Function at 0x420910
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54e4fa
mov eax, dword fs:[0]
push eax
sub esp, 0x19c
mov eax, dword [0x5a33dc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0xc8], edi
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc0], edx
mov dword [ebp - 0xc4], eax
mov eax, dword [ecx]
mov dword [ebp - 0xcc], ecx
mov ecx, dword [ecx + 4]
mov dword [ebp - 0xb8], edx
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0x14], ecx
cmp eax, ecx
je 0x420ccb
nop dword [eax + eax]
mov eax, dword [eax + 0xc]
sub eax, 0x10
push eax
call fcn.0042a160
add esp, 4
lea esi, [eax + 0x10]
mov dword [ebp - 0x18], esi
mov dword [ebp - 4], 0
mov edi, dword [esi - 0xc]
test edi, edi
js 0x421dc7
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x4209c4
push edi
lea ecx, [ebp - 0x18]
call fcn.0042a1d0
mov esi, dword [ebp - 0x18]
lea eax, [edi + 1]
push eax
push esi
call fcn.0051d6a8
lea eax, [esi - 0x10]
add esp, 8
mov dword [ebp - 0xc0], eax
cmp edi, dword [eax + 8]
jg 0x421dc7
mov dword [eax + 4], edi
lea ecx, [ebp - 0x30]
xor eax, eax
mov word [esi + edi*2], ax
push 0xa
push str.uninstall_
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 7
mov word [ebp - 0x30], ax
call fcn.00429380
mov byte [ebp - 4], 1
lea eax, [ebp - 0x30]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x30]
cmp edx, 8
jb 0x420a21
mov eax, ecx
test eax, eax
je 0x420a6a
cmp dword [esi - 0xc], 0
lea edi, [esi - 0x10]
jl 0x420a70
push eax
push esi
call fcn.005148ba
mov edi, eax
add esp, 8
test edi, edi
je 0x420a64
sub edi, esi
sar edi, 1
cmp edi, 0xffffffff
je 0x420a64
mov eax, dword [ebp - 0xbc]
mov ecx, dword [eax + 0x14]
cmp ecx, reloc.OLEAUT32.dll_SysReAllocString
je 0x420afc
cmp ecx, 0x80000001
je 0x420afc
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x30]
mov edi, dword [ebp - 0xc0]
mov byte [ebp - 4], 0
cmp edx, 8
jb 0x420aa8
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x420a9e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x421db8
push edx
push ecx
call fcn.004d8a95
add esp, 8
xor eax, eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 7
mov word [ebp - 0x30], ax
mov dword [ebp - 4], 4
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x420ad8
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0xbc]
add eax, 0x18
mov dword [ebp - 0xbc], eax
cmp eax, dword [ebp - 0x14]
jne 0x420980
jmp 0x420cc5
mov edx, dword [eax + 0xc]
xor eax, eax
mov ecx, edx
mov word [ebp - 0x48], ax
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 7
lea eax, [ecx + 2]
mov dword [ebp - 0x14], eax
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x420b20
sub ecx, dword [ebp - 0x14]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x48]
call fcn.00429380
mov byte [ebp - 4], 2
xor eax, eax
mov edx, dword [ebp - 0x20]
add edx, edi
mov word [ebp - 0xe4], ax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xd4], 0
mov dword [ebp - 0xd0], 7
cmp eax, edx
jb 0x421db3
sub eax, edx
or ecx, 0xffffffff
cmp eax, 0xffffffff
cmovb ecx, eax
cmp dword [ebp - 0x34], 8
lea eax, [ebp - 0x48]
cmovae eax, dword [ebp - 0x48]
push ecx
lea ecx, [ebp - 0xe4]
lea eax, [eax + edx*2]
push eax
call fcn.00429380
mov edi, dword [ebp - 0xc4]
lea eax, [ebp - 0xe4]
add edi, 0x30
mov edx, 0x10
mov dword [ebp - 0xb8], edx
cmp edi, eax
je 0x420bcf
mov ecx, edi
call fcn.00413420
movups xmm0, xmmword [ebp - 0xe4]
movups xmmword [edi], xmm0
movq xmm0, qword [ebp - 0xd4]
movq qword [edi + 0x10], xmm0
jmp 0x420c0f
mov edx, dword [ebp - 0xd0]
cmp edx, 8
jb 0x420c0f
mov ecx, dword [ebp - 0xe4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x420c05
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x421db8
push edx
push ecx
call fcn.004d8a95
add esp, 8
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x34]
cmp edx, 8
jb 0x420c4d
mov ecx, dword [ebp - 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x420c43
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x421dbd
push edx
push ecx
call fcn.004d8a95
add esp, 8
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x1c]
cmp edx, 8
jb 0x420c8b
mov ecx, dword [ebp - 0x30]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x420c81
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x421dc2
push edx
push ecx
call fcn.004d8a95
add esp, 8
xor eax, eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 7
add esi, 0xfffffff0
mov word [ebp - 0x30], ax
mov dword [ebp - 4], 3
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x420cbe
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edi, dword [ebp - 0xc8]
mov eax, dword [ebp - 0xc4]
cmp dword [eax + 0x40], 0
je 0x421d96
lea esi, [edi + 0x4c]
push esi
mov dword [ebp - 0x18], esi
call fcn.0045f02c
add esp, 4
test eax, eax
je 0x420cf7
push eax
call fcn.0045e323
add esp, 4
mov dword [ebp - 4], 5
mov eax, dword [ebp - 0xc8]
mov edi, dword [edi + 0x180]
cmp edi, dword [eax + 0x184]
je 0x420dd7
mov eax, dword [ebp - 0xc4]
add eax, 0x30
mov dword [ebp - 0xc0], eax
mov ecx, dword [eax + 0x10]
mov dword [ebp - 0x14], ecx
nop dword [eax + eax]
cmp dword [eax + 0x14], 8
mov edx, eax
jb 0x420d3a
mov edx, dword [eax]
cmp dword [edi + 0x44], 8
lea ecx, [edi + 0x30]
mov eax, dword [edi + 0x40]
jb 0x420d48
mov ecx, dword [ecx]
cmp eax, dword [ebp - 0x14]
jne 0x420d5a
push eax
call fcn.00429870
add esp, 4
test eax, eax
je 0x420d76
mov eax, dword [ebp - 0xc8]
add edi, 0xb8
cmp edi, dword [eax + 0x184]
je 0x420dd7
mov eax, dword [ebp - 0xc0]
jmp 0x420d30
mov ecx, dword [ebp - 0xc4]
lea eax, [edi + 0x48]
add ecx, 0x48
cmp ecx, eax
je 0x420d98
cmp dword [eax + 0x14], 8
mov edx, dword [eax + 0x10]
jb 0x420d91
mov eax, dword [eax]
push edx
push eax
call fcn.00429380
mov ecx, dword [ebp - 0xc4]
cmp ecx, edi
je 0x420dbb
cmp dword [edi + 0x14], 0x10
mov eax, edi
jb 0x420dac
mov eax, dword [edi]
push dword [edi + 0x10]
push eax
call fcn.004294e0
mov ecx, dword [ebp - 0xc4]
add edi, 0x18
add ecx, 0x18
cmp ecx, edi
je 0x420dd7
cmp dword [edi + 0x14], 8
mov eax, dword [edi + 0x10]
jb 0x420dd0
mov edi, dword [edi]
push eax
push edi
call fcn.00429380
push esi
mov dword [ebp - 4], 6
call fcn.0045f051
add esp, 4
test eax, eax
je 0x420df4
push eax
call fcn.0045e323
add esp, 4
xorps xmm0, xmm0
mov dword [ebp - 4], 0xffffffff
movups xmmword [ebp - 0x98], xmm0
push 0
push 0
movups xmmword [ebp - 0x88], xmm0
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x90], 0
call fcn.00431bf0
mov dword [ebp - 0x94], eax
mov dword [ebp - 4], 7
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x84], 0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x8c]
push 0x10
mov dword [ebp - 0x98], 0x3f800000
call fcn.0042a640
mov eax, dword [ebp - 0x94]
lea ecx, [ebp - 0x8c]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0x10
call fcn.0042a240
mov dword [ebp - 0x80], 7
mov dword [ebp - 0x7c], 8
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 9
mov edi, dword [edi]
mov esi, dword [edi]
cmp esi, edi
je 0x4216b4
cmp dword [esi + 0x24], 8
lea ecx, [esi + 0x10]
jb 0x420ec3
mov ecx, dword [esi + 0x10]
push dword [esi + 0x20]
xor edx, edx
mov dword [ebp - 0x38], 0
push ecx
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x34], 7
mov word [ebp - 0x48], dx
call fcn.00429380
or dword [ebp - 0xb8], 0x60
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x48]
cmp dword [ebp - 0x34], 8
mov eax, dword [ebp - 0x38]
cmovae ecx, dword [ebp - 0x48]
lea eax, [ecx + eax*2]
mov edx, eax
mov dword [ebp - 0x14], eax
call fcn.00413030
mov ecx, dword [ebp - 0x14]
sub ecx, eax
cmp ecx, 2
jb 0x420f7b
lea eax, [ebp - 0x78]
push eax
lea ecx, [ebp - 0x48]
call fcn.00413380
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0xb8]
or ecx, 1
push 4
mov dword [ebp - 0xb8], ecx
mov dword [ebp - 0xc0], ecx
mov ecx, eax
push str..exe
call fcn.00413160
test eax, eax
je 0x420f72
lea eax, [ebp - 0xe4]
push eax
lea ecx, [ebp - 0x48]
call fcn.00413380
or dword [ebp - 0xb8], 2
mov ecx, eax
push 4
push str..dll
call fcn.00413160
test eax, eax
jne 0x420f7b
mov byte [ebp - 0xb1], 1
jmp 0x420f82
mov byte [ebp - 0xb1], 0
mov eax, dword [ebp - 0xb8]
test al, 2
je 0x420ff8
mov edx, dword [ebp - 0xd0]
and eax, 0xfffffffd
mov dword [ebp - 0xb8], eax
cmp edx, 8
jb 0x420fdb
mov ecx, dword [ebp - 0xe4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x420fcb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x421db8
push edx
push ecx
call fcn.004d8a95
mov eax, dword [ebp - 0xb8]
add esp, 8
xor ecx, ecx
mov dword [ebp - 0xd4], 0
mov dword [ebp - 0xd0], 7
mov word [ebp - 0xe4], cx
mov dword [ebp - 4], 0xa
test al, 1
je 0x421046
mov edx, dword [ebp - 0x64]
and eax, 0xfffffffe
mov dword [ebp - 0xb8], eax
cmp edx, 8
jb 0x421046
mov ecx, dword [ebp - 0x78]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42103c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x421db8
push edx
push ecx
call fcn.004d8a95
add esp, 8
cmp byte [ebp - 0xb1], 0
je 0x4211ba
lea eax, [ebp - 0x78]
push eax
lea ecx, [ebp - 0x48]
call fcn.00413320
mov byte [ebp - 4], 0xc
cmp dword [eax + 0x14], 8
jb 0x42106b
mov eax, dword [eax]
lea ecx, [ebp - 0x1a4]
push 3
mov dword [ebp - 0x1a8], ecx
lea ecx, [ebp - 0x1a8]
push eax
call fcn.00428ea0
mov byte [ebp - 4], 0xd
mov edx, dword [ebp - 0x1a8]
mov ecx, edx
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0xf
mov byte [ebp - 0x60], 0
lea eax, [ecx + 1]
mov dword [ebp - 0x14], eax
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4210b0
sub ecx, dword [ebp - 0x14]
push ecx
push edx
lea ecx, [ebp - 0x60]
call fcn.004294e0
mov ecx, dword [ebp - 0xc4]
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x11c]
mov byte [ebp - 4], 0xe
push eax
lea ecx, [ecx + 0x90]
call fcn.00430fe0
mov eax, dword [ebp - 0x11c]
mov byte [ebp - 4], 0xd
mov dword [eax + 0x20], 1
mov edx, dword [ebp - 0x4c]
cmp edx, 0x10
jb 0x421129
mov ecx, dword [ebp - 0x60]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x42111f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x421db8
push edx
push ecx
call fcn.004d8a95
add esp, 8
mov eax, dword [ebp - 0x1a8]
lea ecx, [ebp - 0x1a4]
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0xf
mov byte [ebp - 0x60], 0
cmp eax, ecx
je 0x421154
push eax
call fcn.0051da1f
add esp, 4
mov byte [ebp - 4], 0xa
mov edx, dword [ebp - 0x64]
cmp edx, 8
jb 0x421192
mov ecx, dword [ebp - 0x78]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x421188
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x421db8
push edx
push ecx
call fcn.004d8a95
add esp, 8
lea edx, [esi + 0x10]
push edx
lea eax, [ebp - 0x124]
push eax
lea ecx, [ebp - 0x98]
call fcn.00430a20
mov eax, dword [ebp - 0x124]
mov dword [eax + 0x20], 1
jmp 0x42162b
cmp dword [esi + 0x24], 8
lea eax, [esi + 0x10]
mov dword [ebp - 0xbc], eax
jb 0x4211d1
mov eax, dword [eax]
mov dword [ebp - 0xbc], eax
call fcn.004135d0
mov ecx, eax
test ecx, ecx
je 0x421dd1
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0xc8], eax
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0xc8]
push dword [ebp - 0xbc]
call fcn.00428d70
test al, al
jne 0x42123d
mov edx, dword [ebp - 0xbc]
test edx, edx
jne 0x421217
xor ecx, ecx
jmp 0x421230
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x14], eax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x421220
sub ecx, dword [ebp - 0x14]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0xc8]
call fcn.00427080
lea ecx, [ebp - 0xc8]
call fcn.00449d80
mov edx, dword [ebp - 0xc8]
mov dword [ebp - 0x14], eax
add edx, 0xfffffff0
mov byte [ebp - 4], 0x10
or ecx, 0xffffffff
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x421270
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 0xa
test eax, eax
je 0x42162b
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
push ecx
lea edx, [esi + 0x10]
movq qword [ebp - 0x24], xmm0
lea ecx, [ebp - 0x24]
call fcn.0044c4f0
add esp, 4
mov byte [ebp - 4], 0x11
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0x18], ecx
cmp eax, ecx
je 0x421623
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0x4212bf
mov ecx, dword [eax]
push dword [eax + 0x10]
xor edx, edx
mov dword [ebp - 0x50], 0
push ecx
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x4c], 7
mov word [ebp - 0x60], dx
call fcn.00429380
or dword [ebp - 0xb8], 0xc00
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x60]
cmp dword [ebp - 0x4c], 8
mov eax, dword [ebp - 0x50]
cmovae ecx, dword [ebp - 0x60]
lea eax, [ecx + eax*2]
mov edx, eax
mov dword [ebp - 0x14], eax
call fcn.00413030
mov ecx, dword [ebp - 0x14]
sub ecx, eax
cmp ecx, 2
jb 0x42137a
lea eax, [ebp - 0x78]
push eax
lea ecx, [ebp - 0x60]
call fcn.00413380
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0xb8]
or ecx, 4
push 4
mov dword [ebp - 0xb8], ecx
mov dword [ebp - 0xc0], ecx
mov ecx, eax
push str..exe
call fcn.00413160
test eax, eax
je 0x421371
lea eax, [ebp - 0xe4]
push eax
lea ecx, [ebp - 0x60]
call fcn.00413380
or dword [ebp - 0xb8], 8
mov ecx, eax
push 4
push str..dll
call fcn.00413160
test eax, eax
jne 0x42137a
mov byte [ebp - 0xb1], 1
jmp 0x421381
mov byte [ebp - 0xb1], 0
mov eax, dword [ebp - 0xb8]
test al, 8
je 0x4213f7
mov edx, dword [ebp - 0xd0]
and eax, 0xfffffff7
mov dword [ebp - 0xb8], eax
cmp edx, 8
jb 0x4213da
mov ecx, dword [ebp - 0xe4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4213ca
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x421db8
push edx
push ecx
call fcn.004d8a95
mov eax, dword [ebp - 0xb8]
add esp, 8
xor ecx, ecx
mov dword [ebp - 0xd4], 0
mov dword [ebp - 0xd0], 7
mov word [ebp - 0xe4], cx
mov dword [ebp - 4], 0x12
test al, 4
je 0x421445
mov edx, dword [ebp - 0x64]
and eax, 0xfffffffb
mov dword [ebp - 0xb8], eax
cmp edx, 8
jb 0x421445
mov ecx, dword [ebp - 0x78]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42143b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x421db8
push edx
push ecx
call fcn.004d8a95
add esp, 8
cmp byte [ebp - 0xb1], 0
je 0x4215a8
lea eax, [ebp - 0x78]
push eax
lea ecx, [ebp - 0x60]
call fcn.00413320
mov byte [ebp - 4], 0x14
cmp dword [eax + 0x14], 8
jb 0x42146a
mov eax, dword [eax]
lea ecx, [ebp - 0x1a4]
push 3
mov dword [ebp - 0x1a8], ecx
lea ecx, [ebp - 0x1a8]
push eax
call fcn.00428ea0
mov byte [ebp - 4], 0x15
mov edx, dword [ebp - 0x1a8]
mov ecx, edx
mov dword [ebp - 0xec], 0
mov dword [ebp - 0xe8], 0xf
mov byte [ebp - 0xfc], 0
lea eax, [ecx + 1]
mov dword [ebp - 0x14], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4214b1
sub ecx, dword [ebp - 0x14]
push ecx
push edx
lea ecx, [ebp - 0xfc]
call fcn.004294e0
mov ecx, dword [ebp - 0xc4]
lea eax, [ebp - 0xfc]
push eax
lea eax, [ebp - 0xac]
mov byte [ebp - 4], 0x16
push eax
lea ecx, [ecx + 0x90]
call fcn.00430fe0
mov eax, dword [ebp - 0xac]
mov byte [ebp - 4], 0x15
mov dword [eax + 0x20], 1
mov edx, dword [ebp - 0xe8]
cmp edx, 0x10
jb 0x421536
mov ecx, dword [ebp - 0xfc]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x42152c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x421db8
push edx
push ecx
call fcn.004d8a95
add esp, 8
mov eax, dword [ebp - 0x1a8]
lea ecx, [ebp - 0x1a4]
mov dword [ebp - 0xec], 0
mov dword [ebp - 0xe8], 0xf
mov byte [ebp - 0xfc], 0
cmp eax, ecx
je 0x42156a
push eax
call fcn.0051da1f
add esp, 4
mov byte [ebp - 4], 0x12
mov edx, dword [ebp - 0x64]
cmp edx, 8
jb 0x4215a8
mov ecx, dword [ebp - 0x78]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42159e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x421db8
push edx
push ecx
call fcn.004d8a95
add esp, 8
push dword [ebp - 0xbc]
lea eax, [ebp - 0xa0]
push eax
lea ecx, [ebp - 0x98]
call fcn.00430a20
mov eax, dword [ebp - 0xa0]
mov byte [ebp - 4], 0x11
mov dword [eax + 0x20], 1
mov edx, dword [ebp - 0x4c]
cmp edx, 8
jb 0x42160b
mov ecx, dword [ebp - 0x60]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x421601
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x421db8
push edx
push ecx
call fcn.004d8a95
add esp, 8
mov eax, dword [ebp - 0xbc]
add eax, 0x18
mov dword [ebp - 0xbc], eax
cmp eax, dword [ebp - 0x18]
jne 0x4212b5
lea ecx, [ebp - 0x24]
call fcn.00428bd0
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x34]
cmp edx, 8
jb 0x421669
mov ecx, dword [ebp - 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42165f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x421db8
push edx
push ecx
call fcn.004d8a95
add esp, 8
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
je 0x421694
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x421690
nop dword [eax + eax]
cmp esi, dword [eax + 8]
jne 0x421690
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x421680
mov esi, eax
jmp 0x4216ac
mov esi, eax
mov ecx, dword [esi]
cmp byte [ecx + 0xd], 0
jne 0x4216ac
nop
mov eax, dword [ecx]
mov esi, ecx
mov ecx, eax
cmp byte [eax + 0xd], 0
je 0x4216a0
cmp esi, edi
jne 0x420eb7
mov eax, dword [ebp - 0xcc]
mov esi, dword [eax]
cmp esi, dword [eax + 4]
je 0x421773
xorps xmm0, xmm0
mov dword [ebp - 0x1c], 0
push esi
lea ecx, [ebp - 0x24]
movq qword [ebp - 0x24], xmm0
call fcn.00426b40
mov byte [ebp - 4], 0x17
mov eax, dword [ebp - 0x20]
mov ecx, eax
mov edi, dword [ebp - 0x24]
sub ecx, edi
mov dword [ebp - 0xc0], eax
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0x14], eax
cmp edi, dword [ebp - 0xc0]
je 0x421738
nop dword [eax]
push edi
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x98]
call fcn.00425b30
mov eax, dword [eax]
cmp eax, dword [ebp - 0x94]
jne 0x421755
add edi, 0x18
cmp edi, dword [ebp - 0xc0]
jne 0x421710
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x421755
push esi
mov esi, dword [ebp - 0xcc]
lea eax, [ebp - 0xbc]
push eax
mov ecx, esi
call fcn.00426270
mov esi, dword [esi]
jmp 0x421758
add esi, 0x18
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 9
call fcn.00428bd0
mov eax, dword [ebp - 0xcc]
cmp esi, dword [eax + 4]
jne 0x4216c5
xorps xmm0, xmm0
mov dword [ebp - 0x9c], 0
movq qword [ebp - 0xa4], xmm0
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0x9c], 0
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0xa4]
cmp dword [0x5a4074], 8
mov eax, 0x5a4060
push 0x20019
cmovae eax, dword [0x5a4060]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00412c70
mov esi, dword [ebp - 0xa4]
test eax, eax
jne 0x421d80
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x421d80
push 0x400
call fcn.004d8aa3
xor edi, edi
add esp, 4
mov esi, eax
mov dword [ebp - 0xcc], edi
mov dword [ebp - 0xc0], esi
cmp dword [ebp - 0x18], edi
jbe 0x421d7a
push 0x200
push esi
push edi
push dword [ebp - 0xa4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x421cc9
mov ecx, esi
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 7
mov word [ebp - 0x30], ax
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x421860
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x30]
call fcn.00429380
xorps xmm0, xmm0
mov dword [ebp - 0xa8], 0
movq qword [ebp - 0xb0], xmm0
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0xac], 0
mov dword [ebp - 0xa8], 0
push 0x20019
push esi
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0xb0]
push dword [ebp - 0xa4]
call fcn.00412c70
mov esi, dword [ebp - 0xb0]
test eax, eax
jne 0x421c66
push 0xa
xor eax, eax
mov dword [ebp - 0x50], 0
push str.ServiceDll
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x4c], 7
mov word [ebp - 0x60], ax
call fcn.00429380
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0xfc]
push 0xa
xor eax, eax
mov dword [ebp - 0xec], 0
push str.Parameters
mov dword [ebp - 0xe8], 7
mov word [ebp - 0xfc], ax
call fcn.00429380
lea eax, [ebp - 0x60]
mov byte [ebp - 4], 0x1c
push eax
lea eax, [ebp - 0xfc]
mov edx, esi
push eax
lea ecx, [ebp - 0x78]
call fcn.0044a4d0
add esp, 8
mov byte [ebp - 4], 0x1e
mov edx, dword [ebp - 0xe8]
cmp edx, 8
jb 0x42198b
mov ecx, dword [ebp - 0xfc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x421981
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x421db8
push edx
push ecx
call fcn.004d8a95
add esp, 8
xor eax, eax
mov dword [ebp - 0xec], 0
mov dword [ebp - 0xe8], 7
mov word [ebp - 0xfc], ax
mov byte [ebp - 4], 0x1f
mov edx, dword [ebp - 0x4c]
cmp edx, 8
jb 0x4219e6
mov ecx, dword [ebp - 0x60]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4219dc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x421db8
push edx
push ecx
call fcn.004d8a95
add esp, 8
xor eax, eax
mov dword [ebp - 0x50], 0
mov word [ebp - 0x60], ax
lea ecx, [ebp - 0x98]
lea eax, [ebp - 0x78]
mov dword [ebp - 0x4c], 7
push eax
lea eax, [ebp - 0xbc]
push eax
call fcn.00425b30
mov eax, dword [eax]
cmp eax, dword [ebp - 0x94]
jne 0x421cde
push 9
xor eax, eax
mov dword [ebp - 0xd4], 0
push str.ImagePath
lea ecx, [ebp - 0xe4]
mov dword [ebp - 0xd0], 7
mov word [ebp - 0xe4], ax
call fcn.00429380
xor eax, eax
mov byte [ebp - 4], 0x20
push eax
push 0x58245c
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x104], 0
mov dword [ebp - 0x100], 7
mov word [ebp - 0x114], ax
call fcn.00429380
lea eax, [ebp - 0xe4]
mov byte [ebp - 4], 0x21
push eax
lea eax, [ebp - 0x114]
mov edx, esi
push eax
lea ecx, [ebp - 0x48]
call fcn.0044a4d0
add esp, 8
mov byte [ebp - 4], 0x23
mov edx, dword [ebp - 0x100]
cmp edx, 8
jb 0x421ae2
mov ecx, dword [ebp - 0x114]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x421ad8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x421db8
push edx
push ecx
call fcn.004d8a95
add esp, 8
xor eax, eax
mov dword [ebp - 0x104], 0
mov dword [ebp - 0x100], 7
mov word [ebp - 0x114], ax
mov byte [ebp - 4], 0x24
mov edx, dword [ebp - 0xd0]
cmp edx, 8
jb 0x421b43
mov ecx, dword [ebp - 0xe4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x421b39
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x421db8
push edx
push ecx
call fcn.004d8a95
add esp, 8
mov edi, dword [ebp - 0x48]
xor eax, eax
mov word [ebp - 0xe4], ax
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0xd4], 0
mov dword [ebp - 0xd0], 7
mov esi, dword [eax]
cmp esi, eax
je 0x421bcd
nop
cmp dword [esi + 0x1c], 8
lea ecx, [esi + 8]
mov edx, dword [ecx + 0x10]
jb 0x421b7e
mov ecx, dword [ecx]
cmp dword [ebp - 0x34], 8
lea eax, [ebp - 0x48]
push edx
push ecx
push 0
push dword [ebp - 0x38]
cmovae eax, edi
push eax
call fcn.0042d530
add esp, 0x14
cmp eax, 0xffffffff
jne 0x421ba9
mov esi, dword [esi]
cmp esi, dword [ebp - 0x94]
jne 0x421b70
jmp 0x421bcd
mov ecx, dword [ebp - 0xc4]
lea eax, [ebp - 0x30]
add ecx, 0x78
cmp ecx, eax
je 0x421bcd
cmp dword [ebp - 0x1c], 8
push dword [ebp - 0x20]
cmovae eax, dword [ebp - 0x30]
push eax
call fcn.00429380
mov edi, dword [ebp - 0x48]
mov byte [ebp - 4], 0x1f
mov eax, dword [ebp - 0x34]
cmp eax, 8
jb 0x421c08
lea ecx, [eax*2 + 2]
mov eax, edi
cmp ecx, 0x1000
jb 0x421bfe
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x421db8
push ecx
push edi
call fcn.004d8a95
add esp, 8
xor eax, eax
mov byte [ebp - 4], 0x1a
mov edx, dword [ebp - 0x64]
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 7
mov word [ebp - 0x48], ax
cmp edx, 8
jb 0x421c5a
mov ecx, dword [ebp - 0x78]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x421c50
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x421db8
push edx
push ecx
call fcn.004d8a95
add esp, 8
mov edi, dword [ebp - 0xcc]
mov esi, dword [ebp - 0xb0]
test esi, esi
je 0x421c7b
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xb0], 0
mov byte [ebp - 4], 0x18
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0xac], 0
cmp edx, 8
jb 0x421cc3
mov ecx, dword [ebp - 0x30]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x421cb9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x421db8
push edx
push ecx
call fcn.004d8a95
add esp, 8
mov esi, dword [ebp - 0xc0]
inc edi
mov dword [ebp - 0xcc], edi
cmp edi, dword [ebp - 0x18]
jb 0x421830
jmp 0x421d7a
mov ecx, dword [ebp - 0xc4]
lea eax, [ebp - 0x30]
add ecx, 0x60
cmp ecx, eax
je 0x421cff
cmp dword [ebp - 0x1c], 8
push dword [ebp - 0x20]
cmovae eax, dword [ebp - 0x30]
push eax
call fcn.00429380
mov edx, dword [ebp - 0x64]
cmp edx, 8
jb 0x421d39
mov ecx, dword [ebp - 0x78]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x421d2f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x421ddb
push edx
push ecx
call fcn.004d8a95
add esp, 8
test esi, esi
je 0x421d44
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x1c]
cmp edx, 8
jb 0x421d7a
mov ecx, dword [ebp - 0x30]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x421d70
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x421de0
push edx
push ecx
call fcn.004d8a95
add esp, 8
mov esi, dword [ebp - 0xa4]
test esi, esi
je 0x421d8b
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x98]
call fcn.00416060
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d84d0
mov esp, ebp
pop ebp
ret 0xc
call fcn.0042a230
call fcn.0051d2db
call fcn.0051d2db
call fcn.0051d2db
push 0x80070057
call fcn.00412830
push 0x80004005
call fcn.00412830
call fcn.0051d2db
call fcn.0051d2db
int3