4], 5
mov ecx, dword [ebp - 0x15e8]
or ecx, 4
mov dword [ebp - 0x15e8], ecx
push 0x434400
lea edx, [ebp - 0x1568]
push edx
call fcn.00401380
add esp, 8
mov dword [ebp - 0x1658], eax
mov eax, dword [ebp - 0x15e8]
or eax, 8
mov dword [ebp - 0x15e8], eax
mov ecx, dword [ebp - 0x1650]
mov edx, dword [ecx]
mov dword [ebp - 0x1654], edx
mov eax, dword [ebp - 0x1658]
mov ecx, dword [eax]
mov dword [ebp - 0x165c], ecx
lea edx, [ebp - 0x234]
push edx
mov eax, dword [ebp - 0x1654]
push eax
mov ecx, dword [ebp - 0x165c]
push ecx
mov edx, dword [0x43ce14]
push edx
call fcn.00424850
add esp, 0x10
test eax, eax
je 0x429433
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
cmp eax, 1
jne 0x429433
mov dword [ebp - 0x17e0], 1
jmp 0x42943d
mov dword [ebp - 0x17e0], 0
mov cl, byte [ebp - 0x17e0]
mov byte [ebp - 0x1555], cl
mov edx, dword [ebp - 0x15e8]
and edx, 8
je 0x429466
and dword [ebp - 0x15e8], 0xfffffff7
lea ecx, [ebp - 0x1568]
call fcn.004019a0
mov dword [ebp - 4], 4
mov eax, dword [ebp - 0x15e8]
and eax, 4
je 0x42948a
and dword [ebp - 0x15e8], 0xfffffffb
lea ecx, [ebp - 0x1564]
call fcn.004019a0
mov dword [ebp - 4], 3
mov ecx, dword [ebp - 0x15e8]
and ecx, 2
je 0x4294ae
and dword [ebp - 0x15e8], 0xfffffffd
lea ecx, [ebp - 0x1560]
call fcn.004019a0
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x15e8]
and edx, 1
je 0x4294d2
and dword [ebp - 0x15e8], 0xfffffffe
lea ecx, [ebp - 0x155c]
call fcn.004019a0
movzx eax, byte [ebp - 0x1555]
test eax, eax
je 0x4294e4
mov byte [ebp - 0x125], 1
movzx ecx, byte [ebp - 0x126]
test ecx, ecx
je 0x4294ff
movzx edx, byte [ebp - 0x125]
test edx, edx
jne 0x4294ff
call fcn.00428c80
movzx eax, byte [ebp - 0x126]
test eax, eax
je 0x4295cb
movzx ecx, byte [ebp - 0x11e]
test ecx, ecx
jne 0x4295cb
push 0x43447c
lea edx, [ebp - 0x156c]
push edx
call fcn.00401380
add esp, 8
mov dword [ebp - 0x17e4], eax
mov eax, dword [ebp - 0x17e4]
mov dword [ebp - 0x1670], eax
mov dword [ebp - 4], 6
push 0x434490
lea ecx, [ebp - 0x1570]
push ecx
call fcn.00401380
add esp, 8
mov dword [ebp - 0x1678], eax
mov edx, dword [ebp - 0x1670]
mov eax, dword [edx]
mov dword [ebp - 0x1674], eax
mov ecx, dword [ebp - 0x1678]
mov edx, dword [ecx]
mov dword [ebp - 0x167c], edx
push 0x43f988
call fcn.0040e850
add esp, 4
push eax
push 0x43f988
push 1
mov eax, dword [ebp - 0x1674]
push eax
mov ecx, dword [ebp - 0x167c]
push ecx
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
lea ecx, [ebp - 0x1570]
call fcn.004019a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x156c]
call fcn.004019a0
movzx edx, byte [ebp - 0x126]
test edx, edx
jne 0x4297d3
movzx eax, byte [ebp - 0x235]
test eax, eax
je 0x4297d3
push 0x44
push 0
lea ecx, [ebp - 0x2bc]
push ecx
call fcn.0040e9c0
add esp, 0xc
mov dword [ebp - 0x2bc], 0x44
push 0x10
push 0
lea edx, [ebp - 0x248]
push edx
call fcn.0040e9c0
add esp, 0xc
push 1
lea eax, [ebp - 0x268]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 1
lea ecx, [ebp - 0x268]
push ecx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov dword [ebp - 0x254], 0xc
lea edx, [ebp - 0x268]
mov dword [ebp - 0x250], edx
mov dword [ebp - 0x24c], 0
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x2bc]
push ecx
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x254]
push edx
lea eax, [ebp - 0x254]
push eax
push 0
push 0x43f988
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x26c], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x26c], 1
jne 0x4296d0
mov ecx, dword [ebp - 0x248]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x244]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x43fecc]
add eax, 1
mov dword [0x43fecc], eax
jmp 0x429706
push 1
push 0
push 0x43050e
push 0x43f988
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 0x21
jl 0x429706
mov ecx, dword [0x43fecc]
add ecx, 1
mov dword [0x43fecc], ecx
movzx edx, byte [ebp - 0x11e]
test edx, edx
jne 0x4297c3
push 0x4344f0
lea eax, [ebp - 0x1574]
push eax
call fcn.00401380
add esp, 8
mov dword [ebp - 0x17e8], eax
mov ecx, dword [ebp - 0x17e8]
mov dword [ebp - 0x1688], ecx
mov dword [ebp - 4], 7
push 0x434508
lea edx, [ebp - 0x1578]
push edx
call fcn.00401380
add esp, 8
mov dword [ebp - 0x1690], eax
mov eax, dword [ebp - 0x1688]
mov ecx, dword [eax]
mov dword [ebp - 0x168c], ecx
mov edx, dword [ebp - 0x1690]
mov eax, dword [edx]
mov dword [ebp - 0x1694], eax
push 0x43f988
call fcn.0040e850
add esp, 4
push eax
push 0x43f988
push 1
mov ecx, dword [ebp - 0x168c]
push ecx
mov edx, dword [ebp - 0x1694]
push edx
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
lea ecx, [ebp - 0x1578]
call fcn.004019a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1574]
call fcn.004019a0
movzx eax, byte [ebp - 0x125]
test eax, eax
jne 0x4297d3
call fcn.00428c80
movzx ecx, byte [ebp - 0x126]
test ecx, ecx
jne 0x42a48d
movzx edx, byte [ebp - 0x235]
test edx, edx
jne 0x42a48d
movzx eax, byte [ebp - 0x125]
test eax, eax
jne 0x4299a2
movzx ecx, byte [ebp - 0x11e]
test ecx, ecx
jne 0x4299a2
movzx edx, byte [ebp - 0x11d]
test edx, edx
jne 0x4299a2
push 0x434568
lea eax, [ebp - 0x1580]
push eax
call fcn.00401380
add esp, 8
mov dword [ebp - 0x17ec], eax
mov ecx, dword [ebp - 0x17ec]
mov dword [ebp - 0x16a0], ecx
mov dword [ebp - 4], 8
mov edx, dword [ebp - 0x15e8]
or edx, 0x10
mov dword [ebp - 0x15e8], edx
push 0x434584
lea eax, [ebp - 0x1584]
push eax
call fcn.00401380
add esp, 8
mov dword [ebp - 0x17f0], eax
mov ecx, dword [ebp - 0x17f0]
mov dword [ebp - 0x16a8], ecx
mov dword [ebp - 4], 9
mov edx, dword [ebp - 0x15e8]
or edx, 0x20
mov dword [ebp - 0x15e8], edx
mov eax, dword [ebp - 0x16a0]
mov ecx, dword [eax]
mov dword [ebp - 0x16a4], ecx
mov edx, dword [ebp - 0x16a8]
mov eax, dword [edx]
mov dword [ebp - 0x16ac], eax
push 0
mov ecx, dword [ebp - 0x16a4]
push ecx
mov edx, dword [ebp - 0x16ac]
push edx
push 0x80000001
call fcn.00424850
add esp, 0x10
test eax, eax
jne 0x4299a2
push 0x4345a8
lea eax, [ebp - 0x1588]
push eax
call fcn.00401380
add esp, 8
mov dword [ebp - 0x17f4], eax
mov ecx, dword [ebp - 0x17f4]
mov dword [ebp - 0x16b0], ecx
mov dword [ebp - 4], 0xa
mov edx, dword [ebp - 0x15e8]
or edx, 0x40
mov dword [ebp - 0x15e8], edx
push 0x4345d4
lea eax, [ebp - 0x158c]
push eax
call fcn.00401380
add esp, 8
mov dword [ebp - 0x17f8], eax
mov ecx, dword [ebp - 0x17f8]
mov dword [ebp - 0x16b8], ecx
mov dword [ebp - 4], 0xb
mov edx, dword [ebp - 0x15e8]
or edx, 0x80
mov dword [ebp - 0x15e8], edx
mov eax, dword [ebp - 0x16b0]
mov ecx, dword [eax]
mov dword [ebp - 0x16b4], ecx
mov edx, dword [ebp - 0x16b8]
mov eax, dword [edx]
mov dword [ebp - 0x16bc], eax
push 0
mov ecx, dword [ebp - 0x16b4]
push ecx
mov edx, dword [ebp - 0x16bc]
push edx
push 0x80000001
call fcn.00424850
add esp, 0x10
test eax, eax
jne 0x4299a2
push 0x43faa0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x429b13
push 0x4345f8
lea eax, [ebp - 0x1590]
push eax
call fcn.00401380
add esp, 8
mov dword [ebp - 0x17fc], eax
mov ecx, dword [ebp - 0x17fc]
mov dword [ebp - 0x16c0], ecx
mov dword [ebp - 4], 0xc
mov edx, dword [ebp - 0x15e8]
or edx, 0x100
mov dword [ebp - 0x15e8], edx
push 0x43460c
lea eax, [ebp - 0x1594]
push eax
call fcn.00401380
add esp, 8
mov dword [ebp - 0x1800], eax
mov ecx, dword [ebp - 0x1800]
mov dword [ebp - 0x16c8], ecx
mov dword [ebp - 4], 0xd
mov edx, dword [ebp - 0x15e8]
or edx, 0x200
mov dword [ebp - 0x15e8], edx
mov eax, dword [ebp - 0x16c0]
mov ecx, dword [eax]
mov dword [ebp - 0x16c4], ecx
mov edx, dword [ebp - 0x16c8]
mov eax, dword [edx]
mov dword [ebp - 0x16cc], eax
push 0
push 0
push 0
mov ecx, dword [ebp - 0x16c4]
push ecx
mov edx, dword [ebp - 0x16cc]
push edx
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
je 0x429b13
push 0x434630
lea eax, [ebp - 0x1598]
push eax
call fcn.00401380
add esp, 8
mov dword [ebp - 0x1804], eax
mov ecx, dword [ebp - 0x1804]
mov dword [ebp - 0x16d0], ecx
mov dword [ebp - 4], 0xe
mov edx, dword [ebp - 0x15e8]
or edx, 0x400
mov dword [ebp - 0x15e8], edx
push 0x434648
lea eax, [ebp - 0x159c]
push eax
call fcn.00401380
add esp, 8
mov dword [ebp - 0x16d8], eax
mov ecx, dword [ebp - 0x15e8]
or ecx, 0x800
mov dword [ebp - 0x15e8], ecx
mov edx, dword [ebp - 0x16d0]
mov eax, dword [edx]
mov dword [ebp - 0x16d4], eax
mov ecx, dword [ebp - 0x16d8]
mov edx, dword [ecx]
mov dword [ebp - 0x16dc], edx
push 4
mov eax, dword [ebp - 0x16d4]
push eax
mov ecx, dword [ebp - 0x16dc]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 7
je 0x429b13
mov dword [ebp - 0x1808], 0
jmp 0x429b1d
mov dword [ebp - 0x1808], 1
mov dl, byte [ebp - 0x1808]
mov byte [ebp - 0x1579], dl
mov eax, dword [ebp - 0x15e8]
and eax, 0x800
je 0x429b4b
and dword [ebp - 0x15e8], 0xfffff7ff
lea ecx, [ebp - 0x159c]
call fcn.004019a0
mov dword [ebp - 4], 0xd
mov ecx, dword [ebp - 0x15e8]
and ecx, 0x400
je 0x429b75
and dword [ebp - 0x15e8], 0xfffffbff
lea ecx, [ebp - 0x1598]
call fcn.004019a0
mov dword [ebp - 4], 0xc
mov edx, dword [ebp - 0x15e8]
and edx, 0x200
je 0x429b9f
and dword [ebp - 0x15e8], 0xfffffdff
lea ecx, [ebp - 0x1594]
call fcn.004019a0
mov dword [ebp - 4], 0xb
mov eax, dword [ebp - 0x15e8]
and eax, 0x100
je 0x429bc8
and dword [ebp - 0x15e8], 0xfffffeff
lea ecx, [ebp - 0x1590]
call fcn.004019a0
mov dword [ebp - 4], 0xa
mov ecx, dword [ebp - 0x15e8]
and ecx, 0x80
je 0x429bf2
and dword [ebp - 0x15e8], 0xffffff7f
lea ecx, [ebp - 0x158c]
call fcn.004019a0
mov dword [ebp - 4], 9
mov edx, dword [ebp - 0x15e8]
and edx, 0x40
je 0x429c16
and dword [ebp - 0x15e8], 0xffffffbf
lea ecx, [ebp - 0x1588]
call fcn.004019a0
mov dword [ebp - 4], 8
mov eax, dword [ebp - 0x15e8]
and eax, 0x20
je 0x429c3a
and dword [ebp - 0x15e8], 0xffffffdf
lea ecx, [ebp - 0x1584]
call fcn.004019a0
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x15e8]
and ecx, 0x10
je 0x429c5e
and dword [ebp - 0x15e8], 0xffffffef
lea ecx, [ebp - 0x1580]
call fcn.004019a0
movzx edx, byte [ebp - 0x1579]
test edx, edx
je 0x42a2c4
mov byte [ebp - 0xc04], 0
push 0x103
push 0
lea eax, [ebp - 0xc03]
push eax
call fcn.0040e9c0
add esp, 0xc
push 0x434708
lea ecx, [ebp - 0x15a0]
push ecx
call fcn.00401380
add esp, 8
mov dword [ebp - 0x180c], eax
mov edx, dword [ebp - 0x180c]
mov dword [ebp - 0x1700], edx
mov dword [ebp - 4], 0xf
push 0x43471c
lea eax, [ebp - 0x15a4]
push eax
call fcn.00401380
add esp, 8
mov dword [ebp - 0x1708], eax
mov ecx, dword [ebp - 0x1700]
mov edx, dword [ecx]
mov dword [ebp - 0x1704], edx
mov eax, dword [ebp - 0x1708]
mov ecx, dword [eax]
mov dword [ebp - 0x170c], ecx
push 0
push 0x434704
push 1
mov edx, dword [ebp - 0x1704]
push edx
mov eax, dword [ebp - 0x170c]
push eax
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov dword [ebp - 0xad4], eax
lea ecx, [ebp - 0x15a4]
call fcn.004019a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x15a0]
call fcn.004019a0
cmp dword [ebp - 0xad4], 0
je 0x429dee
push 0x434740
lea ecx, [ebp - 0x15a8]
push ecx
call fcn.00401380
add esp, 8
mov dword [ebp - 0x1810], eax
mov edx, dword [ebp - 0x1810]
mov dword [ebp - 0x1718], edx
mov dword [ebp - 4], 0x10
push 0x434798
lea eax, [ebp - 0x15ac]
push eax
call fcn.00401380
add esp, 8
mov dword [ebp - 0x1814], eax
mov ecx, dword [ebp - 0x1814]
mov dword [ebp - 0x1720], ecx
mov byte [ebp - 4], 0x11
mov edx, dword [ebp - 0x1718]
mov eax, dword [edx]
mov dword [ebp - 0x171c], eax
mov ecx, dword [ebp - 0x1720]
mov edx, dword [ecx]
mov dword [ebp - 0x1724], edx
mov eax, dword [ebp - 0x171c]
push eax
mov ecx, dword [ebp - 0x1724]
push ecx
call fcn.00427370
add esp, 8
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x15ac]
call fcn.004019a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x15a8]
call fcn.004019a0
call fcn.00426910
push 0x43faa0
lea edx, [ebp - 0xc04]
push edx
call fcn.0040f7d0
add esp, 8
push 0x4347b4
lea eax, [ebp - 0x15b0]
push eax
call fcn.00401380
add esp, 8
mov dword [ebp - 0x1730], eax
mov ecx, dword [ebp - 0x1730]
mov edx, dword [ecx]
mov dword [ebp - 0x1734], edx
mov eax, dword [ebp - 0x1734]
push eax
lea ecx, [ebp - 0xc04]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea ecx, [ebp - 0x15b0]
call fcn.004019a0
call fcn.00428960
lea edx, [ebp - 0xc04]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x42a050
mov byte [ebp - 0x150c], 0
push 0x7ff
push 0
lea eax, [ebp - 0x150b]
push eax
call fcn.0040e9c0
add esp, 0xc
push 0x4347d8
lea ecx, [ebp - 0x15b4]
push ecx
call fcn.00401380
add esp, 8
mov dword [ebp - 0x1818], eax
mov edx, dword [ebp - 0x1818]
mov dword [ebp - 0x181c], edx
mov dword [ebp - 4], 0x12
push 0x4347e8
lea eax, [ebp - 0x15b8]
push eax
call fcn.00401380
add esp, 8
mov dword [ebp - 0x173c], eax
mov ecx, dword [ebp - 0x173c]
mov edx, dword [ecx]
mov dword [ebp - 0x1740], edx
push 0x222fb
mov eax, dword [ebp - 0x181c]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp - 0x1740]
push edx
push 0x43483c
lea eax, [ebp - 0x150c]
push eax
call fcn.0040fa55
add esp, 0x14
lea ecx, [ebp - 0x15b8]
call fcn.004019a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x15b4]
call fcn.004019a0
push 0x43faa0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x429f83
lea ecx, [ebp - 0xc04]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x434844
lea edx, [ebp - 0x15bc]
push edx
call fcn.00401380
add esp, 8
mov dword [ebp - 0x174c], eax
mov eax, dword [ebp - 0x174c]
mov ecx, dword [eax]
mov dword [ebp - 0x1750], ecx
mov edx, dword [ebp - 0x1750]
push edx
lea eax, [ebp - 0xc04]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea ecx, [ebp - 0x15bc]
call fcn.004019a0
lea ecx, [ebp - 0xc04]
push ecx
lea edx, [ebp - 0x150c]
push edx
call fcn.00426150
add esp, 8
test eax, eax
jne 0x42a050
push 0x434868
lea eax, [ebp - 0x15c0]
push eax
call fcn.00401380
add esp, 8
mov dword [ebp - 0x1820], eax
mov ecx, dword [ebp - 0x1820]
mov dword [ebp - 0x1758], ecx
mov dword [ebp - 4], 0x13
push 0x434898
lea edx, [ebp - 0x15c4]
push edx
call fcn.00401380
add esp, 8
mov dword [ebp - 0x1824], eax
mov eax, dword [ebp - 0x1824]
mov dword [ebp - 0x1760], eax
mov byte [ebp - 4], 0x14
mov ecx, dword [ebp - 0x1758]
mov edx, dword [ecx]
mov dword [ebp - 0x175c], edx
mov eax, dword [ebp - 0x1760]
mov ecx, dword [eax]
mov dword [ebp - 0x1764], ecx
mov edx, dword [ebp - 0x175c]
push edx
mov eax, dword [ebp - 0x1764]
push eax
call fcn.00427370
add esp, 8
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x15c4]
call fcn.004019a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x15c0]
call fcn.004019a0
call fcn.00426910
mov byte [ebp - 0xafc], 0
xor ecx, ecx
mov dword [ebp - 0xafb], ecx
mov dword [ebp - 0xaf7], ecx
mov dword [ebp - 0xaf3], ecx
mov dword [ebp - 0xaef], ecx
mov dword [ebp - 0xaeb], ecx
mov dword [ebp - 0xae7], ecx
mov dword [ebp - 0xae3], ecx
mov dword [ebp - 0xadf], ecx
mov byte [ebp - 0xad0], 0
xor edx, edx
mov dword [ebp - 0xacf], edx
mov dword [ebp - 0xacb], edx
mov word [ebp - 0xac7], dx
lea eax, [ebp - 0xad0]
push eax
lea ecx, [ebp - 0xafc]
push ecx
call fcn.00428800
add esp, 8
mov byte [ebp - 0xd0c], 0
push 0x103
push 0
lea edx, [ebp - 0xd0b]
push edx
call fcn.0040e9c0
add esp, 0xc
push 0x4348b4
lea eax, [ebp - 0x15c8]
push eax
call fcn.00401380
add esp, 8
mov dword [ebp - 0x1770], eax
mov ecx, dword [ebp - 0x1770]
mov edx, dword [ecx]
mov dword [ebp - 0x1774], edx
lea eax, [ebp - 0xad0]
push eax
lea ecx, [ebp - 0xafc]
push ecx
mov edx, dword [ebp - 0x1774]
push edx
lea eax, [ebp - 0xd0c]
push eax
call fcn.0040fa55
add esp, 0x10
lea ecx, [ebp - 0x15c8]
call fcn.004019a0
push 0
push 0
lea ecx, [ebp - 0xd0c]
push ecx
lea edx, [ebp - 0xc04]
push edx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [ebp - 0xad8], eax
cmp dword [ebp - 0xad8], 0x20
jg 0x42a212
push 0x4348e8
lea eax, [ebp - 0x15cc]
push eax
call fcn.00401380
add esp, 8
mov dword [ebp - 0x1828], eax
mov ecx, dword [ebp - 0x1828]
mov dword [ebp - 0x177c], ecx
mov dword [ebp - 4], 0x15
push 0x434914
lea edx, [ebp - 0x15d0]
push edx
call fcn.00401380
add esp, 8
mov dword [ebp - 0x182c], eax
mov eax, dword [ebp - 0x182c]
mov dword [ebp - 0x1784], eax
mov byte [ebp - 4], 0x16
mov ecx, dword [ebp - 0x177c]
mov edx, dword [ecx]
mov dword [ebp - 0x1780], edx
mov eax, dword [ebp - 0x1784]
mov ecx, dword [eax]
mov dword [ebp - 0x1788], ecx
mov edx, dword [ebp - 0x1780]
push edx
mov eax, dword [ebp - 0x1788]
push eax
call fcn.00427370
add esp, 8
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x15d0]
call fcn.004019a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x15cc]
call fcn.004019a0
call fcn.00426910
jmp 0x42a2bc
push 0x434930
lea ecx, [ebp - 0x15d4]
push ecx
call fcn.00401380
add esp, 8
mov dword [ebp - 0x1830], eax
mov edx, dword [ebp - 0x1830]
mov dword [ebp - 0x1794], edx
mov dword [ebp - 4], 0x17
push 0x434968
lea eax, [ebp - 0x15d8]
push eax
call fcn.00401380
add esp, 8
mov dword [ebp - 0x1834], eax
mov ecx, dword [ebp - 0x1834]
mov dword [ebp - 0x179c], ecx
mov byte [ebp - 4], 0x18
mov edx, dword [ebp - 0x1794]
mov eax, dword [edx]
mov dword [ebp - 0x1798], eax
mov ecx, dword [ebp - 0x179c]
mov edx, dword [ecx]
mov dword [ebp - 0x17a0], edx
mov eax, dword [ebp - 0x1798]
push eax
mov ecx, dword [ebp - 0x17a0]
push ecx
call fcn.00427370
add esp, 8
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x15d8]
call fcn.004019a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x15d4]
call fcn.004019a0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov byte [ebp - 0xac4], 0
push 0x7ff
push 0
lea edx, [ebp - 0xac3]
push edx
call fcn.0040e9c0
add esp, 0xc
push 0x434984
lea eax, [ebp - 0x15dc]
push eax
call fcn.00401380
add esp, 8
mov dword [ebp - 0x1838], eax
mov ecx, dword [ebp - 0x1838]
mov dword [ebp - 0x183c], ecx
mov dword [ebp - 4], 0x19
push 0x434998
lea edx, [ebp - 0x15e0]
push edx
call fcn.00401380
add esp, 8
mov dword [ebp - 0x17ac], eax
mov eax, dword [ebp - 0x17ac]
mov ecx, dword [eax]
mov dword [ebp - 0x17b0], ecx
push 0x222fb
mov edx, dword [ebp - 0x183c]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 0x17b0]
push ecx
push 0x4349ec
lea edx, [ebp - 0xac4]
push edx
call fcn.0040fa55
add esp, 0x14
lea ecx, [ebp - 0x15e0]
call fcn.004019a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x15dc]
call fcn.004019a0
push 0x43faa0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x42a3df
push 1
lea eax, [ebp - 0x152c]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push 1
lea ecx, [ebp - 0x152c]
push ecx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov dword [ebp - 0x1518], 0xc
lea edx, [ebp - 0x152c]
mov dword [ebp - 0x1514], edx
mov dword [ebp - 0x1510], 0
lea eax, [ebp - 0x1518]
push eax
push 0x43faa0
call dword [0x43f95c]
push 0x43f988
lea ecx, [ebp - 0xac4]
push ecx
call fcn.00426150
add esp, 8
test eax, eax
jne 0x42a3fe
xor eax, eax
jmp 0x42a492
push 0x4349f8
lea edx, [ebp - 0x15e4]
push edx
call fcn.00401380
add esp, 8
mov dword [ebp - 0x17bc], eax
mov eax, dword [ebp - 0x17bc]
mov ecx, dword [eax]
mov dword [ebp - 0x17c0], ecx
mov edx, dword [0x43fed0]
push edx
mov eax, dword [0x43fecc]
push eax
push 0x222fb
mov ecx, dword [ebp - 0x17c0]
push ecx
lea edx, [ebp - 0x11c]
push edx
call fcn.0040fa55
add esp, 0x14
lea ecx, [ebp - 0x15e4]
call fcn.004019a0
push 0
push 0
lea eax, [ebp - 0x11c]
push eax
push 0x43f988
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [0x43fed0]
add ecx, 1
mov dword [0x43fed0], ecx
push 0xea60
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040e83e
mov esp, ebp
pop ebp
ret