Function at 0x405342
Capabilities:
Get common file path
Get disk information
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3208
call fcn.0040ead0
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
mov edi, 0x41509c
push edi
push dword [0x418a6c]
call esi
push edi
push dword [0x418a3c]
call esi
cmp dword [0x418b60], 0
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
je 0x4054ae
lea eax, [ebp - 4]
push eax
push 0x13
push 0
mov ebx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push ebx
push 0x80000001
call edi
test eax, eax
jne 0x40541f
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x454]
push eax
lea eax, [ebp - 0x28]
push eax
push 0
push str.Start_Menu
push dword [ebp - 4]
mov dword [ebp - 0x14], pe_nt_image_headers32
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x405416
cmp byte [ebp - 0x454], al
je 0x405416
lea eax, [ebp - 0x454]
push eax
push dword [0x418a6c]
call esi
push dword [0x418a6c]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [0x418a6c]
add eax, ecx
cmp eax, ecx
jbe 0x405412
cmp byte [eax], 0x5c
je 0x405402
dec eax
cmp eax, ecx
ja 0x4053f8
cmp eax, ecx
jbe 0x405412
jmp 0x40540d
cmp byte [eax], 0x5c
je 0x405412
dec eax
cmp eax, ecx
ja 0x405408
mov byte [eax + 1], 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x4186c0], 1
jne 0x4054ae
lea eax, [ebp - 4]
push eax
push 0x13
push 0
push ebx
push 0x80000002
call edi
test eax, eax
jne 0x4054ae
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x454]
push eax
lea eax, [ebp - 0x28]
push eax
push 0
push str.Common_Start_Menu
push dword [ebp - 4]
mov dword [ebp - 0x14], pe_nt_image_headers32
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4054a5
cmp byte [ebp - 0x454], al
je 0x4054a5
lea eax, [ebp - 0x454]
push eax
push dword [0x418a3c]
call esi
push dword [0x418a3c]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [0x418a3c]
add eax, ecx
jmp 0x40549d
cmp byte [eax], 0x5c
je 0x4054a1
dec eax
cmp eax, ecx
ja 0x405497
mov byte [eax + 1], 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push edi
call esi
push edi
call fcn.00401ec6
cmp eax, edi
pop ecx
jbe 0x4054c6
mov byte [eax - 1], 0
push 0
push edi
call fcn.0040306b
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
pop ecx
pop ecx
push 0x414474
push edi
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
and dword [ebp - 0x2c], 0
push 0x415034
call edi
push 0x415030
mov dword [ebp - 0x1c], eax
call edi
push 0x10c
mov dword [ebp - 0x18], eax
call fcn.00401fe8
mov edx, dword [0x418ae4]
pop ecx
mov ecx, dword [0x418b64]
push dword [ebp + 8]
mov dword [ecx + edx*4], eax
mov ecx, dword [0x418ae4]
mov eax, dword [0x418b64]
mov eax, dword [eax + ecx*4]
and dword [eax + 0x104], 0
mov ecx, dword [0x418ae4]
mov eax, dword [0x418b64]
mov eax, dword [eax + ecx*4]
and word [eax + 0x108], 0
mov ecx, dword [0x418ae4]
mov eax, dword [0x418b64]
mov eax, dword [eax + ecx*4]
mov word [eax + 0x10a], 0x7fff
mov eax, dword [0x418b64]
mov ecx, dword [0x418ae4]
mov edi, dword [eax + ecx*4]
push edi
call esi
push 0x7e
push edi
call fcn.004025e3
test eax, eax
pop ecx
pop ecx
je 0x4056b8
cmp dword [0x4186c0], 0
je 0x4056b8
push 0x5c
push edi
call fcn.004025e3
test eax, eax
pop ecx
pop ecx
jne 0x4055d0
push edi
lea eax, [ebp - 0xfd4]
push eax
call esi
push pe_nt_image_headers32
push edi
call fcn.0040eab2
pop ecx
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [eax + edi - 1], 0x5c
je 0x4055c6
push 0x414474
push edi
call ebx
lea eax, [ebp - 0xfd4]
push eax
push edi
call ebx
cmp dword [0x41806c], 1
movsx eax, byte [edi]
mov ebx, edi
jle 0x4055ed
push 0x103
push eax
call fcn.0040e5a2
pop ecx
pop ecx
jmp 0x4055fc
mov ecx, dword [str.________________________________H]
movzx eax, word [ecx + eax*2]
and eax, 0x103
test eax, eax
je 0x405612
cmp byte [edi + 1], 0x3a
jne 0x405612
movsx eax, byte [edi]
push eax
call fcn.0040e620
pop ecx
mov byte [edi], al
cmp byte [edi], 0x5c
jne 0x405638
cmp byte [edi + 1], 0x5c
jne 0x405638
lea ebx, [edi + 2]
jmp 0x405627
cmp al, 0x5c
je 0x405637
inc ebx
mov al, byte [ebx]
test al, al
jne 0x405622
cmp al, 0x5c
jne 0x405638
jmp 0x405637
cmp al, 0x5c
je 0x4056b2
inc ebx
mov al, byte [ebx]
test al, al
jne 0x405633
jmp 0x4056ad
cmp byte [ebx], 0
mov eax, ebx
jmp 0x405650
cmp byte [eax], 0x5c
je 0x405655
inc eax
cmp byte [eax], 0
mov dword [ebp - 0x10], eax
jne 0x405647
push dword [ebp - 0x10]
lea eax, [ebp - 0xfd4]
push eax
call esi
mov eax, dword [ebp - 0x10]
mov byte [eax], 0
lea eax, [ebp - 0x2130]
push eax
push 0x17
push edi
call fcn.00401cc6
add esp, 0xc
test eax, eax
jne 0x405694
lea eax, [ebp - 0x2130]
push eax
push ebx
call esi
lea eax, [ebp - 0x2130]
push eax
call fcn.00401d45
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
lea eax, [ebp - 0xfd4]
push eax
push edi
add ebx, edi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp byte [ebx], 0x5c
jne 0x4056b3
inc ebx
cmp byte [ebx], 0
jne 0x405640
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
call ebx
lea eax, [eax + edi - 1]
jmp 0x4056d0
cmp byte [eax], 0x5c
je 0x4056d9
mov byte [eax], 0
dec eax
cmp eax, edi
ja 0x4056c7
cmp byte [eax], 0x5c
jne 0x4056dd
mov byte [eax + 1], 0
push edi
call ebx
cmp eax, 3
jg 0x4056e8
mov byte [edi], 0
and dword [ebp - 4], 0
mov ebx, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0xcd4]
dec eax
mov dword [ebp - 0xc], 1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 4], 0
lea eax, [ebp - 0xcd4]
je 0x40571d
push pe_nt_image_headers32
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x405725
push 0x104
push eax
call ebx
lea eax, [ebp - 0xcd4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x14]
cmp byte [eax + ecx], 0x5c
je 0x40574d
push 0x414474
lea eax, [ebp - 0xcd4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0xcd4]
push eax
push edi
call fcn.00413271
add esp, 0xc
test eax, eax
jne 0x40576c
and dword [ebp - 0xc], eax
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x405703
push 0x104
lea eax, [ebp - 0x1de4]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x104
lea eax, [ebp - 0x15d8]
push eax
call ebx
lea eax, [ebp - 0x15d8]
push eax
lea eax, [ebp - 0x1bdc]
push eax
call esi
push str.WIN32S
lea eax, [ebp - 0x1bdc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp dword [0x4186c0], 1
jne 0x405811
push 0x104
push dword [0x418b08]
call ebx
push dword [0x418b08]
lea eax, [ebp - 0x1ce0]
push eax
call esi
push 0x414474
lea eax, [ebp - 0x1ce0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x1ce0]
push eax
push edi
call fcn.00413271
add esp, 0xc
xor ebx, ebx
test eax, eax
jne 0x405822
mov dword [ebp - 0xc], ebx
jmp 0x405822
lea eax, [ebp - 0x15d8]
push eax
push dword [0x418b08]
call esi
xor ebx, ebx
cmp dword [ebp - 0xc], ebx
je 0x405832
cmp byte [edi], 0
je 0x405832
inc dword [0x418ae4]
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll__lopen]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
jne 0x4058a9
mov esi, pe_nt_image_headers32
push esi
lea eax, [ebp - 0xcd4]
push eax
push 3
push dword [0x418790]
call fcn.004033e3
push esi
lea eax, [ebp - 0x454]
push eax
push 2
push dword [0x418790]
call fcn.004033e3
mov eax, dword [0x418ba0]
add esp, 0x20
cmp eax, ebx
je 0x405886
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push ebx
lea eax, [ebp - 0x454]
push eax
lea eax, [ebp - 0xcd4]
push eax
push dword [0x418ba8]
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
inc eax
jmp 0x408921
mov edi, dword [sym.imp.KERNEL32.dll__llseek]
push 2
push ebx
push dword [ebp - 8]
call edi
push ebx
push ebx
push dword [ebp - 8]
mov dword [0x418688], eax
call edi
or dword [ebp - 0x34], 0xffffffff
push ebx
push dword [ebp - 8]
mov edi, 0x800
lea eax, [ebp - 0xcd4]
push edi
push eax
call fcn.00401579
add esp, 0x10
cmp byte [ebp - 0xcd0], 0x20
jne 0x4058f3
mov dword [0x418b3c], 1
movzx eax, word [0x4186ac]
mov ecx, dword [0x418a58]
mov dword [ecx + eax*4], ebx
inc word [0x4186ac]
movzx eax, word [0x4186ac]
mov ecx, dword [0x418a58]
mov dword [ecx + eax*4], ebx
push str.
lea eax, [ebp - 0xcd4]
push eax
mov byte [ebp - 0xcd0], 0
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x405aa7
push ebx
push dword [ebp - 8]
lea eax, [ebp - 0xcd4]
push edi
push eax
call fcn.00401579
add esp, 0x10
push str.Title:
lea eax, [ebp - 0xcd4]
push eax
mov byte [ebp - 0xcce], 0
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x405975
cmp byte [ebp - 0xcd4], 0
jne 0x40593b
cmp byte [ebp - 0xcd4], 0
je 0x405aa7
lea eax, [ebp - 0xcd4]
push eax
call fcn.00402602
pop ecx
push ebx
push dword [ebp - 8]
lea eax, [ebp - 0xcd4]
push edi
push eax
call fcn.00401579
add esp, 0x10
cmp byte [ebp - 0xcd4], 0
je 0x408916
xor ebx, ebx
cmp dword [0x418ba0], ebx
je 0x405a66
push 1
push ebx
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll__llseek]
cmp dword [ebp - 0x34], eax
mov dword [0x418b38], eax
je 0x405a66
push 0xef6
push dword [0x418ba0]
mov dword [ebp - 0x34], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp eax, ebx
je 0x405a66
lea ecx, [ebp - 0x44]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x44]
mov edi, dword [sym.imp.USER32.dll_ScreenToClient]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x418ba0]
call edi
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x418ba0]
call edi
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
push ebx
lea eax, [ebp - 0x44]
push eax
push dword [0x418ba0]
call dword [sym.imp.USER32.dll_InvalidateRect]
push dword [0x418ba0]
call dword [sym.imp.USER32.dll_UpdateWindow]
lea eax, [ebp - 0xcd4]
push str.Non_System_File:
push eax
mov dword [ebp - 0xc], 1
call fcn.0041322e
test eax, eax
mov ebx, dword [ebp - 8]
pop ecx
pop ecx
mov edi, 0x800
jne 0x405afc
push eax
push ebx
lea eax, [ebp - 0xcd4]
push edi
push eax
mov dword [ebp - 0x14], 1
call fcn.00401579
add esp, 0x10
jmp 0x405b00
mov esi, pe_nt_image_headers32
push esi
lea eax, [ebp - 0xcd4]
push eax
push 4
push dword [0x418790]
call fcn.004033e3
push esi
lea eax, [ebp - 0x454]
push eax
push 2
push dword [0x418790]
call fcn.004033e3
mov eax, dword [0x418ba0]
add esp, 0x20
cmp eax, ebx
je 0x405ae9
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
lea eax, [ebp - 0x454]
push ebx
push eax
lea eax, [ebp - 0xcd4]
jmp 0x408906
and dword [ebp - 0x14], 0
lea eax, [ebp - 0xcd4]
push str.Shared_DLL_counter_ignored:
push eax
call fcn.0041322e
test eax, eax
pop ecx
pop ecx
jne 0x405b32
push eax
push ebx
lea eax, [ebp - 0xcd4]
push edi
push eax
mov dword [ebp - 0x10], 1
call fcn.00401579
add esp, 0x10
jmp 0x405b36
and dword [ebp - 0x10], 0
push 0xb
lea eax, [ebp - 0xcd4]
push str.File_Copy:
push eax
call fcn.00413271
add esp, 0xc
test eax, eax
je 0x407d75
push 0xc
lea eax, [ebp - 0xcd4]
push str.Shell_Link:
push eax
call fcn.00413271
add esp, 0xc
test eax, eax
je 0x407d75
push 0x10
lea eax, [ebp - 0xcd4]
push str.File_Overwrite:
push eax
call fcn.00413271
add esp, 0xc
test eax, eax
je 0x407d75
push 0xb
lea eax, [ebp - 0xcd4]
push str.RegDB_Key:
push eax
call fcn.00413271
add esp, 0xc
test eax, eax
jne 0x406096
lea eax, [ebp - 0xcc9]
push eax
lea eax, [ebp - 0x254]
push eax
call esi
push 0
push ebx
lea eax, [ebp - 0xcd4]
push edi
push eax
call fcn.00401579
push 0xb
lea eax, [ebp - 0xcd4]
push str.RegDB_Val:
push eax
call fcn.00413271
add esp, 0x1c
test eax, eax
jne 0x4088a4
lea eax, [ebp - 0xcc9]
push eax
lea eax, [ebp - 0x3208]
push eax
call esi
push 0
push dword [ebp - 8]
lea eax, [ebp - 0xcd4]
push 0x800
push eax
call fcn.00401579
push 0xb
lea eax, [ebp - 0xcd4]
push str.RegDB_Val:
push eax
call fcn.00413271
add esp, 0x1c
test eax, eax
je 0x405bfc
push 0xc
lea eax, [ebp - 0xcd4]
push str.RegDB_Name:
xor ebx, ebx
push eax
mov byte [ebp - 0x17d8], 0
mov dword [ebp - 4], ebx
call fcn.00413271
add esp, 0xc
test eax, eax
jne 0x405c7d
lea eax, [ebp - 0xcc8]
push eax
lea eax, [ebp - 0x17d8]
push eax
call esi
push ebx
push dword [ebp - 8]
mov edi, 0x800
lea eax, [ebp - 0xcd4]
push edi
push eax
call fcn.00401579
add esp, 0x10
jmp 0x405c82
mov edi, 0x800
push 0xc
lea eax, [ebp - 0xcd4]
push str.RegDB_Type:
push eax
call fcn.00413271
add esp, 0xc
test eax, eax
jne 0x405cc0
lea eax, [ebp - 0xcc8]
push eax
call fcn.0040e74f
push 0
push dword [ebp - 8]
mov dword [ebp - 4], eax
lea eax, [ebp - 0xcd4]
push edi
push eax
call fcn.00401579
add esp, 0x14
push 0xc
lea eax, [ebp - 0xcd4]
push str.RegDB_Root:
push eax
call fcn.00413271
add esp, 0xc
test eax, eax
jne 0x405d0f
lea eax, [ebp - 0xcc8]
push eax
call fcn.0040e74f
push 0
push dword [ebp - 8]
mov ebx, eax
lea eax, [ebp - 0xcd4]
push edi
push eax
call fcn.00401579
add esp, 0x14
cmp ebx, 1
jne 0x405d0f
cmp dword [0x418a40], 0
jne 0x4088a4
push ebx
lea eax, [ebp - 0x50]
push 0x414f6c
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push 0x10
call fcn.00401fe8
mov ecx, dword [0x41870c]
mov edx, dword [0x4186a0]
mov dword [ecx + edx*4], eax
mov eax, dword [0x41870c]
mov ecx, dword [0x4186a0]
mov edi, dword [eax + ecx*4]
add esp, 0x10
inc dword [0x4186a0]
lea eax, [ebp - 0x3208]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
call fcn.00401fe8
pop ecx
lea ecx, [ebp - 0x3208]
push ecx
push eax
mov dword [edi + 0xc], eax
call esi
and dword [edi], 0
and dword [edi + 8], 0
push 0xb
lea eax, [ebp - 0xcd4]
push str.RegDB_Old:
push eax
call fcn.00413271
add esp, 0xc
test eax, eax
jne 0x405f8e
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x17d8]
push eax
mov dword [edi], 1
mov ecx, dword [0x418788]
lea eax, [ebp - 0x254]
push eax
mov eax, dword [0x418728]
push ecx
push 0x1224
push dword [eax]
lea eax, [eax + ecx*4]
push eax
call fcn.00402111
add esp, 0x1c
test eax, eax
mov dword [ebp - 0x10], eax
jne 0x405f18
mov ecx, dword [0x418788]
mov eax, dword [0x418728]
mov eax, dword [eax + ecx*4]
and dword [eax + 0x121c], 0
mov ecx, dword [0x418788]
mov eax, dword [0x418728]
mov eax, dword [eax + ecx*4]
mov ecx, dword [ebp - 4]
mov dword [eax + 0x1218], ecx
mov ecx, dword [0x418788]
mov eax, dword [0x418728]
mov eax, dword [eax + ecx*4]
mov dword [eax + 0x1214], ebx
mov ecx, dword [0x418788]
mov eax, dword [0x418728]
mov eax, dword [eax + ecx*4]
mov cx, word [0x4186ac]
mov word [eax + 0x1220], cx
mov ecx, dword [0x418788]
lea eax, [ebp - 0x254]
push eax
mov eax, dword [0x418728]
mov eax, dword [eax + ecx*4]
add eax, 8
push eax
call esi
mov ecx, dword [0x418788]
lea eax, [ebp - 0x17d8]
push eax
mov eax, dword [0x418728]
mov eax, dword [eax + ecx*4]
add eax, 0x108
push eax
call esi
mov ecx, dword [0x418788]
lea eax, [ebp - 0x50]
push eax
mov eax, dword [0x418728]
mov eax, dword [eax + ecx*4]
add eax, 0x208
push eax
call esi
mov eax, dword [0x418788]
mov ecx, dword [0x418728]
mov ebx, dword [ecx + eax*4]
add ebx, 0x214
lea eax, [ebp - 0xcc9]
push eax
push ebx
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push 0
push dword [ebp - 8]
lea ebx, [ebx + eax + 1]
lea eax, [ebp - 0xcd4]
push 0x800
push eax
call fcn.00401579
push 0xb
lea eax, [ebp - 0xcd4]
push str.RegDB_Old:
push eax
call fcn.00413271
add esp, 0x1c
test eax, eax
je 0x405e97
mov byte [ebx], 0
mov ecx, dword [0x418788]
mov eax, dword [0x418728]
mov eax, dword [eax + ecx*4]
lea ecx, [eax + 0x214]
push ecx
add eax, 0xa14
push eax
call esi
mov eax, dword [0x418788]
mov ecx, dword [0x418728]
mov eax, dword [ecx + eax*4]
mov dword [edi + 8], eax
inc dword [0x418788]
jmp 0x4088a4
lea ebx, [ebp - 0x20e8]
lea eax, [ebp - 0xcc9]
push eax
push ebx
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push 0
push dword [ebp - 8]
lea ebx, [ebx + eax + 1]
lea eax, [ebp - 0xcd4]
push 0x800
push eax
call fcn.00401579
push 0xb
lea eax, [ebp - 0xcd4]
push str.RegDB_Old:
push eax
call fcn.00413271
add esp, 0x1c
test eax, eax
je 0x405f1e
lea eax, [ebp - 0x20e8]
push eax
mov eax, dword [ebp - 0x10]
add eax, 0xa14
push eax
mov byte [ebx], 0
call esi
mov cx, word [0x4186ac]
mov eax, dword [ebp - 0x10]
mov word [eax + 0x1220], cx
jmp 0x40608e
mov eax, dword [ebp - 4]
mov dword [edi + 4], eax
mov ecx, dword [0x418b34]
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x17d8]
push eax
lea eax, [ebp - 0x254]
push eax
mov eax, dword [0x41872c]
push ecx
push 0x224
push dword [eax]
lea eax, [eax + ecx*4]
push eax
call fcn.00402111
add esp, 0x1c
test eax, eax
jne 0x406080
mov ecx, dword [0x418b34]
mov eax, dword [0x41872c]
mov eax, dword [eax + ecx*4]
and dword [eax + 0x21c], 0
mov ecx, dword [0x418b34]
mov eax, dword [0x41872c]
mov eax, dword [eax + ecx*4]
mov dword [eax + 0x218], ebx
mov ecx, dword [0x418b34]
mov eax, dword [0x41872c]
mov eax, dword [eax + ecx*4]
mov cx, word [0x4186ac]
mov word [eax + 0x220], cx
mov ecx, dword [0x418b34]
lea eax, [ebp - 0x254]
push eax
mov eax, dword [0x41872c]
mov eax, dword [eax + ecx*4]
add eax, 8
push eax
call esi
mov ecx, dword [0x418b34]
lea eax, [ebp - 0x17d8]
push eax
mov eax, dword [0x41872c]
mov eax, dword [eax + ecx*4]
add eax, 0x10c
push eax
call esi
mov ecx, dword [0x418b34]
lea eax, [ebp - 0x50]
push eax
mov eax, dword [0x41872c]
mov eax, dword [eax + ecx*4]
add eax, 0x20c
push eax
call esi
mov eax, dword [0x418b34]
mov ecx, dword [0x41872c]
mov eax, dword [ecx + eax*4]
mov dword [edi + 8], eax
inc dword [0x418b34]
jmp 0x4088a4
mov cx, word [0x4186ac]
mov word [eax + 0x220], cx
mov dword [edi + 8], eax
jmp 0x4088a4
push 0xb
lea eax, [ebp - 0xcd4]
push str.File_Edit:
push eax
call fcn.00413271
add esp, 0xc
test eax, eax
jne 0x4062ad
lea eax, [ebp - 0xcc9]
push eax
lea eax, [ebp - 0x10d4]
push eax
call esi
push 0
push ebx
lea eax, [ebp - 0xcd4]
push edi
push eax
call fcn.00401579
push 0xd
lea eax, [ebp - 0xcd4]
push str.Backup_Copy:
push eax
mov byte [ebp - 0xfd4], 0
call fcn.00413271
add esp, 0x1c
test eax, eax
jne 0x406107
lea eax, [ebp - 0xcc7]
push eax
lea eax, [ebp - 0xfd4]
push eax
call esi
jmp 0x40610b
and dword [ebp - 0xc], 0
push 2
pop edi
push edi
lea eax, [ebp - 0x10d4]
push 0x414f40
push eax
call fcn.00413271
add esp, 0xc
test eax, eax
jne 0x406130
cmp dword [ebp - 0x1c], edi
je 0x408885
push edi
lea eax, [ebp - 0x10d4]
push 0x414f3c
push eax
call fcn.00413271
add esp, 0xc
test eax, eax
jne 0x406152
cmp dword [ebp - 0x18], edi
je 0x408885
cmp byte [ebp - 0xfd4], 0
je 0x408885
lea eax, [ebp - 0x10d4]
push 0
push eax
call fcn.00401d5c
test eax, eax
pop ecx
pop ecx
jne 0x408885
lea eax, [ebp - 0x10d4]
push eax
lea eax, [ebp - 0x454]
push eax
call esi
xor ebx, ebx
xor edi, edi
cmp dword [0x4186fc], ebx
jle 0x4061be
mov eax, dword [0x418af0]
push dword [eax + edi*4]
lea eax, [ebp - 0x10d4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
mov eax, dword [0x4186fc]
je 0x4061b6
inc edi
cmp edi, eax
jl 0x406193
cmp edi, eax
jl 0x406277
push 0x20a
call fcn.00401fe8
mov edx, dword [0x418af0]
pop ecx
mov ecx, dword [0x4186fc]
mov dword [edx + ecx*4], eax
cmp dword [0x418b3c], ebx
mov ecx, dword [0x418af0]
je 0x4061f9
lea eax, [ebp - 0x10d4]
push eax
mov eax, dword [0x4186fc]
push dword [ecx + eax*4]
call esi
jmp 0x40620e
mov eax, dword [0x4186fc]
push dword [ecx + eax*4]
lea eax, [ebp - 0x10d4]
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
cmp dword [0x418b3c], ebx
mov ecx, dword [0x418af0]
je 0x406235
lea eax, [ebp - 0xfd4]
push eax
mov eax, dword [0x4186fc]
mov eax, dword [ecx + eax*4]
add eax, 0x104
push eax
call esi
jmp 0x406250
mov eax, dword [0x4186fc]
mov eax, dword [ecx + eax*4]
add eax, 0x104
push eax
lea eax, [ebp - 0xfd4]
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov eax, dword [0x4186fc]
mov ecx, dword [0x418af0]
mov eax, dword [ecx + eax*4]
mov cx, word [0x4186ac]
mov word [eax + 0x208], cx
inc dword [0x4186fc]
jmp 0x408885
mov ecx, dword [0x418af0]
mov dx, word [0x4186ac]
mov eax, edi
shl eax, 2
mov ecx, dword [ecx + eax]
mov word [ecx + 0x208], dx
lea ecx, [ebp - 0xfd4]
push ecx
mov ecx, dword [0x418af0]
mov eax, dword [ecx + eax]
add eax, 0x104
jmp 0x4087d6
push 0x10
lea eax, [ebp - 0xcd4]
push str.Create_Service:
push eax
call fcn.00413271
add esp, 0xc
test eax, eax
jne 0x406384
xor edi, edi
cmp dword [0x418714], edi
jle 0x4062fc
mov eax, dword [0x418a34]
push dword [eax + edi*4]
lea eax, [ebp - 0xcc4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
mov eax, dword [0x418714]
je 0x4062f8
inc edi
cmp edi, eax
jl 0x4062d5
cmp edi, eax
jl 0x406369
push 0x10c
call fcn.00401fe8
mov edx, dword [0x418714]
pop ecx
mov ecx, dword [0x418a34]
mov dword [ecx + edx*4], eax
mov ecx, dword [0x418714]
mov eax, dword [0x418a34]
mov eax, dword [eax + ecx*4]
and dword [eax + 0x104], 0
mov ecx, dword [0x418714]
mov eax, dword [0x418a34]
mov eax, dword [eax + ecx*4]
mov cx, word [0x4186ac]
mov word [eax + 0x108], cx
mov ecx, dword [0x418a34]
lea eax, [ebp - 0xcc4]
push eax
mov eax, dword [0x418714]
push dword [ecx + eax*4]
call esi
inc dword [0x418714]
jmp 0x40888b
mov eax, dword [0x418a34]
mov eax, dword [eax + edi*4]
mov cx, word [0x4186ac]
mov word [eax + 0x108], cx
jmp 0x40888b
push 0xc
lea eax, [ebp - 0xcd4]
push str.Add_Device:
push eax
call fcn.00413271
add esp, 0xc
test eax, eax
jne 0x406433
xor edi, edi
cmp dword [0x418720], edi
jle 0x4063e8
lea eax, [ebp - 0xcc8]
push eax
mov eax, dword [0x418778]
mov eax, dword [eax + edi*4]
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4063df
mov eax, dword [0x418778]
mov eax, dword [eax + edi*4]
mov cx, word [0x4186ac]
mov word [eax + 0x26e], cx
inc edi
cmp edi, dword [0x418720]
jl 0x4063ac
xor edi, edi
cmp dword [0x418a64], edi
jle 0x40888b
lea eax, [ebp - 0xcc8]
push eax
mov eax, dword [0x418b5c]
push dword [eax + edi*4]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x406425
mov eax, dword [0x418b5c]
mov eax, dword [eax + edi*4]
mov cx, word [0x4186ac]
mov word [eax + 0x266], cx
inc edi
cmp edi, dword [0x418a64]
jl 0x4063f6
jmp 0x40888b
push 0xf
lea eax, [ebp - 0xcd4]
push str.Self_Register:
push eax
call fcn.00413271
add esp, 0xc
test eax, eax
jne 0x406a8f
lea eax, [ebp - 0xcc5]
push eax
lea eax, [ebp - 0x454]
push eax
call esi
lea eax, [ebp - 0x454]
push 0x7e
push eax
call fcn.004025e3
test eax, eax
pop ecx
pop ecx
je 0x406628
cmp dword [0x4186c0], 0
je 0x406628
lea eax, [ebp - 0x454]
push 0x5c
push eax
call fcn.004025e3
test eax, eax
pop ecx
pop ecx
jne 0x4064fd
lea eax, [ebp - 0x454]
push eax
lea eax, [ebp - 0x18d8]
push eax
call esi
lea eax, [ebp - 0x454]
push pe_nt_image_headers32
push eax
call fcn.0040eab2
pop ecx
pop ecx
lea eax, [ebp - 0x454]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [ebp - 0x454]
dec ecx
cmp byte [eax + ecx], 0x5c
je 0x4064e9
push 0x414474
lea eax, [ebp - 0x454]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x18d8]
push eax
lea eax, [ebp - 0x454]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp dword [0x41806c], 1
movsx eax, byte [ebp - 0x454]
lea edi, [ebp - 0x454]
jle 0x406522
push 0x103
push eax
call fcn.0040e5a2
pop ecx
pop ecx
jmp 0x406531
mov ecx, dword [str.________________________________H]
movzx eax, word [ecx + eax*2]
and eax, 0x103
test eax, eax
je 0x406552
cmp byte [ebp - 0x453], 0x3a
jne 0x406552
movsx eax, byte [ebp - 0x454]
push eax
call fcn.0040e620
pop ecx
mov byte [ebp - 0x454], al
cmp byte [ebp - 0x454], 0x5c
jne 0x406583
cmp byte [ebp - 0x453], 0x5c
jne 0x40658c
mov al, byte [ebp - 0x452]
lea edi, [ebp - 0x452]
jmp 0x406579
cmp al, 0x5c
je 0x406582
inc edi
mov al, byte [edi]
test al, al
jne 0x406572
cmp byte [edi], 0x5c
jne 0x406583
inc edi
cmp byte [edi], 0
je 0x406619
mov al, byte [edi]
cmp al, 0x5c
je 0x40661e
inc edi
mov al, byte [edi]
test al, al
jne 0x40658e
jmp 0x406619
cmp byte [edi], 0
mov ebx, edi
je 0x4065b1
cmp byte [ebx], 0x5c
je 0x4065b1
inc ebx
cmp byte [ebx], 0
jne 0x4065a6
push ebx
lea eax, [ebp - 0x18d8]
push eax
call esi
lea eax, [ebp - 0x27c0]
push eax
lea eax, [ebp - 0x454]
push 0x17
push eax
mov byte [ebx], 0
call fcn.00401cc6
add esp, 0xc
test eax, eax
jne 0x4065f1
lea eax, [ebp - 0x27c0]
push eax
push edi
call esi
lea eax, [ebp - 0x27c0]
push eax
call fcn.00401d45
pop ecx
lea eax, [ebp - 0x454]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edi, [ebp + eax - 0x454]
lea eax, [ebp - 0x18d8]
push eax
lea eax, [ebp - 0x454]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp byte [edi], 0x5c
jne 0x40661f
inc edi
cmp byte [edi], 0
jne 0x40659f
and dword [ebp - 0xc], 0
cmp dword [0x418720], 0
jle 0x40685b
mov eax, dword [0x418778]
mov ecx, dword [ebp - 0xc]
mov eax, dword [eax + ecx*4]
add eax, 8
push eax
lea eax, [ebp - 0x254]
push eax
call esi
lea eax, [ebp - 0x254]
push 0x7e
push eax
call fcn.004025e3
test eax, eax
pop ecx
pop ecx
je 0x406818
cmp dword [0x4186c0], 0
je 0x406818
lea eax, [ebp - 0x254]
push 0x5c
push eax
call fcn.004025e3
test eax, eax
pop ecx
pop ecx
jne 0x4066ed
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x19d8]
push eax
call esi
lea eax, [ebp - 0x254]
push pe_nt_image_headers32
push eax
call fcn.0040eab2
pop ecx
pop ecx
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [ebp - 0x254]
dec ecx
cmp byte [eax + ecx], 0x5c
je 0x4066d9
push 0x414474
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x19d8]
push eax
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp dword [0x41806c], 1
movsx eax, byte [ebp - 0x254]
lea edi, [ebp - 0x254]
jle 0x406712
push 0x103
push eax
call fcn.0040e5a2
pop ecx
pop ecx
jmp 0x406721
mov ecx, dword [str.________________________________H]
movzx eax, word [ecx + eax*2]
and eax, 0x103
test eax, eax
je 0x406742
cmp byte [ebp - 0x253], 0x3a
jne 0x406742
movsx eax, byte [ebp - 0x254]
push eax
call fcn.0040e620
pop ecx
mov byte [ebp - 0x254], al
cmp byte [ebp - 0x254], 0x5c
jne 0x406773
cmp byte [ebp - 0x253], 0x5c
jne 0x40677c
mov al, byte [ebp - 0x252]
lea edi, [ebp - 0x252]
jmp 0x406769
cmp al, 0x5c
je 0x406772
inc edi
mov al, byte [edi]
test al, al
jne 0x406762
cmp byte [edi], 0x5c
jne 0x406773
inc edi
cmp byte [edi], 0
je 0x406809
mov al, byte [edi]
cmp al, 0x5c
je 0x40680e
inc edi
mov al, byte [edi]
test al, al
jne 0x40677e
jmp 0x406809
cmp byte [edi], 0
mov ebx, edi
je 0x4067a1
cmp byte [ebx], 0x5c
je 0x4067a1
inc ebx
cmp byte [ebx], 0
jne 0x406796
push ebx
lea eax, [ebp - 0x19d8]
push eax
call esi
lea eax, [ebp - 0x2a08]
push eax
lea eax, [ebp - 0x254]
push 0x17
push eax
mov byte [ebx], 0
call fcn.00401cc6
add esp, 0xc
test eax, eax
jne 0x4067e1
lea eax, [ebp - 0x2a08]
push eax
push edi
call esi
lea eax, [ebp - 0x2a08]
push eax
call fcn.00401d45
pop ecx
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edi, [ebp + eax - 0x254]
lea eax, [ebp - 0x19d8]
push eax
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp byte [edi], 0x5c
jne 0x40680f
inc edi
cmp byte [edi], 0
jne 0x40678f
lea eax, [ebp - 0x454]
push eax
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x406849
mov eax, dword [0x418778]
mov ecx, dword [ebp - 0xc]
mov eax, dword [eax + ecx*4]
mov cx, word [0x4186ac]
mov word [eax + 0x26c], cx
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp eax, dword [0x418720]
jl 0x406639
and dword [ebp - 0xc], 0
cmp dword [0x418a64], 0
jle 0x40888b
mov eax, dword [0x418b5c]
mov ecx, dword [ebp - 0xc]
push dword [eax + ecx*4]
lea eax, [ebp - 0x254]
push eax
call esi
lea eax, [ebp - 0x254]
push 0x7e
push eax
call fcn.004025e3
test eax, eax
pop ecx
pop ecx
je 0x406a47
cmp dword [0x4186c0], 0
je 0x406a47
lea eax, [ebp - 0x254]
push 0x5c
push eax
call fcn.004025e3
test eax, eax
pop ecx
pop ecx
jne 0x40691c
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x1ad8]
push eax
call esi
lea eax, [ebp - 0x254]
push pe_nt_image_headers32
push eax
call fcn.0040eab2
pop ecx
pop ecx
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [ebp - 0x254]
dec ecx
cmp byte [eax + ecx], 0x5c
je 0x406908
push 0x414474
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x1ad8]
push eax
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp dword [0x41806c], 1
movsx eax, byte [ebp - 0x254]
lea edi, [ebp - 0x254]
jle 0x406941
push 0x103
push eax
call fcn.0040e5a2
pop ecx
pop ecx
jmp 0x406950
mov ecx, dword [str.________________________________H]
movzx eax, word [ecx + eax*2]
and eax, 0x103
test eax, eax
je 0x406971
cmp byte [ebp - 0x253], 0x3a
jne 0x406971
movsx eax, byte [ebp - 0x254]
push eax
call fcn.0040e620
pop ecx
mov byte [ebp - 0x254], al
cmp byte [ebp - 0x254], 0x5c
jne 0x4069a2
cmp byte [ebp - 0x253], 0x5c
jne 0x4069ab
mov al, byte [ebp - 0x252]
lea edi, [ebp - 0x252]
jmp 0x406998
cmp al, 0x5c
je 0x4069a1
inc edi
mov al, byte [edi]
test al, al
jne 0x406991
cmp byte [edi], 0x5c
jne 0x4069a2
inc edi
cmp byte [edi], 0
je 0x406a38
mov al, byte [edi]
cmp al, 0x5c
je 0x406a3d
inc edi
mov al, byte [edi]
test al, al
jne 0x4069ad
jmp 0x406a38
cmp byte [edi], 0
mov ebx, edi
je 0x4069d0
cmp byte [ebx], 0x5c
je 0x4069d0
inc ebx
cmp byte [ebx], 0
jne 0x4069c5
push ebx
lea eax, [ebp - 0x1ad8]
push eax
call esi
lea eax, [ebp - 0x2578]
push eax
lea eax, [ebp - 0x254]
push 0x17
push eax
mov byte [ebx], 0
call fcn.00401cc6
add esp, 0xc
test eax, eax
jne 0x406a10
lea eax, [ebp - 0x2578]
push eax
push edi
call esi
lea eax, [ebp - 0x2578]
push eax
call fcn.00401d45
pop ecx
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edi, [ebp + eax - 0x254]
lea eax, [ebp - 0x1ad8]
push eax
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp byte [edi], 0x5c
jne 0x406a3e
inc edi
cmp byte [edi], 0
jne 0x4069be
lea eax, [ebp - 0x454]
push eax
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x406a78
mov eax, dword [0x418b5c]
mov ecx, dword [ebp - 0xc]
mov eax, dword [eax + ecx*4]
mov cx, word [0x4186ac]
mov word [eax + 0x264], cx
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp eax, dword [0x418a64]
jl 0x40686c
jmp 0x40888b
push 9
lea eax, [ebp - 0xcd4]
push str.INI_New:
push eax
call fcn.00413271
add esp, 0xc
test eax, eax
lea eax, [ebp - 0xcd4]
jne 0x406c5d
push 0
push ebx
push edi
push eax
call fcn.00401579
push 0xa
lea eax, [ebp - 0xcd4]
push str.INI_File:
push eax
call fcn.00413271
add esp, 0x1c
test eax, eax
jne 0x4088a4
push 2
pop edi
push edi
lea eax, [ebp - 0xcca]
push 0x414f40
push eax
call fcn.00413271
add esp, 0xc
test eax, eax
jne 0x406b00
cmp dword [ebp - 0x1c], edi
je 0x406c0e
push edi
lea eax, [ebp - 0xcca]
push 0x414f3c
push eax
call fcn.00413271
add esp, 0xc
test eax, eax
jne 0x406b22
cmp dword [ebp - 0x18], edi
je 0x406c0e
xor ebx, ebx
lea eax, [ebp - 0xcca]
push ebx
push eax
call fcn.00401d5c
test eax, eax
pop ecx
pop ecx
jne 0x406c0e
xor edi, edi
cmp dword [0x418a68], ebx
jle 0x406b70
mov eax, dword [0x418a28]
push dword [eax + edi*4]
lea eax, [ebp - 0xcca]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
mov eax, dword [0x418a68]
je 0x406b68
inc edi
cmp edi, eax
jl 0x406b45
cmp edi, eax
jl 0x406bf8
push 0x10c
call fcn.00401fe8
mov edx, dword [0x418a68]
pop ecx
mov ecx, dword [0x418a28]
mov dword [ecx + edx*4], eax
mov ecx, dword [0x418a28]
mov eax, dword [0x418a68]
mov eax, dword [ecx + eax*4]
mov dword [eax + 0x104], ebx
cmp dword [0x418b3c], ebx
mov ecx, dword [0x418a28]
je 0x406bbf
lea eax, [ebp - 0xcca]
push eax
mov eax, dword [0x418a68]
push dword [ecx + eax*4]
call esi
jmp 0x406bd4
mov eax, dword [0x418a68]
push dword [ecx + eax*4]
lea eax, [ebp - 0xcca]
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
mov eax, dword [0x418a68]
mov ecx, dword [0x418a28]
mov eax, dword [ecx + eax*4]
mov cx, word [0x4186ac]
mov word [eax + 0x108], cx
inc dword [0x418a68]
jmp 0x406c0e
mov eax, dword [0x418a28]
mov eax, dword [eax + edi*4]
mov cx, word [0x4186ac]
mov word [eax + 0x108], cx
push 0
push dword [ebp - 8]
lea eax, [ebp - 0xcd4]
push 0x800
push eax
call fcn.00401579
push 4
lea eax, [ebp - 0xcd4]
push str.INI
push eax
call fcn.00413271
add esp, 0x1c
test eax, eax
jne 0x4088a4
cmp byte [ebp - 0xcd0], 0x46
je 0x4088a4
cmp byte [ebp - 0xcd0], 0x4e
jne 0x406c0e
jmp 0x4088a4
push 0xa
push str.INI_File:
push eax
call fcn.00413271
add esp, 0xc
test eax, eax
jne 0x406f07
push 2
lea eax, [ebp - 0xcca]
push 0x414f40
push eax
call fcn.00413271
add esp, 0xc
test eax, eax
jne 0x406c95
cmp dword [ebp - 0x1c], 2
je 0x406cb5
push 2
lea eax, [ebp - 0xcca]
push 0x414f3c
push eax
call fcn.00413271
add esp, 0xc
test eax, eax
jne 0x406cbb
cmp dword [ebp - 0x18], 2
jne 0x406cbb
and dword [ebp - 0x10], 0
jmp 0x406cc2
mov dword [ebp - 0x10], 1
cmp dword [0x418b3c], 0
je 0x406cdd
lea eax, [ebp - 0xcca]
push eax
lea eax, [ebp - 0x17d8]
push eax
call esi
jmp 0x406cf1
lea eax, [ebp - 0x17d8]
push eax
lea eax, [ebp - 0xcca]
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
push 0
push ebx
lea eax, [ebp - 0xcd4]
push edi
push eax
call fcn.00401579
add esp, 0x10
cmp dword [ebp - 0x10], 0
je 0x40888b
and dword [ebp - 0xc], 0
push 0xa
lea eax, [ebp - 0xcd4]
push str.INI_Sect:
push eax
call fcn.00413271
add esp, 0xc
test eax, eax
jne 0x4088a4
lea eax, [ebp - 0xcca]
push eax
lea eax, [ebp - 0x454]
push eax
call esi
push 0
push dword [ebp - 8]
lea eax, [ebp - 0xcd4]
push 0x800
push eax
call fcn.00401579
push 0xa
lea eax, [ebp - 0xcd4]
push str.INI_Item:
push eax
call fcn.00413271
add esp, 0x1c
test eax, eax
jne 0x4088a4
lea eax, [ebp - 0xcca]
push eax
lea eax, [ebp - 0x254]
push eax
call esi
push 0
push dword [ebp - 8]
lea eax, [ebp - 0xcd4]
push 0x800
push eax
call fcn.00401579
push 9
lea eax, [ebp - 0xcd4]
push str.INI_Val:
push eax
call fcn.00413271
add esp, 0x1c
test eax, eax
jne 0x4088a4
push eax
push dword [ebp - 8]
lea eax, [ebp - 0xcd4]
push 0x800
push eax
call fcn.00401579
push 9
lea eax, [ebp - 0xcd4]
push str.INI_Old:
push eax
call fcn.00413271
add esp, 0x1c
test eax, eax
jne 0x406df6
mov dword [ebp - 0xc], 1
lea edi, [ebp - 0xccb]
jmp 0x406dfb
mov edi, 0x41461e
mov ecx, dword [0x418718]
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x454]
push eax
lea eax, [ebp - 0x17d8]
push eax
mov eax, dword [0x418ae0]
push ecx
push 0x714
push dword [eax]
lea eax, [eax + ecx*4]
push eax
call fcn.00402111
add esp, 0x1c
test eax, eax
jne 0x406efc
mov ecx, dword [0x418718]
mov eax, dword [0x418ae0]
mov eax, dword [eax + ecx*4]
and dword [eax + 0x70c], 0
mov ecx, dword [0x418718]
mov eax, dword [0x418ae0]
mov eax, dword [eax + ecx*4]
mov cx, word [0x4186ac]
mov word [eax + 0x710], cx
mov ecx, dword [0x418718]
lea eax, [ebp - 0x17d8]
push eax
mov eax, dword [0x418ae0]
mov eax, dword [eax + ecx*4]
add eax, 8
push eax
call esi
mov ecx, dword [0x418718]
lea eax, [ebp - 0x454]
push eax
mov eax, dword [0x418ae0]
mov eax, dword [eax + ecx*4]
add eax, 0x10c
push eax
call esi
mov ecx, dword [0x418718]
lea eax, [ebp - 0x254]
push eax
mov eax, dword [0x418ae0]
mov eax, dword [eax + ecx*4]
add eax, 0x20c
push eax
call esi
mov eax, dword [0x418ae0]
mov ecx, dword [0x418718]
mov eax, dword [eax + ecx*4]
push edi
add eax, 0x30c
push eax
call esi
mov ecx, dword [0x418ae0]
mov eax, dword [0x418718]
mov eax, dword [ecx + eax*4]
lea ecx, [eax + 0x30c]
push ecx
add eax, 0x50c
push eax
call esi
inc dword [0x418718]
jmp 0x408885
push edi
add eax, 0x50c
jmp 0x4087d6
push 0xe
lea eax, [ebp - 0xcd4]
push str.Execute_Path:
push eax
call fcn.00413271
add esp, 0xc
test eax, eax
je 0x407c38
push 0x11
lea eax, [ebp - 0xcd4]
push str.Execute_Program:
push eax
call fcn.00413271
add esp, 0xc
test eax, eax
je 0x407c38
push 0xc
lea eax, [ebp - 0xcd4]
push str.Icon_Group:
push eax
call fcn.00413271
add esp, 0xc
test eax, eax
jne 0x4070f8
lea eax, [ebp - 0xcc8]
push eax
lea eax, [ebp - 0x454]
push eax
call esi
push 0
push ebx
lea eax, [ebp - 0xcd4]
push edi
push eax
call fcn.00401579
push 0xb
lea eax, [ebp - 0xcd4]
push str.Icon_Name:
push eax
call fcn.00413271
add esp, 0x1c
test eax, eax
jne 0x4088a4
lea eax, [ebp - 0xcc9]
push eax
lea eax, [ebp - 0x254]
push eax
call esi
push 0
push dword [ebp - 8]
lea eax, [ebp - 0xcd4]
push 0x800
push eax
call fcn.00401579
push 0xa
lea eax, [ebp - 0xcd4]
push str.Icon_Cmd:
push eax
call fcn.00413271
add esp, 0x1c
test eax, eax
jne 0x4088a4
xor edi, edi
cmp dword [0x418670], edi
jle 0x407038
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea eax, [ebp - 0x454]
push eax
mov eax, dword [0x418b18]
push dword [eax + edi*4]
call ebx
test eax, eax
jne 0x407023
lea eax, [ebp - 0x254]
push eax
mov eax, dword [0x418b18]
mov eax, dword [eax + edi*4]
add eax, 0x100
push eax
call ebx
test eax, eax
je 0x40702c
inc edi
cmp edi, dword [0x418670]
jl 0x406ff3
cmp edi, dword [0x418670]
jl 0x4070df
push 0x308
call fcn.00401fe8
mov edx, dword [0x418670]
pop ecx
mov ecx, dword [0x418b18]
mov dword [ecx + edx*4], eax
mov ecx, dword [0x418670]
mov eax, dword [0x418b18]
mov eax, dword [eax + ecx*4]
and dword [eax + 0x300], 0
mov ecx, dword [0x418670]
mov eax, dword [0x418b18]
mov eax, dword [eax + ecx*4]
mov cx, word [0x4186ac]
mov word [eax + 0x304], cx
mov ecx, dword [0x418670]
lea eax, [ebp - 0x254]
push eax
mov eax, dword [0x418b18]
mov eax, dword [eax + ecx*4]
add eax, 0x100
push eax
call esi
mov ecx, dword [0x418670]
lea eax, [ebp - 0x454]
push eax
mov eax, dword [0x418b18]
push dword [eax + ecx*4]
call esi
mov ecx, dword [0x418b18]
lea eax, [ebp - 0xcca]
push eax
mov eax, dword [0x418670]
mov eax, dword [ecx + eax*4]
add eax, 0x200
push eax
call esi
inc dword [0x418670]
jmp 0x40888b
lea eax, [ebp - 0xcca]
push eax
mov eax, dword [0x418b18]
mov eax, dword [eax + edi*4]
add eax, 0x200
jmp 0x407a2d
push 0xc
lea eax, [ebp - 0xcd4]
push str.SubSystem:_B
push eax
call fcn.00413271
add esp, 0xc
test eax, eax
jne 0x407142
lea eax, [ebp - 0xcc9]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
call fcn.00401fe8
pop ecx
lea ecx, [ebp - 0xcc9]
push ecx
push eax
mov dword [0x418b40], eax
call esi
and dword [0x418710], 0
jmp 0x40888b
push 0xa
lea eax, [ebp - 0xcd4]
push str.Made_Dir:
push eax
call fcn.00413271
add esp, 0xc
test eax, eax
lea eax, [ebp - 0xcd4]
jne 0x40736d
push 0x414474
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0xcca]
push eax
lea eax, [ebp - 0x454]
push eax
call esi
lea eax, [ebp - 0x454]
push 0
push eax
call fcn.0040306b
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
pop ecx
pop ecx
lea eax, [ebp - 0x454]
push eax
call ebx
mov edi, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x454]
push edi
push eax
call fcn.00413271
add esp, 0xc
test eax, eax
jne 0x4071c6
lea eax, [ebp - 0x454]
push eax
call ebx
mov byte [eax + edi], 0
lea eax, [ebp - 0xcca]
push eax
call ebx
cmp eax, 3
mov dword [ebp - 4], eax
jle 0x40888b
cmp byte [ebp - 0xcca], 0x5c
jne 0x4071ed
cmp byte [ebp - 0xcc9], 0x5c
je 0x40723d
cmp dword [0x41806c], 1
movsx eax, byte [ebp - 0xcca]
jle 0x40720c
push 0x103
push eax
call fcn.0040e5a2
pop ecx
pop ecx
jmp 0x40721b
mov ecx, dword [str.________________________________H]
movzx eax, word [ecx + eax*2]
and eax, 0x103
test eax, eax
je 0x40888b
cmp byte [ebp - 0xcc9], 0x3a
jne 0x40888b
cmp byte [ebp - 0xcc8], 0x5c
jne 0x40888b
xor edi, edi
cmp dword [0x418ae4], edi
jle 0x407293
mov eax, dword [0x418b64]
push dword [eax + edi*4]
call ebx
cmp dword [ebp - 4], eax
jge 0x40725b
mov eax, dword [ebp - 4]
jmp 0x407265
mov eax, dword [0x418b64]
push dword [eax + edi*4]
call ebx
push eax
mov eax, dword [0x418b64]
push dword [eax + edi*4]
lea eax, [ebp - 0xcca]
push eax
call fcn.00413271
add esp, 0xc
test eax, eax
mov eax, dword [0x418ae4]
je 0x40728b
inc edi
cmp edi, eax
jl 0x407247
cmp edi, eax
jl 0x407332
push 0x10c
call fcn.00401fe8
mov edx, dword [0x418ae4]
pop ecx
mov ecx, dword [0x418b64]
mov dword [ecx + edx*4], eax
mov eax, dword [0x418b64]
mov ecx, dword [0x418ae4]
mov ecx, dword [eax + ecx*4]
xor eax, eax
mov dword [ecx + 0x104], eax
mov edx, dword [0x418ae4]
mov ecx, dword [0x418b64]
mov ecx, dword [ecx + edx*4]
mov word [ecx + 0x108], ax
mov edx, dword [0x418ae4]
mov ecx, dword [0x418b64]
mov ecx, dword [ecx + edx*4]
mov dx, word [0x4186ac]
mov word [ecx + 0x10a], dx
cmp dword [0x418b3c], eax
mov ecx, dword [0x418ae4]
je 0x407318
lea eax, [ebp - 0xcca]
push eax
mov eax, dword [0x418b64]
push dword [eax + ecx*4]
jmp 0x40764b
mov eax, dword [0x418b64]
push dword [eax + ecx*4]
lea eax, [ebp - 0xcca]
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
jmp 0x40764d
mov eax, dword [0x418b64]
shl edi, 2
push dword [edi + eax]
call ebx
cmp dword [ebp - 4], eax
jge 0x407349
mov eax, dword [ebp - 4]
jmp 0x407353
mov eax, dword [0x418b64]
push dword [edi + eax]
call ebx
mov ecx, dword [0x418b64]
mov ecx, dword [edi + ecx]
mov byte [eax + ecx], 0
mov eax, dword [0x418b64]
mov eax, dword [edi + eax]
jmp 0x40767d
push 0xd
push str.File_Delete:
push eax
call fcn.00413271
add esp, 0xc
test eax, eax
jne 0x4074a6
lea eax, [ebp - 0xcc7]
push eax
lea eax, [ebp - 0x1ee8]
push eax
call esi
push 0
push ebx
lea eax, [ebp - 0xcd4]
push edi
push eax
call fcn.00401579
push 0xd
lea eax, [ebp - 0xcd4]
push str.Backup_Copy:
push eax
call fcn.00413271
add esp, 0x1c
test eax, eax
jne 0x4088a4
xor edi, edi
cmp dword [0x4186f4], edi
mov dword [0x4186d0], 1
jle 0x4073fe
mov eax, dword [0x418a30]
push dword [eax + edi*4]
lea eax, [ebp - 0x1ee8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
mov eax, dword [0x4186f4]
je 0x4073fa
inc edi
cmp edi, eax
jl 0x4073d7
cmp edi, eax
jl 0x407473
push 0x20a
call fcn.00401fe8
mov edx, dword [0x4186f4]
pop ecx
mov ecx, dword [0x418a30]
mov dword [ecx + edx*4], eax
mov ecx, dword [0x4186f4]
mov eax, dword [0x418a30]
mov eax, dword [eax + ecx*4]
mov cx, word [0x4186ac]
mov word [eax + 0x208], cx
mov ecx, dword [0x4186f4]
lea eax, [ebp - 0x1ee8]
push eax
mov eax, dword [0x418a30]
push dword [eax + ecx*4]
call esi
mov ecx, dword [0x418a30]
lea eax, [ebp - 0xcc7]
push eax
mov eax, dword [0x4186f4]
mov eax, dword [ecx + eax*4]
add eax, 0x104
push eax
call esi
inc dword [0x4186f4]
jmp 0x40888b
lea ecx, [ebp - 0xcc7]
push ecx
mov ecx, dword [0x418a30]
mov eax, dword [ecx + eax*4]
add eax, 0x104
push eax
call esi
mov eax, dword [0x418a30]
mov eax, dword [eax + edi*4]
mov cx, word [0x4186ac]
mov word [eax + 0x208], cx
jmp 0x40888b
push 0xb
lea eax, [ebp - 0xcd4]
push str.File_Tree:
push eax
call fcn.00413271
add esp, 0xc
test eax, eax
jne 0x407690
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp - 0xcc9]
push eax
call ebx
lea edi, [ebp + eax - 0xccd]
push str..
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x4074ec
mov byte [edi], al
lea eax, [ebp - 0xcd4]
push 0x2a
push eax
call fcn.004025e3
test eax, eax
pop ecx
pop ecx
jne 0x407526
lea eax, [ebp - 0xcd4]
push 0x3f
push eax
call fcn.004025e3
test eax, eax
pop ecx
pop ecx
jne 0x407526
push 0x414474
lea eax, [ebp - 0xcd4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0xcc9]
push eax
call ebx
cmp eax, 3
jle 0x40888b
cmp byte [ebp - 0xcc9], 0x5c
jne 0x40754a
cmp byte [ebp - 0xcc8], 0x5c
je 0x40759a
cmp dword [0x41806c], 1
movsx eax, byte [ebp - 0xcc9]
jle 0x407569
push 0x103
push eax
call fcn.0040e5a2
pop ecx
pop ecx
jmp 0x407578
mov ecx, dword [str.________________________________H]
movzx eax, word [ecx + eax*2]
and eax, 0x103
test eax, eax
je 0x40888b
cmp byte [ebp - 0xcc8], 0x3a
jne 0x40888b
cmp byte [ebp - 0xcc7], 0x5c
jne 0x40888b
xor edi, edi
cmp dword [0x418ae4], edi
jle 0x4075cf
mov eax, dword [0x418b64]
push dword [eax + edi*4]
lea eax, [ebp - 0xcc9]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
mov eax, dword [0x418ae4]
je 0x4075c7
inc edi
cmp edi, eax
jl 0x4075a4
cmp edi, eax
jl 0x407658
push 0x10c
call fcn.00401fe8
mov edx, dword [0x418ae4]
pop ecx
mov ecx, dword [0x418b64]
mov dword [ecx + edx*4], eax
mov ecx, dword [0x418ae4]
mov eax, dword [0x418b64]
mov eax, dword [eax + ecx*4]
and dword [eax + 0x104], 0
mov ecx, dword [0x418ae4]
mov eax, dword [0x418b64]
mov eax, dword [eax + ecx*4]
mov cx, word [0x4186ac]
mov word [eax + 0x108], cx
mov ecx, dword [0x418ae4]
mov eax, dword [0x418b64]
mov eax, dword [eax + ecx*4]
mov cx, word [0x4186ac]
mov word [eax + 0x10a], cx
mov ecx, dword [0x418b64]
lea eax, [ebp - 0xcc9]
push eax
mov eax, dword [0x418ae4]
push dword [ecx + eax*4]
call esi
inc dword [0x418ae4]
jmp 0x40888b
mov ecx, dword [0x418b64]
mov dx, word [0x4186ac]
mov eax, edi
shl eax, 2
mov ecx, dword [eax + ecx]
mov word [ecx + 0x108], dx
mov ecx, dword [0x418b64]
mov eax, dword [eax + ecx]
mov cx, word [0x4186ac]
mov word [eax + 0x10a], cx
jmp 0x40888b
push 0xc
lea eax, [ebp - 0xcd4]
push str.RegDB_Tree:
push eax
call fcn.00413271
add esp, 0xc
test eax, eax
jne 0x4077eb
lea eax, [ebp - 0xcc8]
push eax
lea eax, [ebp - 0x254]
push eax
call esi
xor ebx, ebx
push ebx
push dword [ebp - 8]
lea eax, [ebp - 0xcd4]
push edi
push eax
call fcn.00401579
push 0xc
lea eax, [ebp - 0xcd4]
push str.RegDB_Root:
push eax
call fcn.00413271
add esp, 0x1c
test eax, eax
jne 0x40770e
lea eax, [ebp - 0xcc8]
push eax
call fcn.0040e74f
push 0
push dword [ebp - 8]
mov ebx, eax
lea eax, [ebp - 0xcd4]
push edi
push eax
call fcn.00401579
add esp, 0x14
xor edi, edi
cmp dword [0x418a54], edi
jle 0x407754
mov eax, dword [0x4186cc]
push dword [eax + edi*4]
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov ecx, dword [0x418a54]
test eax, eax
mov eax, dword [0x4186cc]
jne 0x407747
mov edx, dword [eax + edi*4]
cmp ebx, dword [edx + 0x100]
je 0x40774c
inc edi
cmp edi, ecx
jl 0x40771d
cmp edi, ecx
jl 0x4077d5
push 0x10c
call fcn.00401fe8
mov edx, dword [0x418a54]
pop ecx
mov ecx, dword [0x4186cc]
mov dword [ecx + edx*4], eax
mov ecx, dword [0x418a54]
mov eax, dword [0x4186cc]
mov eax, dword [eax + ecx*4]
and dword [eax + 0x104], 0
mov ecx, dword [0x418a54]
mov eax, dword [0x4186cc]
mov eax, dword [eax + ecx*4]
mov dword [eax + 0x100], ebx
mov ecx, dword [0x418a54]
mov eax, dword [0x4186cc]
mov eax, dword [eax + ecx*4]
mov cx, word [0x4186ac]
mov word [eax + 0x108], cx
mov ecx, dword [0x4186cc]
lea eax, [ebp - 0x254]
push eax
mov eax, dword [0x418a54]
push dword [ecx + eax*4]
call esi
inc dword [0x418a54]
jmp 0x4088a4
mov eax, dword [eax + edi*4]
mov cx, word [0x4186ac]
mov word [eax + 0x108], cx
jmp 0x4088a4
push 4
lea eax, [ebp - 0xcd4]
push str.
push eax
call fcn.00413271
add esp, 0xc
test eax, eax
lea eax, [ebp - 0xcd4]
jne 0x407857
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [0x41871c]
mov edx, dword [0x418af4]
add edx, ecx
mov ecx, dword [0x418a58]
sub edx, eax
dec edx
inc word [0x4186ac]
movzx eax, word [0x4186ac]
mov dword [0x418b4c], edx
and dword [ecx + eax*4], 0
xor eax, eax
cmp byte [ebp - 0xcd0], 0x20
sete al
mov dword [0x418b3c], eax
jmp 0x40888b
push 8
pop ebx
push ebx
push str.Source:
push eax
call fcn.00413271
add esp, 0xc
test eax, eax
jne 0x4078d2
lea eax, [ebp - 0xccc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
call fcn.00401fe8
mov edx, dword [0x418a58]
pop ecx
movzx ecx, word [0x4186ac]
mov dword [edx + ecx*4], eax
mov ecx, dword [0x418a58]
lea eax, [ebp - 0xccc]
push eax
movzx eax, word [0x4186ac]
push dword [ecx + eax*4]
call esi
lea eax, [ebp - 0xcd4]
push 0x7c
push eax
call fcn.004025e3
test eax, eax
pop ecx
pop ecx
je 0x40888b
mov dword [0x4186e8], 1
jmp 0x40888b
push 0xf
lea eax, [ebp - 0xcd4]
push str.Uninstall_MIF:
push eax
call fcn.00413271
add esp, 0xc
test eax, eax
jne 0x4078fd
lea eax, [ebp - 0xcc5]
push eax
push 0x4187a0
jmp 0x407a2e
push 0xe
lea eax, [ebp - 0xcd4]
push str.Manufacturer:
push eax
call fcn.00413271
add esp, 0xc
test eax, eax
jne 0x407928
lea eax, [ebp - 0xcc6]
push eax
push 0x418820
jmp 0x407a2e
push 9
lea eax, [ebp - 0xcd4]
push str.Product:
push eax
call fcn.00413271
add esp, 0xc
test eax, eax
jne 0x407953
lea eax, [ebp - 0xccb]
push eax
push 0x4188a0
jmp 0x407a2e
push 0x10
lea eax, [ebp - 0xcd4]
push str.Version_Number:
push eax
call fcn.00413271
add esp, 0xc
test eax, eax
jne 0x40797e
lea eax, [ebp - 0xcc4]
push eax
push 0x418920
jmp 0x407a2e
push 0xf
lea eax, [ebp - 0xcd4]
push str.Serial_Number:
push eax
call fcn.00413271
add esp, 0xc
test eax, eax
jne 0x4079a9
lea eax, [ebp - 0xcc5]
push eax
push 0x4189a0
jmp 0x407a2e
lea eax, [ebp - 0xcd4]
push str.User_Rights:_Admin
push eax
call fcn.0041322e
test eax, eax
pop ecx
pop ecx
jne 0x4079fc
xor edi, edi
cmp dword [ebp - 0x2c], edi
jne 0x40888b
inc eax
cmp dword [0x4186c0], eax
jne 0x40888b
push 0xe0000000
push edi
push edi
mov dword [ebp - 0x2c], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
cmp eax, edi
je 0x4088b5
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x40888b
push 0xd
lea eax, [ebp - 0xcd4]
push str.Per_User_ID:
push eax
call fcn.00413271
add esp, 0xc
test eax, eax
jne 0x407a35
push pe_nt_image_headers32
call fcn.00401fe8
pop ecx
lea ecx, [ebp - 0xcc7]
mov dword [0x418a40], eax
push ecx
push eax
call esi
jmp 0x40888b
push 0x15
lea eax, [ebp - 0xcd4]
push str.Delete_in_use_files:
push eax
call fcn.00413271
add esp, 0xc
test eax, eax
jne 0x407aa1
push 2
lea eax, [ebp - 0xcbf]
push 0x414d80
push eax
call fcn.00413271
add esp, 0xc
test eax, eax
jne 0x407a78
mov dword [0x418b2c], 1
jmp 0x40888b
push 2
lea eax, [ebp - 0xcbf]
push 0x414d7c
push eax
call fcn.00413271
add esp, 0xc
test eax, eax
jne 0x40888b
and dword [0x418b2c], eax
jmp 0x40888b
push 0x17
lea eax, [ebp - 0xcd4]
push str.System_Restore:_Enabled
push eax
call fcn.00413271
add esp, 0xc
test eax, eax
jne 0x407aca
mov dword [0x4186e0], 1
jmp 0x40888b
push 7
lea eax, [ebp - 0xcd4]
push 0x414d5c
push eax
call fcn.00413271
add esp, 0xc
test eax, eax
lea eax, [ebp - 0xcd4]
jne 0x407af6
push eax
call fcn.00402602
pop ecx
jmp 0x40888b
push 0xc
push str.Layer_GUID:
push eax
call fcn.00413271
add esp, 0xc
test eax, eax
jne 0x407ba2
cmp byte [ebp - 0xcc8], al
lea edi, [ebp - 0xcc8]
je 0x40888b
cmp dword [0x41806c], 1
movsx eax, byte [edi]
jle 0x407b37
push ebx
push eax
call fcn.0040e5a2
pop ecx
pop ecx
jmp 0x407b43
mov ecx, dword [str.________________________________H]
movzx eax, byte [ecx + eax*2]
and eax, ebx
test eax, eax
je 0x407b4d
inc edi
cmp byte [edi], 0
jne 0x407b20
cmp byte [edi], 0
je 0x40888b
push 0x27
call fcn.00401fe8
mov ecx, dword [0x4186ec]
mov edx, dword [0x4186f8]
mov dword [ecx + edx*4], eax
mov eax, dword [0x4186ec]
mov ecx, dword [0x4186f8]
push 0x27
push edi
push dword [eax + ecx*4]
call fcn.0040e870
mov eax, dword [0x4186f8]
mov ecx, dword [0x4186ec]
mov eax, dword [ecx + eax*4]
add esp, 0x10
mov byte [eax + 0x26], 0
inc dword [0x4186f8]
jmp 0x40888b
push 0xc
lea eax, [ebp - 0xcd4]
push str.ProductCode:
push eax
call fcn.00413271
add esp, 0xc
test eax, eax
jne 0x40888b
cmp byte [ebp - 0xcc8], al
lea edi, [ebp - 0xcc8]
je 0x40888b
cmp dword [0x41806c], 1
movsx eax, byte [edi]
jle 0x407be9
push ebx
push eax
call fcn.0040e5a2
pop ecx
pop ecx
jmp 0x407bf5
mov ecx, dword [str.________________________________H]
movzx eax, byte [ecx + eax*2]
and eax, ebx
test eax, eax
je 0x407bff
inc edi
cmp byte [edi], 0
jne 0x407bd2
cmp byte [edi], 0
je 0x40888b
mov eax, dword [0x418780]
test eax, eax
jne 0x407c1e
push 0x27
call fcn.00401fe8
pop ecx
mov dword [0x418780], eax
push 0x27
push edi
push eax
call fcn.0040e870
mov eax, dword [0x418780]
add esp, 0xc
mov byte [eax + 0x26], 0
jmp 0x40888b
xor eax, eax
cmp byte [ebp - 0xccb], 0x72
setne al
xor ebx, ebx
dec eax
and eax, 3
add eax, 0xe
cmp dword [0x418b44], ebx
mov dword [ebp - 4], eax
jle 0x407c87
mov eax, dword [0x418744]
push dword [eax + ebx*4]
mov eax, dword [ebp - 4]
lea eax, [ebp + eax - 0xcd4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
mov eax, dword [0x418b44]
je 0x407c7f
inc ebx
cmp ebx, eax
jl 0x407c58
cmp ebx, eax
jl 0x407d5a
push 0x20c
call fcn.00401fe8
mov edx, dword [0x418b44]
pop ecx
mov ecx, dword [0x418744]
mov dword [ecx + edx*4], eax
mov ecx, dword [0x418b44]
mov eax, dword [0x418744]
mov eax, dword [eax + ecx*4]
xor ebx, ebx
mov dword [eax + 0x204], ebx
mov ecx, dword [0x418b44]
mov eax, dword [0x418744]
mov eax, dword [eax + ecx*4]
mov cx, word [0x4186ac]
mov word [eax + 0x208], cx
mov eax, dword [ebp - 4]
mov ecx, dword [0x418b44]
lea eax, [ebp + eax - 0xcd4]
push eax
mov eax, dword [0x418744]
push dword [eax + ecx*4]
call esi
mov eax, dword [0x418b44]
mov ecx, dword [0x418744]
mov eax, dword [ecx + eax*4]
push ebx
push dword [ebp - 8]
mov byte [eax + 0x104], bl
lea eax, [ebp - 0xcd4]
push edi
push eax
call fcn.00401579
push 0xe
lea eax, [ebp - 0xcd4]
push str.Execute_Name:
push eax
call fcn.00413271
add esp, 0x1c
test eax, eax
jne 0x407d4c
mov ecx, dword [0x418744]
lea eax, [ebp - 0xcc6]
push eax
mov eax, dword [0x418b44]
mov eax, dword [ecx + eax*4]
add eax, 0x104
push eax
call esi
jmp 0x407d4f
mov dword [ebp - 0xc], ebx
inc dword [0x418b44]
jmp 0x408885
mov eax, dword [0x418744]
mov eax, dword [eax + ebx*4]
mov cx, word [0x4186ac]
mov word [eax + 0x208], cx
jmp 0x408885
and dword [ebp - 4], 0
lea eax, [ebp - 0xcd4]
push 0x7c
push eax
mov byte [ebp - 0x14d4], 0
mov byte [ebp - 0x4d4], 0
call fcn.004025e3
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
je 0x407db9
lea eax, [ebx + 1]
push eax
lea eax, [ebp - 0x4d4]
push eax
call esi
cmp byte [ebx - 1], 0x20
jne 0x407db6
mov byte [ebx - 1], 0
jmp 0x407db9
mov byte [ebx], 0
cmp byte [ebp - 0xcd4], 0x53
jne 0x407e3d
lea eax, [ebp - 0xcc8]
push eax
lea eax, [ebp - 0xdd4]
push eax
call esi
cmp dword [0x418a40], 0
je 0x407ecd
push dword [0x418a6c]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
call ebx
push eax
push dword [0x418a6c]
lea eax, [ebp - 0xdd4]
push eax
call fcn.00413271
add esp, 0xc
test eax, eax
jne 0x407ecd
push dword [0x418a3c]
call ebx
push eax
push dword [0x418a3c]
lea eax, [ebp - 0xdd4]
push eax
call fcn.00413271
add esp, 0xc
test eax, eax
je 0x407ecd
mov byte [ebp - 0xdd4], 0
jmp 0x407ecd
cmp byte [ebp - 0xccf], 0x43
jne 0x407e58
lea eax, [ebp - 0xcc9]
push eax
lea eax, [ebp - 0xdd4]
push eax
call esi
jmp 0x407ecd
lea eax, [ebp - 0xcc4]
push eax
lea eax, [ebp - 0xdd4]
push eax
call esi
cmp dword [0x418b60], 0
mov dword [ebp - 4], 1
je 0x407ecd
lea eax, [ebp - 0x30]
push eax
push 0x1f
push 0
push dword [0x418058]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x407ecd
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x1cdc]
push eax
lea eax, [ebp - 0x54]
push eax
push 0
lea eax, [ebp - 0xdd4]
push eax
push dword [ebp - 0x30]
mov dword [ebp - 0x28], pe_nt_image_headers32
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x407ec4
and dword [ebp - 4], eax
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
push ebx
push dword [ebp - 8]
lea eax, [ebp - 0xcd4]
push edi
push eax
call fcn.00401579
push 0xb
lea eax, [ebp - 0xcd4]
push str.Link_Info:
push eax
mov byte [ebp - 0xed4], bl
call fcn.00413271
add esp, 0x1c
test eax, eax
jne 0x407f24
lea eax, [ebp - 0xcc9]
push eax
lea eax, [ebp - 0x14d4]
push eax
call esi
push ebx
push dword [ebp - 8]
lea eax, [ebp - 0xcd4]
push edi
push eax
call fcn.00401579
add esp, 0x10
push 0xd
lea eax, [ebp - 0xcd4]
push str.Backup_Copy:
push eax
call fcn.00413271
add esp, 0xc
test eax, eax
jne 0x407f5a
lea eax, [ebp - 0xcc7]
push eax
lea eax, [ebp - 0xed4]
push eax
call esi
mov dword [0x4186d0], 1
jmp 0x407f5d
mov dword [ebp - 0xc], ebx
push 2
pop edi
push edi
lea eax, [ebp - 0xdd4]
push 0x414f40
push eax
call fcn.00413271
add esp, 0xc
test eax, eax
jne 0x407f82
cmp dword [ebp - 0x1c], edi
je 0x4086df
push edi
lea eax, [ebp - 0xdd4]
push 0x414f3c
push eax
call fcn.00413271
add esp, 0xc
test eax, eax
jne 0x407fa4
cmp dword [ebp - 0x18], edi
je 0x4086df
cmp dword [ebp - 4], ebx
je 0x407fb6
cmp byte [ebp - 0xed4], 0
je 0x4086df
cmp byte [ebp - 0xdd4], 0
je 0x4086df
lea eax, [ebp - 0xdd4]
push ebx
push eax
call fcn.00401d5c
test eax, eax
pop ecx
pop ecx
jne 0x40861a
lea eax, [ebp - 0xdd4]
push eax
lea eax, [ebp - 0x454]
push eax
call esi
lea eax, [ebp - 0x454]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [ebp - 0x454]
dec ecx
add eax, ecx
jmp 0x40800b
cmp byte [eax], 0x5c
je 0x40801a
mov byte [eax], 0
dec eax
lea ecx, [ebp - 0x454]
cmp eax, ecx
ja 0x408002
cmp byte [eax], 0x5c
jne 0x40801d
mov byte [eax], 0
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea eax, [ebp - 0x1de4]
push eax
lea eax, [ebp - 0x454]
push eax
call ebx
test eax, eax
je 0x40832d
lea eax, [ebp - 0x15d8]
push eax
lea eax, [ebp - 0x454]
push eax
call ebx
test eax, eax
je 0x40832d
push dword [0x418b08]
lea eax, [ebp - 0x454]
push eax
call ebx
test eax, eax
je 0x40832d
lea eax, [ebp - 0x1bdc]
push eax
lea eax, [ebp - 0x454]
push eax
call ebx
test eax, eax
je 0x40832d
mov ecx, dword [0x418720]
xor ebx, ebx
push ebx
push ebx
lea eax, [ebp - 0xdd4]
push eax
mov eax, dword [0x418778]
push ecx
push 0x27c
push dword [eax]
lea eax, [eax + ecx*4]
push eax
call fcn.00402111
mov edi, eax
add esp, 0x1c
cmp edi, ebx
jne 0x4082d9
mov ecx, dword [0x418720]
mov eax, dword [0x418778]
mov eax, dword [eax + ecx*4]
mov word [eax + 0x274], bx
mov ecx, dword [0x418778]
mov eax, dword [0x418720]
mov eax, dword [ecx + eax*4]
mov dword [eax + 0x264], ebx
cmp dword [0x418b3c], ebx
mov ecx, dword [0x418778]
je 0x408104
lea eax, [ebp - 0xdd4]
push eax
mov eax, dword [0x418720]
mov eax, dword [ecx + eax*4]
add eax, 8
push eax
call esi
jmp 0x40811d
mov eax, dword [0x418720]
mov eax, dword [ecx + eax*4]
add eax, 8
push eax
lea eax, [ebp - 0xdd4]
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
cmp dword [0x418b3c], ebx
mov ecx, dword [0x418778]
je 0x408144
lea eax, [ebp - 0xed4]
push eax
mov eax, dword [0x418720]
mov eax, dword [ecx + eax*4]
add eax, 0x10c
push eax
call esi
jmp 0x40815f
mov eax, dword [0x418720]
mov eax, dword [ecx + eax*4]
add eax, 0x10c
push eax
lea eax, [ebp - 0xed4]
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
cmp dword [ebp - 0x10], ebx
mov ecx, dword [0x418720]
mov eax, dword [0x418778]
mov eax, dword [eax + ecx*4]
mov word [eax + 0x26e], bx
mov ecx, dword [0x418720]
mov eax, dword [0x418778]
mov eax, dword [eax + ecx*4]
mov word [eax + 0x26c], bx
mov ecx, dword [0x418720]
mov eax, dword [0x418778]
mov eax, dword [eax + ecx*4]
mov cx, word [0x4186ac]
mov word [eax + 0x270], cx
mov ecx, dword [0x418778]
mov eax, dword [0x418720]
mov eax, dword [ecx + eax*4]
mov cx, word [0x4186ac]
mov word [eax + 0x272], cx
jne 0x4081fc
mov ecx, dword [0x418720]
mov eax, dword [0x418778]
mov eax, dword [eax + ecx*4]
mov cx, word [0x4186ac]
mov word [eax + 0x276], cx
mov eax, dword [0x418720]
mov ecx, dword [0x418778]
mov eax, dword [ecx + eax*4]
mov dword [eax + 0x278], 1
jmp 0x408211
mov eax, dword [0x418720]
mov ecx, dword [0x418778]
mov eax, dword [ecx + eax*4]
mov word [eax + 0x276], bx
cmp dword [ebp - 4], ebx
jne 0x408239
cmp byte [ebp - 0xed4], 0
jne 0x408239
mov eax, dword [0x418720]
mov ecx, dword [0x418778]
mov eax, dword [ecx + eax*4]
mov dword [eax + 0x268], 1
jmp 0x40824d
mov eax, dword [0x418720]
mov ecx, dword [0x418778]
mov eax, dword [ecx + eax*4]
mov dword [eax + 0x268], ebx
mov ecx, dword [0x418720]
lea eax, [ebp - 0x4d4]
push eax
mov eax, dword [0x418778]
mov eax, dword [eax + ecx*4]
add eax, 0x210
push eax
call esi
mov eax, dword [0x418720]
mov ecx, dword [0x418778]
mov eax, dword [ecx + eax*4]
mov dword [eax + 0x260], ebx
cmp byte [ebp - 0x14d4], 0
je 0x4082ce
lea eax, [ebp - 0x14d4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
call fcn.00401fe8
mov edx, dword [0x418720]
pop ecx
mov ecx, dword [0x418778]
mov ecx, dword [ecx + edx*4]
mov dword [ecx + 0x260], eax
mov ecx, dword [0x418778]
lea eax, [ebp - 0x14d4]
push eax
mov eax, dword [0x418720]
mov eax, dword [ecx + eax*4]
push dword [eax + 0x260]
call esi
inc dword [0x418720]
jmp 0x408885
cmp dword [ebp - 0x10], ebx
mov ax, word [0x4186ac]
mov word [edi + 0x270], ax
jne 0x4082fe
mov ax, word [0x4186ac]
inc dword [edi + 0x278]
mov word [edi + 0x276], ax
cmp byte [ebp - 0xed4], 0
je 0x408797
lea eax, [ebp - 0xed4]
push eax
lea eax, [edi + 0x10c]
push eax
call esi
mov ax, word [0x4186ac]
mov word [edi + 0x272], ax
jmp 0x408797
xor edi, edi
cmp dword [0x418a64], edi
jle 0x40835e
mov eax, dword [0x418b5c]
push dword [eax + edi*4]
lea eax, [ebp - 0xdd4]
push eax
call ebx
test eax, eax
mov eax, dword [0x418a64]
je 0x408356
inc edi
cmp edi, eax
jl 0x408337
cmp edi, eax
jl 0x408598
push 0x274
call fcn.00401fe8
mov edx, dword [0x418a64]
pop ecx
mov ecx, dword [0x418b5c]
mov dword [ecx + edx*4], eax
mov ecx, dword [0x418a64]
mov eax, dword [0x418b5c]
mov eax, dword [eax + ecx*4]
xor edi, edi
mov word [eax + 0x26c], di
mov ecx, dword [0x418b5c]
mov eax, dword [0x418a64]
mov eax, dword [ecx + eax*4]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 0x25c], ecx
cmp dword [0x418b3c], edi
mov ecx, dword [0x418b5c]
je 0x4083c7
lea eax, [ebp - 0xdd4]
push eax
mov eax, dword [0x418a64]
push dword [ecx + eax*4]
call esi
jmp 0x4083dc
mov eax, dword [0x418a64]
push dword [ecx + eax*4]
lea eax, [ebp - 0xdd4]
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
cmp dword [0x418b3c], edi
mov ecx, dword [0x418b5c]
je 0x408403
lea eax, [ebp - 0xed4]
push eax
mov eax, dword [0x418a64]
mov eax, dword [ecx + eax*4]
add eax, 0x104
push eax
call esi
jmp 0x40841e
mov eax, dword [0x418a64]
mov eax, dword [ecx + eax*4]
add eax, 0x104
push eax
lea eax, [ebp - 0xed4]
push eax
call dword [sym.imp.USER32.dll_OemToCharA]
cmp dword [ebp - 0x10], edi
mov ecx, dword [0x418a64]
mov eax, dword [0x418b5c]
mov eax, dword [eax + ecx*4]
mov word [eax + 0x266], di
mov ecx, dword [0x418a64]
mov eax, dword [0x418b5c]
mov eax, dword [eax + ecx*4]
mov word [eax + 0x264], di
mov ecx, dword [0x418a64]
mov eax, dword [0x418b5c]
mov eax, dword [eax + ecx*4]
mov cx, word [0x4186ac]
mov word [eax + 0x268], cx
mov ecx, dword [0x418b5c]
mov eax, dword [0x418a64]
mov eax, dword [ecx + eax*4]
mov cx, word [0x4186ac]
mov word [eax + 0x26a], cx
jne 0x4084bb
mov ecx, dword [0x418a64]
mov eax, dword [0x418b5c]
mov eax, dword [eax + ecx*4]
mov cx, word [0x4186ac]
mov word [eax + 0x26e], cx
mov eax, dword [0x418a64]
mov ecx, dword [0x418b5c]
mov eax, dword [ecx + eax*4]
mov dword [eax + 0x270], 1
jmp 0x4084d0
mov eax, dword [0x418a64]
mov ecx, dword [0x418b5c]
mov eax, dword [ecx + eax*4]
mov word [eax + 0x26e], di
cmp dword [ebp - 4], edi
jne 0x4084f8
cmp byte [ebp - 0xed4], 0
jne 0x4084f8
mov eax, dword [0x418a64]
mov ecx, dword [0x418b5c]
mov eax, dword [ecx + eax*4]
mov dword [eax + 0x260], 1
jmp 0x40850c
mov eax, dword [0x418a64]
mov ecx, dword [0x418b5c]
mov eax, dword [ecx + eax*4]
mov dword [eax + 0x260], edi
mov ecx, dword [0x418a64]
lea eax, [ebp - 0x4d4]
push eax
mov eax, dword [0x418b5c]
mov eax, dword [eax + ecx*4]
add eax, 0x208
push eax
call esi
mov eax, dword [0x418a64]
mov ecx, dword [0x418b5c]
mov eax, dword [ecx + eax*4]
mov dword [eax + 0x258], edi
cmp byte [ebp - 0x14d4], 0
je 0x40858d
lea eax, [ebp - 0x14d4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
call fcn.00401fe8
mov edx, dword [0x418a64]
pop ecx
mov ecx, dword [0x418b5c]
mov ecx, dword [ecx + edx*4]
mov dword [ecx + 0x258], eax
mov ecx, dword [0x418b5c]
lea eax, [ebp - 0x14d4]
push eax
mov eax, dword [0x418a64]
mov eax, dword [ecx + eax*4]
push dword [eax + 0x258]
call esi
inc dword [0x418a64]
jmp 0x408885
mov eax, dword [0x418b5c]
mov cx, word [0x4186ac]
shl edi, 2
cmp dword [ebp - 0x10], 0
mov eax, dword [eax + edi]
mov word [eax + 0x268], cx
jne 0x4085db
mov eax, dword [0x418b5c]
mov eax, dword [eax + edi]
mov cx, word [0x4186ac]
mov word [eax + 0x26e], cx
mov eax, dword [0x418b5c]
mov eax, dword [eax + edi]
inc dword [eax + 0x270]
cmp byte [ebp - 0xed4], 0
je 0x40882a
lea eax, [ebp - 0xed4]
push eax
mov eax, dword [0x418b5c]
mov eax, dword [eax + edi]
add eax, 0x104
push eax
call esi
mov eax, dword [0x418b5c]
mov eax, dword [eax + edi]
mov cx, word [0x4186ac]
mov word [eax + 0x26a], cx
jmp 0x40882a
xor edi, edi
cmp dword [0x418798], ebx
jle 0x40864b
mov eax, dword [0x418a48]
push dword [eax + edi*4]
lea eax, [ebp - 0xdd4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
mov eax, dword [0x418798]
je 0x408647
inc edi
cmp edi, eax
jl 0x408624
cmp edi, eax
jl 0x40866d
lea eax, [ebp - 0x14d4]
push eax
lea eax, [ebp - 0x4d4]
push eax
lea eax, [ebp - 0xdd4]
push eax
call fcn.00402a12
add esp, 0xc
jmp 0x408885
mov eax, dword [0x418a48]
mov cx, word [0x4186ac]
shl edi, 2
mov eax, dword [eax + edi]
mov word [eax + 0x268], cx
lea eax, [ebp - 0x4d4]
push eax
mov eax, dword [0x418a48]
mov eax, dword [eax + edi]
add eax, 0x208
push eax
call esi
cmp byte [ebp - 0x14d4], 0
je 0x408885
lea eax, [ebp - 0x14d4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
call fcn.00401fe8
pop ecx
mov ecx, dword [0x418a48]
mov ecx, dword [ecx + edi]
mov dword [ecx + 0x258], eax
lea eax, [ebp - 0x14d4]
push eax
mov eax, dword [0x418a48]
jmp 0x40887a
cmp byte [ebp - 0x4d4], 0
jne 0x4086f5
cmp byte [ebp - 0x14d4], 0
je 0x408885
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea eax, [ebp - 0x1de4]
push eax
lea eax, [ebp - 0x454]
push eax
call ebx
test eax, eax
je 0x4087dc
lea eax, [ebp - 0x15d8]
push eax
lea eax, [ebp - 0x454]
push eax
call ebx
test eax, eax
je 0x4087dc
push dword [0x418b08]
lea eax, [ebp - 0x454]
push eax
call ebx
test eax, eax
je 0x4087dc
lea eax, [ebp - 0x1bdc]
push eax
lea eax, [ebp - 0x454]
push eax
call ebx
test eax, eax
je 0x4087dc
xor ebx, ebx
push ebx
push ebx
lea eax, [ebp - 0xdd4]
push eax
push dword [0x418720]
mov eax, dword [0x418778]
push 0x27c
push dword [eax]
push ebx
call fcn.00402111
mov edi, eax
add esp, 0x1c
cmp edi, ebx
je 0x40864b
mov ax, word [0x4186ac]
mov word [edi + 0x274], ax
lea eax, [ebp - 0x4d4]
push eax
lea eax, [edi + 0x210]
push eax
call esi
cmp byte [ebp - 0x14d4], 0
je 0x408885
lea eax, [ebp - 0x14d4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
call fcn.00401fe8
pop ecx
lea ecx, [ebp - 0x14d4]
mov dword [edi + 0x260], eax
push ecx
push eax
jmp 0x408883
xor edi, edi
cmp dword [0x418a64], edi
jle 0x40864b
mov eax, dword [0x418b5c]
push dword [eax + edi*4]
lea eax, [ebp - 0xdd4]
push eax
call ebx
test eax, eax
mov eax, dword [0x418a64]
je 0x408809
inc edi
cmp edi, eax
jl 0x4087ea
cmp edi, eax
jge 0x40864b
mov eax, dword [0x418b5c]
mov cx, word [0x4186ac]
shl edi, 2
mov eax, dword [eax + edi]
mov word [eax + 0x26c], cx
lea eax, [ebp - 0x4d4]
push eax
mov eax, dword [0x418b5c]
mov eax, dword [eax + edi]
add eax, 0x208
push eax
call esi
cmp byte [ebp - 0x14d4], 0
je 0x408885
lea eax, [ebp - 0x14d4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
call fcn.00401fe8
pop ecx
mov ecx, dword [0x418b5c]
mov ecx, dword [ecx + edi]
mov dword [ecx + 0x258], eax
lea eax, [ebp - 0x14d4]
push eax
mov eax, dword [0x418b5c]
mov eax, dword [eax + edi]
push dword [eax + 0x258]
call esi
cmp dword [ebp - 0xc], 0
je 0x4088a4
push 0
push dword [ebp - 8]
lea eax, [ebp - 0xcd4]
push 0x800
push eax
call fcn.00401579
add esp, 0x10
cmp byte [ebp - 0xcd4], 0
jne 0x4059b0
xor ebx, ebx
jmp 0x408916
mov esi, pe_nt_image_headers32
push esi
lea eax, [ebp - 0x2230]
push eax
push 0x19
push dword [0x418790]
call fcn.004033e3
push esi
lea eax, [ebp - 0x2330]
push eax
push 0x43
push dword [0x418790]
call fcn.004033e3
mov eax, dword [0x418ba0]
add esp, 0x20
cmp eax, edi
je 0x4088f7
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
lea eax, [ebp - 0x2230]
push 0
push eax
lea eax, [ebp - 0x2330]
push eax
push dword [0x418ba8]
call dword [sym.imp.USER32.dll_MessageBoxA]
xor ebx, ebx
inc ebx
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll__lclose]
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret