Function at 0x45e92a
Capabilities:
Encode data using base64
Parse credit card information
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x90
push ebx
push esi
push edi
mov dword [ebp + 0x18], ecx
push ecx
lea ecx, [ebp - 0x20]
call fcn.004462b2
mov eax, dword [ebp + 0x78]
mov dword [ebp + 0x24], eax
xor ebx, ebx
lea eax, [ebp + 0x78]
push eax
mov byte [ebp + 0x3b], 0xff
mov byte [ebp + 0x66], bl
mov byte [ebp + 0x53], bl
mov dword [ebp - 8], ebx
call fcn.0043dae7
push 0xa
lea eax, [ebp + 0x78]
push eax
push str.___initram
call fcn.00445f31
add esp, 0x10
test al, al
jne 0x45ee32
mov dword [ebp + 0x68], ebx
mov esi, dword [ebp + 0x78]
mov ax, word [esi]
cmp ax, 0x2d
mov dword [ebp + 0x54], ebx
mov dword [ebp + 0x58], 0xfffffff0
mov byte [ebp + 0x6f], 0
mov byte [ebp + 0x5f], 0
mov byte [ebp + 0x65], 0
mov byte [ebp + 0x67], 0
mov byte [ebp + 0x2b], 0
mov byte [ebp + 0x64], 0
mov byte [ebp + 0x2a], 0
mov byte [ebp + 0x29], 0
mov dword [ebp + 0x4c], ebx
mov cl, 0x2a
jne 0x45e9bd
mov cl, al
movsx ecx, cl
movzx eax, ax
cmp ecx, eax
mov dword [ebp + 0x14], ecx
jne 0x45ec30
movzx eax, word [esi + 2]
cmp dword [ebp + 0x14], eax
jne 0x45ec30
xor eax, eax
lea ecx, [esi + 4]
mov ax, word [ecx]
mov edx, eax
and dx, 0xffdf
cmp dx, 0x48
je 0x45ec30
call fcn.0043daaf
test al, al
jne 0x45ec30
xor edi, edi
mov esi, ecx
inc edi
push edi
push esi
push 0x4c6008
mov dword [ebp + 0x78], esi
call fcn.0043eeea
add esp, 0xc
test al, al
je 0x45ea65
lea eax, [ebp + 0x78]
add esi, 2
push eax
mov dword [ebp + 0x30], esi
call fcn.00408ddd
cmp word [esi], 0x3a
pop ecx
je 0x45ea3b
or dword [ebp + 0x4c], 7
jmp 0x45ec21
lea eax, [ebp + 0x60]
push eax
inc esi
lea eax, [ebp + 0x30]
inc esi
push eax
mov dword [ebp + 0x60], ebx
mov dword [ebp + 0x30], esi
call fcn.004404ef
test eax, eax
pop ecx
pop ecx
jle 0x45ec21
mov eax, dword [ebp + 0x60]
or dword [ebp + 0x4c], eax
jmp 0x45ec21
push 2
push esi
push 0x4c6004
call fcn.0043eeea
add esp, 0xc
test al, al
lea eax, [ebp + 0x78]
je 0x45eab1
add esi, 4
push eax
mov dword [ebp + 0xc], esi
call fcn.00408ddd
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0xc]
push eax
mov dword [ebp + 0x60], ebx
call fcn.004503bc
add esp, 0xc
test eax, eax
jle 0x45ec21
mov eax, dword [ebp + 0x60]
mov dword [ebp + 0x54], eax
mov dword [ebp + 0x58], ebx
jmp 0x45ec21
push 2
pop esi
push esi
push eax
push 0x4c22c4
call fcn.00445f31
add esp, 0xc
test al, al
je 0x45ead0
mov byte [ebp + 0x65], 1
jmp 0x45ec21
push 4
lea eax, [ebp + 0x78]
push eax
push str.byte
call fcn.00445f31
add esp, 0xc
test al, al
je 0x45eaf0
mov byte [ebp + 0x64], 1
jmp 0x45ec21
push edi
lea eax, [ebp + 0x78]
push eax
push 0x4c06c0
call fcn.00445f31
add esp, 0xc
test al, al
je 0x45eb0f
mov byte [ebp + 0x67], 3
jmp 0x45ec21
push esi
lea eax, [ebp + 0x78]
push eax
push 0x4c5ff8
call fcn.00445f31
add esp, 0xc
test al, al
je 0x45eb2e
or byte [ebp + 0x67], 1
jmp 0x45ec21
push esi
lea eax, [ebp + 0x78]
push eax
push 0x4c5ff4
call fcn.00445f31
add esp, 0xc
test al, al
je 0x45eb4d
or byte [ebp + 0x67], 2
jmp 0x45ec21
push 4
lea eax, [ebp + 0x78]
push eax
push 0x4c5fec
call fcn.00445f31
add esp, 0xc
test al, al
je 0x45eb6d
mov byte [ebp + 0x2b], 1
jmp 0x45ec21
push edi
lea eax, [ebp + 0x78]
push eax
push 0x4c5fe8
call fcn.00445f31
add esp, 0xc
test al, al
je 0x45eb8b
inc byte [ebp + 0x66]
jmp 0x45ec21
push esi
lea eax, [ebp + 0x78]
push eax
push 0x4c5fe4
call fcn.00445f31
add esp, 0xc
test al, al
je 0x45eba6
dec byte [ebp + 0x66]
jmp 0x45ec21
push edi
lea eax, [ebp + 0x78]
push eax
push 0x4c5fe0
call fcn.00445f31
add esp, 0xc
test al, al
je 0x45ebc1
inc byte [ebp + 0x53]
jmp 0x45ec21
push esi
lea eax, [ebp + 0x78]
push eax
push 0x4c5fdc
call fcn.00445f31
add esp, 0xc
test al, al
je 0x45ebdd
mov byte [ebp + 0x2a], 1
jmp 0x45ec21
push 4
lea eax, [ebp + 0x78]
push eax
push str.init
call fcn.00445f31
add esp, 0xc
test al, al
je 0x45ebfa
mov byte [ebp + 0x29], 1
jmp 0x45ec21
push esi
lea eax, [ebp + 0x78]
push eax
push 0x4bddc8
call fcn.00445f31
add esp, 0xc
test al, al
je 0x45ec17
call fcn.00441ceb
jmp 0x45ec21
lea eax, [ebp + 0x78]
push eax
call fcn.00408ddd
pop ecx
mov esi, dword [ebp + 0x78]
movzx eax, word [esi]
cmp dword [ebp + 0x14], eax
je 0x45e9ce
lea ecx, [ebp + 8]
call fcn.00443f5b
lea ecx, [ebp - 0x10]
call fcn.00443f5b
lea ecx, [ebp + 0x10]
call fcn.00443f5b
lea ecx, [ebp + 4]
call fcn.00443f5b
lea ecx, [ebp]
call fcn.00443f5b
xor eax, eax
mov ax, word [esi]
mov ecx, eax
or ecx, 0x20
cmp cx, 0x6e
je 0x45ecaa
cmp cx, 0x75
je 0x45ecaa
cmp cx, 0x62
je 0x45ecaa
cmp ax, 0x5e
je 0x45ecaa
cmp ax, 0x2b
je 0x45ecaa
cmp ax, 0x23
je 0x45ecaa
cmp ax, 0x40
je 0x45ecaa
cmp ax, 0x24
je 0x45ecaa
cmp ax, 0x2a
je 0x45ecaa
cmp ax, 0x7e
je 0x45ecaa
cmp ax, 0x2e
je 0x45ecaa
cmp ax, 0x3f
jne 0x45ecc3
mov al, byte [esi]
inc esi
inc esi
test al, al
mov byte [ebp + 0x6f], al
mov dword [ebp + 0x78], esi
je 0x45ecc3
movzx eax, word [esi]
movsx ecx, byte [ebp + 0x6f]
cmp ecx, eax
je 0x45ecc9
cmp word [esi], 0x24
jne 0x45ecd3
mov al, byte [esi]
inc esi
inc esi
mov byte [ebp + 0x5f], al
mov dword [ebp + 0x78], esi
cmp byte [ebp + 0x6f], 0x41
jl 0x45ece3
cmp byte [ebp + 0x6f], 0x5a
jg 0x45ece3
or byte [ebp + 0x6f], 0x20
lea eax, [ebp + 0x78]
push eax
call fcn.0043dae7
mov edi, dword [ebp + 0x78]
mov dword [esp], 0x4c5fcc
push edi
mov dword [ebp + 0x1c], edi
call dword [sym.imp.SHLWAPI.dll_StrStrW]
mov esi, eax
cmp esi, ebx
je 0x45ed09
lea edi, [esi + 4]
mov edx, edi
mov dword [ebp + 0x44], edx
cmp word [edi], bx
je 0x45ed9c
mov ax, word [edx]
cmp ax, 0x2c
je 0x45ed53
cmp ax, 0x3d
je 0x45ed9c
cmp ax, 0x21
jne 0x45ed47
lea eax, [edx + 2]
mov dword [ebp + 0x30], eax
lea eax, [ebp + 0x30]
push eax
call fcn.0043dae7
mov eax, dword [ebp + 0x30]
cmp word [eax], bx
pop ecx
je 0x45ed9c
lea edx, [eax - 2]
inc edx
inc edx
mov dword [ebp + 0x44], edx
cmp word [edx], bx
jne 0x45ed17
jmp 0x45ed9c
add edx, 2
push 0x3d
push edx
call dword [sym.imp.SHLWAPI.dll_StrChrW]
cmp eax, ebx
je 0x45ed67
mov edx, eax
jmp 0x45ed94
mov eax, dword [ebp + 0x44]
add eax, 2
push 0x21
push eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov edx, eax
cmp edx, ebx
je 0x45ed99
lea eax, [edx + 2]
mov dword [ebp + 0x30], eax
lea eax, [ebp + 0x30]
push eax
call fcn.0043dae7
mov eax, dword [ebp + 0x30]
cmp word [eax], bx
pop ecx
jne 0x45ed99
mov dword [ebp + 0x44], edx
jmp 0x45ed9c
mov edx, dword [ebp + 0x44]
mov ax, word [edx]
cmp ax, 0x2c
je 0x45edb1
cmp ax, 0x3d
je 0x45edb1
cmp ax, 0x21
jne 0x45edc5
mov al, byte [edx]
mov word [edx], bx
add dword [ebp + 0x44], 2
test al, al
mov byte [ebp + 0x3a], al
jne 0x45ee4b
inc byte [ebp + 0x3b]
cmp byte [ebp + 0x3b], 0
jg 0x45ee41
mov ecx, dword [ebp + 0x18]
push 1
push ebx
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x24]
call fcn.00454bdd
mov eax, dword [ebp - 8]
lea ecx, [ebp]
mov dword [ebp + 0x78], eax
call fcn.0043db4f
lea ecx, [ebp + 4]
call fcn.0043db4f
lea ecx, [ebp + 0x10]
call fcn.0043db4f
lea ecx, [ebp - 0x10]
call fcn.0043db4f
lea ecx, [ebp + 8]
call fcn.0043db4f
lea eax, [ebp + 0x78]
push eax
call fcn.0043dae7
push 0xa
lea eax, [ebp + 0x78]
push eax
push str.___initram
call fcn.00445f31
add esp, 0x10
test al, al
je 0x45e980
push 3
call fcn.004126ce
pop ecx
xor esi, esi
jmp 0x45fe71
mov esi, 0x80070057
jmp 0x45fe49
cmp esi, ebx
mov dword [ebp - 4], ebx
jne 0x45ee64
push 0x5c
push ebx
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_StrRChrW]
call edi
mov esi, eax
cmp esi, ebx
je 0x45eebc
mov ecx, dword [ebp + 0x18]
push 1
push ebx
lea eax, [ebp + 8]
push eax
push dword [ebp + 0x78]
mov word [esi], bx
call fcn.00454bdd
mov eax, dword [ebp + 8]
push 0x5c
push eax
mov dword [ebp + 0x1c], eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
cmp eax, ebx
jne 0x45ee96
mov esi, 0x80070057
jmp 0x45fe41
mov ecx, dword [ebp + 0x18]
mov word [eax], bx
inc eax
inc eax
push 1
mov dword [ebp + 0x60], eax
push ebx
lea eax, [ebp - 4]
push eax
add esi, 2
push esi
call fcn.00454bdd
mov eax, dword [ebp - 4]
mov dword [ebp + 0x40], eax
jmp 0x45ef3f
push 1
push 0x2c
lea eax, [ebp + 0x1c]
push eax
lea ecx, [ebp - 0x20]
call fcn.00456f8f
push ebx
lea ecx, [ebp + 8]
push ecx
push eax
call fcn.00446d58
mov eax, dword [ebp + 8]
add esp, 0xc
push 0x5c
push eax
mov dword [ebp + 0x1c], eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov esi, eax
cmp esi, ebx
je 0x45ee8c
mov word [esi], bx
inc esi
inc esi
push 0x4c5fcc
push esi
mov dword [ebp + 0x60], esi
call dword [sym.imp.SHLWAPI.dll_StrStrW]
cmp byte [ebp + 0x67], 0
mov dword [ebp + 0x40], eax
je 0x45ef1d
cmp eax, ebx
jne 0x45ef32
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esi + eax*2]
mov dword [ebp + 0x40], eax
cmp eax, ebx
jne 0x45ef32
push 0x5c
push ebx
push esi
call edi
cmp eax, ebx
mov dword [ebp + 0x40], eax
je 0x45ee8c
cmp word [eax], bx
je 0x45ef3f
mov word [eax], bx
inc eax
inc eax
mov dword [ebp + 0x40], eax
cmp word [eax], 0x5c
jne 0x45ef4a
inc eax
inc eax
mov dword [ebp + 0x40], eax
cmp byte [ebp + 0x2b], 0
mov dword [ebp + 0x30], ebx
je 0x45ef6e
lea eax, [ebp + 0x30]
push eax
lea eax, [ebp + 0x44]
push eax
push dword [ebp + 0x18]
call fcn.00453446
mov eax, dword [ebp + 0x30]
add esp, 0xc
mov dword [ebp + 0x44], eax
jmp 0x45ef71
mov eax, dword [ebp + 0x44]
cmp byte [ebp + 0x3a], 0x2c
jne 0x45f002
push 1
push 0x2c
lea eax, [ebp + 0x44]
push eax
lea ecx, [ebp - 0x20]
call fcn.00456f8f
push ebx
lea ecx, [ebp + 0x10]
push ecx
push eax
call fcn.00446d58
mov ecx, dword [ebp + 0x18]
add esp, 0xc
push ebx
lea eax, [ebp + 0x10]
push eax
call fcn.00402eb0
cmp byte [ebp + 0x6f], 0x2e
jne 0x45efe4
mov eax, dword [ebp + 0x44]
cmp word [eax], 0x2c
jne 0x45efe4
add dword [ebp + 0x44], 2
push 1
push 0x2c
lea eax, [ebp + 0x44]
push eax
lea ecx, [ebp - 0x20]
call fcn.00456f8f
push ebx
lea ecx, [ebp]
push ecx
push eax
call fcn.00446d58
mov ecx, dword [ebp + 0x18]
add esp, 0xc
push ebx
lea eax, [ebp]
push eax
call fcn.00402eb0
mov eax, dword [ebp + 0x10]
cmp word [eax], bx
jne 0x45f0fb
push str.RegDat
lea ecx, [ebp + 0x10]
call fcn.0044cddc
jmp 0x45f0fb
cmp byte [ebp + 0x3a], 0x21
je 0x45f0fb
cmp word [eax], bx
jne 0x45f035
cmp byte [ebp + 0x6f], 0x24
je 0x45f054
cmp byte [ebp + 0x6f], 0x2a
je 0x45f035
cmp byte [ebp + 0x6f], 0x7e
je 0x45f035
cmp byte [ebp + 0x53], 0
je 0x45f0fb
mov dword [ebp + 0x68], eax
jmp 0x45f0fb
cmp byte [ebp + 0x6f], 0x24
je 0x45f054
cmp byte [ebp + 0x6f], 0x2a
je 0x45f054
cmp byte [ebp + 0x6f], 0x7e
je 0x45f054
lea eax, [ebp + 0x44]
push eax
call fcn.0043dae7
mov eax, dword [ebp + 0x44]
pop ecx
push eax
lea ecx, [ebp + 0x14]
call fcn.0044cd74
mov edx, dword [ebp + 0x14]
lea eax, [ebp + 0x78]
push eax
mov dword [ebp + 0x78], edx
call fcn.0043dae7
cmp byte [ebp + 0x7c], 0
pop ecx
je 0x45f07e
push edx
lea ecx, [ebp + 4]
call fcn.0044cddc
jmp 0x45f08e
mov ecx, dword [ebp + 0x18]
push 1
push ebx
lea eax, [ebp + 4]
push eax
push edx
call fcn.004537c3
mov eax, dword [ebp + 4]
mov dword [ebp + 0x68], eax
mov dword [ebp + 0x7c], eax
lea eax, [ebp + 0x7c]
push eax
call fcn.0043dae7
cmp byte [ebp + 0x6f], 0
pop ecx
jne 0x45f0d9
push dword [ebp + 0x78]
push 0x4c5fb4
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x45f0c2
mov dword [ebp + 0x68], 0x4bca0c
jmp 0x45f0f3
mov ecx, dword [ebp + 0x7c]
mov ax, word [ecx]
cmp ax, 0x23
je 0x45f0d4
cmp ax, 0x40
jne 0x45f0f3
mov dword [ebp + 0x68], ecx
jmp 0x45f0f3
cmp byte [ebp + 0x6f], 0x23
je 0x45f0e5
cmp byte [ebp + 0x6f], 0x40
jne 0x45f0f3
mov eax, dword [ebp + 0x7c]
cmp word [eax], bx
mov dword [ebp + 0x68], eax
jne 0x45f0f3
mov dword [ebp + 0x68], ebx
lea ecx, [ebp + 0x14]
call fcn.0043db4f
mov edi, dword [ebp + 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str.HKLM
push edi
call esi
test eax, eax
je 0x45f1b2
push str.HKEY_LOCAL_MACHINE
push edi
call esi
test eax, eax
je 0x45f1b2
push str.HKCU
push edi
call esi
test eax, eax
je 0x45f1a9
push str.HKEY_CURRENT_USER
push edi
call esi
test eax, eax
je 0x45f1a9
push str.HKCR
push edi
call esi
test eax, eax
je 0x45f1a0
push str.HKEY_CLASSES_ROOT
push edi
call esi
test eax, eax
je 0x45f1a0
push 0x4c5f18
push edi
call esi
test eax, eax
je 0x45f197
push str.HKEY_USERS
push edi
call esi
test eax, eax
je 0x45f197
push str.HKCC
push edi
call esi
test eax, eax
je 0x45f18e
push str.HKEY_CURRENT_CONFIG
push edi
call esi
test eax, eax
je 0x45f18e
mov esi, 0x80070057
jmp 0x45fe39
mov dword [ebp + 0x78], 0x80000005
jmp 0x45f1b9
mov dword [ebp + 0x78], 0x80000003
jmp 0x45f1b9
mov dword [ebp + 0x78], 0x80000000
jmp 0x45f1b9
mov dword [ebp + 0x78], 0x80000001
jmp 0x45f1b9
mov dword [ebp + 0x78], 0x80000002
mov eax, dword [ebp + 0x10]
cmp word [eax], bx
je 0x45f8d9
cmp byte [ebp + 0x6f], 0x2e
je 0x45f1d4
cmp byte [ebp + 0x6f], 0x3f
mov dword [ebp + 0x3c], ebx
jne 0x45f1e1
cmp byte [ebp + 0x6f], 0x3f
mov dword [ebp + 0x3c], 1
je 0x45f1f0
cmp dword [ebp + 0x3c], ebx
je 0x45f1eb
cmp word [eax], bx
je 0x45f1f0
mov dword [ebp + 0x4c], ebx
jmp 0x45f1f7
mov dword [ebp + 0x4c], 1
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x64
lea ecx, [ebp + 0x68]
mov dword [ebp + 0xc], ebx
call fcn.00443f79
lea ecx, [ebp + 0x2c]
call fcn.00443f5b
cmp byte [ebp + 0x6f], 0x2e
lea eax, [ebp + 0x2c]
je 0x45f21f
lea eax, [ebp + 0x68]
push 0x1000
lea ecx, [ebp + 0x48]
mov dword [ebp + 0x34], eax
call fcn.00443e04
cmp byte [ebp + 0x67], 0
lea eax, [ebp + 0x7c]
mov dword [ebp + 0x1c], 0xfff
mov dword [ebp + 0x7c], ebx
mov dword [ebp + 0x24], ebx
push eax
je 0x45f3c8
movzx eax, word [0x4d7c1c]
or eax, 9
push eax
push ebx
push dword [ebp + 0x60]
mov dword [ebp + 0x40], ebx
push dword [ebp + 0x78]
mov dword [ebp + 0x3c], ebx
mov dword [ebp + 0x4c], ebx
mov dword [ebp + 0x14], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp + 0x7c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push ebx
push ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp + 0x3c]
push eax
push ebx
push ebx
push ebx
push dword [ebp + 0x7c]
call esi
push ebx
push ebx
push ebx
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 0x14]
push eax
push ebx
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp + 0x3c]
push eax
push ebx
push ebx
push ebx
push dword [ebp + 0x7c]
call esi
mov dword [ebp + 0x78], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp + 0x4c], eax
jae 0x45f2ba
mov dword [ebp + 0x4c], eax
mov eax, dword [ebp + 0x4c]
lea eax, [eax*4 + 0x20]
mov dword [ebp - 0xc], eax
shr eax, 1
add eax, 8
push eax
lea ecx, [ebp + 0x58]
call fcn.00443f79
mov esi, dword [ebp + 0x58]
mov word [esi], 0xd
mov word [esi + 2], 0xa
lea ebx, [esi + 4]
mov word [ebx], 0x76
lea edi, [esi + 8]
mov word [esi + 6], 0x20
and word [edi], 0
cmp byte [ebp + 0x67], 3
mov dword [ebp + 0x60], ebx
je 0x45f303
mov edi, ebx
cmp dword [ebp + 0x78], 0
jne 0x45f3ac
test byte [ebp + 0x67], 1
je 0x45f35a
and dword [ebp + 0x78], 0
cmp dword [ebp + 0x14], 0
jle 0x45f35a
mov eax, dword [ebp - 0xc]
mov dword [ebp + 0x40], eax
xor eax, eax
push eax
push eax
push eax
push eax
mov word [edi], ax
lea eax, [ebp + 0x40]
push eax
push edi
push dword [ebp + 0x78]
push dword [ebp + 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x45f34f
push dword [ebp + 0x60]
lea ecx, [ebp + 0x68]
call fcn.00443fc7
mov dword [ebp + 0x60], esi
inc dword [ebp + 0x78]
mov eax, dword [ebp + 0x78]
cmp eax, dword [ebp + 0x14]
jl 0x45f31d
test byte [ebp + 0x67], 2
mov word [ebx], 0x6b
je 0x45f3ac
and dword [ebp + 0x78], 0
cmp dword [ebp + 0x3c], 0
jle 0x45f3ac
xor ebx, ebx
mov eax, dword [ebp - 0xc]
push ebx
push ebx
push ebx
push ebx
mov dword [ebp + 0x40], eax
lea eax, [ebp + 0x40]
push eax
push edi
push dword [ebp + 0x78]
mov word [edi], bx
push dword [ebp + 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x45f3a1
push dword [ebp + 0x60]
lea ecx, [ebp + 0x68]
call fcn.00443fc7
mov dword [ebp + 0x60], esi
inc dword [ebp + 0x78]
mov eax, dword [ebp + 0x78]
cmp eax, dword [ebp + 0x3c]
jl 0x45f371
cmp dword [ebp + 0x7c], 0
je 0x45f3bb
push dword [ebp + 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 0x58]
call fcn.0043db4f
jmp 0x45f886
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp + 0x48]
push eax
push dword [ebp + 0x40]
push dword [ebp + 0x60]
push dword [ebp + 0x78]
call fcn.0044856b
mov esi, dword [ebp + 0x7c]
add esp, 0x18
cmp esi, ebx
mov edi, eax
je 0x45f455
mov eax, dword [ebp + 0x40]
cmp word [eax], bx
jne 0x45f410
cmp esi, 2
jne 0x45f410
cmp edi, 0xfffffffe
jne 0x45f410
cmp dword [ebp + 0x3c], ebx
je 0x45f888
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x4c5ec8
jmp 0x45f421
cmp dword [ebp + 0x3c], ebx
mov dword [ebp + 0xc], esi
je 0x45f42e
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.ERROR
mov ecx, dword [ebp + 0x34]
call fcn.00444016
jmp 0x45f888
cmp byte [ebp + 0x29], 0
jne 0x45f888
lea ecx, [ebp + 0x48]
call fcn.0043db4f
lea ecx, [ebp + 0x2c]
call fcn.0043db4f
lea ecx, [ebp + 0x68]
call fcn.0043db4f
jmp 0x45fe39
cmp dword [ebp + 0x58], ebx
jl 0x45f476
jg 0x45f461
cmp dword [ebp + 0x54], ebx
jb 0x45f476
xor eax, eax
cmp dword [ebp + 0x54], edi
jne 0x45f46d
cmp dword [ebp + 0x58], eax
je 0x45f476
mov dword [ebp + 0x60], 1
jmp 0x45f479
mov dword [ebp + 0x60], ebx
cmp edi, 1
mov byte [ebp + 0x7b], 0
mov byte [ebp + 0x7f], 0xff
mov eax, str.REG_SZ
jne 0x45f493
mov bl, 0x24
mov byte [ebp + 0x7f], 0
jmp 0x45f4ad
cmp edi, 6
jne 0x45f4a1
mov eax, str.REG_LINK
mov bl, 0x5e
jmp 0x45f4ad
cmp edi, 0x15
jne 0x45f504
mov eax, str.REG_MUI_SZ
mov bl, 0x75
xor esi, esi
cmp dword [ebp + 0x3c], esi
je 0x45f4ca
mov ecx, dword [ebp + 0x34]
push 0xffffffffffffffff
push 0xffffffffffffffff
push eax
call fcn.00444016
cmp dword [ebp + 0x4c], esi
jne 0x45f886
cmp dword [ebp + 0x60], esi
jne 0x45f821
cmp dword [ebp + 0x58], esi
jg 0x45f4f3
jl 0x45f4df
cmp dword [ebp + 0x54], esi
jae 0x45f4f3
mov al, byte [ebp + 0x6f]
cmp bl, al
je 0x45f4f3
cmp al, 0x2e
je 0x45f4f3
cmp byte [ebp + 0x7f], al
jne 0x45f821
mov eax, dword [ebp + 0x68]
mov ecx, dword [ebp + 0x48]
mov dword [ebp + 0x68], ecx
mov dword [ebp + 0x48], eax
jmp 0x45f886
cmp edi, 0xb
jne 0x45f56a
cmp dword [ebp + 0x3c], ebx
je 0x45f528
mov ecx, dword [ebp + 0x34]
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_QWORD
call fcn.00444016
cmp dword [ebp + 0x4c], ebx
jne 0x45f886
cmp dword [ebp + 0x60], ebx
jne 0x45f821
cmp dword [ebp + 0x58], ebx
jg 0x45f54d
jl 0x45f53d
cmp dword [ebp + 0x54], ebx
jae 0x45f54d
cmp byte [ebp + 0x6f], 0x2b
je 0x45f54d
cmp byte [ebp + 0x6f], 0x2e
jne 0x45f821
mov eax, dword [ebp + 0x48]
push str.0x_I64x
push dword [eax + 4]
push dword [eax]
push dword [ebp + 0x68]
call fcn.00497e6e
add esp, 0x10
jmp 0x45f886
cmp edi, 4
mov esi, dword [ebp + 0x48]
jne 0x45f5b7
cmp dword [ebp + 0x3c], ebx
je 0x45f591
mov ecx, dword [ebp + 0x34]
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_DWORD
call fcn.00444016
cmp dword [ebp + 0x4c], ebx
jne 0x45f886
cmp dword [ebp + 0x60], ebx
jne 0x45f821
cmp dword [ebp + 0x58], ebx
jg 0x45f616
jl 0x45f5a6
cmp dword [ebp + 0x54], ebx
jae 0x45f616
cmp byte [ebp + 0x6f], 0x23
je 0x45f616
cmp byte [ebp + 0x6f], 0x2e
je 0x45f616
jmp 0x45f821
cmp edi, 5
jne 0x45f62e
cmp dword [ebp + 0x3c], ebx
je 0x45f5db
mov ecx, dword [ebp + 0x34]
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_DWORD_BIG_ENDIAN
call fcn.00444016
cmp dword [ebp + 0x4c], ebx
jne 0x45f886
cmp dword [ebp + 0x60], ebx
jne 0x45f821
cmp dword [ebp + 0x58], ebx
jg 0x45f600
jl 0x45f5f0
cmp dword [ebp + 0x54], ebx
jae 0x45f600
cmp byte [ebp + 0x6f], 0x62
je 0x45f600
cmp byte [ebp + 0x6f], 0x2e
jne 0x45f821
mov cl, byte [esi + 3]
mov al, byte [esi]
mov byte [esi], cl
mov byte [esi + 3], al
mov cl, byte [esi + 2]
mov al, byte [esi + 1]
mov byte [esi + 1], cl
mov byte [esi + 2], al
push dword [esi]
push str.0x_x
push dword [ebp + 0x68]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x45f886
cmp edi, 2
jne 0x45f69c
cmp dword [ebp + 0x3c], ebx
je 0x45f652
mov ecx, dword [ebp + 0x34]
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_EXPAND_SZ
call fcn.00444016
cmp dword [ebp + 0x4c], ebx
jne 0x45f886
cmp dword [ebp + 0x60], ebx
jne 0x45f821
cmp dword [ebp + 0x58], ebx
jg 0x45f677
jl 0x45f667
cmp dword [ebp + 0x54], ebx
jae 0x45f677
cmp byte [ebp + 0x6f], 0x7e
je 0x45f677
cmp byte [ebp + 0x6f], 0x2e
jne 0x45f821
cmp byte [ebp + 0x5f], 0
je 0x45f4f3
mov eax, dword [ebp + 0x48]
push 1
push ebx
lea ecx, [ebp + 0x68]
push ecx
mov ecx, dword [ebp + 0x18]
push eax
mov dword [ebp + 0x44], eax
call fcn.00454bdd
jmp 0x45f886
cmp edi, 7
jne 0x45f77f
cmp dword [ebp + 0x3c], ebx
je 0x45f6c4
mov ecx, dword [ebp + 0x34]
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_MULTI_SZ
call fcn.00444016
cmp dword [ebp + 0x4c], ebx
jne 0x45f886
cmp dword [ebp + 0x60], ebx
jne 0x45f821
cmp dword [ebp + 0x58], ebx
jg 0x45f6e9
jl 0x45f6d9
cmp dword [ebp + 0x54], ebx
jae 0x45f6e9
cmp byte [ebp + 0x6f], 0x2a
je 0x45f6e9
cmp byte [ebp + 0x6f], 0x2e
jne 0x45f821
mov esi, dword [ebp + 0x1c]
shr esi, 1
lea eax, [esi*4 + 6]
push eax
lea ecx, [ebp + 0x68]
call fcn.00443fa0
mov ecx, dword [ebp + 0x48]
mov eax, dword [ebp + 0x68]
lea esi, [ecx + esi*2]
jmp 0x45f773
cmp byte [ebp + 0x5f], 0x2a
jne 0x45f73a
cmp word [ecx], 0x5c
jne 0x45f73a
lea edx, [ecx + 2]
mov di, word [edx]
cmp di, 0x30
je 0x45f72c
cmp di, 0x5c
je 0x45f72c
cmp di, bx
jne 0x45f73a
mov word [eax], 0x5c
mov ecx, edx
mov dx, word [ecx]
inc eax
inc eax
jmp 0x45f742
mov dx, word [ecx]
cmp dx, bx
je 0x45f74b
mov word [eax], dx
inc eax
inc eax
inc ecx
inc ecx
jmp 0x45f773
inc ecx
inc ecx
cmp byte [ebp + 0x5f], 0x24
jne 0x45f765
cmp ecx, esi
jae 0x45f777
mov word [eax], 0xd
inc eax
inc eax
mov word [eax], 0xa
jmp 0x45f771
mov word [eax], 0x5c
inc eax
inc eax
mov word [eax], 0x30
inc eax
inc eax
cmp ecx, esi
jb 0x45f709
mov word [eax], bx
jmp 0x45f886
cmp edi, 3
jne 0x45f78b
mov eax, str.REG_BINARY
jmp 0x45f7b8
cmp edi, ebx
jne 0x45f796
mov eax, str.REG_NONE
jmp 0x45f7b8
cmp edi, 8
jne 0x45f7a2
mov eax, str.REG_RESOURCE_LIST
jmp 0x45f7b8
cmp edi, 9
jne 0x45f7ae
mov eax, str.REG_FULL_RESOURCE_DESCRIPTOR
jmp 0x45f7b8
cmp edi, 0xa
jne 0x45f7d9
mov eax, str.REG_RESOURCE_REQUIREMENTS_LIST
cmp dword [ebp + 0x3c], ebx
je 0x45f7d3
mov ecx, dword [ebp + 0x34]
push 0xffffffffffffffff
push 0xffffffffffffffff
push eax
call fcn.00444016
cmp dword [ebp + 0x4c], ebx
jne 0x45f886
mov byte [ebp + 0x7b], 0x40
jmp 0x45f804
cmp dword [ebp + 0x3c], ebx
je 0x45f804
mov esi, dword [ebp + 0x34]
push 0x32
mov ecx, esi
call fcn.00443fa0
push edi
push str.0x_lx
push dword [esi]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
cmp dword [ebp + 0x4c], ebx
jne 0x45f886
cmp dword [ebp + 0x58], ebx
jg 0x45f81c
jl 0x45f810
cmp dword [ebp + 0x54], ebx
jae 0x45f81c
mov al, byte [ebp + 0x6f]
cmp byte [ebp + 0x7b], al
je 0x45f81c
cmp al, 0x2e
jne 0x45f821
cmp dword [ebp + 0x60], ebx
je 0x45f83e
lea ecx, [ebp + 0x48]
call fcn.0043db4f
lea ecx, [ebp + 0x2c]
call fcn.0043db4f
lea ecx, [ebp + 0x68]
call fcn.0043db4f
jmp 0x45f184
mov eax, dword [ebp + 0x1c]
lea eax, [eax + eax*4 + 7]
push eax
lea ecx, [ebp + 0x68]
call fcn.00443fa0
mov edi, dword [ebp + 0x68]
mov esi, dword [ebp + 0x48]
xor ebx, ebx
mov word [edi], bx
mov word [edi + 2], bx
cmp dword [ebp + 0x1c], ebx
mov dword [ebp + 0x24], 1
jle 0x45f886
movzx eax, byte [esi]
push eax
push str._0x_02X
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
inc esi
inc ebx
add edi, 0xa
cmp ebx, dword [ebp + 0x1c]
jl 0x45f869
xor ebx, ebx
mov eax, dword [ebp + 0x10]
cmp word [eax], bx
je 0x45f8a3
mov edx, dword [ebp + 0x68]
mov ecx, dword [ebp + 0x24]
lea ecx, [edx + ecx*2]
push ecx
mov ecx, dword [ebp + 0x18]
push eax
call fcn.00443666
mov eax, dword [ebp]
cmp word [eax], bx
je 0x45f8b9
mov ecx, dword [ebp + 0x34]
push dword [ecx]
mov ecx, dword [ebp + 0x18]
push eax
call fcn.00443666
lea ecx, [ebp + 0x48]
call fcn.0043db4f
lea ecx, [ebp + 0x2c]
call fcn.0043db4f
lea ecx, [ebp + 0x68]
call fcn.0043db4f
mov esi, dword [ebp + 0xc]
jmp 0x45fe39
cmp dword [ebp + 0x68], ebx
je 0x45fdb1
xor edx, edx
cmp byte [ebp + 0x66], dl
push 8
mov dword [ebp + 0x7c], edx
pop edi
mov dword [ebp + 0x20], edx
mov dword [ebp + 0x24], edx
lea ebx, [ebp + 0x20]
jg 0x45f8fd
cmp byte [ebp + 0x53], dl
je 0x45f928
movsx eax, byte [ebp + 0x66]
push eax
push dword [ebp + 0x60]
push dword [ebp + 0x78]
call fcn.0044119c
add esp, 0xc
cmp byte [ebp + 0x66], 2
mov esi, eax
jge 0x45fda4
cmp byte [ebp + 0x53], 0
jne 0x45fda4
xor edx, edx
mov cl, byte [ebp + 0x6f]
cmp cl, 0x2b
je 0x45fcf7
test cl, cl
jne 0x45f94e
mov esi, dword [ebp + 0x68]
mov ax, word [esi]
cmp ax, 0x2b
jne 0x45f98c
inc esi
inc esi
mov dword [ebp + 0x68], esi
jmp 0x45fcfa
cmp cl, 0x23
je 0x45fc7d
cmp cl, 0x62
jne 0x45fa3a
cmp byte [ebp + 0x64], 0
mov dword [ebp + 0x54], 5
mov dword [ebp + 0x58], edx
je 0x45f9a0
movsx eax, byte [ebp + 0x65]
push eax
lea eax, [ebp + 0x7c]
push eax
push dword [ebp + 0x68]
call fcn.0044865a
mov ebx, dword [ebp + 0x7c]
add esp, 0xc
jmp 0x45fa10
cmp ax, 0x23
jne 0x45fa65
inc esi
inc esi
mov dword [ebp + 0x68], esi
jmp 0x45fc80
cmp byte [ebp + 0x65], 0
je 0x45f9e0
mov edx, dword [ebp + 0x68]
xor ecx, ecx
mov cx, word [edx]
mov eax, ecx
call fcn.00443a3f
test al, al
je 0x45fac8
cmp cx, 0x30
jne 0x45f9d4
mov ax, word [edx + 2]
or ax, 0x20
cmp ax, 0x78
jne 0x45f9d4
add edx, 4
push edx
call fcn.00444b5c
pop ecx
mov dword [ebp + 0x20], eax
jmp 0x45f9f8
lea eax, [ebp + 0x20]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.004503bc
cmp eax, 1
pop ecx
pop ecx
jl 0x45fd65
mov al, byte [ebp + 0x20]
mov cl, byte [ebp + 0x23]
mov byte [ebp + 0x20], cl
mov cl, byte [ebp + 0x22]
mov byte [ebp + 0x23], al
mov al, byte [ebp + 0x21]
mov byte [ebp + 0x21], cl
mov byte [ebp + 0x22], al
push 4
pop edi
push edi
push ebx
push dword [ebp + 0x54]
xor esi, esi
cmp byte [ebp + 0x2a], 0
push dword [ebp + 0x40]
push dword [ebp + 0x60]
push dword [ebp + 0x78]
je 0x45fd75
call dword [0x4d8254]
mov esi, eax
jmp 0x45fd7d
cmp cl, 0x2a
je 0x45fb73
cmp cl, 0x7e
je 0x45fb0a
cmp cl, 0x40
je 0x45fafb
cmp cl, 0x6e
mov esi, dword [ebp + 0x68]
jne 0x45fa8f
mov dword [ebp + 0x54], edx
jmp 0x45fb05
cmp ax, 0x2a
jne 0x45fa75
inc esi
inc esi
mov dword [ebp + 0x68], esi
jmp 0x45fb76
cmp ax, 0x7e
jne 0x45fa85
push 2
pop edi
add esi, edi
jmp 0x45fb10
cmp ax, 0x40
jne 0x45fa8f
inc esi
inc esi
jmp 0x45fafe
cmp dword [ebp + 0x58], edx
jg 0x45fb86
jl 0x45faa3
cmp dword [ebp + 0x54], edx
jae 0x45fb86
cmp cl, 0x5e
jne 0x45fab1
mov dword [ebp + 0x54], 6
jmp 0x45fadc
cmp cl, 0x75
jne 0x45fabf
mov dword [ebp + 0x54], 0x15
jmp 0x45fadc
test cl, cl
je 0x45fad5
cmp cl, 0x24
je 0x45fad5
lea ecx, [ebp + 0x7c]
call fcn.0043db4f
jmp 0x45f184
mov dword [ebp + 0x54], 1
cmp byte [ebp + 0x64], 0
mov dword [ebp + 0x58], edx
jne 0x45fb86
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
shl edi, 1
mov ebx, esi
jmp 0x45fa13
mov esi, dword [ebp + 0x68]
mov dword [ebp + 0x54], 3
mov dword [ebp + 0x58], edx
jmp 0x45fb86
mov esi, dword [ebp + 0x68]
push 2
pop edi
cmp byte [ebp + 0x64], 0
mov dword [ebp + 0x54], edi
mov dword [ebp + 0x58], edx
jne 0x45fb86
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 2
push eax
lea ecx, [ebp + 0x7c]
call fcn.00443fa0
cmp word [esi], 0
mov ebx, dword [ebp + 0x7c]
mov ecx, esi
mov eax, ebx
je 0x45fb64
mov dx, word [ecx]
cmp dx, 0x5c
jne 0x45fb57
cmp word [ecx + 2], 0x30
jne 0x45fb57
and word [eax], 0
add eax, edi
add ecx, 4
jmp 0x45fb5e
mov word [eax], dx
add eax, edi
add ecx, edi
cmp word [ecx], 0
jne 0x45fb3c
and word [eax], 0
sub eax, ebx
add eax, edi
mov edi, eax
jmp 0x45fa13
mov esi, dword [ebp + 0x68]
cmp byte [ebp + 0x64], 0
mov dword [ebp + 0x54], 7
mov dword [ebp + 0x58], edx
je 0x45fb9c
movsx eax, byte [ebp + 0x65]
push eax
lea eax, [ebp + 0x7c]
push eax
push esi
call fcn.0044865a
mov edi, eax
jmp 0x45fc9e
mov esi, dword [ebp + 0x68]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
lea eax, [ebx + 0x10]
push eax
lea ecx, [ebp + 0x7c]
xor edi, edi
call fcn.00443fa0
mov edx, dword [ebp + 0x7c]
lea ecx, [esi + ebx*2]
cmp esi, ecx
mov eax, esi
mov dword [ebp + 0xc], ecx
jae 0x45fbfa
and word [edx], 0
cmp byte [ebp + 0x5f], 0x2a
jne 0x45fc31
cmp word [eax], 0x5c
jne 0x45fc5e
lea ecx, [eax + 2]
cmp word [ecx], 0x5c
jne 0x45fc5e
mov eax, ecx
mov cx, word [eax]
mov word [edx], cx
inc edx
inc edx
inc eax
inc eax
xor edi, edi
cmp eax, dword [ebp + 0xc]
jb 0x45fbc5
cmp edi, 1
jge 0x45fc01
and word [edx], 0
inc edi
inc edx
inc edx
test ebx, ebx
jle 0x45fc21
cmp edi, 2
jge 0x45fc21
push 2
pop esi
sub esi, edi
xor eax, eax
mov ecx, esi
shr ecx, 1
mov edi, edx
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
lea edx, [edx + esi*2]
mov ebx, dword [ebp + 0x7c]
and word [edx], 0
sub edx, ebx
mov edi, edx
jmp 0x45fa13
cmp byte [ebp + 0x5f], 0x24
jne 0x45fc5e
mov cx, word [eax]
cmp cx, 0xd
jne 0x45fc4d
lea esi, [eax + 2]
cmp word [esi], 0xa
jne 0x45fc4d
mov eax, esi
jmp 0x45fc53
cmp cx, 0xa
jne 0x45fbe7
and word [edx], 0
inc eax
inc eax
inc edx
inc edx
inc edi
jmp 0x45fbf0
mov cx, word [eax]
cmp cx, 0x5c
jne 0x45fbe7
cmp word [eax + 2], 0x30
jne 0x45fbe7
and word [edx], 0
inc edx
inc edx
add eax, 4
jmp 0x45fc5b
mov esi, dword [ebp + 0x68]
cmp byte [ebp + 0x64], 0
push 4
pop edi
mov dword [ebp + 0x54], edi
mov dword [ebp + 0x58], edx
je 0x45fca9
movsx eax, byte [ebp + 0x65]
push eax
lea eax, [ebp + 0x7c]
push eax
push esi
call fcn.0044865a
mov ebx, dword [ebp + 0x7c]
add esp, 0xc
jmp 0x45fa13
cmp byte [ebp + 0x65], 0
je 0x45fce8
xor ecx, ecx
mov cx, word [esi]
mov eax, ecx
call fcn.00443a3f
test al, al
je 0x45fac8
cmp cx, 0x30
jne 0x45fcd9
mov ax, word [esi + 2]
or ax, 0x20
cmp ax, 0x78
jne 0x45fcd9
add esi, edi
push esi
call fcn.00444b5c
pop ecx
mov dword [ebp + 0x20], eax
jmp 0x45fa13
lea eax, [ebp + 0x20]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.004503bc
jmp 0x45fd5a
mov esi, dword [ebp + 0x68]
cmp byte [ebp + 0x64], 0
mov dword [ebp + 0x54], 0xb
mov dword [ebp + 0x58], edx
jne 0x45fc8f
cmp byte [ebp + 0x65], 0
je 0x45fd4d
xor ecx, ecx
mov cx, word [esi]
mov eax, ecx
call fcn.00443a3f
test al, al
je 0x45fac8
cmp cx, 0x30
jne 0x45fd3b
mov ax, word [esi + 2]
or ax, 0x20
cmp ax, 0x78
jne 0x45fd3b
add esi, 4
push esi
call fcn.00444b5c
pop ecx
mov dword [ebp + 0x20], eax
mov dword [ebp + 0x24], edx
jmp 0x45fa13
lea eax, [ebp + 0x20]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.00450152
cmp eax, 1
pop ecx
pop ecx
jge 0x45fa13
lea ecx, [ebp + 0x7c]
call fcn.0043db4f
xor esi, esi
inc esi
jmp 0x45fe39
call fcn.0043ed6b
add esp, 0x18
cmp esi, 0x3fd
jne 0x45fda4
cmp byte [ebp + 0x66], 0
jne 0x45fda4
push 1
push dword [ebp + 0x60]
mov byte [ebp + 0x66], 1
push dword [ebp + 0x78]
call fcn.0044119c
add esp, 0xc
jmp 0x45fa13
lea ecx, [ebp + 0x7c]
call fcn.0043db4f
jmp 0x45fe39
cmp byte [ebp + 0x3a], 0x21
jne 0x45fde3
mov eax, dword [ebp + 0x40]
cmp word [eax], bx
jne 0x45fde3
cmp dword [ebp + 0x4c], ebx
je 0x45fdd4
push dword [ebp + 0x4c]
push dword [ebp + 0x60]
push dword [ebp + 0x78]
call fcn.0044e2a7
jmp 0x45fe2d
push dword [ebp + 0x60]
push dword [ebp + 0x78]
call fcn.0044e0a6
pop ecx
pop ecx
jmp 0x45fe30
cmp dword [ebp + 0x4c], ebx
je 0x45fe1f
push ebx
lea eax, [ebp + 0x7c]
push eax
movzx eax, word [0x4d7c1c]
push ebx
or eax, 0x2001b
push eax
push ebx
push ebx
push ebx
push dword [ebp + 0x60]
mov dword [ebp + 0x7c], ebx
push dword [ebp + 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp dword [ebp + 0x7c], ebx
mov esi, eax
je 0x45fe32
push dword [ebp + 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x45fe32
push dword [ebp + 0x40]
push dword [ebp + 0x60]
push dword [ebp + 0x78]
call fcn.0043edb7
add esp, 0xc
mov esi, eax
cmp esi, 2
jne 0x45fe39
xor esi, esi
lea ecx, [ebp + 0x30]
call fcn.0043db4f
lea ecx, [ebp - 4]
call fcn.0043db4f
lea ecx, [ebp]
call fcn.0043db4f
lea ecx, [ebp + 4]
call fcn.0043db4f
lea ecx, [ebp + 0x10]
call fcn.0043db4f
lea ecx, [ebp - 0x10]
call fcn.0043db4f
lea ecx, [ebp + 8]
call fcn.0043db4f
lea ecx, [ebp - 8]
call fcn.0043db4f
lea ecx, [ebp - 0x20]
call fcn.0043db4f
pop edi
mov eax, esi
pop esi
pop ebx
add ebp, 0x70
leave
ret 8