Function at 0x416f10
Capabilities:
Delete registry value
Persist via run registry key
Query or enumerate registry value

Disassembly:
mov eax, 0x4747b2
call fcn.00444d58
sub esp, 0x444
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push 1
lea eax, [ebp - 0x1d]
pop edi
lea ecx, [ebp - 0x54]
push edi
push eax
push esi
call fcn.00402caf
movsx eax, byte [esi]
add eax, 0xffffffbf
xor ebx, ebx
cmp eax, 0x39
mov dword [ebp - 4], ebx
ja case.0x416f4b.71
jmp dword [eax*4 + 0x417c03]
push str.auto
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x416f74
push ebx
push ebx
mov dword [0x49b6f0], edi
push str._auto
jmp 0x417bc4
mov eax, dword [ebp + 8]
cmp dword [eax + 0x24], ebx
je 0x416f8a
push eax
call fcn.0041694b
pop ecx
xor edi, edi
jmp 0x417089
mov ecx, dword [ebp + 8]
push ebx
push ebx
push 0x48ffbc
mov dword [ecx + 0x24], edi
call fcn.004315f3
push esi
call dword [sym.imp.USER32.dll_CharNextA]
lea ecx, [ebp - 0x24]
push edi
push ecx
push eax
lea ecx, [ebp - 0x20c]
call fcn.00402caf
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push ebx
push eax
push 0x10
mov byte [ebp - 4], 1
call fcn.0040833f
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x20c]
jmp 0x4178fe
push esi
call dword [sym.imp.USER32.dll_CharNextA]
lea ecx, [ebp - 0x26]
push edi
push ecx
push eax
lea ecx, [ebp - 0x2ac]
call fcn.00402caf
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x2ac]
push ebx
push eax
push 0xd
mov byte [ebp - 4], 2
call fcn.0040833f
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x2ac]
jmp 0x4178fe
mov esi, dword [ebp + 8]
push edi
mov ecx, esi
call fcn.0042e059
jmp 0x417610
mov eax, str.debuglog
mov dword [ebp - 0xf4], 0x47b5a0
mov ecx, eax
mov dword [ebp - 0xd4], 0x47b598
test ecx, ecx
jne 0x417048
mov eax, 0x498d9c
lea ecx, [ebp - 0x17]
push ebx
push ecx
push eax
lea ecx, [ebp - 0xf4]
call fcn.00403ed5
lea eax, [ebp - 0xf4]
push ebx
push eax
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 3
call fcn.004024b0
neg eax
sbb al, al
lea ecx, [ebp - 0xf4]
inc al
mov byte [ebp - 4], bl
mov byte [ebp + 0xf], al
call fcn.00401f95
cmp byte [ebp + 0xf], bl
je 0x41709c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.00401f95
mov eax, edi
jmp 0x417bf4
push edi
push esi
call dword [sym.imp.USER32.dll_CharNextA]
push eax
push 0x48ffa4
jmp 0x417bc4
mov eax, 0x48ff94
mov edi, 0x47b598
mov ecx, eax
mov dword [ebp - 0x7c], 0x47b5a0
test ecx, ecx
mov dword [ebp - 0x5c], edi
jne 0x4170ce
mov eax, 0x498d9c
lea ecx, [ebp - 0x1f]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x7c]
call fcn.00403ed5
lea eax, [ebp - 0x7c]
push ebx
push eax
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 4
call fcn.004024b0
test eax, eax
jne 0x417150
mov eax, 0x48ff90
mov dword [ebp - 0x144], 0x47b5a0
mov ecx, eax
mov dword [ebp - 0x124], edi
test ecx, ecx
jne 0x417111
mov eax, 0x498d9c
lea ecx, [ebp - 0x19]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x144]
call fcn.00403ed5
lea eax, [ebp - 0x144]
lea ecx, [ebp - 0x54]
push eax
mov byte [ebp - 4], 5
call fcn.00414f81
lea ecx, [ebp - 0x144]
mov byte [ebp + 0xf], al
mov byte [ebp - 4], 4
call fcn.00401f95
cmp byte [ebp + 0xf], bl
mov byte [ebp + 0xf], 1
jne 0x417153
mov byte [ebp + 0xf], bl
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], bl
call fcn.00401f95
cmp byte [ebp + 0xf], bl
je 0x417194
push 0xffffffffffffffff
lea eax, [ebp - 0x428]
push 5
push eax
lea ecx, [ebp - 0x54]
call fcn.00402d31
mov ecx, dword [ebp + 8]
push ebx
push eax
push 0x13
mov byte [ebp - 4], 6
call fcn.0040833f
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x428]
jmp 0x4178fe
push esi
call dword [sym.imp.USER32.dll_CharNextA]
mov esi, eax
push str._IS_E_
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x4171bf
mov edi, 0x49b2ec
push esi
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x41725a
mov dword [ebp + 0xc], ebx
push 0xf003f
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 7
call fcn.00417ceb
test eax, eax
jne 0x417333
push 0x40
lea edi, [ebp - 0x3ff]
pop ecx
mov byte [ebp - 0x400], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x104
push eax
lea eax, [ebp - 0x400]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push esi
mov dword [ebp - 0x14], ebx
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x400]
mov edi, 0x49b2ec
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp dword [ebp + 0xc], ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x41724d
push dword [ebp + 0xc]
call esi
mov dword [ebp + 0xc], ebx
cmp dword [ebp + 0xc], ebx
mov byte [ebp - 4], bl
je 0x41725a
push dword [ebp + 0xc]
call esi
push edi
call fcn.004409c9
mov esi, dword [ebp + 8]
mov ecx, 0x49aeb8
mov dword [esi + 0x5c], 1
call fcn.0040198d
push eax
push edi
push 0x49a2c8
call fcn.00440ae2
lea eax, [ebp - 0x23]
push ebx
push eax
push 0x498d9c
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0xa4], 0x47b560
mov dword [ebp - 0x84], 0x47b558
call fcn.00408d40
lea eax, [ebp - 0x1b]
push 1
push eax
lea ecx, [ebp - 0x2d4]
push dword [0x47b5d8]
mov byte [ebp - 4], 8
call fcn.0040175f
lea eax, [ebp - 0x21]
push 1
push eax
lea ecx, [ebp - 0x194]
push dword [0x47b5cc]
mov byte [ebp - 4], 9
call fcn.0040175f
lea eax, [ebp - 0xa4]
mov ecx, esi
push eax
lea eax, [ebp - 0x2d4]
push eax
lea eax, [ebp - 0x194]
push eax
push 6
mov byte [ebp - 4], 0xa
call fcn.0040845f
lea ecx, [ebp - 0x194]
call fcn.00401bc2
lea ecx, [ebp - 0x2d4]
call fcn.00401bc2
lea ecx, [ebp - 0xa4]
mov byte [ebp - 4], bl
call fcn.00401bc2
push 2
mov ecx, esi
call fcn.0042e07b
jmp 0x417bcc
push dword [ebp + 8]
call fcn.0041694b
cmp dword [ebp + 0xc], ebx
pop ecx
je 0x417be6
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 0xc], ebx
jmp 0x417be6
mov edi, dword [sym.imp.USER32.dll_CharNextA]
push esi
call edi
movsx eax, byte [eax]
sub eax, 0x31
je 0x4173ab
dec eax
je 0x417399
dec eax
je 0x41737c
push ebx
push esi
call edi
push eax
push 0x48ff84
jmp 0x417bc4
mov ebx, dword [ebp + 8]
push esi
mov byte [ebx + 0x17c], 1
call edi
push eax
call edi
push eax
mov ecx, ebx
call fcn.0042df80
jmp 0x417bcc
push ebx
push esi
call edi
push eax
call edi
push eax
push 0x48ff80
jmp 0x417bc4
push ebx
push esi
call edi
push eax
call edi
mov esi, dword [ebp + 8]
push eax
push 0x48fc5c
mov ecx, esi
call fcn.004315f3
mov dword [esi + 0x64], 1
jmp 0x417bcc
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push str.hide_progress
push esi
call edi
mov ebx, dword [ebp + 8]
test eax, eax
jne 0x4173ea
mov byte [ebx + 0x175], 1
push str.hide_splash
push esi
call edi
test eax, eax
jne 0x417bcc
mov byte [ebx + 0x176], 1
jmp 0x417bcc
mov eax, str.instance
mov dword [ebp - 0xcc], 0x47b5a0
mov ecx, eax
mov dword [ebp - 0xac], 0x47b598
test ecx, ecx
jne 0x41742a
mov eax, 0x498d9c
lea ecx, [ebp - 0x15]
push ebx
push ecx
push eax
lea ecx, [ebp - 0xcc]
call fcn.00403ed5
lea eax, [ebp - 0xcc]
push ebx
push eax
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0xb
call fcn.004024b0
neg eax
sbb al, al
lea ecx, [ebp - 0xcc]
inc al
mov byte [ebp - 4], bl
mov byte [ebp + 0xf], al
call fcn.00401f95
cmp byte [ebp + 0xf], bl
je 0x417bcc
mov eax, dword [ebp + 8]
push 0xfffffffffffffffd
pop edi
lea ecx, [ebp - 0x54]
lea esi, [eax + 0x178]
push 0xffffffffffffffff
lea eax, [ebp - 0x11c]
push 9
push eax
mov dword [esi], edi
call fcn.00402d31
lea eax, [ebp - 0x11c]
lea ecx, [ebp - 0x118]
neg eax
sbb eax, eax
push 0x48ff40
and eax, ecx
mov byte [ebp - 4], 0xc
push eax
call fcn.00409a77
pop ecx
test al, al
pop ecx
je 0x4174bc
or dword [esi], 0xffffffff
jmp 0x4174d0
push 0xa
push esi
lea ecx, [ebp - 0x11c]
call fcn.00417ddf
test al, al
jne 0x4174d0
mov dword [esi], edi
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x11c]
jmp 0x4178fe
mov eax, dword [ebp + 8]
cmp dword [eax + 0x24], ebx
jne case.0x416f4b.71
push esi
mov dword [eax + 0x24], 3
call dword [sym.imp.USER32.dll_CharNextA]
mov esi, eax
lea eax, [ebp - 0x25]
push edi
push eax
push esi
lea ecx, [ebp - 0x25c]
call fcn.00402caf
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x25c]
push ebx
push eax
push 9
mov byte [ebp - 4], 0xd
call fcn.0040833f
lea ecx, [ebp - 0x25c]
mov byte [ebp - 4], bl
call fcn.00401f95
push ebx
push esi
push 0x48ff3c
jmp 0x417bc4
mov edi, dword [ebp + 8]
lea eax, [ebp + 0xc]
push edi
push eax
push esi
mov dword [ebp + 0xc], ebx
call dword [sym.imp.USER32.dll_CharNextA]
push eax
call fcn.00417f01
add esp, 0xc
test eax, eax
je 0x41756a
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x60], eax
mov dword [0x49a8e8], eax
jmp 0x417bcc
push edi
jmp 0x417be0
push esi
mov esi, dword [sym.imp.USER32.dll_CharNextA]
call esi
movsx ecx, byte [eax]
sub ecx, 0x31
je 0x41759d
dec ecx
push ebx
push eax
je 0x417590
push 0x48ff38
jmp 0x417bc4
call esi
push eax
push 0x48ff34
jmp 0x417bc4
push ebx
push eax
call esi
push eax
push 0x48ff30
jmp 0x417bc4
push str.noscript_uninst
push esi
call fcn.004463a0
pop ecx
test eax, eax
pop ecx
jne 0x4175c9
push ebx
push ebx
push str._noscript_uninst
jmp 0x417bc4
push esi
call dword [sym.imp.USER32.dll_CharNextA]
lea ecx, [ebp - 0x16]
push edi
push ecx
push eax
lea ecx, [ebp - 0x2fc]
call fcn.00402caf
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x2fc]
push ebx
push eax
push 6
mov ecx, esi
mov byte [ebp - 4], 0xe
call fcn.0040833f
lea ecx, [ebp - 0x2fc]
mov byte [ebp - 4], bl
call fcn.00401f95
push 2
mov ecx, esi
call fcn.0042e07b
mov dword [esi + 0x5c], edi
jmp 0x417bcc
push esi
call dword [sym.imp.USER32.dll_CharNextA]
push eax
push 0x498e0c
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x417bcc
mov eax, dword [ebp + 8]
mov byte [eax + 0x17d], 1
jmp 0x417bcc
push str.removeonly
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x41765b
push ebx
push ebx
push str._removeonly
jmp 0x417bc4
push str.runas
push esi
call fcn.004463a0
pop ecx
test eax, eax
pop ecx
je 0x417bcc
push 0x48fee8
push esi
call fcn.004463a0
pop ecx
test eax, eax
pop ecx
je 0x417bcc
mov eax, str.runprerequisites
mov dword [ebp - 0x16c], 0x47b5a0
mov ecx, eax
mov dword [ebp - 0x14c], 0x47b598
test ecx, ecx
jne 0x4176a9
mov eax, 0x498d9c
lea ecx, [ebp - 0x18]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x16c]
call fcn.00403ed5
lea eax, [ebp - 0x16c]
push ebx
push eax
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 0xf
call fcn.004024b0
neg eax
sbb al, al
lea ecx, [ebp - 0x16c]
inc al
mov byte [ebp - 4], bl
mov byte [ebp + 0xf], al
call fcn.00401f95
cmp byte [ebp + 0xf], bl
jne 0x417bcc
push 6
push 0x48febc
push esi
call fcn.00445e10
add esp, 0xc
test eax, eax
je 0x417bcc
push 0x48fea4
push esi
call fcn.004463a0
pop ecx
test eax, eax
pop ecx
je 0x417bcc
push ebx
push ebx
push 0x48fea0
jmp 0x417bc4
push 0x48fe9c
push esi
call fcn.004463a0
pop ecx
test eax, eax
pop ecx
je 0x41774a
push ebx
push ebx
mov dword [0x49b6f4], edi
push 0x48fe98
jmp 0x417bc4
push ebx
push ebx
push str._SMS
jmp 0x417bc4
mov edi, str.tempdisk1folder
push edi
call fcn.004454af
pop ecx
push eax
push ebx
push edi
lea ecx, [ebp - 0x50]
call fcn.00404016
cmp eax, ebx
je 0x417bcc
push esi
call dword [sym.imp.USER32.dll_CharNextA]
mov esi, eax
push str._IS_T_
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x41779c
mov ecx, dword [ebp + 8]
push esi
call fcn.0042df35
jmp 0x41783f
mov dword [ebp + 0xc], ebx
push 0xf003f
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 0x10
call fcn.00417ceb
test eax, eax
jne 0x417858
push 0x40
lea edi, [ebp - 0x3ff]
pop ecx
mov byte [ebp - 0x400], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x104
push eax
lea eax, [ebp - 0x400]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push esi
mov dword [ebp - 0x10], ebx
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x400]
push eax
call fcn.004409c9
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x400]
push eax
call fcn.0042df35
push esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp dword [ebp + 0xc], ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x417832
push dword [ebp + 0xc]
call esi
mov dword [ebp + 0xc], ebx
cmp dword [ebp + 0xc], ebx
mov byte [ebp - 4], bl
je 0x41783f
push dword [ebp + 0xc]
call esi
mov ecx, dword [ebp + 8]
push 3
call fcn.0042e07b
mov eax, dword [ebp + 8]
mov dword [eax + 0x5c], 1
jmp 0x417bcc
push dword [ebp + 8]
call fcn.0041694b
cmp dword [ebp + 0xc], ebx
pop ecx
je 0x417be6
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 0xc], ebx
jmp 0x417be6
mov edi, dword [sym.imp.USER32.dll_CharNextA]
push esi
call edi
mov al, byte [eax]
cmp al, 0x41
je 0x417941
cmp al, 0x4d
je 0x417908
cmp al, 0x57
je 0x4178c7
cmp al, 0x61
je 0x417941
cmp al, 0x6d
je 0x417908
cmp al, 0x77
je 0x4178c7
push str.uninst
push esi
call fcn.004463a0
pop ecx
test eax, eax
pop ecx
jne 0x417bcc
push ebx
push ebx
push str._uninst
jmp 0x417bc4
push esi
call edi
push eax
call edi
lea ecx, [ebp - 0x1a]
push 1
push ecx
push eax
lea ecx, [ebp - 0x1bc]
call fcn.00402caf
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x1bc]
push ebx
push eax
push 0xb
mov byte [ebp - 4], 0x12
call fcn.0040833f
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x1bc]
call fcn.00401f95
jmp 0x417bcc
push esi
call edi
push eax
call edi
lea ecx, [ebp - 0x1c]
push 1
push ecx
push eax
lea ecx, [ebp - 0x1e4]
call fcn.00402caf
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x1e4]
push ebx
push eax
push 0xc
mov byte [ebp - 4], 0x13
call fcn.0040833f
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x1e4]
jmp 0x4178fe
push esi
call edi
push eax
call edi
lea ecx, [ebp - 0x1e]
push 1
push ecx
push eax
lea ecx, [ebp - 0x234]
call fcn.00402caf
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x234]
push ebx
push eax
push 0xa
mov byte [ebp - 4], 0x11
call fcn.0040833f
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x234]
jmp 0x4178fe
mov dword [ebp - 0x10], ebx
push 0xf003f
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x14
call fcn.00417ceb
test eax, eax
jne 0x4179bb
push str.ISSetup
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp dword [ebp - 0x10], ebx
je 0x4179bb
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], ebx
push 7
push str.verbose
push esi
call fcn.00445e10
add esp, 0xc
test eax, eax
je 0x417b5e
push esi
call dword [sym.imp.USER32.dll_CharNextA]
push str._IS_V_
push eax
mov dword [ebp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x417a72
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 8
push eax
mov eax, dword [ebp + 8]
lea ecx, [eax + 0x14]
call fcn.00408c09
mov esi, eax
cmp dword [esi + 0xc], ebx
je 0x417a27
push 0x48f9b8
call fcn.004454af
pop ecx
push eax
push 0x48f9b8
lea ecx, [esi + 4]
call fcn.0041567d
lea eax, [ebp - 0x20]
push edi
push eax
lea ecx, [ebp - 0x450]
push dword [ebp + 0xc]
call fcn.00402caf
push dword [0x47b5a8]
mov ecx, eax
add eax, 4
mov byte [ebp - 4], 0x15
neg ecx
sbb ecx, ecx
push ebx
and ecx, eax
push ecx
lea ecx, [esi + 4]
call fcn.00410795
lea ecx, [ebp - 0x450]
mov byte [ebp - 4], 0x14
call fcn.00401f95
mov esi, dword [ebp + 0xc]
push edi
push esi
jmp 0x417b34
push 0xf003f
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x10]
call fcn.00417ceb
test eax, eax
jne 0x417b3b
push 0x40
lea edi, [ebp - 0x3ff]
pop ecx
mov byte [ebp - 0x400], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x104
push eax
lea eax, [ebp - 0x400]
push eax
lea eax, [ebp - 0x2c]
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x2c], ebx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp dword [ebp - 0x10], ebx
je 0x417ae8
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], ebx
lea eax, [ebp - 0x22]
push 1
push eax
lea eax, [ebp - 0x400]
push eax
lea ecx, [ebp - 0x284]
call fcn.00402caf
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x284]
push ebx
push eax
push 8
mov byte [ebp - 4], 0x16
call fcn.0040833f
lea ecx, [ebp - 0x284]
mov byte [ebp - 4], 0x14
call fcn.00401f95
lea eax, [ebp - 0x400]
push 1
lea esi, [ebp - 0x400]
push eax
push 0x48f300
jmp 0x417b68
push dword [ebp + 8]
call fcn.0041694b
cmp dword [ebp - 0x10], ebx
pop ecx
je 0x417be6
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], ebx
jmp 0x417be6
add esi, 7
push edi
push esi
push str._verbose
mov ecx, dword [ebp + 8]
call fcn.004315f3
cmp esi, ebx
je 0x417b87
push esi
push 0x498e70
mov byte [0x499e74], 1
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp dword [ebp - 0x10], ebx
je 0x417bcc
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], ebx
jmp 0x417bcc
mov eax, dword [ebp + 8]
mov dword [eax + 0x4c], edi
jmp 0x417bcc
mov eax, dword [ebp + 8]
cmp dword [eax + 0x24], ebx
je 0x417bad
push eax
jmp 0x417be0
mov dword [eax + 0x24], 4
jmp 0x417bcc
push ebx
push esi
call dword [sym.imp.USER32.dll_CharNextA]
push eax
push 0x48fe00
mov ecx, dword [ebp + 8]
call fcn.004315f3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.00401f95
push 1
pop eax
jmp 0x417bf4
push dword [ebp + 8]
call fcn.0041694b
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.00401f95
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret