Function at 0x452970
Capabilities:
Encode data using base64
Parse credit card information
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
push ebx
push esi
push edi
mov dword [ebp - 0x44], ecx
push ecx
lea ecx, [ebp - 0x8c]
call fcn.004391ff
mov eax, dword [ebp + 8]
xor ebx, ebx
mov byte [ebp - 0x35], 0xff
mov byte [ebp - 0x1e], bl
mov byte [ebp - 0x1d], bl
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x1c], ebx
lea eax, [ebp + 8]
push eax
call fcn.00431c97
mov esi, dword [ebp + 8]
mov ax, word [esi]
cmp ax, 0x2d
pop ecx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], 0xfffffff0
mov byte [ebp - 1], bl
mov byte [ebp - 0xd], bl
mov byte [ebp - 3], bl
mov byte [ebp - 2], bl
mov byte [ebp - 0x3d], bl
mov byte [ebp - 4], bl
mov dword [ebp - 0x14], ebx
mov cl, 0x2a
jne 0x4529dc
mov cl, al
movsx edi, cl
movzx eax, ax
jmp 0x452bc0
movzx eax, word [esi + 2]
cmp edi, eax
jne 0x452bc8
xor eax, eax
lea ecx, [esi + 4]
mov ax, word [ecx]
mov edx, eax
and dx, 0xffdf
cmp dx, 0x48
je 0x452bc8
call fcn.00431c5f
test al, al
jne 0x452bc8
mov esi, ecx
push 1
push esi
push 0x49fa54
mov dword [ebp + 8], esi
call fcn.00432c59
add esp, 0xc
test al, al
je 0x452a78
lea eax, [ebp + 8]
push eax
add esi, 2
call fcn.00404807
cmp word [esi], 0x3a
pop ecx
je 0x452a4e
or dword [ebp - 0x14], 7
jmp 0x452bba
lea eax, [ebp - 8]
push eax
inc esi
lea eax, [ebp - 0x50]
inc esi
push eax
mov dword [ebp - 8], ebx
mov dword [ebp - 0x50], esi
call fcn.00439fac
test eax, eax
pop ecx
pop ecx
jle 0x452bba
mov eax, dword [ebp - 8]
or dword [ebp - 0x14], eax
jmp 0x452bba
push 2
push esi
push 0x49fa50
call fcn.00432c59
add esp, 0xc
test al, al
lea eax, [ebp + 8]
je 0x452ac4
add esi, 4
push eax
mov dword [ebp - 0x50], esi
call fcn.00404807
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x50]
push eax
mov dword [ebp - 8], ebx
call fcn.00439fac
add esp, 0xc
test eax, eax
jle 0x452bba
mov eax, dword [ebp - 8]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], ebx
jmp 0x452bba
push 2
push eax
push 0x49fa4c
call fcn.00438eee
add esp, 0xc
test al, al
je 0x452ae1
mov byte [ebp - 3], 1
jmp 0x452bba
push 4
lea eax, [ebp + 8]
push eax
push str.byte
call fcn.00438eee
add esp, 0xc
test al, al
je 0x452b01
mov byte [ebp - 4], 1
jmp 0x452bba
push 1
lea eax, [ebp + 8]
push eax
push 0x49abe8
call fcn.00438eee
add esp, 0xc
test al, al
je 0x452b21
mov byte [ebp - 2], 3
jmp 0x452bba
push 2
lea eax, [ebp + 8]
push eax
push 0x49fa48
call fcn.00438eee
add esp, 0xc
test al, al
je 0x452b3e
or byte [ebp - 2], 1
jmp 0x452bba
push 2
lea eax, [ebp + 8]
push eax
push 0x49fa44
call fcn.00438eee
add esp, 0xc
test al, al
je 0x452b5b
or byte [ebp - 2], 2
jmp 0x452bba
push 4
lea eax, [ebp + 8]
push eax
push str.name
call fcn.00438eee
add esp, 0xc
test al, al
je 0x452b78
mov byte [ebp - 0x3d], 1
jmp 0x452bba
push 1
lea eax, [ebp + 8]
push eax
push 0x49fa38
call fcn.00438eee
add esp, 0xc
test al, al
je 0x452b94
inc byte [ebp - 0x1e]
jmp 0x452bba
push 1
lea eax, [ebp + 8]
push eax
push 0x49fa34
call fcn.00438eee
add esp, 0xc
test al, al
je 0x452bb0
inc byte [ebp - 0x1d]
jmp 0x452bba
lea eax, [ebp + 8]
push eax
call fcn.00404807
pop ecx
mov esi, dword [ebp + 8]
movzx eax, word [esi]
cmp edi, eax
je 0x4529e7
lea ecx, [ebp - 0x58]
call fcn.0043717e
lea ecx, [ebp - 0x7c]
call fcn.0043717e
lea ecx, [ebp - 0x4c]
call fcn.0043717e
lea ecx, [ebp - 0x64]
call fcn.0043717e
lea ecx, [ebp - 0x68]
call fcn.0043717e
xor eax, eax
mov ax, word [esi]
mov ecx, eax
or ecx, 0x20
cmp cx, 0x6e
je 0x452c42
cmp cx, 0x75
je 0x452c42
cmp cx, 0x62
je 0x452c42
cmp ax, 0x5e
je 0x452c42
cmp ax, 0x2b
je 0x452c42
cmp ax, 0x23
je 0x452c42
cmp ax, 0x40
je 0x452c42
cmp ax, 0x24
je 0x452c42
cmp ax, 0x2a
je 0x452c42
cmp ax, 0x7e
je 0x452c42
cmp ax, 0x2e
je 0x452c42
cmp ax, 0x3f
jne 0x452c5a
mov al, byte [esi]
inc esi
inc esi
cmp al, bl
mov byte [ebp - 1], al
mov dword [ebp + 8], esi
je 0x452c5a
movzx ecx, word [esi]
movsx eax, al
cmp eax, ecx
je 0x452c60
cmp word [esi], 0x24
jne 0x452c6a
mov al, byte [esi]
inc esi
inc esi
mov byte [ebp - 0xd], al
mov dword [ebp + 8], esi
cmp byte [ebp - 1], 0x41
jl 0x452c7a
cmp byte [ebp - 1], 0x5a
jg 0x452c7a
or byte [ebp - 1], 0x20
lea eax, [ebp + 8]
push eax
call fcn.00431c97
mov edi, dword [ebp + 8]
mov dword [esp], 0x49fa2c
push edi
mov dword [ebp - 0x50], edi
call dword [sym.imp.SHLWAPI.dll_StrStrW]
mov esi, eax
cmp esi, ebx
je 0x452ca0
lea edi, [esi + 4]
mov edx, edi
mov dword [ebp - 0x3c], edx
cmp word [edi], bx
je 0x452ce4
mov ax, word [edx]
cmp ax, 0x2c
je 0x452ce4
cmp ax, 0x3d
je 0x452ce4
cmp ax, 0x21
jne 0x452cda
lea eax, [edx + 2]
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x5c]
push eax
call fcn.00431c97
mov eax, dword [ebp - 0x5c]
cmp word [eax], bx
pop ecx
je 0x452ce4
lea edx, [eax - 2]
inc edx
inc edx
mov dword [ebp - 0x3c], edx
cmp word [edx], bx
jne 0x452caa
mov ax, word [edx]
cmp ax, 0x2c
je 0x452cf9
cmp ax, 0x3d
je 0x452cf9
cmp ax, 0x21
jne 0x452d09
mov al, byte [edx]
mov word [edx], bx
add dword [ebp - 0x3c], 2
cmp al, bl
mov byte [ebp - 0x36], al
jne 0x452d60
inc byte [ebp - 0x35]
cmp byte [ebp - 0x35], bl
jg 0x452d56
mov ecx, dword [ebp - 0x44]
push 1
push ebx
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x60]
call fcn.0043fdd2
mov eax, dword [ebp - 0x70]
lea ecx, [ebp - 0x68]
mov dword [ebp + 8], eax
call fcn.00431c4c
lea ecx, [ebp - 0x64]
call fcn.00431c4c
lea ecx, [ebp - 0x4c]
call fcn.00431c4c
lea ecx, [ebp - 0x7c]
call fcn.00431c4c
lea ecx, [ebp - 0x58]
call fcn.00431c4c
jmp 0x4529a3
mov esi, 0x80070057
jmp 0x453d28
cmp esi, ebx
mov dword [ebp - 0x5c], ebx
jne 0x452d79
push 0x5c
push ebx
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_StrRChrW]
call edi
mov esi, eax
cmp esi, ebx
je 0x452dcd
mov ecx, dword [ebp - 0x44]
push 1
push ebx
lea eax, [ebp - 0x58]
push eax
push dword [ebp + 8]
mov word [esi], bx
call fcn.0043fdd2
push 0x5c
push dword [ebp - 0x58]
call dword [sym.imp.SHLWAPI.dll_StrChrW]
cmp eax, ebx
jne 0x452da7
mov esi, 0x80070057
jmp 0x453d20
mov ecx, dword [ebp - 0x44]
mov word [eax], bx
inc eax
inc eax
push 1
mov dword [ebp - 0xc], eax
push ebx
lea eax, [ebp - 0x5c]
push eax
add esi, 2
push esi
call fcn.0043fdd2
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x24], eax
jmp 0x452e4e
push 1
push 0x2c
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x8c]
call fcn.00443720
push ebx
lea ecx, [ebp - 0x58]
push ecx
push eax
call fcn.00439b04
add esp, 0xc
push 0x5c
push dword [ebp - 0x58]
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov esi, eax
cmp esi, ebx
je 0x452d9d
mov word [esi], bx
inc esi
inc esi
push 0x49fa2c
push esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.SHLWAPI.dll_StrStrW]
cmp byte [ebp - 2], bl
mov dword [ebp - 0x24], eax
je 0x452e2c
cmp eax, ebx
jne 0x452e41
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esi + eax*2]
mov dword [ebp - 0x24], eax
cmp eax, ebx
jne 0x452e41
push 0x5c
push ebx
push esi
call edi
cmp eax, ebx
mov dword [ebp - 0x24], eax
je 0x452d9d
cmp word [eax], bx
je 0x452e4e
mov word [eax], bx
inc eax
inc eax
mov dword [ebp - 0x24], eax
cmp word [eax], 0x5c
jne 0x452e59
inc eax
inc eax
mov dword [ebp - 0x24], eax
cmp byte [ebp - 0x3d], bl
mov dword [ebp - 0x74], ebx
je 0x452e7c
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x44]
call fcn.00449ef8
mov eax, dword [ebp - 0x74]
add esp, 0xc
mov dword [ebp - 0x3c], eax
jmp 0x452e7f
mov eax, dword [ebp - 0x3c]
cmp byte [ebp - 0x36], 0x2c
jne 0x452f16
push 1
push 0x2c
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x8c]
call fcn.00443720
push ebx
lea ecx, [ebp - 0x4c]
push ecx
push eax
call fcn.00439b04
mov ecx, dword [ebp - 0x44]
add esp, 0xc
push ebx
lea eax, [ebp - 0x4c]
push eax
call fcn.00402c95
cmp byte [ebp - 1], 0x2e
jne 0x452ef8
mov eax, dword [ebp - 0x3c]
cmp word [eax], 0x2c
jne 0x452ef8
add dword [ebp - 0x3c], 2
push 1
push 0x2c
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x8c]
call fcn.00443720
push ebx
lea ecx, [ebp - 0x68]
push ecx
push eax
call fcn.00439b04
mov ecx, dword [ebp - 0x44]
add esp, 0xc
push ebx
lea eax, [ebp - 0x68]
push eax
call fcn.00402c95
mov eax, dword [ebp - 0x4c]
cmp word [eax], bx
jne 0x45300c
push str.RegDat
lea ecx, [ebp - 0x4c]
call fcn.00441a24
jmp 0x45300c
cmp byte [ebp - 0x36], 0x21
je 0x45300c
cmp word [eax], bx
jne 0x452f48
cmp byte [ebp - 1], 0x24
je 0x452f67
cmp byte [ebp - 1], 0x2a
je 0x452f48
cmp byte [ebp - 1], 0x7e
je 0x452f48
cmp byte [ebp - 0x1d], bl
je 0x45300c
mov dword [ebp - 0x1c], eax
jmp 0x45300c
cmp byte [ebp - 1], 0x24
je 0x452f67
cmp byte [ebp - 1], 0x2a
je 0x452f67
cmp byte [ebp - 1], 0x7e
je 0x452f67
lea eax, [ebp - 0x3c]
push eax
call fcn.00431c97
mov eax, dword [ebp - 0x3c]
pop ecx
push eax
lea ecx, [ebp - 0x48]
call fcn.004419bc
mov edx, dword [ebp - 0x48]
lea eax, [ebp + 8]
push eax
mov dword [ebp + 8], edx
call fcn.00431c97
cmp byte [ebp + 0xc], bl
pop ecx
je 0x452f90
push edx
lea ecx, [ebp - 0x64]
call fcn.00441a24
jmp 0x452fa0
mov ecx, dword [ebp - 0x44]
push 1
push ebx
lea eax, [ebp - 0x64]
push eax
push edx
call fcn.0043eb92
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x1c], eax
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
call fcn.00431c97
cmp byte [ebp - 1], bl
pop ecx
jne 0x452fea
push dword [ebp + 8]
push 0x49fa14
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x452fd3
mov dword [ebp - 0x1c], 0x497994
jmp 0x453004
mov ecx, dword [ebp + 0xc]
mov ax, word [ecx]
cmp ax, 0x23
je 0x452fe5
cmp ax, 0x40
jne 0x453004
mov dword [ebp - 0x1c], ecx
jmp 0x453004
cmp byte [ebp - 1], 0x23
je 0x452ff6
cmp byte [ebp - 1], 0x40
jne 0x453004
mov eax, dword [ebp + 0xc]
cmp word [eax], bx
mov dword [ebp - 0x1c], eax
jne 0x453004
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x48]
call fcn.00431c4c
mov edi, dword [ebp - 0x58]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str.HKLM
push edi
call esi
test eax, eax
je 0x4530c3
push str.HKEY_LOCAL_MACHINE
push edi
call esi
test eax, eax
je 0x4530c3
push str.HKCU
push edi
call esi
test eax, eax
je 0x4530ba
push str.HKEY_CURRENT_USER
push edi
call esi
test eax, eax
je 0x4530ba
push str.HKCR
push edi
call esi
test eax, eax
je 0x4530b1
push str.HKEY_CLASSES_ROOT
push edi
call esi
test eax, eax
je 0x4530b1
push 0x49f978
push edi
call esi
test eax, eax
je 0x4530a8
push str.HKEY_USERS
push edi
call esi
test eax, eax
je 0x4530a8
push str.HKCC
push edi
call esi
test eax, eax
je 0x45309f
push str.HKEY_CURRENT_CONFIG
push edi
call esi
test eax, eax
je 0x45309f
mov esi, 0x80070057
jmp 0x453d18
mov dword [ebp + 8], 0x80000005
jmp 0x4530ca
mov dword [ebp + 8], 0x80000003
jmp 0x4530ca
mov dword [ebp + 8], 0x80000000
jmp 0x4530ca
mov dword [ebp + 8], 0x80000001
jmp 0x4530ca
mov dword [ebp + 8], 0x80000002
mov eax, dword [ebp - 0x4c]
cmp word [eax], bx
je 0x4537da
cmp byte [ebp - 1], 0x2e
je 0x4530e5
cmp byte [ebp - 1], 0x3f
mov dword [ebp - 0x2c], ebx
jne 0x4530f2
cmp byte [ebp - 1], 0x3f
mov dword [ebp - 0x2c], 1
je 0x453101
cmp dword [ebp - 0x2c], ebx
je 0x4530fc
cmp word [eax], bx
je 0x453101
mov dword [ebp - 0x14], ebx
jmp 0x453108
mov dword [ebp - 0x14], 1
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x64
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x50], ebx
call fcn.0043719c
lea ecx, [ebp - 8]
call fcn.0043717e
cmp byte [ebp - 1], 0x2e
lea eax, [ebp - 8]
je 0x453130
lea eax, [ebp - 0x18]
push 0x1000
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x1c], eax
call fcn.00437072
cmp byte [ebp - 2], bl
lea eax, [ebp + 0xc]
mov dword [ebp - 0x6c], 0xfff
mov dword [ebp + 0xc], ebx
mov dword [ebp - 0x60], ebx
push eax
je 0x4532c6
push 9
push ebx
push dword [ebp - 0xc]
mov dword [ebp - 0x2c], ebx
push dword [ebp + 8]
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp + 0xc], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push ebx
push ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
call esi
push ebx
push ebx
push ebx
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x48]
push eax
push ebx
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
call esi
mov dword [ebp + 8], eax
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x14], eax
jae 0x4531c1
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
lea eax, [eax*4 + 0x20]
mov dword [ebp - 0x80], eax
shr eax, 1
add eax, 8
push eax
lea ecx, [ebp - 0x30]
call fcn.0043719c
cmp byte [ebp - 2], 3
mov esi, dword [ebp - 0x30]
mov word [esi], 0xd
mov word [esi + 2], 0xa
lea eax, [esi + 4]
mov word [eax], 0x76
lea edi, [esi + 8]
mov word [esi + 6], 0x20
mov dword [ebp - 0xc], eax
mov word [edi], bx
je 0x45320a
lea edi, [esi + 4]
cmp dword [ebp + 8], ebx
jne 0x4532ab
test byte [ebp - 2], 1
je 0x45325c
cmp dword [ebp - 0x48], ebx
mov dword [ebp + 8], ebx
jle 0x45325c
mov eax, dword [ebp - 0x80]
push ebx
push ebx
push ebx
push ebx
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
push eax
push edi
push dword [ebp + 8]
mov word [edi], bx
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x453251
push dword [ebp - 0xc]
lea ecx, [ebp - 0x18]
call fcn.004371ec
mov dword [ebp - 0xc], esi
inc dword [ebp + 8]
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 0x48]
jl 0x453221
test byte [ebp - 2], 2
mov word [esi + 4], 0x6b
je 0x4532ab
cmp dword [ebp - 0x24], ebx
mov dword [ebp + 8], ebx
jle 0x4532ab
mov eax, dword [ebp - 0x80]
push ebx
push ebx
push ebx
push ebx
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
push eax
push edi
push dword [ebp + 8]
mov word [edi], bx
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x4532a0
push dword [ebp - 0xc]
lea ecx, [ebp - 0x18]
call fcn.004371ec
mov dword [ebp - 0xc], esi
inc dword [ebp + 8]
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 0x24]
jl 0x453270
cmp dword [ebp + 0xc], ebx
je 0x4532b9
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x30]
call fcn.00431c4c
jmp 0x453789
mov esi, dword [ebp - 0x24]
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x28]
push eax
push esi
push dword [ebp - 0xc]
push dword [ebp + 8]
call fcn.0043b309
mov edi, eax
mov eax, dword [ebp + 0xc]
add esp, 0x18
cmp eax, ebx
je 0x45334a
cmp word [esi], bx
jne 0x45330c
cmp eax, 2
jne 0x45330c
cmp edi, 0xfffffffe
jne 0x45330c
cmp dword [ebp - 0x2c], ebx
je 0x453789
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x49f928
jmp 0x45331d
cmp dword [ebp - 0x2c], ebx
mov dword [ebp - 0x50], eax
je 0x45332a
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.ERROR
mov ecx, dword [ebp - 0x1c]
call fcn.0043723b
jmp 0x453789
lea ecx, [ebp - 0x28]
call fcn.00431c4c
lea ecx, [ebp - 8]
call fcn.00431c4c
lea ecx, [ebp - 0x18]
call fcn.00431c4c
mov esi, dword [ebp + 0xc]
jmp 0x453d18
cmp dword [ebp - 0x30], ebx
jl 0x453369
jg 0x453356
cmp dword [ebp - 0x34], ebx
jb 0x453369
cmp dword [ebp - 0x34], edi
jne 0x453360
cmp dword [ebp - 0x30], ebx
je 0x453369
mov dword [ebp - 0xc], 1
jmp 0x45336c
mov dword [ebp - 0xc], ebx
cmp edi, 1
mov byte [ebp + 0xf], bl
mov byte [ebp + 0xb], 0xff
mov eax, str.REG_SZ
jne 0x453386
mov byte [ebp + 0xf], 0x24
mov byte [ebp + 0xb], bl
jmp 0x4533a4
cmp edi, 6
jne 0x453396
mov eax, str.REG_LINK
mov byte [ebp + 0xf], 0x5e
jmp 0x4533a4
cmp edi, 0x15
jne 0x4533fa
mov eax, str.REG_MUI_SZ
mov byte [ebp + 0xf], 0x75
cmp dword [ebp - 0x2c], ebx
je 0x4533bf
mov ecx, dword [ebp - 0x1c]
push 0xffffffffffffffff
push 0xffffffffffffffff
push eax
call fcn.0043723b
cmp dword [ebp - 0x14], ebx
jne 0x453789
cmp dword [ebp - 0xc], ebx
jne 0x45371e
cmp dword [ebp - 0x30], ebx
jg 0x4533e9
jl 0x4533d4
cmp dword [ebp - 0x34], ebx
jae 0x4533e9
mov al, byte [ebp - 1]
cmp byte [ebp + 0xf], al
je 0x4533e9
cmp al, 0x2e
je 0x4533e9
cmp byte [ebp + 0xb], al
jne 0x45371e
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x28], eax
jmp 0x453789
cmp edi, 0xb
jne 0x453460
cmp dword [ebp - 0x2c], ebx
je 0x45341e
mov ecx, dword [ebp - 0x1c]
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_QWORD
call fcn.0043723b
cmp dword [ebp - 0x14], ebx
jne 0x453789
cmp dword [ebp - 0xc], ebx
jne 0x45371e
cmp dword [ebp - 0x30], ebx
jg 0x453443
jl 0x453433
cmp dword [ebp - 0x34], ebx
jae 0x453443
cmp byte [ebp - 1], 0x2b
je 0x453443
cmp byte [ebp - 1], 0x2e
jne 0x45371e
mov eax, dword [ebp - 0x28]
push str.0x_I64x
push dword [eax + 4]
push dword [eax]
push dword [ebp - 0x18]
call fcn.00478179
add esp, 0x10
jmp 0x453789
cmp edi, 4
mov esi, dword [ebp - 0x28]
jne 0x4534ad
cmp dword [ebp - 0x2c], ebx
je 0x453487
mov ecx, dword [ebp - 0x1c]
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_DWORD
call fcn.0043723b
cmp dword [ebp - 0x14], ebx
jne 0x453789
cmp dword [ebp - 0xc], ebx
jne 0x45371e
cmp dword [ebp - 0x30], ebx
jg 0x45350c
jl 0x45349c
cmp dword [ebp - 0x34], ebx
jae 0x45350c
cmp byte [ebp - 1], 0x23
je 0x45350c
cmp byte [ebp - 1], 0x2e
je 0x45350c
jmp 0x45371e
cmp edi, 5
jne 0x453524
cmp dword [ebp - 0x2c], ebx
je 0x4534d1
mov ecx, dword [ebp - 0x1c]
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_DWORD_BIG_ENDIAN
call fcn.0043723b
cmp dword [ebp - 0x14], ebx
jne 0x453789
cmp dword [ebp - 0xc], ebx
jne 0x45371e
cmp dword [ebp - 0x30], ebx
jg 0x4534f6
jl 0x4534e6
cmp dword [ebp - 0x34], ebx
jae 0x4534f6
cmp byte [ebp - 1], 0x62
je 0x4534f6
cmp byte [ebp - 1], 0x2e
jne 0x45371e
mov cl, byte [esi + 3]
mov al, byte [esi]
mov byte [esi], cl
mov byte [esi + 3], al
mov cl, byte [esi + 2]
mov al, byte [esi + 1]
mov byte [esi + 1], cl
mov byte [esi + 2], al
push dword [esi]
push str.0x_x
push dword [ebp - 0x18]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x453789
cmp edi, 2
jne 0x453591
cmp dword [ebp - 0x2c], ebx
je 0x453548
mov ecx, dword [ebp - 0x1c]
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_EXPAND_SZ
call fcn.0043723b
cmp dword [ebp - 0x14], ebx
jne 0x453789
cmp dword [ebp - 0xc], ebx
jne 0x45371e
cmp dword [ebp - 0x30], ebx
jg 0x45356d
jl 0x45355d
cmp dword [ebp - 0x34], ebx
jae 0x45356d
cmp byte [ebp - 1], 0x7e
je 0x45356d
cmp byte [ebp - 1], 0x2e
jne 0x45371e
cmp byte [ebp - 0xd], bl
je 0x4533e9
mov eax, dword [ebp - 0x28]
push 1
push ebx
lea ecx, [ebp - 0x18]
push ecx
mov ecx, dword [ebp - 0x44]
push eax
mov dword [ebp - 0x3c], eax
call fcn.0043fdd2
jmp 0x453789
cmp edi, 7
jne 0x45367c
cmp dword [ebp - 0x2c], ebx
je 0x4535b9
mov ecx, dword [ebp - 0x1c]
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_MULTI_SZ
call fcn.0043723b
cmp dword [ebp - 0x14], ebx
jne 0x453789
cmp dword [ebp - 0xc], ebx
jne 0x45371e
cmp dword [ebp - 0x30], ebx
jg 0x4535de
jl 0x4535ce
cmp dword [ebp - 0x34], ebx
jae 0x4535de
cmp byte [ebp - 1], 0x2a
je 0x4535de
cmp byte [ebp - 1], 0x2e
jne 0x45371e
mov esi, dword [ebp - 0x6c]
shr esi, 1
lea eax, [esi*4 + 6]
push eax
lea ecx, [ebp - 0x18]
call fcn.004371c5
mov edi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
lea esi, [edi + esi*2]
cmp edi, esi
mov dword [ebp + 0xc], esi
jae 0x453674
push 2
pop esi
cmp byte [ebp - 0xd], 0x2a
jne 0x45363e
cmp word [edi], 0x5c
jne 0x45363e
lea ecx, [edi + 2]
mov dx, word [ecx]
cmp dx, 0x30
je 0x453629
cmp dx, 0x5c
je 0x453629
cmp dx, bx
jne 0x45363e
mov edi, ecx
mov word [eax], 0x5c
mov cx, word [edi]
add eax, esi
mov word [eax], cx
add eax, esi
add edi, esi
jmp 0x45366f
mov cx, word [edi]
cmp cx, bx
jne 0x453635
add edi, esi
cmp byte [ebp - 0xd], 0x24
jne 0x453661
cmp edi, dword [ebp + 0xc]
jae 0x453674
mov word [eax], 0xd
add eax, esi
mov word [eax], 0xa
jmp 0x45366d
mov word [eax], 0x5c
add eax, esi
mov word [eax], 0x30
add eax, esi
cmp edi, dword [ebp + 0xc]
jb 0x453606
mov word [eax], bx
jmp 0x453789
cmp edi, 3
jne 0x453688
mov eax, str.REG_BINARY
jmp 0x4536b5
cmp edi, ebx
jne 0x453693
mov eax, str.REG_NONE
jmp 0x4536b5
cmp edi, 8
jne 0x45369f
mov eax, str.REG_RESOURCE_LIST
jmp 0x4536b5
cmp edi, 9
jne 0x4536ab
mov eax, str.REG_FULL_RESOURCE_DESCRIPTOR
jmp 0x4536b5
cmp edi, 0xa
jne 0x4536d6
mov eax, str.REG_RESOURCE_REQUIREMENTS_LIST
cmp dword [ebp - 0x2c], ebx
je 0x4536d0
mov ecx, dword [ebp - 0x1c]
push 0xffffffffffffffff
push 0xffffffffffffffff
push eax
call fcn.0043723b
cmp dword [ebp - 0x14], ebx
jne 0x453789
mov byte [ebp + 0xf], 0x40
jmp 0x453701
cmp dword [ebp - 0x2c], ebx
je 0x453701
mov esi, dword [ebp - 0x1c]
push 0x32
mov ecx, esi
call fcn.004371c5
push edi
push str.0x_lx
push dword [esi]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
cmp dword [ebp - 0x14], ebx
jne 0x453789
cmp dword [ebp - 0x30], ebx
jg 0x453719
jl 0x45370d
cmp dword [ebp - 0x34], ebx
jae 0x453719
mov al, byte [ebp - 1]
cmp byte [ebp + 0xf], al
je 0x453719
cmp al, 0x2e
jne 0x45371e
cmp dword [ebp - 0xc], ebx
je 0x45373b
lea ecx, [ebp - 0x28]
call fcn.00431c4c
lea ecx, [ebp - 8]
call fcn.00431c4c
lea ecx, [ebp - 0x18]
call fcn.00431c4c
jmp 0x453095
mov eax, dword [ebp - 0x6c]
lea eax, [eax + eax*4 + 7]
push eax
lea ecx, [ebp - 0x18]
call fcn.004371c5
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x28]
mov word [eax], bx
mov word [eax + 2], bx
xor edi, edi
cmp dword [ebp - 0x6c], ebx
mov dword [ebp + 0xc], eax
mov dword [ebp - 0x60], 1
jle 0x453789
movzx eax, byte [esi]
push eax
push str._0x_02X
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_wsprintfW]
add dword [ebp + 0xc], 0xa
add esp, 0xc
inc esi
inc edi
cmp edi, dword [ebp - 0x6c]
jl 0x453769
mov eax, dword [ebp - 0x4c]
cmp word [eax], bx
je 0x4537a4
mov edx, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx + edx*2]
push ecx
mov ecx, dword [ebp - 0x44]
push eax
call fcn.00436b54
mov eax, dword [ebp - 0x68]
cmp word [eax], bx
je 0x4537ba
mov ecx, dword [ebp - 0x1c]
push dword [ecx]
mov ecx, dword [ebp - 0x44]
push eax
call fcn.00436b54
lea ecx, [ebp - 0x28]
call fcn.00431c4c
lea ecx, [ebp - 8]
call fcn.00431c4c
lea ecx, [ebp - 0x18]
call fcn.00431c4c
mov esi, dword [ebp - 0x50]
jmp 0x453d18
mov esi, dword [ebp - 0x1c]
cmp esi, ebx
je 0x453c90
cmp byte [ebp - 0x1e], bl
mov dword [ebp + 0xc], ebx
jne 0x4537f2
cmp byte [ebp - 0x1d], bl
je 0x453842
push ebx
lea eax, [ebp - 0x48]
push eax
movzx eax, word [0x4afb70]
push ebx
or eax, 0x2001b
push eax
xor eax, eax
cmp byte [ebp - 0x1e], bl
mov dword [ebp - 0x48], ebx
setne al
push eax
push ebx
push ebx
push dword [ebp - 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp dword [ebp - 0x48], ebx
mov edi, eax
je 0x45382f
push dword [ebp - 0x48]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x1e], 2
jge 0x453c81
cmp byte [ebp - 0x1d], bl
jne 0x453c81
mov cl, byte [ebp - 1]
cmp cl, 0x2b
je 0x45385c
cmp cl, bl
jne 0x45388d
mov ax, word [esi]
cmp ax, 0x2b
jne 0x4538c0
inc esi
inc esi
mov dword [ebp - 0x1c], esi
cmp byte [ebp - 4], bl
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], ebx
lea edi, [ebp - 0x54]
je 0x453c18
movsx eax, byte [ebp - 3]
push eax
lea eax, [ebp + 0xc]
push eax
push esi
call fcn.0043b3f4
mov edi, dword [ebp + 0xc]
add esp, 0xc
push 8
push edi
push 0xb
jmp 0x453b0c
cmp cl, 0x23
je 0x4538cf
cmp cl, 0x62
jne 0x453970
cmp byte [ebp - 4], bl
mov dword [ebp - 8], ebx
lea edi, [ebp - 8]
je 0x4538f8
movsx eax, byte [ebp - 3]
push eax
lea eax, [ebp + 0xc]
push eax
push esi
call fcn.0043b3f4
mov edi, dword [ebp + 0xc]
add esp, 0xc
jmp 0x453966
cmp ax, 0x23
jne 0x453997
inc esi
inc esi
mov dword [ebp - 0x1c], esi
cmp byte [ebp - 4], bl
mov dword [ebp - 0x14], ebx
lea edi, [ebp - 0x14]
je 0x453bbc
movsx eax, byte [ebp - 3]
push eax
lea eax, [ebp + 0xc]
push eax
push esi
call fcn.0043b3f4
mov edi, dword [ebp + 0xc]
add esp, 0xc
jmp 0x453c0e
cmp byte [ebp - 3], bl
je 0x453934
xor ecx, ecx
mov cx, word [esi]
mov eax, ecx
call fcn.00436d9b
test al, al
je 0x453ae8
cmp cx, 0x30
jne 0x453928
mov ax, word [esi + 2]
or ax, 0x20
cmp ax, 0x78
jne 0x453928
add esi, 4
push esi
call fcn.00437c0e
pop ecx
mov dword [ebp - 8], eax
jmp 0x45394e
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00439fac
xor esi, esi
inc esi
cmp eax, esi
pop ecx
pop ecx
jl 0x453c74
mov al, byte [ebp - 8]
mov cl, byte [ebp - 5]
mov byte [ebp - 8], cl
mov cl, byte [ebp - 6]
mov byte [ebp - 5], al
mov al, byte [ebp - 7]
mov byte [ebp - 7], cl
mov byte [ebp - 6], al
push 4
push edi
push 5
jmp 0x453b0c
cmp cl, 0x2a
je 0x4539a3
cmp cl, 0x7e
je 0x453a58
cmp cl, 0x40
je 0x453ab3
cmp cl, 0x6e
jne 0x453abe
xor edi, edi
jmp 0x453ab6
cmp ax, 0x2a
jne 0x453a50
inc esi
inc esi
cmp byte [ebp - 4], bl
push 7
pop edi
mov dword [ebp - 0x30], ebx
jne 0x453b40
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x50], eax
add eax, 0x10
push eax
lea ecx, [ebp + 0xc]
xor edi, edi
call fcn.004371c5
mov ecx, dword [ebp - 0x50]
mov edx, dword [ebp + 0xc]
lea ecx, [esi + ecx*2]
cmp esi, ecx
mov eax, esi
mov dword [ebp - 0x60], ecx
jae 0x453a18
cmp byte [ebp - 0xd], 0x2a
mov word [edx], bx
jne 0x453b67
cmp word [eax], 0x5c
jne 0x453b9a
lea ecx, [eax + 2]
cmp word [ecx], 0x5c
jne 0x453b9a
mov eax, ecx
mov cx, word [eax]
mov word [edx], cx
inc edx
inc edx
inc eax
inc eax
xor edi, edi
cmp eax, dword [ebp - 0x60]
jb 0x4539dc
cmp edi, 1
jge 0x453a1e
inc edi
mov word [edx], bx
inc edx
inc edx
cmp dword [ebp - 0x50], ebx
jle 0x453a3f
cmp edi, 2
jge 0x453a3f
push 2
pop esi
sub esi, edi
xor eax, eax
mov ecx, esi
shr ecx, 1
mov edi, edx
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
lea edx, [edx + esi*2]
mov word [edx], bx
sub edx, dword [ebp + 0xc]
push edx
push dword [ebp + 0xc]
push 7
jmp 0x453b0c
cmp ax, 0x7e
jne 0x453aab
inc esi
inc esi
cmp byte [ebp - 4], bl
push 2
pop edi
mov dword [ebp - 0x30], ebx
jne 0x453b40
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
push eax
lea ecx, [ebp + 0xc]
call fcn.004371c5
cmp word [esi], bx
mov eax, dword [ebp + 0xc]
mov ecx, esi
je 0x453b34
mov dx, word [ecx]
cmp dx, 0x5c
jne 0x453b24
cmp word [ecx + 2], 0x30
jne 0x453b24
mov word [eax], bx
add eax, edi
add ecx, 4
jmp 0x453b2b
cmp ax, 0x40
jne 0x453abe
inc esi
inc esi
push 3
pop edi
mov dword [ebp - 0x30], ebx
jmp 0x453b40
cmp dword [ebp - 0x30], ebx
jg 0x453b3d
jl 0x453acc
mov edi, dword [ebp - 0x34]
cmp edi, ebx
jae 0x453b40
cmp cl, 0x5e
jne 0x453ad5
push 6
jmp 0x453adc
cmp cl, 0x75
jne 0x453adf
push 0x15
pop edi
jmp 0x453af8
cmp cl, bl
je 0x453af5
cmp cl, 0x24
je 0x453af5
lea ecx, [ebp + 0xc]
call fcn.00431c4c
jmp 0x453095
xor edi, edi
inc edi
cmp byte [ebp - 4], bl
mov dword [ebp - 0x30], ebx
jne 0x453b40
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
push eax
push esi
push edi
push dword [ebp - 0x24]
push dword [ebp - 0xc]
push dword [ebp + 8]
call fcn.00432b38
add esp, 0x18
mov esi, eax
jmp 0x453c74
mov word [eax], dx
add eax, edi
add ecx, edi
cmp word [ecx], bx
jne 0x453a86
sub eax, dword [ebp + 0xc]
push eax
push dword [ebp + 0xc]
jmp 0x453b0b
mov edi, dword [ebp - 0x34]
movsx eax, byte [ebp - 3]
push eax
lea eax, [ebp + 0xc]
push eax
push esi
call fcn.0043b3f4
push eax
push dword [ebp + 0xc]
push edi
push dword [ebp - 0x24]
push dword [ebp - 0xc]
push dword [ebp + 8]
call fcn.00432b38
add esp, 0x24
jmp 0x453b1d
cmp byte [ebp - 0xd], 0x24
jne 0x453b9a
mov cx, word [eax]
cmp cx, 0xd
jne 0x453b83
lea esi, [eax + 2]
cmp word [esi], 0xa
jne 0x453b83
mov eax, esi
jmp 0x453b8d
cmp cx, 0xa
jne 0x453a05
inc eax
inc eax
mov word [edx], bx
inc edx
inc edx
inc edi
jmp 0x453a0e
mov cx, word [eax]
cmp cx, 0x5c
jne 0x453a05
cmp word [eax + 2], 0x30
jne 0x453a05
mov word [edx], bx
inc edx
inc edx
add eax, 4
jmp 0x453b94
cmp byte [ebp - 3], bl
je 0x453bf8
xor ecx, ecx
mov cx, word [esi]
mov eax, ecx
call fcn.00436d9b
test al, al
je 0x453ae8
cmp cx, 0x30
jne 0x453bec
mov ax, word [esi + 2]
or ax, 0x20
cmp ax, 0x78
jne 0x453bec
add esi, 4
push esi
call fcn.00437c0e
pop ecx
mov dword [ebp - 0x14], eax
jmp 0x453c0e
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00439fac
xor esi, esi
inc esi
cmp eax, esi
pop ecx
pop ecx
jl 0x453c74
push 4
push edi
push 4
jmp 0x453b0c
cmp byte [ebp - 3], bl
je 0x453c5a
xor ecx, ecx
mov cx, word [esi]
mov eax, ecx
call fcn.00436d9b
test al, al
je 0x453ae8
cmp cx, 0x30
jne 0x453c48
mov ax, word [esi + 2]
or ax, 0x20
cmp ax, 0x78
jne 0x453c48
add esi, 4
push esi
call fcn.00437c0e
pop ecx
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], edx
jmp 0x453883
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00439f88
xor esi, esi
inc esi
cmp eax, esi
pop ecx
pop ecx
jge 0x453883
lea ecx, [ebp + 0xc]
call fcn.00431c4c
jmp 0x453d18
lea ecx, [ebp + 0xc]
call fcn.00431c4c
mov esi, edi
jmp 0x453d18
cmp byte [ebp - 0x36], 0x21
jne 0x453cc2
mov eax, dword [ebp - 0x24]
cmp word [eax], bx
jne 0x453cc2
cmp dword [ebp - 0x14], ebx
je 0x453cb3
push dword [ebp - 0x14]
push dword [ebp - 0xc]
push dword [ebp + 8]
call fcn.00438d9d
jmp 0x453d0c
push dword [ebp - 0xc]
push dword [ebp + 8]
call fcn.00442d5a
pop ecx
pop ecx
jmp 0x453d0f
cmp dword [ebp - 0x14], ebx
je 0x453cfe
push ebx
lea eax, [ebp + 0xc]
push eax
movzx eax, word [0x4afb70]
push ebx
or eax, 0x2001b
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0xc]
mov dword [ebp + 0xc], ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp dword [ebp + 0xc], ebx
mov esi, eax
je 0x453d11
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x453d11
push dword [ebp - 0x24]
push dword [ebp - 0xc]
push dword [ebp + 8]
call fcn.00432b84
add esp, 0xc
mov esi, eax
cmp esi, 2
jne 0x453d18
xor esi, esi
lea ecx, [ebp - 0x74]
call fcn.00431c4c
lea ecx, [ebp - 0x5c]
call fcn.00431c4c
lea ecx, [ebp - 0x68]
call fcn.00431c4c
lea ecx, [ebp - 0x64]
call fcn.00431c4c
lea ecx, [ebp - 0x4c]
call fcn.00431c4c
lea ecx, [ebp - 0x7c]
call fcn.00431c4c
lea ecx, [ebp - 0x58]
call fcn.00431c4c
lea ecx, [ebp - 0x70]
call fcn.00431c4c
lea ecx, [ebp - 0x8c]
call fcn.00431c4c
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8