Function at 0xa59ae0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0xa8f077
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xb5c
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x24]
call fcn.00a50480
xor ebx, ebx
lea ecx, [esp + 0x24]
mov dword [esp + 0xb74], ebx
call fcn.00a504c0
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov esi, dword [esp + 0xb80]
mov byte [esp + 0xb74], 1
cmp esi, ebx
je 0xa59c11
mov edi, dword [esp + 0xb7c]
push edi
call fcn.00a52330
add esp, 4
test al, al
je 0xa59b94
cmp word [esi], bx
jne 0xa59b94
mov eax, dword [esp + 0x10]
mov byte [esp + 0xb74], bl
cmp eax, ebx
je 0xa59b70
lea ecx, [esp + 0x10]
call fcn.00a5b3c0
cmp dword [esp + 0x10], ebx
jne 0xa59b61
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0xa59c11
mov esi, dword [eax + 4]
push eax
call fcn.00a7d8f0
add esp, 4
mov eax, esi
cmp esi, ebx
mov dword [esp + 0x14], eax
jne 0xa59b7c
jmp 0xa59c11
lea eax, [esp + 0x10]
lea ecx, [esp + 0x1c]
push eax
push ecx
lea edx, [esp + 0x2c]
push edi
push edx
call fcn.00a523e0
add esp, 0x10
test al, al
mov eax, dword [0xaa2204]
mov ecx, dword [eax]
jne 0xa59c2c
shr ecx, 0xd
test cl, 1
je 0xa59bd5
mov edx, dword [esp + 0xb88]
push edi
push str.__hKey_x__not_seen_before__
push edx
call fcn.00a16060
add esp, 0xc
mov eax, dword [esp + 0x10]
mov byte [esp + 0xb74], bl
cmp eax, ebx
je 0xa59bf3
lea ecx, [esp + 0x10]
call fcn.00a5b3c0
cmp dword [esp + 0x10], ebx
jne 0xa59be4
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0xa59c11
mov esi, dword [eax + 4]
push eax
call fcn.00a7d8f0
add esp, 4
mov eax, esi
cmp esi, ebx
mov dword [esp + 0x14], eax
jne 0xa59bfb
lea ecx, [esp + 0x24]
mov dword [esp + 0xb74], 0xffffffff
call fcn.00a51780
xor al, al
jmp 0xa5b21e
mov ebp, dword [esp + 0xb88]
shr ecx, 0xd
test cl, 1
je 0xa59c63
cmp ebp, ebx
je 0xa59c63
mov eax, dword [esp + 0x1c]
mov edx, dword [eax + 0xc]
mov eax, dword [eax + 8]
push edx
push eax
call fcn.00a534a0
add esp, 4
push eax
push edi
push str.__xh_ls_ls_
push ebp
call fcn.00a16060
add esp, 0x14
lea ecx, [esp + 0x11c]
call fcn.00a155c0
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x11c]
push ecx
push esi
mov eax, dword [edx + 0xc]
mov byte [esp + 0xb7c], 2
push eax
call fcn.00a525f0
mov eax, dword [esp + 0x130]
lea ecx, [esp + 0xbc]
push ecx
mov ecx, dword [esp + 0x2c]
lea edx, [esp + 0x58]
mov dword [esp + 0x58], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0xc0], ebx
mov dword [esp + 0xc4], ebx
push edx
mov edx, dword [ecx + 8]
push ebx
push eax
push edx
lea eax, [esp + 0x44]
push ebx
push eax
mov byte [esp + 0x42], 1
call fcn.00a54500
add esp, 0x28
cmp eax, 1
jne 0xa59d61
mov ecx, dword [esp + 0xb84]
mov eax, dword [esp + 0x10]
cmp eax, ebx
mov dword [ecx], 2
je 0xa59d08
mov ecx, eax
push 0xaf53f0
dec ecx
mov dword [esp + 0x14], ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [esp + 0x11c]
mov byte [esp + 0xb74], 1
call fcn.00a155e0
mov eax, dword [esp + 0x10]
mov byte [esp + 0xb74], bl
cmp eax, ebx
je 0xa59d3a
lea ecx, [esp + 0x10]
call fcn.00a5b3c0
cmp dword [esp + 0x10], ebx
jne 0xa59d2b
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0xa5b208
mov esi, dword [eax + 4]
push eax
call fcn.00a7d8f0
add esp, 4
mov eax, esi
cmp esi, ebx
mov dword [esp + 0x14], eax
jne 0xa59d46
jmp 0xa5b208
cmp eax, ebx
jne 0xa5a290
mov edx, dword [0xaa2204]
mov eax, dword [edx]
shr eax, 0xd
test al, 1
je 0xa59d8a
cmp ebp, ebx
je 0xa59d8a
push str._found_in_RW_View_
push ebp
call fcn.00a16060
add esp, 8
lea ecx, [esp + 0x53c]
call fcn.00a155c0
mov ecx, dword [esp + 0x48]
push ebx
push ecx
lea ecx, [esp + 0x2c]
mov byte [esp + 0xb7c], 3
call fcn.00a5b240
lea edx, [esp + 0x1a]
lea ecx, [esp + 0x78]
push edx
mov esi, eax
call fcn.00a600a0
lea eax, [esp + 0x1b]
lea ecx, [esp + 0x88]
push eax
mov byte [esp + 0xb78], 4
call fcn.00a600a0
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x64], ebx
mov dword [esp + 0xa4], ebx
mov dword [esp + 0xa8], ebx
mov dword [esp + 0xa0], 7
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x124]
push 1
push ecx
mov eax, dword [edx + 8]
lea ecx, [esp + 0x2c]
push eax
push ebx
push ecx
lea ecx, [esp + 0x74]
mov byte [esp + 0xb88], 5
call fcn.00a5d030
mov eax, dword [esp + 0x8c]
cmp eax, ebx
je 0xa59f4c
mov edx, dword [esp + 0x90]
sub edx, eax
test edx, 0xfffffffc
je 0xa59f4c
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0xa59e5e
mov ecx, eax
push 0xaf53f0
dec ecx
mov dword [esp + 0x14], ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0xaa2204]
mov ecx, dword [eax]
shr ecx, 0xd
test cl, 1
je 0xa59e82
mov edx, dword [esp + 0x124]
push edx
push str.__ls__key_subkeys__cannot_delete_
call fcn.009fe320
add esp, 8
mov eax, dword [esp + 0xb84]
mov dword [eax], 5
mov eax, dword [esp + 0x6c]
mov byte [esp + 0xb74], 7
cmp eax, ebx
je 0xa59ea8
push eax
call fcn.009ef440
add esp, 4
lea ecx, [esp + 0x60]
call fcn.00a534d0
lea ecx, [esp + 0x60]
call fcn.00a53550
lea ecx, [esp + 0x88]
mov byte [esp + 0xb74], 6
call fcn.009fd400
lea ecx, [esp + 0x78]
mov byte [esp + 0xb74], 3
call fcn.009fd400
lea ecx, [esp + 0x53c]
mov byte [esp + 0xb74], 2
call fcn.00a155e0
lea ecx, [esp + 0x11c]
mov byte [esp + 0xb74], 1
call fcn.00a155e0
mov eax, dword [esp + 0x10]
mov byte [esp + 0xb74], bl
cmp eax, ebx
je 0xa59f25
lea ecx, [esp + 0x10]
call fcn.00a5b3c0
cmp dword [esp + 0x10], ebx
jne 0xa59f16
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0xa5b208
mov esi, dword [eax + 4]
push eax
call fcn.00a7d8f0
add esp, 4
mov eax, esi
cmp esi, ebx
mov dword [esp + 0x14], eax
jne 0xa59f31
jmp 0xa5b208
mov ecx, dword [esi + 4]
push ebx
push ecx
lea ecx, [esp + 0x2c]
call fcn.00a5b240
lea edx, [esp + 0x53c]
push 1
lea ecx, [esp + 0x50]
push edx
push ecx
push eax
lea edx, [esp + 0x34]
push ebx
push edx
call fcn.00a56050
add esp, 0x18
lea ecx, [esp + 0x32c]
call fcn.00a155c0
mov eax, dword [esi + 8]
push ebx
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0xb7c], 8
call fcn.00a5b240
xor ecx, ecx
mov cx, word [eax + 2]
add eax, 4
push ecx
push eax
lea ecx, [esp + 0x334]
call fcn.00a15880
mov eax, dword [esp + 0x544]
mov ecx, dword [esp + 0x4c]
push ebx
lea edx, [esp + 0x24]
push ebx
push edx
push ebx
push eax
push ecx
lea edx, [esp + 0x3c]
push ebx
push edx
call fcn.00a56640
add esp, 0x20
test al, al
jne 0xa5a0f8
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0xa59ff6
mov ecx, eax
push 0xaf53f0
dec ecx
mov dword [esp + 0x14], ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0xaa2204]
mov ecx, dword [eax]
shr ecx, 0xd
test cl, 1
je 0xa5a01a
mov edx, dword [esp + 0x124]
push edx
push str.__ls__CreateKeyPath_failed_
call fcn.009fe320
add esp, 8
mov eax, dword [esp + 0xb84]
lea ecx, [esp + 0x32c]
mov byte [esp + 0xb74], 5
mov dword [eax], 0x57
call fcn.00a155e0
mov eax, dword [esp + 0x6c]
mov byte [esp + 0xb74], 0xa
cmp eax, ebx
je 0xa5a054
push eax
call fcn.009ef440
add esp, 4
lea ecx, [esp + 0x60]
call fcn.00a534d0
lea ecx, [esp + 0x60]
call fcn.00a53550
lea ecx, [esp + 0x88]
mov byte [esp + 0xb74], 9
call fcn.009fd400
lea ecx, [esp + 0x78]
mov byte [esp + 0xb74], 3
call fcn.009fd400
lea ecx, [esp + 0x53c]
mov byte [esp + 0xb74], 2
call fcn.00a155e0
lea ecx, [esp + 0x11c]
mov byte [esp + 0xb74], 1
call fcn.00a155e0
mov eax, dword [esp + 0x10]
mov byte [esp + 0xb74], bl
cmp eax, ebx
je 0xa5a0d1
lea ecx, [esp + 0x10]
call fcn.00a5b3c0
cmp dword [esp + 0x10], ebx
jne 0xa5a0c2
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0xa5b208
mov esi, dword [eax + 4]
push eax
call fcn.00a7d8f0
add esp, 4
mov eax, esi
cmp esi, ebx
mov dword [esp + 0x14], eax
jne 0xa5a0dd
jmp 0xa5b208
mov ecx, dword [esp + 0x20]
push ebx
push ecx
lea ecx, [esp + 0x2c]
call fcn.00a5b240
mov esi, dword [eax]
lea ecx, [esp + 0x74c]
and esi, 7
call fcn.00a155c0
mov edi, dword [esp + 0x334]
mov byte [esp + 0xb74], 0xb
push edi
call fcn.00a7e07a
add esp, 4
mov ebp, eax
lea edx, [esp + 0x24]
lea ecx, [esp + 0x20]
push ebx
push 1
push ebp
push edi
push ebx
push edx
call fcn.00a53920
cmp esi, 4
je 0xa5a15e
push ebx
push ebp
push edi
push ebx
lea eax, [esp + 0x34]
push ebx
push eax
lea ecx, [esp + 0x38]
call fcn.00a52f50
mov ecx, dword [0xaa2204]
mov edx, dword [ecx]
shr edx, 0xd
test dl, 1
je 0xa5a17b
push str._found__deleted_from_RW_View_
call fcn.009fe320
add esp, 4
lea eax, [esp + 0x10]
push eax
call fcn.00a52460
mov eax, dword [esp + 0x14]
add esp, 4
cmp eax, ebx
je 0xa5a1a2
mov ecx, eax
push 0xaf53f0
dec ecx
mov dword [esp + 0x14], ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0xb84]
mov byte [esp + 0xb74], 8
mov dword [ecx], ebx
lea ecx, [esp + 0x74c]
call fcn.00a155e0
lea ecx, [esp + 0x32c]
mov byte [esp + 0xb74], 5
call fcn.00a155e0
mov eax, dword [esp + 0x6c]
mov byte [esp + 0xb74], 0xd
cmp eax, ebx
je 0xa5a1ec
push eax
call fcn.009ef440
add esp, 4
lea ecx, [esp + 0x60]
call fcn.00a534d0
lea ecx, [esp + 0x60]
call fcn.00a53550
lea ecx, [esp + 0x88]
mov byte [esp + 0xb74], 0xc
call fcn.009fd400
lea ecx, [esp + 0x78]
mov byte [esp + 0xb74], 3
call fcn.009fd400
lea ecx, [esp + 0x53c]
mov byte [esp + 0xb74], 2
call fcn.00a155e0
lea ecx, [esp + 0x11c]
mov byte [esp + 0xb74], 1
call fcn.00a155e0
mov eax, dword [esp + 0x10]
mov byte [esp + 0xb74], bl
cmp eax, ebx
je 0xa5a269
lea ecx, [esp + 0x10]
call fcn.00a5b3c0
cmp dword [esp + 0x10], ebx
jne 0xa5a25a
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0xa5b208
mov esi, dword [eax + 4]
push eax
call fcn.00a7d8f0
add esp, 4
mov eax, esi
cmp esi, ebx
mov dword [esp + 0x14], eax
jne 0xa5a275
jmp 0xa5b208
cmp eax, 2
mov edi, 7
jne 0xa5a367
mov edx, dword [esp + 0x48]
push ebx
push edx
lea ecx, [esp + 0x2c]
call fcn.00a5b240
mov eax, dword [eax]
and eax, edi
cmp eax, 4
jne 0xa5a35e
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0xa5a2d4
mov ecx, eax
push 0xaf53f0
dec ecx
mov dword [esp + 0x14], ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [0xaa2204]
mov ecx, dword [eax]
shr ecx, 0xd
test cl, 1
je 0xa5a2f8
mov edx, dword [esp + 0x124]
push edx
push str.__ls__not_found_in_RW_View__fully_isolated_
call fcn.009fe320
add esp, 8
mov eax, dword [esp + 0xb84]
lea ecx, [esp + 0x11c]
mov byte [esp + 0xb74], 1
mov dword [eax], 2
call fcn.00a155e0
mov eax, dword [esp + 0x10]
mov byte [esp + 0xb74], bl
cmp eax, ebx
je 0xa5a337
lea ecx, [esp + 0x10]
call fcn.00a5b3c0
cmp dword [esp + 0x10], ebx
jne 0xa5a328
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0xa5b208
mov esi, dword [eax + 4]
push eax
call fcn.00a7d8f0
add esp, 4
mov eax, esi
cmp esi, ebx
mov dword [esp + 0x14], eax
jne 0xa5a343
jmp 0xa5b208
cmp eax, 3
jne 0xa5a367
mov byte [esp + 0x1a], bl
mov eax, dword [esp + 0x124]
lea ecx, [esp + 0xb4]
push ecx
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x48]
push edx
mov edx, dword [ecx + 8]
push ebx
push eax
push edx
lea eax, [esp + 0x38]
push 1
push eax
call fcn.00a54500
add esp, 0x1c
cmp eax, 1
jne 0xa5a442
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0xa5a3b7
mov ecx, eax
push 0xaf53f0
dec ecx
mov dword [esp + 0x14], ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0xaa2204]
mov edx, dword [ecx]
shr edx, 0xd
test dl, 1
je 0xa5a3dc
mov eax, dword [esp + 0x124]
push eax
push str.__ls__Already_deleted_from_RO_View_
call fcn.009fe320
add esp, 8
mov ecx, dword [esp + 0xb84]
mov byte [esp + 0xb74], 1
mov dword [ecx], 2
lea ecx, [esp + 0x11c]
call fcn.00a155e0
mov eax, dword [esp + 0x10]
mov byte [esp + 0xb74], bl
cmp eax, ebx
je 0xa5a41b
lea ecx, [esp + 0x10]
call fcn.00a5b3c0
cmp dword [esp + 0x10], ebx
jne 0xa5a40c
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0xa5b208
mov esi, dword [eax + 4]
push eax
call fcn.00a7d8f0
add esp, 4
mov eax, esi
cmp esi, ebx
mov dword [esp + 0x14], eax
jne 0xa5a427
jmp 0xa5b208
cmp eax, ebx
jne 0xa5a8d1
mov edx, dword [0xaa2204]
mov eax, dword [edx]
shr eax, 0xd
test al, 1
je 0xa5a46b
cmp ebp, ebx
je 0xa5a46b
push str._found_in_RO_View_
push ebp
call fcn.00a16060
add esp, 8
mov ecx, dword [esp + 0x44]
push 1
push ecx
lea ecx, [esp + 0x2c]
call fcn.00a5b240
lea edx, [esp + 0x1b]
lea ecx, [esp + 0x78]
push edx
mov esi, eax
call fcn.00a600a0
lea eax, [esp + 0x1a]
lea ecx, [esp + 0x88]
push eax
mov byte [esp + 0xb78], 0xe
call fcn.00a600a0
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x64], ebx
mov dword [esp + 0xa4], ebx
mov dword [esp + 0xa8], ebx
mov dword [esp + 0xa0], edi
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x124]
push 1
push ecx
mov eax, dword [edx + 8]
lea ecx, [esp + 0x2c]
push eax
push ebx
push ecx
lea ecx, [esp + 0x74]
mov byte [esp + 0xb88], 0xf
call fcn.00a5d030
mov eax, dword [esp + 0x8c]
cmp eax, ebx
je 0xa5a607
mov edx, dword [esp + 0x90]
sub edx, eax
test edx, 0xfffffffc
je 0xa5a607
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp eax, ebx
je 0xa5a52a
mov ecx, eax
push 0xaf53f0
dec ecx
mov dword [esp + 0x14], ecx
call esi
mov eax, dword [0xaa2204]
mov ecx, dword [eax]
shr ecx, 0xd
test cl, 1
je 0xa5a553
cmp ebp, ebx
je 0xa5a553
mov edx, dword [esp + 0x124]
push edx
push 0xaad5cc
push ebp
call fcn.00a16060
add esp, 0xc
mov eax, dword [esp + 0xb84]
mov dword [eax], 5
mov eax, dword [esp + 0x6c]
mov byte [esp + 0xb74], 0x11
cmp eax, ebx
je 0xa5a579
push eax
call fcn.009ef440
add esp, 4
lea ecx, [esp + 0x60]
call fcn.00a534d0
lea ecx, [esp + 0x60]
call fcn.00a53550
lea ecx, [esp + 0x88]
mov byte [esp + 0xb74], 0x10
call fcn.009fd400
lea ecx, [esp + 0x78]
mov byte [esp + 0xb74], 2
call fcn.009fd400
lea ecx, [esp + 0x11c]
mov byte [esp + 0xb74], 1
call fcn.00a155e0
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0xa5a5e0
dec eax
push 0xaf53f0
mov dword [esp + 0x14], eax
call esi
mov eax, dword [esp + 0x10]
cmp eax, ebx
jne 0xa5a5cc
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0xa5b208
mov esi, dword [eax + 4]
push eax
call fcn.00a7d8f0
add esp, 4
mov eax, esi
cmp esi, ebx
mov dword [esp + 0x14], eax
jne 0xa5a5ec
jmp 0xa5b208
lea ecx, [esp + 0x32c]
call fcn.00a155c0
mov ecx, dword [esi + 4]
push 1
push ecx
lea ecx, [esp + 0x2c]
mov byte [esp + 0xb7c], 0x12
call fcn.00a5b240
lea edx, [esp + 0x32c]
push 1
lea ecx, [esp + 0x50]
push edx
push ecx
push eax
lea edx, [esp + 0x34]
push 1
push edx
call fcn.00a56050
mov eax, dword [esi + 8]
add esp, 0x18
lea ecx, [esp + 0x24]
push 1
push eax
call fcn.00a5b240
mov edx, dword [esp + 0x334]
push ebx
lea ecx, [esp + 0x24]
push ebx
mov esi, eax
mov eax, dword [esp + 0x54]
push ecx
push ebx
push edx
push eax
lea ecx, [esp + 0x3c]
push ebx
push ecx
call fcn.00a56640
add esp, 0x20
test al, al
jne 0xa5a792
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp eax, ebx
je 0xa5a6a1
mov ecx, eax
push 0xaf53f0
dec ecx
mov dword [esp + 0x14], ecx
call esi
mov edx, dword [0xaa2204]
mov eax, dword [edx]
shr eax, 0xd
test al, 1
je 0xa5a6ca
cmp ebp, ebx
je 0xa5a6ca
mov ecx, dword [esp + 0x124]
push ecx
push 0xaad58c
push ebp
call fcn.00a16060
add esp, 0xc
mov edx, dword [esp + 0xb84]
lea ecx, [esp + 0x32c]
mov byte [esp + 0xb74], 0xf
mov dword [edx], 0x57
call fcn.00a155e0
mov eax, dword [esp + 0x6c]
mov byte [esp + 0xb74], 0x14
cmp eax, ebx
je 0xa5a704
push eax
call fcn.009ef440
add esp, 4
lea ecx, [esp + 0x60]
call fcn.00a534d0
lea ecx, [esp + 0x60]
call fcn.00a53550
lea ecx, [esp + 0x88]
mov byte [esp + 0xb74], 0x13
call fcn.009fd400
lea ecx, [esp + 0x78]
mov byte [esp + 0xb74], 2
call fcn.009fd400
lea ecx, [esp + 0x11c]
mov byte [esp + 0xb74], 1
call fcn.00a155e0
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0xa5a76b
dec eax
push 0xaf53f0
mov dword [esp + 0x14], eax
call esi
mov eax, dword [esp + 0x10]
cmp eax, ebx
jne 0xa5a757
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0xa5b208
mov esi, dword [eax + 4]
push eax
call fcn.00a7d8f0
add esp, 4
mov eax, esi
cmp esi, ebx
mov dword [esp + 0x14], eax
jne 0xa5a777
jmp 0xa5b208
lea ecx, [esp + 0x74c]
call fcn.00a155c0
xor eax, eax
cmp word [esi], bx
mov ax, word [esi + 2]
lea ecx, [esi + 4]
setne dl
mov byte [esp + 0x40], dl
mov edx, dword [esp + 0x40]
push edx
push eax
push ecx
push ebx
lea eax, [esp + 0x34]
push ebx
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0xb8c], 0x15
call fcn.00a52f50
lea ecx, [esp + 0x10]
push ecx
call fcn.00a52460
mov eax, dword [esp + 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
add esp, 4
cmp eax, ebx
je 0xa5a7f9
mov ecx, eax
push 0xaf53f0
dec ecx
mov dword [esp + 0x14], ecx
call esi
mov edx, dword [esp + 0xb84]
lea ecx, [esp + 0x74c]
mov byte [esp + 0xb74], 0x12
mov dword [edx], ebx
call fcn.00a155e0
lea ecx, [esp + 0x32c]
mov byte [esp + 0xb74], 0xf
call fcn.00a155e0
mov eax, dword [esp + 0x6c]
mov byte [esp + 0xb74], 0x17
cmp eax, ebx
je 0xa5a843
push eax
call fcn.009ef440
add esp, 4
lea ecx, [esp + 0x60]
call fcn.00a534d0
lea ecx, [esp + 0x60]
call fcn.00a53550
lea ecx, [esp + 0x88]
mov byte [esp + 0xb74], 0x16
call fcn.009fd400
lea ecx, [esp + 0x78]
mov byte [esp + 0xb74], 2
call fcn.009fd400
lea ecx, [esp + 0x11c]
mov byte [esp + 0xb74], 1
call fcn.00a155e0
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0xa5a8aa
dec eax
push 0xaf53f0
mov dword [esp + 0x14], eax
call esi
mov eax, dword [esp + 0x10]
cmp eax, ebx
jne 0xa5a896
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0xa5b208
mov esi, dword [eax + 4]
push eax
call fcn.00a7d8f0
add esp, 4
mov eax, esi
cmp esi, ebx
mov dword [esp + 0x14], eax
jne 0xa5a8b6
jmp 0xa5b208
cmp eax, 2
jne 0xa5a9a1
mov eax, dword [esp + 0x44]
push 1
push eax
lea ecx, [esp + 0x2c]
call fcn.00a5b240
mov eax, dword [eax]
and eax, edi
cmp eax, 3
jne 0xa5a9a1
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp eax, ebx
je 0xa5a913
mov ecx, eax
push 0xaf53f0
dec ecx
mov dword [esp + 0x14], ecx
call esi
mov ecx, dword [0xaa2204]
mov edx, dword [ecx]
shr edx, 0xd
test dl, 1
je 0xa5a93d
cmp ebp, ebx
je 0xa5a93d
mov eax, dword [esp + 0x124]
push eax
push str.__ls__not_found_in_RO_View_or_RW_View_and_isolated_
push ebp
call fcn.00a16060
add esp, 0xc
mov ecx, dword [esp + 0xb84]
mov byte [esp + 0xb74], 1
mov dword [ecx], 2
lea ecx, [esp + 0x11c]
call fcn.00a155e0
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0xa5a97a
dec eax
push 0xaf53f0
mov dword [esp + 0x14], eax
call esi
mov eax, dword [esp + 0x10]
cmp eax, ebx
jne 0xa5a966
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0xa5b208
mov esi, dword [eax + 4]
push eax
call fcn.00a7d8f0
add esp, 4
mov eax, esi
cmp esi, ebx
mov dword [esp + 0x14], eax
jne 0xa5a986
jmp 0xa5b208
mov edx, dword [esp + 0x1c]
test byte [edx + 0x40], 4
je 0xa5b168
cmp byte [esp + 0x1a], bl
je 0xa5b168
lea eax, [esp + 0x24]
push eax
call fcn.00a56620
add esp, 4
cmp eax, 3
je 0xa5b168
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x124]
lea ecx, [esp + 0x118]
push ecx
mov ecx, dword [eax + 8]
push 0x2000000
push ebx
push edx
push ecx
call fcn.00a20e00
test eax, eax
jne 0xa5b0b7
mov edx, dword [0xaa2204]
mov eax, dword [edx]
shr eax, 0xd
test al, 1
je 0xa5aa16
push str._found_in_system_
call fcn.009fe320
add esp, 4
lea ecx, [esp + 0x1b]
push ecx
lea ecx, [esp + 0xe4]
call fcn.00a600a0
lea edx, [esp + 0x1a]
lea ecx, [esp + 0xf0]
push edx
mov byte [esp + 0xb78], 0x18
call fcn.00a600a0
mov dword [esp + 0xd4], ebx
mov dword [esp + 0xcc], ebx
mov dword [esp + 0x10c], ebx
mov dword [esp + 0x110], ebx
mov dword [esp + 0x108], edi
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x124]
push 1
push eax
mov edx, dword [ecx + 8]
lea eax, [esp + 0x2c]
push edx
push ebx
push eax
lea ecx, [esp + 0xdc]
mov byte [esp + 0xb88], 0x19
call fcn.00a5d030
mov eax, dword [esp + 0xf4]
cmp eax, ebx
je 0xa5abb8
mov ecx, dword [esp + 0xf8]
sub ecx, eax
test ecx, 0xfffffffc
je 0xa5abb8
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp eax, ebx
je 0xa5aacf
mov ecx, eax
push 0xaf53f0
dec ecx
mov dword [esp + 0x14], ecx
call esi
mov edx, dword [0xaa2204]
mov eax, dword [edx]
shr eax, 0xd
test al, 1
je 0xa5aaf8
cmp ebp, ebx
je 0xa5aaf8
mov ecx, dword [esp + 0x124]
push ecx
push 0xaad5cc
push ebp
call fcn.00a16060
add esp, 0xc
mov edx, dword [esp + 0xb84]
mov dword [edx], 5
mov eax, dword [esp + 0xd4]
mov byte [esp + 0xb74], 0x1b
cmp eax, ebx
je 0xa5ab21
push eax
call fcn.009ef440
add esp, 4
lea ecx, [esp + 0xc8]
call fcn.00a534d0
lea ecx, [esp + 0xc8]
call fcn.00a53550
lea ecx, [esp + 0xf0]
mov byte [esp + 0xb74], 0x1a
call fcn.009fd400
lea ecx, [esp + 0xe0]
mov byte [esp + 0xb74], 2
call fcn.009fd400
lea ecx, [esp + 0x11c]
mov byte [esp + 0xb74], 1
call fcn.00a155e0
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0xa5ab91
dec eax
push 0xaf53f0
mov dword [esp + 0x14], eax
call esi
mov eax, dword [esp + 0x10]
cmp eax, ebx
jne 0xa5ab7d
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0xa5b208
mov esi, dword [eax + 4]
push eax
call fcn.00a7d8f0
add esp, 4
mov eax, esi
cmp esi, ebx
mov dword [esp + 0x14], eax
jne 0xa5ab9d
jmp 0xa5b208
mov al, byte [esp + 0x1b]
mov esi, dword [esp + 0x124]
push ebx
lea ecx, [esp + 0x54]
mov byte [esp + 0x54], al
call fcn.009f6b50
push esi
call fcn.00a7e07a
add esp, 4
lea ecx, [esp + 0x50]
push eax
push esi
call fcn.00a61330
mov eax, dword [esp + 0x58]
mov byte [esp + 0xb74], 0x1c
cmp eax, ebx
jne 0xa5ad12
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp eax, ebx
je 0xa5ac15
mov ecx, eax
push 0xaf53f0
dec ecx
mov dword [esp + 0x14], ecx
call esi
mov ecx, dword [0xaa2204]
mov edx, dword [ecx]
shr edx, 0xd
test dl, 1
je 0xa5ac3f
cmp ebp, ebx
je 0xa5ac3f
mov eax, dword [esp + 0x124]
push eax
push str.__ls__cannot_delete_base_key_
push ebp
call fcn.00a16060
add esp, 0xc
mov ecx, dword [esp + 0xb84]
push 1
mov byte [esp + 0xb78], 0x19
mov dword [ecx], 5
lea ecx, [esp + 0x54]
call fcn.009f6b50
mov eax, dword [esp + 0xd4]
mov byte [esp + 0xb74], 0x1e
cmp eax, ebx
je 0xa5ac7b
push eax
call fcn.009ef440
add esp, 4
lea ecx, [esp + 0xc8]
call fcn.00a534d0
lea ecx, [esp + 0xc8]
call fcn.00a53550
lea ecx, [esp + 0xf0]
mov byte [esp + 0xb74], 0x1d
call fcn.009fd400
lea ecx, [esp + 0xe0]
mov byte [esp + 0xb74], 2
call fcn.009fd400
lea ecx, [esp + 0x11c]
mov byte [esp + 0xb74], 1
call fcn.00a155e0
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0xa5aceb
dec eax
push 0xaf53f0
mov dword [esp + 0x14], eax
call esi
mov eax, dword [esp + 0x10]
cmp eax, ebx
jne 0xa5acd7
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0xa5b208
mov esi, dword [eax + 4]
push eax
call fcn.00a7d8f0
add esp, 4
mov eax, esi
cmp esi, ebx
mov dword [esp + 0x14], eax
jne 0xa5acf7
jmp 0xa5b208
mov dl, byte [esp + 0x1b]
push ebx
lea ecx, [esp + 0xbc]
mov byte [esp + 0xbc], dl
call fcn.009f6b50
mov eax, dword [esp + 0x54]
mov byte [esp + 0xb74], 0x1f
cmp eax, ebx
jne 0xa5ad3f
mov eax, 0xa917ac
push 0x5c
push eax
call fcn.00a7e1b5
mov esi, eax
add esp, 8
cmp esi, ebx
je 0xa5ad6f
lea edi, [esi + 2]
push edi
call fcn.00a7e07a
add esp, 4
lea ecx, [esp + 0xb8]
push eax
push edi
call fcn.00a61330
mov word [esi], bx
jmp 0xa5ada3
mov eax, dword [0xa918f8]
lea ecx, [esp + 0x50]
push eax
push ebx
push ecx
lea ecx, [esp + 0xc4]
call fcn.00a1f2c0
push 0xab504c
call fcn.00a7e07a
add esp, 4
lea ecx, [esp + 0x50]
push eax
push 0xab504c
call fcn.00a61330
mov eax, dword [esp + 0x54]
mov dword [esp + 0x40], ebx
cmp eax, ebx
jne 0xa5adb4
mov eax, 0xa917ac
push ebx
lea edx, [esp + 0x44]
push ebx
push edx
push ebx
push eax
mov eax, dword [esp + 0x30]
lea edx, [esp + 0x38]
mov ecx, dword [eax + 8]
push ecx
push ebx
push edx
call fcn.00a56640
add esp, 0x20
test al, al
jne 0xa5af09
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp eax, ebx
je 0xa5adf7
mov ecx, eax
push 0xaf53f0
dec ecx
mov dword [esp + 0x14], ecx
call esi
mov eax, dword [0xaa2204]
mov ecx, dword [eax]
shr ecx, 0xd
test cl, 1
je 0xa5ae20
cmp ebp, ebx
je 0xa5ae20
mov edx, dword [esp + 0x124]
push edx
push 0xaad58c
push ebp
call fcn.00a16060
add esp, 0xc
mov eax, dword [esp + 0xb84]
push 1
lea ecx, [esp + 0xbc]
mov byte [esp + 0xb78], 0x1c
mov dword [eax], 0x57
call fcn.009f6b50
push 1
lea ecx, [esp + 0x54]
mov byte [esp + 0xb78], 0x19
call fcn.009f6b50
mov eax, dword [esp + 0xd4]
mov byte [esp + 0xb74], 0x21
cmp eax, ebx
je 0xa5ae72
push eax
call fcn.009ef440
add esp, 4
lea ecx, [esp + 0xc8]
call fcn.00a534d0
lea ecx, [esp + 0xc8]
call fcn.00a53550
lea ecx, [esp + 0xf0]
mov byte [esp + 0xb74], 0x20
call fcn.009fd400
lea ecx, [esp + 0xe0]
mov byte [esp + 0xb74], 2
call fcn.009fd400
lea ecx, [esp + 0x11c]
mov byte [esp + 0xb74], 1
call fcn.00a155e0
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0xa5aee2
dec eax
push 0xaf53f0
mov dword [esp + 0x14], eax
call esi
mov eax, dword [esp + 0x10]
cmp eax, ebx
jne 0xa5aece
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0xa5b208
mov esi, dword [eax + 4]
push eax
call fcn.00a7d8f0
add esp, 4
mov eax, esi
cmp esi, ebx
mov dword [esp + 0x14], eax
jne 0xa5aeee
jmp 0xa5b208
lea ecx, [esp + 0x95c]
call fcn.00a155c0
mov eax, dword [esp + 0xbc]
mov byte [esp + 0xb74], 0x22
cmp eax, ebx
jne 0xa5b0b0
mov esi, 0xa917ac
mov eax, esi
push eax
call fcn.00a7e07a
add esp, 4
lea ecx, [esp + 0x24]
push ebx
push eax
push esi
push ebx
push ebx
push ecx
lea ecx, [esp + 0x58]
call fcn.00a52f50
lea edx, [esp + 0x10]
push edx
call fcn.00a52460
mov eax, dword [esp + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
add esp, 4
cmp eax, ebx
je 0xa5af78
mov ecx, eax
push 0xaf53f0
dec ecx
mov dword [esp + 0x14], ecx
call edi
mov eax, dword [esp + 0xb84]
lea ecx, [esp + 0x95c]
mov byte [esp + 0xb74], 0x1f
mov dword [eax], ebx
call fcn.00a155e0
push 1
lea ecx, [esp + 0xbc]
mov byte [esp + 0xb78], 0x1c
call fcn.009f6b50
push 1
lea ecx, [esp + 0x54]
mov byte [esp + 0xb78], 0x19
call fcn.009f6b50
mov eax, dword [esp + 0xd4]
mov byte [esp + 0xb74], 0x24
cmp eax, ebx
je 0xa5afda
push eax
call fcn.009ef440
add esp, 4
lea ecx, [esp + 0xe0]
mov dword [esp + 0x10c], ebx
xor esi, esi
call fcn.00a1da30
test eax, eax
jbe 0xa5b019
mov ecx, dword [esp + 0xe4]
mov ecx, dword [ecx + esi*4]
cmp ecx, ebx
je 0xa5b008
push 1
call fcn.00a5b3a0
lea ecx, [esp + 0xe0]
inc esi
call fcn.00a1da30
cmp esi, eax
jb 0xa5aff3
lea ecx, [esp + 0xe0]
call fcn.00a60190
lea ecx, [esp + 0xc8]
call fcn.00a53550
lea ecx, [esp + 0xf0]
mov byte [esp + 0xb74], 0x23
call fcn.009fd400
lea ecx, [esp + 0xe0]
mov byte [esp + 0xb74], 2
call fcn.009fd400
lea ecx, [esp + 0x11c]
mov byte [esp + 0xb74], 1
call fcn.00a155e0
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0xa5b089
dec eax
push 0xaf53f0
mov dword [esp + 0x14], eax
call edi
mov eax, dword [esp + 0x10]
cmp eax, ebx
jne 0xa5b075
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0xa5b208
mov esi, dword [eax + 4]
push eax
call fcn.00a7d8f0
add esp, 4
mov eax, esi
cmp esi, ebx
mov dword [esp + 0x14], eax
jne 0xa5b095
jmp 0xa5b208
mov esi, eax
jmp 0xa5af33
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp eax, ebx
je 0xa5b0d3
mov ecx, eax
push 0xaf53f0
dec ecx
mov dword [esp + 0x14], ecx
call esi
mov edx, dword [0xaa2204]
mov eax, dword [edx]
shr eax, 0xd
test al, 1
je 0xa5b104
cmp ebp, ebx
je 0xa5b104
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x124]
push ecx
mov eax, dword [edx + 8]
push eax
push str.__x__ls__key_not_found_on_system_
push ebp
call fcn.00a16060
add esp, 0x10
mov ecx, dword [esp + 0xb84]
mov byte [esp + 0xb74], 1
mov dword [ecx], 2
lea ecx, [esp + 0x11c]
call fcn.00a155e0
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0xa5b141
dec eax
push 0xaf53f0
mov dword [esp + 0x14], eax
call esi
mov eax, dword [esp + 0x10]
cmp eax, ebx
jne 0xa5b12d
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0xa5b208
mov esi, dword [eax + 4]
push eax
call fcn.00a7d8f0
add esp, 4
mov eax, esi
cmp esi, ebx
mov dword [esp + 0x14], eax
jne 0xa5b14d
jmp 0xa5b208
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp eax, ebx
je 0xa5b184
mov ecx, eax
push 0xaf53f0
dec ecx
mov dword [esp + 0x14], ecx
call esi
mov edx, dword [0xaa2204]
mov eax, dword [edx]
shr eax, 0xd
test al, 1
je 0xa5b1ad
cmp ebp, ebx
je 0xa5b1ad
mov ecx, dword [esp + 0x124]
push ecx
push str.__ls__not_found_in_RO_View_or_RW_View_and_isolated_
push ebp
call fcn.00a16060
add esp, 0xc
mov edx, dword [esp + 0xb84]
lea ecx, [esp + 0x11c]
mov byte [esp + 0xb74], 1
mov dword [edx], 2
call fcn.00a155e0
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0xa5b1ea
dec eax
push 0xaf53f0
mov dword [esp + 0x14], eax
call esi
mov eax, dword [esp + 0x10]
cmp eax, ebx
jne 0xa5b1d6
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0xa5b208
mov esi, dword [eax + 4]
push eax
call fcn.00a7d8f0
add esp, 4
mov eax, esi
cmp esi, ebx
mov dword [esp + 0x14], eax
jne 0xa5b1f2
lea ecx, [esp + 0x24]
mov dword [esp + 0xb74], 0xffffffff
call fcn.00a51780
mov al, 1
mov ecx, dword [esp + 0xb6c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xb68
ret