Function at 0x407c0e
Capabilities:
Create process on windows
Delete registry key
Delete registry value
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0xbcc
cmp dword [0x413664], 0x3e9
push ebx
push ebp
push esi
push edi
push 1
mov dword [esp + 0x28], 0x1d
mov dword [esp + 0x2c], 0x1e
mov dword [esp + 0x30], 0x1f
mov dword [esp + 0x34], 0x20
mov dword [esp + 0x38], 0x21
mov dword [esp + 0x3c], 0x22
mov dword [esp + 0x40], 0x23
mov dword [esp + 0x44], 0x24
mov dword [esp + 0x48], 0x25
mov dword [esp + 0x4c], 0x28
mov dword [esp + 0x50], 0x2c
mov dword [esp + 0x54], 0x38
mov dword [esp + 0x58], 0x39
mov dword [esp + 0x5c], 0x3a
pop ebx
jne 0x407ca7
cmp dword [0x413710], 0
je 0x407cbd
and dword [0x413710], 0
cmp dword [0x413710], 0
je 0x407cbd
mov ax, word [0x413b34]
mov word [esp + 0x10], ax
jmp 0x407cc1
mov dword [esp + 0x10], ebx
push 0xe
lea esi, [esp + 0x28]
lea edi, [esp + 0x60]
pop ebp
push 0x40
push edi
push dword [esi]
push dword [0x413a30]
call fcn.0040aa2b
add esp, 0x10
add edi, 0x40
add esi, 4
dec ebp
jne 0x407ccc
mov eax, dword [0x413668]
mov ecx, dword [0x413a20]
add ecx, eax
and dword [0x413698], 0
add ecx, dword [0x413a9c]
add ecx, dword [0x413aa4]
add ecx, dword [0x413b3c]
add ecx, dword [0x4136c0]
add ecx, dword [0x413714]
add ecx, dword [0x413b28]
add ecx, dword [0x413708]
add ecx, dword [0x413a54]
mov dword [0x413a98], ecx
jne 0x407d3a
mov dword [0x413a98], ebx
cmp dword [0x413a2c], 0
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
jne 0x407f64
xor edi, edi
push edi
push 0x3ea
call fcn.0040317d
push edi
push 0x3ec
call fcn.0040317d
mov esi, 0x3ed
push 1
push esi
call fcn.0040317d
push 1
push 0x3ef
call fcn.0040317d
lea eax, [esp + 0x3fc]
push 0x100
push eax
push 0x2d
push dword [0x413a30]
call fcn.0040aa2b
push dword [0x413a48]
lea eax, [esp + 0x410]
push eax
lea eax, [esp + 0x814]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x3c
lea eax, [esp + 0x7dc]
push eax
push esi
push dword [0x413630]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 1
push dword [0x413630]
call edi
mov esi, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call esi
push 0
push 5
push dword [0x413630]
call edi
push eax
call esi
xor edi, edi
mov esi, 0x413ac0
lea eax, [edi + 0x6b]
movzx eax, ax
push eax
push dword [0x413a30]
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [esi], eax
add esi, 4
inc edi
cmp esi, 0x413b14
jl 0x407e02
xor esi, esi
cmp dword [0x413720], esi
je 0x407e47
push 5
push 0xef6
push dword [0x413630]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call fcn.00408f82
xor edi, edi
cmp dword [0x413a40], esi
pop ecx
mov dword [0x413a2c], 1
jle 0x407f64
jmp 0x407e6a
xor esi, esi
cmp dword [0x4136c4], esi
jne 0x407f64
cmp dword [0x413664], 0x3e8
je 0x407e96
mov eax, dword [0x4136e8]
mov eax, dword [eax + edi*4]
cmp dword [eax + 0x204], esi
je 0x407f57
mov eax, dword [0x4136e8]
mov cx, word [esp + 0x10]
mov esi, edi
shl esi, 2
mov eax, dword [esi + eax]
cmp word [eax + 0x208], cx
jb 0x407f57
push 0x5c
push eax
call fcn.0040bc63
pop ecx
test eax, eax
pop ecx
je 0x407ed4
mov eax, dword [0x4136e8]
push 0
push dword [esi + eax]
call fcn.0040a622
pop ecx
pop ecx
lea eax, [esp + 0x3dc]
push 0x4125e4
push eax
call ebp
push 0
call fcn.0040b123
mov byte [esp + 0x3e0], al
pop ecx
lea eax, [esp + 0x35c]
push eax
push dword [0x4136f4]
call ebp
mov eax, dword [0x4136e8]
mov eax, dword [esi + eax]
cmp byte [eax + 0x104], 0
lea ecx, [eax + 0x104]
je 0x407f1c
push ecx
jmp 0x407f1d
push eax
push dword [0x4136f4]
call ebx
push dword [0x4136f4]
call fcn.00408f82
cmp dword [0x413664], 0x3e8
pop ecx
mov eax, str.Automatic
je 0x407f47
mov eax, str.Custom
push eax
mov eax, dword [0x4136e8]
push dword [esi + eax]
call fcn.0040bbb2
pop ecx
pop ecx
inc edi
cmp edi, dword [0x413a40]
jl 0x407e68
xor edi, edi
xor esi, esi
cmp dword [0x413a20], edi
jle 0x40800a
cmp dword [0x4136c4], edi
jne 0x40800a
cmp dword [0x413664], 0x3e8
je 0x407f9c
mov eax, dword [0x413b38]
mov eax, dword [eax + esi*4]
cmp dword [eax + 0x104], edi
je 0x407ff7
mov eax, dword [0x413b38]
mov eax, dword [eax + esi*4]
mov ax, word [eax + 0x108]
cmp ax, word [esp + 0x10]
jb 0x407ff7
lea eax, [esp + 0x39c]
push eax
push dword [0x4136f4]
call ebp
mov eax, dword [0x413b38]
push dword [eax + esi*4]
push dword [0x4136f4]
call ebx
push dword [0x4136f4]
call fcn.00408f82
mov eax, dword [0x413b38]
push dword [eax + esi*4]
call fcn.0040aaf7
push 0xdac
call fcn.00409088
add esp, 0xc
inc dword [0x413698]
inc esi
cmp esi, dword [0x413a20]
jl 0x407f74
cmp dword [0x41373c], edi
je 0x40805d
cmp dword [0x413664], 0x3e8
je 0x408026
cmp dword [0x413670], edi
je 0x40805d
lea eax, [esp + 0x2dc]
push eax
push dword [0x4136f4]
call ebp
push dword [0x41373c]
push dword [0x4136f4]
call ebx
push dword [0x4136f4]
call fcn.00408f82
pop ecx
call fcn.00409f08
test eax, eax
jne 0x408f77
xor edi, edi
cmp dword [0x413714], edi
jle 0x40810d
cmp dword [0x4136c4], 0
jne 0x40810d
cmp dword [0x413664], 0x3e8
je 0x408095
mov eax, dword [0x413648]
mov eax, dword [eax + edi*4]
cmp dword [eax + 0x104], 0
je 0x4080fa
mov eax, dword [0x413648]
mov cx, word [esp + 0x10]
mov esi, edi
shl esi, 2
mov eax, dword [esi + eax]
cmp word [eax + 0x108], cx
jb 0x4080fa
lea eax, [esp + 0x15c]
push eax
push dword [0x4136f4]
call ebp
mov eax, dword [0x413648]
push dword [esi + eax]
push dword [0x4136f4]
call ebx
push dword [0x4136f4]
call fcn.00408f82
mov eax, dword [0x413648]
push 0
push dword [esi + eax]
call fcn.0040a569
mov eax, dword [0x413648]
push dword [esi + eax]
call fcn.0040a2ce
add esp, 0x10
inc dword [0x413698]
inc edi
cmp edi, dword [0x413714]
jl 0x40806b
xor edi, edi
cmp dword [0x4136c0], edi
jle 0x4081f5
cmp dword [0x4136c4], 0
jne 0x4081f5
cmp dword [0x413664], 0x3e8
je 0x408149
mov eax, dword [0x413748]
mov eax, dword [eax + edi*4]
cmp dword [eax + 0x70c], 0
je 0x4081e2
mov eax, dword [0x413748]
mov cx, word [esp + 0x10]
mov esi, edi
shl esi, 2
mov eax, dword [esi + eax]
cmp word [eax + 0x710], cx
jb 0x4081e2
add eax, 8
push 0
push eax
call fcn.0040a7c1
pop ecx
test eax, eax
pop ecx
jne 0x4081e2
lea eax, [esp + 0x19c]
push eax
push dword [0x4136f4]
call ebp
mov eax, dword [0x413748]
mov eax, dword [esi + eax]
add eax, 8
push eax
push dword [0x4136f4]
call ebx
push dword [0x4136f4]
call fcn.00408f82
mov eax, dword [0x413748]
cmp dword [0x413710], 0
pop ecx
mov eax, dword [esi + eax]
lea ecx, [eax + 0x50c]
jne 0x4081c2
lea ecx, [eax + 0x30c]
lea edx, [eax + 8]
push edx
mov dl, byte [ecx]
neg dl
sbb edx, edx
and edx, ecx
lea ecx, [eax + 0x20c]
push edx
add eax, 0x10c
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
inc dword [0x413698]
inc edi
cmp edi, dword [0x4136c0]
jl 0x40811b
xor esi, esi
cmp dword [0x413a50], esi
jle 0x408254
cmp dword [0x413710], 0
je 0x40824b
mov eax, dword [0x413640]
mov cx, word [esp + 0x10]
mov eax, dword [eax + esi*4]
cmp word [eax + 0x208], cx
jb 0x40824b
add eax, 0x104
push 0
push eax
call fcn.0040a7c1
pop ecx
test eax, eax
pop ecx
jne 0x40824b
mov eax, dword [0x413640]
push 1
mov eax, dword [eax + esi*4]
lea ecx, [eax + 0x104]
push ecx
push eax
call fcn.00409b57
add esp, 0xc
inc esi
cmp esi, dword [0x413a50]
jl 0x4081ff
mov eax, dword [0x413a54]
lea esi, [eax - 1]
test esi, esi
jl 0x408387
cmp dword [0x413664], 0x3e8
jne 0x408294
mov eax, dword [0x413688]
mov eax, dword [eax + esi*4]
cmp dword [eax + 0x268], 0
jne 0x4082a9
cmp dword [0x413710], 0
je 0x408294
lea ecx, [eax + 0x10c]
test ecx, ecx
jne 0x4082a9
mov eax, dword [0x413688]
mov eax, dword [eax + esi*4]
cmp dword [eax + 0x264], 0
je 0x408380
mov cx, word [esp + 0x10]
cmp word [eax + 0x270], cx
jb 0x408380
cmp word [eax + 0x276], cx
jb 0x4082da
push dword [eax + 0x278]
add eax, 8
push 1
push eax
call fcn.00409952
add esp, 0xc
jmp 0x4082dc
xor eax, eax
cmp eax, 1
jne 0x408317
cmp dword [0x413710], 0
je 0x408309
mov eax, dword [0x413688]
mov cx, word [esp + 0x10]
mov eax, dword [eax + esi*4]
cmp word [eax + 0x272], cx
jne 0x408309
cmp byte [eax + 0x10c], 0
jne 0x408380
mov eax, dword [0x413688]
mov eax, dword [eax + esi*4]
and byte [eax + 8], 0
jmp 0x408380
mov eax, dword [0x413688]
mov eax, dword [eax + esi*4]
mov cx, word [eax + 0x272]
cmp cx, word [eax + 0x270]
jne 0x408338
cmp byte [eax + 0x10c], 0
je 0x408341
cmp dword [0x413710], 0
jne 0x408380
mov di, word [esp + 0x10]
cmp word [eax + 0x26c], di
jb 0x408365
add eax, 8
push 0
push eax
lea eax, [esp + 0x2a4]
push eax
call fcn.00409d58
add esp, 0xc
mov eax, dword [0x413688]
mov eax, dword [eax + esi*4]
cmp word [eax + 0x26e], di
jb 0x408380
add eax, 8
push eax
call fcn.0040ab4c
pop ecx
dec esi
jns 0x408264
mov eax, dword [0x413708]
lea edi, [eax - 1]
test edi, edi
jl 0x4084b1
mov eax, dword [0x413aac]
mov dx, word [esp + 0x10]
mov esi, edi
shl esi, 2
mov eax, dword [esi + eax]
cmp word [eax + 0x268], dx
jb 0x4084aa
mov ecx, dword [eax + 0x25c]
test ecx, ecx
jne 0x4083c8
cmp dword [0x41368c], ecx
je 0x408434
cmp word [eax + 0x26e], dx
jb 0x4083e3
push dword [eax + 0x270]
push ecx
push eax
call fcn.00409952
add esp, 0xc
jmp 0x4083e5
xor eax, eax
push 1
pop ecx
cmp eax, ecx
jne 0x408421
cmp dword [0x413710], 0
je 0x408414
mov eax, dword [0x413aac]
mov eax, dword [esi + eax]
mov cx, word [eax + 0x26a]
cmp cx, word [esp + 0x10]
jne 0x408414
cmp byte [eax + 0x104], 0
jne 0x408434
mov eax, dword [0x413aac]
mov eax, dword [esi + eax]
and byte [eax], 0
jmp 0x408434
cmp eax, 2
jne 0x408434
mov eax, dword [0x413aac]
mov eax, dword [esi + eax]
mov dword [eax + 0x25c], ecx
mov eax, dword [0x413aac]
mov eax, dword [esi + eax]
cmp dword [eax + 0x25c], 0
je 0x4084aa
cmp byte [eax], 0
je 0x4084aa
mov cx, word [eax + 0x26a]
cmp cx, word [eax + 0x268]
jne 0x408463
cmp byte [eax + 0x104], 0
je 0x40846c
cmp dword [0x413710], 0
jne 0x4084aa
mov cx, word [esp + 0x10]
cmp word [eax + 0x264], cx
jb 0x40848d
push 0
push eax
lea eax, [esp + 0x2a4]
push eax
call fcn.00409d58
add esp, 0xc
mov eax, dword [0x413aac]
mov esi, dword [esi + eax]
mov ax, word [esp + 0x10]
cmp word [esi + 0x266], ax
jb 0x4084aa
push esi
call fcn.0040ab4c
pop ecx
dec edi
jns 0x408397
xor esi, esi
cmp dword [0x413a54], esi
jle 0x4085bd
cmp dword [0x4136c4], 0
jne 0x4085bd
mov eax, dword [0x413688]
mov eax, dword [eax + esi*4]
cmp byte [eax + 8], 0
lea ecx, [eax + 8]
je 0x4085aa
cmp dword [0x413664], 0x3e8
jne 0x408516
cmp dword [eax + 0x268], 0
jne 0x408523
cmp dword [0x413710], 0
je 0x408516
cmp byte [eax + 0x10c], 0
je 0x408516
mov dx, word [eax + 0x272]
cmp dx, word [esp + 0x10]
je 0x408523
cmp dword [eax + 0x264], 0
je 0x4085aa
mov dx, word [esp + 0x10]
cmp word [eax + 0x270], dx
jb 0x4085aa
cmp word [eax + 0x272], dx
jne 0x408548
cmp dword [0x413710], 0
je 0x408548
push 1
pop edx
jmp 0x40854a
xor edx, edx
add eax, 0x10c
push edx
push eax
push ecx
call fcn.00409b57
add esp, 0xc
test eax, eax
je 0x4085aa
lea eax, [esp + 0x5c]
push eax
push dword [0x4136f4]
call ebp
mov eax, dword [0x413688]
mov eax, dword [eax + esi*4]
add eax, 8
push eax
push dword [0x4136f4]
call ebx
push dword [0x4136f4]
push 0x3ef
push dword [0x413630]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call fcn.00409766
push dword [0x4136f4]
call fcn.00408f82
add esp, 0xc
inc dword [0x413698]
inc esi
cmp esi, dword [0x413a54]
jl 0x4084bf
xor esi, esi
cmp dword [0x413708], esi
jle 0x4086b8
cmp dword [0x4136c4], 0
jne 0x4086b8
mov eax, dword [0x413aac]
mov eax, dword [eax + esi*4]
cmp byte [eax], 0
je 0x4086a5
cmp dword [eax + 0x25c], 0
jne 0x40861e
cmp dword [0x413710], 0
je 0x4086a5
cmp byte [eax + 0x104], 0
je 0x4086a5
mov cx, word [esp + 0x10]
cmp word [eax + 0x26a], cx
jne 0x4086a5
mov cx, word [esp + 0x10]
cmp word [eax + 0x268], cx
jb 0x4086a5
cmp word [eax + 0x26a], cx
jne 0x408643
cmp dword [0x413710], 0
je 0x408643
push 1
pop ecx
jmp 0x408645
xor ecx, ecx
push ecx
lea ecx, [eax + 0x104]
push ecx
push eax
call fcn.00409b57
add esp, 0xc
test eax, eax
je 0x4086a5
lea eax, [esp + 0x9c]
push eax
push dword [0x4136f4]
call ebp
mov eax, dword [0x413aac]
push dword [eax + esi*4]
push dword [0x4136f4]
call ebx
push dword [0x4136f4]
push 0x3ef
push dword [0x413630]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call fcn.00409766
push dword [0x4136f4]
call fcn.00408f82
add esp, 0xc
inc dword [0x413698]
inc esi
cmp esi, dword [0x413708]
jl 0x4085cb
xor esi, esi
cmp dword [0x413710], esi
je 0x4087e6
cmp dword [0x413a54], esi
jle 0x408769
cmp dword [0x4136c4], 0
jne 0x408769
mov eax, dword [0x413688]
mov eax, dword [eax + esi*4]
cmp byte [eax + 8], 0
lea ecx, [eax + 8]
je 0x40875c
cmp dword [0x413664], 0x3e8
jne 0x408717
cmp dword [eax + 0x268], 0
jne 0x408720
cmp dword [0x413710], 0
je 0x408717
cmp byte [eax + 0x10c], 0
jne 0x408720
cmp dword [eax + 0x264], 0
je 0x40875c
mov dx, word [esp + 0x10]
cmp word [eax + 0x270], dx
jb 0x40875c
cmp byte [eax + 0x10c], 0
je 0x40875c
cmp word [eax + 0x272], dx
jne 0x40875c
cmp word [eax + 0x26c], dx
jb 0x40875c
push 1
lea eax, [esp + 0x2a0]
push ecx
push eax
call fcn.00409d58
add esp, 0xc
inc esi
cmp esi, dword [0x413a54]
jl 0x4086d2
xor esi, esi
cmp dword [0x413708], esi
jle 0x4087e6
xor ecx, ecx
cmp dword [0x4136c4], ecx
jne 0x4087e6
mov eax, dword [0x413aac]
mov eax, dword [eax + esi*4]
cmp byte [eax], cl
je 0x4087dd
cmp dword [eax + 0x25c], ecx
jne 0x4087a1
cmp dword [0x413710], ecx
je 0x4087dd
cmp byte [eax + 0x104], cl
je 0x4087dd
mov cx, word [esp + 0x10]
cmp word [eax + 0x268], cx
jb 0x4087dd
cmp byte [eax + 0x104], 0
je 0x4087dd
cmp word [eax + 0x26a], cx
jne 0x4087dd
cmp word [eax + 0x264], cx
jb 0x4087dd
push 1
push eax
lea eax, [esp + 0x2a4]
push eax
call fcn.00409d58
add esp, 0xc
inc esi
cmp esi, dword [0x413708]
jl 0x408773
cmp dword [0x413664], 0x3e8
jne 0x408811
cmp dword [0x4136c4], 0
jne 0x408811
cmp dword [0x413710], 0
jne 0x408811
push dword [esp + 0xbe0]
call fcn.0040a2ce
pop ecx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
xor edi, edi
cmp dword [0x413b28], edi
jle 0x408939
mov bp, word [esp + 0x10]
cmp dword [0x4136c4], 0
jne 0x408939
mov ecx, dword [0x413664]
cmp ecx, 0x3e8
je 0x40885a
mov eax, dword [0x41369c]
mov eax, dword [eax + edi*4]
cmp dword [eax + 0x104], 0
je 0x408926
mov eax, dword [0x41369c]
mov esi, edi
shl esi, 2
mov eax, dword [esi + eax]
cmp word [eax + 0x10a], bp
jb 0x408926
cmp ecx, 0x3e9
je 0x40888c
cmp word [eax + 0x108], bp
lea eax, [esp + 0x11c]
jb 0x408893
lea eax, [esp + 0xdc]
push eax
push dword [0x4136f4]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [0x41369c]
push dword [esi + eax]
call ebx
mov ecx, dword [0x41369c]
mov ecx, dword [esi + ecx]
and byte [eax + ecx - 1], 0
mov eax, dword [0x41369c]
push dword [esi + eax]
push dword [0x4136f4]
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push dword [0x4136f4]
push 0x3ef
push dword [0x413630]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call fcn.00409766
push dword [0x4136f4]
call fcn.00408f82
mov eax, dword [0x41369c]
add esp, 0xc
cmp dword [0x413664], 0x3e9
je 0x408918
mov ecx, dword [esi + eax]
cmp word [ecx + 0x108], bp
jae 0x408918
xor ecx, ecx
jmp 0x40891b
push 1
pop ecx
push ecx
push dword [esi + eax]
call fcn.0040910b
pop ecx
pop ecx
inc dword [0x413698]
inc edi
cmp edi, dword [0x413b28]
jl 0x40882a
cmp dword [0x413710], 0
je 0x408986
cmp dword [0x413734], 0
jne 0x40895a
push dword [esp + 0xbe0]
call fcn.0040a2ce
pop ecx
jmp 0x408986
push 1
push dword [esp + 0xbe4]
call fcn.0040c3c8
mov esi, eax
pop ecx
cmp esi, 0xffffffff
pop ecx
je 0x408986
push dword [0x413734]
push esi
call fcn.0040c282
push esi
call fcn.0040c1cf
add esp, 0xc
xor ecx, ecx
xor ebp, ebp
cmp dword [0x413a9c], ecx
jle 0x408a91
cmp dword [0x4136c4], ecx
jne 0x408a91
cmp dword [0x413664], 0x3e8
je 0x4089c2
mov eax, dword [0x413a24]
mov eax, dword [eax + ebp*4]
cmp dword [eax + 0x121c], ecx
je 0x408a7e
mov eax, dword [0x413a24]
mov dx, word [esp + 0x10]
mov edi, ebp
shl edi, 2
mov eax, dword [edi + eax]
cmp word [eax + 0x1220], dx
jb 0x408a7e
lea eax, [esp + 0x21c]
push eax
push dword [0x4136f4]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [0x4136f4]
call ebx
mov ecx, dword [0x413a24]
mov esi, eax
mov eax, dword [0x4136f4]
mov ecx, dword [edi + ecx]
add esi, eax
add ecx, 8
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push esi
call ebx
cmp eax, 0x30
jle 0x408a31
add esi, 0x2d
push 0x4125cc
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [0x4136f4]
call fcn.00408f82
mov eax, dword [0x413a24]
cmp dword [0x413710], 0
pop ecx
mov eax, dword [edi + eax]
lea ecx, [eax + 0xa14]
jne 0x408a5a
lea ecx, [eax + 0x214]
push 0
push ecx
lea ecx, [eax + 0x108]
push ecx
lea ecx, [eax + 8]
push ecx
push dword [eax + 0x1218]
push dword [eax + 0x1214]
call fcn.00407a6f
add esp, 0x18
xor ecx, ecx
inc dword [0x413698]
inc ebp
cmp ebp, dword [0x413a9c]
jl 0x408996
mov eax, dword [0x413b3c]
dec eax
cmp eax, ecx
mov dword [esp + 0x1c], eax
jl 0x408ccc
jmp 0x408aab
mov eax, dword [esp + 0x1c]
xor ecx, ecx
cmp dword [0x4136c4], ecx
jne 0x408ccc
cmp dword [0x413664], 0x3e8
je 0x408adc
mov edx, dword [0x41366c]
mov eax, dword [edx + eax*4]
cmp dword [eax + 0x21c], ecx
je 0x408cba
mov eax, dword [esp + 0x1c]
mov cx, word [esp + 0x10]
mov esi, eax
mov eax, dword [0x41366c]
shl esi, 2
mov eax, dword [esi + eax]
cmp word [eax + 0x220], cx
jb 0x408cba
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x1dc]
push eax
push dword [0x4136f4]
call ebp
push dword [0x4136f4]
call ebx
mov ecx, dword [0x41366c]
mov edi, eax
mov eax, dword [0x4136f4]
mov ecx, dword [esi + ecx]
add edi, eax
add ecx, 8
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
call ebx
cmp eax, 0x30
jle 0x408b49
add edi, 0x2d
push 0x4125cc
push edi
call ebp
push dword [0x4136f4]
call fcn.00408f82
cmp dword [0x413650], 0
pop ecx
je 0x408c91
mov dword [esp + 0x14], 1
mov eax, dword [0x41366c]
lea ecx, [esp + 0x20]
push ecx
push 0x1f
mov eax, dword [esi + eax]
push 0
lea ecx, [eax + 8]
mov eax, dword [eax + 0x218]
push ecx
push dword [eax*4 + 0x412030]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x408c77
cmp dword [esp + 0x14], eax
je 0x408bb8
mov eax, dword [0x41366c]
mov eax, dword [esi + eax]
add eax, 0x10c
push eax
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
xor edi, edi
lea eax, [esp + 0x18]
push edi
push edi
push edi
push edi
push eax
lea eax, [esp + 0x3f0]
push eax
push edi
push dword [esp + 0x3c]
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], 0x100
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov ebp, eax
cmp ebp, edi
je 0x408c41
push edi
push edi
push edi
lea eax, [esp + 0x24]
push edi
push eax
lea eax, [esp + 0x3f0]
mov dword [esp + 0x2c], 0x100
push eax
push edi
push dword [esp + 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push dword [esp + 0x20]
mov ebp, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebp, edi
je 0x408cba
mov eax, dword [0x41366c]
mov eax, dword [esi + eax]
lea ecx, [eax + 8]
mov eax, dword [eax + 0x218]
push ecx
push dword [eax*4 + 0x412030]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x408c4b
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebp, edi
je 0x408cba
mov eax, dword [0x41366c]
mov edi, dword [esi + eax]
mov eax, edi
add eax, 8
push eax
call ebx
lea eax, [eax + edi + 7]
lea ecx, [edi + 8]
cmp eax, ecx
jbe 0x408c72
cmp byte [eax], 0x5c
je 0x408c72
dec eax
jmp 0x408c66
and byte [eax], 0
jmp 0x408c79
xor ebp, ebp
test ebp, ebp
je 0x408cba
mov eax, dword [0x41366c]
mov eax, dword [esi + eax]
cmp byte [eax + 8], 0
jne 0x408b6a
jmp 0x408cba
mov eax, dword [0x41366c]
mov esi, dword [esi + eax]
cmp byte [esi + 0x10c], 0
jne 0x408cba
cmp dword [esi + 0x218], 0
jne 0x408cba
add esi, 8
push esi
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
inc dword [0x413698]
dec dword [esp + 0x1c]
jns 0x408aa5
xor ecx, ecx
mov eax, dword [0x413aa4]
lea edi, [eax - 1]
cmp edi, ecx
jl 0x408d99
cmp dword [0x4136c4], ecx
jne 0x408f77
cmp dword [0x413664], 0x3e8
je 0x408d08
mov eax, dword [0x413760]
mov eax, dword [eax + edi*4]
cmp dword [eax + 0x104], ecx
je 0x408d8c
mov eax, dword [0x413760]
mov dx, word [esp + 0x10]
mov eax, dword [eax + edi*4]
cmp word [eax + 0x108], dx
jb 0x408d8c
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x31c]
push eax
push dword [0x4136f4]
call ebp
push dword [0x4136f4]
call ebx
mov ecx, dword [0x413760]
mov esi, eax
mov eax, dword [0x4136f4]
push dword [ecx + edi*4]
add esi, eax
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push esi
call ebx
cmp eax, 0x30
jle 0x408d68
add esi, 0x2d
push 0x4125cc
push esi
call ebp
push dword [0x4136f4]
call fcn.00408f82
mov eax, dword [0x413760]
mov eax, dword [eax + edi*4]
push dword [eax + 0x100]
push eax
call fcn.0040a10f
add esp, 0xc
xor ecx, ecx
inc dword [0x413698]
dec edi
jns 0x408cdc
cmp dword [0x4136c4], ecx
jne 0x408f77
push 1
xor esi, esi
cmp dword [0x413668], ecx
pop edi
jle 0x408e85
cmp dword [0x4136c4], ecx
jne 0x408e5d
cmp dword [0x413664], 0x3e8
je 0x408dde
mov eax, dword [0x4136d4]
mov eax, dword [eax + esi*4]
cmp dword [eax + 0x300], ecx
je 0x408e4a
mov eax, dword [0x4136d4]
mov dx, word [esp + 0x10]
mov eax, dword [eax + esi*4]
cmp word [eax + 0x304], dx
je 0x408dfc
cmp dword [0x413710], ecx
jne 0x408e4a
cmp edi, ecx
je 0x408e07
call fcn.004092c2
xor edi, edi
lea eax, [esp + 0x25c]
push eax
push dword [0x4136f4]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [0x4136d4]
mov eax, dword [eax + esi*4]
add eax, 0x100
push eax
push dword [0x4136f4]
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push dword [0x4136f4]
call fcn.00408f82
push esi
call fcn.0040948f
pop ecx
pop ecx
xor ecx, ecx
inc dword [0x413698]
inc esi
cmp esi, dword [0x413668]
jl 0x408db6
cmp edi, ecx
jne 0x408e85
mov eax, dword [0x4136c8]
cmp eax, ecx
je 0x408e70
push eax
call sub.USER32.dll_DdeDisconnect
push 0
call fcn.00408f82
pop ecx
push dword [0x41365c]
call sub.USER32.dll_DdeUninitialize
xor ecx, ecx
cmp dword [0x413724], ecx
je 0x408f77
cmp dword [0x413664], 0x3e8
jne 0x408ea5
cmp dword [0x413710], ecx
je 0x408ebd
cmp dword [0x413710], ecx
je 0x408f77
cmp dword [0x413734], ecx
jne 0x408f77
cmp dword [0x413650], ecx
je 0x408f77
lea eax, [esp + 0x14]
xor esi, esi
push eax
push 0x1f
push esi
push str.SoftwareWise_SolutionsWamUser
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x408f77
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x100
push eax
lea eax, [esp + 0x3e0]
push eax
lea eax, [esp + 0x24]
push eax
push esi
push str.Path
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x408f6d
lea eax, [esp + 0x3dc]
push esi
push eax
call fcn.0040a622
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
pop ecx
pop ecx
lea eax, [esp + 0x3dc]
push str.__U__
push eax
call esi
push dword [0x413724]
lea eax, [esp + 0x3e0]
push eax
call esi
lea eax, [esp + 0x3dc]
push 0x412598
push eax
call esi
lea eax, [esp + 0x3dc]
push 5
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xbcc
ret