Function at 0x449280
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47f871
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x498
mov eax, dword [0x4b5200]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x450], esi
mov eax, dword [ebx + 8]
push 0x268
mov dword [ebp - 0x484], eax
lea eax, [ebp - 0x320]
push 0
push eax
call fcn.0046ce00
add esp, 0xc
mov word [ebp - 0x2e8], 0
mov dword [ebp - 0x20c], 0
mov dword [ebp - 0x210], 0
mov byte [ebp - 0x208], 1
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x320]
push 1
mov dword [ebp - 0x204], 0
mov dword [ebp - 0xe0], 0
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0xd4], 0
call fcn.0041ac10
push ecx
push 0
push 0xffffffffffffffff
push 0xcf0000
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x226
push 0x2ee
add esi, 0xd0
lea eax, [ebp - 0x320]
push 0x4ee644
cmovne eax, esi
lea ecx, [ebp - 0x320]
push str.ClearDiskInfoResultsDlg
mov dword [ebp - 0x160], eax
call fcn.0040ea00
lea eax, [ebp - 0xac]
mov dword [ebp - 4], 1
push eax
push dword [ebp - 0xf0]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0xa0]
mov ecx, dword [ebp - 0xa4]
sub eax, dword [ebp - 0xa8]
sub ecx, dword [ebp - 0xac]
movsd xmm0, qword [0x4ab350]
mov dword [ebp - 0x1dc], eax
xor eax, eax
mov dword [ebp - 0x1e0], ecx
mov dword [ebp - 0x1d8], 0
mov dword [ebp - 0x1d4], 0
movsd qword [ebp - 0x1b0], xmm0
mov dword [ebp - 0x1a8], 0x190
mov byte [ebp - 0x1a4], 1
mov byte [ebp - 0x162], 0
nop word [eax + eax]
inc eax
cmp word [eax*2 + str.Arial], 0
jne 0x449410
inc eax
push eax
push str.Arial
lea eax, [ebp - 0x1a2]
push 0x20
push eax
call fcn.0046e5a3
add esp, 0x10
mov dword [ebp - 0x130], 0x404
lea ecx, [ebp - 0x320]
call fcn.0041a8c0
mov edi, dword [sym.imp.USER32.dll_CreateWindowExW]
test al, al
jne 0x449462
mov dword [ebp - 0x460], 0
jmp 0x4494e9
mov eax, dword [ebp - 0x2e0]
mov ecx, str.Clear_Disk_Info______._____.
push 0
push dword [ebp - 0x204]
inc eax
push eax
push dword [ebp - 0xec]
movzx eax, byte [ebp - 0xd8]
push 0x12
push 0x2da
and eax, 1
push 0xa
shl eax, 0x11
push 0xa
add eax, 0x50000101
test byte [ebp - 0x484], 2
push eax
mov eax, 0x4ee694
cmove eax, ecx
push eax
push 0x4a01b4
push 0
call edi
test eax, eax
jne 0x4494c0
mov dword [ebp - 0x460], eax
jmp 0x4494e9
push eax
push 0xd
lea ecx, [ebp - 0x320]
call fcn.0041a630
mov ecx, dword [ebp - 0x2e4]
movaps xmm0, xmmword [0x4ab5c0]
mov dword [ebp - 0x460], eax
lea edx, [eax + eax*8]
movups xmmword [ecx + edx*8 + 0x24], xmm0
push 0x10021
push 0x1080000d
push 0x1d1
push 0x2ee
push 0x2d
push 0
push 0x49faf8
push 0x4ee740
lea ecx, [ebp - 0x320]
mov dword [ebp - 0x130], 0x433
call fcn.00415520
mov esi, dword [ebp - 0x2e0]
cmp eax, 0xffffffff
mov edx, dword [ebp - 0x2e4]
mov ecx, eax
cmove ecx, esi
mov dword [ebp - 0x470], eax
test edx, edx
je 0x44956b
cmp ecx, 1
jl 0x44956b
cmp ecx, esi
jg 0x44956b
lea eax, [ecx + ecx*8]
cmp dword [edx + eax*8 + 0xc], 0
je 0x44956b
cmp dword [edx + eax*8], 0xf
jne 0x44956b
push 0
push 1
push 0x109d
push dword [edx + eax*8 + 4]
mov eax, dword [sym.imp.USER32.dll_SendMessageW]
call eax
mov eax, dword [ebp - 0x450]
push 0
push 0x10
push 0x10
push ecx
push 0x6a
push dword [eax + 0x3b0]
call fcn.0041afb0
mov esi, eax
mov dword [ebp - 0x334], esi
mov dword [ebp - 0x34c], 0
test esi, esi
je 0x4495b4
push 0
lea eax, [ebp - 0x34c]
push eax
push dword [esi + 4]
call dword [sym.imp.gdiplus.dll_GdipCreateHBITMAPFromBitmap]
test eax, eax
je 0x4495b4
mov dword [esi + 8], eax
push 0x10
push 0x10
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x320]
push dword [ebp - 0x34c]
push 1
push dword [ebp - 0x470]
call fcn.004172d0
mov eax, dword [ebp - 0x34c]
test eax, eax
je 0x4495e6
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov byte [ebp - 4], 1
test esi, esi
je 0x4495f8
mov eax, dword [esi]
mov ecx, esi
push 1
mov eax, dword [eax]
call eax
mov ecx, dword [ebp - 0x470]
test ecx, ecx
jne 0x44960a
mov eax, dword [ebp - 0xf0]
jmp 0x44963d
mov edx, dword [ebp - 0x2e0]
cmp ecx, 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0x2e4]
cmove eax, edx
test ecx, ecx
je 0x44963b
cmp eax, 1
jl 0x44963b
cmp eax, edx
jg 0x44963b
lea eax, [eax + eax*8]
cmp dword [ecx + eax*8 + 0xc], 0
je 0x44963b
mov eax, dword [ecx + eax*8 + 4]
jmp 0x44963d
xor eax, eax
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0xc8
push 0
push 0x101e
push eax
mov dword [ebp - 0x48c], eax
call esi
push 0x64
push 1
push 0x101e
push dword [ebp - 0x48c]
call esi
push 0x64
push 2
push 0x101e
push dword [ebp - 0x48c]
call esi
push 0x1f4
push 3
push 0x101e
push dword [ebp - 0x48c]
call esi
cmp dword [ebp - 0xf0], 0
mov dword [ebp - 0x130], 0x424
je 0x449728
lea ecx, [ebp - 0x320]
call fcn.0041a8c0
test al, al
je 0x449728
mov eax, dword [ebp - 0x2e0]
push 0
push dword [ebp - 0x204]
inc eax
push eax
push dword [ebp - 0xec]
movzx eax, byte [ebp - 0xd8]
push 0x1e
push 0x96
push 0x203
and eax, 1
push 0x7d
shl eax, 0x11
add eax, 0x50010000
push eax
push str.OK__
push str.Button
push 0
call edi
test eax, eax
je 0x449728
push eax
push 3
lea ecx, [ebp - 0x320]
call fcn.0041a630
mov ecx, dword [ebp - 0x2e4]
movaps xmm0, xmmword [0x4ab6d0]
mov dword [ebp - 0x45c], eax
lea edx, [eax + eax*8]
movups xmmword [ecx + edx*8 + 0x24], xmm0
jmp 0x449732
mov dword [ebp - 0x45c], 0
cmp dword [ebp - 0xf0], 0
je 0x4497c5
lea ecx, [ebp - 0x320]
call fcn.0041a8c0
test al, al
je 0x4497c5
mov eax, dword [ebp - 0x2e0]
push 0
push dword [ebp - 0x204]
inc eax
push eax
push dword [ebp - 0xec]
movzx eax, byte [ebp - 0xd8]
push 0x1e
push 0x96
push 0x203
and eax, 1
push 0x12c
shl eax, 0x11
add eax, 0x50010000
push eax
push 0x4ee7c8
push str.Button
push 0
call edi
test eax, eax
je 0x4497c5
push eax
push 3
lea ecx, [ebp - 0x320]
call fcn.0041a630
mov ecx, dword [ebp - 0x2e4]
movaps xmm0, xmmword [0x4ab6e0]
mov dword [ebp - 0x4a0], eax
lea edx, [eax + eax*8]
movups xmmword [ecx + edx*8 + 0x24], xmm0
jmp 0x4497cf
mov dword [ebp - 0x4a0], 0
cmp dword [ebp - 0xf0], 0
je 0x449862
lea ecx, [ebp - 0x320]
call fcn.0041a8c0
test al, al
je 0x449862
mov eax, dword [ebp - 0x2e0]
push 0
push dword [ebp - 0x204]
inc eax
push eax
push dword [ebp - 0xec]
movzx eax, byte [ebp - 0xd8]
push 0x1e
push 0x96
push 0x203
and eax, 1
push 0x12c
shl eax, 0x11
add eax, 0x40010000
push eax
push 0x4ee7f8
push str.Button
push 0
call edi
test eax, eax
je 0x449862
push eax
push 3
lea ecx, [ebp - 0x320]
call fcn.0041a630
mov ecx, dword [ebp - 0x2e4]
movaps xmm0, xmmword [0x4ab6e0]
mov dword [ebp - 0x498], eax
lea edx, [eax + eax*8]
movups xmmword [ecx + edx*8 + 0x24], xmm0
jmp 0x44986c
mov dword [ebp - 0x498], 0
cmp dword [ebp - 0xf0], 0
je 0x4498ff
lea ecx, [ebp - 0x320]
call fcn.0041a8c0
test al, al
je 0x4498ff
mov eax, dword [ebp - 0x2e0]
push 0
push dword [ebp - 0x204]
inc eax
push eax
push dword [ebp - 0xec]
movzx eax, byte [ebp - 0xd8]
push 0x1e
push 0x96
push 0x203
and eax, 1
push 0x1db
shl eax, 0x11
add eax, 0x50010000
push eax
push 0x4ee81c
push str.Button
push 0
call edi
test eax, eax
je 0x4498ff
push eax
push 3
lea ecx, [ebp - 0x320]
call fcn.0041a630
mov ecx, dword [ebp - 0x2e4]
movaps xmm0, xmmword [0x4ab6f0]
mov dword [ebp - 0x49c], eax
lea edx, [eax + eax*8]
movups xmmword [ecx + edx*8 + 0x24], xmm0
jmp 0x449909
mov dword [ebp - 0x49c], 0
cmp dword [ebp - 0xf0], 0
je 0x44999e
lea ecx, [ebp - 0x320]
call fcn.0041a8c0
test al, al
je 0x44999e
mov eax, dword [ebp - 0x2e0]
push 0
push dword [ebp - 0x204]
inc eax
push eax
push dword [ebp - 0xec]
movzx eax, byte [ebp - 0xd8]
push 0x1e
push 0x96
push 0x203
and eax, 1
push 0x1db
shl eax, 0x11
add eax, 0x40010000
push eax
push 0x4ee84c
push str.Button
push 0
call edi
test eax, eax
je 0x44999e
push eax
push 3
lea ecx, [ebp - 0x320]
call fcn.0041a630
mov ecx, dword [ebp - 0x2e4]
mov esi, eax
movaps xmm0, xmmword [0x4ab6f0]
mov dword [ebp - 0x490], esi
lea edx, [esi + esi*8]
movups xmmword [ecx + edx*8 + 0x24], xmm0
jmp 0x4499a8
mov dword [ebp - 0x490], 0
mov esi, dword [ebp - 0x450]
mov ecx, esi
push 0
call fcn.0042ce20
mov eax, dword [esi + 0x90]
test eax, eax
jne 0x4499c9
mov eax, dword [esi + 0x378]
jmp 0x4499fd
cmp eax, 0xffffffff
jne 0x4499d4
mov eax, dword [esi + 0x188]
mov ecx, dword [esi + 0x184]
test ecx, ecx
je 0x4499fb
cmp eax, 1
jl 0x4499fb
cmp eax, dword [esi + 0x188]
jg 0x4499fb
lea eax, [eax + eax*8]
cmp dword [ecx + eax*8 + 0xc], 0
je 0x4499fb
mov eax, dword [ecx + eax*8 + 4]
jmp 0x4499fd
xor eax, eax
xor edx, edx
xorps xmm0, xmm0
movq qword [ebp - 0x20], xmm0
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x4a4], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edx
mov byte [ebp - 0x18], 1
movq qword [ebp - 0x58], xmm0
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x58], edx
mov byte [ebp - 0x50], 1
movq qword [ebp - 0x2c], xmm0
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], edx
mov byte [ebp - 0x24], 1
movq qword [ebp - 0x44], xmm0
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x44], edx
mov byte [ebp - 0x3c], 1
movq qword [ebp - 0x38], xmm0
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x38], edx
mov byte [ebp - 0x30], 1
xor edi, edi
movq qword [ebp - 0x47c], xmm0
mov dword [ebp - 0x474], edx
mov dword [ebp - 0x478], edx
mov dword [ebp - 0x454], edi
mov dword [ebp - 0x47c], edi
mov byte [ebp - 0x474], 1
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x4c], edi
test dword [ebp - 0x484], 2
mov byte [ebp - 4], 0xb
jne 0x44ab93
xor esi, esi
push esi
push esi
push 0x1004
push eax
mov eax, dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x464], esi
call eax
mov dword [ebp - 0x334], eax
test eax, eax
jle 0x44ab27
mov edi, dword [ebp - 0x450]
lea eax, [edi + 0x148]
mov dword [ebp - 0x480], eax
nop dword [eax]
push 3
push esi
push dword [edi + 0x90]
mov ecx, eax
call fcn.00419bd0
mov esi, eax
test esi, esi
jne 0x449b0d
push eax
lea ecx, [ebp - 0x20]
call fcn.00401a90
mov esi, dword [ebp - 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x449b31
mov eax, dword [ebp - 0x1c]
jmp 0x449b2b
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x449b1d
push eax
call fcn.0046b303
add esp, 4
xor eax, eax
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], eax
mov ecx, esi
mov byte [ebp - 0x18], 1
cmp word [ecx], 0
jne 0x449ba7
test esi, esi
je 0x449b3e
push esi
call fcn.0046b303
add esp, 4
mov byte [ebp - 0x18], 0
xor eax, eax
inc eax
cmp word [eax*2 + 0x4a08e8], 0
jne 0x449b44
mov dword [ebp - 0x1c], eax
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0046b90c
mov edx, eax
add esp, 4
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov dword [ebp - 0x20], edx
test eax, eax
jle 0x449b97
nop dword [eax + eax]
mov ax, word [ecx*2 + 0x4a08e8]
mov word [edx + ecx*2], ax
inc ecx
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
cmp ecx, eax
jl 0x449b80
xor ecx, ecx
mov word [edx + eax*2], cx
mov eax, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
mov byte [ebp - 0x18], 1
test esi, esi
je 0x449be2
test eax, eax
jne 0x449bc1
cmp word [esi], ax
je 0x449bbc
inc eax
cmp word [esi + eax*2], 0
jne 0x449bb4
mov dword [ebp - 0x1c], eax
test eax, eax
jle 0x449be2
push esi
mov byte [ebp - 0x18], 1
call fcn.0046f460
mov esi, eax
mov dword [ebp - 0x488], eax
add esp, 4
test esi, esi
js 0x44ab00
jmp 0x449bee
xor esi, esi
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x488], esi
mov ecx, dword [edi + 0x9c4]
cmp esi, ecx
jge 0x44ab00
lea edx, [esi + 1]
jb 0x449c09
mov ecx, edx
mov dword [edi + 0x9c4], edx
mov eax, dword [ebp - 0x450]
lea edi, [esi + esi*2]
shl edi, 5
mov eax, dword [eax + 0x9cc]
cmp byte [edi + eax], 0
je 0x44aafa
mov eax, dword [ebp - 0x450]
cmp ecx, esi
ja 0x449c35
mov dword [eax + 0x9c4], edx
mov esi, dword [eax + 0x9cc]
mov eax, dword [esi + edi + 0x54]
test eax, eax
je 0x44aafa
cmp word [eax], 0
je 0x44aafa
mov byte [esi + edi + 0x5c], 1
xor ecx, ecx
mov esi, eax
mov dword [ebp - 0x494], eax
mov dword [ebp - 0x47c], 0
mov edi, str.Monitoring_
mov byte [ebp - 0x474], 0
mov dword [ebp - 0x478], 0
lea ecx, [ecx + 1]
cmp word [ecx*2 + str.HKCUSoftwareClearDiskInfo], 0
jne 0x449c80
xor eax, eax
lea eax, [eax + 1]
cmp word [eax*2 + str.Monitoring_], 0
jne 0x449c90
mov dword [ebp - 0x468], esi
lea edx, [eax + ecx]
mov dword [ebp - 0x338], edx
test esi, esi
jne 0x449cc5
mov eax, dword [ebp - 0x454]
mov dword [ebp - 0x44c], eax
mov dword [ebp - 0x494], esi
jmp 0x449d02
mov ecx, dword [ebp - 0x454]
xor eax, eax
mov dword [ebp - 0x44c], ecx
cmp word [esi], ax
je 0x449d00
mov edx, dword [ebp - 0x454]
mov ecx, esi
mov dword [ebp - 0x44c], edx
mov edx, dword [ebp - 0x338]
mov dword [ebp - 0x468], esi
mov dword [ebp - 0x494], esi
inc eax
cmp word [ecx + eax*2], 0
jne 0x449cf8
add edx, eax
mov dword [ebp - 0x338], edx
lea eax, [edx + 1]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0046b90c
mov esi, str.HKCUSoftwareClearDiskInfo
mov dword [ebp - 0x454], eax
add esp, 4
mov ecx, eax
mov edx, 0x48
sub esi, eax
nop dword [eax + eax]
mov word [ecx], dx
add ecx, 2
movzx eax, word [ecx + esi]
mov edx, eax
test ax, ax
jne 0x449d40
mov esi, dword [ebp - 0x494]
mov eax, 0x5c
nop dword [eax]
mov word [ecx], ax
lea edi, [edi + 2]
movzx eax, word [edi]
add ecx, 2
test ax, ax
jne 0x449d60
mov eax, dword [ebp - 0x468]
test eax, eax
je 0x449d96
movzx eax, word [eax]
mov edx, eax
test ax, ax
je 0x449d96
mov word [ecx], ax
lea esi, [esi + 2]
movzx eax, word [esi]
add ecx, 2
test ax, ax
jne 0x449d85
mov edi, dword [ebp - 0x454]
xor eax, eax
mov word [ecx], ax
mov eax, dword [ebp - 0x338]
mov dword [ebp - 0x478], eax
mov eax, dword [ebp - 0x44c]
mov dword [ebp - 0x47c], edi
test eax, eax
je 0x449dc6
push eax
call fcn.0046b303
add esp, 4
mov eax, dword [ebp - 0x48]
mov byte [ebp - 0x474], 1
test eax, eax
je 0x449de2
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x48], 0
push ecx
mov edx, 0xf003f
mov ecx, edi
call fcn.004054e0
mov dword [ebp - 0x48], eax
test eax, eax
je 0x44aafa
lea ecx, [ebp - 0x84]
mov dword [ebp - 0x74], 0
push ecx
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x78], 0
push ecx
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x84], 4
push ecx
push 0
push 0x4a7bd8
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44aafa
cmp dword [ebp - 0x78], 4
jne 0x44aafa
mov edi, dword [ebp - 0x450]
cmp dword [ebp - 0x74], eax
je 0x44ab00
push dword [ebp - 0x464]
mov ecx, edi
call fcn.0042fa70
push 1
push dword [ebp - 0x488]
mov esi, eax
mov ecx, edi
push esi
mov dword [ebp - 0x468], esi
call fcn.0042f850
mov ecx, esi
test esi, esi
jne 0x449e8f
mov edi, dword [edi + 0x378]
mov dword [ebp - 0x44c], edi
mov edi, dword [ebp - 0x450]
jmp 0x449ed7
cmp esi, 0xffffffff
jne 0x449e9a
mov ecx, dword [edi + 0x188]
mov eax, dword [edi + 0x184]
test eax, eax
je 0x449ecd
cmp ecx, 1
jl 0x449ecd
cmp ecx, dword [edi + 0x188]
jg 0x449ecd
lea ecx, [ecx + ecx*8]
cmp dword [eax + ecx*8 + 0xc], 0
je 0x449ecd
mov edi, dword [eax + ecx*8 + 4]
mov dword [ebp - 0x44c], edi
mov edi, dword [ebp - 0x450]
jmp 0x449ed7
mov dword [ebp - 0x44c], 0
mov ecx, dword [ebp - 0x480]
push 0
push dword [ebp - 0x464]
push dword [edi + 0x90]
call fcn.00419bd0
mov esi, eax
mov eax, dword [ebp - 0x58]
test esi, esi
jne 0x449f51
test eax, eax
je 0x449f06
push eax
call fcn.0046b303
add esp, 4
push 2
mov byte [ebp - 0x50], 0
mov dword [ebp - 0x54], 0
call fcn.0046b90c
mov edx, eax
add esp, 4
mov eax, dword [ebp - 0x54]
xor ecx, ecx
mov dword [ebp - 0x58], edx
test eax, eax
jle 0x449f43
nop dword [eax]
mov ax, word [ecx + ecx]
mov word [edx + ecx*2], ax
inc ecx
mov eax, dword [ebp - 0x54]
mov edx, dword [ebp - 0x58]
cmp ecx, eax
jl 0x449f30
xor ecx, ecx
mov word [edx + eax*2], cx
mov eax, dword [ebp - 0x54]
mov esi, dword [ebp - 0x58]
jmp 0x449f66
test eax, eax
je 0x449f5e
push eax
call fcn.0046b303
add esp, 4
xor eax, eax
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x54], eax
mov edi, dword [ebp - 0x20]
mov byte [ebp - 0x50], 1
mov dword [ebp - 0x494], 0x49faf4
test edi, edi
jne 0x449f99
push 2
call fcn.0046b90c
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov edi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x54]
mov esi, dword [ebp - 0x58]
mov dword [ebp - 0x1c], ecx
mov byte [ebp - 0x18], 1
mov byte [ebp - 0x50], 0
test eax, eax
jne 0x449fbb
test esi, esi
je 0x449fb8
cmp word [esi], ax
je 0x449fb8
nop
inc eax
cmp word [esi + eax*2], 0
jne 0x449fb0
mov dword [ebp - 0x54], eax
xor ecx, ecx
nop dword [eax]
inc ecx
cmp word [ecx*2 + 0x4a21c0], 0
jne 0x449fc0
add ecx, eax
test edi, edi
je 0x449fea
xor eax, eax
cmp word [edi], ax
je 0x449fe8
nop dword [eax]
inc eax
cmp word [edi + eax*2], 0
jne 0x449fe0
add ecx, eax
xor eax, eax
nop dword [eax]
inc eax
cmp word [eax*2 + 0x49faf4], 0
jne 0x449ff0
add ecx, eax
mov edx, 2
mov dword [ebp - 0x46c], ecx
lea eax, [ecx + 1]
xor ecx, ecx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0046b90c
mov edx, dword [ebp - 0x58]
add esp, 4
mov dword [ebp - 0x338], eax
mov ecx, eax
test edx, edx
je 0x44a051
movzx esi, word [edx]
test si, si
je 0x44a051
mov eax, esi
nop dword [eax]
mov word [ecx], ax
lea edx, [edx + 2]
movzx eax, word [edx]
add ecx, 2
test ax, ax
jne 0x44a040
mov esi, 0x4a21c0
mov edx, 0x20
sub esi, ecx
nop dword [eax]
mov word [ecx], dx
add ecx, 2
movzx eax, word [ecx + esi]
mov edx, eax
test ax, ax
jne 0x44a060
test edi, edi
je 0x44a091
movzx eax, word [edi]
mov edx, eax
test ax, ax
je 0x44a091
nop
mov word [ecx], ax
lea edi, [edi + 2]
movzx eax, word [edi]
add ecx, 2
test ax, ax
jne 0x44a080
mov eax, 0x29
nop word [eax + eax]
mov word [ecx], ax
lea ecx, [ecx + 2]
mov eax, dword [ebp - 0x494]
add eax, 2
mov dword [ebp - 0x494], eax
movzx eax, word [eax]
test ax, ax
jne 0x44a0a0
xor eax, eax
mov word [ecx], ax
mov eax, dword [ebp - 0x58]
test eax, eax
je 0x44a0d2
push eax
call fcn.0046b303
add esp, 4
mov eax, dword [ebp - 0x338]
sub esp, 0x14
mov ecx, dword [ebp - 0x46c]
mov dword [ebp - 0x54], ecx
lea ecx, [ebp - 0x320]
mov dword [ebp - 0x58], eax
push eax
push dword [ebp - 0x488]
mov byte [ebp - 0x50], 1
push dword [ebp - 0x470]
call fcn.004197a0
xor esi, esi
push esi
push esi
push 0x1004
push dword [ebp - 0x44c]
mov dword [ebp - 0x338], esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x46c], eax
test eax, eax
jle 0x44aafa
nop dword [eax]
mov ecx, dword [ebp - 0x480]
push 1
push esi
push dword [ebp - 0x468]
call fcn.00419bd0
mov esi, eax
mov eax, dword [ebp - 0x2c]
test esi, esi
jne 0x44a19e
test eax, eax
je 0x44a15a
push eax
call fcn.0046b303
add esp, 4
push 2
mov byte [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
call fcn.0046b90c
mov edx, eax
add esp, 4
mov eax, dword [ebp - 0x28]
xor ecx, ecx
mov dword [ebp - 0x2c], edx
test eax, eax
jle 0x44a193
nop dword [eax]
mov ax, word [ecx + ecx]
mov word [edx + ecx*2], ax
inc ecx
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x2c]
cmp ecx, eax
jl 0x44a180
xor ecx, ecx
mov word [edx + eax*2], cx
mov esi, dword [ebp - 0x2c]
jmp 0x44a1b5
test eax, eax
je 0x44a1ab
push eax
call fcn.0046b303
add esp, 4
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], 0
mov byte [ebp - 0x24], 1
cmp esi, 0x4a8178
jne 0x44a1cd
mov byte [ebp - 0x455], 1
jmp 0x44a24e
test esi, esi
je 0x44a247
mov edi, 0x4a8178
movzx eax, word [esi]
mov ecx, eax
test ax, ax
jne 0x44a1f1
cmp word [edi], ax
jne 0x44a1f6
mov esi, dword [ebp - 0x2c]
mov byte [ebp - 0x455], 1
jmp 0x44a24e
cmp ax, word [edi]
je 0x44a23c
xor edx, edx
cmp dx, ax
jne 0x44a205
mov dword [ebp - 0x44c], edx
jmp 0x44a217
push ecx
call fcn.0046f530
movzx eax, ax
add esp, 4
mov dword [ebp - 0x44c], eax
movzx eax, word [edi]
xor edx, edx
mov ecx, eax
cmp dx, ax
jne 0x44a227
xor eax, eax
jmp 0x44a233
push ecx
call fcn.0046f530
add esp, 4
movzx eax, ax
cmp word [ebp - 0x44c], ax
jne 0x44a244
add esi, 2
add edi, 2
jmp 0x44a1d6
mov esi, dword [ebp - 0x2c]
mov byte [ebp - 0x455], 0
test esi, esi
jne 0x44a26a
push 2
call fcn.0046b90c
add esp, 4
mov dword [ebp - 0x2c], eax
xor ecx, ecx
mov word [eax], cx
mov esi, dword [ebp - 0x2c]
mov dword [ebp - 0x28], ecx
mov eax, esi
mov byte [ebp - 0x24], 1
test eax, eax
mov ecx, 0x49fab0
mov eax, dword [ebp - 0x38]
cmovne ecx, esi
mov dword [ebp - 0x44c], ecx
test eax, eax
je 0x44a296
push eax
call fcn.0046b303
mov ecx, dword [ebp - 0x44c]
add esp, 4
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov byte [ebp - 0x30], 1
test eax, eax
je 0x44a423
lea edx, [ebp - 0x60]
mov dword [ebp - 0x70], 0
push edx
push 0
lea edx, [ebp - 0x70]
mov dword [ebp - 0x60], 0
push edx
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44a423
mov eax, dword [ebp - 0x70]
cmp eax, 1
je 0x44a2f3
cmp eax, 2
je 0x44a2f3
cmp eax, 7
jne 0x44a423
mov esi, dword [ebp - 0x60]
xor ecx, ecx
mov edi, dword [ebp - 0x38]
add esi, 4
mov dword [ebp - 0x60], esi
mov edx, 2
shr esi, 1
mov dword [ebp - 0x34], 0
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0046b90c
xor ecx, ecx
mov dword [ebp - 0x38], eax
add esp, 4
mov word [eax + esi*2], cx
mov eax, dword [ebp - 0x38]
mov word [eax], cx
test edi, edi
je 0x44a340
push edi
call fcn.0046b303
add esp, 4
mov eax, dword [ebp - 0x38]
lea ecx, [esi - 1]
test eax, eax
jne 0x44a362
push 2
call fcn.0046b90c
add esp, 4
mov dword [ebp - 0x38], eax
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x34], ecx
xor edx, edx
mov word [eax + ecx*2], dx
lea ecx, [esi - 2]
mov eax, dword [ebp - 0x38]
test eax, eax
jne 0x44a38a
push 2
call fcn.0046b90c
add esp, 4
mov dword [ebp - 0x38], eax
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x34], ecx
xor edx, edx
mov word [eax + ecx*2], dx
mov eax, dword [ebp - 0x38]
test eax, eax
jne 0x44a3af
push 2
call fcn.0046b90c
add esp, 4
mov dword [ebp - 0x38], eax
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x60]
mov byte [ebp - 0x30], 1
push ecx
push eax
push 0
push 0
push dword [ebp - 0x44c]
push dword [ebp - 0x48]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44a423
cmp dword [ebp - 0x70], 7
jne 0x44a430
cmp esi, 3
jbe 0x44a430
mov ecx, dword [ebp - 0x38]
test ecx, ecx
jne 0x44a3f9
push 2
call fcn.0046b90c
add esp, 4
mov dword [ebp - 0x38], eax
xor ecx, ecx
mov word [eax], cx
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x38]
xor eax, eax
mov byte [ebp - 0x30], 1
add esi, 0xffffffff
je 0x44a430
xor edx, edx
cmp dx, word [ecx + eax*2]
jne 0x44a41c
cmp word [ecx + eax*2 + 2], dx
je 0x44a41c
mov edx, 0xa
mov word [ecx + eax*2], dx
inc eax
cmp eax, esi
jb 0x44a404
jmp 0x44a430
cmp byte [ebp - 0x455], 0
je 0x44aae1
mov ecx, dword [ebp - 0x480]
push 2
push dword [ebp - 0x338]
push dword [ebp - 0x468]
call fcn.00419bd0
mov esi, eax
mov eax, dword [ebp - 0x44]
test esi, esi
jne 0x44a4a0
test eax, eax
je 0x44a45f
push eax
call fcn.0046b303
add esp, 4
push 2
mov byte [ebp - 0x3c], 0
mov dword [ebp - 0x40], 0
call fcn.0046b90c
mov edx, eax
add esp, 4
mov eax, dword [ebp - 0x40]
xor ecx, ecx
mov dword [ebp - 0x44], edx
test eax, eax
jle 0x44a495
mov ax, word [ecx + ecx]
mov word [edx + ecx*2], ax
inc ecx
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 0x44]
cmp ecx, eax
jl 0x44a482
xor ecx, ecx
mov word [edx + eax*2], cx
mov esi, dword [ebp - 0x44]
jmp 0x44a4b7
test eax, eax
je 0x44a4ad
push eax
call fcn.0046b303
add esp, 4
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x40], 0
cmp byte [ebp - 0x455], 0
mov byte [ebp - 0x3c], 1
jne 0x44a584
mov edi, dword [ebp - 0x38]
test edi, edi
jne 0x44a4ea
push 2
call fcn.0046b90c
add esp, 4
mov dword [ebp - 0x38], eax
xor ecx, ecx
mov word [eax], cx
mov esi, dword [ebp - 0x44]
mov edi, dword [ebp - 0x38]
mov dword [ebp - 0x34], ecx
mov byte [ebp - 0x30], 1
cmp esi, edi
je 0x44aae1
test esi, esi
je 0x44a570
test edi, edi
je 0x44aae1
movzx eax, word [esi]
mov ecx, eax
test ax, ax
jne 0x44a517
cmp word [edi], ax
je 0x44aae1
jmp 0x44a51c
cmp ax, word [edi]
je 0x44a562
xor edx, edx
cmp dx, ax
jne 0x44a52b
mov dword [ebp - 0x44c], edx
jmp 0x44a53d
push ecx
call fcn.0046f530
movzx eax, ax
add esp, 4
mov dword [ebp - 0x44c], eax
movzx eax, word [edi]
xor edx, edx
mov ecx, eax
cmp dx, ax
jne 0x44a54d
xor eax, eax
jmp 0x44a559
push ecx
call fcn.0046f530
add esp, 4
movzx eax, ax
cmp word [ebp - 0x44c], ax
jne 0x44a56a
add esi, 2
add edi, 2
jmp 0x44a502
mov esi, dword [ebp - 0x44]
mov edi, dword [ebp - 0x38]
test edi, edi
je 0x44aae1
cmp word [edi], 0
je 0x44aae1
jmp 0x44a5cf
test esi, esi
je 0x44aadd
cmp dword [ebp - 0x40], 0
jne 0x44a5ad
xor eax, eax
cmp word [esi], ax
je 0x44a5a8
nop dword [eax]
inc eax
cmp word [esi + eax*2], 0
jne 0x44a5a0
mov dword [ebp - 0x40], eax
test eax, eax
jle 0x44aadd
push esi
mov byte [ebp - 0x3c], 1
call fcn.0046f460
add esp, 4
cmp eax, 0x37
jl 0x44aae1
mov esi, dword [ebp - 0x44]
mov edi, dword [ebp - 0x38]
cmp dword [ebp - 0x74], 1
jbe 0x44a879
cmp esi, str.True
je 0x44a879
test esi, esi
je 0x44a65e
mov edi, str.True
nop
movzx eax, word [esi]
mov ecx, eax
test ax, ax
jne 0x44a605
cmp word [edi], ax
je 0x44a879
jmp 0x44a60a
cmp ax, word [edi]
je 0x44a650
xor edx, edx
cmp dx, ax
jne 0x44a619
mov dword [ebp - 0x44c], edx
jmp 0x44a62b
push ecx
call fcn.0046f530
movzx eax, ax
add esp, 4
mov dword [ebp - 0x44c], eax
movzx eax, word [edi]
xor edx, edx
mov ecx, eax
cmp dx, ax
jne 0x44a63b
xor eax, eax
jmp 0x44a647
push ecx
call fcn.0046f530
add esp, 4
movzx eax, ax
cmp word [ebp - 0x44c], ax
jne 0x44a658
add esi, 2
add edi, 2
jmp 0x44a5f0
mov esi, dword [ebp - 0x44]
mov edi, dword [ebp - 0x38]
cmp esi, str.False
je 0x44a879
test esi, esi
je 0x44a6e1
mov edi, str.False
movzx eax, word [esi]
mov ecx, eax
test ax, ax
jne 0x44a688
cmp word [edi], ax
je 0x44a879
jmp 0x44a68d
cmp ax, word [edi]
je 0x44a6d3
xor edx, edx
cmp dx, ax
jne 0x44a69c
mov dword [ebp - 0x44c], edx
jmp 0x44a6ae
push ecx
call fcn.0046f530
movzx eax, ax
add esp, 4
mov dword [ebp - 0x44c], eax
movzx eax, word [edi]
xor edx, edx
mov ecx, eax
cmp dx, ax
jne 0x44a6be
xor eax, eax
jmp 0x44a6ca
push ecx
call fcn.0046f530
add esp, 4
movzx eax, ax
cmp word [ebp - 0x44c], ax
jne 0x44a6db
add esi, 2
add edi, 2
jmp 0x44a673
mov esi, dword [ebp - 0x44]
mov edi, dword [ebp - 0x38]
cmp esi, 0x4a03a0
je 0x44a879
test esi, esi
je 0x44a764
mov edi, 0x4a03a0
movzx eax, word [esi]
mov ecx, eax
test ax, ax
jne 0x44a70b
cmp word [edi], ax
je 0x44a879
jmp 0x44a710
cmp ax, word [edi]
je 0x44a756
xor edx, edx
cmp dx, ax
jne 0x44a71f
mov dword [ebp - 0x44c], edx
jmp 0x44a731
push ecx
call fcn.0046f530
movzx eax, ax
add esp, 4
mov dword [ebp - 0x44c], eax
movzx eax, word [edi]
xor edx, edx
mov ecx, eax
cmp dx, ax
jne 0x44a741
xor eax, eax
jmp 0x44a74d
push ecx
call fcn.0046f530
add esp, 4
movzx eax, ax
cmp word [ebp - 0x44c], ax
jne 0x44a75e
add esi, 2
add edi, 2
jmp 0x44a6f6
mov esi, dword [ebp - 0x44]
mov edi, dword [ebp - 0x38]
cmp esi, 0x4a03a8
je 0x44a879
test esi, esi
je 0x44a823
mov edi, 0x4a03a8
nop dword [eax]
movzx eax, word [esi]
mov ecx, eax
test ax, ax
jne 0x44a795
cmp word [edi], ax
je 0x44a879
jmp 0x44a79a
cmp ax, word [edi]
je 0x44a7e0
xor edx, edx
cmp dx, ax
jne 0x44a7a9
mov dword [ebp - 0x44c], edx
jmp 0x44a7bb
push ecx
call fcn.0046f530
movzx eax, ax
add esp, 4
mov dword [ebp - 0x44c], eax
movzx eax, word [edi]
xor edx, edx
mov ecx, eax
cmp dx, ax
jne 0x44a7cb
xor eax, eax
jmp 0x44a7d7
push ecx
call fcn.0046f530
add esp, 4
movzx eax, ax
cmp word [ebp - 0x44c], ax
jne 0x44a7e8
add esi, 2
add edi, 2
jmp 0x44a780
mov esi, dword [ebp - 0x44]
mov edi, dword [ebp - 0x38]
test esi, esi
je 0x44a823
cmp dword [ebp - 0x40], 0
jne 0x44a80d
xor eax, eax
cmp word [esi], ax
je 0x44a808
nop
inc eax
cmp word [esi + eax*2], 0
jne 0x44a800
mov dword [ebp - 0x40], eax
test eax, eax
jle 0x44a823
push esi
mov byte [ebp - 0x3c], 1
call fcn.0046f460
mov edi, dword [ebp - 0x38]
add esp, 4
mov esi, eax
jmp 0x44a829
mov byte [ebp - 0x3c], 0
xor esi, esi
test edi, edi
je 0x44a860
cmp dword [ebp - 0x34], 0
jne 0x44a84d
xor eax, eax
cmp word [edi], ax
je 0x44a848
nop word [eax + eax]
inc eax
cmp word [edi + eax*2], 0
jne 0x44a840
mov dword [ebp - 0x34], eax
test eax, eax
jle 0x44a860
push edi
mov byte [ebp - 0x30], 1
call fcn.0046f460
add esp, 4
mov ecx, eax
jmp 0x44a866
mov byte [ebp - 0x30], 0
xor ecx, ecx
mov eax, esi
sub eax, ecx
jns 0x44a870
mov eax, ecx
sub eax, esi
cmp eax, 5
jl 0x44aae1
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x44a898
push 2
call fcn.0046b90c
add esp, 4
mov dword [ebp - 0x2c], eax
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], ecx
push ecx
push dword [ebp - 0x470]
lea ecx, [ebp - 0x320]
mov byte [ebp - 0x24], 1
push 0
push dword [ebp - 0x488]
push 0xffffffffffffffff
push 0
push eax
call fcn.00419860
mov esi, dword [ebp - 0x44]
mov edi, eax
test esi, esi
jne 0x44a8dc
push 2
call fcn.0046b90c
add esp, 4
mov dword [ebp - 0x44], eax
xor ecx, ecx
mov word [eax], cx
mov esi, dword [ebp - 0x44]
mov dword [ebp - 0x40], ecx
mov ecx, dword [ebp - 0x470]
cmp ecx, 0xffffffff
mov edx, dword [ebp - 0x2e0]
mov eax, dword [ebp - 0x2e4]
cmove ecx, edx
mov byte [ebp - 0x3c], 1
test eax, eax
je 0x44a948
cmp ecx, 1
jl 0x44a948
cmp ecx, edx
jg 0x44a948
lea ecx, [ecx + ecx*8]
cmp dword [eax + ecx*8 + 0xc], 0
je 0x44a948
cmp dword [eax + ecx*8], 0xf
jne 0x44a948
lea edx, [ebp - 0x394]
mov dword [ebp - 0x38c], 1
push edx
push edi
push 0x1074
mov dword [ebp - 0x380], esi
push dword [eax + ecx*8 + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [ebp - 0x2e0]
mov eax, dword [ebp - 0x2e4]
mov esi, dword [ebp - 0x38]
test esi, esi
jne 0x44a973
push 2
call fcn.0046b90c
add esp, 4
mov dword [ebp - 0x38], eax
xor ecx, ecx
mov word [eax], cx
mov edx, dword [ebp - 0x2e0]
mov eax, dword [ebp - 0x2e4]
mov esi, dword [ebp - 0x38]
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x470]
cmp ecx, 0xffffffff
mov byte [ebp - 0x30], 1
cmove ecx, edx
test eax, eax
je 0x44a9c7
cmp ecx, 1
jl 0x44a9c7
cmp ecx, edx
jg 0x44a9c7
lea ecx, [ecx + ecx*8]
cmp dword [eax + ecx*8 + 0xc], 0
je 0x44a9c7
cmp dword [eax + ecx*8], 0xf
jne 0x44a9c7
lea edx, [ebp - 0x3d0]
mov dword [ebp - 0x3c8], 2
push edx
push edi
push 0x1074
mov dword [ebp - 0x3bc], esi
push dword [eax + ecx*8 + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0x480]
push 4
push dword [ebp - 0x338]
push dword [ebp - 0x468]
call fcn.00419bd0
mov esi, eax
mov eax, dword [ebp - 0x20]
test esi, esi
jne 0x44aa3e
test eax, eax
je 0x44a9f6
push eax
call fcn.0046b303
add esp, 4
push 2
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
call fcn.0046b90c
mov edx, eax
add esp, 4
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov dword [ebp - 0x20], edx
test eax, eax
jle 0x44aa33
nop dword [eax]
mov ax, word [ecx + ecx]
mov word [edx + ecx*2], ax
inc ecx
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
cmp ecx, eax
jl 0x44aa20
xor ecx, ecx
mov word [edx + eax*2], cx
mov esi, dword [ebp - 0x20]
jmp 0x44aa55
test eax, eax
je 0x44aa4b
push eax
call fcn.0046b303
add esp, 4
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x18], 1
test esi, esi
jne 0x44aa75
push 2
call fcn.0046b90c
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov esi, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x470]
cmp eax, 0xffffffff
mov edx, dword [ebp - 0x2e0]
mov ecx, dword [ebp - 0x2e4]
cmove eax, edx
mov byte [ebp - 0x18], 1
test ecx, ecx
je 0x44aad5
cmp eax, 1
jl 0x44aad5
cmp eax, edx
jg 0x44aad5
lea eax, [eax + eax*8]
cmp dword [ecx + eax*8 + 0xc], 0
je 0x44aad5
cmp dword [ecx + eax*8], 0xf
jne 0x44aad5
lea edx, [ebp - 0x40c]
mov dword [ebp - 0x404], 3
push edx
push edi
push 0x1074
mov dword [ebp - 0x3f8], esi
push dword [ecx + eax*8 + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
inc dword [ebp - 0x4a4]
jmp 0x44aae1
mov byte [ebp - 0x3c], 0
mov esi, dword [ebp - 0x338]
inc esi
mov dword [ebp - 0x338], esi
cmp esi, dword [ebp - 0x46c]
jl 0x44a130
mov edi, dword [ebp - 0x450]
mov esi, dword [ebp - 0x464]
mov eax, dword [ebp - 0x480]
inc esi
mov dword [ebp - 0x464], esi
cmp esi, dword [ebp - 0x334]
jl 0x449ae0
mov edx, dword [ebp - 0x4a4]
jmp 0x44ab29
xor edx, edx
test dword [ebp - 0x484], 2
mov esi, dword [ebp - 0x450]
jne 0x44ab93
test edx, edx
jne 0x44ab93
push edx
push 0x20
push 0x20
push 1
push 1
push dword [esi + 0x3b0]
call dword [sym.imp.USER32.dll_LoadImageW]
mov esi, eax
mov dword [ebp - 0x334], esi
test byte [ebp - 0x484], 1
mov byte [ebp - 4], 0xc
je 0x44ab81
mov eax, dword [ebp - 0x450]
push esi
sub esp, 0xc
lea ecx, [eax + 0x148]
push dword [eax + 8]
call fcn.0041adf0
test esi, esi
je 0x44ab8c
push esi
call dword [sym.imp.USER32.dll_DestroyIcon]
xor esi, esi
jmp 0x44cc2c
push 0x10021
push 0x80000d
push 0x1d1
push 0x2ee
push 0x2d
push 0
push 0x49faf8
push 0x4ee908
lea ecx, [ebp - 0x320]
mov dword [ebp - 0x130], 0x433
call fcn.00415520
mov esi, dword [ebp - 0x2e0]
mov edi, eax
mov edx, dword [ebp - 0x2e4]
cmp edi, 0xffffffff
mov ecx, edi
mov dword [ebp - 0x480], edi
cmove ecx, esi
test edx, edx
je 0x44ac16
cmp ecx, 1
jl 0x44ac16
cmp ecx, esi
jg 0x44ac16
lea eax, [ecx + ecx*8]
cmp dword [edx + eax*8 + 0xc], 0
je 0x44ac16
cmp dword [edx + eax*8], 0xf
jne 0x44ac16
push 0
push 1
push 0x109d
push dword [edx + eax*8 + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x450]
push 0
push 0x10
push 0x10
push ecx
push 0x6a
push dword [eax + 0x3b0]
call fcn.0041afb0
mov esi, eax
mov dword [ebp - 0x334], esi
mov dword [ebp - 0x348], 0
test esi, esi
je 0x44ac5f
push 0
lea eax, [ebp - 0x348]
push eax
push dword [esi + 4]
call dword [sym.imp.gdiplus.dll_GdipCreateHBITMAPFromBitmap]
test eax, eax
je 0x44ac5f
mov dword [esi + 8], eax
push 0x10
push 0x10
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x320]
push dword [ebp - 0x348]
push 1
push edi
call fcn.004172d0
mov eax, dword [ebp - 0x348]
test eax, eax
je 0x44ac8c
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov byte [ebp - 4], 0xb
test esi, esi
je 0x44ac9e
mov eax, dword [esi]
mov ecx, esi
push 1
mov eax, dword [eax]
call eax
test edi, edi
jne 0x44acaa
mov esi, dword [ebp - 0xf0]
jmp 0x44acdd
mov edx, dword [ebp - 0x2e0]
cmp edi, 0xffffffff
mov ecx, dword [ebp - 0x2e4]
mov eax, edi
cmove eax, edx
test ecx, ecx
je 0x44acdb
cmp eax, 1
jl 0x44acdb
cmp eax, edx
jg 0x44acdb
lea eax, [eax + eax*8]
cmp dword [ecx + eax*8 + 0xc], 0
je 0x44acdb
mov esi, dword [ecx + eax*8 + 4]
jmp 0x44acdd
xor esi, esi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0xc8
push 0
push 0x101e
push esi
mov dword [ebp - 0x468], esi
call edi
push 0xc8
push 1
push 0x101e
push esi
call edi
push 0x64
push 2
push 0x101e
push esi
call edi
push 0x64
push 3
push 0x101e
push esi
call edi
push 0x1f4
push 4
push 0x101e
push esi
call edi
mov eax, dword [ebp - 0x454]
mov esi, str.MonitoringHistory
mov dword [ebp - 0x46c], eax
xor ecx, ecx
mov dword [ebp - 0x47c], 0
mov byte [ebp - 0x474], 0
mov dword [ebp - 0x478], 0
nop dword [eax]
inc ecx
cmp word [ecx*2 + str.HKCUSoftwareClearDiskInfo], 0
jne 0x44ad60
xor eax, eax
nop
inc eax
cmp word [eax*2 + str.MonitoringHistory], 0
jne 0x44ad70
add eax, ecx
mov edx, 2
mov dword [ebp - 0x334], eax
xor ecx, ecx
inc eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0046b90c
mov edi, str.HKCUSoftwareClearDiskInfo
mov dword [ebp - 0x454], eax
add esp, 4
mov ecx, eax
mov edx, 0x48
sub edi, eax
mov word [ecx], dx
add ecx, 2
movzx eax, word [edi + ecx]
mov edx, eax
test ax, ax
jne 0x44adb2
mov eax, 0x5c
nop dword [eax + eax]
mov word [ecx], ax
lea esi, [esi + 2]
movzx eax, word [esi]
lea ecx, [ecx + 2]
test ax, ax
jne 0x44add0
xor eax, eax
mov byte [ebp - 0x474], 1
mov word [ecx], ax
mov eax, dword [ebp - 0x454]
mov dword [ebp - 0x47c], eax
mov eax, dword [ebp - 0x334]
mov dword [ebp - 0x478], eax
mov eax, dword [ebp - 0x46c]
test eax, eax
je 0x44ae18
push eax
call fcn.0046b303
add esp, 4
xorps xmm0, xmm0
mov dword [ebp - 0x350], 0
push 0x8020
movq qword [ebp - 0x358], xmm0
call fcn.0046b90c
add esp, 4
mov esi, eax
mov dword [ebp - 0x494], esi
push 0x8020
push 0
push esi
call fcn.0046ce00
add esp, 0xc
mov dword [ebp - 0x358], esi
mov dword [ebp - 0x354], 0xffffffff
mov dword [ebp - 0x350], 0
mov byte [ebp - 4], 0x10
xorps xmm0, xmm0
push 0x8020
movq qword [ebp - 0x344], xmm0
mov dword [ebp - 0x33c], 0
call fcn.0046b90c
add esp, 4
mov esi, eax
push 0x8020
push 0
push esi
call fcn.0046ce00
add esp, 0xc
mov dword [ebp - 0x344], esi
mov dword [ebp - 0x340], 0xffffffff
mov dword [ebp - 0x33c], 0
xorps xmm0, xmm0
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x9c]
movq qword [ebp - 0x8c], xmm0
movups xmmword [ebp - 0x9c], xmm0
call fcn.004035a0
push 0
lea eax, [ebp - 0xb4]
push eax
lea eax, [ebp - 0xb0]
push eax
push 8
push 0xffffffffffffffff
push str.:d3
call fcn.00465c30
mov edi, eax
add esp, 0x18
mov dword [ebp - 0x338], edi
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x48]
mov byte [ebp - 0x474], 1
test ecx, ecx
je 0x44af28
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x48], 0
mov esi, dword [ebp - 0x454]
mov edx, 0x20019
push ecx
mov ecx, esi
call fcn.004054e0
mov dword [ebp - 0x48], eax
test eax, eax
je 0x44b789
xor ecx, ecx
mov dword [ebp - 0x464], ecx
test eax, eax
je 0x44b789
mov eax, dword [ebp - 0x494]
xor edx, edx
push edx
push edx
push edx
push edx
mov dword [ebp - 0x80], 0x4010
mov word [eax], dx
mov dword [ebp - 0x350], edx
lea edx, [ebp - 0x80]
push edx
push eax
push ecx
push dword [ebp - 0x48]
mov dword [ebp - 0x354], 0xffffffff
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x44b789
mov edx, dword [ebp - 0x494]
cmp word [edx], ax
je 0x44b789
mov dword [ebp - 0x44c], esi
xor ecx, ecx
mov dword [ebp - 0x354], 0xfffffffe
mov esi, str.MonitoringHistory_
mov dword [ebp - 0x47c], eax
mov dword [ebp - 0x334], edx
mov byte [ebp - 0x474], al
mov dword [ebp - 0x478], eax
inc ecx
cmp word [ecx*2 + str.HKCUSoftwareClearDiskInfo], 0
jne 0x44afd1
xor eax, eax
nop
inc eax
cmp word [eax*2 + str.MonitoringHistory_], 0
jne 0x44afe0
add ecx, eax
xor eax, eax
cmp word [edx], ax
je 0x44affd
inc eax
cmp word [edx + eax*2], 0
jne 0x44aff5
add ecx, eax
mov edx, 2
mov dword [ebp - 0x46c], ecx
lea eax, [ecx + 1]
xor ecx, ecx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0046b90c
mov edi, str.HKCUSoftwareClearDiskInfo
mov dword [ebp - 0x454], eax
add esp, 4
mov ecx, eax
mov edx, 0x48
sub edi, eax
mov word [ecx], dx
add ecx, 2
movzx eax, word [edi + ecx]
mov edx, eax
test ax, ax
jne 0x44b035
mov edi, dword [ebp - 0x338]
mov eax, 0x5c
mov word [ecx], ax
lea esi, [esi + 2]
movzx eax, word [esi]
add ecx, 2
test ax, ax
jne 0x44b051
mov eax, dword [ebp - 0x494]
movzx eax, word [eax]
mov edx, eax
test ax, ax
je 0x44b097
mov edi, dword [ebp - 0x334]
nop dword [eax + eax]
mov word [ecx], ax
lea edi, [edi + 2]
movzx eax, word [edi]
add ecx, 2
test ax, ax
jne 0x44b080
mov edi, dword [ebp - 0x338]
mov esi, dword [ebp - 0x454]
xor eax, eax
mov word [ecx], ax
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0x478], eax
mov eax, dword [ebp - 0x44c]
mov dword [ebp - 0x47c], esi
test eax, eax
je 0x44b0c7
push eax
call fcn.0046b303
add esp, 4
mov eax, dword [ebp - 0x4c]
mov byte [ebp - 0x474], 1
test eax, eax
je 0x44b0e3
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x4c], 0
push ecx
mov edx, 0x20019
mov ecx, esi
call fcn.004054e0
mov dword [ebp - 0x4c], eax
test eax, eax
je 0x44b77a
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x44b10e
push ecx
call fcn.0046b303
mov eax, dword [ebp - 0x4c]
add esp, 4
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x18], 1
test eax, eax
je 0x44b77a
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x68], 0
push ecx
push 0
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x64], 0
push ecx
push 0
push 0x4ee9a8
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44b77a
mov eax, dword [ebp - 0x68]
cmp eax, 1
je 0x44b16c
cmp eax, 2
je 0x44b16c
cmp eax, 7
jne 0x44b77a
mov esi, dword [ebp - 0x64]
xor ecx, ecx
mov eax, dword [ebp - 0x20]
add esi, 4
mov dword [ebp - 0x64], esi
mov edx, 2
shr esi, 1
mov dword [ebp - 0x334], eax
mov dword [ebp - 0x1c], 0
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0046b90c
mov dword [ebp - 0x20], eax
xor ecx, ecx
add esp, 4
mov word [eax + esi*2], cx
mov eax, dword [ebp - 0x20]
mov word [eax], cx
mov eax, dword [ebp - 0x334]
test eax, eax
je 0x44b1c5
push eax
call fcn.0046b303
add esp, 4
mov eax, dword [ebp - 0x20]
lea ecx, [esi - 1]
test eax, eax
jne 0x44b1e7
push 2
call fcn.0046b90c
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
xor edx, edx
mov word [eax + ecx*2], dx
lea ecx, [esi - 2]
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x44b20f
push 2
call fcn.0046b90c
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
xor edx, edx
mov word [eax + ecx*2], dx
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x44b234
push 2
call fcn.0046b90c
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x64]
mov byte [ebp - 0x18], 1
push ecx
push eax
push 0
push 0
push 0x4ee9a8
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44b774
cmp dword [ebp - 0x68], 7
jne 0x44b2ae
cmp esi, 3
jbe 0x44b2ae
cmp dword [ebp - 0x20], eax
jne 0x44b27c
push 2
call fcn.0046b90c
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x20]
xor eax, eax
mov byte [ebp - 0x18], 1
add esi, 0xffffffff
je 0x44b2ae
lea edi, [eax + 0xa]
nop dword [eax]
xor edx, edx
cmp dx, word [ecx + eax*2]
jne 0x44b2a3
cmp word [ecx + eax*2 + 2], dx
je 0x44b2a3
mov word [ecx + eax*2], di
inc eax
cmp eax, esi
jb 0x44b290
mov edi, dword [ebp - 0x338]
cmp dword [ebp - 0x20], 0
jne 0x44b2c9
push 2
call fcn.0046b90c
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov dword [ebp - 0x1c], ecx
sub esp, 0x14
mov byte [ebp - 0x18], 1
lea ecx, [ebp - 0x320]
push dword [ebp - 0x20]
push dword [ebp - 0x464]
push dword [ebp - 0x480]
call fcn.004197a0
xor ecx, ecx
cmp dword [ebp - 0x4c], 0
mov dword [ebp - 0x488], ecx
je 0x44b774
mov eax, dword [ebp - 0x344]
xor edx, edx
mov dword [ebp - 0x7c], 0x4010
mov word [eax], dx
lea eax, [ebp - 0x33c]
push eax
push edx
lea eax, [ebp - 0x340]
mov dword [ebp - 0x340], 0xffffffff
push eax
push edx
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x33c], edx
push eax
push dword [ebp - 0x344]
push ecx
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x44b76a
mov eax, dword [ebp - 0x344]
cmp eax, 0x4ee9a8
je 0x44b75e
test eax, eax
je 0x44b3b1
mov ecx, 0x4ee9a8
sub eax, ecx
mov dword [ebp - 0x46c], eax
nop dword [eax]
movzx esi, word [eax + ecx]
mov eax, esi
mov dword [ebp - 0x334], eax
test si, si
jne 0x44b38f
cmp word [ecx], si
je 0x44b75e
movzx edx, word [ecx]
jmp 0x44b39f
movzx eax, word [ecx]
mov edx, eax
cmp si, ax
je 0x44b3a6
mov eax, dword [ebp - 0x334]
cmp ax, dx
jb 0x44b3b1
ja 0x44b3b1
mov eax, dword [ebp - 0x46c]
add ecx, 2
jmp 0x44b370
mov eax, dword [ebp - 0x344]
mov ecx, 0x49fab0
test eax, eax
cmovne ecx, eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x44c], ecx
test eax, eax
je 0x44b3dd
push eax
call fcn.0046b303
mov ecx, dword [ebp - 0x44c]
add esp, 4
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x18], 1
test eax, eax
je 0x44b75e
lea edx, [ebp - 0x5c]
mov dword [ebp - 0x6c], 0
push edx
push 0
lea edx, [ebp - 0x6c]
mov dword [ebp - 0x5c], 0
push edx
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44b75e
mov eax, dword [ebp - 0x6c]
cmp eax, 1
je 0x44b43a
cmp eax, 2
je 0x44b43a
cmp eax, 7
jne 0x44b75e
mov esi, dword [ebp - 0x5c]
xor ecx, ecx
mov eax, dword [ebp - 0x20]
add esi, 4
mov dword [ebp - 0x5c], esi
mov edx, 2
shr esi, 1
mov dword [ebp - 0x334], eax
mov dword [ebp - 0x1c], 0
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0046b90c
mov dword [ebp - 0x20], eax
xor ecx, ecx
add esp, 4
mov word [eax + esi*2], cx
mov eax, dword [ebp - 0x20]
mov word [eax], cx
mov eax, dword [ebp - 0x334]
test eax, eax
je 0x44b493
push eax
call fcn.0046b303
add esp, 4
mov eax, dword [ebp - 0x20]
lea ecx, [esi - 1]
test eax, eax
jne 0x44b4b5
push 2
call fcn.0046b90c
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
xor edx, edx
mov word [eax + ecx*2], dx
lea ecx, [esi - 2]
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x44b4dd
push 2
call fcn.0046b90c
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
xor edx, edx
mov word [eax + ecx*2], dx
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x44b502
push 2
call fcn.0046b90c
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x5c]
mov byte [ebp - 0x18], 1
push ecx
push eax
push 0
push 0
push dword [ebp - 0x44c]
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44b75e
cmp dword [ebp - 0x6c], 7
jne 0x44b57e
cmp esi, 3
jbe 0x44b57e
cmp dword [ebp - 0x20], eax
jne 0x44b54b
push 2
call fcn.0046b90c
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x20]
xor eax, eax
mov byte [ebp - 0x18], 1
add esi, 0xffffffff
je 0x44b57e
lea edi, [eax + 0xa]
nop dword [eax]
xor edx, edx
cmp dx, word [ecx + eax*2]
jne 0x44b573
cmp word [ecx + eax*2 + 2], dx
je 0x44b573
mov word [ecx + eax*2], di
inc eax
cmp eax, esi
jb 0x44b560
mov edi, dword [ebp - 0x338]
cmp dword [ebp - 0x20], 0
jne 0x44b599
push 2
call fcn.0046b90c
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov dword [ebp - 0x1c], ecx
push 1
push 0x4a01b0
push dword [ebp - 0x20]
lea ecx, [ebp - 0x9c]
mov byte [ebp - 0x18], 1
call fcn.00403690
cmp dword [ebp - 0x9c], 3
jb 0x44b75e
mov eax, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x344]
test eax, eax
je 0x44b5d5
push eax
call fcn.0046b303
add esp, 4
xor eax, eax
mov byte [ebp - 0x24], 0
test esi, esi
je 0x44b5ec
cmp word [esi], ax
je 0x44b5ec
inc eax
cmp word [esi + eax*2], 0
jne 0x44b5e4
mov dword [ebp - 0x28], eax
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0046b90c
mov edx, eax
add esp, 4
mov eax, dword [ebp - 0x28]
xor ecx, ecx
mov dword [ebp - 0x2c], edx
test eax, eax
jle 0x44b62a
mov ax, word [esi + ecx*2]
mov word [edx + ecx*2], ax
inc ecx
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x2c]
cmp ecx, eax
jl 0x44b617
xor ecx, ecx
push ecx
mov word [edx + eax*2], cx
lea ecx, [ebp - 0x2c]
push 0x49faf8
push edi
mov byte [ebp - 0x24], 1
call fcn.00403380
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x44b662
push 2
call fcn.0046b90c
add esp, 4
mov dword [ebp - 0x2c], eax
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], ecx
push ecx
push dword [ebp - 0x480]
lea ecx, [ebp - 0x320]
mov byte [ebp - 0x24], 1
push 0
push dword [ebp - 0x464]
push 0xffffffffffffffff
push 0x49faf8
push eax
call fcn.00419860
mov ecx, dword [ebp - 0x9c]
xor esi, esi
mov edi, dword [ebp - 0x94]
mov dword [ebp - 0x334], eax
nop dword [eax]
test ecx, ecx
jne 0x44b6ac
mov dword [ebp - 0x44c], ecx
jmp 0x44b6ce
cmp esi, ecx
jb 0x44b6c5
lea eax, [ecx - 1]
cmp ecx, eax
ja 0x44b6c0
lea ecx, [eax + 1]
mov dword [ebp - 0x9c], ecx
mov eax, dword [edi + eax*4]
jmp 0x44b6c8
mov eax, dword [edi + esi*4]
mov dword [ebp - 0x44c], eax
mov eax, dword [ebp - 0x480]
cmp eax, 0xffffffff
mov edx, dword [ebp - 0x2e4]
cmove eax, dword [ebp - 0x2e0]
test edx, edx
je 0x44b74e
cmp eax, 1
jl 0x44b74e
cmp eax, dword [ebp - 0x2e0]
jg 0x44b74e
lea eax, [eax + eax*8]
cmp dword [edx + eax*8 + 0xc], 0
mov dword [ebp - 0x46c], eax
je 0x44b74e
cmp dword [edx + eax*8], 0xf
jne 0x44b74e
lea eax, [esi + 2]
mov dword [ebp - 0x440], eax
mov eax, dword [ebp - 0x44c]
mov dword [ebp - 0x434], eax
lea eax, [ebp - 0x448]
push eax
push dword [ebp - 0x334]
mov eax, dword [ebp - 0x46c]
push 0x1074
push dword [edx + eax*8 + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0x9c]
mov edi, dword [ebp - 0x94]
inc esi
cmp esi, 3
jl 0x44b6a0
mov edi, dword [ebp - 0x338]
mov ecx, dword [ebp - 0x488]
inc ecx
jmp 0x44b2ec
mov dword [ebp - 0x340], 0xffffffff
mov esi, dword [ebp - 0x454]
mov ecx, dword [ebp - 0x464]
mov eax, dword [ebp - 0x48]
inc ecx
jmp 0x44af48
mov esi, dword [ebp - 0x480]
mov ecx, esi
mov eax, dword [ebp - 0x2e0]
cmp esi, 0xffffffff
mov edx, dword [ebp - 0x2e4]
cmove ecx, eax
test edx, edx
je 0x44b7d3
cmp ecx, 1
jl 0x44b7d3
cmp ecx, eax
jg 0x44b7d3
lea eax, [ecx + ecx*8]
cmp dword [edx + eax*8 + 0xc], 0
je 0x44b7d3
cmp dword [edx + eax*8], 0xf
jne 0x44b7d3
push 0
push 1
push 0x109d
push dword [edx + eax*8 + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
test byte [ebp - 0x484], 2
je 0x44b849
push 2
push esi
lea ecx, [ebp - 0x320]
call fcn.00417af0
push 2
push dword [ebp - 0x498]
lea ecx, [ebp - 0x320]
call fcn.00417af0
push 0x42
push dword [ebp - 0x490]
lea ecx, [ebp - 0x320]
call fcn.00417af0
push 1
push dword [ebp - 0x470]
lea ecx, [ebp - 0x320]
call fcn.00417af0
push 1
push dword [ebp - 0x4a0]
lea ecx, [ebp - 0x320]
call fcn.00417af0
push 1
push dword [ebp - 0x49c]
lea ecx, [ebp - 0x320]
call fcn.00417af0
push 1
push 5
lea ecx, [ebp - 0x320]
call fcn.00410690
mov ecx, dword [ebp - 0x450]
lea esi, [ecx + 0xd0]
mov dword [ebp - 0x464], esi
jmp 0x44b872
mov esi, dword [ebp - 0x464]
test esi, esi
je 0x44bf98
cmp byte [esi + 0x38], 0
je 0x44b889
mov byte [esi + 0x38], 0
jmp 0x44bc3f
mov dword [esi], 0
lea eax, [esi + 0x14]
mov dword [esi + 4], 0
xorps xmm0, xmm0
mov dword [esi + 8], 0
push 0
mov dword [esi + 0xc], 0
push 0
mov dword [esi + 0x10], 0
movups xmmword [eax], xmm0
push 0
movq qword [eax + 0x10], xmm0
push eax
mov dword [eax + 0x18], 0
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x44bf92
mov edx, dword [esi + 0x18]
cmp edx, 0xcae
jne 0x44b936
mov dword [esi], 0xfffffffa
mov byte [esi + 0x39], 1
test eax, eax
jle 0x44bf92
cmp edx, 0x100
jne 0x44bbcc
mov eax, dword [esi + 0x30]
mov dword [ebp - 0x334], eax
test eax, eax
je 0x44bbcc
mov eax, 0xd
cmp ax, word [esi + 0x1c]
jne 0x44bbcc
mov eax, dword [esi + 0x14]
xor ecx, ecx
mov dword [ebp - 0x46c], eax
test eax, eax
jne 0x44bb36
jmp 0x44bba5
test edx, edx
je 0x44bc39
mov ecx, dword [esi + 0x30]
test ecx, ecx
je 0x44b8ea
cmp edx, 0xcb1
jne 0x44b8ea
mov edx, dword [ecx + 0x3c]
mov eax, dword [esi + 0x1c]
mov dword [ebp - 0x484], eax
test edx, edx
je 0x44bc39
cmp eax, 1
jl 0x44bc39
cmp eax, dword [ecx + 0x40]
jg 0x44bc39
lea eax, [eax + eax*8]
cmp dword [edx + eax*8 + 0xc], 0
je 0x44bc39
mov edx, dword [esi + 0x20]
cmp edx, 0x205
jne 0x44b9ed
mov eax, dword [ecx + 0x1c0]
mov edx, dword [esi + 0x14]
test eax, eax
je 0x44bc39
mov dword [eax + 0x30], ecx
mov eax, dword [ecx + 0x1c0]
mov dword [eax], 0xffffffea
mov eax, dword [ecx + 0x1c0]
mov dword [eax + 8], 0x205
mov eax, dword [ecx + 0x1c0]
mov dword [eax + 4], edx
mov eax, dword [ecx + 0x1c0]
mov edx, dword [ebp - 0x484]
mov dword [eax + 0xc], edx
mov eax, dword [ecx + 0x1c0]
mov dword [eax + 0x10], 0
mov eax, dword [ecx + 0x1c0]
mov byte [eax + 0x38], 1
jmp 0x44bc39
cmp edx, 0x203
jne 0x44ba24
mov eax, dword [ecx + 0x1c0]
mov edx, dword [esi + 0x14]
test eax, eax
je 0x44bc39
mov dword [eax + 0x30], ecx
mov eax, dword [ecx + 0x1c0]
mov dword [eax], 0xfffffff2
mov eax, dword [ecx + 0x1c0]
mov dword [eax + 8], 0x203
jmp 0x44b9b9
cmp edx, 0x202
jne 0x44ba45
push 0
push 0
push dword [esi + 0x14]
push edx
mov edx, dword [ebp - 0x484]
push edx
call fcn.0041ad60
jmp 0x44bc39
cmp edx, 0x402
jne 0x44ba7f
mov eax, dword [ecx + 0x1c0]
mov edx, dword [esi + 0x14]
test eax, eax
je 0x44bc39
mov dword [eax + 0x30], ecx
mov eax, dword [ecx + 0x1c0]
mov dword [eax], 0xffffff35
mov eax, dword [ecx + 0x1c0]
mov dword [eax + 8], 0x402
jmp 0x44b9b9
cmp edx, 0x403
je 0x44bafc
cmp edx, 0x404
je 0x44bafc
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x44c], eax
mov eax, dword [ecx + 0x1c0]
cmp edx, 0x405
jne 0x44bad1
test eax, eax
je 0x44bc39
mov dword [eax + 0x30], ecx
mov eax, dword [ecx + 0x1c0]
mov dword [eax], 0xffffff34
mov eax, dword [ecx + 0x1c0]
mov dword [eax + 8], edx
mov edx, dword [ebp - 0x44c]
jmp 0x44b9b9
test eax, eax
je 0x44bc39
mov dword [eax + 0x30], ecx
mov eax, dword [ecx + 0x1c0]
mov dword [eax], 0xffffff36
mov eax, dword [ecx + 0x1c0]
mov dword [eax + 8], edx
mov edx, dword [ebp - 0x44c]
jmp 0x44b9b9
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x334], eax
mov eax, dword [ecx + 0x1c0]
test eax, eax
je 0x44bc39
mov dword [eax + 0x30], ecx
mov eax, dword [ecx + 0x1c0]
mov dword [eax], 0xffffff33
mov eax, dword [ecx + 0x1c0]
mov dword [eax + 8], edx
mov edx, dword [ebp - 0x334]
jmp 0x44b9b9
push 0xfffffffffffffff4
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, dword [ebp - 0x334]
mov edx, dword [ecx + 0x3c]
test edx, edx
je 0x44bba1
cmp eax, 1
jl 0x44bba1
cmp eax, dword [ecx + 0x40]
jg 0x44bba1
lea ecx, [eax + eax*8]
cmp dword [edx + ecx*8 + 0xc], 0
je 0x44bba1
mov ecx, dword [ebp - 0x46c]
lea edi, [eax + eax*8]
cmp dword [edx + edi*8 + 4], ecx
mov edi, dword [ebp - 0x338]
jne 0x44bba1
mov edx, dword [esi + 0x30]
mov ecx, dword [edx + 0x3c]
test ecx, ecx
je 0x44bb9d
cmp eax, dword [edx + 0x40]
jg 0x44bb9d
lea edx, [eax + eax*8]
cmp dword [ecx + edx*8 + 0xc], 0
je 0x44bb9d
mov ecx, dword [ecx + edx*8]
cmp ecx, 0x23
je 0x44bbaf
cmp ecx, 0x24
jne 0x44bba5
jmp 0x44bbaf
xor ecx, ecx
jmp 0x44bba5
xor eax, eax
mov ecx, eax
cmp ecx, 0x22
je 0x44bbaf
cmp ecx, 0x25
jne 0x44bbcc
mov ecx, dword [esi + 0x14]
push ecx
movzx eax, ax
push eax
push 0x111
push ecx
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x44bc39
mov eax, dword [esi + 0x34]
test eax, eax
je 0x44bc21
lea ecx, [esi + 0x14]
test ecx, ecx
jne 0x44bbde
xor cl, cl
jmp 0x44bc1d
mov edx, dword [eax + 0x244]
add eax, 0x230
mov dword [ebp - 0x334], eax
test edx, edx
je 0x44bc0f
push ecx
push edx
push dword [eax]
call dword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
setne cl
test eax, eax
jne 0x44bc1d
mov eax, dword [ebp - 0x334]
lea ecx, [esi + 0x14]
push ecx
push dword [eax]
call dword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
setne cl
test cl, cl
jne 0x44bc35
lea eax, [esi + 0x14]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esi + 0x14]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
mov byte [esi + 0x38], 0
mov ecx, dword [ebp - 0x450]
mov eax, dword [esi]
cmp eax, 0xfffffffa
je 0x44bf98
lea edx, [ebp - 0x320]
cmp dword [ecx + 0x100], edx
jne 0x44b872
cmp eax, dword [ebp - 0x45c]
je 0x44bf98
cmp eax, dword [ebp - 0x4a0]
jne 0x44bce5
cmp dword [ecx + 0x994], 0
jne 0x44bc9a
push 2
call fcn.0046b90c
mov ecx, dword [ebp - 0x450]
add esp, 4
xor edx, edx
mov dword [ecx + 0x994], eax
mov word [eax], dx
mov dword [ecx + 0x998], edx
push ecx
push 5
mov byte [ecx + 0x99c], 1
xor edx, edx
mov ecx, dword [ecx + 0x994]
push 0
call fcn.0040b800
mov ecx, dword [ebp - 0x450]
mov esi, eax
test esi, esi
je 0x44b86c
cmp esi, 0xffffffff
je 0x44b86c
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessId]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x450]
jmp 0x44b86c
cmp eax, dword [ebp - 0x498]
jne 0x44be50
sub esp, 8
lea eax, [ebp - 0x320]
push 0x8c
push 0x190
push 0
push eax
push 1
push 0x4a8760
call fcn.00441c90
mov ecx, dword [ebp - 0x450]
test eax, eax
je 0x44b872
mov eax, dword [ebp - 0x454]
xor ecx, ecx
mov dword [ebp - 0x44c], eax
mov dword [ebp - 0x47c], 0
mov dword [ebp - 0x334], str.MonitoringHistory
mov byte [ebp - 0x474], 0
mov dword [ebp - 0x478], 0
inc ecx
cmp word [ecx*2 + str.HKCUSoftwareClearDiskInfo], 0
jne 0x44bd54
xor eax, eax
inc eax
cmp word [eax*2 + str.MonitoringHistory], 0
jne 0x44bd62
add eax, ecx
mov edx, 2
mov dword [ebp - 0x46c], eax
xor ecx, ecx
inc eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0046b90c
mov esi, str.HKCUSoftwareClearDiskInfo
mov dword [ebp - 0x454], eax
add esp, 4
mov ecx, eax
mov edx, 0x48
sub esi, eax
mov word [ecx], dx
add ecx, 2
movzx eax, word [esi + ecx]
mov edx, eax
test ax, ax
jne 0x44bda4
mov esi, dword [ebp - 0x464]
mov eax, 0x5c
mov edi, dword [ebp - 0x334]
mov word [ecx], ax
lea edi, [edi + 2]
movzx eax, word [edi]
lea ecx, [ecx + 2]
test ax, ax
jne 0x44bdc6
mov edi, dword [ebp - 0x338]
xor eax, eax
mov word [ecx], ax
mov eax, dword [ebp - 0x454]
mov dword [ebp - 0x47c], eax
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0x478], eax
mov eax, dword [ebp - 0x44c]
test eax, eax
je 0x44be0d
push eax
call fcn.0046b303
add esp, 4
push dword [ebp - 0x454]
lea ecx, [ebp - 0x4c]
mov byte [ebp - 0x474], 1
call fcn.00404610
mov ecx, dword [ebp - 0x450]
test al, al
je 0x44b872
push 0
push 0
push 0x1009
push dword [ebp - 0x468]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0x450]
jmp 0x44b872
cmp eax, dword [ebp - 0x49c]
jne 0x44bef1
push 2
push dword [ebp - 0x480]
lea ecx, [ebp - 0x320]
call fcn.00417af0
push 2
push dword [ebp - 0x498]
lea ecx, [ebp - 0x320]
call fcn.00417af0
push 2
push dword [ebp - 0x490]
lea ecx, [ebp - 0x320]
call fcn.00417af0
push 1
push dword [ebp - 0x470]
lea ecx, [ebp - 0x320]
call fcn.00417af0
push 1
push dword [ebp - 0x4a0]
lea ecx, [ebp - 0x320]
call fcn.00417af0
push 1
push dword [ebp - 0x49c]
lea ecx, [ebp - 0x320]
call fcn.00417af0
push 0
push 0x4ee694
push dword [ebp - 0x460]
lea ecx, [ebp - 0x320]
call fcn.00418210
mov ecx, dword [ebp - 0x450]
jmp 0x44b872
cmp eax, dword [ebp - 0x490]
jne 0x44b872
push 2
push dword [ebp - 0x470]
lea ecx, [ebp - 0x320]
call fcn.00417af0
push 2
push dword [ebp - 0x4a0]
lea ecx, [ebp - 0x320]
call fcn.00417af0
push 2
push dword [ebp - 0x49c]
lea ecx, [ebp - 0x320]
call fcn.00417af0
push 1
push dword [ebp - 0x480]
lea ecx, [ebp - 0x320]
call fcn.00417af0
push 1
push dword [ebp - 0x498]
lea ecx, [ebp - 0x320]
call fcn.00417af0
push 1
push dword [ebp - 0x490]
lea ecx, [ebp - 0x320]
call fcn.00417af0
push 0
push str.Clear_Disk_Info______._____.
push dword [ebp - 0x460]
lea ecx, [ebp - 0x320]
call fcn.00418210
mov ecx, dword [ebp - 0x450]
jmp 0x44b872
mov dword [esi], 0xfffffed4
push 0
push 0
push 0x1004
push dword [ebp - 0x48c]
mov dword [ebp - 0x490], 0
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x480], eax
test eax, eax
jle 0x44cbbc
xor eax, eax
nop word [eax + eax]
push eax
push dword [ebp - 0x470]
lea ecx, [ebp - 0x320]
call fcn.00419ab0
mov ecx, eax
test ecx, ecx
js 0x44cb9d
mov edi, dword [ebp - 0x450]
mov edx, dword [edi + 0x9c4]
cmp ecx, edx
jge 0x44cb9d
jb 0x44c00b
lea edx, [ecx + 1]
mov dword [edi + 0x9c4], edx
mov eax, dword [edi + 0x9cc]
lea esi, [ecx + ecx*2]
shl esi, 5
cmp byte [esi + eax], 0
je 0x44cb9d
cmp edx, ecx
ja 0x44c02e
lea eax, [ecx + 1]
mov dword [edi + 0x9c4], eax
mov edi, dword [edi + 0x9cc]
add edi, esi
mov dword [ebp - 0x498], edi
mov eax, dword [edi + 0x54]
test eax, eax
je 0x44cb9d
cmp word [eax], 0
je 0x44cb9d
push 0
push dword [ebp - 0x490]
lea ecx, [ebp - 0x320]
push dword [ebp - 0x470]
call fcn.00419bd0
mov esi, eax
test esi, esi
jne 0x44c07b
push eax
lea ecx, [ebp - 0x2c]
call fcn.00401a90
jmp 0x44c099
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x44c08b
push eax
call fcn.0046b303
add esp, 4
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], 0
mov byte [ebp - 0x24], 1
push 1
push dword [ebp - 0x490]
lea ecx, [ebp - 0x320]
push dword [ebp - 0x470]
call fcn.00419bd0
mov esi, eax
test esi, esi
jne 0x44c0c3
push eax
lea ecx, [ebp - 0x44]
call fcn.00401a90
jmp 0x44c0e1
mov eax, dword [ebp - 0x44]
test eax, eax
je 0x44c0d3
push eax
call fcn.0046b303
add esp, 4
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x40], 0
mov byte [ebp - 0x3c], 1
cmp dword [edi + 0x54], 0
jne 0x44c12b
push 2
call fcn.0046b90c
mov dword [edi + 0x54], eax
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x47c], ecx
mov word [eax], cx
mov dword [edi + 0x58], ecx
mov byte [edi + 0x5c], 1
mov edx, dword [edi + 0x54]
mov byte [ebp - 0x474], cl
mov dword [ebp - 0x478], ecx
mov ecx, edx
mov dword [ebp - 0x48c], edx
mov dword [ebp - 0x45c], edx
mov dword [ebp - 0x460], ecx
jmp 0x44c16d
mov ecx, dword [ebp - 0x454]
mov byte [edi + 0x5c], 1
mov eax, dword [edi + 0x54]
mov dword [ebp - 0x454], ecx
mov ecx, eax
mov dword [ebp - 0x48c], eax
mov dword [ebp - 0x45c], eax
mov dword [ebp - 0x47c], 0
mov dword [ebp - 0x460], eax
mov byte [ebp - 0x474], 0
mov dword [ebp - 0x478], 0
mov esi, str.Monitoring_
xor eax, eax
nop dword [eax]
nop dword [eax + eax]
lea eax, [eax + 1]
cmp word [eax*2 + str.HKCUSoftwareClearDiskInfo], 0
jne 0x44c180
xor edx, edx
lea edx, [edx + 1]
cmp word [edx*2 + str.Monitoring_], 0
jne 0x44c190
lea edi, [eax + edx]
mov edx, dword [ebp - 0x48c]
test edx, edx
jne 0x44c1c5
mov eax, dword [ebp - 0x454]
mov dword [ebp - 0x48c], edx
mov dword [ebp - 0x454], eax
mov dword [ebp - 0x460], ecx
jmp 0x44c1fa
xor eax, eax
cmp word [edx], ax
je 0x44c1f8
mov dword [ebp - 0x48c], edx
mov edx, dword [ebp - 0x454]
mov dword [ebp - 0x460], ecx
mov ecx, dword [ebp - 0x45c]
mov dword [ebp - 0x454], edx
nop word [eax + eax]
inc eax
cmp word [ecx + eax*2], 0
jne 0x44c1f0
add edi, eax
xor ecx, ecx
mov dword [ebp - 0x44c], edi
lea eax, [edi + 1]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0046b90c
mov edi, str.HKCUSoftwareClearDiskInfo
mov dword [ebp - 0x45c], eax
add esp, 4
mov ecx, eax
mov edx, 0x48
sub edi, eax
mov word [ecx], dx
add ecx, 2
movzx eax, word [edi + ecx]
mov edx, eax
test ax, ax
jne 0x44c230
mov edi, dword [ebp - 0x498]
mov eax, 0x5c
nop dword [eax]
mov word [ecx], ax
lea esi, [esi + 2]
movzx eax, word [esi]
add ecx, 2
test ax, ax
jne 0x44c250
mov eax, dword [ebp - 0x48c]
test eax, eax
je 0x44c291
movzx eax, word [eax]
mov edx, eax
test ax, ax
je 0x44c291
mov eax, dword [ebp - 0x460]
nop dword [eax + eax]
mov word [ecx], dx
lea eax, [eax + 2]
movzx edx, word [eax]
add ecx, 2
test dx, dx
jne 0x44c280
xor eax, eax
mov word [ecx], ax
mov eax, dword [ebp - 0x45c]
mov dword [ebp - 0x47c], eax
mov eax, dword [ebp - 0x44c]
mov dword [ebp - 0x478], eax
mov eax, dword [ebp - 0x454]
test eax, eax
je 0x44c2c1
push eax
call fcn.0046b303
add esp, 4
mov esi, dword [ebp - 0x44]
mov byte [ebp - 0x474], 1
test esi, esi
jne 0x44c2e7
push 2
call fcn.0046b90c
add esp, 4
mov dword [ebp - 0x44], eax
xor ecx, ecx
mov word [eax], cx
mov esi, dword [ebp - 0x44]
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 0x3c], 1
test eax, eax
jne 0x44c30a
push 2
call fcn.0046b90c
add esp, 4
mov dword [ebp - 0x2c], eax
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], ecx
push ecx
push esi
push ecx
push eax
push dword [ebp - 0x45c]
lea ecx, [ebp - 0x48]
mov byte [ebp - 0x24], 1
call fcn.00404470
cmp dword [edi + 0x54], 0
jne 0x44c35e
push 2
call fcn.0046b90c
mov dword [edi + 0x54], eax
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x47c], ecx
mov word [eax], cx
mov dword [edi + 0x58], ecx
mov byte [edi + 0x5c], 1
mov edx, dword [edi + 0x54]
mov edi, edx
mov byte [ebp - 0x474], cl
mov dword [ebp - 0x478], ecx
mov dword [ebp - 0x460], edi
jmp 0x44c388
mov byte [edi + 0x5c], 1
mov edx, dword [edi + 0x54]
mov edi, edx
mov dword [ebp - 0x47c], 0
mov dword [ebp - 0x460], edx
mov byte [ebp - 0x474], 0
mov dword [ebp - 0x478], 0
mov esi, str.MonitoringHistory_
mov dword [ebp - 0x44c], edx
mov dword [ebp - 0x464], edx
xor eax, eax
nop dword [eax + eax]
inc eax
cmp word [eax*2 + str.HKCUSoftwareClearDiskInfo], 0
jne 0x44c3a0
xor ecx, ecx
nop
inc ecx
cmp word [ecx*2 + str.MonitoringHistory_], 0
jne 0x44c3b0
add ecx, eax
mov dword [ebp - 0x488], ecx
test edx, edx
jne 0x44c3d6
mov dword [ebp - 0x464], edx
mov dword [ebp - 0x460], edi
jmp 0x44c400
xor eax, eax
cmp word [edx], ax
je 0x44c3fe
mov ecx, dword [ebp - 0x44c]
mov dword [ebp - 0x464], edx
mov dword [ebp - 0x460], edi
nop
inc eax
cmp word [ecx + eax*2], 0
jne 0x44c3f0
mov ecx, dword [ebp - 0x488]
add ecx, eax
lea eax, [ecx + 1]
mov dword [ebp - 0x488], ecx
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0046b90c
mov edi, str.HKCUSoftwareClearDiskInfo
mov dword [ebp - 0x454], eax
add esp, 4
mov ecx, eax
mov edx, 0x48
sub edi, eax
mov word [ecx], dx
add ecx, 2
movzx eax, word [ecx + edi]
mov edx, eax
test ax, ax
jne 0x44c436
mov edi, dword [ebp - 0x460]
mov eax, 0x5c
mov word [ecx], ax
lea esi, [esi + 2]
movzx eax, word [esi]
add ecx, 2
test ax, ax
jne 0x44c452
mov eax, dword [ebp - 0x464]
test eax, eax
je 0x44c488
movzx eax, word [eax]
mov edx, eax
test ax, ax
je 0x44c488
mov word [ecx], ax
lea edi, [edi + 2]
movzx eax, word [edi]
add ecx, 2
test ax, ax
jne 0x44c477
push dword [ebp - 0x45c]
xor eax, eax
mov byte [ebp - 0x474], 1
mov word [ecx], ax
mov eax, dword [ebp - 0x454]
mov dword [ebp - 0x47c], eax
mov eax, dword [ebp - 0x488]
mov dword [ebp - 0x478], eax
call fcn.0046b303
mov edi, dword [ebp - 0x498]
add esp, 4
cmp dword [edi + 0x54], 0
jne 0x44c4db
push 2
call fcn.0046b90c
add esp, 4
mov dword [edi + 0x54], eax
xor ecx, ecx
mov word [eax], cx
mov dword [edi + 0x58], ecx
mov byte [edi + 0x5c], 1
cmp dword [edi + 0x3c], 0
mov esi, dword [edi + 0x54]
jne 0x44c4fd
push 2
call fcn.0046b90c
add esp, 4
mov dword [edi + 0x3c], eax
xor ecx, ecx
mov word [eax], cx
mov dword [edi + 0x40], ecx
mov byte [edi + 0x44], 1
mov ecx, dword [edi + 0x3c]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x44c], eax
xor eax, eax
mov dword [ebp - 0x334], ecx
mov dword [ebp - 0x20], 0
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
test ecx, ecx
je 0x44c538
cmp word [ecx], ax
je 0x44c538
inc eax
cmp word [ecx + eax*2], 0
jne 0x44c530
xor ecx, ecx
nop word [eax + eax]
inc ecx
cmp word [ecx*2 + 0x4a87e8], 0
jne 0x44c540
add ecx, eax
test esi, esi
je 0x44c56a
xor eax, eax
cmp word [esi], ax
je 0x44c568
nop dword [eax]
inc eax
cmp word [esi + eax*2], 0
jne 0x44c560
add ecx, eax
lea eax, [ecx + 1]
mov dword [ebp - 0x45c], ecx
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0046b90c
mov edx, dword [ebp - 0x20]
add esp, 4
mov dword [ebp - 0x46c], eax
mov ecx, eax
test edx, edx
je 0x44c5b4
movzx eax, word [edx]
test ax, ax
je 0x44c5b4
mov word [ecx], ax
lea edx, [edx + 2]
movzx eax, word [edx]
add ecx, 2
test ax, ax
jne 0x44c5a3
mov edx, dword [ebp - 0x334]
test edx, edx
je 0x44c5e4
movzx eax, word [edx]
mov edi, eax
mov dword [ebp - 0x334], edi
test ax, ax
je 0x44c5e4
movzx edi, ax
sub edx, ecx
mov word [ecx], di
add ecx, 2
movzx eax, word [ecx + edx]
mov edi, eax
test ax, ax
jne 0x44c5d3
mov edi, 0x4a87e8
mov edx, 0x20
sub edi, ecx
mov word [ecx], dx
add ecx, 2
movzx eax, word [ecx + edi]
mov edx, eax
test ax, ax
jne 0x44c5f0
mov edi, dword [ebp - 0x498]
test esi, esi
je 0x44c626
movzx eax, word [esi]
mov edx, eax
test ax, ax
je 0x44c626
mov word [ecx], ax
lea esi, [esi + 2]
movzx eax, word [esi]
add ecx, 2
test ax, ax
jne 0x44c615
xor eax, eax
mov word [ecx], ax
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x44c63b
push eax
call fcn.0046b303
add esp, 4
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x45c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x44c]
mov byte [ebp - 0x18], 1
test eax, eax
je 0x44c664
push eax
call fcn.0046b303
add esp, 4
cmp dword [edi + 0x3c], 0
mov byte [ebp - 0x474], 1
jne 0x44c686
push 2
call fcn.0046b90c
add esp, 4
mov dword [edi + 0x3c], eax
xor ecx, ecx
mov word [eax], cx
mov dword [edi + 0x40], ecx
push ecx
mov byte [edi + 0x44], 1
push dword [edi + 0x3c]
push ecx
push 0x4ee9a8
push dword [ebp - 0x454]
lea ecx, [ebp - 0x48]
call fcn.00404470
lea eax, [ebp - 0x330]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push ecx
lea edx, [ebp - 0x20]
lea ecx, [ebp - 0x330]
call fcn.00407300
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x45c], eax
test eax, eax
jne 0x44c6e9
push 2
call fcn.0046b90c
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x45c], eax
mov byte [ebp - 0x18], 1
test eax, eax
jne 0x44c70f
push 2
call fcn.0046b90c
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x45c], eax
mov esi, dword [ebp - 0x28]
mov byte [ebp - 0x18], 1
mov byte [ebp - 0x24], 0
test esi, esi
jne 0x44c73b
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x44c738
cmp word [ecx], si
je 0x44c738
nop word [eax + eax]
inc esi
cmp word [ecx + esi*2], 0
jne 0x44c730
mov dword [ebp - 0x28], esi
test eax, eax
je 0x44c750
xor ecx, ecx
cmp word [eax], cx
je 0x44c74e
inc ecx
cmp word [eax + ecx*2], 0
jne 0x44c746
add esi, ecx
xor eax, eax
inc eax
cmp word [eax*2 + 0x49faf8], 0
jne 0x44c752
add esi, eax
xor ecx, ecx
mov edx, 2
mov dword [ebp - 0x334], esi
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0046b90c
mov edi, dword [ebp - 0x45c]
add esp, 4
mov ecx, dword [ebp - 0x2c]
mov edx, eax
mov dword [ebp - 0x468], eax
mov dword [ebp - 0x44c], ecx
test edi, edi
je 0x44c7c7
movzx ecx, word [edi]
test cx, cx
je 0x44c7c1
sub edi, eax
nop word [eax + eax]
mov word [edx], cx
add edx, 2
movzx eax, word [edi + edx]
mov ecx, eax
test ax, ax
jne 0x44c7b0
mov ecx, dword [ebp - 0x44c]
mov esi, 0x49faf8
mov edi, 0x7c
sub esi, edx
mov word [edx], di
add edx, 2
movzx eax, word [esi + edx]
mov edi, eax
test ax, ax
jne 0x44c7d3
cmp dword [ebp - 0x2c], 0
mov esi, dword [ebp - 0x334]
je 0x44c811
movzx eax, word [ecx]
mov edi, eax
test ax, ax
je 0x44c811
nop word [eax + eax]
mov word [edx], ax
lea ecx, [ecx + 2]
movzx eax, word [ecx]
add edx, 2
test ax, ax
jne 0x44c800
xor eax, eax
mov word [edx], ax
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x44c826
push eax
call fcn.0046b303
add esp, 4
mov edi, dword [ebp - 0x490]
lea ecx, [ebp - 0x320]
mov eax, dword [ebp - 0x468]
push 2
push edi
push dword [ebp - 0x470]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], esi
mov byte [ebp - 0x24], 1
call fcn.00419bd0
mov esi, eax
mov eax, dword [ebp - 0x38]
test esi, esi
jne 0x44c8ab
test eax, eax
je 0x44c866
push eax
call fcn.0046b303
add esp, 4
push 2
mov byte [ebp - 0x30], 0
mov dword [ebp - 0x34], 0
call fcn.0046b90c
mov edx, eax
add esp, 4
mov eax, dword [ebp - 0x34]
xor ecx, ecx
mov dword [ebp - 0x38], edx
test eax, eax
jle 0x44c8a3
nop dword [eax]
mov ax, word [ecx + ecx]
mov word [edx + ecx*2], ax
inc ecx
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x38]
cmp ecx, eax
jl 0x44c890
xor ecx, ecx
mov word [edx + eax*2], cx
jmp 0x44c8c2
test eax, eax
je 0x44c8b8
push eax
call fcn.0046b303
add esp, 4
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], 0
push 3
push edi
push dword [ebp - 0x470]
lea ecx, [ebp - 0x320]
mov byte [ebp - 0x30], 1
call fcn.00419bd0
mov esi, eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x460], esi
test esi, esi
jne 0x44c944
test eax, eax
je 0x44c8f6
push eax
call fcn.0046b303
add esp, 4
push 2
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
call fcn.0046b90c
mov edx, eax
add esp, 4
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov dword [ebp - 0x20], edx
test eax, eax
jle 0x44c933
nop dword [eax]
mov ax, word [ecx + ecx]
mov word [edx + ecx*2], ax
inc ecx
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
cmp ecx, eax
jl 0x44c920
xor ecx, ecx
mov word [edx + eax*2], cx
mov esi, dword [ebp - 0x20]
mov dword [ebp - 0x460], esi
jmp 0x44c95b
test eax, eax
je 0x44c951
push eax
call fcn.0046b303
add esp, 4
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], 0
mov edi, dword [ebp - 0x38]
mov byte [ebp - 0x18], 1
mov dword [ebp - 0x45c], edi
test edi, edi
jne 0x44c993
push 2
call fcn.0046b90c
add esp, 4
mov dword [ebp - 0x38], eax
xor ecx, ecx
mov word [eax], cx
mov esi, dword [ebp - 0x20]
mov edi, dword [ebp - 0x38]
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x460], esi
mov dword [ebp - 0x45c], edi
mov byte [ebp - 0x30], 1
test esi, esi
jne 0x44c9b9
push 2
call fcn.0046b90c
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov esi, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x460], esi
mov eax, dword [ebp - 0x40]
mov byte [ebp - 0x18], 1
mov dword [ebp - 0x334], 0x4a01b0
mov byte [ebp - 0x3c], 0
test eax, eax
jne 0x44c9eb
mov ecx, dword [ebp - 0x44]
test ecx, ecx
je 0x44c9e8
cmp word [ecx], ax
je 0x44c9e8
nop
inc eax
cmp word [ecx + eax*2], 0
jne 0x44c9e0
mov dword [ebp - 0x40], eax
xor ecx, ecx
nop dword [eax]
inc ecx
cmp word [ecx*2 + 0x4a01b0], 0
jne 0x44c9f0
add ecx, eax
test edi, edi
je 0x44ca1a
xor eax, eax
cmp word [edi], ax
je 0x44ca18
nop dword [eax]
inc eax
cmp word [edi + eax*2], 0
jne 0x44ca10
add ecx, eax
xor eax, eax
nop dword [eax]
inc eax
cmp word [eax*2 + 0x4a01b0], 0
jne 0x44ca20
add ecx, eax
test esi, esi
je 0x44ca4a
xor eax, eax
cmp word [esi], ax
je 0x44ca48
nop dword [eax]
inc eax
cmp word [esi + eax*2], 0
jne 0x44ca40
add ecx, eax
lea eax, [ecx + 1]
mov dword [ebp - 0x44c], ecx
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0046b90c
mov edx, dword [ebp - 0x44]
add esp, 4
mov dword [ebp - 0x468], eax
mov ecx, eax
test edx, edx
je 0x44ca94
movzx eax, word [edx]
test ax, ax
je 0x44ca94
mov word [ecx], ax
lea edx, [edx + 2]
movzx eax, word [edx]
add ecx, 2
test ax, ax
jne 0x44ca83
mov edi, 0x4a01b0
mov edx, 0xa
sub edi, ecx
mov word [ecx], dx
add ecx, 2
movzx eax, word [edi + ecx]
mov edx, eax
test ax, ax
jne 0x44caa0
mov edi, dword [ebp - 0x45c]
test edi, edi
je 0x44cad6
movzx eax, word [edi]
mov edx, eax
test ax, ax
je 0x44cad6
mov word [ecx], ax
lea edi, [edi + 2]
movzx eax, word [edi]
add ecx, 2
test ax, ax
jne 0x44cac5
mov esi, dword [ebp - 0x334]
mov eax, 0xa
mov word [ecx], ax
lea esi, [esi + 2]
movzx eax, word [esi]
add ecx, 2
test ax, ax
jne 0x44cae1
mov esi, dword [ebp - 0x460]
test esi, esi
je 0x44cb17
movzx eax, word [esi]
mov edx, eax
test ax, ax
je 0x44cb17
mov word [ecx], ax
lea esi, [esi + 2]
movzx eax, word [esi]
add ecx, 2
test ax, ax
jne 0x44cb06
xor eax, eax
mov word [ecx], ax
mov eax, dword [ebp - 0x44]
test eax, eax
je 0x44cb2c
push eax
call fcn.0046b303
add esp, 4
mov esi, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x468]
mov eax, dword [ebp - 0x44c]
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x3c], 1
test esi, esi
jne 0x44cb67
push 2
call fcn.0046b90c
mov edx, dword [ebp - 0x468]
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x2c], eax
mov word [eax], cx
mov esi, dword [ebp - 0x2c]
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x48]
mov byte [ebp - 0x24], 1
test eax, eax
je 0x44cb9d
xor ecx, ecx
cmp word [edx], cx
je 0x44cb88
nop dword [eax]
inc ecx
cmp word [edx + ecx*2], 0
jne 0x44cb80
lea ecx, [ecx*2 + 2]
push ecx
push edx
push 1
push 0
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x490]
inc eax
mov dword [ebp - 0x490], eax
cmp eax, dword [ebp - 0x480]
jl 0x44bfd0
mov edi, dword [ebp - 0x338]
mov eax, dword [ebp - 0x450]
push 0x20
push dword [eax + 0x10]
lea ecx, [eax + 0x148]
call fcn.00417af0
test edi, edi
je 0x44cbdf
push edi
call fcn.00465bd0
add esp, 4
mov eax, dword [ebp - 0x90]
test eax, eax
je 0x44cbf2
push eax
call fcn.0046b303
add esp, 4
mov eax, dword [ebp - 0x94]
test eax, eax
je 0x44cc05
push eax
call fcn.0046b303
add esp, 4
mov eax, dword [ebp - 0x344]
test eax, eax
je 0x44cc18
push eax
call fcn.0046b303
add esp, 4
push dword [ebp - 0x494]
call fcn.0046b303
mov esi, dword [ebp - 0x4a4]
add esp, 4
mov eax, dword [ebp - 0x4c]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x44cc41
cmp eax, 0xffffffff
je 0x44cc41
push eax
call edi
mov eax, dword [ebp - 0x48]
test eax, eax
je 0x44cc50
cmp eax, 0xffffffff
je 0x44cc50
push eax
call edi
mov eax, dword [ebp - 0x454]
test eax, eax
je 0x44cc63
push eax
call fcn.0046b303
add esp, 4
mov eax, dword [ebp - 0x38]
test eax, eax
je 0x44cc73
push eax
call fcn.0046b303
add esp, 4
mov eax, dword [ebp - 0x44]
test eax, eax
je 0x44cc83
push eax
call fcn.0046b303
add esp, 4
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x44cc93
push eax
call fcn.0046b303
add esp, 4
mov eax, dword [ebp - 0x58]
test eax, eax
je 0x44cca3
push eax
call fcn.0046b303
add esp, 4
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x44ccb3
push eax
call fcn.0046b303
add esp, 4
lea ecx, [ebp - 0x320]
mov dword [ebp - 4], 0x14
call fcn.0040efc0
mov eax, dword [ebp - 0x2e4]
test eax, eax
je 0x44ccd8
push eax
call fcn.0046b303
add esp, 4
mov ecx, dword [ebp - 0x210]
test ecx, ecx
je 0x44cceb
push ecx
call fcn.0046b303
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0046b2f5
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4