Function at 0x443030
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
mov dword [ebp - 0x20], ecx
push ecx
lea ecx, [ebp - 0x54]
call fcn.0042c9fa
mov eax, dword [ebp + 8]
xor ebx, ebx
mov byte [ebp - 4], 0xff
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x30], eax
mov dword [ebp - 8], ebx
lea eax, [ebp + 8]
push eax
call fcn.0042609c
mov esi, dword [ebp + 8]
mov ax, word [esi]
cmp ax, 0x2d
pop ecx
mov byte [ebp - 1], 0
mov byte [ebp - 2], 0
mov byte [ebp - 3], 0
mov dword [ebp - 0x24], ebx
mov cl, 0x2a
jne 0x443080
mov cl, al
movsx edi, cl
movzx eax, ax
jmp 0x44313c
movzx eax, word [esi + 2]
cmp edi, eax
jne 0x443144
xor eax, eax
lea ecx, [esi + 4]
mov ax, word [ecx]
mov edx, eax
and dx, 0xffdf
cmp dx, 0x48
je 0x443144
call fcn.00426083
test al, al
jne 0x443144
mov esi, ecx
push 1
push esi
push 0x481040
mov dword [ebp + 8], esi
call fcn.00426f79
add esp, 0xc
test al, al
lea eax, [ebp + 8]
je 0x443112
push eax
add esi, 2
call fcn.00403b20
cmp word [esi], 0x3a
pop ecx
je 0x4430ef
or dword [ebp - 0x24], 7
jmp 0x443136
lea eax, [ebp - 0x38]
push eax
inc esi
lea eax, [ebp - 0x40]
inc esi
push eax
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x40], esi
call fcn.0042dab0
test eax, eax
pop ecx
pop ecx
jle 0x443136
mov eax, dword [ebp - 0x38]
or dword [ebp - 0x24], eax
jmp 0x443136
push 2
push eax
push 0x48103c
call fcn.0042c7e8
add esp, 0xc
test al, al
je 0x44312c
mov byte [ebp - 3], 1
jmp 0x443136
lea eax, [ebp + 8]
push eax
call fcn.00403b20
pop ecx
mov esi, dword [ebp + 8]
movzx eax, word [esi]
cmp edi, eax
je 0x44308b
lea ecx, [ebp - 0x34]
call fcn.0042aeb8
lea ecx, [ebp - 0x48]
call fcn.0042aeb8
lea ecx, [ebp - 0x1c]
call fcn.0042aeb8
lea ecx, [ebp - 0x2c]
call fcn.0042aeb8
lea ecx, [ebp - 0x28]
call fcn.0042aeb8
mov ax, word [esi]
cmp ax, 0x2b
je 0x44319f
cmp ax, 0x23
je 0x44319f
cmp ax, 0x40
je 0x44319f
cmp ax, 0x24
je 0x44319f
cmp ax, 0x2a
je 0x44319f
cmp ax, 0x7e
je 0x44319f
cmp ax, 0x2e
je 0x44319f
cmp ax, 0x3f
jne 0x4431b8
mov al, byte [esi]
inc esi
inc esi
test al, al
mov byte [ebp - 1], al
mov dword [ebp + 8], esi
je 0x4431b8
movzx eax, word [esi]
movsx ecx, byte [ebp - 1]
cmp ecx, eax
je 0x4431be
cmp word [esi], 0x24
jne 0x4431c8
mov al, byte [esi]
inc esi
inc esi
mov byte [ebp - 2], al
mov dword [ebp + 8], esi
lea eax, [ebp + 8]
push eax
call fcn.0042609c
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov esi, eax
movzx eax, word [eax]
pop ecx
jmp 0x4431f6
cmp ax, 0x2c
je 0x4431fb
cmp ax, 0x3d
je 0x4431fb
cmp ax, 0x21
je 0x4431fb
inc esi
inc esi
mov ax, word [esi]
cmp ax, bx
jne 0x4431df
mov ax, word [esi]
cmp ax, 0x2c
je 0x443210
cmp ax, 0x3d
je 0x443210
cmp ax, 0x21
jne 0x443221
mov al, byte [esi]
mov word [esi], bx
inc esi
inc esi
test al, al
mov byte [ebp + 0xb], al
mov dword [ebp - 0x18], esi
jne 0x443273
inc byte [ebp - 4]
cmp byte [ebp - 4], 0
jg 0x443692
mov ecx, dword [ebp - 0x20]
push 1
push ebx
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x30]
call fcn.0043b18c
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x28]
mov dword [ebp + 8], eax
call fcn.0042602e
lea ecx, [ebp - 0x2c]
call fcn.0042602e
lea ecx, [ebp - 0x1c]
call fcn.0042602e
lea ecx, [ebp - 0x48]
call fcn.0042602e
lea ecx, [ebp - 0x34]
call fcn.0042602e
jmp 0x443057
push 1
push 0x2c
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x54]
call fcn.0043e2e9
push ebx
lea ecx, [ebp - 0x34]
push ecx
push eax
call fcn.0042d669
mov eax, dword [ebp - 0x34]
add esp, 0xc
push 0x5c
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov edi, eax
cmp edi, ebx
je 0x443692
mov word [edi], bx
inc edi
inc edi
push 0x481034
push edi
mov dword [ebp - 0x14], edi
call dword [sym.imp.SHLWAPI.dll_StrStrW]
cmp eax, ebx
jne 0x4432d4
push 0x5c
push ebx
push edi
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
cmp eax, ebx
je 0x443692
mov word [eax], bx
inc eax
inc eax
cmp word [eax], 0x5c
mov dword [ebp - 0x10], eax
jne 0x4432ed
add eax, 2
cmp word [eax], bx
jne 0x4432ed
mov dword [ebp - 0x10], eax
cmp byte [ebp + 0xb], 0x2c
jne 0x44337e
push 1
push 0x2c
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x54]
call fcn.0043e2e9
push ebx
lea ecx, [ebp - 0x1c]
push ecx
push eax
call fcn.0042d669
mov ecx, dword [ebp - 0x20]
add esp, 0xc
push ebx
lea eax, [ebp - 0x1c]
push eax
call fcn.00402aa0
cmp byte [ebp - 1], 0x2e
jne 0x443360
mov eax, dword [ebp - 0x18]
cmp word [eax], 0x2c
jne 0x443360
add dword [ebp - 0x18], 2
push 1
push 0x2c
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x54]
call fcn.0043e2e9
push ebx
lea ecx, [ebp - 0x28]
push ecx
push eax
call fcn.0042d669
mov ecx, dword [ebp - 0x20]
add esp, 0xc
push ebx
lea eax, [ebp - 0x28]
push eax
call fcn.00402aa0
mov eax, dword [ebp - 0x1c]
cmp word [eax], bx
jne 0x443469
push str.RegDat
lea ecx, [ebp - 0x1c]
call fcn.004346c9
jmp 0x443469
cmp byte [ebp + 0xb], 0x21
je 0x443469
cmp word [esi], bx
jne 0x4433a3
cmp byte [ebp - 1], 0x24
je 0x4433c2
cmp byte [ebp - 1], 0x2a
je 0x4433a3
cmp byte [ebp - 1], 0x7e
jne 0x443469
cmp byte [ebp - 1], 0x24
je 0x4433c2
cmp byte [ebp - 1], 0x2a
je 0x4433c2
cmp byte [ebp - 1], 0x7e
je 0x4433c2
lea eax, [ebp - 0x18]
push eax
call fcn.0042609c
mov esi, dword [ebp - 0x18]
pop ecx
push esi
lea ecx, [ebp - 0x30]
call fcn.00434695
mov edx, dword [ebp - 0x30]
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 0x38], edx
call fcn.0042609c
cmp byte [ebp + 0xc], 0
pop ecx
je 0x4433ec
push edx
lea ecx, [ebp - 0x2c]
call fcn.004346c9
jmp 0x4433fc
mov ecx, dword [ebp - 0x20]
push 1
push ebx
lea eax, [ebp - 0x2c]
push eax
push edx
call fcn.00439f58
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 8], eax
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
call fcn.0042609c
cmp byte [ebp - 1], 0
pop ecx
jne 0x443447
push dword [ebp - 0x38]
push 0x48101c
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x443430
mov dword [ebp - 8], 0x47a8e8
jmp 0x443461
mov ecx, dword [ebp + 0xc]
mov ax, word [ecx]
cmp ax, 0x23
je 0x443442
cmp ax, 0x40
jne 0x443461
mov dword [ebp - 8], ecx
jmp 0x443461
cmp byte [ebp - 1], 0x23
je 0x443453
cmp byte [ebp - 1], 0x40
jne 0x443461
mov eax, dword [ebp + 0xc]
cmp word [eax], bx
mov dword [ebp - 8], eax
jne 0x443461
mov dword [ebp - 8], ebx
lea ecx, [ebp - 0x30]
call fcn.0042602e
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov edi, dword [ebp - 8]
push str.HKLM
push dword [ebp - 0xc]
call esi
test eax, eax
je 0x443532
push str.HKEY_LOCAL_MACHINE
push dword [ebp - 0xc]
call esi
test eax, eax
je 0x443532
push str.HKCU
push dword [ebp - 0xc]
call esi
test eax, eax
je 0x443529
push str.HKEY_CURRENT_USER
push dword [ebp - 0xc]
call esi
test eax, eax
je 0x443529
push str.HKCR
push dword [ebp - 0xc]
call esi
test eax, eax
je 0x443520
push str.HKEY_CLASSES_ROOT
push dword [ebp - 0xc]
call esi
test eax, eax
je 0x443520
push 0x480f80
push dword [ebp - 0xc]
call esi
test eax, eax
je 0x443517
push str.HKEY_USERS
push dword [ebp - 0xc]
call esi
test eax, eax
je 0x443517
push str.HKCC
push dword [ebp - 0xc]
call esi
test eax, eax
je 0x44350e
push str.HKEY_CURRENT_CONFIG
push dword [ebp - 0xc]
call esi
test eax, eax
jne 0x443692
mov dword [ebp - 0xc], 0x80000005
jmp 0x443539
mov dword [ebp - 0xc], 0x80000003
jmp 0x443539
mov dword [ebp - 0xc], 0x80000000
jmp 0x443539
mov dword [ebp - 0xc], 0x80000001
jmp 0x443539
mov dword [ebp - 0xc], 0x80000002
mov eax, dword [ebp - 0x1c]
cmp word [eax], bx
je 0x443993
cmp byte [ebp - 1], 0x2e
je 0x443554
cmp byte [ebp - 1], 0x3f
mov dword [ebp - 8], ebx
jne 0x443561
cmp byte [ebp - 1], 0x3f
mov dword [ebp - 8], 1
je 0x44356f
cmp dword [ebp - 8], ebx
je 0x44356b
cmp word [eax], bx
je 0x44356f
xor edi, edi
jmp 0x443572
xor edi, edi
inc edi
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x64
lea ecx, [ebp + 0xc]
mov dword [ebp - 0x38], ebx
call fcn.0042aed6
lea ecx, [ebp - 0x18]
call fcn.0042aeb8
cmp byte [ebp - 1], 0x2e
lea ebx, [ebp - 0x18]
je 0x44359a
lea ebx, [ebp + 0xc]
push 0x1000
lea ecx, [ebp + 8]
mov dword [ebp - 0x40], ebx
call fcn.0042add7
and dword [ebp - 0x30], 0
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp + 8]
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x24], 0xfff
push dword [ebp - 0x14]
push dword [ebp - 0xc]
call fcn.0042e603
mov esi, eax
add esp, 0x18
test esi, esi
jge 0x443645
mov eax, dword [ebp - 0x10]
xor edi, edi
cmp word [eax], di
jne 0x443601
cmp dword [ebp - 0x30], 2
jne 0x443601
cmp esi, 0xfffffffe
jne 0x443601
cmp dword [ebp - 8], edi
je 0x44394c
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x480f30
jmp 0x44361c
mov esi, dword [ebp - 0x30]
cmp esi, edi
jne 0x44360b
xor esi, esi
inc esi
cmp dword [ebp - 8], edi
mov dword [ebp - 0x38], esi
je 0x443628
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.ERROR
mov ecx, ebx
call fcn.00409f00
jmp 0x44394c
lea ecx, [ebp + 8]
call fcn.0042602e
lea ecx, [ebp - 0x18]
call fcn.0042602e
lea ecx, [ebp + 0xc]
call fcn.0042602e
jmp 0x443d96
cmp esi, 1
jne 0x4436ad
cmp dword [ebp - 8], 0
je 0x443668
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_SZ
mov ecx, ebx
call fcn.00409f00
test edi, edi
jne 0x44394a
cmp byte [ebp - 1], 0x24
je 0x44369c
cmp byte [ebp - 1], 0x2e
je 0x44369c
cmp byte [ebp - 1], 0
je 0x44369c
lea ecx, [ebp + 8]
call fcn.0042602e
lea ecx, [ebp - 0x18]
call fcn.0042602e
lea ecx, [ebp + 0xc]
call fcn.0042602e
mov esi, 0x80070057
jmp 0x443d96
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [ebp + 0xc], ecx
mov dword [ebp + 8], eax
jmp 0x443947
cmp esi, 0xb
jne 0x4436f9
cmp dword [ebp - 8], 0
je 0x4436d0
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_QWORD
mov ecx, ebx
call fcn.00409f00
test edi, edi
jne 0x44394a
cmp byte [ebp - 1], 0x2b
je 0x4436dc
cmp byte [ebp - 1], 0x2e
jne 0x44367a
mov eax, dword [ebp + 8]
push str.0x_I64x
push dword [eax + 4]
push dword [eax]
push dword [ebp + 0xc]
call fcn.004344dc
add esp, 0x10
jmp 0x443947
cmp esi, 4
jne 0x443747
cmp dword [ebp - 8], 0
je 0x44371c
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_DWORD
mov ecx, ebx
call fcn.00409f00
test edi, edi
jne 0x44394a
cmp byte [ebp - 1], 0x23
je 0x44372c
cmp byte [ebp - 1], 0x2e
jne 0x44367a
mov eax, dword [ebp + 8]
push dword [eax]
push 0x480eec
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x443947
cmp esi, 3
jne 0x4437eb
cmp dword [ebp - 8], 0
je 0x44376e
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_BINARY
mov ecx, ebx
call fcn.00409f00
test edi, edi
jne 0x44394a
cmp byte [ebp - 1], 0x40
je 0x44377e
cmp byte [ebp - 1], 0x2e
jne 0x44367a
mov eax, dword [ebp - 0x24]
lea eax, [eax + eax*4 + 6]
push eax
lea ecx, [ebp + 0xc]
call fcn.0042aeff
mov eax, dword [ebp + 0xc]
and word [eax], 0
cmp dword [ebp - 0x24], 0
mov esi, dword [ebp + 8]
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
mov ebx, eax
jle 0x4437b6
movzx eax, byte [esi]
push eax
push str.0x_02X
push ebx
call edi
add esp, 0xc
inc esi
xor eax, eax
inc eax
add ebx, 8
cmp dword [ebp - 0x24], eax
mov dword [ebp - 0x30], eax
jle 0x443947
movzx eax, byte [esi]
push eax
push str._0x_02X
push ebx
call edi
add esp, 0xc
inc esi
inc dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
add ebx, 0xa
cmp eax, dword [ebp - 0x24]
jl 0x4437c8
jmp 0x443947
cmp esi, 2
jne 0x443840
cmp dword [ebp - 8], 0
je 0x44380e
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_EXPAND_SZ
mov ecx, ebx
call fcn.00409f00
test edi, edi
jne 0x44394a
cmp byte [ebp - 1], 0x7e
je 0x44381e
cmp byte [ebp - 1], 0x2e
jne 0x44367a
cmp byte [ebp - 2], 0
je 0x44369c
mov ecx, dword [ebp - 0x20]
push 1
push 0
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
call fcn.0043b18c
jmp 0x443947
cmp esi, 7
jne 0x443915
cmp dword [ebp - 8], 0
je 0x443867
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_MULTI_SZ
mov ecx, ebx
call fcn.00409f00
test edi, edi
jne 0x44394a
cmp byte [ebp - 1], 0x2a
je 0x443877
cmp byte [ebp - 1], 0x2e
jne 0x44367a
mov esi, dword [ebp - 0x24]
shr esi, 1
lea eax, [esi*4 + 6]
push eax
lea ecx, [ebp + 0xc]
call fcn.0042aeff
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
lea esi, [ecx + esi*2]
cmp ecx, esi
mov dword [ebp - 0x30], esi
jae 0x44390f
push 0x5c
pop esi
push 2
pop edi
cmp byte [ebp - 2], 0x2a
jne 0x4438d6
cmp word [ecx], si
jne 0x4438d6
lea edx, [ecx + 2]
mov bx, word [edx]
cmp bx, 0x30
je 0x4438c3
cmp bx, si
je 0x4438c3
test bx, bx
jne 0x4438d6
mov ecx, edx
mov word [eax], si
mov dx, word [ecx]
add eax, edi
mov word [eax], dx
add eax, edi
add ecx, edi
jmp 0x44390a
mov dx, word [ecx]
test dx, dx
jne 0x4438cd
add ecx, edi
cmp byte [ebp - 2], 0x24
jne 0x4438fe
cmp ecx, dword [ebp - 0x30]
jae 0x44390f
cmp word [ecx], dx
je 0x44390f
mov word [eax], 0xd
add eax, edi
mov word [eax], 0xa
jmp 0x443908
mov word [eax], si
add eax, edi
mov word [eax], 0x30
add eax, edi
cmp ecx, dword [ebp - 0x30]
jb 0x4438a2
and word [eax], 0
jmp 0x443947
cmp dword [ebp - 8], 0
je 0x443939
push 0x32
mov ecx, ebx
call fcn.0042aeff
push esi
push 0x47b234
push dword [ebx]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
test edi, edi
jne 0x44394a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x443944
inc eax
mov dword [ebp - 0x38], eax
mov ebx, dword [ebp - 0x40]
xor edi, edi
mov eax, dword [ebp - 0x1c]
cmp word [eax], di
je 0x443960
push dword [ebp + 0xc]
mov ecx, dword [ebp - 0x20]
push eax
call fcn.00429dbf
mov eax, dword [ebp - 0x28]
cmp word [eax], di
je 0x443973
push dword [ebx]
mov ecx, dword [ebp - 0x20]
push eax
call fcn.00429dbf
lea ecx, [ebp + 8]
call fcn.0042602e
lea ecx, [ebp - 0x18]
call fcn.0042602e
lea ecx, [ebp + 0xc]
call fcn.0042602e
mov esi, dword [ebp - 0x38]
jmp 0x443d96
cmp edi, ebx
je 0x443d0e
mov al, byte [ebp - 1]
cmp al, 0x2b
je 0x4439b8
test al, al
jne 0x443a20
mov ax, word [edi]
cmp ax, 0x2b
jne 0x443a4b
inc edi
inc edi
mov dword [ebp - 8], edi
cmp byte [ebp - 3], 0
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ebx
je 0x443cee
xor ecx, ecx
mov cx, word [edi]
mov eax, ecx
call fcn.0042aa48
test al, al
je 0x443692
cmp cx, 0x30
jne 0x4439f3
mov ax, word [edi + 2]
or ax, 0x20
cmp ax, 0x78
jne 0x4439f3
add edi, 4
push edi
call fcn.0042b545
pop ecx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], edx
push 8
lea eax, [ebp - 0x44]
push eax
push 0xb
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0xc]
call fcn.00426e2f
add esp, 0x18
mov esi, eax
jmp 0x443d96
cmp al, 0x23
je 0x443a56
cmp al, 0x40
je 0x443aac
cmp al, 0x2a
je 0x443b41
cmp al, 0x7e
je 0x443bdd
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
push eax
push edi
push 1
jmp 0x443a08
cmp ax, 0x23
jne 0x443a9d
inc edi
inc edi
mov dword [ebp - 8], edi
cmp byte [ebp - 3], 0
mov dword [ebp + 8], ebx
je 0x443ccd
xor ecx, ecx
mov cx, word [edi]
mov eax, ecx
call fcn.0042aa48
test al, al
je 0x443692
cmp cx, 0x30
jne 0x443a8e
mov ax, word [edi + 2]
or ax, 0x20
cmp ax, 0x78
jne 0x443a8e
add edi, 4
push edi
call fcn.0042b545
pop ecx
mov dword [ebp + 8], eax
jmp 0x443ce1
cmp ax, 0x40
jne 0x443b32
inc edi
inc edi
mov dword [ebp - 8], edi
push dword [ebp - 8]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
push edi
lea ecx, [ebp + 0xc]
call fcn.0042add7
lea eax, [ebp - 8]
push eax
call fcn.0042609c
test edi, edi
mov ebx, dword [ebp + 0xc]
pop ecx
jle 0x443ca9
mov eax, dword [ebp - 8]
mov cx, word [eax]
test cx, cx
je 0x443ca9
and dword [ebp - 0x44], 0
and dword [ebp - 0x40], 0
cmp byte [ebp - 3], 0
je 0x443c8b
cmp cx, 0x30
jne 0x443b12
mov cx, word [eax + 2]
or cx, 0x20
cmp cx, 0x78
jne 0x443b12
add eax, 4
mov dword [ebp - 8], eax
push 2
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 8]
push eax
call fcn.0042b60a
lea eax, [ebp - 8]
push eax
call fcn.0042609c
add esp, 0x10
jmp 0x443c9a
cmp ax, 0x2a
jne 0x443bd1
inc edi
inc edi
mov dword [ebp - 8], edi
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
lea eax, [esi + 0x10]
push eax
lea ecx, [ebp + 0xc]
xor ebx, ebx
call fcn.0042aed6
mov eax, dword [ebp - 8]
mov edx, dword [ebp + 0xc]
lea esi, [eax + esi*2]
cmp eax, esi
jae 0x443ba1
and word [edx], 0
cmp byte [ebp - 2], 0x2a
jne 0x443c46
cmp word [eax], 0x5c
jne 0x443c68
lea ecx, [eax + 2]
cmp word [ecx], 0x5c
jne 0x443c68
mov eax, ecx
mov cx, word [eax]
mov word [edx], cx
inc edx
inc edx
inc eax
inc eax
xor ebx, ebx
cmp eax, esi
jb 0x443b65
cmp ebx, 2
jge 0x443bba
push 2
pop esi
sub esi, ebx
xor eax, eax
mov ecx, esi
shr ecx, 1
mov edi, edx
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
add ebx, esi
lea edx, [edx + esi*2]
push 2
pop eax
sub eax, ebx
lea eax, [edx + eax*2]
and word [eax], 0
sub eax, dword [ebp + 0xc]
push eax
push dword [ebp + 0xc]
push 7
jmp 0x443c2e
cmp ax, 0x7e
jne 0x443a3c
inc edi
inc edi
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
push eax
lea ecx, [ebp + 0xc]
call fcn.0042aed6
cmp word [edi], bx
mov eax, dword [ebp + 0xc]
mov ecx, edi
je 0x443c1e
mov dx, word [ecx]
cmp dx, 0x5c
jne 0x443c12
cmp word [ecx + 2], 0x30
jne 0x443c12
mov word [eax], bx
inc eax
inc eax
add ecx, 4
jmp 0x443c19
mov word [eax], dx
inc eax
inc eax
inc ecx
inc ecx
cmp word [ecx], bx
jne 0x443bf8
mov word [eax], bx
sub eax, dword [ebp + 0xc]
sar eax, 1
shl eax, 1
push eax
push dword [ebp + 0xc]
push 2
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0xc]
call fcn.00426e2f
add esp, 0x18
mov esi, eax
jmp 0x443638
cmp byte [ebp - 2], 0x24
jne 0x443c68
cmp word [eax], 0xd
jne 0x443c68
cmp word [eax + 2], 0xa
jne 0x443c68
and word [edx], 0
add eax, 4
inc edx
inc edx
inc ebx
jmp 0x443b98
mov cx, word [eax]
cmp cx, 0x5c
jne 0x443b8f
cmp word [eax + 2], 0x30
jne 0x443b8f
and word [edx], 0
inc edx
inc edx
add eax, 4
jmp 0x443c62
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 8]
push eax
call fcn.0042d9d2
pop ecx
pop ecx
mov al, byte [ebp - 0x44]
mov byte [ebx + esi], al
inc esi
cmp esi, edi
jl 0x443ad7
push esi
push ebx
push 3
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0xc]
call fcn.00426e2f
add esp, 0x18
lea ecx, [ebp + 0xc]
mov esi, eax
call fcn.0042602e
jmp 0x443d96
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
call fcn.0042dab0
cmp eax, 1
pop ecx
pop ecx
jl 0x443d06
push 4
lea eax, [ebp + 8]
push eax
push 4
jmp 0x443a08
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 8]
push eax
call fcn.0042d9d2
cmp eax, 1
pop ecx
pop ecx
jge 0x443a00
xor esi, esi
inc esi
jmp 0x443d96
cmp byte [ebp + 0xb], 0x21
jne 0x443d40
mov eax, dword [ebp - 0x10]
cmp word [eax], bx
jne 0x443d40
cmp dword [ebp - 0x24], ebx
je 0x443d31
push dword [ebp - 0x24]
push dword [ebp - 0x14]
push dword [ebp - 0xc]
call fcn.0042c692
jmp 0x443d8a
push dword [ebp - 0x14]
push dword [ebp - 0xc]
call fcn.0042c46c
pop ecx
pop ecx
jmp 0x443d8d
cmp dword [ebp - 0x24], ebx
je 0x443d7c
push ebx
lea eax, [ebp + 0xc]
push eax
movzx eax, word [0x48fb88]
push ebx
or eax, 0x2001b
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x14]
mov dword [ebp + 0xc], ebx
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp dword [ebp + 0xc], ebx
mov esi, eax
je 0x443d8f
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x443d8f
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebp - 0xc]
call fcn.00426ea6
add esp, 0xc
mov esi, eax
cmp esi, 2
jne 0x443d96
xor esi, esi
lea ecx, [ebp - 0x28]
call fcn.0042602e
lea ecx, [ebp - 0x2c]
call fcn.0042602e
lea ecx, [ebp - 0x1c]
call fcn.0042602e
lea ecx, [ebp - 0x48]
call fcn.0042602e
lea ecx, [ebp - 0x34]
call fcn.0042602e
lea ecx, [ebp - 0x3c]
call fcn.0042602e
lea ecx, [ebp - 0x54]
call fcn.0042602e
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8