Function at 0x407170
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c4
mov eax, dword [0x50738c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x10
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x37c], eax
push 0x11
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x368], eax
call fcn.00406e20
movzx eax, al
test eax, eax
jne 0x4071b3
push 0
call fcn.004ba12a
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
mov ecx, dword [ebp + 8]
push ecx
call fcn.004295c0
add esp, 4
call fcn.00406d90
call fcn.00406ed0
push str.union.lizhi.io
mov ecx, 0x50aae0
call fcn.00405f30
push 0x1fe
push 0
lea edx, [ebp - 0x204]
push edx
call fcn.004b6780
add esp, 0xc
push 0xff
lea eax, [ebp - 0x204]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x204]
push ecx
lea ecx, [ebp - 0x21c]
call fcn.00402200
push 0xffffffffffffffff
push 0x5c
lea ecx, [ebp - 0x21c]
call fcn.00401ff0
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x32c], 0
jl 0x4072c9
lea ecx, [ebp - 0x21c]
call fcn.00402090
sub eax, dword [ebp - 0x32c]
push eax
mov edx, dword [ebp - 0x32c]
add edx, 1
push edx
lea eax, [ebp - 0x394]
push eax
lea ecx, [ebp - 0x21c]
call fcn.00401fa0
push eax
lea ecx, [ebp - 0x21c]
call fcn.00405f50
lea ecx, [ebp - 0x394]
call fcn.004021b0
push 0xffffffffffffffff
push 0x2e
lea ecx, [ebp - 0x21c]
call fcn.00401ff0
mov dword [ebp - 0x32c], eax
mov ecx, dword [ebp - 0x32c]
push ecx
push 0
lea edx, [ebp - 0x3ac]
push edx
lea ecx, [ebp - 0x21c]
call fcn.00401fa0
push eax
mov ecx, 0x50aac8
call fcn.00405f50
lea ecx, [ebp - 0x3ac]
call fcn.004021b0
push 0x4f7b64
push 0x50aac8
push 0x4f7c68
lea eax, [ebp - 0x3c4]
push eax
call fcn.00406300
add esp, 0xc
push eax
lea ecx, [ebp - 0x264]
push ecx
call fcn.004063d0
add esp, 0xc
lea ecx, [ebp - 0x3c4]
call fcn.004021b0
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0x36c], esp
lea ecx, [ebp - 0x264]
call fcn.004020b0
push eax
mov ecx, esi
call fcn.00402200
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0x370], esp
mov ecx, 0x50aae0
call fcn.004020b0
push eax
mov ecx, esi
call fcn.00402200
lea edx, [ebp - 0x234]
push edx
call fcn.004091d0
add esp, 0x34
push 0x74
lea ecx, [ebp - 0x320]
call fcn.00401b60
lea ecx, [ebp - 0x320]
call fcn.00415f10
push 0x18
lea ecx, [ebp - 0x24c]
call fcn.00401b60
push 0
lea ecx, [ebp - 0x24c]
call fcn.00411cc0
lea ecx, [ebp - 0x234]
call fcn.00402060
movzx eax, al
test eax, eax
je 0x4073dd
call fcn.00407090
mov dword [ebp - 0x364], eax
lea ecx, [ebp - 0x24c]
call fcn.00411f10
lea ecx, [ebp - 0x320]
call fcn.00403970
lea ecx, [ebp - 0x234]
call fcn.00402340
lea ecx, [ebp - 0x264]
call fcn.004021b0
lea ecx, [ebp - 0x21c]
call fcn.004021b0
mov eax, dword [ebp - 0x364]
jmp 0x4077db
lea ecx, [ebp - 0x234]
call fcn.00402060
movzx ecx, al
test ecx, ecx
jne 0x4076c0
push 1
lea edx, [ebp - 0x24c]
push edx
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x320]
call fcn.00416090
movzx ecx, al
test ecx, ecx
je 0x4076c0
push 0x4f7ca8
lea ecx, [ebp - 0x24c]
call fcn.00413160
mov ecx, eax
call fcn.00412160
mov dword [ebp - 0x360], eax
cmp dword [ebp - 0x360], 0
je 0x40748c
call fcn.00407090
mov dword [ebp - 0x35c], eax
lea ecx, [ebp - 0x24c]
call fcn.00411f10
lea ecx, [ebp - 0x320]
call fcn.00403970
lea ecx, [ebp - 0x234]
call fcn.00402340
lea ecx, [ebp - 0x264]
call fcn.004021b0
lea ecx, [ebp - 0x21c]
call fcn.004021b0
mov eax, dword [ebp - 0x35c]
jmp 0x4077db
push 0x18
lea ecx, [ebp - 0x27c]
call fcn.00401b60
push 0x4f7cb0
lea ecx, [ebp - 0x24c]
call fcn.00413160
push eax
lea ecx, [ebp - 0x27c]
call fcn.00411ee0
push 0x18
lea ecx, [ebp - 0x294]
call fcn.00401b60
push 0x4f7cb8
lea ecx, [ebp - 0x27c]
call fcn.00413160
push eax
lea ecx, [ebp - 0x294]
call fcn.00411ee0
push str.wizardOpen
lea ecx, [ebp - 0x294]
call fcn.00413160
mov ecx, eax
call fcn.004125a0
mov byte [ebp - 0x325], al
movzx edx, byte [ebp - 0x325]
test edx, edx
je 0x4076aa
push 0x50aac8
push str.SoftwareMicrosoft_
lea eax, [ebp - 0x2ac]
push eax
call fcn.00406300
add esp, 0xc
lea ecx, [ebp - 0x324]
push ecx
push 0xf003f
push 0
lea ecx, [ebp - 0x2ac]
call fcn.004020b0
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x358], eax
cmp dword [ebp - 0x358], 0
jne 0x407569
mov edx, dword [ebp - 0x324]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40769f
push 0x720
call fcn.004b3f75
add esp, 4
mov dword [ebp - 0x334], eax
cmp dword [ebp - 0x334], 0
je 0x4075bf
push 0x720
mov ecx, dword [ebp - 0x334]
call fcn.00401b60
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x374], esp
lea eax, [ebp - 0x234]
push eax
call fcn.00403c30
mov ecx, dword [ebp - 0x334]
call fcn.00404910
mov dword [ebp - 0x340], eax
jmp 0x4075c9
mov dword [ebp - 0x340], 0
mov ecx, dword [ebp - 0x340]
mov dword [ebp - 0x354], ecx
mov edx, dword [ebp - 0x354]
mov dword [ebp - 0x338], edx
push 0
push SysReAllocString
push SysReAllocString
push SysReAllocString
push SysReAllocString
push 0x60000
push 0x100
push 0x4f7ce8
push 0
mov ecx, dword [ebp - 0x338]
call fcn.00431290
mov ecx, dword [ebp - 0x338]
call fcn.00431090
push 1
push 1
mov ecx, dword [ebp - 0x338]
call fcn.00431aa0
call fcn.00426720
mov dword [ebp - 0x350], 0
lea ecx, [ebp - 0x2ac]
call fcn.004021b0
lea ecx, [ebp - 0x294]
call fcn.00411f10
lea ecx, [ebp - 0x27c]
call fcn.00411f10
lea ecx, [ebp - 0x24c]
call fcn.00411f10
lea ecx, [ebp - 0x320]
call fcn.00403970
lea ecx, [ebp - 0x234]
call fcn.00402340
lea ecx, [ebp - 0x264]
call fcn.004021b0
lea ecx, [ebp - 0x21c]
call fcn.004021b0
mov eax, dword [ebp - 0x350]
jmp 0x4077db
lea ecx, [ebp - 0x2ac]
call fcn.004021b0
lea ecx, [ebp - 0x294]
call fcn.00411f10
lea ecx, [ebp - 0x27c]
call fcn.00411f10
push 0xad8
call fcn.004b3f75
add esp, 4
mov dword [ebp - 0x33c], eax
cmp dword [ebp - 0x33c], 0
je 0x4076ff
push 0xad8
mov ecx, dword [ebp - 0x33c]
call fcn.00401b60
mov ecx, dword [ebp - 0x33c]
call fcn.00407be0
mov dword [ebp - 0x344], eax
jmp 0x407709
mov dword [ebp - 0x344], 0
mov eax, dword [ebp - 0x344]
mov dword [ebp - 0x34c], eax
mov ecx, dword [ebp - 0x34c]
mov dword [ebp - 0x330], ecx
push 0
push SysReAllocString
push SysReAllocString
push SysReAllocString
push SysReAllocString
push 0x60000
push 0x100
push str.office
push 0
mov ecx, dword [ebp - 0x330]
call fcn.00431290
mov ecx, dword [ebp - 0x330]
call fcn.00431090
push 1
push 1
mov ecx, dword [ebp - 0x330]
call fcn.00431aa0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x378], esp
lea edx, [ebp - 0x234]
push edx
call fcn.00403c30
mov ecx, dword [ebp - 0x330]
call fcn.00409ce0
call fcn.00426720
mov dword [ebp - 0x348], 0
lea ecx, [ebp - 0x24c]
call fcn.00411f10
lea ecx, [ebp - 0x320]
call fcn.00403970
lea ecx, [ebp - 0x234]
call fcn.00402340
lea ecx, [ebp - 0x264]
call fcn.004021b0
lea ecx, [ebp - 0x21c]
call fcn.004021b0
mov eax, dword [ebp - 0x348]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b3f64
mov esp, ebp
pop ebp
ret 0x10