Function at 0x421330
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f02e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x149c
call fcn.004c71a0
push esi
mov dword [ebp - 0xf8], ecx
mov ecx, 0x52474f
call fcn.004c6bbd
mov eax, dword [ebp - 0xf8]
mov ecx, dword [eax + 4]
add ecx, 4
push ecx
lea ecx, [ebp - 0x10]
call fcn.00406000
mov dword [ebp - 4], 0
mov byte [ebp - 0xc8], 0x53
mov byte [ebp - 0xc7], 0x4f
mov byte [ebp - 0xc6], 0x46
mov byte [ebp - 0xc5], 0x54
mov byte [ebp - 0xc4], 0x57
mov byte [ebp - 0xc3], 0x41
mov byte [ebp - 0xc2], 0x52
mov byte [ebp - 0xc1], 0x45
mov byte [ebp - 0xc0], 0x5c
mov byte [ebp - 0xbf], 0x4d
mov byte [ebp - 0xbe], 0x69
mov byte [ebp - 0xbd], 0x63
mov byte [ebp - 0xbc], 0x72
mov byte [ebp - 0xbb], 0x6f
mov byte [ebp - 0xba], 0x73
mov byte [ebp - 0xb9], 0x6f
mov byte [ebp - 0xb8], 0x66
mov byte [ebp - 0xb7], 0x74
mov byte [ebp - 0xb6], 0x5c
mov byte [ebp - 0xb5], 0x57
mov byte [ebp - 0xb4], 0x69
mov byte [ebp - 0xb3], 0x6e
mov byte [ebp - 0xb2], 0x64
mov byte [ebp - 0xb1], 0x6f
mov byte [ebp - 0xb0], 0x77
mov byte [ebp - 0xaf], 0x73
mov byte [ebp - 0xae], 0x5c
mov byte [ebp - 0xad], 0x43
mov byte [ebp - 0xac], 0x75
mov byte [ebp - 0xab], 0x72
mov byte [ebp - 0xaa], 0x72
mov byte [ebp - 0xa9], 0x65
mov byte [ebp - 0xa8], 0x6e
mov byte [ebp - 0xa7], 0x74
mov byte [ebp - 0xa6], 0x56
mov byte [ebp - 0xa5], 0x65
mov byte [ebp - 0xa4], 0x72
mov byte [ebp - 0xa3], 0x73
mov byte [ebp - 0xa2], 0x69
mov byte [ebp - 0xa1], 0x6f
mov byte [ebp - 0xa0], 0x6e
mov byte [ebp - 0x9f], 0x5c
mov byte [ebp - 0x9e], 0x55
mov byte [ebp - 0x9d], 0x6e
mov byte [ebp - 0x9c], 0x69
mov byte [ebp - 0x9b], 0x6e
mov byte [ebp - 0x9a], 0x73
mov byte [ebp - 0x99], 0x74
mov byte [ebp - 0x98], 0x61
mov byte [ebp - 0x97], 0x6c
mov byte [ebp - 0x96], 0x6c
mov byte [ebp - 0x95], 0x5c
mov byte [ebp - 0x94], 0
lea ecx, [ebp - 0xd1]
call fcn.004063b0
push eax
lea edx, [ebp - 0x93]
push edx
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0x610]
call fcn.00406b20
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea ecx, [ebp - 0x500]
call fcn.00406c60
mov dword [ebp - 0x45c], eax
mov eax, dword [ebp - 0x45c]
mov dword [ebp - 0x460], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x460]
call fcn.00415e30
push eax
lea ecx, [ebp - 0x120]
call fcn.004064f0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x500]
call fcn.00407900
mov byte [ebp - 0x70], 0x47
mov byte [ebp - 0x6f], 0x65
mov byte [ebp - 0x6e], 0x6d
mov byte [ebp - 0x6d], 0x69
mov byte [ebp - 0x6c], 0x6e
mov byte [ebp - 0x6b], 0x69
mov byte [ebp - 0x6a], 0x42
mov byte [ebp - 0x69], 0x72
mov byte [ebp - 0x68], 0x6f
mov byte [ebp - 0x67], 0x77
mov byte [ebp - 0x66], 0x73
mov byte [ebp - 0x65], 0x65
mov byte [ebp - 0x64], 0x72
mov byte [ebp - 0x63], 0
push ecx
mov esi, esp
mov dword [ebp - 0x4bc], esp
lea ecx, [ebp - 0xd3]
call fcn.004063b0
push eax
lea ecx, [ebp - 0x62]
push ecx
lea edx, [ebp - 0x70]
push edx
lea ecx, [ebp - 0x618]
call fcn.00406b20
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea ecx, [ebp - 0x4dc]
call fcn.00406c60
mov dword [ebp - 0x464], eax
mov eax, dword [ebp - 0x464]
mov dword [ebp - 0x468], eax
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x468]
call fcn.00415e30
push eax
mov ecx, esi
call fcn.00406060
mov dword [ebp - 0x4d0], eax
mov byte [ebp - 4], 5
push ecx
mov esi, esp
mov dword [ebp - 0x4c0], esp
lea ecx, [ebp - 0x120]
call fcn.00415bb0
push eax
mov ecx, esi
call fcn.00406060
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebp - 4], 4
call fcn.0040dbf0
add esp, 0xc
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x4dc]
call fcn.00407900
mov byte [ebp - 0x80], 0x47
mov byte [ebp - 0x7f], 0x65
mov byte [ebp - 0x7e], 0x6d
mov byte [ebp - 0x7d], 0x69
mov byte [ebp - 0x7c], 0x6e
mov byte [ebp - 0x7b], 0x69
mov byte [ebp - 0x7a], 0x42
mov byte [ebp - 0x79], 0x72
mov byte [ebp - 0x78], 0x6f
mov byte [ebp - 0x77], 0x77
mov byte [ebp - 0x76], 0x73
mov byte [ebp - 0x75], 0x65
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0
push ecx
mov esi, esp
mov dword [ebp - 0x4cc], esp
lea ecx, [ebp - 0xd4]
call fcn.004063b0
push eax
lea ecx, [ebp - 0x72]
push ecx
lea edx, [ebp - 0x80]
push edx
lea ecx, [ebp - 0x620]
call fcn.00406b20
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea ecx, [ebp - 0x50c]
call fcn.00406c60
mov dword [ebp - 0x46c], eax
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0x470], eax
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x470]
call fcn.00415e30
push eax
mov ecx, esi
call fcn.00406060
mov dword [ebp - 0x4c8], eax
mov byte [ebp - 4], 7
push ecx
mov esi, esp
mov dword [ebp - 0x4c4], esp
lea ecx, [ebp - 0x120]
call fcn.00415bb0
push eax
mov ecx, esi
call fcn.00406060
push SysReAllocString
mov byte [ebp - 4], 6
call fcn.0040dbf0
add esp, 0xc
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x50c]
call fcn.00407900
push 0x400
push 0
lea ecx, [ebp - 0xca8]
push ecx
call fcn.004cb140
add esp, 0xc
push 0x400
push 0
lea edx, [ebp - 0x10a8]
push edx
call fcn.004cb140
add esp, 0xc
push 0x400
push 0
lea eax, [ebp - 0x14a8]
push eax
call fcn.004cb140
add esp, 0xc
push 0x4f7b78
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x30]
push edx
call fcn.00408630
add esp, 0xc
mov byte [ebp - 4], 8
mov eax, 0x47
mov word [ebp - 0x2bc], ax
mov ecx, 0x65
mov word [ebp - 0x2ba], cx
mov edx, 0x6d
mov word [ebp - 0x2b8], dx
mov eax, 0x69
mov word [ebp - 0x2b6], ax
mov ecx, 0x6e
mov word [ebp - 0x2b4], cx
mov edx, 0x69
mov word [ebp - 0x2b2], dx
mov eax, 0x42
mov word [ebp - 0x2b0], ax
mov ecx, 0x72
mov word [ebp - 0x2ae], cx
mov edx, 0x6f
mov word [ebp - 0x2ac], dx
mov eax, 0x77
mov word [ebp - 0x2aa], ax
mov ecx, 0x73
mov word [ebp - 0x2a8], cx
mov edx, 0x65
mov word [ebp - 0x2a6], dx
mov eax, 0x72
mov word [ebp - 0x2a4], ax
mov ecx, 0x2e
mov word [ebp - 0x2a2], cx
mov edx, 0x65
mov word [ebp - 0x2a0], dx
mov eax, 0x78
mov word [ebp - 0x29e], ax
mov ecx, 0x65
mov word [ebp - 0x29c], cx
xor edx, edx
mov word [ebp - 0x29a], dx
lea ecx, [ebp - 0xd5]
call fcn.004063b0
push eax
lea eax, [ebp - 0x298]
push eax
lea ecx, [ebp - 0x2bc]
push ecx
lea ecx, [ebp - 0x628]
call fcn.00406b20
mov edx, dword [eax + 4]
push edx
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x518]
call fcn.00406d10
mov dword [ebp - 0x474], eax
mov ecx, dword [ebp - 0x474]
mov dword [ebp - 0x478], ecx
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x478]
call fcn.00415e30
push eax
lea edx, [ebp - 0x30]
push edx
lea eax, [ebp - 0x38]
push eax
call fcn.00408630
add esp, 0xc
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x518]
call fcn.00407960
mov ecx, 0x75
mov word [ebp - 0x1c8], cx
mov edx, 0x6e
mov word [ebp - 0x1c6], dx
mov eax, 0x69
mov word [ebp - 0x1c4], ax
mov ecx, 0x6e
mov word [ebp - 0x1c2], cx
mov edx, 0x73
mov word [ebp - 0x1c0], dx
mov eax, 0x74
mov word [ebp - 0x1be], ax
mov ecx, 0x61
mov word [ebp - 0x1bc], cx
mov edx, 0x6c
mov word [ebp - 0x1ba], dx
mov eax, 0x6c
mov word [ebp - 0x1b8], ax
mov ecx, 0x2e
mov word [ebp - 0x1b6], cx
mov edx, 0x65
mov word [ebp - 0x1b4], dx
mov eax, 0x78
mov word [ebp - 0x1b2], ax
mov ecx, 0x65
mov word [ebp - 0x1b0], cx
xor edx, edx
mov word [ebp - 0x1ae], dx
lea ecx, [ebp - 0xd2]
call fcn.004063b0
push eax
lea eax, [ebp - 0x1ac]
push eax
lea ecx, [ebp - 0x1c8]
push ecx
lea ecx, [ebp - 0x630]
call fcn.00406b20
mov edx, dword [eax + 4]
push edx
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x524]
call fcn.00406d10
mov dword [ebp - 0x47c], eax
mov ecx, dword [ebp - 0x47c]
mov dword [ebp - 0x480], ecx
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x480]
call fcn.00415e30
push eax
lea edx, [ebp - 0x30]
push edx
lea eax, [ebp - 0x34]
push eax
call fcn.00408630
add esp, 0xc
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x524]
call fcn.00407960
lea ecx, [ebp - 0x38]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.00406000
mov byte [ebp - 4], 0xf
mov edx, 0x5c
mov word [ebp - 0x2f0], dx
mov eax, 0x56
mov word [ebp - 0x2ee], ax
mov ecx, 0x69
mov word [ebp - 0x2ec], cx
mov edx, 0x73
mov word [ebp - 0x2ea], dx
mov eax, 0x75
mov word [ebp - 0x2e8], ax
mov ecx, 0x61
mov word [ebp - 0x2e6], cx
mov edx, 0x6c
mov word [ebp - 0x2e4], dx
mov eax, 0x45
mov word [ebp - 0x2e2], ax
mov ecx, 0x6c
mov word [ebp - 0x2e0], cx
mov edx, 0x65
mov word [ebp - 0x2de], dx
mov eax, 0x6d
mov word [ebp - 0x2dc], ax
mov ecx, 0x65
mov word [ebp - 0x2da], cx
mov edx, 0x6e
mov word [ebp - 0x2d8], dx
mov eax, 0x74
mov word [ebp - 0x2d6], ax
mov ecx, 0x73
mov word [ebp - 0x2d4], cx
mov edx, 0x5c
mov word [ebp - 0x2d2], dx
mov eax, 0x6c
mov word [ebp - 0x2d0], ax
mov ecx, 0x6f
mov word [ebp - 0x2ce], cx
mov edx, 0x67
mov word [ebp - 0x2cc], dx
mov eax, 0x6f
mov word [ebp - 0x2ca], ax
mov ecx, 0x2e
mov word [ebp - 0x2c8], cx
mov edx, 0x69
mov word [ebp - 0x2c6], dx
mov eax, 0x63
mov word [ebp - 0x2c4], ax
mov ecx, 0x6f
mov word [ebp - 0x2c2], cx
xor edx, edx
mov word [ebp - 0x2c0], dx
lea ecx, [ebp - 0xd6]
call fcn.004063b0
push eax
lea eax, [ebp - 0x2be]
push eax
lea ecx, [ebp - 0x2f0]
push ecx
lea ecx, [ebp - 0x638]
call fcn.00406b20
mov edx, dword [eax + 4]
push edx
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x4e8]
call fcn.00406d10
mov dword [ebp - 0x484], eax
mov ecx, dword [ebp - 0x484]
mov dword [ebp - 0x488], ecx
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0x488]
call fcn.00415e30
push eax
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x28]
push eax
call fcn.00408630
add esp, 0xc
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x4e8]
call fcn.00407960
lea ecx, [ebp - 0x28]
call fcn.004084d0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x421bbc
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.00407eb0
lea ecx, [ebp - 0x2c]
call fcn.004084d0
push eax
push 0x4f7b7c
lea edx, [ebp - 0xca8]
push edx
call fcn.00423cd0
add esp, 0xc
lea ecx, [ebp - 0x10]
call fcn.004084d0
push eax
push 0x4f7b84
lea eax, [ebp - 0x10a8]
push eax
call fcn.00423cd0
add esp, 0xc
mov ecx, 0x22
mov word [ebp - 0x294], cx
mov edx, 0x25
mov word [ebp - 0x292], dx
mov eax, 0x73
mov word [ebp - 0x290], ax
mov ecx, 0x22
mov word [ebp - 0x28e], cx
mov edx, 0x20
mov word [ebp - 0x28c], dx
mov eax, 0x2d
mov word [ebp - 0x28a], ax
mov ecx, 0x2d
mov word [ebp - 0x288], cx
mov edx, 0x75
mov word [ebp - 0x286], dx
mov eax, 0x6e
mov word [ebp - 0x284], ax
mov ecx, 0x69
mov word [ebp - 0x282], cx
mov edx, 0x6e
mov word [ebp - 0x280], dx
mov eax, 0x73
mov word [ebp - 0x27e], ax
mov ecx, 0x74
mov word [ebp - 0x27c], cx
mov edx, 0x61
mov word [ebp - 0x27a], dx
mov eax, 0x6c
mov word [ebp - 0x278], ax
mov ecx, 0x6c
mov word [ebp - 0x276], cx
xor edx, edx
mov word [ebp - 0x274], dx
lea ecx, [ebp - 0x34]
call fcn.004084d0
push eax
lea ecx, [ebp - 0xd7]
call fcn.004063b0
push eax
lea eax, [ebp - 0x272]
push eax
lea ecx, [ebp - 0x294]
push ecx
lea ecx, [ebp - 0x640]
call fcn.00406b20
mov edx, dword [eax + 4]
push edx
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x530]
call fcn.00406d10
mov dword [ebp - 0x48c], eax
mov ecx, dword [ebp - 0x48c]
call fcn.00415e30
push eax
lea ecx, [ebp - 0x14a8]
push ecx
call fcn.00423cd0
add esp, 0xc
lea ecx, [ebp - 0x530]
call fcn.00407960
mov edx, 0x53
mov word [ebp - 0x41c], dx
mov eax, 0x4f
mov word [ebp - 0x41a], ax
mov ecx, 0x46
mov word [ebp - 0x418], cx
mov edx, 0x54
mov word [ebp - 0x416], dx
mov eax, 0x57
mov word [ebp - 0x414], ax
mov ecx, 0x41
mov word [ebp - 0x412], cx
mov edx, 0x52
mov word [ebp - 0x410], dx
mov eax, 0x45
mov word [ebp - 0x40e], ax
mov ecx, 0x5c
mov word [ebp - 0x40c], cx
mov edx, 0x4d
mov word [ebp - 0x40a], dx
mov eax, 0x69
mov word [ebp - 0x408], ax
mov ecx, 0x63
mov word [ebp - 0x406], cx
mov edx, 0x72
mov word [ebp - 0x404], dx
mov eax, 0x6f
mov word [ebp - 0x402], ax
mov ecx, 0x73
mov word [ebp - 0x400], cx
mov edx, 0x6f
mov word [ebp - 0x3fe], dx
mov eax, 0x66
mov word [ebp - 0x3fc], ax
mov ecx, 0x74
mov word [ebp - 0x3fa], cx
mov edx, 0x5c
mov word [ebp - 0x3f8], dx
mov eax, 0x57
mov word [ebp - 0x3f6], ax
mov ecx, 0x69
mov word [ebp - 0x3f4], cx
mov edx, 0x6e
mov word [ebp - 0x3f2], dx
mov eax, 0x64
mov word [ebp - 0x3f0], ax
mov ecx, 0x6f
mov word [ebp - 0x3ee], cx
mov edx, 0x77
mov word [ebp - 0x3ec], dx
mov eax, 0x73
mov word [ebp - 0x3ea], ax
mov ecx, 0x5c
mov word [ebp - 0x3e8], cx
mov edx, 0x43
mov word [ebp - 0x3e6], dx
mov eax, 0x75
mov word [ebp - 0x3e4], ax
mov ecx, 0x72
mov word [ebp - 0x3e2], cx
mov edx, 0x72
mov word [ebp - 0x3e0], dx
mov eax, 0x65
mov word [ebp - 0x3de], ax
mov ecx, 0x6e
mov word [ebp - 0x3dc], cx
mov edx, 0x74
mov word [ebp - 0x3da], dx
mov eax, 0x56
mov word [ebp - 0x3d8], ax
mov ecx, 0x65
mov word [ebp - 0x3d6], cx
mov edx, 0x72
mov word [ebp - 0x3d4], dx
mov eax, 0x73
mov word [ebp - 0x3d2], ax
mov ecx, 0x69
mov word [ebp - 0x3d0], cx
mov edx, 0x6f
mov word [ebp - 0x3ce], dx
mov eax, 0x6e
mov word [ebp - 0x3cc], ax
mov ecx, 0x5c
mov word [ebp - 0x3ca], cx
mov edx, 0x55
mov word [ebp - 0x3c8], dx
mov eax, 0x6e
mov word [ebp - 0x3c6], ax
mov ecx, 0x69
mov word [ebp - 0x3c4], cx
mov edx, 0x6e
mov word [ebp - 0x3c2], dx
mov eax, 0x73
mov word [ebp - 0x3c0], ax
mov ecx, 0x74
mov word [ebp - 0x3be], cx
mov edx, 0x61
mov word [ebp - 0x3bc], dx
mov eax, 0x6c
mov word [ebp - 0x3ba], ax
mov ecx, 0x6c
mov word [ebp - 0x3b8], cx
mov edx, 0x5c
mov word [ebp - 0x3b6], dx
xor eax, eax
mov word [ebp - 0x3b4], ax
lea ecx, [ebp - 0xd8]
call fcn.004063b0
push eax
lea ecx, [ebp - 0x3b2]
push ecx
lea edx, [ebp - 0x41c]
push edx
lea ecx, [ebp - 0x648]
call fcn.00406b20
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea ecx, [ebp - 0x53c]
call fcn.00406d10
mov dword [ebp - 0x490], eax
mov eax, dword [ebp - 0x490]
mov dword [ebp - 0x494], eax
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x494]
call fcn.00415e30
push eax
lea ecx, [ebp - 0x24]
call fcn.00406160
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x53c]
call fcn.00407960
mov byte [ebp - 0x90], 0x47
mov byte [ebp - 0x8f], 0x65
mov byte [ebp - 0x8e], 0x6d
mov byte [ebp - 0x8d], 0x69
mov byte [ebp - 0x8c], 0x6e
mov byte [ebp - 0x8b], 0x69
mov byte [ebp - 0x8a], 0x42
mov byte [ebp - 0x89], 0x72
mov byte [ebp - 0x88], 0x6f
mov byte [ebp - 0x87], 0x77
mov byte [ebp - 0x86], 0x73
mov byte [ebp - 0x85], 0x65
mov byte [ebp - 0x84], 0x72
mov byte [ebp - 0x83], 0
lea ecx, [ebp - 0xd9]
call fcn.004063b0
push eax
lea ecx, [ebp - 0x82]
push ecx
lea edx, [ebp - 0x90]
push edx
lea ecx, [ebp - 0x650]
call fcn.00406b20
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea ecx, [ebp - 0x5d8]
call fcn.00406c60
mov dword [ebp - 0x498], eax
mov eax, dword [ebp - 0x498]
mov dword [ebp - 0x49c], eax
mov byte [ebp - 4], 0x16
mov ecx, dword [ebp - 0x49c]
call fcn.00415e30
push eax
lea ecx, [ebp - 0x24]
call fcn.004089f0
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x5d8]
call fcn.00407900
push 0x208
push 0
lea ecx, [ebp - 0x8a8]
push ecx
call fcn.004cb140
add esp, 0xc
push 0x104
lea edx, [ebp - 0x8a8]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x8a8]
push eax
lea ecx, [ebp - 0x14]
call fcn.00406160
mov byte [ebp - 4], 0x17
push 0x5c
lea ecx, [ebp - 0x14]
call fcn.0040ca80
mov dword [ebp - 0x4a0], eax
lea ecx, [ebp - 0x14]
call fcn.0040aee0
sub eax, dword [ebp - 0x4a0]
sub eax, 1
push eax
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x14]
call fcn.0040cae0
mov byte [ebp - 4], 0x18
mov dword [ebp - 0xfc], VariantClear
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x422173
mov dword [ebp - 0xfc], reloc.OLEAUT32.dll_SysReAllocString
lea edx, [ebp - 0x6a0]
push edx
mov ecx, dword [ebp - 0xf8]
call fcn.0041d080
mov dword [ebp - 0x4a4], eax
mov eax, dword [ebp - 0x4a4]
mov dword [ebp - 0x4a8], eax
mov byte [ebp - 4], 0x19
mov ecx, dword [ebp - 0x4a8]
call fcn.00415bb0
push eax
lea ecx, [ebp - 0x20]
call fcn.00406060
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x6a0]
call fcn.00402610
mov byte [ebp - 0x60], 0x31
mov byte [ebp - 0x5f], 0x32
mov byte [ebp - 0x5e], 0x38
mov byte [ebp - 0x5d], 0x2e
mov byte [ebp - 0x5c], 0x31
mov byte [ebp - 0x5b], 0x2e
mov byte [ebp - 0x5a], 0x36
mov byte [ebp - 0x59], 0x35
mov byte [ebp - 0x58], 0x34
mov byte [ebp - 0x57], 0x31
mov byte [ebp - 0x56], 0x2e
mov byte [ebp - 0x55], 0x39
mov byte [ebp - 0x54], 0
lea ecx, [ebp - 0xda]
call fcn.004063b0
push eax
lea ecx, [ebp - 0x53]
push ecx
lea edx, [ebp - 0x60]
push edx
lea ecx, [ebp - 0x658]
call fcn.00406b20
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea ecx, [ebp - 0x548]
call fcn.00406c60
mov dword [ebp - 0x4ac], eax
mov eax, dword [ebp - 0x4ac]
mov dword [ebp - 0x4b0], eax
mov byte [ebp - 4], 0x1c
mov ecx, dword [ebp - 0x4b0]
call fcn.00415e30
push eax
lea ecx, [ebp - 0x1c]
call fcn.00406060
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x548]
call fcn.00407900
lea ecx, [ebp - 0x4b8]
push ecx
lea edx, [ebp - 0x3c]
push edx
push 0
push 0x20106
push 0
push 0
push 0
lea ecx, [ebp - 0x24]
call fcn.004084d0
push eax
mov eax, dword [ebp - 0xfc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x42398d
mov ecx, 0x44
mov word [ebp - 0x154], cx
mov edx, 0x69
mov word [ebp - 0x152], dx
mov eax, 0x73
mov word [ebp - 0x150], ax
mov ecx, 0x70
mov word [ebp - 0x14e], cx
mov edx, 0x6c
mov word [ebp - 0x14c], dx
mov eax, 0x61
mov word [ebp - 0x14a], ax
mov ecx, 0x79
mov word [ebp - 0x148], cx
mov edx, 0x49
mov word [ebp - 0x146], dx
mov eax, 0x63
mov word [ebp - 0x144], ax
mov ecx, 0x6f
mov word [ebp - 0x142], cx
mov edx, 0x6e
mov word [ebp - 0x140], dx
xor eax, eax
mov word [ebp - 0x13e], ax
lea ecx, [ebp - 0xca8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edx, [eax + eax + 2]
push edx
lea eax, [ebp - 0xca8]
push eax
push 1
push 0
lea ecx, [ebp - 0xdb]
call fcn.004063b0
push eax
lea ecx, [ebp - 0x13c]
push ecx
lea edx, [ebp - 0x154]
push edx
lea ecx, [ebp - 0x660]
call fcn.00406b20
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea ecx, [ebp - 0x554]
call fcn.00406d10
mov dword [ebp - 0x4b4], eax
mov ecx, dword [ebp - 0x4b4]
call fcn.00415e30
push eax
mov eax, dword [ebp - 0x3c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x42239f
mov dword [ebp - 0x100], 1
jmp 0x4223a9
mov dword [ebp - 0x100], 0
mov cl, byte [ebp - 0x100]
mov byte [ebp - 0x43], cl
lea ecx, [ebp - 0x554]
call fcn.00407960
movzx edx, byte [ebp - 0x43]
test edx, edx
je 0x42246b
mov byte [ebp - 0x44], 0
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x1c]
call fcn.00407640
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x20]
call fcn.00407640
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x18]
call fcn.00407640
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x14]
call fcn.00407640
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x24]
call fcn.00407640
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x28]
call fcn.00407640
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x2c]
call fcn.00407640
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x34]
call fcn.00407640
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x38]
call fcn.00407640
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x30]
call fcn.00407640
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x120]
call fcn.00402610
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00407640
mov al, byte [ebp - 0x44]
jmp 0x423ac5
mov eax, 0x47
mov word [ebp - 0x1e8], ax
mov ecx, 0x65
mov word [ebp - 0x1e6], cx
mov edx, 0x6d
mov word [ebp - 0x1e4], dx
mov eax, 0x69
mov word [ebp - 0x1e2], ax
mov ecx, 0x6e
mov word [ebp - 0x1e0], cx
mov edx, 0x69
mov word [ebp - 0x1de], dx
mov eax, 0x20
mov word [ebp - 0x1dc], ax
mov ecx, 0x43
mov word [ebp - 0x1da], cx
mov edx, 0x68
mov word [ebp - 0x1d8], dx
mov eax, 0x72
mov word [ebp - 0x1d6], ax
mov ecx, 0x6f
mov word [ebp - 0x1d4], cx
mov edx, 0x6d
mov word [ebp - 0x1d2], dx
mov eax, 0x65
mov word [ebp - 0x1d0], ax
xor ecx, ecx
mov word [ebp - 0x1ce], cx
mov edx, 0x47
mov word [ebp - 0x208], dx
mov eax, 0x65
mov word [ebp - 0x206], ax
mov ecx, 0x6d
mov word [ebp - 0x204], cx
mov edx, 0x69
mov word [ebp - 0x202], dx
mov eax, 0x6e
mov word [ebp - 0x200], ax
mov ecx, 0x69
mov word [ebp - 0x1fe], cx
mov edx, 0x20
mov word [ebp - 0x1fc], dx
mov eax, 0x43
mov word [ebp - 0x1fa], ax
mov ecx, 0x68
mov word [ebp - 0x1f8], cx
mov edx, 0x72
mov word [ebp - 0x1f6], dx
mov eax, 0x6f
mov word [ebp - 0x1f4], ax
mov ecx, 0x6d
mov word [ebp - 0x1f2], cx
mov edx, 0x65
mov word [ebp - 0x1f0], dx
xor eax, eax
mov word [ebp - 0x1ee], ax
mov ecx, 0x44
mov word [ebp - 0x170], cx
mov edx, 0x69
mov word [ebp - 0x16e], dx
mov eax, 0x73
mov word [ebp - 0x16c], ax
mov ecx, 0x70
mov word [ebp - 0x16a], cx
mov edx, 0x6c
mov word [ebp - 0x168], dx
mov eax, 0x61
mov word [ebp - 0x166], ax
mov ecx, 0x79
mov word [ebp - 0x164], cx
mov edx, 0x4e
mov word [ebp - 0x162], dx
mov eax, 0x61
mov word [ebp - 0x160], ax
mov ecx, 0x6d
mov word [ebp - 0x15e], cx
mov edx, 0x65
mov word [ebp - 0x15c], dx
xor eax, eax
mov word [ebp - 0x15a], ax
lea ecx, [ebp - 0xdc]
call fcn.004063b0
push eax
lea ecx, [ebp - 0x1cc]
push ecx
lea edx, [ebp - 0x1e8]
push edx
lea ecx, [ebp - 0x668]
call fcn.00406b20
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea ecx, [ebp - 0x578]
call fcn.00406d10
mov dword [ebp - 0x420], eax
mov eax, dword [ebp - 0x420]
mov dword [ebp - 0x424], eax
mov byte [ebp - 4], 0x1f
mov ecx, dword [ebp - 0x424]
call fcn.00415e30
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [eax + eax + 2]
push ecx
lea ecx, [ebp - 0xdd]
call fcn.004063b0
push eax
lea edx, [ebp - 0x1ec]
push edx
lea eax, [ebp - 0x208]
push eax
lea ecx, [ebp - 0x670]
call fcn.00406b20
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea ecx, [ebp - 0x56c]
call fcn.00406d10
mov dword [ebp - 0x428], eax
mov eax, dword [ebp - 0x428]
mov dword [ebp - 0x42c], eax
mov byte [ebp - 4], 0x20
mov ecx, dword [ebp - 0x42c]
call fcn.00415e30
push eax
push 1
push 0
lea ecx, [ebp - 0xde]
call fcn.004063b0
push eax
lea ecx, [ebp - 0x158]
push ecx
lea edx, [ebp - 0x170]
push edx
lea ecx, [ebp - 0x678]
call fcn.00406b20
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea ecx, [ebp - 0x560]
call fcn.00406d10
mov dword [ebp - 0x430], eax
mov ecx, dword [ebp - 0x430]
call fcn.00415e30
push eax
mov eax, dword [ebp - 0x3c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x422766
mov dword [ebp - 0x104], 1
jmp 0x422770
mov dword [ebp - 0x104], 0
mov cl, byte [ebp - 0x104]
mov byte [ebp - 0x45], cl
lea ecx, [ebp - 0x560]
call fcn.00407960
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x56c]
call fcn.00407960
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x578]
call fcn.00407960
movzx edx, byte [ebp - 0x45]
test edx, edx
je 0x422850
mov byte [ebp - 0x46], 0
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x1c]
call fcn.00407640
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x20]
call fcn.00407640
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x18]
call fcn.00407640
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x14]
call fcn.00407640
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x24]
call fcn.00407640
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x28]
call fcn.00407640
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x2c]
call fcn.00407640
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x34]
call fcn.00407640
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x38]
call fcn.00407640
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x30]
call fcn.00407640
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x120]
call fcn.00402610
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00407640
mov al, byte [ebp - 0x46]
jmp 0x423ac5
mov eax, 0x49
mov word [ebp - 0x24c], ax
mov ecx, 0x6e
mov word [ebp - 0x24a], cx
mov edx, 0x73
mov word [ebp - 0x248], dx
mov eax, 0x74
mov word [ebp - 0x246], ax
mov ecx, 0x61
mov word [ebp - 0x244], cx
mov edx, 0x6c
mov word [ebp - 0x242], dx
mov eax, 0x6c
mov word [ebp - 0x240], ax
mov ecx, 0x4c
mov word [ebp - 0x23e], cx
mov edx, 0x6f
mov word [ebp - 0x23c], dx
mov eax, 0x63
mov word [ebp - 0x23a], ax
mov ecx, 0x61
mov word [ebp - 0x238], cx
mov edx, 0x74
mov word [ebp - 0x236], dx
mov eax, 0x69
mov word [ebp - 0x234], ax
mov ecx, 0x6f
mov word [ebp - 0x232], cx
mov edx, 0x6e
mov word [ebp - 0x230], dx
xor eax, eax
mov word [ebp - 0x22e], ax
lea ecx, [ebp - 0x10a8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edx, [eax + eax + 2]
push edx
lea eax, [ebp - 0x10a8]
push eax
push 1
push 0
lea ecx, [ebp - 0xd0]
call fcn.004063b0
push eax
lea ecx, [ebp - 0x22c]
push ecx
lea edx, [ebp - 0x24c]
push edx
lea ecx, [ebp - 0x680]
call fcn.00406b20
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea ecx, [ebp - 0x584]
call fcn.00406d10
mov dword [ebp - 0x434], eax
mov ecx, dword [ebp - 0x434]
call fcn.00415e30
push eax
mov eax, dword [ebp - 0x3c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x42298d
mov dword [ebp - 0x108], 1
jmp 0x422997
mov dword [ebp - 0x108], 0
mov cl, byte [ebp - 0x108]
mov byte [ebp - 0x47], cl
lea ecx, [ebp - 0x584]
call fcn.00407960
movzx edx, byte [ebp - 0x47]
test edx, edx
je 0x422a59
mov byte [ebp - 0x48], 0
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x1c]
call fcn.00407640
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x20]
call fcn.00407640
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x18]
call fcn.00407640
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x14]
call fcn.00407640
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x24]
call fcn.00407640
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x28]
call fcn.00407640
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x2c]
call fcn.00407640
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x34]
call fcn.00407640
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x38]
call fcn.00407640
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x30]
call fcn.00407640
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x120]
call fcn.00402610
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00407640
mov al, byte [ebp - 0x48]
jmp 0x423ac5
mov eax, 0x43
mov word [ebp - 0x350], ax
mov ecx, 0x68
mov word [ebp - 0x34e], cx
mov edx, 0x65
mov word [ebp - 0x34c], dx
mov eax, 0x6e
mov word [ebp - 0x34a], ax
mov ecx, 0x67
mov word [ebp - 0x348], cx
mov edx, 0x64
mov word [ebp - 0x346], dx
mov eax, 0x75
mov word [ebp - 0x344], ax
mov ecx, 0x20
mov word [ebp - 0x342], cx
mov edx, 0x44
mov word [ebp - 0x340], dx
mov eax, 0x75
mov word [ebp - 0x33e], ax
mov ecx, 0x6f
mov word [ebp - 0x33c], cx
mov edx, 0x6a
mov word [ebp - 0x33a], dx
mov eax, 0x69
mov word [ebp - 0x338], ax
mov ecx, 0x61
mov word [ebp - 0x336], cx
mov edx, 0x79
mov word [ebp - 0x334], dx
mov eax, 0x75
mov word [ebp - 0x332], ax
mov ecx, 0x20
mov word [ebp - 0x330], cx
mov edx, 0x4e
mov word [ebp - 0x32e], dx
mov eax, 0x65
mov word [ebp - 0x32c], ax
mov ecx, 0x74
mov word [ebp - 0x32a], cx
mov edx, 0x77
mov word [ebp - 0x328], dx
mov eax, 0x6f
mov word [ebp - 0x326], ax
mov ecx, 0x72
mov word [ebp - 0x324], cx
mov edx, 0x6b
mov word [ebp - 0x322], dx
mov eax, 0x20
mov word [ebp - 0x320], ax
mov ecx, 0x54
mov word [ebp - 0x31e], cx
mov edx, 0x65
mov word [ebp - 0x31c], dx
mov eax, 0x63
mov word [ebp - 0x31a], ax
mov ecx, 0x68
mov word [ebp - 0x318], cx
mov edx, 0x6e
mov word [ebp - 0x316], dx
mov eax, 0x6f
mov word [ebp - 0x314], ax
mov ecx, 0x6c
mov word [ebp - 0x312], cx
mov edx, 0x6f
mov word [ebp - 0x310], dx
mov eax, 0x67
mov word [ebp - 0x30e], ax
mov ecx, 0x79
mov word [ebp - 0x30c], cx
mov edx, 0x20
mov word [ebp - 0x30a], dx
mov eax, 0x43
mov word [ebp - 0x308], ax
mov ecx, 0x6f
mov word [ebp - 0x306], cx
mov edx, 0x2e
mov word [ebp - 0x304], dx
mov eax, 0x2c
mov word [ebp - 0x302], ax
mov ecx, 0x20
mov word [ebp - 0x300], cx
mov edx, 0x4c
mov word [ebp - 0x2fe], dx
mov eax, 0x74
mov word [ebp - 0x2fc], ax
mov ecx, 0x64
mov word [ebp - 0x2fa], cx
mov edx, 0x2e
mov word [ebp - 0x2f8], dx
xor eax, eax
mov word [ebp - 0x2f6], ax
mov ecx, 0x43
mov word [ebp - 0x3b0], cx
mov edx, 0x68
mov word [ebp - 0x3ae], dx
mov eax, 0x65
mov word [ebp - 0x3ac], ax
mov ecx, 0x6e
mov word [ebp - 0x3aa], cx
mov edx, 0x67
mov word [ebp - 0x3a8], dx
mov eax, 0x64
mov word [ebp - 0x3a6], ax
mov ecx, 0x75
mov word [ebp - 0x3a4], cx
mov edx, 0x20
mov word [ebp - 0x3a2], dx
mov eax, 0x44
mov word [ebp - 0x3a0], ax
mov ecx, 0x75
mov word [ebp - 0x39e], cx
mov edx, 0x6f
mov word [ebp - 0x39c], dx
mov eax, 0x6a
mov word [ebp - 0x39a], ax
mov ecx, 0x69
mov word [ebp - 0x398], cx
mov edx, 0x61
mov word [ebp - 0x396], dx
mov eax, 0x79
mov word [ebp - 0x394], ax
mov ecx, 0x75
mov word [ebp - 0x392], cx
mov edx, 0x20
mov word [ebp - 0x390], dx
mov eax, 0x4e
mov word [ebp - 0x38e], ax
mov ecx, 0x65
mov word [ebp - 0x38c], cx
mov edx, 0x74
mov word [ebp - 0x38a], dx
mov eax, 0x77
mov word [ebp - 0x388], ax
mov ecx, 0x6f
mov word [ebp - 0x386], cx
mov edx, 0x72
mov word [ebp - 0x384], dx
mov eax, 0x6b
mov word [ebp - 0x382], ax
mov ecx, 0x20
mov word [ebp - 0x380], cx
mov edx, 0x54
mov word [ebp - 0x37e], dx
mov eax, 0x65
mov word [ebp - 0x37c], ax
mov ecx, 0x63
mov word [ebp - 0x37a], cx
mov edx, 0x68
mov word [ebp - 0x378], dx
mov eax, 0x6e
mov word [ebp - 0x376], ax
mov ecx, 0x6f
mov word [ebp - 0x374], cx
mov edx, 0x6c
mov word [ebp - 0x372], dx
mov eax, 0x6f
mov word [ebp - 0x370], ax
mov ecx, 0x67
mov word [ebp - 0x36e], cx
mov edx, 0x79
mov word [ebp - 0x36c], dx
mov eax, 0x20
mov word [ebp - 0x36a], ax
mov ecx, 0x43
mov word [ebp - 0x368], cx
mov edx, 0x6f
mov word [ebp - 0x366], dx
mov eax, 0x2e
mov word [ebp - 0x364], ax
mov ecx, 0x2c
mov word [ebp - 0x362], cx
mov edx, 0x20
mov word [ebp - 0x360], dx
mov eax, 0x4c
mov word [ebp - 0x35e], ax
mov ecx, 0x74
mov word [ebp - 0x35c], cx
mov edx, 0x64
mov word [ebp - 0x35a], dx
mov eax, 0x2e
mov word [ebp - 0x358], ax
xor ecx, ecx
mov word [ebp - 0x356], cx
mov edx, 0x50
mov word [ebp - 0x138], dx
mov eax, 0x75
mov word [ebp - 0x136], ax
mov ecx, 0x62
mov word [ebp - 0x134], cx
mov edx, 0x6c
mov word [ebp - 0x132], dx
mov eax, 0x69
mov word [ebp - 0x130], ax
mov ecx, 0x73
mov word [ebp - 0x12e], cx
mov edx, 0x68
mov word [ebp - 0x12c], dx
mov eax, 0x65
mov word [ebp - 0x12a], ax
mov ecx, 0x72
mov word [ebp - 0x128], cx
xor edx, edx
mov word [ebp - 0x126], dx
lea ecx, [ebp - 0xc9]
call fcn.004063b0
push eax
lea eax, [ebp - 0x2f4]
push eax
lea ecx, [ebp - 0x350]
push ecx
lea ecx, [ebp - 0x688]
call fcn.00406b20
mov edx, dword [eax + 4]
push edx
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x59c]
call fcn.00406d10
mov dword [ebp - 0x438], eax
mov ecx, dword [ebp - 0x438]
mov dword [ebp - 0x43c], ecx
mov byte [ebp - 4], 0x21
mov ecx, dword [ebp - 0x43c]
call fcn.00415e30
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edx, [eax + eax + 2]
push edx
lea ecx, [ebp - 0xca]
call fcn.004063b0
push eax
lea eax, [ebp - 0x354]
push eax
lea ecx, [ebp - 0x3b0]
push ecx
lea ecx, [ebp - 0x600]
call fcn.00406b20
mov edx, dword [eax + 4]
push edx
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x590]
call fcn.00406d10
mov dword [ebp - 0x440], eax
mov ecx, dword [ebp - 0x440]
mov dword [ebp - 0x444], ecx
mov byte [ebp - 4], 0x22
mov ecx, dword [ebp - 0x444]
call fcn.00415e30
push eax
push 1
push 0
lea ecx, [ebp - 0xcb]
call fcn.004063b0
push eax
lea edx, [ebp - 0x124]
push edx
lea eax, [ebp - 0x138]
push eax
lea ecx, [ebp - 0x5e0]
call fcn.00406b20
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea ecx, [ebp - 0x4f4]
call fcn.00406d10
mov dword [ebp - 0x448], eax
mov ecx, dword [ebp - 0x448]
call fcn.00415e30
push eax
mov eax, dword [ebp - 0x3c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x42303c
mov dword [ebp - 0xe4], 1
jmp 0x423046
mov dword [ebp - 0xe4], 0
mov cl, byte [ebp - 0xe4]
mov byte [ebp - 0x49], cl
lea ecx, [ebp - 0x4f4]
call fcn.00407960
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x590]
call fcn.00407960
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x59c]
call fcn.00407960
movzx edx, byte [ebp - 0x49]
test edx, edx
je 0x423126
mov byte [ebp - 0x4a], 0
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x1c]
call fcn.00407640
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x20]
call fcn.00407640
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x18]
call fcn.00407640
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x14]
call fcn.00407640
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x24]
call fcn.00407640
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x28]
call fcn.00407640
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x2c]
call fcn.00407640
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x34]
call fcn.00407640
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x38]
call fcn.00407640
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x30]
call fcn.00407640
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x120]
call fcn.00402610
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00407640
mov al, byte [ebp - 0x4a]
jmp 0x423ac5
mov eax, 0x55
mov word [ebp - 0x270], ax
mov ecx, 0x6e
mov word [ebp - 0x26e], cx
mov edx, 0x69
mov word [ebp - 0x26c], dx
mov eax, 0x6e
mov word [ebp - 0x26a], ax
mov ecx, 0x73
mov word [ebp - 0x268], cx
mov edx, 0x74
mov word [ebp - 0x266], dx
mov eax, 0x61
mov word [ebp - 0x264], ax
mov ecx, 0x6c
mov word [ebp - 0x262], cx
mov edx, 0x6c
mov word [ebp - 0x260], dx
mov eax, 0x53
mov word [ebp - 0x25e], ax
mov ecx, 0x74
mov word [ebp - 0x25c], cx
mov edx, 0x72
mov word [ebp - 0x25a], dx
mov eax, 0x69
mov word [ebp - 0x258], ax
mov ecx, 0x6e
mov word [ebp - 0x256], cx
mov edx, 0x67
mov word [ebp - 0x254], dx
xor eax, eax
mov word [ebp - 0x252], ax
lea ecx, [ebp - 0x14a8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edx, [eax + eax + 2]
push edx
lea eax, [ebp - 0x14a8]
push eax
push 1
push 0
lea ecx, [ebp - 0xcc]
call fcn.004063b0
push eax
lea ecx, [ebp - 0x250]
push ecx
lea edx, [ebp - 0x270]
push edx
lea ecx, [ebp - 0x5e8]
call fcn.00406b20
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea ecx, [ebp - 0x5a8]
call fcn.00406d10
mov dword [ebp - 0x44c], eax
mov ecx, dword [ebp - 0x44c]
call fcn.00415e30
push eax
mov eax, dword [ebp - 0x3c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x423263
mov dword [ebp - 0xe8], 1
jmp 0x42326d
mov dword [ebp - 0xe8], 0
mov cl, byte [ebp - 0xe8]
mov byte [ebp - 0x4b], cl
lea ecx, [ebp - 0x5a8]
call fcn.00407960
movzx edx, byte [ebp - 0x4b]
test edx, edx
je 0x42332f
mov byte [ebp - 0x4c], 0
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x1c]
call fcn.00407640
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x20]
call fcn.00407640
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x18]
call fcn.00407640
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x14]
call fcn.00407640
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x24]
call fcn.00407640
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x28]
call fcn.00407640
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x2c]
call fcn.00407640
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x34]
call fcn.00407640
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x38]
call fcn.00407640
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x30]
call fcn.00407640
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x120]
call fcn.00402610
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00407640
mov al, byte [ebp - 0x4c]
jmp 0x423ac5
mov eax, 0x50
mov word [ebp - 0x18c], ax
mov ecx, 0x61
mov word [ebp - 0x18a], cx
mov edx, 0x63
mov word [ebp - 0x188], dx
mov eax, 0x6b
mov word [ebp - 0x186], ax
mov ecx, 0x61
mov word [ebp - 0x184], cx
mov edx, 0x67
mov word [ebp - 0x182], dx
mov eax, 0x65
mov word [ebp - 0x180], ax
mov ecx, 0x4e
mov word [ebp - 0x17e], cx
mov edx, 0x61
mov word [ebp - 0x17c], dx
mov eax, 0x6d
mov word [ebp - 0x17a], ax
mov ecx, 0x65
mov word [ebp - 0x178], cx
xor edx, edx
mov word [ebp - 0x176], dx
lea ecx, [ebp - 0x18]
call fcn.0040aee0
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x18]
call fcn.004084d0
push eax
push 1
push 0
lea ecx, [ebp - 0xcd]
call fcn.004063b0
push eax
lea ecx, [ebp - 0x174]
push ecx
lea edx, [ebp - 0x18c]
push edx
lea ecx, [ebp - 0x5f8]
call fcn.00406b20
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea ecx, [ebp - 0x5b4]
call fcn.00406d10
mov dword [ebp - 0x450], eax
mov ecx, dword [ebp - 0x450]
call fcn.00415e30
push eax
mov eax, dword [ebp - 0x3c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x423439
mov dword [ebp - 0xec], 1
jmp 0x423443
mov dword [ebp - 0xec], 0
mov cl, byte [ebp - 0xec]
mov byte [ebp - 0x4d], cl
lea ecx, [ebp - 0x5b4]
call fcn.00407960
movzx edx, byte [ebp - 0x4d]
test edx, edx
je 0x423505
mov byte [ebp - 0x4e], 0
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x1c]
call fcn.00407640
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x20]
call fcn.00407640
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x18]
call fcn.00407640
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x14]
call fcn.00407640
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x24]
call fcn.00407640
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x28]
call fcn.00407640
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x2c]
call fcn.00407640
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x34]
call fcn.00407640
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x38]
call fcn.00407640
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x30]
call fcn.00407640
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x120]
call fcn.00402610
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00407640
mov al, byte [ebp - 0x4e]
jmp 0x423ac5
mov eax, 0x44
mov word [ebp - 0x228], ax
mov ecx, 0x69
mov word [ebp - 0x226], cx
mov edx, 0x73
mov word [ebp - 0x224], dx
mov eax, 0x70
mov word [ebp - 0x222], ax
mov ecx, 0x6c
mov word [ebp - 0x220], cx
mov edx, 0x61
mov word [ebp - 0x21e], dx
mov eax, 0x79
mov word [ebp - 0x21c], ax
mov ecx, 0x56
mov word [ebp - 0x21a], cx
mov edx, 0x65
mov word [ebp - 0x218], dx
mov eax, 0x72
mov word [ebp - 0x216], ax
mov ecx, 0x73
mov word [ebp - 0x214], cx
mov edx, 0x69
mov word [ebp - 0x212], dx
mov eax, 0x6f
mov word [ebp - 0x210], ax
mov ecx, 0x6e
mov word [ebp - 0x20e], cx
xor edx, edx
mov word [ebp - 0x20c], dx
lea ecx, [ebp - 0x1c]
call fcn.004084d0
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x1c]
call fcn.004084d0
push eax
push 1
push 0
lea ecx, [ebp - 0xce]
call fcn.004063b0
push eax
lea ecx, [ebp - 0x20a]
push ecx
lea edx, [ebp - 0x228]
push edx
lea ecx, [ebp - 0x5f0]
call fcn.00406b20
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea ecx, [ebp - 0x5c0]
call fcn.00406d10
mov dword [ebp - 0x454], eax
mov ecx, dword [ebp - 0x454]
call fcn.00415e30
push eax
mov eax, dword [ebp - 0x3c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x42363a
mov dword [ebp - 0xf0], 1
jmp 0x423644
mov dword [ebp - 0xf0], 0
mov cl, byte [ebp - 0xf0]
mov byte [ebp - 0x3d], cl
lea ecx, [ebp - 0x5c0]
call fcn.00407960
movzx edx, byte [ebp - 0x3d]
test edx, edx
je 0x423706
mov byte [ebp - 0x3e], 0
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x1c]
call fcn.00407640
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x20]
call fcn.00407640
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x18]
call fcn.00407640
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x14]
call fcn.00407640
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x24]
call fcn.00407640
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x28]
call fcn.00407640
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x2c]
call fcn.00407640
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x34]
call fcn.00407640
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x38]
call fcn.00407640
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x30]
call fcn.00407640
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x120]
call fcn.00402610
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00407640
mov al, byte [ebp - 0x3e]
jmp 0x423ac5
mov eax, 0x49
mov word [ebp - 0x1a8], ax
mov ecx, 0x6e
mov word [ebp - 0x1a6], cx
mov edx, 0x73
mov word [ebp - 0x1a4], dx
mov eax, 0x74
mov word [ebp - 0x1a2], ax
mov ecx, 0x61
mov word [ebp - 0x1a0], cx
mov edx, 0x6c
mov word [ebp - 0x19e], dx
mov eax, 0x6c
mov word [ebp - 0x19c], ax
mov ecx, 0x44
mov word [ebp - 0x19a], cx
mov edx, 0x61
mov word [ebp - 0x198], dx
mov eax, 0x74
mov word [ebp - 0x196], ax
mov ecx, 0x65
mov word [ebp - 0x194], cx
xor edx, edx
mov word [ebp - 0x192], dx
lea ecx, [ebp - 0x20]
call fcn.0040aee0
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x20]
call fcn.004084d0
push eax
push 1
push 0
lea ecx, [ebp - 0xcf]
call fcn.004063b0
push eax
lea ecx, [ebp - 0x190]
push ecx
lea edx, [ebp - 0x1a8]
push edx
lea ecx, [ebp - 0x608]
call fcn.00406b20
mov ecx, dword [eax + 4]
push ecx
mov edx, dword [eax]
push edx
lea ecx, [ebp - 0x5cc]
call fcn.00406d10
mov dword [ebp - 0x458], eax
mov ecx, dword [ebp - 0x458]
call fcn.00415e30
push eax
mov eax, dword [ebp - 0x3c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x423810
mov dword [ebp - 0xf4], 1
jmp 0x42381a
mov dword [ebp - 0xf4], 0
mov cl, byte [ebp - 0xf4]
mov byte [ebp - 0x3f], cl
lea ecx, [ebp - 0x5cc]
call fcn.00407960
movzx edx, byte [ebp - 0x3f]
test edx, edx
je 0x4238dc
mov byte [ebp - 0x40], 0
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x1c]
call fcn.00407640
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x20]
call fcn.00407640
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x18]
call fcn.00407640
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x14]
call fcn.00407640
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x24]
call fcn.00407640
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x28]
call fcn.00407640
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x2c]
call fcn.00407640
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x34]
call fcn.00407640
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x38]
call fcn.00407640
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x30]
call fcn.00407640
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x120]
call fcn.00402610
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00407640
mov al, byte [ebp - 0x40]
jmp 0x423ac5
mov eax, dword [ebp - 0x3c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 0x41], 1
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x1c]
call fcn.00407640
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x20]
call fcn.00407640
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x18]
call fcn.00407640
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x14]
call fcn.00407640
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x24]
call fcn.00407640
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x28]
call fcn.00407640
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x2c]
call fcn.00407640
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x34]
call fcn.00407640
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x38]
call fcn.00407640
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x30]
call fcn.00407640
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x120]
call fcn.00402610
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00407640
mov al, byte [ebp - 0x41]
jmp 0x423ac5
mov byte [ebp - 0x42], 0
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x1c]
call fcn.00407640
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x20]
call fcn.00407640
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x18]
call fcn.00407640
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x14]
call fcn.00407640
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x24]
call fcn.00407640
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x28]
call fcn.00407640
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x2c]
call fcn.00407640
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x34]
call fcn.00407640
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x38]
call fcn.00407640
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x30]
call fcn.00407640
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x120]
call fcn.00402610
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00407640
mov al, byte [ebp - 0x42]
jmp 0x423ac5
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret