Function at 0x49fa40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63db1a
mov eax, dword fs:[0]
push eax
mov eax, 0x62dc
call fcn.00610bb0
mov eax, dword [0x721970]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x626c], ecx
mov dword [ebp - 0x6030], 0
lea ecx, [ebp - 0x6028]
call fcn.004a2270
mov dword [ebp - 4], 1
push 0x17
push 0
push 0x66f7d4
lea ecx, [ebp - 0x6028]
call fcn.0045d870
mov dword [ebp - 0x6080], eax
cmp dword [ebp - 0x6080], 0
jge 0x49fae5
push 0
mov ecx, dword [ebp + 8]
call fcn.00435240
mov eax, dword [ebp - 0x6030]
or eax, 1
mov dword [ebp - 0x6030], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x6028]
call fcn.00468ec0
mov eax, dword [ebp + 8]
jmp 0x4a1e8d
mov ecx, dword [0x71e614]
push ecx
lea ecx, [ebp - 0x6264]
call fcn.0040bfc0
mov dword [ebp - 0x6178], eax
mov edx, dword [ebp - 0x6178]
mov dword [ebp - 0x6260], edx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x6260]
push eax
lea ecx, [ebp - 0x62e8]
call fcn.0045d6b0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x62e8]
push ecx
push ecx
mov ecx, esp
mov dword [ebp - 0x62d0], esp
mov edx, dword [0x71e610]
push edx
call fcn.0040bfc0
mov dword [ebp - 0x6268], eax
mov eax, dword [ebp - 0x6268]
mov dword [ebp - 0x62d8], eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x6028]
call fcn.004db440
mov byte [ebp - 4], 3
mov ecx, eax
call fcn.0045df90
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x62e8]
call fcn.00418610
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x6264]
call fcn.0040c080
lea ecx, [ebp - 0x6024]
call fcn.004a2270
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x602c]
call fcn.004a2270
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x6044]
call fcn.004a2270
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x604c]
call fcn.004a2270
mov byte [ebp - 4], 8
push str.registry
lea ecx, [ebp - 0x6040]
call fcn.004065a0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x6040]
call fcn.004a7500
push eax
lea ecx, [ebp - 0x605c]
call fcn.0040bfc0
mov byte [ebp - 4], 0xa
push ecx
mov ecx, esp
mov dword [ebp - 0x62d4], esp
lea edx, [ebp - 0x605c]
push edx
call fcn.004a2290
mov dword [ebp - 0x624c], eax
mov eax, dword [ebp - 0x624c]
mov dword [ebp - 0x62a8], eax
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x6120]
push ecx
lea ecx, [ebp - 0x6028]
call fcn.004db440
mov byte [ebp - 4], 0xa
mov ecx, eax
call fcn.0045dc70
mov dword [ebp - 0x6118], eax
mov edx, dword [ebp - 0x6118]
mov dword [ebp - 0x61fc], edx
mov byte [ebp - 4], 0xc
mov eax, dword [ebp - 0x61fc]
push eax
lea ecx, [ebp - 0x6024]
call fcn.004a20e0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x6120]
call fcn.0045d720
lea ecx, [ebp - 0x6024]
push ecx
push 0
call fcn.0040ba90
add esp, 8
movzx edx, al
test edx, edx
je 0x49fd19
push 0
mov ecx, dword [ebp + 8]
call fcn.00435240
mov eax, dword [ebp - 0x6030]
or eax, 1
mov dword [ebp - 0x6030], eax
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x605c]
call fcn.0040c080
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x6040]
call fcn.004068c0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x604c]
call fcn.00468ec0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x6044]
call fcn.00468ec0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x602c]
call fcn.00468ec0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x6024]
call fcn.00468ec0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x6028]
call fcn.00468ec0
mov eax, dword [ebp + 8]
jmp 0x4a1e8d
lea ecx, [ebp - 0x6024]
call fcn.004a7500
push eax
lea ecx, [ebp - 0x6204]
push ecx
lea ecx, [ebp - 0x6028]
call fcn.004db440
mov ecx, eax
call fcn.0045db30
mov dword [ebp - 0x6234], eax
mov edx, dword [ebp - 0x6234]
mov dword [ebp - 0x6128], edx
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0x6128]
push eax
lea ecx, [ebp - 0x602c]
call fcn.0040c0c0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x6204]
call fcn.00468ec0
lea ecx, [ebp - 0x602c]
push ecx
push 0
call fcn.0040ba90
add esp, 8
movzx edx, al
test edx, edx
je 0x49fe1b
push 0
mov ecx, dword [ebp + 8]
call fcn.00435240
mov eax, dword [ebp - 0x6030]
or eax, 1
mov dword [ebp - 0x6030], eax
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x605c]
call fcn.0040c080
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x6040]
call fcn.004068c0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x604c]
call fcn.00468ec0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x6044]
call fcn.00468ec0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x602c]
call fcn.00468ec0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x6024]
call fcn.00468ec0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x6028]
call fcn.00468ec0
mov eax, dword [ebp + 8]
jmp 0x4a1e8d
lea ecx, [ebp - 0x602c]
push ecx
lea ecx, [ebp - 0x6044]
call fcn.0040c0c0
lea edx, [ebp - 0x602c]
push edx
lea ecx, [ebp - 0x604c]
call fcn.0040c0c0
mov byte [ebp - 0x605d], 1
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x6020]
call fcn.004065a0
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x6020]
call fcn.00407b60
push str.regkey
lea ecx, [ebp - 0x6074]
call fcn.004065a0
mov byte [ebp - 4], 0xf
mov dword [ebp - 0x6064], 0
mov dword [ebp - 0x6034], 0xffffffff
mov dword [ebp - 0x60ac], 0xffffffff
movzx ecx, byte [ebp - 0x605d]
test ecx, ecx
je 0x4a1de5
mov byte [ebp - 0x6039], 0
push 0
lea ecx, [ebp - 0x6074]
call fcn.004a7500
push eax
lea ecx, [ebp - 0x6020]
call fcn.00407530
mov dword [ebp - 0x6064], eax
cmp dword [ebp - 0x6064], 0xffffffff
je 0x4a00ef
mov edx, dword [ebp - 0x6064]
push edx
push 0x68d5a0
lea ecx, [ebp - 0x6020]
call fcn.00407530
mov dword [ebp - 0x6034], eax
cmp dword [ebp - 0x6034], 0
jl 0x4a00dc
mov eax, dword [ebp - 0x6034]
push eax
push 0x68d5a4
lea ecx, [ebp - 0x6020]
call fcn.00407530
mov dword [ebp - 0x6034], eax
cmp dword [ebp - 0x6034], 0
jl 0x4a00dc
mov ecx, dword [ebp - 0x6034]
push ecx
push 0x68d5a8
lea ecx, [ebp - 0x6020]
call fcn.00407530
mov dword [ebp - 0x60d4], eax
cmp dword [ebp - 0x60d4], 0
jl 0x4a0009
mov edx, dword [ebp - 0x60d4]
mov dword [ebp - 0x6034], edx
mov eax, dword [ebp - 0x6034]
push eax
push 0x68d5b4
lea ecx, [ebp - 0x6020]
call fcn.00407530
mov dword [ebp - 0x6034], eax
cmp dword [ebp - 0x6034], 0
jl 0x4a0004
mov ecx, dword [ebp - 0x6034]
sub ecx, dword [ebp - 0x6064]
add ecx, 1
push ecx
mov edx, dword [ebp - 0x6064]
push edx
lea eax, [ebp - 0x60bc]
push eax
lea ecx, [ebp - 0x6020]
call fcn.00407bb0
mov byte [ebp - 4], 0x10
push 0x68d5b8
push 0x68d5bc
lea ecx, [ebp - 0x60bc]
call fcn.004787f0
push 0
push 0x68d5c0
lea ecx, [ebp - 0x60bc]
call fcn.00407530
mov dword [ebp - 0x60ac], eax
cmp dword [ebp - 0x60ac], 0xffffffff
jne 0x49fff5
mov dword [ebp - 0x6034], 0xffffffff
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x60bc]
call fcn.004068c0
jmp 0x4a00dc
mov ecx, dword [ebp - 0x6034]
push ecx
push 0x68d5dc
lea ecx, [ebp - 0x6020]
call fcn.00407530
mov dword [ebp - 0x6034], eax
cmp dword [ebp - 0x6034], 0
jl 0x4a00dc
mov byte [ebp - 0x6039], 1
mov edx, dword [ebp - 0x6034]
push edx
push 0x68d5f0
lea ecx, [ebp - 0x6020]
call fcn.00407530
mov dword [ebp - 0x6034], eax
cmp dword [ebp - 0x6034], 0
jl 0x4a00dc
mov eax, dword [ebp - 0x6034]
sub eax, dword [ebp - 0x6064]
add eax, 1
push eax
mov ecx, dword [ebp - 0x6064]
push ecx
lea edx, [ebp - 0x60c4]
push edx
lea ecx, [ebp - 0x6020]
call fcn.00407bb0
mov byte [ebp - 4], 0x11
push 0x68d5f4
push 0x68d5f8
lea ecx, [ebp - 0x60c4]
call fcn.004787f0
push 0
push 0x68d5fc
lea ecx, [ebp - 0x60c4]
call fcn.00407530
mov dword [ebp - 0x60ac], eax
cmp dword [ebp - 0x60ac], 0xffffffff
jne 0x4a00cd
mov dword [ebp - 0x6034], 0xffffffff
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x60c4]
call fcn.004068c0
cmp dword [ebp - 0x6034], 0xffffffff
jne 0x4a00ef
mov dword [ebp - 0x6064], 0xffffffff
cmp dword [ebp - 0x6064], 0
jl 0x4a1dd9
lea ecx, [ebp - 0x6020]
call fcn.004078a0
sub eax, dword [ebp - 0x6064]
push eax
lea eax, [ebp - 0x6138]
push eax
lea ecx, [ebp - 0x6020]
call fcn.00407f20
mov dword [ebp - 0x6130], eax
mov ecx, dword [ebp - 0x6130]
mov dword [ebp - 0x625c], ecx
mov byte [ebp - 4], 0x12
mov edx, dword [ebp - 0x625c]
push edx
lea ecx, [ebp - 0x6020]
call fcn.00406b80
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x6138]
call fcn.004068c0
push 0x68d45a
lea ecx, [ebp - 0x6048]
call fcn.0047a290
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x6020]
call fcn.004078a0
mov ecx, dword [ebp - 0x6034]
sub ecx, dword [ebp - 0x6064]
sub eax, ecx
sub eax, 2
push eax
lea edx, [ebp - 0x606c]
push edx
lea ecx, [ebp - 0x6020]
call fcn.00407f20
mov byte [ebp - 4], 0x14
push 0
push 0x68d620
lea ecx, [ebp - 0x606c]
call fcn.00407530
mov dword [ebp - 0x60f8], eax
cmp dword [ebp - 0x60f8], 0
jl 0x4a0212
mov eax, dword [ebp - 0x60f8]
sub eax, 1
push eax
lea ecx, [ebp - 0x623c]
push ecx
lea ecx, [ebp - 0x606c]
call fcn.004079d0
mov dword [ebp - 0x620c], eax
mov edx, dword [ebp - 0x620c]
mov dword [ebp - 0x6140], edx
mov byte [ebp - 4], 0x15
mov eax, dword [ebp - 0x6140]
push eax
lea ecx, [ebp - 0x6048]
call fcn.00406b80
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x623c]
call fcn.004068c0
mov dword [ebp - 0x6088], 0
push 0x68d624
lea ecx, [ebp - 0x6058]
call fcn.004065a0
mov byte [ebp - 4], 0x16
push 0
lea ecx, [ebp - 0x6058]
call fcn.004a7500
push eax
lea ecx, [ebp - 0x6048]
call fcn.00407530
mov dword [ebp - 0x60a8], eax
cmp dword [ebp - 0x60a8], 0
jl 0x4a0264
mov dword [ebp - 0x6088], reloc.OLEAUT32.dll_SysReAllocString
jmp 0x4a02a6
push str.hkcu
lea ecx, [ebp - 0x6058]
call fcn.00406ba0
push 0
lea ecx, [ebp - 0x6058]
call fcn.004a7500
push eax
lea ecx, [ebp - 0x6048]
call fcn.00407530
mov dword [ebp - 0x60a8], eax
cmp dword [ebp - 0x60a8], 0
jl 0x4a02a6
mov dword [ebp - 0x6088], VariantClear
cmp dword [ebp - 0x6088], 0
jne 0x4a0388
push 0
mov ecx, dword [ebp + 8]
call fcn.00435240
mov ecx, dword [ebp - 0x6030]
or ecx, 1
mov dword [ebp - 0x6030], ecx
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x6058]
call fcn.004068c0
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x606c]
call fcn.004068c0
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x6048]
call fcn.004068c0
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x6074]
call fcn.004068c0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x6020]
call fcn.004068c0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x605c]
call fcn.0040c080
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x6040]
call fcn.004068c0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x604c]
call fcn.00468ec0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x6044]
call fcn.00468ec0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x602c]
call fcn.00468ec0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x6024]
call fcn.00468ec0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x6028]
call fcn.00468ec0
mov eax, dword [ebp + 8]
jmp 0x4a1e8d
lea edx, [ebp - 0x6048]
push edx
lea ecx, [ebp - 0x6068]
call fcn.004064e0
mov byte [ebp - 4], 0x17
push 0x68d63c
push 0x68d640
lea ecx, [ebp - 0x6068]
call fcn.004787f0
lea ecx, [ebp - 0x6068]
call fcn.004078a0
mov esi, eax
lea ecx, [ebp - 0x6058]
call fcn.004078a0
sub esi, eax
sub esi, dword [ebp - 0x60a8]
sub esi, 1
push esi
lea eax, [ebp - 0x607c]
push eax
lea ecx, [ebp - 0x6068]
call fcn.00407f20
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x607c]
call fcn.004078a0
mov dword [ebp - 0x6278], eax
lea ecx, [ebp - 0x607c]
push ecx
lea ecx, [ebp - 0x6078]
call fcn.004064e0
mov byte [ebp - 4], 0x19
cmp dword [ebp - 0x6088], 0x80000002
jne 0x4a042c
mov dword [ebp - 0x6100], 0x20119
jmp 0x4a0436
mov dword [ebp - 0x6100], 0x20019
lea edx, [ebp - 0x60a4]
push edx
mov eax, dword [ebp - 0x6100]
push eax
push 0
lea ecx, [ebp - 0x6078]
call fcn.004a7500
push eax
mov ecx, dword [ebp - 0x6088]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x60b0], eax
cmp dword [ebp - 0x6088], 0x80000002
jne 0x4a04a7
cmp dword [ebp - 0x60b0], 0
je 0x4a04a7
lea edx, [ebp - 0x60a4]
push edx
push 0x20219
push 0
lea ecx, [ebp - 0x6078]
call fcn.004a7500
push eax
mov eax, dword [ebp - 0x6088]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x60b0], eax
cmp dword [ebp - 0x60b0], 0
jne 0x4a04bb
movzx ecx, byte [ebp - 0x6039]
test ecx, ecx
je 0x4a04d7
cmp dword [ebp - 0x60b0], 0
je 0x4a1d04
movzx edx, byte [ebp - 0x6039]
test edx, edx
je 0x4a1d04
push 0x68d644
lea ecx, [ebp - 0x6040]
call fcn.00406ba0
lea ecx, [ebp - 0x6040]
call fcn.004a7500
push eax
lea ecx, [ebp - 0x6084]
call fcn.0040bfc0
mov byte [ebp - 4], 0x1a
push ecx
mov ecx, esp
mov dword [ebp - 0x62c4], esp
lea eax, [ebp - 0x6084]
push eax
call fcn.004a2290
mov dword [ebp - 0x6148], eax
mov ecx, dword [ebp - 0x6148]
mov dword [ebp - 0x6280], ecx
mov byte [ebp - 4], 0x1b
lea edx, [ebp - 0x6254]
push edx
lea ecx, [ebp - 0x6028]
call fcn.004db440
mov byte [ebp - 4], 0x1a
mov ecx, eax
call fcn.0045dc70
mov dword [ebp - 0x6214], eax
mov eax, dword [ebp - 0x6214]
mov dword [ebp - 0x6150], eax
mov byte [ebp - 4], 0x1c
mov ecx, dword [ebp - 0x6150]
push ecx
lea ecx, [ebp - 0x6024]
call fcn.004a20e0
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x6254]
call fcn.0045d720
lea edx, [ebp - 0x6024]
push edx
push 0
call fcn.0040ba90
add esp, 8
movzx eax, al
test eax, eax
je 0x4a06ae
push 0
mov ecx, dword [ebp + 8]
call fcn.00435240
mov ecx, dword [ebp - 0x6030]
or ecx, 1
mov dword [ebp - 0x6030], ecx
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x6084]
call fcn.0040c080
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x6078]
call fcn.004068c0
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x607c]
call fcn.004068c0
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x6068]
call fcn.004068c0
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x6058]
call fcn.004068c0
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x606c]
call fcn.004068c0
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x6048]
call fcn.004068c0
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x6074]
call fcn.004068c0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x6020]
call fcn.004068c0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x605c]
call fcn.0040c080
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x6040]
call fcn.004068c0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x604c]
call fcn.00468ec0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x6044]
call fcn.00468ec0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x602c]
call fcn.00468ec0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x6024]
call fcn.00468ec0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x6028]
call fcn.00468ec0
mov eax, dword [ebp + 8]
jmp 0x4a1e8d
lea ecx, [ebp - 0x6024]
call fcn.004a7500
push eax
lea edx, [ebp - 0x6160]
push edx
lea ecx, [ebp - 0x6044]
call fcn.004db440
mov ecx, eax
call fcn.0045db30
mov dword [ebp - 0x6158], eax
mov eax, dword [ebp - 0x6158]
mov dword [ebp - 0x621c], eax
mov byte [ebp - 4], 0x1d
mov ecx, dword [ebp - 0x621c]
push ecx
lea ecx, [ebp - 0x602c]
call fcn.0040c0c0
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x6160]
call fcn.00468ec0
lea edx, [ebp - 0x602c]
push edx
push 0
call fcn.0040ba90
add esp, 8
movzx eax, al
test eax, eax
je 0x4a0837
push 0
mov ecx, dword [ebp + 8]
call fcn.00435240
mov ecx, dword [ebp - 0x6030]
or ecx, 1
mov dword [ebp - 0x6030], ecx
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x6084]
call fcn.0040c080
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x6078]
call fcn.004068c0
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x607c]
call fcn.004068c0
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x6068]
call fcn.004068c0
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x6058]
call fcn.004068c0
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x606c]
call fcn.004068c0
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x6048]
call fcn.004068c0
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x6074]
call fcn.004068c0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x6020]
call fcn.004068c0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x605c]
call fcn.0040c080
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x6040]
call fcn.004068c0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x604c]
call fcn.00468ec0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x6044]
call fcn.00468ec0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x602c]
call fcn.00468ec0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x6024]
call fcn.00468ec0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x6028]
call fcn.00468ec0
mov eax, dword [ebp + 8]
jmp 0x4a1e8d
lea edx, [ebp - 0x602c]
push edx
lea ecx, [ebp - 0x6044]
call fcn.0040c0c0
lea eax, [ebp - 0x6050]
push eax
lea ecx, [ebp - 0x602c]
call fcn.004db440
mov ecx, eax
call fcn.004355c0
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x6054]
call fcn.00406700
mov byte [ebp - 4], 0x1f
movzx ecx, byte [ebp - 0x6039]
test ecx, ecx
je 0x4a0892
push 0x68d654
lea ecx, [ebp - 0x6054]
call fcn.00406ba0
jmp 0x4a08a2
push 0x68d668
lea ecx, [ebp - 0x6054]
call fcn.00406ba0
lea ecx, [ebp - 0x6054]
call fcn.004a7500
push eax
lea ecx, [ebp - 0x6098]
call fcn.0040bfc0
mov byte [ebp - 4], 0x20
push ecx
mov ecx, esp
mov dword [ebp - 0x62b0], esp
lea edx, [ebp - 0x6098]
push edx
call fcn.004a2290
mov dword [ebp - 0x6244], eax
mov eax, dword [ebp - 0x6244]
mov dword [ebp - 0x6288], eax
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x6170]
push ecx
lea ecx, [ebp - 0x6028]
call fcn.004db440
mov byte [ebp - 4], 0x20
mov ecx, eax
call fcn.00463a80
mov dword [ebp - 0x6168], eax
mov edx, dword [ebp - 0x6168]
mov dword [ebp - 0x6224], edx
mov byte [ebp - 4], 0x22
mov eax, dword [ebp - 0x6224]
push eax
lea ecx, [ebp - 0x6038]
call fcn.00463840
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x6170]
call fcn.0045d720
lea ecx, [ebp - 0x6038]
push ecx
push 0
call fcn.0040bab0
add esp, 8
movzx edx, al
test edx, edx
je 0x4a0a05
lea ecx, [ebp - 0x6038]
call fcn.004a7500
push eax
lea eax, [ebp - 0x61e8]
push eax
lea ecx, [ebp - 0x6050]
call fcn.004db440
mov ecx, eax
call fcn.00463b30
mov dword [ebp - 0x61e4], eax
mov ecx, dword [ebp - 0x61e4]
mov dword [ebp - 0x610c], ecx
mov byte [ebp - 4], 0x25
mov ecx, dword [ebp - 0x610c]
call fcn.0044bd00
movzx edx, al
mov dword [ebp - 0x6080], edx
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x61e8]
call fcn.00468ec0
cmp dword [ebp - 0x6080], 0
jl 0x4a0a05
lea ecx, [ebp - 0x6048]
call fcn.004a7500
push ecx
mov ecx, esp
mov dword [ebp - 0x62c8], esp
push eax
call fcn.0040bfc0
mov dword [ebp - 0x6180], eax
mov eax, dword [ebp - 0x6180]
mov dword [ebp - 0x6290], eax
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x6038]
call fcn.004db440
mov byte [ebp - 4], 0x24
mov ecx, eax
call fcn.0045da30
push 0
push 0x68d674
lea ecx, [ebp - 0x6020]
call fcn.00407530
mov dword [ebp - 0x6108], eax
cmp dword [ebp - 0x6108], 0
jl 0x4a1cac
mov ecx, dword [ebp - 0x6108]
push ecx
lea edx, [ebp - 0x608c]
push edx
lea ecx, [ebp - 0x6020]
call fcn.00435700
mov byte [ebp - 4], 0x27
push 0
push str.regval__notexist
lea ecx, [ebp - 0x608c]
call fcn.00407530
mov dword [ebp - 0x60cc], eax
cmp dword [ebp - 0x60cc], 0
jl 0x4a11b8
mov eax, dword [ebp - 0x60cc]
add eax, 0x11
push eax
lea ecx, [ebp - 0x6070]
push ecx
lea ecx, [ebp - 0x608c]
call fcn.00435700
mov byte [ebp - 4], 0x28
push 0
push 0x68d6a8
lea ecx, [ebp - 0x6070]
call fcn.00407530
mov dword [ebp - 0x60fc], eax
cmp dword [ebp - 0x60fc], 0
jle 0x4a0afd
mov edx, dword [ebp - 0x60fc]
push edx
lea eax, [ebp - 0x61f8]
push eax
lea ecx, [ebp - 0x6070]
call fcn.004079d0
mov dword [ebp - 0x61f0], eax
mov ecx, dword [ebp - 0x61f0]
mov dword [ebp - 0x6188], ecx
mov byte [ebp - 4], 0x29
mov edx, dword [ebp - 0x6188]
push edx
lea ecx, [ebp - 0x6070]
call fcn.00406b80
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x61f8]
call fcn.004068c0
push 0x68d6ac
push 0x68d6b0
lea ecx, [ebp - 0x6070]
call fcn.004787f0
push 0x68d6b4
push 0x68d6b8
lea ecx, [ebp - 0x6070]
call fcn.004787f0
mov dword [ebp - 0x6190], 0x1000
mov dword [ebp - 0x6200], 0
lea eax, [ebp - 0x6190]
push eax
lea ecx, [ebp - 0x601c]
push ecx
lea edx, [ebp - 0x6200]
push edx
push 0
lea ecx, [ebp - 0x6070]
call fcn.004a7500
push eax
mov eax, dword [ebp - 0x60a4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x6198], eax
cmp dword [ebp - 0x6198], 0
je 0x4a11a4
push 0x68d6bc
lea ecx, [ebp - 0x6040]
call fcn.00406ba0
lea ecx, [ebp - 0x6040]
call fcn.004a7500
push eax
lea ecx, [ebp - 0x60b8]
call fcn.0040bfc0
mov byte [ebp - 4], 0x2a
push ecx
mov ecx, esp
mov dword [ebp - 0x62b8], esp
lea edx, [ebp - 0x60b8]
push edx
call fcn.004a2290
mov dword [ebp - 0x6208], eax
mov eax, dword [ebp - 0x6208]
mov dword [ebp - 0x6298], eax
mov byte [ebp - 4], 0x2b
lea ecx, [ebp - 0x61a8]
push ecx
lea ecx, [ebp - 0x6028]
call fcn.004db440
mov byte [ebp - 4], 0x2a
mov ecx, eax
call fcn.0045dc70
mov dword [ebp - 0x61a0], eax
mov edx, dword [ebp - 0x61a0]
mov dword [ebp - 0x6210], edx
mov byte [ebp - 4], 0x2c
mov eax, dword [ebp - 0x6210]
push eax
lea ecx, [ebp - 0x6024]
call fcn.004a20e0
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x61a8]
call fcn.0045d720
lea ecx, [ebp - 0x6024]
push ecx
push 0
call fcn.0040ba90
add esp, 8
movzx edx, al
test edx, edx
je 0x4a0dbe
push 0
mov ecx, dword [ebp + 8]
call fcn.00435240
mov eax, dword [ebp - 0x6030]
or eax, 1
mov dword [ebp - 0x6030], eax
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x60b8]
call fcn.0040c080
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x6070]
call fcn.004068c0
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x608c]
call fcn.004068c0
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x6038]
call fcn.00468ec0
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x6098]
call fcn.0040c080
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x6054]
call fcn.004068c0
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x6050]
call fcn.00468ec0
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x6084]
call fcn.0040c080
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x6078]
call fcn.004068c0
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x607c]
call fcn.004068c0
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x6068]
call fcn.004068c0
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x6058]
call fcn.004068c0
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x606c]
call fcn.004068c0
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x6048]
call fcn.004068c0
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x6074]
call fcn.004068c0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x6020]
call fcn.004068c0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x605c]
call fcn.0040c080
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x6040]
call fcn.004068c0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x604c]
call fcn.00468ec0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x6044]
call fcn.00468ec0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x602c]
call fcn.00468ec0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x6024]
call fcn.00468ec0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x6028]
call fcn.00468ec0
mov eax, dword [ebp + 8]
jmp 0x4a1e8d
lea ecx, [ebp - 0x6024]
call fcn.004a7500
push eax
lea ecx, [ebp - 0x6220]
push ecx
lea ecx, [ebp - 0x6044]
call fcn.004db440
mov ecx, eax
call fcn.0045db30
mov dword [ebp - 0x6218], eax
mov edx, dword [ebp - 0x6218]
mov dword [ebp - 0x61b0], edx
mov byte [ebp - 4], 0x2d
mov eax, dword [ebp - 0x61b0]
push eax
lea ecx, [ebp - 0x602c]
call fcn.0040c0c0
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x6220]
call fcn.00468ec0
lea ecx, [ebp - 0x602c]
push ecx
push 0
call fcn.0040ba90
add esp, 8
movzx edx, al
test edx, edx
je 0x4a0fb0
push 0
mov ecx, dword [ebp + 8]
call fcn.00435240
mov eax, dword [ebp - 0x6030]
or eax, 1
mov dword [ebp - 0x6030], eax
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x60b8]
call fcn.0040c080
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x6070]
call fcn.004068c0
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x608c]
call fcn.004068c0
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x6038]
call fcn.00468ec0
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x6098]
call fcn.0040c080
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x6054]
call fcn.004068c0
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x6050]
call fcn.00468ec0
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x6084]
call fcn.0040c080
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x6078]
call fcn.004068c0
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x607c]
call fcn.004068c0
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x6068]
call fcn.004068c0
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x6058]
call fcn.004068c0
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x606c]
call fcn.004068c0
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x6048]
call fcn.004068c0
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x6074]
call fcn.004068c0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x6020]
call fcn.004068c0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x605c]
call fcn.0040c080
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x6040]
call fcn.004068c0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x604c]
call fcn.00468ec0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x6044]
call fcn.00468ec0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x602c]
call fcn.00468ec0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x6024]
call fcn.00468ec0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x6028]
call fcn.00468ec0
mov eax, dword [ebp + 8]
jmp 0x4a1e8d
lea ecx, [ebp - 0x61c0]
push ecx
lea ecx, [ebp - 0x6024]
call fcn.004db440
mov ecx, eax
call fcn.004355c0
mov dword [ebp - 0x61b8], eax
mov edx, dword [ebp - 0x61b8]
mov dword [ebp - 0x6228], edx
mov byte [ebp - 4], 0x2e
mov eax, dword [ebp - 0x6228]
push eax
lea ecx, [ebp - 0x6050]
call fcn.0040c0c0
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x61c0]
call fcn.00468ec0
push str.notexist
lea ecx, [ebp - 0x60f4]
call fcn.004065a0
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x60f4]
call fcn.004a7500
push eax
lea ecx, [ebp - 0x60dc]
call fcn.0040bfc0
mov byte [ebp - 4], 0x30
push ecx
mov ecx, esp
mov dword [ebp - 0x62cc], esp
lea edx, [ebp - 0x60dc]
push edx
call fcn.004a2290
mov dword [ebp - 0x6230], eax
mov eax, dword [ebp - 0x6230]
mov dword [ebp - 0x62a0], eax
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x61d0]
push ecx
lea ecx, [ebp - 0x6028]
call fcn.004db440
mov byte [ebp - 4], 0x30
mov ecx, eax
call fcn.00463a80
mov dword [ebp - 0x61c8], eax
mov edx, dword [ebp - 0x61c8]
mov dword [ebp - 0x6238], edx
mov byte [ebp - 4], 0x32
mov eax, dword [ebp - 0x6238]
push eax
lea ecx, [ebp - 0x6038]
call fcn.0046e750
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0x61d0]
call fcn.0045d720
lea ecx, [ebp - 0x6038]
push ecx
push 0
call fcn.0040bab0
add esp, 8
movzx edx, al
test edx, edx
je 0x4a1177
lea ecx, [ebp - 0x6038]
call fcn.004a7500
push eax
lea eax, [ebp - 0x6248]
push eax
lea ecx, [ebp - 0x6050]
call fcn.004db440
mov ecx, eax
call fcn.00463b30
mov dword [ebp - 0x6240], eax
mov ecx, dword [ebp - 0x6240]
mov dword [ebp - 0x61d8], ecx
mov byte [ebp - 4], 0x33
mov ecx, dword [ebp - 0x61d8]
call fcn.0044bd00
movzx edx, al
mov dword [ebp - 0x6080], edx
mov byte [ebp - 4], 0x30
lea ecx, [ebp - 0x6248]
call fcn.00468ec0
cmp dword [ebp - 0x6080], 0
jl 0x4a1177
lea ecx, [ebp - 0x6070]
call fcn.004a7500
push ecx
mov ecx, esp
mov dword [ebp - 0x62c0], esp
push eax
call fcn.0040bfc0
mov dword [ebp - 0x61e0], eax
mov eax, dword [ebp - 0x61e0]
mov dword [ebp - 0x6270], eax
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0x6038]
call fcn.004db440
mov byte [ebp - 4], 0x30
mov ecx, eax
call fcn.0045da30
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x60dc]
call fcn.0040c080
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x60f4]
call fcn.004068c0
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x60b8]
call fcn.0040c080
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x6070]
call fcn.004068c0
jmp 0x4a1c9d
mov dword [ebp - 0x60c8], 0
mov dword [ebp - 0x60d8], 0x1000
mov dword [ebp - 0x60e0], 0x1000
mov dword [ebp - 0x60c0], 0
mov ecx, 2
imul edx, ecx, 0
mov dword [ebp - 0x60e4], edx
cmp dword [ebp - 0x60e4], 0x2002
jae 0x4a11fc
jmp 0x4a1201
call fcn.00612151
xor eax, eax
mov ecx, dword [ebp - 0x60e4]
mov word [ebp + ecx - 0x4018], ax
mov edx, 2
imul eax, edx, 0
mov dword [ebp - 0x6104], eax
cmp dword [ebp - 0x6104], 0x2002
jae 0x4a122d
jmp 0x4a1232
call fcn.00612151
xor ecx, ecx
mov edx, dword [ebp - 0x6104]
mov word [ebp + edx - 0x2014], cx
lea ecx, [ebp - 0x6094]
call fcn.00406700
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x6090]
call fcn.00406700
mov byte [ebp - 4], 0x36
mov byte [ebp - 0x603a], 0
mov dword [ebp - 0x609c], 0
lea eax, [ebp - 0x60e0]
push eax
lea ecx, [ebp - 0x2014]
push ecx
lea edx, [ebp - 0x609c]
push edx
push 0
lea eax, [ebp - 0x60d8]
push eax
lea ecx, [ebp - 0x4018]
push ecx
mov edx, dword [ebp - 0x60c8]
push edx
mov eax, dword [ebp - 0x60a4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x4a1c72
cmp dword [ebp - 0x609c], 1
jne 0x4a12f4
lea ecx, [ebp - 0x4018]
push ecx
lea ecx, [ebp - 0x6054]
call fcn.00406ba0
lea edx, [ebp - 0x2014]
push edx
push 0x68d6e0
lea eax, [ebp - 0x6094]
push eax
call fcn.004076f0
add esp, 0xc
mov byte [ebp - 0x603a], 1
jmp 0x4a13af
cmp dword [ebp - 0x609c], 4
je 0x4a130a
cmp dword [ebp - 0x609c], 0xb
jne 0x4a13af
lea ecx, [ebp - 0x4018]
push ecx
lea ecx, [ebp - 0x6054]
call fcn.00406ba0
lea edx, [ebp - 0x2014]
mov dword [ebp - 0x60b4], edx
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp - 0x60b4]
movzx eax, byte [edx + ecx]
mov ecx, 1
shl ecx, 0
mov edx, dword [ebp - 0x60b4]
movzx ecx, byte [edx + ecx]
shl ecx, 8
add eax, ecx
mov edx, 1
shl edx, 1
mov ecx, dword [ebp - 0x60b4]
movzx edx, byte [ecx + edx]
shl edx, 8
shl edx, 8
add eax, edx
mov ecx, 1
imul edx, ecx, 3
mov ecx, dword [ebp - 0x60b4]
movzx edx, byte [ecx + edx]
shl edx, 8
shl edx, 8
shl edx, 8
add eax, edx
mov dword [ebp - 0x60c0], eax
mov eax, dword [ebp - 0x60c0]
push eax
push 0x68d6e8
lea ecx, [ebp - 0x6094]
push ecx
call fcn.004076f0
add esp, 0xc
mov byte [ebp - 0x603a], 1
lea ecx, [ebp - 0x6054]
call fcn.00407b60
lea ecx, [ebp - 0x6094]
call fcn.00407b60
movzx edx, byte [ebp - 0x603a]
test edx, edx
je 0x4a1bd7
push str.regval
lea ecx, [ebp - 0x6040]
call fcn.00406ba0
lea ecx, [ebp - 0x6040]
call fcn.004a7500
push eax
lea ecx, [ebp - 0x60a0]
call fcn.0040bfc0
mov byte [ebp - 4], 0x37
push ecx
mov ecx, esp
mov dword [ebp - 0x6274], esp
lea eax, [ebp - 0x60a0]
push eax
call fcn.004a2290
mov dword [ebp - 0x6250], eax
mov ecx, dword [ebp - 0x6250]
mov dword [ebp - 0x627c], ecx
mov byte [ebp - 4], 0x38
lea edx, [ebp - 0x622c]
push edx
lea ecx, [ebp - 0x6028]
call fcn.004db440
mov byte [ebp - 4], 0x37
mov ecx, eax
call fcn.0045dc70
mov dword [ebp - 0x6258], eax
mov eax, dword [ebp - 0x6258]
mov dword [ebp - 0x61ec], eax
mov byte [ebp - 4], 0x39
mov ecx, dword [ebp - 0x61ec]
push ecx
lea ecx, [ebp - 0x6024]
call fcn.004a20e0
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0x622c]
call fcn.0045d720
lea edx, [ebp - 0x6024]
push edx
push 0
call fcn.0040ba90
add esp, 8
movzx eax, al
test eax, eax
je 0x4a1623
push 0
mov ecx, dword [ebp + 8]
call fcn.00435240
mov ecx, dword [ebp - 0x6030]
or ecx, 1
mov dword [ebp - 0x6030], ecx
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0x60a0]
call fcn.0040c080
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x6090]
call fcn.004068c0
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x6094]
call fcn.004068c0
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x608c]
call fcn.004068c0
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x6038]
call fcn.00468ec0
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x6098]
call fcn.0040c080
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x6054]
call fcn.004068c0
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x6050]
call fcn.00468ec0
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x6084]
call fcn.0040c080
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x6078]
call fcn.004068c0
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x607c]
call fcn.004068c0
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x6068]
call fcn.004068c0
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x6058]
call fcn.004068c0
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x606c]
call fcn.004068c0
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x6048]
call fcn.004068c0
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x6074]
call fcn.004068c0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x6020]
call fcn.004068c0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x605c]
call fcn.0040c080
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x6040]
call fcn.004068c0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x604c]
call fcn.00468ec0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x6044]
call fcn.00468ec0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x602c]
call fcn.00468ec0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x6024]
call fcn.00468ec0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x6028]
call fcn.00468ec0
mov eax, dword [ebp + 8]
jmp 0x4a1e8d
lea ecx, [ebp - 0x6024]
call fcn.004a7500
push eax
lea edx, [ebp - 0x6114]
push edx
lea ecx, [ebp - 0x6044]
call fcn.004db440
mov ecx, eax
call fcn.0045db30
mov dword [ebp - 0x61f4], eax
mov eax, dword [ebp - 0x61f4]
mov dword [ebp - 0x6110], eax
mov byte [ebp - 4], 0x3a
mov ecx, dword [ebp - 0x6110]
push ecx
lea ecx, [ebp - 0x602c]
call fcn.0040c0c0
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0x6114]
call fcn.00468ec0
lea edx, [ebp - 0x602c]
push edx
push 0
call fcn.0040ba90
add esp, 8
movzx eax, al
test eax, eax
je 0x4a1824
push 0
mov ecx, dword [ebp + 8]
call fcn.00435240
mov ecx, dword [ebp - 0x6030]
or ecx, 1
mov dword [ebp - 0x6030], ecx
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0x60a0]
call fcn.0040c080
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x6090]
call fcn.004068c0
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x6094]
call fcn.004068c0
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x608c]
call fcn.004068c0
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x6038]
call fcn.00468ec0
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x6098]
call fcn.0040c080
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x6054]
call fcn.004068c0
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x6050]
call fcn.00468ec0
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x6084]
call fcn.0040c080
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x6078]
call fcn.004068c0
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x607c]
call fcn.004068c0
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x6068]
call fcn.004068c0
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x6058]
call fcn.004068c0
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x606c]
call fcn.004068c0
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x6048]
call fcn.004068c0
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x6074]
call fcn.004068c0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x6020]
call fcn.004068c0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x605c]
call fcn.0040c080
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x6040]
call fcn.004068c0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x604c]
call fcn.00468ec0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x6044]
call fcn.00468ec0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x602c]
call fcn.00468ec0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x6024]
call fcn.00468ec0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x6028]
call fcn.00468ec0
mov eax, dword [ebp + 8]
jmp 0x4a1e8d
lea edx, [ebp - 0x612c]
push edx
lea ecx, [ebp - 0x6024]
call fcn.004db440
mov ecx, eax
call fcn.004355c0
mov dword [ebp - 0x611c], eax
mov eax, dword [ebp - 0x611c]
mov dword [ebp - 0x6124], eax
mov byte [ebp - 4], 0x3b
mov ecx, dword [ebp - 0x6124]
push ecx
lea ecx, [ebp - 0x6050]
call fcn.0040c0c0
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0x612c]
call fcn.00468ec0
push 0x68d700
lea ecx, [ebp - 0x6090]
call fcn.00406ba0
lea ecx, [ebp - 0x6090]
call fcn.004a7500
push eax
lea ecx, [ebp - 0x60d0]
call fcn.0040bfc0
mov byte [ebp - 4], 0x3c
push ecx
mov ecx, esp
mov dword [ebp - 0x6284], esp
lea edx, [ebp - 0x60d0]
push edx
call fcn.004a2290
mov dword [ebp - 0x6134], eax
mov eax, dword [ebp - 0x6134]
mov dword [ebp - 0x628c], eax
mov byte [ebp - 4], 0x3d
lea ecx, [ebp - 0x614c]
push ecx
lea ecx, [ebp - 0x6028]
call fcn.004db440
mov byte [ebp - 4], 0x3c
mov ecx, eax
call fcn.00463a80
mov dword [ebp - 0x613c], eax
mov edx, dword [ebp - 0x613c]
mov dword [ebp - 0x6144], edx
mov byte [ebp - 4], 0x3e
mov eax, dword [ebp - 0x6144]
push eax
lea ecx, [ebp - 0x6038]
call fcn.0046e750
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x614c]
call fcn.0045d720
lea ecx, [ebp - 0x6038]
push ecx
push 0
call fcn.0040bab0
add esp, 8
movzx edx, al
test edx, edx
je 0x4a19e7
lea ecx, [ebp - 0x6038]
call fcn.004a7500
push eax
lea eax, [ebp - 0x6164]
push eax
lea ecx, [ebp - 0x6050]
call fcn.004db440
mov ecx, eax
call fcn.00463b30
mov dword [ebp - 0x6154], eax
mov ecx, dword [ebp - 0x6154]
mov dword [ebp - 0x615c], ecx
mov byte [ebp - 4], 0x3f
mov ecx, dword [ebp - 0x615c]
call fcn.0044bd00
movzx edx, al
mov dword [ebp - 0x6080], edx
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x6164]
call fcn.00468ec0
cmp dword [ebp - 0x6080], 0
jl 0x4a19e7
lea ecx, [ebp - 0x6054]
call fcn.004a7500
push ecx
mov ecx, esp
mov dword [ebp - 0x6294], esp
push eax
call fcn.0040bfc0
mov dword [ebp - 0x616c], eax
mov eax, dword [ebp - 0x616c]
mov dword [ebp - 0x629c], eax
mov byte [ebp - 4], 0x40
lea ecx, [ebp - 0x6038]
call fcn.004db440
mov byte [ebp - 4], 0x3c
mov ecx, eax
call fcn.0045da30
lea ecx, [ebp - 0x6184]
push ecx
lea ecx, [ebp - 0x6024]
call fcn.004db440
mov ecx, eax
call fcn.004355c0
mov dword [ebp - 0x6174], eax
mov edx, dword [ebp - 0x6174]
mov dword [ebp - 0x617c], edx
mov byte [ebp - 4], 0x41
mov eax, dword [ebp - 0x617c]
push eax
lea ecx, [ebp - 0x6050]
call fcn.0040c0c0
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x6184]
call fcn.00468ec0
push 0x68d70c
lea ecx, [ebp - 0x6090]
call fcn.00406ba0
lea ecx, [ebp - 0x6090]
call fcn.004a7500
push eax
lea ecx, [ebp - 0x60ec]
call fcn.0040bfc0
mov byte [ebp - 4], 0x42
push ecx
mov ecx, esp
mov dword [ebp - 0x62a4], esp
lea edx, [ebp - 0x60ec]
push edx
call fcn.004a2290
mov dword [ebp - 0x618c], eax
mov eax, dword [ebp - 0x618c]
mov dword [ebp - 0x62ac], eax
mov byte [ebp - 4], 0x43
lea ecx, [ebp - 0x61a4]
push ecx
lea ecx, [ebp - 0x6028]
call fcn.004db440
mov byte [ebp - 4], 0x42
mov ecx, eax
call fcn.00463a80
mov dword [ebp - 0x6194], eax
mov edx, dword [ebp - 0x6194]
mov dword [ebp - 0x619c], edx
mov byte [ebp - 4], 0x44
mov eax, dword [ebp - 0x619c]
push eax
lea ecx, [ebp - 0x6038]
call fcn.0046e750
mov byte [ebp - 4], 0x42
lea ecx, [ebp - 0x61a4]
call fcn.0045d720
lea ecx, [ebp - 0x6038]
push ecx
push 0
call fcn.0040bab0
add esp, 8
movzx edx, al
test edx, edx
je 0x4a1baa
lea ecx, [ebp - 0x6038]
call fcn.004a7500
push eax
lea eax, [ebp - 0x61bc]
push eax
lea ecx, [ebp - 0x6050]
call fcn.004db440
mov ecx, eax
call fcn.00463b30
mov dword [ebp - 0x61ac], eax
mov ecx, dword [ebp - 0x61ac]
mov dword [ebp - 0x61b4], ecx
mov byte [ebp - 4], 0x45
mov ecx, dword [ebp - 0x61b4]
call fcn.0044bd00
movzx edx, al
mov dword [ebp - 0x6080], edx
mov byte [ebp - 4], 0x42
lea ecx, [ebp - 0x61bc]
call fcn.00468ec0
cmp dword [ebp - 0x6080], 0
jl 0x4a1baa
lea ecx, [ebp - 0x6094]
call fcn.004a7500
push ecx
mov ecx, esp
mov dword [ebp - 0x62b4], esp
push eax
call fcn.0040bfc0
mov dword [ebp - 0x61c4], eax
mov eax, dword [ebp - 0x61c4]
mov dword [ebp - 0x62bc], eax
mov byte [ebp - 4], 0x46
lea ecx, [ebp - 0x6038]
call fcn.004db440
mov byte [ebp - 4], 0x42
mov ecx, eax
call fcn.0045da30
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x60ec]
call fcn.0040c080
mov byte [ebp - 4], 0x37
lea ecx, [ebp - 0x60d0]
call fcn.0040c080
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0x60a0]
call fcn.0040c080
mov byte [ebp - 0x603a], 0
mov dword [ebp - 0x60d8], 0x1000
mov dword [ebp - 0x60e0], 0x1000
mov ecx, 2
imul edx, ecx, 0
mov dword [ebp - 0x60e8], edx
cmp dword [ebp - 0x60e8], 0x2002
jae 0x4a1c0e
jmp 0x4a1c13
call fcn.00612151
xor eax, eax
mov ecx, dword [ebp - 0x60e8]
mov word [ebp + ecx - 0x4018], ax
mov edx, 2
imul eax, edx, 0
mov dword [ebp - 0x60f0], eax
cmp dword [ebp - 0x60f0], 0x2002
jae 0x4a1c3f
jmp 0x4a1c44
call fcn.00612151
xor ecx, ecx
mov edx, dword [ebp - 0x60f0]
mov word [ebp + edx - 0x2014], cx
mov dword [ebp - 0x609c], 0
mov eax, dword [ebp - 0x60c8]
add eax, 1
mov dword [ebp - 0x60c8], eax
jmp 0x4a1271
mov ecx, dword [ebp - 0x60a4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x6090]
call fcn.004068c0
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x6094]
call fcn.004068c0
mov byte [ebp - 4], 0x24
lea ecx, [ebp - 0x608c]
call fcn.004068c0
mov edx, dword [ebp - 0x6088]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x6038]
call fcn.00468ec0
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0x6098]
call fcn.0040c080
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x6054]
call fcn.004068c0
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x6050]
call fcn.00468ec0
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x6084]
call fcn.0040c080
lea ecx, [ebp - 0x6020]
call fcn.004078a0
mov esi, eax
lea ecx, [ebp - 0x6074]
call fcn.004078a0
sub esi, eax
sub esi, 1
push esi
lea eax, [ebp - 0x61dc]
push eax
lea ecx, [ebp - 0x6020]
call fcn.00407f20
mov dword [ebp - 0x61cc], eax
mov ecx, dword [ebp - 0x61cc]
mov dword [ebp - 0x61d4], ecx
mov byte [ebp - 4], 0x47
mov edx, dword [ebp - 0x61d4]
push edx
lea ecx, [ebp - 0x6020]
call fcn.00406b80
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x61dc]
call fcn.004068c0
lea eax, [ebp - 0x604c]
push eax
lea ecx, [ebp - 0x6044]
call fcn.0040c0c0
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x6078]
call fcn.004068c0
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x607c]
call fcn.004068c0
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x6068]
call fcn.004068c0
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x6058]
call fcn.004068c0
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x606c]
call fcn.004068c0
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x6048]
call fcn.004068c0
jmp 0x4a1de0
mov byte [ebp - 0x605d], 0
jmp 0x49fe96
lea ecx, [ebp - 0x6028]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0044bca0
mov edx, dword [ebp - 0x6030]
or edx, 1
mov dword [ebp - 0x6030], edx
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x6074]
call fcn.004068c0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x6020]
call fcn.004068c0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x605c]
call fcn.0040c080
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x6040]
call fcn.004068c0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x604c]
call fcn.00468ec0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x6044]
call fcn.00468ec0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x602c]
call fcn.00468ec0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x6024]
call fcn.00468ec0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x6028]
call fcn.00468ec0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0060f7c8
mov esp, ebp
pop ebp
ret 8