Function at 0x464650
Capabilities:
Delete registry value
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fb401
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x29e0
call fcn.004f2630
push ebx
push esi
push edi
lea eax, [ebp - 0x1a8]
mov dword [ebp - 0x10], esp
xor edi, edi
push eax
mov dword [ebp - 4], edi
call fcn.004ab6e0
add esp, 4
lea ecx, [ebp - 0x98]
push ecx
call fcn.00401350
add esp, 4
mov dword [ebp - 0x44], edi
call fcn.004b1530
call fcn.004ac240
call fcn.004ac4a0
call fcn.004ac6c0
call fcn.004ac8e0
call fcn.004acb00
call fcn.004acd20
call fcn.004acf40
call fcn.004ad160
lea edx, [ebp - 0x44]
lea eax, [ebp - 0x29f0]
push edx
push eax
call fcn.004c6c30
add esp, 8
cmp edi, dword [ebp - 0x44]
jge 0x4647af
mov ecx, edi
shl ecx, 7
lea esi, [ebp + ecx - 0x29f0]
push esi
call fcn.004ad380
add esp, 4
push esi
call fcn.004ad610
add esp, 4
push esi
call fcn.004ad890
add esp, 4
push esi
call fcn.004adb10
add esp, 4
push esi
call fcn.004add90
add esp, 4
push esi
call fcn.004ae020
add esp, 4
push esi
call fcn.004ae2a0
add esp, 4
push esi
call fcn.004ae520
add esp, 4
push esi
call fcn.004ad380
add esp, 4
lea edx, [ebp - 0x670]
mov byte [ebp - 0x670], 0
push esi
push str._sSoftwareMicrosoftWindows_NTCurrentVersionWindows
push edx
call fcn.004f175f
lea eax, [ebp - 0x670]
push str.load
push eax
push str.HKCU
call fcn.004bf570
add esp, 0x18
lea ecx, [ebp - 0x670]
mov byte [ebp - 0x670], 0
push esi
push str._sSoftwareMicrosoftWindows_NTCurrentVersionWindows
push ecx
call fcn.004f175f
lea edx, [ebp - 0x670]
push 0x5142f8
push edx
push str.HKCU
call fcn.004bf570
add esp, 0x18
inc edi
jmp 0x4646df
call fcn.004af8c0
call fcn.004afb80
call fcn.004afe00
call fcn.004b0080
call fcn.004b0320
call fcn.004b05b0
call fcn.004b0830
call fcn.004b0ab0
call fcn.004b0d30
call fcn.004b0f70
call fcn.004b1190
call fcn.004af1e0
call fcn.004af480
call fcn.004af6c0
call fcn.004b1500
mov ebx, 1
mov esi, eax
push ebx
lea ecx, [ebp - 0xe0]
mov dword [ebp - 0x5c], esi
call fcn.004f0653
push ebx
lea ecx, [ebp - 0x1f0]
mov byte [ebp - 4], bl
call fcn.004f0653
push 0x2c0
mov byte [ebp - 4], 2
call fcn.004f266a
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
add esp, 4
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x570]
push 0x80
push eax
call edi
lea ecx, [ebp - 0x8f0]
push 0x80
push ecx
call edi
push ebx
lea ecx, [ebp - 0x128]
call fcn.004f0653
mov edx, dword [0x4fe4e8]
lea ecx, [ebp - 0x128]
push edx
push ebx
push str.c:endpcache_auto_repair.txt
mov byte [ebp - 4], 3
mov dword [ebp - 0x38], 0
call fcn.004f0727
mov eax, dword [ebp - 0x128]
mov ecx, dword [eax + 4]
mov eax, dword [ebp + ecx - 0x124]
cmp dword [eax + 0x30], 0xffffffff
je 0x464908
mov edi, dword [ebp - 0x124]
push 0xa
lea edx, [ebp - 0x4f0]
inc edi
push 0x40
push edx
lea ecx, [ebp - 0x128]
mov dword [ebp - 0x124], edi
call fcn.004f0ae9
lea edi, [ebp - 0x4f0]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 2
jle 0x464908
lea eax, [ebp - 0x4f0]
push str.close
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4648ed
mov dword [ebp - 0x38], ebx
lea ecx, [ebp - 0x4f0]
push str.startup
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x464908
mov dword [ebp - 0x38], ebx
lea ecx, [ebp - 0x128]
call fcn.004f076e
mov edx, dword [0x4fe4e8]
lea ecx, [ebp - 0xe0]
push edx
push 2
push str.c:endpcacheprocess_log_HKLM.txt
call fcn.004f0727
push 0x100
push 0
push str.c:endpcacheprocess_start_list.txt
mov dword [ebp - 0x24], 0
call fcn.004f2f2b
mov edi, eax
add esp, 0xc
cmp edi, 0xffffffff
je 0x46495d
push edi
call fcn.004f2eb3
push edi
call fcn.004f2e00
add esp, 8
mov eax, dword [0x4fe4e8]
lea ecx, [ebp - 0x1f0]
push eax
push 8
push str.c:endpcacheprocess_start_list.txt
call fcn.004f0727
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
cmp ebx, esi
jge 0x465808
xor eax, eax
push ebx
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x18], eax
call fcn.004b1510
mov esi, eax
or ecx, 0xffffffff
mov edi, esi
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 4
jge 0x464adc
test ecx, ecx
jle 0x464adc
lea ecx, [ebp - 0x14]
push ebx
push ecx
call fcn.004b1440
mov edx, dword [ebp - 0x14]
add esp, 8
add edx, 0x40
push edx
call fcn.004fa6c0
mov esi, eax
mov eax, dword [ebp - 0x14]
push eax
call fcn.004fa6c0
push str.HKEY_LOCAL_MACHINE
push eax
call fcn.004f61e0
add esp, 0x10
test eax, eax
jne 0x464a02
lea ecx, [ebp - 0x60]
lea edx, [ebp - 0x30]
push ecx
push edx
push eax
push 2
push eax
push 0xc30c0c
push eax
push esi
push closesocket
jmp 0x464a1d
lea eax, [ebp - 0x60]
lea ecx, [ebp - 0x30]
push eax
push ecx
push 0
push 2
push 0
push 0xc30c0c
push 0
push esi
push reloc.WS2_32.dll_closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x464ad3
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x30]
add edx, 0x140
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x464a4d
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x14]
push str.load
add edx, 0x140
mov byte [ebp - 0x470], 0
push edx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x464ad3
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x98]
add eax, 0x140
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x1a8]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x470]
push 0x51719c
push eax
call fcn.004f175f
add esp, 0x14
lea ecx, [ebp - 0x470]
push ecx
lea ecx, [ebp - 0xd4]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov edx, dword [ebp - 0x30]
push edx
jmp 0x4657f3
push str.c:endpcachedownAutohc.exe
push esi
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x4657f9
push str._ProgramFiles_Windows_SidebarSidebar.exe__autoRun
push esi
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x4657f9
push str._ProgramFiles_Windows_SidebarSidebar.exe
push esi
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4657f9
push str.c:endpcache
push esi
call fcn.004f2d80
push str.soundman.exe
push esi
call fcn.004f61e0
add esp, 0x10
test eax, eax
jne 0x464b48
cmp dword [0xe56bd8], 1
je 0x4657f9
lea eax, [ebp - 0x570]
lea ecx, [ebp - 0x470]
push eax
push str._sctfmon.exe
push ecx
mov byte [ebp - 0x470], 0
call fcn.004f175f
lea edx, [ebp - 0x470]
push edx
push esi
call fcn.004f61e0
add esp, 0x14
test eax, eax
je 0x4657f9
lea eax, [ebp - 0x570]
lea ecx, [ebp - 0x470]
push eax
push str._sinternat.exe
push ecx
mov byte [ebp - 0x470], 0
call fcn.004f175f
lea edx, [ebp - 0x470]
push edx
push esi
call fcn.004f61e0
add esp, 0x14
test eax, eax
je 0x4657f9
push str.ctfmon.exe
push esi
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x4657f9
push str.internat.exe
push esi
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x4657f9
push str._system32ctfmon.exe
push esi
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4657f9
push str._system32internat.exe
push esi
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4657f9
push str.System32ctfmon.exe
push esi
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4657f9
push str.System32internat.exe
push esi
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4657f9
push str.stem32dumprep
push esi
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4657f9
push str.IMETINTLGNTTINTSETP.EXE
push esi
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4657f9
push str.IMEimjp8_1IMJPMIG.EXE
push esi
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4657f9
push str.NvCpl.dll_NvStartup
push esi
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4657f9
push str.IgAgent.exe
push esi
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x4657f9
mov eax, dword [0xe56da0]
mov ebx, 1
cmp eax, ebx
jne 0x464cea
push str.ShowWelcomeCenter
push esi
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4657f9
cmp dword [0xe56da0], ebx
jne 0x464cea
push str.Core_StaticCLIStart.exe
push esi
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4657f9
push str..bat
push esi
call fcn.004f2d80
push str..reg
push esi
call fcn.004f2d80
push str..com
push esi
call fcn.004f2d80
add esp, 0x18
test eax, eax
je 0x464d20
push str..com_
push esi
call fcn.004f2d80
add esp, 8
push str..pif
push esi
call fcn.004f2d80
push str..scr
push esi
call fcn.004f2d80
push str..hta
push esi
call fcn.004f2d80
push str..vbs
push esi
call fcn.004f2d80
add esp, 0x20
test eax, eax
je 0x464d5e
cmp dword [0xe56bec], ebx
jne 0x464d5e
mov dword [ebp - 0x18], ebx
push str..VBS
push esi
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x464d7b
cmp dword [0xe56bec], ebx
jne 0x464d7b
mov dword [ebp - 0x18], ebx
push str..Vbs
push esi
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x464d98
cmp dword [0xe56bec], ebx
jne 0x464d98
mov dword [ebp - 0x18], ebx
push str..vba
push esi
call fcn.004f2d80
push 0x516fc8
push esi
call fcn.004f2d80
push str..bmp
push esi
call fcn.004f2d80
push str..BMP
push esi
call fcn.004f2d80
push 0x516860
push esi
call fcn.004f2d80
push str..jse
push esi
call fcn.004f2d80
push str..wsf
push esi
call fcn.004f2d80
push str..wsh
push esi
call fcn.004f2d80
add esp, 0x40
push str.regedit
push esi
call fcn.004f2d80
push str.http
push esi
call fcn.004f2d80
push str.Http
push esi
call fcn.004f2d80
push 0x51688c
push esi
call fcn.004f2d80
push str.Rundll32
push esi
call fcn.004f2d80
push 0x5222fc
push esi
call fcn.004f2d80
push str.IEXPLORE
push esi
call fcn.004f2d80
push str.Temp
push esi
call fcn.004f2d80
add esp, 0x40
push str.Application_Data
push esi
call fcn.004f2d80
push str.windows_
push esi
call fcn.004f2d80
push str.WINDOWS_
push esi
call fcn.004f2d80
push str.WINNT_
push esi
call fcn.004f2d80
push str.winnt_
push esi
call fcn.004f2d80
push str._system
push esi
call fcn.004f2d80
push str.System
push esi
call fcn.004f2d80
push str.regsvr32
push esi
call fcn.004f2d80
add esp, 0x40
push 0x5147e0
push esi
call fcn.004f2d80
push 0x516f24
push esi
call fcn.004f2d80
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
dec ecx
xor edx, edx
cmp eax, ecx
jge 0x464ede
cmp byte [eax + esi], 0x5c
jne 0x464edb
inc edx
inc eax
jmp 0x464ed0
push 0x515e8c
push esi
call fcn.004f2d80
push 0x515e88
push esi
call fcn.004f2d80
push str..pif
push esi
call fcn.004f2d80
push str..Pif
push esi
call fcn.004f2d80
push str..kxp
push esi
call fcn.004f2d80
mov eax, dword [0xe56be4]
add esp, 0x28
xor edi, edi
cmp eax, ebx
mov byte [ebp - 0x470], 0
jne 0x464f6a
xor ebx, ebx
mov dword [ebp - 0x20], ebx
cmp ebx, 2
jge 0x464f64
shl ebx, 8
push esi
lea eax, [ebx + 0xc5159c]
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x464f59
lea ecx, [ebx + 0x510324]
push ecx
call fcn.004fa6c0
jmp 0x464f70
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
mov ebx, eax
jmp 0x464f2f
xor eax, eax
test eax, eax
jne 0x464f75
push esi
call fcn.00410fd0
add esp, 4
mov edi, eax
push str.load
push str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
push str.HKCU
call fcn.004bf570
add esp, 0xc
push 0x5147b4
push edi
call fcn.004f2d80
push 0x5144fc
push edi
mov ebx, eax
call fcn.004f2d80
push 0x516f10
push edi
mov dword [ebp - 0x20], eax
call fcn.004f2d80
push 0x5222e0
push edi
mov dword [ebp - 0x58], eax
call fcn.004f2d80
push 0x5222d4
push edi
call fcn.004f2d80
push 0x516efc
push edi
mov dword [ebp - 0x50], eax
call fcn.004f2d80
push 0x5222c8
push edi
mov dword [ebp - 0x48], eax
call fcn.004f2d80
push str..NET
push edi
mov dword [ebp - 0x74], eax
call fcn.004f2d80
add esp, 0x40
mov dword [ebp - 0x4c], eax
test ebx, ebx
jne 0x4650d4
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x4650d4
mov eax, dword [ebp - 0x58]
test eax, eax
jne 0x4650d4
mov eax, dword [ebp - 0x50]
test eax, eax
jne 0x4650d4
mov eax, dword [ebp - 0x48]
test eax, eax
jne 0x4650d4
mov eax, dword [ebp - 0x74]
test eax, eax
jne 0x4650d4
mov eax, dword [ebp - 0x4c]
test eax, eax
jne 0x4650d4
push edi
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x98]
push eax
push esi
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x1a8]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x470]
push eax
push 0x516eb4
push ecx
call fcn.004f175f
mov edx, dword [0xe56d24]
mov ecx, dword [0xe56d68]
add esp, 0x18
inc edx
mov dword [0xe56d24], edx
inc ecx
lea edx, [ebp - 0x470]
mov dword [0xe56d68], ecx
push edx
lea ecx, [ebp - 0xd4]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov ebx, 1
mov edi, ebx
mov dword [ebp - 0x24], ebx
jmp 0x465181
push edi
lea eax, [ebp - 0x98]
push esi
push eax
mov byte [ebp - 0x470], 0
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x1a8]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x470]
push eax
push 0x516e8c
push edx
call fcn.004f175f
add esp, 0x18
lea eax, [ebp - 0x470]
lea ecx, [ebp - 0xd4]
push eax
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x46515b
mov eax, dword [ebp - 0x58]
test eax, eax
jne 0x46515b
mov eax, dword [ebp - 0x50]
test eax, eax
jne 0x46515b
mov eax, dword [ebp - 0x48]
test eax, eax
jne 0x46515b
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x465165
mov ebx, 1
mov dword [ebp - 0x18], ebx
jmp 0x46516a
mov ebx, 1
push str.StarSoftComm
push edi
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x46517f
mov dword [ebp - 0x54], ebx
xor edi, edi
push str.StartPowerManager
push esi
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4651cd
push str.StartBattLog
push esi
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4651cd
push str.PwrMgrBkGndMonitor
push esi
call fcn.004f2d80
add esp, 8
test eax, eax
jne 0x4651cd
push str.Bluetooth
push esi
call fcn.004f2d80
add esp, 8
test eax, eax
je 0x4652d1
mov dword [ebp - 0x18], ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp dword [ebp - 0x38], ebx
jne 0x46556a
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x46556a
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x98]
add eax, 0x140
mov byte [ebp - 0x470], 0
push eax
push esi
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x1a8]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x470]
push 0x516dac
push eax
call fcn.004f175f
add esp, 0x18
lea ecx, [ebp - 0x470]
push ecx
lea ecx, [ebp - 0xd4]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x14]
push edx
push eax
call fcn.004b1440
mov ecx, dword [ebp - 0x14]
add esp, 8
add ecx, 0x40
push ecx
call fcn.004fa6c0
mov edx, dword [ebp - 0x14]
mov ebx, eax
add edx, 0x40
push edx
call fcn.004fa6c0
push eax
lea eax, [ebp - 0x770]
push 0x50d39c
push eax
call fcn.004f175f
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.004fa6c0
push str.HKEY_LOCAL_MACHINE
push eax
call fcn.004f61e0
add esp, 0x20
test eax, eax
jne 0x465512
lea edx, [ebp - 0x78]
lea eax, [ebp - 0x3c]
push edx
push eax
push 0
push 2
push 0
push 0xc30c0c
push 0
push ebx
push closesocket
jmp 0x465533
cmp edi, ebx
jne 0x4653ed
lea ecx, [ebp - 0x98]
push esi
push ecx
mov byte [ebp - 0x470], 0
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x1a8]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x470]
push 0x516de0
push eax
call fcn.004f175f
add esp, 0x14
lea ecx, [ebp - 0x470]
push ecx
lea ecx, [ebp - 0xd4]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x14]
push edx
push eax
mov dword [ebp - 0x24], ebx
call fcn.004b1440
mov ecx, dword [ebp - 0x14]
add esp, 8
add ecx, 0x40
push ecx
call fcn.004fa6c0
mov edx, dword [ebp - 0x14]
mov edi, eax
push edx
call fcn.004fa6c0
push str.HKEY_LOCAL_MACHINE
push eax
call fcn.004f61e0
add esp, 0x10
test eax, eax
jne 0x465395
lea eax, [ebp - 0x6c]
lea ecx, [ebp - 0x28]
push eax
push ecx
push 0
push 2
push 0
push 0xc30c0c
push 0
push edi
push closesocket
jmp 0x4653b0
lea edx, [ebp - 0x6c]
lea eax, [ebp - 0x28]
push edx
push eax
push 0
push 2
push 0
push 0xc30c0c
push 0
push edi
push reloc.WS2_32.dll_closesocket
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
call edi
test eax, eax
jne 0x4653de
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x28]
add ecx, 0x140
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x4653de
mov eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4651d6
cmp edi, 2
jne 0x4651d0
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x4651d0
lea edx, [ebp - 0x98]
push esi
push edx
mov byte [ebp - 0x470], 0
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x1a8]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x470]
push eax
push 0x522264
push ecx
call fcn.004f175f
add esp, 0x14
lea edx, [ebp - 0x470]
lea ecx, [ebp - 0xd4]
push edx
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x14]
push eax
push ecx
mov dword [ebp - 0x24], ebx
call fcn.004b1440
mov edx, dword [ebp - 0x14]
add esp, 8
add edx, 0x40
push edx
call fcn.004fa6c0
mov edi, eax
mov eax, dword [ebp - 0x14]
push eax
call fcn.004fa6c0
push str.HKEY_LOCAL_MACHINE
push eax
call fcn.004f61e0
add esp, 0x10
test eax, eax
jne 0x4654ba
lea ecx, [ebp - 0x70]
lea edx, [ebp - 0x40]
push ecx
push edx
push eax
push 2
push eax
push 0xc30c0c
push eax
push edi
push closesocket
jmp 0x4654d5
lea eax, [ebp - 0x70]
lea ecx, [ebp - 0x40]
push eax
push ecx
push 0
push 2
push 0
push 0xc30c0c
push 0
push edi
push reloc.WS2_32.dll_closesocket
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
call edi
test eax, eax
jne 0x465503
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x40]
add edx, 0x140
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x465503
mov ecx, dword [ebp - 0x40]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x40]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4651d6
lea ecx, [ebp - 0x78]
lea edx, [ebp - 0x3c]
push ecx
push edx
push 0
push 2
push 0
push 0xc30c0c
lea eax, [ebp - 0x770]
push 0
push eax
push reloc.WS2_32.dll_closesocket
call edi
test eax, eax
jne 0x46555b
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x3c]
add ecx, 0x140
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x46555b
mov eax, dword [ebp - 0x3c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x3c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, 1
cmp dword [ebp - 0x54], ebx
jne 0x4656a3
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x98]
add edx, 0x140
mov byte [ebp - 0x470], 0
push edx
push esi
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x1a8]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x470]
push eax
push 0x516dac
push edx
call fcn.004f175f
add esp, 0x18
lea eax, [ebp - 0x470]
lea ecx, [ebp - 0xd4]
push eax
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov ecx, dword [ebp - 0x1c]
lea edx, [ebp - 0x14]
push ecx
push edx
call fcn.004b1440
mov eax, dword [ebp - 0x14]
add esp, 8
add eax, 0x40
push eax
call fcn.004fa6c0
mov ecx, dword [ebp - 0x14]
mov ebx, eax
add ecx, 0x40
push ecx
call fcn.004fa6c0
push eax
lea edx, [ebp - 0x9f0]
push 0x50d39c
push edx
call fcn.004f175f
mov eax, dword [ebp - 0x14]
push eax
call fcn.004fa6c0
push str.HKEY_LOCAL_MACHINE
push eax
call fcn.004f61e0
add esp, 0x20
test eax, eax
jne 0x465651
lea ecx, [ebp - 0x64]
lea edx, [ebp - 0x34]
push ecx
push edx
push eax
push 2
push eax
push 0xc30c0c
push eax
push ebx
push closesocket
jmp 0x465672
lea eax, [ebp - 0x64]
lea ecx, [ebp - 0x34]
push eax
push ecx
push 0
push 2
push 0
push 0xc30c0c
lea edx, [ebp - 0x9f0]
push 0
push edx
push reloc.WS2_32.dll_closesocket
call edi
test eax, eax
jne 0x465699
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x34]
add eax, 0x140
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x465699
mov edx, dword [ebp - 0x34]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x5c]
mov edi, dword [ebp - 0x44]
sub ecx, edi
sub ecx, 5
cmp ecx, 0xdc
jle 0x4657f9
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x4657f9
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x98]
add edx, 0x140
mov byte [ebp - 0x470], 0
push edx
push esi
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x1a8]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x470]
push eax
push 0x516dac
push edx
call fcn.004f175f
add esp, 0x18
lea eax, [ebp - 0x470]
lea ecx, [ebp - 0xd4]
push eax
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov ecx, dword [ebp - 0x1c]
lea edx, [ebp - 0x14]
push ecx
push edx
call fcn.004b1440
mov eax, dword [ebp - 0x14]
add esp, 8
add eax, 0x40
push eax
call fcn.004fa6c0
mov ecx, dword [ebp - 0x14]
mov esi, eax
add ecx, 0x40
push ecx
call fcn.004fa6c0
push eax
lea edx, [ebp - 0x870]
push 0x50d39c
push edx
call fcn.004f175f
mov eax, dword [ebp - 0x14]
push eax
call fcn.004fa6c0
push str.HKEY_LOCAL_MACHINE
push eax
call fcn.004f61e0
add esp, 0x20
test eax, eax
jne 0x4657a3
lea ecx, [ebp - 0x68]
lea edx, [ebp - 0x2c]
push ecx
push edx
push eax
push 2
push eax
push 0xc30c0c
push eax
push esi
push closesocket
jmp 0x4657c4
lea eax, [ebp - 0x68]
lea ecx, [ebp - 0x2c]
push eax
push ecx
push 0
push 2
push 0
push 0xc30c0c
lea edx, [ebp - 0x870]
push 0
push edx
push reloc.WS2_32.dll_closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4657ef
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x2c]
add eax, 0x140
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x4657ef
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x5c]
inc ebx
mov dword [ebp - 0x1c], ebx
jmp 0x46497a
mov eax, dword [ebp - 0x24]
test eax, eax
jne 0x4658bd
lea ecx, [ebp - 0x98]
push esi
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x1a8]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x470]
push 0x522230
push eax
call fcn.004f175f
mov eax, dword [ebp - 0x38]
add esp, 0x14
cmp eax, 1
jne 0x465880
mov edi, 0x516d9c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x470]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 0xe0]
mov ecx, dword [eax + 4]
mov eax, dword [ebp + ecx - 0xdc]
cmp dword [eax + 0x30], 0xffffffff
je 0x4658bd
lea edx, [ebp - 0x470]
lea ecx, [ebp - 0xd4]
push edx
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
lea ecx, [ebp - 0xe0]
call fcn.004f076e
lea ecx, [ebp - 0x1f0]
call fcn.004f076e
mov eax, dword [ebp - 0x14]
push eax
call fcn.004f265f
add esp, 4
lea ecx, [ebp - 0x114]
mov byte [ebp - 4], 2
call fcn.004f0714
lea ecx, [ebp - 0x114]
call fcn.004f05fb
lea ecx, [ebp - 0x1dc]
mov byte [ebp - 4], 1
call fcn.004f0714
lea ecx, [ebp - 0x1dc]
call fcn.004f05fb
lea ecx, [ebp - 0xcc]
mov byte [ebp - 4], 0
call fcn.004f0714
lea ecx, [ebp - 0xcc]
call fcn.004f05fb
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret