Function at 0x41d024
Capabilities:
Copy file
Persist via run registry key
Set file attributes
Set registry value

Disassembly:
mov eax, 0x47019a
call fcn.0045454c
mov eax, 0x22a4
call fcn.00454c90
push ebx
push esi
push edi
mov dword [ebp - 0x2c], ecx
call fcn.00401166
mov dword [ebp - 0x14], eax
xor ebx, ebx
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0xaae]
mov word [ebp - 0xab0], bx
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 0x14]
stosw word es:[edi], ax
call fcn.0042ce80
test eax, eax
jne 0x41d1bb
lea ecx, [ebp - 0xbc]
call fcn.004020b2
mov eax, dword [0x496c20]
mov dword [ebp - 4], ebx
cmp eax, ebx
jne 0x41d08c
mov eax, 0x4765fc
push eax
lea eax, [ebp - 0xab0]
push 0x497c70
push eax
call fcn.004358f6
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileW]
lea eax, [ebp - 0xab0]
push ebx
push eax
push 0x496c40
call esi
lea eax, [ebp - 0xab0]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0xab0]
lea ecx, [ebp - 0xbc]
push eax
call fcn.0040251f
push 9
xor eax, eax
pop ecx
lea edi, [ebp - 0x5e]
mov word [ebp - 0x60], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x268]
movzx eax, word [eax + 0x48]
push eax
lea eax, [ebp - 0x60]
push str._04x
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x1ab0]
push eax
lea eax, [ebp - 0x22b0]
push eax
push 0x496c40
call fcn.004356a0
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x22b0]
push eax
lea eax, [ebp - 0x1ab0]
push eax
call fcn.004358f6
lea eax, [ebp - 0x1ab0]
push str..ini
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x12ae]
mov word [ebp - 0x12b0], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x12b0]
push 0x497c70
push eax
call fcn.004358f6
lea eax, [ebp - 0x12b0]
push str..ini
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x12b0]
push ebx
push eax
lea eax, [ebp - 0x1ab0]
push eax
call esi
lea eax, [ebp - 0x12b0]
lea ecx, [ebp - 0xbc]
push eax
call fcn.0040251f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbc]
call fcn.004020df
jmp 0x41d1cd
lea eax, [ebp - 0xab0]
push 0x496c40
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [str.NoSuppressRebootKey]
mov esi, 0x4765e0
mov edi, 0x4765d8
cmp eax, ebx
mov dword [ebp - 0x10c], esi
mov dword [ebp - 0xec], edi
jne 0x41d1f1
mov eax, 0x4947d8
lea ecx, [ebp - 0x25]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x10c]
call fcn.004011a9
mov eax, dword [str.Startup]
mov dword [ebp - 4], 1
cmp eax, ebx
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x40], edi
jne 0x41d21d
mov eax, 0x4947d8
lea ecx, [ebp - 0x1d]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x60]
call fcn.004011a9
mov ecx, dword [ebp - 0x14]
push 0xa
lea eax, [ebp - 0x10c]
push ebx
push eax
lea eax, [ebp - 0x60]
push eax
mov byte [ebp - 4], 2
call fcn.0042e521
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x34], eax
mov byte [ebp - 4], 1
call fcn.00401093
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10c]
call fcn.00401093
lea eax, [ebp - 0x1d]
mov esi, 0x476628
mov edi, 0x476620
push ebx
push eax
lea ecx, [ebp - 0xe4]
mov dword [ebp - 0xe4], esi
mov dword [ebp - 0xc4], edi
call fcn.00403bf5
mov dword [ebp - 4], 3
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x1d]
push ebx
push eax
lea ecx, [ebp - 0x15c]
mov byte [ebp - 4], 4
mov dword [ebp - 0x15c], esi
mov dword [ebp - 0x13c], edi
call fcn.00403bf5
mov eax, dword [ebp - 0x34]
mov byte [ebp - 4], 5
sub eax, ebx
je 0x41d2e9
dec eax
je 0x41d2cb
dec eax
jne 0x41d305
mov eax, str.SoftwareMicrosoftWindowsCurrentVersionRun
jmp 0x41d2d0
mov eax, str.SoftwareMicrosoftWindowsCurrentVersionRunOnceEx
mov ecx, eax
test ecx, ecx
jne 0x41d2db
mov eax, 0x4947d8
push eax
lea ecx, [ebp - 0x15c]
call fcn.00403d99
jmp 0x41d30f
mov eax, str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
mov ecx, eax
test ecx, ecx
jne 0x41d2f9
mov eax, 0x4947d8
push eax
lea ecx, [ebp - 0x15c]
call fcn.00403d99
cmp dword [ebp - 0x34], 3
je 0x41db25
mov eax, dword [ebp - 0x154]
cmp eax, ebx
jne 0x41d31e
mov eax, 0x476650
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
push ecx
push 0xf003f
push ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x41db25
lea ecx, [ebp - 0x1c]
call fcn.00411283
mov ecx, dword [ebp - 0x10]
cmp eax, ebx
mov dword [ebp - 0x1c], ecx
jne 0x41db25
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c0], esi
cmp eax, ebx
mov dword [ebp - 0x1a0], edi
jne 0x41d36d
mov eax, 0x4947d8
lea ecx, [ebp - 0x25]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x1c0]
call fcn.00403cfd
cmp dword [ebp + 0xc], ebx
mov byte [ebp - 4], 6
je 0x41d3a3
push str._AFTERREBOOT1
call fcn.00454574
pop ecx
push eax
push str._AFTERREBOOT1
lea ecx, [ebp - 0x1bc]
call fcn.004100be
lea eax, [ebp + 0xf]
push ebx
push eax
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x88], esi
mov dword [ebp - 0x68], edi
call fcn.00403bf5
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 7
mov eax, dword [eax + 0x14]
dec eax
je 0x41d4a0
dec eax
je 0x41d44b
dec eax
je 0x41d3f1
dec eax
je 0x41d3e7
dec eax
jne 0x41d4bc
mov eax, 0x48c80c
jmp 0x41d4a5
mov eax, 0x48c804
jmp 0x41d4a5
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x2b0]
push 8
push eax
call fcn.0040a474
push eax
lea eax, [ebp - 0x134]
push 0x48b24c
push eax
mov byte [ebp - 4], 0xa
call fcn.0040c631
add esp, 0xc
push eax
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0xb
call fcn.0040249e
lea ecx, [ebp - 0x134]
mov byte [ebp - 4], 0xa
call fcn.00402424
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x2b0]
call fcn.00402424
jmp 0x41d4bc
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0xb0]
push 8
push eax
call fcn.0040a474
push eax
lea eax, [ebp - 0x288]
push 0x48b280
push eax
mov byte [ebp - 4], 8
call fcn.0040c631
add esp, 0xc
push eax
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 9
call fcn.0040249e
lea ecx, [ebp - 0x288]
mov byte [ebp - 4], 8
call fcn.00402424
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xb0]
jmp 0x41d444
mov eax, 0x48b31c
mov ecx, eax
test ecx, ecx
jne 0x41d4b0
mov eax, 0x4947d8
push eax
lea ecx, [ebp - 0x88]
call fcn.00403d99
mov ecx, dword [ebp - 0x14]
call fcn.0042ce80
test eax, eax
mov eax, 0x48c7fc
jne 0x41d4d2
mov eax, 0x4947d8
cmp eax, ebx
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x40], edi
jne 0x41d4e1
mov eax, 0x4947d8
lea ecx, [ebp - 0x35]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x60]
call fcn.00403cfd
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x10c]
push eax
mov byte [ebp - 4], 0xc
call fcn.0042ad59
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 0xd
call fcn.0042af8e
cmp eax, ebx
mov dword [ebp - 0x260], esi
mov dword [ebp - 0x240], edi
jne 0x41d523
mov eax, 0x4947d8
lea ecx, [ebp - 0x38]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x260]
call fcn.00403cfd
mov eax, 0x497c70
mov byte [ebp - 4], 0xe
test eax, eax
mov dword [ebp - 0x238], esi
mov dword [ebp - 0x218], edi
jne 0x41d552
mov eax, 0x4947d8
lea ecx, [ebp - 0x37]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x238]
call fcn.00403cfd
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 0xf
call fcn.0042ce80
test eax, eax
je 0x41d5f1
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x54], ebx
jne 0x41d5f1
mov edx, dword [ebp - 0x58]
mov eax, 0x476650
cmp edx, ebx
jne 0x41d589
mov edx, eax
mov ecx, dword [ebp - 0x1b8]
mov dword [ebp + 8], eax
cmp ecx, ebx
je 0x41d599
mov dword [ebp + 8], ecx
mov ecx, dword [ebp - 0x230]
mov dword [ebp - 0x10], eax
cmp ecx, ebx
je 0x41d5a9
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x258]
mov dword [ebp - 0x2c], eax
cmp ecx, ebx
je 0x41d5b9
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x80]
cmp ecx, ebx
jne 0x41d5c2
mov ecx, eax
cmp dword [ebp - 0x104], ebx
je 0x41d5d0
mov eax, dword [ebp - 0x104]
push edx
mov edx, dword [ebp - 0x14]
push dword [ebp + 8]
mov edx, dword [edx + 0x268]
push dword [ebp - 0x10]
movzx edx, word [edx + 0x48]
push dword [ebp - 0x2c]
push edx
push ecx
push eax
push str.__s___k__s__l_d__t__s___e__s___w__v__s___s
jmp 0x41d665
mov edx, dword [ebp - 0x58]
mov eax, 0x476650
cmp edx, ebx
jne 0x41d5ff
mov edx, eax
mov ecx, dword [ebp - 0x1b8]
mov dword [ebp + 8], eax
cmp ecx, ebx
je 0x41d60f
mov dword [ebp + 8], ecx
mov ecx, dword [ebp - 0x230]
mov dword [ebp - 0x2c], eax
cmp ecx, ebx
je 0x41d61f
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x258]
mov dword [ebp - 0x10], eax
cmp ecx, ebx
je 0x41d62f
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x80]
cmp ecx, ebx
jne 0x41d638
mov ecx, eax
cmp dword [ebp - 0x104], ebx
je 0x41d646
mov eax, dword [ebp - 0x104]
push edx
mov edx, dword [ebp - 0x14]
push dword [ebp + 8]
mov edx, dword [edx + 0x268]
push dword [ebp - 0x2c]
movzx edx, word [edx + 0x48]
push dword [ebp - 0x10]
push edx
push ecx
push eax
push str.__s___s__l_d__t__s___e__s___v__s___s
lea eax, [ebp - 0xe4]
push eax
call fcn.0040faf5
mov ecx, dword [ebp - 0x14]
add esp, 0x24
lea eax, [ebp - 0xb0]
push eax
call fcn.0041dce8
cmp dword [eax + 0xc], ebx
lea ecx, [ebp - 0xb0]
setne byte [ebp + 0xb]
call fcn.00402424
cmp byte [ebp + 0xb], bl
je 0x41d72b
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x2b0]
push eax
call fcn.0041dce8
push eax
lea eax, [ebp - 0x288]
push str.__debuglog_
push eax
mov byte [ebp - 4], 0x10
call fcn.0040c631
push 0x48b4c8
push eax
lea eax, [ebp - 0xb0]
mov byte [ebp - 4], 0x11
push eax
call fcn.0040ff97
add esp, 0x18
push dword [0x476630]
mov ecx, eax
add eax, 4
mov byte [ebp - 4], 0x12
neg ecx
sbb ecx, ecx
push ebx
and ecx, eax
push ecx
lea ecx, [ebp - 0xe0]
call fcn.0040b08e
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0x11
call fcn.00402424
lea ecx, [ebp - 0x288]
mov byte [ebp - 4], 0x10
call fcn.00402424
lea ecx, [ebp - 0x2b0]
mov byte [ebp - 4], 0xf
call fcn.00402424
cmp dword [ebp - 0x34], 1
jne 0x41d767
lea eax, [ebp - 0x2c]
mov dword [ebp + 8], ebx
push eax
lea eax, [ebp + 8]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.0001
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
jne 0x41d767
lea ecx, [ebp - 0x1c]
call fcn.00411283
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c0]
push ebx
push eax
lea ecx, [ebp - 0x1e8]
mov dword [ebp - 0x1e8], esi
mov dword [ebp - 0x1c8], edi
call fcn.00403c6a
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 0x13
call fcn.0042af8e
cmp eax, ebx
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x1f0], edi
jne 0x41d7a7
mov eax, 0x4947d8
lea ecx, [ebp + 0xb]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x210]
call fcn.00403cfd
mov eax, 0x497c70
mov byte [ebp - 4], 0x14
test eax, eax
mov dword [ebp - 0x198], esi
mov dword [ebp - 0x178], edi
jne 0x41d7d6
mov eax, 0x4947d8
lea ecx, [ebp - 0x36]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x198]
call fcn.00403cfd
cmp dword [ebp - 0x204], ebx
mov byte [ebp - 4], 0x15
je 0x41d811
lea eax, [ebp - 0xb0]
push ebx
push eax
lea ecx, [ebp - 0x210]
call fcn.00415a55
lea ecx, [ebp - 0xb0]
call fcn.00402424
cmp dword [ebp - 0x18c], ebx
je 0x41d837
lea eax, [ebp - 0xb0]
push ebx
push eax
lea ecx, [ebp - 0x198]
call fcn.00415a55
lea ecx, [ebp - 0xb0]
call fcn.00402424
mov esi, dword [ebp - 0xdc]
cmp esi, ebx
jne 0x41d846
mov esi, 0x476650
lea eax, [ebp - 0x15]
push 1
push eax
push str.C:CodeBasesisdev_srcRuntimeMSISharedSetupmsiaction.cpp
lea ecx, [ebp - 0xb0]
call fcn.00401889
mov eax, dword [eax + 8]
mov byte [ebp - 4], 0x16
cmp eax, ebx
jne 0x41d86c
mov eax, 0x4765fc
mov dword [ebp - 0x30], eax
push esi
lea eax, [ebp - 0x30]
push str.MsiAction::Reboot_command_line__s
push eax
mov dword [ebp - 0x2c], 0x708
call fcn.0040a580
add esp, 0xc
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0x15
call fcn.00401093
mov dword [ebp - 0x24], ebx
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 0x17
push eax
push 0xf003f
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x2c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, ebx
jne 0x41da56
lea ecx, [ebp - 0x24]
call fcn.00411283
mov ecx, dword [ebp - 0x2c]
cmp eax, ebx
mov dword [ebp - 0x24], ecx
jne 0x41da56
mov eax, dword [ebp - 0x208]
mov dword [ebp - 0x10], 0x476650
cmp eax, ebx
je 0x41d8f9
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
call edi
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0x10]
push 1
push ebx
push str._IS_T_
push dword [ebp - 0x24]
call esi
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x10], 0x476650
cmp eax, ebx
je 0x41d927
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
call edi
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0x10]
push 1
push ebx
push str._IS_E_
push dword [ebp - 0x24]
call esi
cmp dword [ebp - 0x1dc], ebx
je 0x41d977
mov eax, dword [ebp - 0x1e0]
mov dword [ebp - 0x10], 0x476650
cmp eax, ebx
je 0x41d95d
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
call edi
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0x10]
push 1
push ebx
push str._IS_V_
push dword [ebp - 0x24]
call esi
cmp dword [ebp - 0x24], ebx
je 0x41d988
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x24], ebx
lea eax, [ebp - 0x15]
push 1
push eax
push str._IS_T_
lea ecx, [ebp - 0x134]
call fcn.00403cfd
lea eax, [ebp - 0x134]
lea ecx, [ebp - 0xe4]
push eax
lea eax, [ebp - 0x210]
push eax
mov byte [ebp - 4], 0x18
call fcn.00404b65
lea ecx, [ebp - 0x134]
mov byte [ebp - 4], 0x17
call fcn.00402424
lea eax, [ebp - 0x15]
push 1
push eax
push str._IS_E_
lea ecx, [ebp - 0x134]
call fcn.00403cfd
lea eax, [ebp - 0x134]
lea ecx, [ebp - 0xe4]
push eax
lea eax, [ebp - 0x198]
push eax
mov byte [ebp - 4], 0x19
call fcn.00404b65
lea ecx, [ebp - 0x134]
mov byte [ebp - 4], 0x17
call fcn.00402424
cmp dword [ebp - 0x1dc], ebx
je 0x41da56
lea eax, [ebp - 0x15]
push 1
push eax
push str._IS_V_
lea ecx, [ebp - 0x134]
call fcn.00403cfd
lea eax, [ebp - 0x134]
lea ecx, [ebp - 0xe4]
push eax
lea eax, [ebp - 0x1e8]
push eax
mov byte [ebp - 4], 0x1a
call fcn.00404b65
lea ecx, [ebp - 0x134]
mov byte [ebp - 4], 0x17
call fcn.00402424
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x10], 0x476650
cmp eax, ebx
je 0x41da6a
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
call edi
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0x10]
push 1
push ebx
push str.ISSetup
push dword [ebp - 0x1c]
call esi
cmp dword [ebp - 0x1c], ebx
je 0x41da95
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x15
call fcn.00411283
lea ecx, [ebp - 0x198]
mov byte [ebp - 4], 0x14
call fcn.00402424
lea ecx, [ebp - 0x210]
mov byte [ebp - 4], 0x13
call fcn.00402424
lea ecx, [ebp - 0x1e8]
mov byte [ebp - 4], 0xf
call fcn.00402424
lea ecx, [ebp - 0x238]
mov byte [ebp - 4], 0xe
call fcn.00402424
lea ecx, [ebp - 0x260]
mov byte [ebp - 4], 0xd
call fcn.00402424
lea ecx, [ebp - 0x10c]
mov byte [ebp - 4], 0xc
call fcn.00402424
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 7
call fcn.00402424
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 6
call fcn.00402424
lea ecx, [ebp - 0x1c0]
mov byte [ebp - 4], 5
call fcn.00402424
xor eax, eax
lea edi, [ebp - 0x16e]
mov word [ebp - 0x170], bx
mov dword [ebp - 0x60], 0x4765e0
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [str.Type]
mov dword [ebp - 0x40], 0x4765d8
cmp eax, ebx
jne 0x41db56
mov eax, 0x4947d8
lea ecx, [ebp + 0xb]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x60]
call fcn.004011a9
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x288]
push 5
push eax
mov ecx, esi
mov byte [ebp - 4], 0x1b
call fcn.0040a474
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0x1c
push ecx
mov ecx, eax
call fcn.00424526
push 0xa
lea ecx, [ebp - 0x60]
push ebx
push ecx
push eax
mov ecx, esi
mov byte [ebp - 4], 0x1d
call fcn.0042e521
lea ecx, [ebp - 0xb0]
mov edi, eax
mov byte [ebp - 4], 0x1c
call fcn.00401093
lea ecx, [ebp - 0x288]
mov byte [ebp - 4], 0x1b
call fcn.00402424
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 5
call fcn.00401093
push 0xb
mov ecx, esi
call fcn.0040a44f
test al, al
jne 0x41dbe7
cmp edi, 1
je 0x41dbe7
cmp edi, 2
jne 0x41dc80
push 4
lea eax, [ebp - 0x170]
push 0x48c6e8
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [ebp - 0x80]
call fcn.004028ee
lea eax, [ebp - 0xab0]
lea ecx, [ebp - 0x80]
push eax
mov byte [ebp - 4], 0x1e
call fcn.00402936
lea eax, [ebp - 0xb0]
push 5
push eax
mov ecx, esi
call fcn.0040a474
mov eax, dword [eax + 8]
mov byte [ebp - 4], 0x1f
cmp eax, ebx
jne 0x41dc39
mov eax, 0x476650
lea ecx, [ebp - 0x170]
push ecx
lea ecx, [ebp - 0x80]
push dword [0x47677c]
push eax
call fcn.00402975
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 0x1e
call fcn.00402424
lea ecx, [ebp - 0x80]
call fcn.00402962
push 1
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0x20
call fcn.00402f3d
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 5
call fcn.00403a04
cmp dword [ebp - 0x34], 3
je 0x41dca8
mov esi, dword [esi + 0x268]
cmp byte [esi + 1], bl
je 0x41dc9d
cmp byte [esi + 2], bl
jne 0x41dc9d
call fcn.0043606b
jmp 0x41dca8
push 0x453
call fcn.00435176
pop ecx
lea ecx, [ebp - 0x15c]
mov byte [ebp - 4], 4
call fcn.00402424
cmp dword [ebp - 0x1c], ebx
je 0x41dcc8
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1c], ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe4]
call fcn.00402424
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8