Function at 0x439ed0
Capabilities:
Delete registry value
Get geographical location
Identify system language via api
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b612b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4a0
push ebx
push esi
push edi
xor edx, edx
xor bl, bl
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x48], edx
mov byte [ebp - 0x22], bl
mov byte [ebp - 0x21], bl
mov byte [ebp - 0x19], bl
mov dword [ebp - 4], edx
mov dword [ebp - 0x4c], 0x5d6444
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x180]
mov byte [ebp - 0x80], al
rep stosd dword es:[edi], eax
mov ecx, dword [0x682bcc]
lea eax, [ebp - 0x14]
push eax
push 1
push edx
push ecx
push reloc.WSOCK32.dll_bind
mov byte [ebp - 4], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
mov edi, 0x32
jne 0x439ff2
mov ecx, dword [0x682bd8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x1b4]
push edx
mov edx, dword [ebp - 0x14]
push eax
push 0
push 0
push ecx
push edx
mov dword [ebp - 0x18], edi
call esi
test eax, eax
jne 0x439f75
mov bl, 1
mov edx, dword [0x682bd4]
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x1e8]
push eax
mov eax, dword [ebp - 0x14]
push ecx
push 0
push 0
push edx
push eax
mov dword [ebp - 0x18], edi
call esi
test eax, eax
jne 0x439f9c
mov byte [ebp - 0x22], 1
mov eax, dword [0x682bd0]
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x21c]
push ecx
mov ecx, dword [ebp - 0x14]
push edx
push 0
push 0
push eax
push ecx
mov dword [ebp - 0x18], edi
call esi
test eax, eax
jne 0x439fc2
mov byte [ebp - 0x21], 1
mov ecx, dword [0x682bdc]
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x80]
push edx
mov edx, dword [ebp - 0x14]
push eax
push 0
push 0
push ecx
push edx
mov dword [ebp - 0x18], edi
call esi
test eax, eax
jne 0x439fe6
mov byte [ebp - 0x19], 1
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x439ff8
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [ebp - 0x14]
push 0
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareDownloadManager_
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x43a0e9
test bl, bl
jne 0x43a051
mov ecx, dword [0x682bd8]
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x1b4]
push edx
mov edx, dword [ebp - 0x14]
push eax
push 0
push 0
push ecx
push edx
mov dword [ebp - 0x18], edi
call esi
test eax, eax
je 0x43a051
mov dword [ebp - 0x48], 5
mov al, byte [ebp - 0x22]
mov ebx, 5
test al, al
jne 0x43a083
mov edx, dword [0x682bd4]
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x1e8]
push eax
mov eax, dword [ebp - 0x14]
push ecx
push 0
push 0
push edx
push eax
mov dword [ebp - 0x18], edi
call esi
test eax, eax
je 0x43a083
mov dword [ebp - 0x48], ebx
mov al, byte [ebp - 0x21]
test al, al
jne 0x43a0af
mov eax, dword [0x682bd0]
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x21c]
push ecx
mov ecx, dword [ebp - 0x14]
push edx
push 0
push 0
push eax
push ecx
mov dword [ebp - 0x18], edi
call esi
test eax, eax
je 0x43a0af
mov dword [ebp - 0x48], ebx
mov al, byte [ebp - 0x19]
test al, al
jne 0x43a0df
mov ecx, dword [0x682bdc]
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x80]
push edx
mov edx, dword [ebp - 0x14]
push eax
push 0
push 0
push ecx
push edx
mov dword [ebp - 0x18], edi
call esi
test eax, eax
je 0x43a0db
mov dword [ebp - 0x48], ebx
jmp 0x43a0df
mov byte [ebp - 0x19], 1
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov bl, byte [ebp - 0x19]
test bl, bl
je 0x43a11e
lea edi, [ebp - 0x80]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x17
jne 0x43a11e
cmp byte [ebp - 0x7b], 0x2d
jne 0x43a11e
cmp byte [ebp - 0x75], 0x2d
jne 0x43a11e
cmp byte [ebp - 0x6f], 0x2d
jne 0x43a11e
mov dword [0x65a724], 0
lea ecx, [ebp - 0x34]
call fcn.004da940
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 2
call fcn.004da940
mov eax, dword [0x65a724]
mov byte [ebp - 4], 3
test eax, eax
jne 0x43a2fb
mov eax, dword [0x6825b8]
mov edx, dword [0x682e94]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [ebp - 0x14]
neg eax
push ecx
push 1
sbb eax, eax
push 0
add eax, reloc.WSOCK32.dll_bind
push edx
push eax
call edi
mov esi, eax
test esi, esi
je 0x43a1f4
cmp esi, 2
je 0x43a1f0
mov ecx, dword [0x67da2c]
mov dword [ebp - 0x20], ecx
mov eax, dword [0x6825b8]
mov byte [ebp - 4], 4
test eax, eax
mov eax, str.CURRENT_USER
jne 0x43a198
mov eax, str.MACHINE
mov edx, dword [0x682e94]
push edx
push eax
lea eax, [ebp - 0x20]
push 0x6579bc
push eax
call fcn.00599a28
mov ecx, dword [ebp - 0x20]
add esp, 0x10
push ecx
lea ecx, [ebp - 0x34]
call fcn.004da9f0
test eax, eax
je 0x43a1e4
mov ecx, dword [0x6825b8]
mov eax, dword [0x682e94]
lea edx, [ebp - 0x14]
neg ecx
push edx
push 1
sbb ecx, ecx
push 0
add ecx, reloc.WSOCK32.dll_bind
push eax
push ecx
call edi
mov esi, eax
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 3
call fcn.005a0c5d
test esi, esi
jne 0x43a229
mov ecx, dword [0x682ad4]
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x180]
push edx
mov edx, dword [ebp - 0x14]
push eax
push 0
push 0
push ecx
push edx
mov dword [ebp - 0x18], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x20], eax
jne 0x43a40a
lea eax, [ebp - 0x14]
push 0
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareClassesCLSIDD5B91409_A8CA_4973_9A0B_59F713D25671
push reloc.WSOCK32.dll_accept
call esi
test eax, eax
je 0x43a2cf
mov ecx, dword [0x67da2c]
mov dword [ebp - 0x20], ecx
push str.SoftwareClassesCLSIDD5B91409_A8CA_4973_9A0B_59F713D25671
lea edx, [ebp - 0x20]
push str.CURRENT_USER_s
push edx
mov byte [ebp - 4], 5
call fcn.00599a28
mov eax, dword [ebp - 0x20]
add esp, 0xc
lea ecx, [ebp - 0x44]
push eax
call fcn.004da9f0
test eax, eax
jne 0x43a296
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 3
call fcn.005a0c5d
jmp 0x43aaaf
lea ecx, [ebp - 0x14]
push 0
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareClassesCLSIDD5B91409_A8CA_4973_9A0B_59F713D25671
push reloc.WSOCK32.dll_accept
call esi
test eax, eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x20]
je 0x43a2ca
call fcn.005a0c5d
jmp 0x43aaaf
call fcn.005a0c5d
mov ecx, dword [0x682ad4]
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x180]
push edx
mov edx, dword [ebp - 0x14]
push eax
push 0
push 0
push ecx
push edx
mov dword [ebp - 0x18], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
jmp 0x43a3fd
mov ecx, dword [0x682e90]
lea eax, [ebp - 0x14]
push 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push ecx
mov cl, byte [0x6825c4]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
xor edx, edx
test cl, cl
setne dl
add edx, reloc.WSOCK32.dll_accept
push edx
call edi
test eax, eax
je 0x43a3db
mov eax, dword [0x67da2c]
mov dword [ebp - 0x20], eax
mov al, byte [0x6825c4]
mov byte [ebp - 4], 6
test al, al
mov eax, str.MACHINE
jne 0x43a358
mov eax, str.CURRENT_USER
mov ecx, dword [0x682e90]
lea edx, [ebp - 0x20]
push ecx
push eax
push 0x6579bc
push edx
call fcn.00599a28
mov eax, dword [ebp - 0x20]
add esp, 0x10
lea ecx, [ebp - 0x34]
push eax
call fcn.004da9f0
test eax, eax
jne 0x43a392
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 3
call fcn.005a0c5d
jmp 0x43aaaf
mov edx, dword [0x682e90]
lea ecx, [ebp - 0x14]
push 0
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push edx
mov dl, byte [0x6825c4]
xor eax, eax
test dl, dl
setne al
add eax, reloc.WSOCK32.dll_accept
push eax
call edi
test eax, eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x20]
je 0x43a3d6
call fcn.005a0c5d
jmp 0x43aaaf
call fcn.005a0c5d
mov eax, dword [0x682ad4]
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x180]
push ecx
mov ecx, dword [ebp - 0x14]
push edx
push 0
push 0
push eax
push ecx
mov dword [ebp - 0x18], 0x100
call esi
neg eax
sbb eax, eax
inc eax
test eax, eax
je 0x43aaa5
mov eax, dword [0x65a724]
test eax, eax
jne 0x43a50f
test bl, bl
je 0x43a50f
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov ecx, 0x20
xor eax, eax
lea edi, [ebp - 0x29c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x29c]
push 0x80
push eax
push 0x1001
push 0x800
call esi
test eax, eax
jle 0x43a474
push 0xa
lea ecx, [ebp - 0x29c]
push str.Vietnamese
push ecx
call fcn.00586aa0
add esp, 0xc
test eax, eax
jne 0x43a474
mov dword [0x6825b4], 1
lea edx, [ebp - 0x29c]
push 0x80
push edx
push 0x1002
push 0x400
call esi
test eax, eax
jle 0x43a4b7
push 8
lea eax, [ebp - 0x29c]
push str.Viet_Nam
push eax
call fcn.00586aa0
add esp, 0xc
test eax, eax
jne 0x43a4b7
mov edi, 1
mov dword [0x6825b4], edi
jmp 0x43a4bc
mov edi, 1
lea ecx, [ebp - 0x29c]
push 0x80
push ecx
push 0x1001
push 0x400
call esi
test eax, eax
jle 0x43a4f8
push 0xa
lea edx, [ebp - 0x29c]
push str.Vietnamese
push edx
call fcn.00586aa0
add esp, 0xc
test eax, eax
jne 0x43a4f8
mov dword [0x6825b4], edi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
and eax, 0x3ff
cmp ax, 0x2a
jne 0x43a50f
mov dword [0x6825b4], edi
mov edx, dword [0x683758]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ebp - 0x180]
push ecx
push edx
push 0x100
push eax
lea ecx, [ebp - 0x4c]
call fcn.0043ac30
mov eax, dword [0x65a724]
test eax, eax
je 0x43a5b8
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x682ad8]
lea esi, [ebp - 0x180]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x43a57d
test cl, cl
je 0x43a579
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x43a57d
add eax, 2
add esi, 2
test cl, cl
jne 0x43a555
xor eax, eax
jmp 0x43a582
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x44]
jne 0x43ab23
call fcn.004da980
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 1
call fcn.004da980
mov eax, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test bl, bl
je 0x43a7e7
mov esi, dword [0x682ae4]
lea eax, [ebp - 0x80]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x43a5f1
test cl, cl
je 0x43a5ed
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x43a5f1
add eax, 2
add esi, 2
test cl, cl
jne 0x43a5c9
xor eax, eax
jmp 0x43a5f6
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x43a672
mov edi, dword [0x682adc]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x180]
mov eax, ecx
mov esi, edi
mov edi, edx
mov edx, dword [0x683754]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
lea ecx, [ebp - 0x180]
push 0x100
push ecx
lea ecx, [ebp - 0x4c]
call fcn.0043ab90
mov eax, dword [0x682ad4]
mov ecx, dword [ebp - 0x14]
lea edx, [ebp - 0x180]
push 0x100
push edx
push 0
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 0x14]
push edx
jmp 0x43a827
mov esi, dword [0x682ae0]
lea eax, [ebp - 0x80]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x43a6a3
test cl, cl
je 0x43a69f
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x43a6a3
add eax, 2
add esi, 2
test cl, cl
jne 0x43a67b
xor eax, eax
jmp 0x43a6a8
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x43a823
mov esi, dword [0x682adc]
lea eax, [ebp - 0x80]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x43a6e1
test cl, cl
je 0x43a6dd
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x43a6e1
add eax, 2
add esi, 2
test cl, cl
jne 0x43a6b9
xor eax, eax
jmp 0x43a6e6
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x43a823
mov esi, dword [0x682ad8]
lea eax, [ebp - 0x80]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x43a71f
test cl, cl
je 0x43a71b
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x43a71f
add eax, 2
add esi, 2
test cl, cl
jne 0x43a6f7
xor eax, eax
jmp 0x43a724
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x43a823
mov esi, dword [0x682aec]
lea eax, [ebp - 0x80]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x43a75d
test cl, cl
je 0x43a759
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x43a75d
add eax, 2
add esi, 2
test cl, cl
jne 0x43a735
xor eax, eax
jmp 0x43a762
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x43a823
mov esi, dword [0x682ae8]
lea eax, [ebp - 0x80]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x43a79b
test cl, cl
je 0x43a797
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x43a79b
add eax, 2
add esi, 2
test cl, cl
jne 0x43a773
xor eax, eax
jmp 0x43a7a0
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x43a823
lea esi, [ebp - 0x180]
lea eax, [ebp - 0x80]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x43a7d5
test cl, cl
je 0x43a7d1
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x43a7d5
add eax, 2
add esi, 2
test cl, cl
jne 0x43a7ad
xor eax, eax
jmp 0x43a7da
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x43a7e7
mov eax, dword [ebp - 0x14]
push eax
jmp 0x43aaa9
mov eax, dword [0x682ae4]
lea esi, [ebp - 0x180]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x43a81a
test cl, cl
je 0x43a816
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x43a81a
add eax, 2
add esi, 2
test cl, cl
jne 0x43a7f2
xor eax, eax
jmp 0x43a81f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x43a85b
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 2
call fcn.004da980
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 1
call fcn.004da980
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x682ae0]
lea esi, [ebp - 0x180]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x43a88e
test cl, cl
je 0x43a88a
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x43a88e
add eax, 2
add esi, 2
test cl, cl
jne 0x43a866
xor eax, eax
jmp 0x43a893
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x43a8cf
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 2
call fcn.004da980
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 1
call fcn.004da980
mov eax, 2
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x682adc]
lea esi, [ebp - 0x180]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x43a902
test cl, cl
je 0x43a8fe
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x43a902
add eax, 2
add esi, 2
test cl, cl
jne 0x43a8da
xor eax, eax
jmp 0x43a907
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x43a947
mov eax, dword [0x682aec]
lea esi, [ebp - 0x180]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x43a93e
test cl, cl
je 0x43a93a
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x43a93e
add eax, 2
add esi, 2
test cl, cl
jne 0x43a916
xor eax, eax
jmp 0x43a943
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x43a97f
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 2
call fcn.004da980
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 1
call fcn.004da980
mov eax, 3
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x682ae8]
lea esi, [ebp - 0x180]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x43a9b2
test cl, cl
je 0x43a9ae
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x43a9b2
add eax, 2
add esi, 2
test cl, cl
jne 0x43a98a
xor eax, eax
jmp 0x43a9b7
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x43a9f3
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 2
call fcn.004da980
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 1
call fcn.004da980
mov eax, 7
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x682ad8]
lea esi, [ebp - 0x180]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x43aa26
test cl, cl
je 0x43aa22
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x43aa26
add eax, 2
add esi, 2
test cl, cl
jne 0x43a9fe
xor eax, eax
jmp 0x43aa2b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x43ab12
cmp dword [ebp - 0x48], 5
je 0x43aada
lea edi, [ebp - 0x1b4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x43aada
lea edi, [ebp - 0x1e8]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x43aada
lea edi, [ebp - 0x21c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x43aada
lea edi, [ebp - 0x80]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x17
jne 0x43aada
cmp byte [ebp - 0x7b], 0x2d
jne 0x43aada
cmp byte [ebp - 0x75], 0x2d
jne 0x43aada
cmp byte [ebp - 0x6f], 0x2d
jne 0x43aada
mov eax, dword [0x682ad4]
mov ecx, dword [ebp - 0x14]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 2
call fcn.004da980
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 1
call fcn.004da980
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 2
call fcn.004da980
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 1
call fcn.004da980
mov eax, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x44]
call fcn.004da980
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 1
call fcn.004da980
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, 6
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret