Function at 0x4184b6
Capabilities:
Copy file
Persist via run registry key
Set file attributes
Set registry value

Disassembly:
mov eax, 0x4468d5
call fcn.004312c8
mov eax, 0x22ac
call fcn.00431990
push ebx
push esi
push edi
mov dword [ebp - 0x28], ecx
call fcn.00401046
mov dword [ebp - 0x1c], eax
xor esi, esi
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0xab6]
mov word [ebp - 0xab8], si
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 0x1c]
stosw word es:[edi], ax
call fcn.00426620
test eax, eax
jne 0x418645
lea ecx, [ebp - 0xc4]
call fcn.00401986
mov eax, dword [0x4613b0]
mov dword [ebp - 4], esi
cmp eax, esi
jne 0x41851e
mov eax, 0x4494dc
push eax
lea eax, [ebp - 0xab8]
push 0x461bd8
push eax
call fcn.0042d32b
mov ebx, dword [sym.imp.KERNEL32.dll_CopyFileW]
lea eax, [ebp - 0xab8]
push esi
push eax
push 0x45fdc8
call ebx
lea eax, [ebp - 0xab8]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0xab8]
lea ecx, [ebp - 0xc4]
push eax
call fcn.00401dc9
push 9
xor eax, eax
pop ecx
lea edi, [ebp - 0x66]
push dword [0x4609f0]
mov word [ebp - 0x68], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x68]
push str._04x
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x1ab8]
push eax
lea eax, [ebp - 0x22b8]
push eax
push 0x45fdc8
call fcn.0042d0d3
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x22b8]
push eax
lea eax, [ebp - 0x1ab8]
push eax
call fcn.0042d32b
lea eax, [ebp - 0x1ab8]
push str..ini
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x12b6]
mov word [ebp - 0x12b8], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x12b8]
push 0x461bd8
push eax
call fcn.0042d32b
lea eax, [ebp - 0x12b8]
push str..ini
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x12b8]
push esi
push eax
lea eax, [ebp - 0x1ab8]
push eax
call ebx
lea eax, [ebp - 0x12b8]
lea ecx, [ebp - 0xc4]
push eax
call fcn.00401dc9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc4]
call fcn.004019b3
jmp 0x418657
lea eax, [ebp - 0xab8]
push 0x45fdc8
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [str.NoSuppressRebootKey]
mov ebx, 0x4494c4
mov edi, 0x4494bc
cmp eax, esi
mov dword [ebp - 0x114], ebx
mov dword [ebp - 0xf4], edi
jne 0x41867b
mov eax, 0x45d464
lea ecx, [ebp - 0x2d]
push esi
push ecx
push eax
lea ecx, [ebp - 0x114]
call fcn.0040856d
mov eax, dword [str.Startup]
mov dword [ebp - 4], 1
cmp eax, esi
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x48], edi
jne 0x4186a7
mov eax, 0x45d464
lea ecx, [ebp - 0x1d]
push esi
push ecx
push eax
lea ecx, [ebp - 0x68]
call fcn.0040856d
mov ecx, dword [ebp - 0x1c]
push 0xa
lea eax, [ebp - 0x114]
push esi
push eax
lea eax, [ebp - 0x68]
push eax
mov byte [ebp - 4], 2
call fcn.00428018
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x38], eax
mov byte [ebp - 4], 1
call fcn.00401929
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x114]
call fcn.00401929
lea eax, [ebp - 0x1d]
mov ebx, 0x449504
mov edi, 0x4494fc
push esi
push eax
lea ecx, [ebp - 0xec]
mov dword [ebp - 0xec], ebx
mov dword [ebp - 0xcc], edi
call fcn.004026fa
mov dword [ebp - 4], 3
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x1d]
push esi
push eax
lea ecx, [ebp - 0x164]
mov byte [ebp - 4], 4
mov dword [ebp - 0x164], ebx
mov dword [ebp - 0x144], edi
call fcn.004026fa
mov eax, dword [ebp - 0x38]
mov byte [ebp - 4], 5
sub eax, esi
je 0x418773
dec eax
je 0x418755
dec eax
jne 0x41878f
mov eax, str.SoftwareMicrosoftWindowsCurrentVersionRun
jmp 0x41875a
mov eax, str.SoftwareMicrosoftWindowsCurrentVersionRunOnceEx
mov ecx, eax
test ecx, ecx
jne 0x418765
mov eax, 0x45d464
push eax
lea ecx, [ebp - 0x164]
call fcn.004039ae
jmp 0x418799
mov eax, str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
mov ecx, eax
test ecx, ecx
jne 0x418783
mov eax, 0x45d464
push eax
lea ecx, [ebp - 0x164]
call fcn.004039ae
cmp dword [ebp - 0x38], 3
je 0x418f93
mov eax, dword [ebp - 0x15c]
cmp eax, esi
jne 0x4187a8
mov eax, 0x44952c
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push ecx
push 0xf003f
push esi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x418f93
lea ecx, [ebp - 0x18]
call fcn.0040b71b
mov ecx, dword [ebp - 0x10]
cmp eax, esi
mov dword [ebp - 0x18], ecx
jne 0x418f93
mov eax, dword [ebp + 8]
mov dword [ebp - 0x240], ebx
cmp eax, esi
mov dword [ebp - 0x220], edi
jne 0x4187f7
mov eax, 0x45d464
lea ecx, [ebp + 0xb]
push esi
push ecx
push eax
lea ecx, [ebp - 0x240]
call fcn.00403912
cmp dword [ebp + 0xc], esi
mov byte [ebp - 4], 6
je 0x41882d
push str._AFTERREBOOT1
call fcn.004319bf
pop ecx
push eax
push str._AFTERREBOOT1
lea ecx, [ebp - 0x23c]
call fcn.0041022c
lea eax, [ebp + 0xf]
push esi
push eax
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x70], edi
call fcn.004026fa
mov eax, dword [ebp - 0x1c]
mov byte [ebp - 4], 7
mov eax, dword [eax + 0x14]
dec eax
je 0x41892a
dec eax
je 0x4188d5
dec eax
je 0x41887b
dec eax
je 0x418871
dec eax
jne 0x418946
mov eax, 0x457eec
jmp 0x41892f
mov eax, 0x457ee4
jmp 0x41892f
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x2b8]
push 9
push eax
call fcn.00407b55
push eax
lea eax, [ebp - 0x13c]
push 0x456bfc
push eax
mov byte [ebp - 4], 0xa
call fcn.0041f5ad
add esp, 0xc
push eax
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 0xb
call fcn.00401d48
lea ecx, [ebp - 0x13c]
mov byte [ebp - 4], 0xa
call fcn.00401cce
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x2b8]
call fcn.00401cce
jmp 0x418946
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0xb8]
push 9
push eax
call fcn.00407b55
push eax
lea eax, [ebp - 0x290]
push 0x456c64
push eax
mov byte [ebp - 4], 8
call fcn.0041f5ad
add esp, 0xc
push eax
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 9
call fcn.00401d48
lea ecx, [ebp - 0x290]
mov byte [ebp - 4], 8
call fcn.00401cce
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xb8]
jmp 0x4188ce
mov eax, 0x456d00
mov ecx, eax
test ecx, ecx
jne 0x41893a
mov eax, 0x45d464
push eax
lea ecx, [ebp - 0x90]
call fcn.004039ae
mov ecx, dword [ebp - 0x1c]
call fcn.00426620
test eax, eax
mov eax, 0x457edc
jne 0x41895c
mov eax, 0x45d464
cmp eax, esi
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x48], edi
jne 0x41896b
mov eax, 0x45d464
lea ecx, [ebp - 0x2d]
push esi
push ecx
push eax
lea ecx, [ebp - 0x68]
call fcn.00403912
mov ecx, dword [ebp - 0x1c]
mov byte [ebp - 4], 0xc
call fcn.004249f9
cmp eax, esi
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x1f8], edi
jne 0x41899a
mov eax, 0x45d464
lea ecx, [ebp - 0x3a]
push esi
push ecx
push eax
lea ecx, [ebp - 0x218]
call fcn.00403912
mov ecx, dword [ebp - 0x1c]
mov byte [ebp - 4], 0xd
call fcn.00424a47
cmp eax, esi
mov dword [ebp - 0x114], ebx
mov dword [ebp - 0xf4], edi
jne 0x4189cc
mov eax, 0x45d464
lea ecx, [ebp - 0x39]
push esi
push ecx
push eax
lea ecx, [ebp - 0x114]
call fcn.00403912
mov eax, 0x461bd8
mov byte [ebp - 4], 0xe
test eax, eax
mov dword [ebp - 0x268], ebx
mov dword [ebp - 0x248], edi
jne 0x4189fb
mov eax, 0x45d464
lea ecx, [ebp - 0x3c]
push esi
push ecx
push eax
lea ecx, [ebp - 0x268]
call fcn.00403912
mov ecx, dword [ebp - 0x1c]
mov byte [ebp - 4], 0xf
call fcn.00426620
test eax, eax
je 0x418a95
mov eax, dword [ebp - 0x28]
cmp dword [eax + 0x54], esi
jne 0x418a95
mov edx, dword [ebp - 0x60]
mov eax, 0x44952c
cmp edx, esi
jne 0x418a32
mov edx, eax
mov ecx, dword [ebp - 0x238]
mov dword [ebp - 0x10], eax
cmp ecx, esi
je 0x418a42
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x260]
mov dword [ebp - 0x34], eax
cmp ecx, esi
je 0x418a52
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x10c]
mov dword [ebp - 0x28], eax
cmp ecx, esi
je 0x418a62
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x88]
cmp ecx, esi
jne 0x418a6e
mov ecx, eax
cmp dword [ebp - 0x210], esi
je 0x418a7c
mov eax, dword [ebp - 0x210]
push edx
push dword [ebp - 0x10]
push dword [ebp - 0x34]
push dword [ebp - 0x28]
push dword [0x4609f0]
push ecx
push eax
push str.__s___k__s__l_d__t__s___e__s___w__v__s___s
jmp 0x418b04
mov edx, dword [ebp - 0x60]
mov eax, 0x44952c
cmp edx, esi
jne 0x418aa3
mov edx, eax
mov ecx, dword [ebp - 0x238]
mov dword [ebp - 0x28], eax
cmp ecx, esi
je 0x418ab3
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x260]
mov dword [ebp - 0x34], eax
cmp ecx, esi
je 0x418ac3
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x10c]
mov dword [ebp - 0x10], eax
cmp ecx, esi
je 0x418ad3
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x88]
cmp ecx, esi
jne 0x418adf
mov ecx, eax
cmp dword [ebp - 0x210], esi
je 0x418aed
mov eax, dword [ebp - 0x210]
push edx
push dword [ebp - 0x28]
push dword [ebp - 0x34]
push dword [ebp - 0x10]
push dword [0x4609f0]
push ecx
push eax
push str.__s___s__l_d__t__s___e__s___v__s___s
lea eax, [ebp - 0xec]
push eax
call fcn.0041e0ff
mov eax, dword [ebp - 0x1c]
add esp, 0x24
cmp dword [eax + 0xc04], esi
je 0x418b99
add eax, 0xbf8
push eax
lea eax, [ebp - 0x290]
push str.__debuglog_
push eax
call fcn.0041f512
push 0x456f9c
push eax
lea eax, [ebp - 0xb8]
mov byte [ebp - 4], 0x10
push eax
call fcn.0041f648
add esp, 0x18
mov eax, dword [eax + 8]
mov byte [ebp - 4], 0x11
cmp eax, esi
mov dword [ebp - 0x10], 0x4494dc
je 0x418b63
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
call fcn.004319bf
pop ecx
push eax
lea ecx, [ebp - 0xe8]
push dword [ebp - 0x10]
call fcn.0041022c
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0x10
call fcn.00401929
lea ecx, [ebp - 0x290]
mov byte [ebp - 4], 0xf
call fcn.00401929
cmp dword [ebp - 0x38], 1
jne 0x418bd5
lea eax, [ebp - 0x34]
mov dword [ebp - 0x28], esi
push eax
lea eax, [ebp - 0x28]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push str.0001
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, esi
jne 0x418bd5
lea ecx, [ebp - 0x18]
call fcn.0040b71b
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x240]
push esi
push eax
lea ecx, [ebp - 0x1f0]
mov dword [ebp - 0x1f0], ebx
mov dword [ebp - 0x1d0], edi
call fcn.0040387f
mov ecx, dword [ebp - 0x1c]
mov byte [ebp - 4], 0x12
call fcn.00424a47
cmp eax, esi
mov dword [ebp - 0x18c], ebx
mov dword [ebp - 0x16c], edi
jne 0x418c15
mov eax, 0x45d464
lea ecx, [ebp - 0x3d]
push esi
push ecx
push eax
lea ecx, [ebp - 0x18c]
call fcn.00403912
mov eax, 0x461bd8
mov byte [ebp - 4], 0x13
test eax, eax
mov dword [ebp - 0x1c8], ebx
mov dword [ebp - 0x1a8], edi
jne 0x418c44
mov eax, 0x45d464
lea ecx, [ebp - 0x3b]
push esi
push ecx
push eax
lea ecx, [ebp - 0x1c8]
call fcn.00403912
cmp dword [ebp - 0x180], esi
mov byte [ebp - 4], 0x14
je 0x418c7f
lea eax, [ebp - 0xb8]
push esi
push eax
lea ecx, [ebp - 0x18c]
call fcn.0040ff58
lea ecx, [ebp - 0xb8]
call fcn.00401cce
cmp dword [ebp - 0x1bc], esi
je 0x418ca5
lea eax, [ebp - 0xb8]
push esi
push eax
lea ecx, [ebp - 0x1c8]
call fcn.0040ff58
lea ecx, [ebp - 0xb8]
call fcn.00401cce
mov edi, dword [ebp - 0xe4]
cmp edi, esi
jne 0x418cb4
mov edi, 0x44952c
lea eax, [ebp - 0x11]
push 1
push eax
push str.C:CodeBasesisdev_srcRuntimeMSISharedSetupmsiaction.cpp
lea ecx, [ebp - 0xb8]
call fcn.00401504
mov eax, dword [eax + 8]
mov byte [ebp - 4], 0x15
cmp eax, esi
jne 0x418cda
mov eax, 0x4494dc
mov dword [ebp - 0x2c], eax
push edi
lea eax, [ebp - 0x2c]
push str.MsiAction::Reboot_command_line__s
push eax
mov dword [ebp - 0x28], 0x6ae
call fcn.00407c61
add esp, 0xc
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0x14
call fcn.00401929
mov dword [ebp - 0x24], esi
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0x16
push eax
push 0xf003f
push esi
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x28], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, esi
jne 0x418ec4
lea ecx, [ebp - 0x24]
call fcn.0040b71b
mov ecx, dword [ebp - 0x28]
cmp eax, esi
mov dword [ebp - 0x24], ecx
jne 0x418ec4
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0x10], 0x44952c
cmp eax, esi
je 0x418d67
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
call ebx
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0x10]
push 1
push esi
push str._IS_T_
push dword [ebp - 0x24]
call edi
mov eax, dword [ebp - 0x1c0]
mov dword [ebp - 0x10], 0x44952c
cmp eax, esi
je 0x418d95
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
call ebx
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0x10]
push 1
push esi
push str._IS_E_
push dword [ebp - 0x24]
call edi
cmp dword [ebp - 0x1e4], esi
je 0x418de5
mov eax, dword [ebp - 0x1e8]
mov dword [ebp - 0x10], 0x44952c
cmp eax, esi
je 0x418dcb
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
call ebx
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0x10]
push 1
push esi
push 0x456a10
push dword [ebp - 0x24]
call edi
cmp dword [ebp - 0x24], esi
je 0x418df6
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x24], esi
lea eax, [ebp - 0x11]
push 1
push eax
push str._IS_T_
lea ecx, [ebp - 0x13c]
call fcn.00403912
lea eax, [ebp - 0x13c]
lea ecx, [ebp - 0xec]
push eax
lea eax, [ebp - 0x18c]
push eax
mov byte [ebp - 4], 0x17
call fcn.004039d7
lea ecx, [ebp - 0x13c]
mov byte [ebp - 4], 0x16
call fcn.00401cce
lea eax, [ebp - 0x11]
push 1
push eax
push str._IS_E_
lea ecx, [ebp - 0x13c]
call fcn.00403912
lea eax, [ebp - 0x13c]
lea ecx, [ebp - 0xec]
push eax
lea eax, [ebp - 0x1c8]
push eax
mov byte [ebp - 4], 0x18
call fcn.004039d7
lea ecx, [ebp - 0x13c]
mov byte [ebp - 4], 0x16
call fcn.00401cce
cmp dword [ebp - 0x1e4], esi
je 0x418ec4
lea eax, [ebp - 0x11]
push 1
push eax
push 0x456a10
lea ecx, [ebp - 0x13c]
call fcn.00403912
lea eax, [ebp - 0x13c]
lea ecx, [ebp - 0xec]
push eax
lea eax, [ebp - 0x1f0]
push eax
mov byte [ebp - 4], 0x19
call fcn.004039d7
lea ecx, [ebp - 0x13c]
mov byte [ebp - 4], 0x16
call fcn.00401cce
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x10], 0x44952c
cmp eax, esi
je 0x418ed8
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
call ebx
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0x10]
push 1
push esi
push str.ISSetup
push dword [ebp - 0x18]
call edi
cmp dword [ebp - 0x18], esi
je 0x418f03
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0x14
call fcn.0040b71b
lea ecx, [ebp - 0x1c8]
mov byte [ebp - 4], 0x13
call fcn.00401cce
lea ecx, [ebp - 0x18c]
mov byte [ebp - 4], 0x12
call fcn.00401cce
lea ecx, [ebp - 0x1f0]
mov byte [ebp - 4], 0xf
call fcn.00401cce
lea ecx, [ebp - 0x268]
mov byte [ebp - 4], 0xe
call fcn.00401cce
lea ecx, [ebp - 0x114]
mov byte [ebp - 4], 0xd
call fcn.00401cce
lea ecx, [ebp - 0x218]
mov byte [ebp - 4], 0xc
call fcn.00401cce
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 7
call fcn.00401cce
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 6
call fcn.00401cce
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 5
call fcn.00401cce
xor eax, eax
lea edi, [ebp - 0x19e]
mov word [ebp - 0x1a0], si
mov dword [ebp - 0x68], 0x4494c4
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [str.Type]
mov dword [ebp - 0x48], 0x4494bc
cmp eax, esi
jne 0x418fc4
mov eax, 0x45d464
lea ecx, [ebp + 0xb]
push esi
push ecx
push eax
lea ecx, [ebp - 0x68]
call fcn.0040856d
mov edi, dword [ebp - 0x1c]
lea eax, [ebp - 0x290]
push 6
push eax
mov ecx, edi
mov byte [ebp - 4], 0x1a
call fcn.00407b55
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0x1b
push ecx
mov ecx, eax
call fcn.0041df30
push 0xa
lea ecx, [ebp - 0x68]
push esi
push ecx
push eax
mov ecx, edi
mov byte [ebp - 4], 0x1c
call fcn.00428018
lea ecx, [ebp - 0xb8]
mov ebx, eax
mov byte [ebp - 4], 0x1b
call fcn.00401929
lea ecx, [ebp - 0x290]
mov byte [ebp - 4], 0x1a
call fcn.00401cce
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 5
call fcn.00401929
push 0xc
mov ecx, edi
call fcn.00407b30
test al, al
jne 0x419055
cmp ebx, 1
je 0x419055
cmp ebx, 2
jne 0x4190fd
push 4
lea eax, [ebp - 0x1a0]
push 0x457dc8
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [ebp - 0x88]
call fcn.0040226e
lea eax, [ebp - 0xab8]
lea ecx, [ebp - 0x88]
push eax
mov byte [ebp - 4], 0x1d
call fcn.004022b6
lea eax, [ebp - 0xb8]
push 6
push eax
mov ecx, edi
call fcn.00407b55
mov eax, dword [eax + 8]
mov byte [ebp - 4], 0x1e
cmp eax, esi
jne 0x4190ad
mov eax, 0x44952c
lea ecx, [ebp - 0x1a0]
push ecx
lea ecx, [ebp - 0x88]
push dword [0x449648]
push eax
call fcn.004022f5
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 0x1d
call fcn.00401cce
lea ecx, [ebp - 0x88]
call fcn.004022e2
push 1
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 0x1f
call fcn.00402c37
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 5
call fcn.0040368e
cmp dword [ebp - 0x38], 3
je 0x41911d
cmp dword [0x4623e0], esi
je 0x419112
call fcn.0042daa2
jmp 0x41911d
push 0x453
call fcn.0042ca21
pop ecx
lea ecx, [ebp - 0x164]
mov byte [ebp - 4], 4
call fcn.00401cce
cmp dword [ebp - 0x18], esi
je 0x41913d
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x18], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xec]
call fcn.00401cce
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8