Function at 0x460564
Capabilities:
Encode data using base64
Parse credit card information
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x94
push ebx
push esi
push edi
mov dword [ebp + 0x18], ecx
push ecx
lea ecx, [ebp - 0x24]
call fcn.0044732d
mov eax, dword [ebp + 0x78]
xor ebx, ebx
mov dword [ebp + 0x20], eax
lea eax, [ebp + 0x78]
push eax
mov byte [ebp + 0x32], 0xff
mov byte [ebp + 0x66], bl
mov byte [ebp + 0x53], bl
mov byte [ebp + 0x43], bl
mov dword [ebp - 8], ebx
call fcn.0043e7bd
push 0xa
lea eax, [ebp + 0x78]
push eax
push str.___initram
call fcn.00446fac
add esp, 0x10
test al, al
jne 0x460a8f
mov dword [ebp + 0x68], ebx
mov esi, dword [ebp + 0x78]
mov ax, word [esi]
cmp ax, 0x2d
mov dword [ebp + 0x54], ebx
mov dword [ebp + 0x58], 0xfffffff0
mov byte [ebp + 0x6f], 0
mov byte [ebp + 0x63], 0
mov byte [ebp + 0x65], 0
mov byte [ebp + 0x67], 0
mov byte [ebp + 0x26], 0
mov byte [ebp + 0x64], 0
mov byte [ebp + 0x25], 0
mov byte [ebp + 0x27], 0
mov dword [ebp + 0x48], ebx
mov cl, 0x2a
jne 0x4605fa
mov cl, al
movsx ecx, cl
movzx eax, ax
cmp ecx, eax
mov dword [ebp + 0x14], ecx
jne 0x46088d
movzx eax, word [esi + 2]
cmp dword [ebp + 0x14], eax
jne 0x46088d
xor eax, eax
lea ecx, [esi + 4]
mov ax, word [ecx]
mov edx, eax
and dx, 0xffdf
cmp dx, 0x48
je 0x46088d
call fcn.0043e785
test al, al
jne 0x46088d
xor edi, edi
mov esi, ecx
inc edi
push edi
push esi
push 0x4cb2dc
mov dword [ebp + 0x78], esi
call fcn.0043fc19
add esp, 0xc
test al, al
je 0x4606a2
lea eax, [ebp + 0x78]
add esi, 2
push eax
mov dword [ebp + 0x28], esi
call fcn.00409344
cmp word [esi], 0x3a
pop ecx
je 0x460678
or dword [ebp + 0x48], 7
jmp 0x46087e
lea eax, [ebp + 0x4c]
push eax
inc esi
lea eax, [ebp + 0x28]
inc esi
push eax
mov dword [ebp + 0x4c], ebx
mov dword [ebp + 0x28], esi
call fcn.004412d1
test eax, eax
pop ecx
pop ecx
jle 0x46087e
mov eax, dword [ebp + 0x4c]
or dword [ebp + 0x48], eax
jmp 0x46087e
push 2
push esi
push 0x4cb2d8
call fcn.0043fc19
add esp, 0xc
test al, al
lea eax, [ebp + 0x78]
je 0x4606ee
add esi, 4
push eax
mov dword [ebp + 0xc], esi
call fcn.00409344
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp + 0xc]
push eax
mov dword [ebp + 0x4c], ebx
call fcn.00451e7f
add esp, 0xc
test eax, eax
jle 0x46087e
mov eax, dword [ebp + 0x4c]
mov dword [ebp + 0x54], eax
mov dword [ebp + 0x58], ebx
jmp 0x46087e
push 2
pop esi
push esi
push eax
push 0x4c744c
call fcn.00446fac
add esp, 0xc
test al, al
je 0x46070d
mov byte [ebp + 0x65], 1
jmp 0x46087e
push 3
lea eax, [ebp + 0x78]
push eax
push 0x4cb2d4
call fcn.00446fac
add esp, 0xc
test al, al
je 0x46072d
mov byte [ebp + 0x43], 1
jmp 0x46087e
push 4
lea eax, [ebp + 0x78]
push eax
push str.byte
call fcn.00446fac
add esp, 0xc
test al, al
je 0x46074d
mov byte [ebp + 0x64], 1
jmp 0x46087e
push edi
lea eax, [ebp + 0x78]
push eax
push 0x4c5774
call fcn.00446fac
add esp, 0xc
test al, al
je 0x46076c
mov byte [ebp + 0x67], 3
jmp 0x46087e
push esi
lea eax, [ebp + 0x78]
push eax
push 0x4cb2c8
call fcn.00446fac
add esp, 0xc
test al, al
je 0x46078b
or byte [ebp + 0x67], 1
jmp 0x46087e
push esi
lea eax, [ebp + 0x78]
push eax
push 0x4cb2c4
call fcn.00446fac
add esp, 0xc
test al, al
je 0x4607aa
or byte [ebp + 0x67], 2
jmp 0x46087e
push 4
lea eax, [ebp + 0x78]
push eax
push str.name
call fcn.00446fac
add esp, 0xc
test al, al
je 0x4607ca
mov byte [ebp + 0x26], 1
jmp 0x46087e
push edi
lea eax, [ebp + 0x78]
push eax
push 0x4cb2b8
call fcn.00446fac
add esp, 0xc
test al, al
je 0x4607e8
inc byte [ebp + 0x66]
jmp 0x46087e
push esi
lea eax, [ebp + 0x78]
push eax
push 0x4cb2b4
call fcn.00446fac
add esp, 0xc
test al, al
je 0x460803
dec byte [ebp + 0x66]
jmp 0x46087e
push edi
lea eax, [ebp + 0x78]
push eax
push 0x4cb2b0
call fcn.00446fac
add esp, 0xc
test al, al
je 0x46081e
inc byte [ebp + 0x53]
jmp 0x46087e
push esi
lea eax, [ebp + 0x78]
push eax
push 0x4cb2ac
call fcn.00446fac
add esp, 0xc
test al, al
je 0x46083a
mov byte [ebp + 0x25], 1
jmp 0x46087e
push 4
lea eax, [ebp + 0x78]
push eax
push str.init
call fcn.00446fac
add esp, 0xc
test al, al
je 0x460857
mov byte [ebp + 0x27], 1
jmp 0x46087e
push esi
lea eax, [ebp + 0x78]
push eax
push 0x4c2ea8
call fcn.00446fac
add esp, 0xc
test al, al
je 0x460874
call fcn.00442bda
jmp 0x46087e
lea eax, [ebp + 0x78]
push eax
call fcn.00409344
pop ecx
mov esi, dword [ebp + 0x78]
movzx eax, word [esi]
cmp dword [ebp + 0x14], eax
je 0x46060b
lea ecx, [ebp + 8]
call fcn.00444f6c
lea ecx, [ebp - 0x14]
call fcn.00444f6c
lea ecx, [ebp + 0x10]
call fcn.00444f6c
lea ecx, [ebp + 4]
call fcn.00444f6c
lea ecx, [ebp - 4]
call fcn.00444f6c
xor eax, eax
mov ax, word [esi]
mov ecx, eax
or ecx, 0x20
cmp cx, 0x6e
je 0x460907
cmp cx, 0x75
je 0x460907
cmp cx, 0x62
je 0x460907
cmp ax, 0x5e
je 0x460907
cmp ax, 0x2b
je 0x460907
cmp ax, 0x23
je 0x460907
cmp ax, 0x40
je 0x460907
cmp ax, 0x24
je 0x460907
cmp ax, 0x2a
je 0x460907
cmp ax, 0x7e
je 0x460907
cmp ax, 0x2e
je 0x460907
cmp ax, 0x3f
jne 0x460920
mov al, byte [esi]
inc esi
inc esi
test al, al
mov byte [ebp + 0x6f], al
mov dword [ebp + 0x78], esi
je 0x460920
movzx eax, word [esi]
movsx ecx, byte [ebp + 0x6f]
cmp ecx, eax
je 0x460926
cmp word [esi], 0x24
jne 0x460930
mov al, byte [esi]
inc esi
inc esi
mov byte [ebp + 0x63], al
mov dword [ebp + 0x78], esi
cmp byte [ebp + 0x6f], 0x41
jl 0x460940
cmp byte [ebp + 0x6f], 0x5a
jg 0x460940
or byte [ebp + 0x6f], 0x20
lea eax, [ebp + 0x78]
push eax
call fcn.0043e7bd
mov edi, dword [ebp + 0x78]
mov dword [esp], 0x4cb29c
push edi
mov dword [ebp + 0x4c], edi
call dword [sym.imp.SHLWAPI.dll_StrStrW]
mov esi, eax
cmp esi, ebx
je 0x460966
lea edi, [esi + 4]
mov edx, edi
mov dword [ebp + 0x3c], edx
cmp word [edi], bx
je 0x4609f9
mov ax, word [edx]
cmp ax, 0x2c
je 0x4609b0
cmp ax, 0x3d
je 0x4609f9
cmp ax, 0x21
jne 0x4609a4
lea eax, [edx + 2]
mov dword [ebp + 0x28], eax
lea eax, [ebp + 0x28]
push eax
call fcn.0043e7bd
mov eax, dword [ebp + 0x28]
cmp word [eax], bx
pop ecx
je 0x4609f9
lea edx, [eax - 2]
inc edx
inc edx
mov dword [ebp + 0x3c], edx
cmp word [edx], bx
jne 0x460974
jmp 0x4609f9
add edx, 2
push 0x3d
push edx
call dword [sym.imp.SHLWAPI.dll_StrChrW]
cmp eax, ebx
je 0x4609c4
mov edx, eax
jmp 0x4609f1
mov eax, dword [ebp + 0x3c]
add eax, 2
push 0x21
push eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov edx, eax
cmp edx, ebx
je 0x4609f6
lea eax, [edx + 2]
mov dword [ebp + 0x28], eax
lea eax, [ebp + 0x28]
push eax
call fcn.0043e7bd
mov eax, dword [ebp + 0x28]
cmp word [eax], bx
pop ecx
jne 0x4609f6
mov dword [ebp + 0x3c], edx
jmp 0x4609f9
mov edx, dword [ebp + 0x3c]
mov ax, word [edx]
cmp ax, 0x2c
je 0x460a0e
cmp ax, 0x3d
je 0x460a0e
cmp ax, 0x21
jne 0x460a22
mov al, byte [edx]
mov word [edx], bx
add dword [ebp + 0x3c], 2
test al, al
mov byte [ebp + 0x33], al
jne 0x460aa8
inc byte [ebp + 0x32]
cmp byte [ebp + 0x32], 0
jg 0x460a9e
mov ecx, dword [ebp + 0x18]
push 1
push ebx
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x20]
call fcn.004567e7
mov eax, dword [ebp - 8]
lea ecx, [ebp - 4]
mov dword [ebp + 0x78], eax
call fcn.0043e825
lea ecx, [ebp + 4]
call fcn.0043e825
lea ecx, [ebp + 0x10]
call fcn.0043e825
lea ecx, [ebp - 0x14]
call fcn.0043e825
lea ecx, [ebp + 8]
call fcn.0043e825
lea eax, [ebp + 0x78]
push eax
call fcn.0043e7bd
push 0xa
lea eax, [ebp + 0x78]
push eax
push str.___initram
call fcn.00446fac
add esp, 0x10
test al, al
je 0x4605bd
push 3
call fcn.00412eaf
pop ecx
xor esi, esi
jmp 0x461b13
mov esi, 0x80070057
jmp 0x461aeb
cmp esi, ebx
mov dword [ebp - 0xc], ebx
jne 0x460ac1
push 0x5c
push ebx
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_StrRChrW]
call edi
mov esi, eax
cmp esi, ebx
je 0x460b11
mov ecx, dword [ebp + 0x18]
push 1
push ebx
lea eax, [ebp + 8]
mov word [esi], bx
push eax
push dword [ebp + 0x78]
inc esi
inc esi
call fcn.004567e7
mov eax, dword [ebp + 8]
push 0x5c
push eax
mov dword [ebp + 0x4c], eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
cmp eax, ebx
mov dword [ebp + 0x5c], eax
je 0x460af6
mov word [eax], bx
inc eax
inc eax
mov dword [ebp + 0x5c], eax
mov ecx, dword [ebp + 0x18]
push 1
push ebx
lea eax, [ebp - 0xc]
push eax
push esi
call fcn.004567e7
mov eax, dword [ebp - 0xc]
mov dword [ebp + 0x34], eax
jmp 0x460b9a
push 1
push 0x2c
lea eax, [ebp + 0x4c]
push eax
lea ecx, [ebp - 0x24]
call fcn.00458b67
push ebx
lea ecx, [ebp + 8]
push ecx
push eax
call fcn.00447e0d
mov eax, dword [ebp + 8]
add esp, 0xc
push 0x5c
push eax
mov dword [ebp + 0x4c], eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov esi, eax
cmp esi, ebx
jne 0x460b4e
mov esi, 0x80070057
jmp 0x461ae3
mov word [esi], bx
inc esi
inc esi
push 0x4cb29c
push esi
mov dword [ebp + 0x5c], esi
call dword [sym.imp.SHLWAPI.dll_StrStrW]
cmp byte [ebp + 0x67], 0
mov dword [ebp + 0x34], eax
je 0x460b7c
cmp eax, ebx
jne 0x460b8d
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esi + eax*2]
mov dword [ebp + 0x34], eax
cmp eax, ebx
jne 0x460b8d
push 0x5c
push ebx
push esi
call edi
cmp eax, ebx
mov dword [ebp + 0x34], eax
je 0x460b44
cmp word [eax], bx
je 0x460b9a
mov word [eax], bx
inc eax
inc eax
mov dword [ebp + 0x34], eax
cmp word [eax], 0x5c
jne 0x460ba5
inc eax
inc eax
mov dword [ebp + 0x34], eax
cmp byte [ebp + 0x26], 0
mov dword [ebp + 0x28], ebx
je 0x460bc9
lea eax, [ebp + 0x28]
push eax
lea eax, [ebp + 0x3c]
push eax
push dword [ebp + 0x18]
call fcn.00455050
mov eax, dword [ebp + 0x28]
add esp, 0xc
mov dword [ebp + 0x3c], eax
jmp 0x460bcc
mov eax, dword [ebp + 0x3c]
cmp byte [ebp + 0x33], 0x2c
jne 0x460c5d
push 1
push 0x2c
lea eax, [ebp + 0x3c]
push eax
lea ecx, [ebp - 0x24]
call fcn.00458b67
push ebx
lea ecx, [ebp + 0x10]
push ecx
push eax
call fcn.00447e0d
mov ecx, dword [ebp + 0x18]
add esp, 0xc
push ebx
lea eax, [ebp + 0x10]
push eax
call fcn.00402ef7
cmp byte [ebp + 0x6f], 0x2e
jne 0x460c3f
mov eax, dword [ebp + 0x3c]
cmp word [eax], 0x2c
jne 0x460c3f
add dword [ebp + 0x3c], 2
push 1
push 0x2c
lea eax, [ebp + 0x3c]
push eax
lea ecx, [ebp - 0x24]
call fcn.00458b67
push ebx
lea ecx, [ebp - 4]
push ecx
push eax
call fcn.00447e0d
mov ecx, dword [ebp + 0x18]
add esp, 0xc
push ebx
lea eax, [ebp - 4]
push eax
call fcn.00402ef7
mov eax, dword [ebp + 0x10]
cmp word [eax], bx
jne 0x460d56
push str.RegDat
lea ecx, [ebp + 0x10]
call fcn.0044e88f
jmp 0x460d56
cmp byte [ebp + 0x33], 0x21
je 0x460d56
cmp word [eax], bx
jne 0x460c90
cmp byte [ebp + 0x6f], 0x24
je 0x460caf
cmp byte [ebp + 0x6f], 0x2a
je 0x460c90
cmp byte [ebp + 0x6f], 0x7e
je 0x460c90
cmp byte [ebp + 0x53], 0
je 0x460d56
mov dword [ebp + 0x68], eax
jmp 0x460d56
cmp byte [ebp + 0x6f], 0x24
je 0x460caf
cmp byte [ebp + 0x6f], 0x2a
je 0x460caf
cmp byte [ebp + 0x6f], 0x7e
je 0x460caf
lea eax, [ebp + 0x3c]
push eax
call fcn.0043e7bd
mov eax, dword [ebp + 0x3c]
pop ecx
push eax
lea ecx, [ebp + 0x14]
call fcn.0044e827
mov edx, dword [ebp + 0x14]
lea eax, [ebp + 0x78]
push eax
mov dword [ebp + 0x78], edx
call fcn.0043e7bd
cmp byte [ebp + 0x7c], 0
pop ecx
je 0x460cd9
push edx
lea ecx, [ebp + 4]
call fcn.0044e88f
jmp 0x460ce9
mov ecx, dword [ebp + 0x18]
push 1
push ebx
lea eax, [ebp + 4]
push eax
push edx
call fcn.004553cd
mov eax, dword [ebp + 4]
mov dword [ebp + 0x68], eax
mov dword [ebp + 0x7c], eax
lea eax, [ebp + 0x7c]
push eax
call fcn.0043e7bd
cmp byte [ebp + 0x6f], 0
pop ecx
jne 0x460d34
push dword [ebp + 0x78]
push 0x4cb284
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x460d1d
mov dword [ebp + 0x68], 0x4c1a3c
jmp 0x460d4e
mov ecx, dword [ebp + 0x7c]
mov ax, word [ecx]
cmp ax, 0x23
je 0x460d2f
cmp ax, 0x40
jne 0x460d4e
mov dword [ebp + 0x68], ecx
jmp 0x460d4e
cmp byte [ebp + 0x6f], 0x23
je 0x460d40
cmp byte [ebp + 0x6f], 0x40
jne 0x460d4e
mov eax, dword [ebp + 0x7c]
cmp word [eax], bx
mov dword [ebp + 0x68], eax
jne 0x460d4e
mov dword [ebp + 0x68], ebx
lea ecx, [ebp + 0x14]
call fcn.0043e825
mov edi, dword [ebp + 0x4c]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str.HKLM
push edi
mov dword [ebp + 0x78], ebx
call esi
test eax, eax
je 0x460e30
push str.HKEY_LOCAL_MACHINE
push edi
call esi
test eax, eax
je 0x460e30
push str.HKCU
push edi
call esi
test eax, eax
je 0x460e27
push str.HKEY_CURRENT_USER
push edi
call esi
test eax, eax
je 0x460e27
push str.HKCR
push edi
call esi
test eax, eax
je 0x460e1e
push str.HKEY_CLASSES_ROOT
push edi
call esi
test eax, eax
je 0x460e1e
push 0x4cb1e8
push edi
call esi
test eax, eax
je 0x460e15
push str.HKEY_USERS
push edi
call esi
test eax, eax
je 0x460e15
push str.HKCC
push edi
call esi
test eax, eax
je 0x460e0c
push str.HKEY_CURRENT_CONFIG
push edi
call esi
test eax, eax
je 0x460e0c
lea eax, [ebp + 0x78]
push eax
lea eax, [ebp + 0x4c]
push eax
call fcn.004483d5
test eax, eax
pop ecx
pop ecx
je 0x460e02
cmp dword [ebp + 0x78], ebx
jne 0x460e37
mov esi, 0x80070057
jmp 0x461adb
mov dword [ebp + 0x78], 0x80000005
jmp 0x460e37
mov dword [ebp + 0x78], 0x80000003
jmp 0x460e37
mov dword [ebp + 0x78], 0x80000000
jmp 0x460e37
mov dword [ebp + 0x78], 0x80000001
jmp 0x460e37
mov dword [ebp + 0x78], 0x80000002
mov eax, dword [ebp + 0x10]
cmp word [eax], bx
je 0x46157b
cmp byte [ebp + 0x6f], 0x2e
je 0x460e52
cmp byte [ebp + 0x6f], 0x3f
mov dword [ebp + 0x38], ebx
jne 0x460e5f
cmp byte [ebp + 0x6f], 0x3f
mov dword [ebp + 0x38], 1
je 0x460e6e
cmp dword [ebp + 0x38], ebx
je 0x460e69
cmp word [eax], bx
je 0x460e6e
mov dword [ebp + 0x48], ebx
jmp 0x460e75
mov dword [ebp + 0x48], 1
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x64
lea ecx, [ebp + 0x68]
mov dword [ebp + 0xc], ebx
call fcn.00444f8a
lea ecx, [ebp + 0x4c]
call fcn.00444f6c
cmp byte [ebp + 0x6f], 0x2e
lea eax, [ebp + 0x4c]
je 0x460e9d
lea eax, [ebp + 0x68]
push 0x1000
lea ecx, [ebp + 0x44]
mov dword [ebp + 0x2c], eax
call fcn.00444e15
cmp byte [ebp + 0x67], 0
lea eax, [ebp + 0x7c]
mov dword [ebp], 0xfff
mov dword [ebp + 0x7c], ebx
mov dword [ebp + 0x20], ebx
push eax
je 0x461046
movzx eax, word [0x4dcc20]
or eax, 9
push eax
push ebx
push dword [ebp + 0x5c]
mov dword [ebp + 0x34], ebx
push dword [ebp + 0x78]
mov dword [ebp + 0x38], ebx
mov dword [ebp + 0x48], ebx
mov dword [ebp + 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp + 0x7c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push ebx
push ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp + 0x48]
push eax
lea eax, [ebp + 0x38]
push eax
push ebx
push ebx
push ebx
push dword [ebp + 0x7c]
call esi
push ebx
push ebx
push ebx
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 0x14]
push eax
push ebx
lea eax, [ebp + 0x48]
push eax
lea eax, [ebp + 0x38]
push eax
push ebx
push ebx
push ebx
push dword [ebp + 0x7c]
call esi
mov dword [ebp + 0x78], eax
mov eax, dword [ebp - 0x18]
cmp dword [ebp + 0x48], eax
jae 0x460f38
mov dword [ebp + 0x48], eax
mov eax, dword [ebp + 0x48]
lea eax, [eax*4 + 0x20]
mov dword [ebp - 0x10], eax
shr eax, 1
add eax, 8
push eax
lea ecx, [ebp + 0x58]
call fcn.00444f8a
mov esi, dword [ebp + 0x58]
mov word [esi], 0xd
mov word [esi + 2], 0xa
lea ebx, [esi + 4]
mov word [ebx], 0x76
lea edi, [esi + 8]
mov word [esi + 6], 0x20
and word [edi], 0
cmp byte [ebp + 0x67], 3
mov dword [ebp + 0x5c], ebx
je 0x460f81
mov edi, ebx
cmp dword [ebp + 0x78], 0
jne 0x46102a
test byte [ebp + 0x67], 1
je 0x460fd8
and dword [ebp + 0x78], 0
cmp dword [ebp + 0x14], 0
jle 0x460fd8
mov eax, dword [ebp - 0x10]
mov dword [ebp + 0x34], eax
xor eax, eax
push eax
push eax
push eax
push eax
mov word [edi], ax
lea eax, [ebp + 0x34]
push eax
push edi
push dword [ebp + 0x78]
push dword [ebp + 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x460fcd
push dword [ebp + 0x5c]
lea ecx, [ebp + 0x68]
call fcn.00444fd8
mov dword [ebp + 0x5c], esi
inc dword [ebp + 0x78]
mov eax, dword [ebp + 0x78]
cmp eax, dword [ebp + 0x14]
jl 0x460f9b
test byte [ebp + 0x67], 2
mov word [ebx], 0x6b
je 0x46102a
and dword [ebp + 0x78], 0
cmp dword [ebp + 0x38], 0
jle 0x46102a
xor ebx, ebx
mov eax, dword [ebp - 0x10]
push ebx
push ebx
push ebx
push ebx
mov dword [ebp + 0x34], eax
lea eax, [ebp + 0x34]
push eax
push edi
push dword [ebp + 0x78]
mov word [edi], bx
push dword [ebp + 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x46101f
push dword [ebp + 0x5c]
lea ecx, [ebp + 0x68]
call fcn.00444fd8
mov dword [ebp + 0x5c], esi
inc dword [ebp + 0x78]
mov eax, dword [ebp + 0x78]
cmp eax, dword [ebp + 0x38]
jl 0x460fef
cmp dword [ebp + 0x7c], 0
je 0x461039
push dword [ebp + 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 0x58]
call fcn.0043e825
jmp 0x461528
lea eax, [ebp]
push eax
lea eax, [ebp + 0x44]
push eax
push dword [ebp + 0x34]
push dword [ebp + 0x5c]
push dword [ebp + 0x78]
call fcn.00449667
mov esi, dword [ebp + 0x7c]
add esp, 0x18
cmp esi, ebx
mov edi, eax
je 0x4610d3
mov eax, dword [ebp + 0x34]
cmp word [eax], bx
jne 0x46108e
cmp esi, 2
jne 0x46108e
cmp edi, 0xfffffffe
jne 0x46108e
cmp dword [ebp + 0x38], ebx
je 0x46152a
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x4cb198
jmp 0x46109f
cmp dword [ebp + 0x38], ebx
mov dword [ebp + 0xc], esi
je 0x4610ac
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.ERROR
mov ecx, dword [ebp + 0x2c]
call fcn.00445027
jmp 0x46152a
cmp byte [ebp + 0x27], 0
jne 0x46152a
lea ecx, [ebp + 0x44]
call fcn.0043e825
lea ecx, [ebp + 0x4c]
call fcn.0043e825
lea ecx, [ebp + 0x68]
call fcn.0043e825
jmp 0x461adb
cmp dword [ebp + 0x58], ebx
jl 0x4610f4
jg 0x4610df
cmp dword [ebp + 0x54], ebx
jb 0x4610f4
xor eax, eax
cmp dword [ebp + 0x54], edi
jne 0x4610eb
cmp dword [ebp + 0x58], eax
je 0x4610f4
mov dword [ebp + 0x5c], 1
jmp 0x4610f7
mov dword [ebp + 0x5c], ebx
cmp edi, 1
mov byte [ebp + 0x7b], 0
mov byte [ebp + 0x7f], 0xff
mov eax, str.REG_SZ
jne 0x461111
mov bl, 0x24
mov byte [ebp + 0x7f], 0
jmp 0x46112b
cmp edi, 6
jne 0x46111f
mov eax, str.REG_LINK
mov bl, 0x5e
jmp 0x46112b
cmp edi, 0x15
jne 0x461182
mov eax, str.REG_MUI_SZ
mov bl, 0x75
xor esi, esi
cmp dword [ebp + 0x38], esi
je 0x461148
mov ecx, dword [ebp + 0x2c]
push 0xffffffffffffffff
push 0xffffffffffffffff
push eax
call fcn.00445027
cmp dword [ebp + 0x48], esi
jne 0x461528
cmp dword [ebp + 0x5c], esi
jne 0x4614b7
cmp dword [ebp + 0x58], esi
jg 0x461171
jl 0x46115d
cmp dword [ebp + 0x54], esi
jae 0x461171
mov al, byte [ebp + 0x6f]
cmp bl, al
je 0x461171
cmp al, 0x2e
je 0x461171
cmp byte [ebp + 0x7f], al
jne 0x4614b7
mov eax, dword [ebp + 0x68]
mov ecx, dword [ebp + 0x44]
mov dword [ebp + 0x68], ecx
mov dword [ebp + 0x44], eax
jmp 0x461528
cmp edi, 0xb
jne 0x4611f4
cmp dword [ebp + 0x38], ebx
je 0x4611a6
mov ecx, dword [ebp + 0x2c]
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_QWORD
call fcn.00445027
cmp dword [ebp + 0x48], ebx
jne 0x461528
cmp dword [ebp + 0x5c], ebx
jne 0x4614b7
cmp dword [ebp + 0x58], ebx
jg 0x4611cb
jl 0x4611bb
cmp dword [ebp + 0x54], ebx
jae 0x4611cb
cmp byte [ebp + 0x6f], 0x2b
je 0x4611cb
cmp byte [ebp + 0x6f], 0x2e
jne 0x4614b7
cmp byte [ebp + 0x43], 0
mov eax, str._I64u
jne 0x4611db
mov eax, str.0x_I64x
push eax
mov eax, dword [ebp + 0x44]
push dword [eax + 4]
push dword [eax]
push dword [ebp + 0x68]
call fcn.0049c16d
add esp, 0x10
jmp 0x461528
cmp edi, 4
mov esi, dword [ebp + 0x44]
jne 0x461241
cmp dword [ebp + 0x38], ebx
je 0x46121b
mov ecx, dword [ebp + 0x2c]
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_DWORD
call fcn.00445027
cmp dword [ebp + 0x48], ebx
jne 0x461528
cmp dword [ebp + 0x5c], ebx
jne 0x4614b7
cmp dword [ebp + 0x58], ebx
jg 0x4612a0
jl 0x461230
cmp dword [ebp + 0x54], ebx
jae 0x4612a0
cmp byte [ebp + 0x6f], 0x23
je 0x4612a0
cmp byte [ebp + 0x6f], 0x2e
je 0x4612a0
jmp 0x4614b7
cmp edi, 5
jne 0x4612c4
cmp dword [ebp + 0x38], ebx
je 0x461265
mov ecx, dword [ebp + 0x2c]
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_DWORD_BIG_ENDIAN
call fcn.00445027
cmp dword [ebp + 0x48], ebx
jne 0x461528
cmp dword [ebp + 0x5c], ebx
jne 0x4614b7
cmp dword [ebp + 0x58], ebx
jg 0x46128a
jl 0x46127a
cmp dword [ebp + 0x54], ebx
jae 0x46128a
cmp byte [ebp + 0x6f], 0x62
je 0x46128a
cmp byte [ebp + 0x6f], 0x2e
jne 0x4614b7
mov cl, byte [esi + 3]
mov al, byte [esi]
mov byte [esi], cl
mov byte [esi + 3], al
mov cl, byte [esi + 2]
mov al, byte [esi + 1]
mov byte [esi + 1], cl
mov byte [esi + 2], al
cmp byte [ebp + 0x43], 0
mov eax, 0x4c780c
jne 0x4612b0
mov eax, str.0x_lx
push dword [esi]
push eax
push dword [ebp + 0x68]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x461528
cmp edi, 2
jne 0x461332
cmp dword [ebp + 0x38], ebx
je 0x4612e8
mov ecx, dword [ebp + 0x2c]
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_EXPAND_SZ
call fcn.00445027
cmp dword [ebp + 0x48], ebx
jne 0x461528
cmp dword [ebp + 0x5c], ebx
jne 0x4614b7
cmp dword [ebp + 0x58], ebx
jg 0x46130d
jl 0x4612fd
cmp dword [ebp + 0x54], ebx
jae 0x46130d
cmp byte [ebp + 0x6f], 0x7e
je 0x46130d
cmp byte [ebp + 0x6f], 0x2e
jne 0x4614b7
cmp byte [ebp + 0x63], 0
je 0x461171
mov eax, dword [ebp + 0x44]
push 1
push ebx
lea ecx, [ebp + 0x68]
push ecx
mov ecx, dword [ebp + 0x18]
push eax
mov dword [ebp + 0x3c], eax
call fcn.004567e7
jmp 0x461528
cmp edi, 7
jne 0x461415
cmp dword [ebp + 0x38], ebx
je 0x46135a
mov ecx, dword [ebp + 0x2c]
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_MULTI_SZ
call fcn.00445027
cmp dword [ebp + 0x48], ebx
jne 0x461528
cmp dword [ebp + 0x5c], ebx
jne 0x4614b7
cmp dword [ebp + 0x58], ebx
jg 0x46137f
jl 0x46136f
cmp dword [ebp + 0x54], ebx
jae 0x46137f
cmp byte [ebp + 0x6f], 0x2a
je 0x46137f
cmp byte [ebp + 0x6f], 0x2e
jne 0x4614b7
mov esi, dword [ebp]
shr esi, 1
lea eax, [esi*4 + 6]
push eax
lea ecx, [ebp + 0x68]
call fcn.00444fb1
mov ecx, dword [ebp + 0x44]
mov eax, dword [ebp + 0x68]
lea esi, [ecx + esi*2]
jmp 0x461409
cmp byte [ebp + 0x63], 0x2a
jne 0x4613d0
cmp word [ecx], 0x5c
jne 0x4613d0
lea edx, [ecx + 2]
mov di, word [edx]
cmp di, 0x30
je 0x4613c2
cmp di, 0x5c
je 0x4613c2
cmp di, bx
jne 0x4613d0
mov word [eax], 0x5c
mov ecx, edx
mov dx, word [ecx]
inc eax
inc eax
jmp 0x4613d8
mov dx, word [ecx]
cmp dx, bx
je 0x4613e1
mov word [eax], dx
inc eax
inc eax
inc ecx
inc ecx
jmp 0x461409
inc ecx
inc ecx
cmp byte [ebp + 0x63], 0x24
jne 0x4613fb
cmp ecx, esi
jae 0x46140d
mov word [eax], 0xd
inc eax
inc eax
mov word [eax], 0xa
jmp 0x461407
mov word [eax], 0x5c
inc eax
inc eax
mov word [eax], 0x30
inc eax
inc eax
cmp ecx, esi
jb 0x46139f
mov word [eax], bx
jmp 0x461528
cmp edi, 3
jne 0x461421
mov eax, str.REG_BINARY
jmp 0x46144e
cmp edi, ebx
jne 0x46142c
mov eax, str.REG_NONE
jmp 0x46144e
cmp edi, 8
jne 0x461438
mov eax, str.REG_RESOURCE_LIST
jmp 0x46144e
cmp edi, 9
jne 0x461444
mov eax, str.REG_FULL_RESOURCE_DESCRIPTOR
jmp 0x46144e
cmp edi, 0xa
jne 0x46146f
mov eax, str.REG_RESOURCE_REQUIREMENTS_LIST
cmp dword [ebp + 0x38], ebx
je 0x461469
mov ecx, dword [ebp + 0x2c]
push 0xffffffffffffffff
push 0xffffffffffffffff
push eax
call fcn.00445027
cmp dword [ebp + 0x48], ebx
jne 0x461528
mov byte [ebp + 0x7b], 0x40
jmp 0x46149a
cmp dword [ebp + 0x38], ebx
je 0x46149a
mov esi, dword [ebp + 0x2c]
push 0x32
mov ecx, esi
call fcn.00444fb1
push edi
push str.0x_lx
push dword [esi]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
cmp dword [ebp + 0x48], ebx
jne 0x461528
cmp dword [ebp + 0x58], ebx
jg 0x4614b2
jl 0x4614a6
cmp dword [ebp + 0x54], ebx
jae 0x4614b2
mov al, byte [ebp + 0x6f]
cmp byte [ebp + 0x7b], al
je 0x4614b2
cmp al, 0x2e
jne 0x4614b7
cmp dword [ebp + 0x5c], ebx
je 0x4614d4
lea ecx, [ebp + 0x44]
call fcn.0043e825
lea ecx, [ebp + 0x4c]
call fcn.0043e825
lea ecx, [ebp + 0x68]
call fcn.0043e825
jmp 0x460e02
mov eax, dword [ebp]
lea eax, [eax + eax*4 + 7]
push eax
lea ecx, [ebp + 0x68]
call fcn.00444fb1
mov edi, dword [ebp + 0x68]
mov esi, dword [ebp + 0x44]
xor ebx, ebx
mov word [edi], bx
mov word [edi + 2], bx
cmp dword [ebp], ebx
mov dword [ebp + 0x20], 1
jle 0x461528
cmp byte [ebp + 0x43], 0
mov ecx, 0x4cb084
jne 0x46150f
mov ecx, str._0x_02X
movzx eax, byte [esi]
push eax
push ecx
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
inc esi
inc ebx
add edi, 0xa
cmp ebx, dword [ebp]
jl 0x4614ff
xor ebx, ebx
mov eax, dword [ebp + 0x10]
cmp word [eax], bx
je 0x461545
mov edx, dword [ebp + 0x68]
mov ecx, dword [ebp + 0x20]
lea ecx, [edx + ecx*2]
push ecx
mov ecx, dword [ebp + 0x18]
push eax
call fcn.00444692
mov eax, dword [ebp - 4]
cmp word [eax], bx
je 0x46155b
mov ecx, dword [ebp + 0x2c]
push dword [ecx]
mov ecx, dword [ebp + 0x18]
push eax
call fcn.00444692
lea ecx, [ebp + 0x44]
call fcn.0043e825
lea ecx, [ebp + 0x4c]
call fcn.0043e825
lea ecx, [ebp + 0x68]
call fcn.0043e825
mov esi, dword [ebp + 0xc]
jmp 0x461adb
cmp dword [ebp + 0x68], ebx
je 0x461a53
xor edx, edx
cmp byte [ebp + 0x66], dl
push 8
mov dword [ebp + 0x7c], edx
pop edi
mov dword [ebp + 0x1c], edx
mov dword [ebp + 0x20], edx
lea ebx, [ebp + 0x1c]
jg 0x46159f
cmp byte [ebp + 0x53], dl
je 0x4615ca
movsx eax, byte [ebp + 0x66]
push eax
push dword [ebp + 0x5c]
push dword [ebp + 0x78]
call fcn.00441f83
add esp, 0xc
cmp byte [ebp + 0x66], 2
mov esi, eax
jge 0x461a46
cmp byte [ebp + 0x53], 0
jne 0x461a46
xor edx, edx
mov cl, byte [ebp + 0x6f]
cmp cl, 0x2b
je 0x461999
test cl, cl
jne 0x4615f0
mov esi, dword [ebp + 0x68]
mov ax, word [esi]
cmp ax, 0x2b
jne 0x46162e
inc esi
inc esi
mov dword [ebp + 0x68], esi
jmp 0x46199c
cmp cl, 0x23
je 0x46191f
cmp cl, 0x62
jne 0x4616dc
cmp byte [ebp + 0x64], 0
mov dword [ebp + 0x54], 5
mov dword [ebp + 0x58], edx
je 0x461642
movsx eax, byte [ebp + 0x65]
push eax
lea eax, [ebp + 0x7c]
push eax
push dword [ebp + 0x68]
call fcn.00449759
mov ebx, dword [ebp + 0x7c]
add esp, 0xc
jmp 0x4616b2
cmp ax, 0x23
jne 0x461707
inc esi
inc esi
mov dword [ebp + 0x68], esi
jmp 0x461922
cmp byte [ebp + 0x65], 0
je 0x461682
mov edx, dword [ebp + 0x68]
xor ecx, ecx
mov cx, word [edx]
mov eax, ecx
call fcn.00444a69
test al, al
je 0x46176a
cmp cx, 0x30
jne 0x461676
mov ax, word [edx + 2]
or ax, 0x20
cmp ax, 0x78
jne 0x461676
add edx, 4
push edx
call fcn.00445bd7
pop ecx
mov dword [ebp + 0x1c], eax
jmp 0x46169a
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.00451e7f
cmp eax, 1
pop ecx
pop ecx
jl 0x461a07
mov al, byte [ebp + 0x1c]
mov cl, byte [ebp + 0x1f]
mov byte [ebp + 0x1c], cl
mov cl, byte [ebp + 0x1e]
mov byte [ebp + 0x1f], al
mov al, byte [ebp + 0x1d]
mov byte [ebp + 0x1d], cl
mov byte [ebp + 0x1e], al
push 4
pop edi
push edi
push ebx
push dword [ebp + 0x54]
xor esi, esi
cmp byte [ebp + 0x25], 0
push dword [ebp + 0x34]
push dword [ebp + 0x5c]
push dword [ebp + 0x78]
je 0x461a17
call dword [0x4dd25c]
mov esi, eax
jmp 0x461a1f
cmp cl, 0x2a
je 0x461815
cmp cl, 0x7e
je 0x4617ac
cmp cl, 0x40
je 0x46179d
cmp cl, 0x6e
mov esi, dword [ebp + 0x68]
jne 0x461731
mov dword [ebp + 0x54], edx
jmp 0x4617a7
cmp ax, 0x2a
jne 0x461717
inc esi
inc esi
mov dword [ebp + 0x68], esi
jmp 0x461818
cmp ax, 0x7e
jne 0x461727
push 2
pop edi
add esi, edi
jmp 0x4617b2
cmp ax, 0x40
jne 0x461731
inc esi
inc esi
jmp 0x4617a0
cmp dword [ebp + 0x58], edx
jg 0x461828
jl 0x461745
cmp dword [ebp + 0x54], edx
jae 0x461828
cmp cl, 0x5e
jne 0x461753
mov dword [ebp + 0x54], 6
jmp 0x46177e
cmp cl, 0x75
jne 0x461761
mov dword [ebp + 0x54], 0x15
jmp 0x46177e
test cl, cl
je 0x461777
cmp cl, 0x24
je 0x461777
lea ecx, [ebp + 0x7c]
call fcn.0043e825
jmp 0x460e02
mov dword [ebp + 0x54], 1
cmp byte [ebp + 0x64], 0
mov dword [ebp + 0x58], edx
jne 0x461828
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
shl edi, 1
mov ebx, esi
jmp 0x4616b5
mov esi, dword [ebp + 0x68]
mov dword [ebp + 0x54], 3
mov dword [ebp + 0x58], edx
jmp 0x461828
mov esi, dword [ebp + 0x68]
push 2
pop edi
cmp byte [ebp + 0x64], 0
mov dword [ebp + 0x54], edi
mov dword [ebp + 0x58], edx
jne 0x461828
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 2
push eax
lea ecx, [ebp + 0x7c]
call fcn.00444fb1
cmp word [esi], 0
mov ebx, dword [ebp + 0x7c]
mov ecx, esi
mov eax, ebx
je 0x461806
mov dx, word [ecx]
cmp dx, 0x5c
jne 0x4617f9
cmp word [ecx + 2], 0x30
jne 0x4617f9
and word [eax], 0
add eax, edi
add ecx, 4
jmp 0x461800
mov word [eax], dx
add eax, edi
add ecx, edi
cmp word [ecx], 0
jne 0x4617de
and word [eax], 0
sub eax, ebx
add eax, edi
mov edi, eax
jmp 0x4616b5
mov esi, dword [ebp + 0x68]
cmp byte [ebp + 0x64], 0
mov dword [ebp + 0x54], 7
mov dword [ebp + 0x58], edx
je 0x46183e
movsx eax, byte [ebp + 0x65]
push eax
lea eax, [ebp + 0x7c]
push eax
push esi
call fcn.00449759
mov edi, eax
jmp 0x461940
mov esi, dword [ebp + 0x68]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
lea eax, [ebx + 0x10]
push eax
lea ecx, [ebp + 0x7c]
xor edi, edi
call fcn.00444fb1
mov edx, dword [ebp + 0x7c]
lea ecx, [esi + ebx*2]
cmp esi, ecx
mov eax, esi
mov dword [ebp + 0xc], ecx
jae 0x46189c
and word [edx], 0
cmp byte [ebp + 0x63], 0x2a
jne 0x4618d3
cmp word [eax], 0x5c
jne 0x461900
lea ecx, [eax + 2]
cmp word [ecx], 0x5c
jne 0x461900
mov eax, ecx
mov cx, word [eax]
mov word [edx], cx
inc edx
inc edx
inc eax
inc eax
xor edi, edi
cmp eax, dword [ebp + 0xc]
jb 0x461867
cmp edi, 1
jge 0x4618a3
and word [edx], 0
inc edi
inc edx
inc edx
test ebx, ebx
jle 0x4618c3
cmp edi, 2
jge 0x4618c3
push 2
pop esi
sub esi, edi
xor eax, eax
mov ecx, esi
shr ecx, 1
mov edi, edx
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
lea edx, [edx + esi*2]
mov ebx, dword [ebp + 0x7c]
and word [edx], 0
sub edx, ebx
mov edi, edx
jmp 0x4616b5
cmp byte [ebp + 0x63], 0x24
jne 0x461900
mov cx, word [eax]
cmp cx, 0xd
jne 0x4618ef
lea esi, [eax + 2]
cmp word [esi], 0xa
jne 0x4618ef
mov eax, esi
jmp 0x4618f5
cmp cx, 0xa
jne 0x461889
and word [edx], 0
inc eax
inc eax
inc edx
inc edx
inc edi
jmp 0x461892
mov cx, word [eax]
cmp cx, 0x5c
jne 0x461889
cmp word [eax + 2], 0x30
jne 0x461889
and word [edx], 0
inc edx
inc edx
add eax, 4
jmp 0x4618fd
mov esi, dword [ebp + 0x68]
cmp byte [ebp + 0x64], 0
push 4
pop edi
mov dword [ebp + 0x54], edi
mov dword [ebp + 0x58], edx
je 0x46194b
movsx eax, byte [ebp + 0x65]
push eax
lea eax, [ebp + 0x7c]
push eax
push esi
call fcn.00449759
mov ebx, dword [ebp + 0x7c]
add esp, 0xc
jmp 0x4616b5
cmp byte [ebp + 0x65], 0
je 0x46198a
xor ecx, ecx
mov cx, word [esi]
mov eax, ecx
call fcn.00444a69
test al, al
je 0x46176a
cmp cx, 0x30
jne 0x46197b
mov ax, word [esi + 2]
or ax, 0x20
cmp ax, 0x78
jne 0x46197b
add esi, edi
push esi
call fcn.00445bd7
pop ecx
mov dword [ebp + 0x1c], eax
jmp 0x4616b5
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.00451e7f
jmp 0x4619fc
mov esi, dword [ebp + 0x68]
cmp byte [ebp + 0x64], 0
mov dword [ebp + 0x54], 0xb
mov dword [ebp + 0x58], edx
jne 0x461931
cmp byte [ebp + 0x65], 0
je 0x4619ef
xor ecx, ecx
mov cx, word [esi]
mov eax, ecx
call fcn.00444a69
test al, al
je 0x46176a
cmp cx, 0x30
jne 0x4619dd
mov ax, word [esi + 2]
or ax, 0x20
cmp ax, 0x78
jne 0x4619dd
add esi, 4
push esi
call fcn.00445bd7
pop ecx
mov dword [ebp + 0x1c], eax
mov dword [ebp + 0x20], edx
jmp 0x4616b5
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.00451c15
cmp eax, 1
pop ecx
pop ecx
jge 0x4616b5
lea ecx, [ebp + 0x7c]
call fcn.0043e825
xor esi, esi
inc esi
jmp 0x461adb
call fcn.0043fa7d
add esp, 0x18
cmp esi, 0x3fd
jne 0x461a46
cmp byte [ebp + 0x66], 0
jne 0x461a46
push 1
push dword [ebp + 0x5c]
mov byte [ebp + 0x66], 1
push dword [ebp + 0x78]
call fcn.00441f83
add esp, 0xc
jmp 0x4616b5
lea ecx, [ebp + 0x7c]
call fcn.0043e825
jmp 0x461adb
cmp byte [ebp + 0x33], 0x21
jne 0x461a85
mov eax, dword [ebp + 0x34]
cmp word [eax], bx
jne 0x461a85
cmp dword [ebp + 0x48], ebx
je 0x461a76
push dword [ebp + 0x48]
push dword [ebp + 0x5c]
push dword [ebp + 0x78]
call fcn.0044fd54
jmp 0x461acf
push dword [ebp + 0x5c]
push dword [ebp + 0x78]
call fcn.0044fb53
pop ecx
pop ecx
jmp 0x461ad2
cmp dword [ebp + 0x48], ebx
je 0x461ac1
push ebx
lea eax, [ebp + 0x7c]
push eax
movzx eax, word [0x4dcc20]
push ebx
or eax, 0x2001b
push eax
push ebx
push ebx
push ebx
push dword [ebp + 0x5c]
mov dword [ebp + 0x7c], ebx
push dword [ebp + 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp dword [ebp + 0x7c], ebx
mov esi, eax
je 0x461ad4
push dword [ebp + 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x461ad4
push dword [ebp + 0x34]
push dword [ebp + 0x5c]
push dword [ebp + 0x78]
call fcn.0043fad8
add esp, 0xc
mov esi, eax
cmp esi, 2
jne 0x461adb
xor esi, esi
lea ecx, [ebp + 0x28]
call fcn.0043e825
lea ecx, [ebp - 0xc]
call fcn.0043e825
lea ecx, [ebp - 4]
call fcn.0043e825
lea ecx, [ebp + 4]
call fcn.0043e825
lea ecx, [ebp + 0x10]
call fcn.0043e825
lea ecx, [ebp - 0x14]
call fcn.0043e825
lea ecx, [ebp + 8]
call fcn.0043e825
lea ecx, [ebp - 8]
call fcn.0043e825
lea ecx, [ebp - 0x24]
call fcn.0043e825
pop edi
mov eax, esi
pop esi
pop ebx
add ebp, 0x70
leave
ret 8