Function at 0x4fbf00
Capabilities:
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x178
lea esi, [esp + 0x68]
mov dword [esp + 0x3c], ecx
lea eax, [0x68587f]
lea ecx, [esp + 0xd0]
mov dword [esp + 0x68], str.SOFTWAREMicrosoftCryptographyMachineGuid
mov edx, esi
mov dword [esp + 0x6c], eax
mov word [esp + 0x70], 0
mov dword [esp + 0x74], 1
call fcn.00532180
mov edi, dword [esp + 0xd0]
mov dword [esp + 0x68], 0
push esi
push 0x20019
push 0
push edi
push 0x80000002
call sub.ADVAPI32.dll_RegOpenKeyExW
mov esi, eax
test eax, eax
mov dword [esp + 0x18], 0
jne 0x4fc09b
mov eax, dword [esp + 0x68]
mov dword [esp + 0x18], eax
test dword [esp + 0xd4], 0x7fffffff
je 0x4fc0ac
push edi
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
test esi, esi
jne 0x4fc0b4
lea eax, [0x68588a]
lea ecx, [esp + 0xd0]
lea edx, [esp + 0x68]
mov dword [esp + 0x68], 0x68587f
mov dword [esp + 0x6c], eax
mov word [esp + 0x70], 0
mov dword [esp + 0x74], 1
call fcn.00532180
mov dword [esp + 0x54], 0x800
mov dword [esp + 0x120], 0
mov eax, dword [0x6f1130]
mov edi, dword [esp + 0x18]
test eax, eax
jne 0x4fc00c
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x4fd1ee
mov dword [0x6f1130], eax
push 0x800
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x4fd1ee
mov esi, dword [esp + 0xd0]
lea ebx, [esp + 0x120]
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], 0x800
mov dword [esp + 0xc], eax
mov dword [esp + 0x70], 0
nop word [eax + eax]
lea eax, [esp + 0x54]
push eax
push dword [esp + 0x10]
push ebx
push 0
push esi
push edi
call sub.ADVAPI32.dll_RegQueryValueExW
cmp eax, 0xea
jne 0x4fc0f1
mov ecx, dword [esp + 0x6c]
mov edx, dword [esp + 0x70]
mov eax, dword [esp + 0x54]
mov edi, dword [esp + 0x18]
sub ecx, edx
cmp ecx, eax
jae 0x4fc050
lea ecx, [esp + 0x68]
push eax
call fcn.005f2340
add esp, 4
mov eax, dword [esp + 0x68]
mov dword [esp + 0xc], eax
jmp 0x4fc050
test dword [esp + 0xd4], 0x7fffffff
jne 0x4fbf93
test esi, esi
je 0x4fbfa9
mov eax, dword [0x6f1130]
mov edi, dword [esp + 0x18]
test eax, eax
jne 0x4fc0d3
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x4fd1dd
mov dword [0x6f1130], eax
push 8
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x4fd1dd
mov ebx, eax
mov dword [eax], edi
mov dword [eax + 4], esi
jmp 0x4fcb69
mov edi, eax
test eax, eax
jne 0x4fc110
mov ecx, dword [esp + 0x120]
mov eax, dword [esp + 0x54]
mov edi, 0xde
cmp ecx, 0xb
mov dword [esp + 0x70], eax
jbe 0x4fc14d
cmp dword [esp + 0x6c], 0
je 0x4fc128
push dword [esp + 0xc]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
test dword [esp + 0xd4], 0x7fffffff
jne 0x4fc3f6
xor esi, esi
mov eax, dword [0x6f1130]
test eax, eax
jne 0x4fcb42
jmp 0x4fcb30
mov edx, dword [esp + 0x6c]
test dword [esp + 0xd4], 0x7fffffff
mov ebx, eax
mov dword [esp + 0xc8], edx
je 0x4fc179
push esi
push 0
push dword [0x6f1130]
mov esi, ecx
call sub.KERNEL32.dll_HeapFree
mov ecx, esi
mov esi, 1
mov edi, 0xde
cmp cl, 7
mov dword [esp + 8], 0
ja 0x4fc877
movzx eax, cl
mov edx, 0x86
mov dword [esp + 4], ecx
bt edx, eax
jae 0x4fcb00
mov eax, dword [0x6dd4e0]
mov edi, ebx
and edi, 0xfffffffe
cmp edi, 4
mov dword [esp + 0x120], eax
mov dword [esp + 0x124], 0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x128], 0
jae 0x4fd133
mov eax, dword [esp + 0xc]
xor esi, esi
add edi, eax
mov dword [esp + 0x10], edi
test si, si
je 0x4fc200
nop
mov ecx, esi
mov dword [esp], eax
shr ecx, 0x10
jmp 0x4fc211
cmp eax, edi
je 0x4fc41e
movzx ecx, word [eax]
add eax, 2
mov dword [esp], eax
mov eax, ecx
and esi, 0xffff0000
and eax, 0xf800
cmp eax, 0xd800
jne 0x4fc280
movzx edx, cx
xor ebx, ebx
mov eax, 1
cmp edx, 0xdbff
ja 0x4fc2a0
mov edx, edi
mov edi, dword [esp]
cmp edi, edx
je 0x4fc287
movzx edx, word [edi]
add edi, 2
mov dword [esp], edi
mov edi, edx
and edi, 0xfc00
cmp edi, 0xdc00
jne 0x4fc28e
add ecx, 0x2800
add edx, 0x2400
movzx eax, cx
movzx ebx, dx
shl eax, 0xa
or ebx, eax
xor eax, eax
add ebx, 0x10000
jmp 0x4fc296
movzx ebx, cx
xor eax, eax
jmp 0x4fc2a0
mov dword [esp], edx
mov edi, edx
jmp 0x4fc2a0
shl edx, 0x10
or edx, 1
mov esi, edx
mov edi, dword [esp + 0x10]
nop word [eax + eax]
test al, 1
mov ecx, 0xfffd
cmovne ebx, ecx
cmp ebx, 0x7f
ja 0x4fc300
mov edx, dword [esp + 0x128]
cmp edx, dword [esp + 0x124]
jne 0x4fc2d2
lea ecx, [esp + 0x120]
call fcn.005b9de0
mov edx, dword [esp + 0x128]
mov eax, dword [esp + 0x120]
mov byte [eax + edx], bl
mov eax, dword [esp]
inc edx
mov dword [esp + 0x128], edx
test si, si
jne 0x4fc1f0
jmp 0x4fc200
mov eax, ebx
cmp ebx, 0x800
mov dword [esp + 0x68], 0
jae 0x4fc330
shr eax, 6
and bl, 0x3f
or al, 0xc0
or bl, 0x80
mov byte [esp + 0x68], al
mov byte [esp + 0x69], bl
mov ebx, 2
jmp 0x4fc391
cmp ebx, 0x10000
jae 0x4fc35f
shr eax, 0xc
or al, 0xe0
mov byte [esp + 0x68], al
mov eax, ebx
and bl, 0x3f
shr eax, 6
or bl, 0x80
and al, 0x3f
or al, 0x80
mov byte [esp + 0x69], al
mov byte [esp + 0x6a], bl
mov ebx, 3
jmp 0x4fc391
shr eax, 0x12
or al, 0xf0
mov byte [esp + 0x68], al
mov eax, ebx
shr eax, 0xc
and al, 0x3f
or al, 0x80
mov byte [esp + 0x69], al
mov eax, ebx
and bl, 0x3f
shr eax, 6
or bl, 0x80
and al, 0x3f
or al, 0x80
mov byte [esp + 0x6a], al
mov byte [esp + 0x6b], bl
mov ebx, 4
mov eax, dword [esp + 0x124]
mov edi, dword [esp + 0x128]
sub eax, edi
cmp eax, ebx
jb 0x4fc3db
mov eax, dword [esp + 0x120]
add eax, edi
push ebx
lea ecx, [esp + 0x6c]
push ecx
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
add ebx, edi
mov edi, dword [esp + 0x10]
mov eax, dword [esp]
mov dword [esp + 0x128], ebx
test si, si
jne 0x4fc1f0
jmp 0x4fc200
lea ecx, [esp + 0x120]
mov edx, edi
push ebx
call fcn.00556540
add esp, 4
mov edi, dword [esp + 0x128]
jmp 0x4fc3a5
push dword [esp + 0xd0]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
xor esi, esi
mov eax, dword [0x6f1130]
test eax, eax
jne 0x4fcb42
jmp 0x4fcb30
mov edx, dword [esp + 0x120]
mov edi, dword [esp + 0x128]
mov dword [esp + 0x24], edx
test edi, edi
jne 0x4fc45b
jmp 0x4fc4fd
and eax, 0x1f
shl eax, 6
and ecx, 0x3f
or ecx, eax
cmp ecx, 0x110000
jne 0x4fc4c9
test edi, edi
je 0x4fc4fd
cmp byte [edi + edx - 1], 0
jne 0x4fc4fd
movzx ecx, byte [edx + edi - 1]
mov ebx, 0xffffffff
test cl, cl
jns 0x4fc4ec
movzx eax, byte [edx + edi - 2]
cmp al, 0xbf
jg 0x4fc440
movzx ebx, byte [edx + edi - 3]
cmp bl, 0xc0
jge 0x4fc4b0
mov esi, dword [esp + 0x24]
and ebx, 0x3f
movzx esi, byte [esi + edi - 4]
and esi, 7
shl esi, 6
or ebx, esi
mov esi, dword [esp + 0x24]
jmp 0x4fc4b5
mov esi, edx
and ebx, 0xf
shl ebx, 6
and eax, 0x3f
mov edx, esi
or eax, ebx
mov ebx, 0xffffffff
jmp 0x4fc443
cmp ecx, 0x80
jb 0x4fc4ec
mov ebx, 0xfffffffe
cmp ecx, 0x800
jb 0x4fc4ec
xor ebx, ebx
cmp ecx, 0x10000
setb bl
or ebx, 0xfffffffc
add edi, ebx
mov dword [esp + 0x128], edi
test edi, edi
jne 0x4fc45b
cmp byte [esp + 4], 7
jne 0x4fc846
mov eax, dword [0x6dd4e0]
lea ecx, [esp + 0x68]
mov dword [esp + 0xd0], eax
mov dword [esp + 0xd4], 0
mov dword [esp + 0xd8], 0
push 1
push 0x6dd4f9
push edi
call fcn.0045fa60
add esp, 0xc
mov ebx, dword [esp + 0x98]
mov edx, dword [esp + 0x9c]
mov eax, dword [esp + 0x74]
cmp dword [esp + 0x68], 1
mov dword [esp + 0x10], edx
mov dword [esp], ebx
jne 0x4fc861
mov esi, dword [esp + 0xa4]
mov ecx, dword [esp + 0x84]
mov dword [esp + 0x28], eax
mov dword [esp + 0x14], 0
lea eax, [esi - 1]
mov dword [esp + 0x44], eax
add eax, ecx
cmp eax, edx
jae 0x4fc870
mov edx, dword [esp + 0x70]
mov dword [esp + 8], esi
mov dword [esp + 0x14], 0
mov dword [esp + 0x2c], edi
mov esi, dword [esp + 8]
mov dword [esp + 0xcc], edx
mov edx, dword [esp + 0x78]
mov dword [esp + 0x40], edx
mov edx, dword [esp + 0x80]
sub esi, edx
mov dword [esp + 0xbc], edx
mov edx, dword [esp + 0x40]
mov dword [esp + 0xb8], esi
neg edx
mov dword [esp + 0xc0], edx
mov edx, dword [esp + 0xa0]
mov dword [esp + 0x34], edx
mov edx, dword [esp + 0x8c]
mov dword [esp + 0x30], edx
xor edx, edx
mov esi, dword [esp + 0x30]
mov dword [esp + 0x38], edx
xor edi, edi
mov dword [esp + 0x20], esi
mov esi, ecx
jmp 0x4fc61c
xor eax, eax
xor edi, edi
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x44]
mov esi, ecx
add eax, ecx
cmp eax, dword [esp + 0x10]
jae 0x4fca87
mov cl, byte [ebx + eax]
xor eax, eax
mov edx, 1
shld eax, edx, cl
mov edx, 1
shl edx, cl
test cl, 0x20
cmovne eax, edx
cmovne edx, edi
and eax, dword [esp + 0x28]
and edx, dword [esp + 0xcc]
or edx, eax
je 0x4fc6be
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x40]
mov dword [esp + 4], esi
cmp eax, ecx
mov edx, ecx
mov ecx, esi
cmova edx, eax
cmp dword [esp + 0x20], 0xffffffff
cmove edx, eax
mov eax, dword [esp + 0x34]
xor ecx, ecx
lea edi, [edx + esi]
mov esi, dword [esp + 8]
mov dword [esp + 0xc4], edx
add eax, edx
sub esi, edx
cmovb esi, ecx
sub esi, 1
jb 0x4fc6d6
mov edx, dword [esp + 0x10]
cmp edi, edx
jae 0x4fd186
movzx ebx, byte [eax]
mov edx, dword [esp]
inc eax
lea ecx, [edi + 1]
cmp bl, byte [edx + edi]
mov ebx, dword [esp]
mov edi, ecx
je 0x4fc680
add ecx, dword [esp + 0xc0]
cmp dword [esp + 0x20], 0xffffffff
jne 0x4fc602
xor edi, edi
jmp 0x4fc60a
add esi, dword [esp + 8]
xor eax, eax
cmp dword [esp + 0x20], 0xffffffff
mov ecx, esi
jne 0x4fc606
jmp 0x4fc60a
cmp dword [esp + 0x20], 0xffffffff
mov edi, dword [esp + 0x30]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x10]
mov eax, 0
cmove edi, eax
nop
cmp edi, ecx
jae 0x4fc749
mov eax, dword [esp + 8]
dec ecx
cmp ecx, eax
jae 0x4fd1a5
mov eax, dword [esp + 4]
add eax, ecx
cmp eax, edx
jae 0x4fd1b6
mov esi, dword [esp + 0x34]
movzx ebx, byte [esi + ecx]
mov esi, dword [esp]
cmp bl, byte [esi + eax]
mov ebx, dword [esp]
je 0x4fc6f0
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0xb8]
mov edi, 0
add ecx, dword [esp + 0xbc]
cmp dword [esp + 0x20], 0xffffffff
jne 0x4fc606
jmp 0x4fc60a
cmp dword [esp + 0x20], 0xffffffff
mov ecx, dword [esp + 0x30]
mov eax, 0
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 8]
cmovne ecx, eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 4]
add edx, eax
lea edi, [eax + ecx]
mov ecx, edx
sub edi, edx
mov edx, dword [esp + 0xd4]
mov esi, edi
sub edx, dword [esp + 0x14]
cmp edx, edi
mov edi, dword [esp + 0x2c]
jb 0x4fc7f2
add dword [esp + 4], ebx
mov eax, dword [esp + 0x1c]
mov ebx, dword [esp + 0x14]
add eax, ebx
push esi
push ecx
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
add ebx, esi
mov dword [esp + 0xd8], ebx
mov edx, ebx
cmp dword [esp + 0xd4], ebx
je 0x4fc829
mov eax, dword [esp + 0xd0]
mov ebx, dword [esp]
mov byte [eax + edx], 0xa
inc edx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x14], edx
mov dword [esp + 0xd8], edx
mov edx, dword [esp + 4]
add eax, edx
mov ecx, edx
cmp eax, dword [esp + 0x10]
jb 0x4fc5f0
jmp 0x4fca8f
mov edx, dword [esp + 0x14]
mov dword [esp + 0x38], ecx
lea ecx, [esp + 0xd0]
push esi
call fcn.00556540
mov ecx, dword [esp + 0x3c]
add esp, 4
mov eax, dword [esp + 0xd0]
mov edx, dword [esp + 0xd8]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], edx
jmp 0x4fc78c
lea ecx, [esp + 0xd0]
push 1
call fcn.00556540
add esp, 4
mov edx, dword [esp + 0xd8]
jmp 0x4fc7b9
mov dword [esp + 0x2c], edi
mov eax, dword [esp + 0x120]
mov edi, dword [esp + 0x124]
mov dword [esp + 8], eax
jmp 0x4fcafe
test eax, 0xff0000
mov dword [esp + 0x14], 0
je 0x4fc87c
xor edx, edx
jmp 0x4fca8f
jmp 0x4fcb00
mov esi, dword [esp + 0x6c]
mov edx, eax
mov dword [esp + 4], 0
mov dword [esp + 0x14], 0
test esi, esi
jne 0x4fc8a0
jmp 0x4fc8b7
add esi, ecx
mov dl, 1
test esi, esi
je 0x4fc8b7
cmp dword [esp + 0x10], esi
jbe 0x4fc8b1
cmp byte [ebx + esi], 0xbf
jg 0x4fc8b7
jmp 0x4fd206
jne 0x4fd206
cmp esi, dword [esp + 0x10]
je 0x4fc98e
movzx ecx, byte [ebx + esi]
test cl, cl
js 0x4fc905
mov eax, ecx
test dl, dl
jne 0x4fc96d
cmp eax, 0x110000
je 0x4fca81
mov ecx, 1
cmp eax, 0x80
jb 0x4fc898
mov ecx, 2
cmp eax, 0x800
jb 0x4fc898
cmp eax, 0x10000
mov ecx, 4
sbb ecx, 0
jmp 0x4fc898
mov dword [esp + 8], esi
movzx esi, byte [ebx + esi + 1]
mov eax, ecx
and eax, 0x1f
and esi, 0x3f
cmp cl, 0xdf
jbe 0x4fc95c
mov dword [esp + 0x28], edx
mov edx, dword [esp + 8]
shl esi, 6
movzx edx, byte [ebx + edx + 2]
and edx, 0x3f
or edx, esi
cmp cl, 0xf0
jb 0x4fc977
mov esi, dword [esp + 8]
shl edx, 6
and eax, 7
shl eax, 0x12
movzx ecx, byte [ebx + esi + 3]
and ecx, 0x3f
or ecx, edx
mov edx, dword [esp + 0x28]
or eax, ecx
test dl, dl
je 0x4fc8d3
jmp 0x4fc96d
shl eax, 6
or eax, esi
mov esi, dword [esp + 8]
test dl, dl
je 0x4fc8d3
mov dword [esp + 0x28], edx
mov edx, dword [esp + 4]
jmp 0x4fc9aa
shl eax, 0xc
mov esi, dword [esp + 8]
or eax, edx
mov edx, dword [esp + 0x28]
test dl, dl
je 0x4fc8d3
jmp 0x4fc96d
test dl, dl
mov dword [esp + 0x28], edx
je 0x4fca81
mov esi, dword [esp + 0x10]
mov edx, dword [esp + 4]
test ebx, ebx
je 0x4fca8f
mov eax, dword [esp + 0x24]
mov dword [esp + 8], esi
add edx, eax
lea ecx, [eax + esi]
mov esi, edx
sub ecx, edx
mov edx, dword [esp + 0xd4]
sub edx, dword [esp + 0x14]
cmp edx, ecx
jb 0x4fca31
mov eax, dword [esp + 0x1c]
mov ebx, dword [esp + 0x14]
add eax, ebx
push ecx
push esi
push eax
mov esi, ecx
call sub.msvcrt.dll_memcpy
add esp, 0xc
add ebx, esi
mov dword [esp + 0xd8], ebx
mov edx, ebx
cmp dword [esp + 0xd4], ebx
je 0x4fca64
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0xd0]
mov esi, dword [esp + 8]
mov ebx, dword [esp]
mov byte [eax + edx], 0xa
inc edx
xor cl, 1
mov dword [esp + 0x1c], eax
mov dword [esp + 4], esi
mov dword [esp + 0x14], edx
mov dword [esp + 0xd8], edx
mov edx, ecx
test esi, esi
jne 0x4fc8a0
jmp 0x4fc8b7
mov edx, dword [esp + 0x14]
mov ebx, ecx
lea ecx, [esp + 0xd0]
push ebx
call fcn.00556540
mov ecx, ebx
add esp, 4
mov eax, dword [esp + 0xd0]
mov edx, dword [esp + 0xd8]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], edx
jmp 0x4fc9ca
lea ecx, [esp + 0xd0]
push 1
call fcn.00556540
add esp, 4
mov edx, dword [esp + 0xd8]
jmp 0x4fc9f5
mov edx, dword [esp + 4]
jmp 0x4fca8f
mov edx, dword [esp + 0x38]
mov edi, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0xd4]
mov esi, dword [esp + 0x14]
add edx, eax
add edi, eax
sub ecx, esi
sub edi, edx
mov dword [esp + 4], edx
cmp ecx, edi
jb 0x4fd15d
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x2c], edi
add eax, esi
push edi
push dword [esp + 8]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov eax, dword [esp + 0xd0]
mov edi, dword [esp + 0xd4]
cmp dword [esp + 0x124], 0
mov dword [esp + 8], eax
je 0x4fcafa
push dword [esp + 0x120]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
add dword [esp + 0x2c], esi
xor esi, esi
cmp dword [esp + 0xc8], 0
je 0x4fcb1b
push dword [esp + 0xc]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
test esi, esi
je 0x4fce18
mov esi, dword [esp + 8]
mov eax, dword [0x6f1130]
test eax, eax
jne 0x4fcb42
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x4fd1dd
mov dword [0x6f1130], eax
push 8
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x4fd1dd
mov ebx, eax
mov dword [eax], esi
mov dword [eax + 4], edi
mov eax, dword [esp + 0x18]
test eax, eax
js 0x4fcb69
push eax
call sub.ADVAPI32.dll_RegCloseKey
lea ecx, [esp + 0x54]
mov edx, str.wmic_csproduct_get_UUID
push 0x17
call fcn.004edd80
add esp, 4
cmp dword [esp + 0x54], 0
je 0x4fcbc7
cmp byte [esp + 0x58], 3
jne 0x4fcd22
mov esi, dword [esp + 0x5c]
mov eax, dword [esi + 4]
push dword [esi]
call dword [eax]
add esp, 4
mov ecx, dword [esi + 4]
cmp dword [ecx + 4], 0
je 0x4fcd14
mov eax, dword [esi]
cmp dword [ecx + 8], 9
jb 0x4fcbb4
mov eax, dword [eax - 4]
push eax
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
jmp 0x4fcd14
mov edx, dword [esp + 0x58]
mov eax, dword [esp + 0x5c]
mov edi, dword [esp + 0x60]
lea esi, [esp + 0x120]
mov ecx, esi
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], edx
push 1
push 0x6dd4f8
push edi
call fcn.0045fa60
add esp, 0xc
lea eax, [esp + 0xd0]
mov dword [esp + 0x160], 0
mov dword [esp + 0x164], edi
mov word [esp + 0x168], 1
mov ecx, 0x14
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
call fcn.005077f0
test eax, eax
mov dword [esp + 0x18], ebx
je 0x4fcd05
mov esi, eax
mov eax, dword [0x6f1130]
mov edi, edx
test eax, eax
jne 0x4fcc52
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x4fd1dd
mov dword [0x6f1130], eax
push 8
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
je 0x4fd1dd
mov dword [eax], esi
mov dword [eax + 4], edi
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], 1
mov dword [esp], eax
mov dword [esp + 0x50], 1
lea edi, [esp + 0x68]
lea esi, [esp + 0xd0]
mov ecx, 0x14
rep movsd dword es:[edi], dword [esi]
mov esi, 1
jmp 0x4fccaf
mov dword [eax + esi*8], edi
mov dword [eax + esi*8 + 4], ebx
inc esi
mov dword [esp], eax
mov dword [esp + 0x50], esi
lea ecx, [esp + 0x68]
call fcn.005077f0
test eax, eax
je 0x4fccdf
mov edi, eax
cmp esi, dword [esp + 0x4c]
mov eax, dword [esp]
mov ebx, edx
jne 0x4fcca0
lea ecx, [esp + 0x48]
mov edx, esi
push 1
call fcn.00557040
add esp, 4
mov eax, dword [esp + 0x48]
jmp 0x4fcca0
mov ebx, dword [esp + 0x48]
mov edi, dword [esp + 0x4c]
test esi, esi
jne 0x4fcdb5
test edi, 0x1fffffff
je 0x4fcd05
push ebx
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
cmp dword [esp + 0xc], 0
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x10]
je 0x4fcd22
push esi
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
lea ecx, [esp + 0x68]
call fcn.004fd220
cmp dword [esp + 0x68], 0
je 0x4fcd76
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x3c]
movsd xmm0, qword [esp + 0x68]
mov dword [ecx + 8], eax
movsd qword [ecx], xmm0
push ebx
call dword [0x68589c]
add esp, 4
cmp dword [0x6858a0], 0
je 0x4fcdad
cmp dword [0x6858a4], 9
jb 0x4fcd66
mov ebx, dword [ebx - 4]
push ebx
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
jmp 0x4fcdad
push ebx
call dword [0x68589c]
add esp, 4
cmp dword [0x6858a0], 0
je 0x4fcda3
cmp dword [0x6858a4], 9
jb 0x4fcd95
mov ebx, dword [ebx - 4]
push ebx
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
mov eax, dword [esp + 0x3c]
mov dword [eax], 0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
cmp esi, 1
je 0x4fd1c7
mov ecx, dword [ebx + 8]
mov edx, dword [ebx + 0xc]
call fcn.0050eba0
test edx, edx
mov dword [esp], edx
js 0x4fd1ff
mov ecx, eax
je 0x4fcf0c
mov eax, dword [0x6f1130]
mov dword [esp + 4], ecx
test eax, eax
jne 0x4fcdf7
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x4fce10
mov dword [0x6f1130], eax
push dword [esp]
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
mov ecx, dword [esp + 4]
mov esi, eax
test eax, eax
jne 0x4fcf11
mov ecx, dword [esp]
jmp 0x4fd1f3
mov ebx, dword [esp + 0x2c]
mov esi, dword [esp + 8]
lea edx, [esi + ebx]
test ebx, ebx
je 0x4fcfc1
xor ebx, ebx
mov dword [esp + 0xc], edx
jmp 0x4fce48
cmp esi, edx
je 0x4fcfb8
movzx ecx, byte [esi]
mov eax, esi
mov dword [esp], ebx
test cl, cl
js 0x4fce60
lea esi, [eax + 1]
jmp 0x4fced0
movzx ebx, byte [eax + 1]
mov edx, ecx
and edx, 0x1f
and ebx, 0x3f
cmp cl, 0xdf
jbe 0x4fcead
movzx esi, byte [eax + 2]
shl ebx, 6
and esi, 0x3f
or esi, ebx
cmp cl, 0xf0
mov ebx, esi
jb 0x4fcebd
movzx ecx, byte [eax + 3]
and edx, 7
shl ebx, 6
lea esi, [eax + 4]
shl edx, 0x12
and ecx, 0x3f
or ecx, ebx
or ecx, edx
cmp ecx, 0x110000
je 0x4fd14f
mov edx, dword [esp + 0xc]
jmp 0x4fced0
shl edx, 6
lea esi, [eax + 2]
or edx, ebx
mov ecx, edx
mov edx, dword [esp + 0xc]
jmp 0x4fced0
shl edx, 0xc
lea esi, [eax + 3]
or ebx, edx
mov edx, dword [esp + 0xc]
mov ecx, ebx
nop dword [eax + eax]
mov ebx, esi
sub ebx, eax
lea eax, [ecx - 9]
add ebx, dword [esp]
cmp eax, 5
jb 0x4fce40
cmp ecx, 0x20
je 0x4fce40
cmp ecx, 0x80
jb 0x4fcf05
call fcn.00464ff0
mov edx, dword [esp + 0xc]
test al, al
jne 0x4fce40
mov eax, ebx
jmp 0x4fcfcc
mov esi, 1
push dword [esp]
push ecx
push esi
call sub.msvcrt.dll_memcpy
add esp, 0xc
test edi, 0x1fffffff
je 0x4fcf34
push ebx
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
cmp dword [esp + 0xc], 0
je 0x4fcf4c
push dword [esp + 0x10]
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
cmp dword [esp + 0x54], 0
mov ebx, dword [esp + 0x18]
je 0x4fcf9c
cmp byte [esp + 0x58], 3
jne 0x4fcf9c
mov edi, dword [esp + 0x5c]
mov eax, dword [edi + 4]
push dword [edi]
call dword [eax]
add esp, 4
mov ecx, dword [edi + 4]
cmp dword [ecx + 4], 0
je 0x4fcf8e
mov eax, dword [edi]
cmp dword [ecx + 8], 9
jb 0x4fcf80
mov eax, dword [eax - 4]
push eax
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
push edi
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
test esi, esi
je 0x4fcd22
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp]
mov dword [eax], esi
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
jmp 0x4fcd47
xor eax, eax
xor ebx, ebx
jmp 0x4fd0a8
xor ebx, ebx
xor eax, eax
mov dword [esp], 0
cmp esi, edx
je 0x4fd0a5
mov dword [esp + 0x20], eax
mov dword [esp + 0x10], esi
jmp 0x4fcfec
mov esi, dword [esp + 0x10]
cmp esi, edx
je 0x4fd0a5
movzx ecx, byte [edx - 1]
mov dword [esp + 4], edx
test cl, cl
js 0x4fcffb
dec edx
jmp 0x4fd067
movzx eax, byte [edx - 2]
cmp al, 0xc0
jge 0x4fd031
mov dword [esp + 0x24], eax
movzx eax, byte [edx - 3]
cmp al, 0xc0
mov dword [esp + 0x34], eax
jge 0x4fd039
mov eax, edx
add edx, 0xfffffffc
movzx esi, byte [eax - 4]
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x34]
and esi, 7
and edx, 0x3f
shl esi, 6
or edx, esi
jmp 0x4fd047
add edx, 0xfffffffe
and eax, 0x1f
jmp 0x4fd057
add edx, 0xfffffffd
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x34]
and edx, 0xf
mov eax, dword [esp + 0x24]
shl edx, 6
and eax, 0x3f
or eax, edx
mov edx, dword [esp + 0xc]
shl eax, 6
and ecx, 0x3f
or ecx, eax
cmp ecx, 0x110000
je 0x4fd0a5
lea eax, [ecx - 9]
cmp eax, 5
jb 0x4fcfe0
cmp ecx, 0x20
je 0x4fcfe0
cmp ecx, 0x80
jb 0x4fd099
mov dword [esp + 0xc], edx
call fcn.00464ff0
mov edx, dword [esp + 0xc]
test al, al
jne 0x4fcfe0
mov ebx, dword [esp + 0x20]
sub ebx, dword [esp + 0x10]
add ebx, dword [esp + 4]
mov eax, dword [esp]
sub ebx, eax
js 0x4fd1ff
test ebx, ebx
mov dword [esp], eax
je 0x4fd0e2
mov eax, dword [0x6f1130]
test eax, eax
jne 0x4fd0ce
call sub.KERNEL32.dll_GetProcessHeap
test eax, eax
je 0x4fd0db
mov dword [0x6f1130], eax
push ebx
push 0
push eax
call sub.KERNEL32.dll_HeapAlloc
test eax, eax
jne 0x4fd0e7
mov ecx, ebx
jmp 0x4fd1f3
mov eax, 1
mov esi, dword [esp + 8]
mov ecx, dword [esp]
add ecx, esi
push ebx
push ecx
mov dword [esp + 8], eax
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
test edi, edi
je 0x4fd111
push esi
push 0
push dword [0x6f1130]
call sub.KERNEL32.dll_HeapFree
mov eax, dword [esp + 0x18]
test eax, eax
js 0x4fd11f
push eax
call sub.ADVAPI32.dll_RegCloseKey
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp]
mov dword [eax], ecx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
jmp 0x4fcdad
mov eax, edi
lea ecx, [esp + 0x120]
xor edx, edx
shr eax, 2
push eax
call fcn.00556540
add esp, 4
jmp 0x4fc1dd
mov eax, dword [esp]
mov edx, dword [esp + 0xc]
xor ebx, ebx
jmp 0x4fcfc5
lea ecx, [esp + 0xd0]
mov edx, esi
push edi
call fcn.00556540
add esp, 4
mov eax, dword [esp + 0xd0]
mov esi, dword [esp + 0xd8]
mov dword [esp + 0x1c], eax
jmp 0x4fcab2
mov ecx, dword [esp + 0xc4]
add ecx, dword [esp + 4]
cmp edx, ecx
cmova ecx, edx
push 0x6dd4b0
call fcn.0045a150
add esp, 4
ud2
mov edx, eax
push 0x6dd4c0
call fcn.0045a150
add esp, 4
ud2
mov ecx, eax
push 0x6dd4d0
call fcn.0045a150
add esp, 4
ud2
mov ecx, 1
mov edx, esi
push 0x684244
call fcn.0045a150
add esp, 4
ud2
mov ecx, 8
mov edx, 4
call fcn.0040a640
ud2
mov ecx, 0x800
mov edx, 1
call fcn.0040a640
ud2
call fcn.0040a620
ud2
mov edx, dword [esp + 0x10]
mov ecx, ebx
push 0x6dd4e8
push edx
push esi
call fcn.0045d720
add esp, 0xc
ud2