Function at 0x471cd0
Capabilities:
Encode data using base64
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4eb0f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5c
push ebx
push ebp
push esi
push edi
mov esi, ecx
xor edi, edi
push 2
mov dword [esp + 0x44], esi
mov dword [esp + 0x64], edi
call fcn.00449130
add esp, 4
cmp eax, edi
mov dword [esp + 0x60], eax
je 0x471d0d
mov word [eax], di
mov dword [esp + 0x64], esi
mov dword [esp + 0x68], edi
mov dword [esp + 0x74], edi
mov byte [esp + 0x12], 0xff
mov dword [esp + 0x1c], edi
mov esi, dword [esp + 0x7c]
mov byte [esp + 0x74], 1
mov dword [esp + 0x48], esi
mov dword [esp + 0x2c], edi
test esi, esi
je 0x471d51
mov ax, word [esi]
cmp ax, 9
jb 0x471d46
cmp ax, 0xd
jbe 0x471d4c
cmp ax, 0x20
jne 0x471d51
add esi, 2
jmp 0x471d37
mov ax, word [esi]
xor edi, edi
cmp ax, 0x2d
mov byte [esp + 0x7c], 0
mov byte [esp + 0x10], 0
mov byte [esp + 0x11], 0
mov dword [esp + 0x34], edi
mov cl, 0x2a
jne 0x471d73
mov cl, al
movsx ecx, cl
movzx eax, ax
cmp ecx, eax
mov dword [esp + 0x58], ecx
jne 0x471e60
jmp 0x471d90
movzx edx, word [esi + 2]
cmp ecx, edx
jne 0x471e5c
xor eax, eax
mov ax, word [esi + 4]
mov ecx, eax
and ecx, 0xffdf
cmp cx, 0x48
je 0x471e5c
cmp ax, 9
jb 0x471dc4
cmp ax, 0xd
jbe 0x471e5c
cmp ax, 0x20
je 0x471e5c
add esi, 4
mov eax, esi
mov ecx, 0x4fa540
xor edx, edx
lea ebx, [ebx]
movzx ebx, word [eax]
movsx ebp, byte [ecx]
or ebx, 0x20
or ebp, 0x20
add eax, 2
inc ecx
cmp ebp, ebx
jne 0x471fb3
dec edx
jns 0x471de0
mov ax, word [esi]
xor ebx, ebx
cmp ax, bx
lea ecx, [esi + 2]
je 0x471e26
cmp ax, 9
jb 0x471e14
cmp ax, 0xd
jbe 0x471e26
cmp ax, 0x20
je 0x471e26
mov ax, word [esi + 2]
add esi, 2
cmp ax, bx
jne 0x471e08
mov ax, word [esi]
cmp ax, 9
jb 0x471e35
cmp ax, 0xd
jbe 0x471e3b
cmp ax, 0x20
jne 0x471e40
add esi, 2
jmp 0x471e26
cmp word [ecx], 0x3a
je 0x471f5e
or edi, 7
movzx edx, word [esi]
mov ecx, dword [esp + 0x58]
cmp ecx, edx
je 0x471d90
mov dword [esp + 0x34], edi
push 2
call fcn.00449130
add esp, 4
test eax, eax
mov dword [esp + 0x18], eax
je 0x471e77
mov word [eax], 0
push 2
call fcn.00449130
add esp, 4
test eax, eax
mov dword [esp + 0x24], eax
je 0x471e8e
mov word [eax], 0
push 2
call fcn.00449130
add esp, 4
test eax, eax
mov dword [esp + 0x14], eax
je 0x471ea5
mov word [eax], 0
push 2
call fcn.00449130
mov ebp, eax
add esp, 4
test ebp, ebp
mov dword [esp + 0x20], ebp
je 0x471ebf
mov word [ebp], 0
push 2
call fcn.00449130
mov edi, eax
add esp, 4
test edi, edi
mov dword [esp + 0x28], edi
je 0x471ed8
mov word [edi], 0
mov ax, word [esi]
cmp ax, 0x2b
mov byte [esp + 0x74], 6
je 0x471f10
cmp ax, 0x23
je 0x471f10
cmp ax, 0x40
je 0x471f10
cmp ax, 0x24
je 0x471f10
cmp ax, 0x2a
je 0x471f10
cmp ax, 0x7e
je 0x471f10
cmp ax, 0x2e
je 0x471f10
cmp ax, 0x3f
jne 0x471f29
mov al, byte [esi]
add esi, 2
test al, al
mov byte [esp + 0x7c], al
je 0x471f29
movzx eax, word [esi]
movsx ecx, byte [esp + 0x7c]
cmp ecx, eax
je 0x471f2f
cmp word [esi], 0x24
jne 0x471f38
mov dl, byte [esi]
mov byte [esp + 0x10], dl
add esi, 2
test esi, esi
je 0x47205e
mov ax, word [esi]
cmp ax, 9
jb 0x471f4f
cmp ax, 0xd
jbe 0x471f59
cmp ax, 0x20
jne 0x47205e
add esi, 2
jmp 0x471f40
lea edx, [esp + 0x50]
push edx
lea eax, [esp + 0x50]
add ecx, 2
push eax
mov dword [esp + 0x54], ecx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x5c], ebx
call fcn.0044cd70
add esp, 8
test eax, eax
jle 0x471e4d
mov ecx, dword [esp + 0x4c]
cmp ecx, ebx
je 0x471faa
nop
mov ax, word [ecx]
cmp ax, 9
jb 0x471f9f
cmp ax, 0xd
jbe 0x471fa5
cmp ax, 0x20
jne 0x471faa
add ecx, 2
jmp 0x471f90
or edi, dword [esp + 0x50]
jmp 0x471e4d
mov eax, esi
mov ecx, 0x4fa53c
mov edx, 1
nop
movzx ebx, word [eax]
movsx ebp, byte [ecx]
or ebx, 0x20
or ebp, 0x20
add eax, 2
inc ecx
cmp ebp, ebx
jne 0x47201a
dec edx
jns 0x471fc0
mov ax, word [eax]
cmp ax, 9
jb 0x471fe6
cmp ax, 0xd
jbe 0x471ff1
cmp ax, 0x20
je 0x471ff1
test ax, ax
jne 0x47201a
add esi, 4
je 0x472010
mov ax, word [esi]
cmp ax, 9
jb 0x472005
cmp ax, 0xd
jbe 0x47200b
cmp ax, 0x20
jne 0x472010
add esi, 2
jmp 0x471ff6
mov byte [esp + 0x11], 1
jmp 0x471e4d
mov ax, word [esi]
test ax, ax
je 0x472040
cmp ax, 9
jb 0x47202e
cmp ax, 0xd
jbe 0x472040
cmp ax, 0x20
je 0x472040
mov ax, word [esi + 2]
add esi, 2
test ax, ax
jne 0x472022
mov ax, word [esi]
cmp ax, 9
jb 0x47204f
cmp ax, 0xd
jbe 0x472059
cmp ax, 0x20
jne 0x471e4d
add esi, 2
jmp 0x472040
xor eax, eax
mov ax, word [esi]
test ax, ax
mov dword [esp + 0x58], esi
je 0x47208e
lea esp, [esp]
cmp ax, 0x2c
je 0x47208e
cmp ax, 0x3d
je 0x47208e
cmp ax, 0x21
je 0x47208e
mov ax, word [esi + 2]
add esi, 2
test ax, ax
jne 0x472070
mov ax, word [esi]
cmp ax, 0x2c
je 0x4720a3
cmp ax, 0x3d
je 0x4720a3
cmp ax, 0x21
jne 0x4720bd
mov bl, byte [esi]
mov word [esi], 0
add esi, 2
test bl, bl
mov byte [esp + 0x13], bl
mov dword [esp + 0x3c], esi
jne 0x472278
mov al, byte [esp + 0x12]
inc al
test al, al
mov byte [esp + 0x12], al
jg 0x4721a2
mov eax, dword [esp + 0x40]
mov cl, byte [eax + 0x8e]
test cl, cl
jne 0x4720fc
test byte [eax + 0xb], 0xf
jne 0x4720fc
mov ecx, dword [esp + 0x48]
push 1
push 0
lea eax, [esp + 0x24]
push eax
push ecx
mov ecx, dword [esp + 0x50]
call fcn.004541d0
jmp 0x472113
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x40]
push 1
push 0
lea edx, [esp + 0x24]
push edx
push eax
call fcn.00452ca0
test edi, edi
mov esi, dword [esp + 0x1c]
je 0x472132
mov ecx, dword [0x51d3c8]
add edi, 0xfffffff8
push edi
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
push 0
push ecx
call edi
jmp 0x472138
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
test ebp, ebp
je 0x47214b
mov edx, dword [0x51d3c8]
add ebp, 0xfffffff8
push ebp
push 0
push edx
call edi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x472161
add eax, 0xfffffff8
push eax
mov eax, dword [0x51d3c8]
push 0
push eax
call edi
mov eax, dword [esp + 0x24]
test eax, eax
je 0x472178
mov ecx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push ecx
call edi
mov eax, dword [esp + 0x18]
test eax, eax
mov byte [esp + 0x74], 1
je 0x471d33
mov edx, eax
mov eax, dword [0x51d3c8]
add edx, 0xfffffff8
push edx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x471d33
test edi, edi
je 0x4721b9
mov ecx, dword [0x51d3c8]
add edi, 0xfffffff8
push edi
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
test ebp, ebp
je 0x4721d0
mov edx, dword [0x51d3c8]
add ebp, 0xfffffff8
push ebp
push 0
push edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4721eb
mov ecx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x24]
test eax, eax
je 0x472207
mov edx, eax
mov eax, dword [0x51d3c8]
add edx, 0xfffffff8
push edx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x472224
mov edx, dword [0x51d3c8]
mov ecx, eax
add ecx, 0xfffffff8
push ecx
push 0
push edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x47223f
mov ecx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x60]
test eax, eax
je 0x473046
mov edx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push edx
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebp
mov eax, 0x80070057
pop ebx
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
add esp, 0x68
ret 8
push 1
push 0x2c
lea eax, [esp + 0x60]
push eax
lea ecx, [esp + 0x6c]
call fcn.00459430
push 0
lea ecx, [esp + 0x1c]
push ecx
push eax
call fcn.0044c770
mov ebp, dword [esp + 0x24]
add esp, 0xc
push 0x5c
push ebp
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov edi, eax
test edi, edi
jne 0x47236f
mov eax, dword [esp + 0x28]
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
je 0x4722cd
mov edx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push edi
push edx
call esi
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4722e3
add eax, 0xfffffff8
push eax
mov eax, dword [0x51d3c8]
push 0
push eax
call esi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4722fa
mov ecx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push ecx
call esi
mov eax, dword [esp + 0x24]
test eax, eax
je 0x472311
mov edx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push edx
call esi
test ebp, ebp
je 0x472323
mov eax, dword [0x51d3c8]
add ebp, 0xfffffff8
push ebp
push 0
push eax
call esi
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x47233a
mov ecx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push ecx
call esi
mov eax, dword [esp + 0x60]
test eax, eax
je 0x473046
mov edx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push edx
call esi
pop edi
pop esi
pop ebp
mov eax, 0x80070057
pop ebx
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
add esp, 0x68
ret 8
mov word [edi], 0
add edi, 2
push 0x4fa534
push edi
mov dword [esp + 0x38], edi
call dword [sym.imp.SHLWAPI.dll_StrStrW]
test eax, eax
jne 0x47245f
push 0x5c
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
test eax, eax
jne 0x47245f
mov eax, dword [esp + 0x28]
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
je 0x4723bd
add eax, 0xfffffff8
push eax
mov eax, dword [0x51d3c8]
push 0
push eax
call esi
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4723d4
mov ecx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push ecx
call esi
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4723eb
mov edx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push edx
call esi
mov eax, dword [esp + 0x24]
test eax, eax
je 0x472401
add eax, 0xfffffff8
push eax
mov eax, dword [0x51d3c8]
push 0
push eax
call esi
test ebp, ebp
je 0x472414
mov ecx, dword [0x51d3c8]
add ebp, 0xfffffff8
push ebp
push 0
push ecx
call esi
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x47242b
mov edx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push edx
call esi
mov eax, dword [esp + 0x60]
test eax, eax
je 0x4731ec
add eax, 0xfffffff8
push eax
mov eax, dword [0x51d3c8]
push 0
push eax
call esi
pop edi
pop esi
pop ebp
mov eax, 0x80070057
pop ebx
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
add esp, 0x68
ret 8
mov word [eax], 0
add eax, 2
cmp word [eax], 0x5c
mov dword [esp + 0x38], eax
jne 0x472478
add eax, 2
mov dword [esp + 0x38], eax
cmp bl, 0x2c
jne 0x47255a
push 1
push 0x2c
lea ecx, [esp + 0x44]
push ecx
lea ecx, [esp + 0x6c]
call fcn.00459430
push 0
lea edx, [esp + 0x18]
push edx
push eax
call fcn.0044c770
mov esi, dword [esp + 0x4c]
add esp, 0xc
push 0
lea eax, [esp + 0x18]
push eax
mov ecx, esi
call fcn.004166b6
cmp byte [esp + 0x7c], 0x2e
jne 0x4724ff
mov ecx, dword [esp + 0x3c]
cmp word [ecx], 0x2c
jne 0x4724ff
push 1
mov edi, ecx
push 0x2c
lea edx, [esp + 0x44]
add edi, 2
push edx
lea ecx, [esp + 0x6c]
mov dword [esp + 0x48], edi
call fcn.00459430
push 0
lea ecx, [esp + 0x2c]
push ecx
push eax
call fcn.0044c770
add esp, 0xc
push 0
lea edx, [esp + 0x2c]
push edx
mov ecx, esi
call fcn.004166b6
mov ebp, dword [esp + 0x14]
cmp word [ebp], 0
jne 0x4726ba
push str.RegDat
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
push esi
call fcn.00449130
mov ecx, esi
mov edx, ecx
shr ecx, 2
mov esi, str.RegDat
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
add esp, 4
test ebp, ebp
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 0x14], eax
je 0x4726ba
mov eax, dword [0x51d3c8]
add ebp, 0xfffffff8
push ebp
push 0
push eax
jmp 0x4726b4
cmp bl, 0x21
je 0x4726ba
cmp word [esi], 0
mov bl, byte [esp + 0x7c]
jne 0x472580
cmp bl, 0x24
je 0x4725a0
cmp bl, 0x2a
je 0x472580
cmp bl, 0x7e
jne 0x4726ba
cmp bl, 0x24
je 0x4725a0
cmp bl, 0x2a
je 0x4725a0
cmp bl, 0x7e
je 0x4725a0
lea ecx, [esp + 0x3c]
push ecx
call fcn.00443850
mov esi, dword [esp + 0x40]
add esp, 4
xor edi, edi
test esi, esi
mov dword [esp + 0x58], edi
je 0x4725d9
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [eax + eax + 2]
lea edx, [edi + 2]
push edx
call fcn.00449130
mov ecx, edi
mov edx, ecx
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
add esp, 4
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, eax
mov dword [esp + 0x58], edi
test edi, edi
mov byte [esp + 0x74], 7
mov ebp, edi
je 0x4725ff
mov ax, word [ebp]
cmp ax, 9
jb 0x4725f4
cmp ax, 0xd
jbe 0x4725fa
cmp ax, 0x20
jne 0x4725ff
add ebp, 2
jmp 0x4725e4
mov al, byte [esp + 0x80]
test al, al
je 0x472616
push edi
lea ecx, [esp + 0x24]
call fcn.00456630
jmp 0x472629
mov ecx, dword [esp + 0x40]
push 1
push 0
lea eax, [esp + 0x28]
push eax
push edi
call fcn.00452ca0
mov esi, dword [esp + 0x20]
test esi, esi
mov dword [esp + 0x2c], esi
je 0x47264f
mov ax, word [esi]
cmp ax, 9
jb 0x472644
cmp ax, 0xd
jbe 0x47264a
cmp ax, 0x20
jne 0x47264f
add esi, 2
jmp 0x472635
test bl, bl
jne 0x472682
push ebp
push 0x4fa51c
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x47266d
mov dword [esp + 0x2c], 0x4efd50
jmp 0x47269e
mov ax, word [esi]
cmp ax, 0x23
je 0x47267c
cmp ax, 0x40
jne 0x47269e
mov dword [esp + 0x2c], esi
jmp 0x47269e
cmp bl, 0x23
je 0x47268c
cmp bl, 0x40
jne 0x47269e
cmp word [esi], 0
mov dword [esp + 0x2c], esi
jne 0x47269e
mov dword [esp + 0x2c], 0
test edi, edi
mov byte [esp + 0x74], 6
je 0x4726ba
mov ecx, dword [0x51d3c8]
add edi, 0xfffffff8
push edi
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str.HKLM
push edi
call esi
test eax, eax
je 0x472764
push str.HKEY_LOCAL_MACHINE
push edi
call esi
test eax, eax
je 0x472764
push str.HKCU
push edi
call esi
test eax, eax
je 0x47275d
push str.HKEY_CURRENT_USER
push edi
call esi
test eax, eax
je 0x47275d
push str.HKCR
push edi
call esi
test eax, eax
je 0x472756
push str.HKEY_CLASSES_ROOT
push edi
call esi
test eax, eax
je 0x472756
push 0x4fa480
push edi
call esi
test eax, eax
je 0x47274f
push str.HKEY_USERS
push edi
call esi
test eax, eax
je 0x47274f
push str.HKCC
push edi
call esi
test eax, eax
je 0x472748
push str.HKEY_CURRENT_CONFIG
push edi
call esi
test eax, eax
jne 0x473604
mov ebx, VariantCopy
jmp 0x472769
mov ebx, SysReAllocStringLen
jmp 0x472769
mov ebx, SysReAllocStringLen
jmp 0x472769
mov ebx, SysReAllocStringLen
jmp 0x472769
mov ebx, SysReAllocStringLen
mov ecx, dword [esp + 0x14]
xor edi, edi
cmp word [ecx], di
mov dword [esp + 0x48], ebx
je 0x47344f
mov al, byte [esp + 0x7c]
cmp al, 0x2e
je 0x47278c
cmp al, 0x3f
je 0x47278c
xor ebp, ebp
jmp 0x472791
mov ebp, 1
cmp al, 0x3f
je 0x4727a4
cmp ebp, edi
je 0x47279e
cmp word [ecx], di
je 0x4727a4
mov dword [esp + 0x3c], edi
jmp 0x4727ac
mov dword [esp + 0x3c], 1
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0xca
mov dword [esp + 0x50], edi
call fcn.00449130
add esp, 4
cmp eax, edi
mov dword [esp + 0x80], eax
je 0x4727d2
mov word [eax], di
push 2
call fcn.00449130
add esp, 4
cmp eax, edi
mov dword [esp + 0x34], eax
je 0x4727e7
mov word [eax], di
cmp byte [esp + 0x7c], 0x2e
lea ebx, [esp + 0x34]
je 0x4727f9
lea ebx, [esp + 0x80]
push 0x1001
mov dword [esp + 0x5c], ebx
call fcn.00449130
add esp, 4
test eax, eax
mov dword [esp + 0x2c], eax
je 0x472815
mov byte [eax], 0
mov edi, dword [esp + 0x38]
lea edx, [esp + 0x50]
push edx
mov edx, dword [esp + 0x34]
lea eax, [esp + 0x48]
push eax
mov eax, dword [esp + 0x50]
lea ecx, [esp + 0x34]
push ecx
push edi
push edx
push eax
mov byte [esp + 0x8c], 0xa
mov dword [esp + 0x5c], 0xfff
mov dword [esp + 0x68], 0
call fcn.0044e270
mov esi, eax
add esp, 0x18
test esi, esi
jge 0x472a29
cmp word [edi], 0
mov eax, dword [esp + 0x50]
jne 0x47288e
cmp eax, 2
jne 0x47288e
cmp esi, 0xfffffffe
jne 0x47288e
test ebp, ebp
je 0x473327
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x4fa430
mov ecx, ebx
call fcn.00449560
jmp 0x473327
test eax, eax
mov edi, eax
jne 0x472899
mov edi, 1
test ebp, ebp
mov dword [esp + 0x4c], edi
je 0x472927
movzx ecx, word [0x522010]
push str.ERROR
mov dword [esp + 0x80], ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [ebx]
mov ebp, eax
lea edi, [ebp + 2]
lea eax, [edi + edi + 4]
push edx
call fcn.00449190
mov esi, eax
add esp, 4
test esi, esi
mov dword [ebx], esi
je 0x4728e1
mov word [esi + edi*2 + 2], 0
mov eax, dword [esp + 0x7c]
push edi
push esi
push ebp
push str.ERROR
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
test edi, edi
jge 0x4728fe
xor edi, edi
lea eax, [edi + edi + 4]
push esi
mov word [esi + edi*2], 0
call fcn.00449190
add esp, 4
test eax, eax
mov dword [ebx], eax
je 0x473327
mov word [eax + edi*2 + 2], 0
jmp 0x473327
mov eax, dword [esp + 0x2c]
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
je 0x472944
mov ecx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push ecx
call esi
mov eax, dword [esp + 0x34]
test eax, eax
je 0x47295c
mov edx, eax
mov eax, dword [0x51d3c8]
add edx, 0xfffffff8
push edx
push 0
push eax
call esi
mov eax, dword [esp + 0x80]
test eax, eax
je 0x472978
mov edx, dword [0x51d3c8]
mov ecx, eax
add ecx, 0xfffffff8
push ecx
push 0
push edx
call esi
mov eax, dword [esp + 0x28]
test eax, eax
je 0x47298e
add eax, 0xfffffff8
push eax
mov eax, dword [0x51d3c8]
push 0
push eax
call esi
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4729a5
mov ecx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push ecx
call esi
mov edx, dword [esp + 0x14]
mov eax, dword [0x51d3c8]
add edx, 0xfffffff8
push edx
push 0
push eax
call esi
mov eax, dword [esp + 0x24]
test eax, eax
je 0x4729ce
mov ecx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push ecx
call esi
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4729e5
mov edx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push edx
call esi
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4729fb
add eax, 0xfffffff8
push eax
mov eax, dword [0x51d3c8]
push 0
push eax
call esi
mov eax, dword [esp + 0x60]
test eax, eax
je 0x472a12
mov ecx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push ecx
call esi
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
add esp, 0x68
ret 8
cmp esi, 1
jne 0x472aed
test ebp, ebp
je 0x472abc
movzx edx, word [0x522010]
push str.REG_SZ
mov dword [esp + 0x54], edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebx]
mov ebp, eax
lea edi, [ebp + 2]
lea eax, [edi + edi + 4]
push ecx
call fcn.00449190
mov esi, eax
add esp, 4
test esi, esi
mov dword [ebx], esi
je 0x472a73
mov word [esi + edi*2 + 2], 0
mov edx, dword [esp + 0x50]
push edi
push esi
push ebp
push str.REG_SZ
push 0
push edx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
test edi, edi
jge 0x472a90
xor edi, edi
lea eax, [edi + edi + 4]
push esi
mov word [esi + edi*2], 0
call fcn.00449190
add esp, 4
test eax, eax
mov dword [ebx], eax
je 0x472ab0
mov word [eax + edi*2 + 2], 0
mov eax, dword [esp + 0x3c]
test eax, eax
jne 0x473327
mov al, byte [esp + 0x7c]
cmp al, 0x24
mov edi, dword [esp + 0x80]
je 0x472ad7
cmp al, 0x2e
je 0x472ad7
test al, al
jne 0x472f66
mov edx, dword [esp + 0x2c]
mov eax, edi
mov dword [esp + 0x80], edx
mov dword [esp + 0x2c], eax
jmp 0x473323
cmp esi, 0xb
jne 0x472bb5
test ebp, ebp
je 0x472b80
movzx eax, word [0x522010]
push str.REG_QWORD
mov dword [esp + 0x54], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebx]
mov ebp, eax
lea edi, [ebp + 2]
lea eax, [edi + edi + 4]
push ecx
call fcn.00449190
mov esi, eax
add esp, 4
test esi, esi
mov dword [ebx], esi
je 0x472b37
mov word [esi + edi*2 + 2], 0
mov edx, dword [esp + 0x50]
push edi
push esi
push ebp
push str.REG_QWORD
push 0
push edx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
test edi, edi
jge 0x472b54
xor edi, edi
lea eax, [edi + edi + 4]
push esi
mov word [esi + edi*2], 0
call fcn.00449190
add esp, 4
test eax, eax
mov dword [ebx], eax
je 0x472b74
mov word [eax + edi*2 + 2], 0
mov eax, dword [esp + 0x3c]
test eax, eax
jne 0x473327
mov al, byte [esp + 0x7c]
cmp al, 0x2b
mov edi, dword [esp + 0x80]
je 0x472b97
cmp al, 0x2e
jne 0x472f66
mov eax, dword [esp + 0x2c]
mov edx, dword [eax + 4]
mov eax, dword [eax]
push str.0x_I64x
push edx
push eax
push edi
call fcn.004a4880
add esp, 0x10
jmp 0x473323
cmp esi, 4
jne 0x472d7e
test ebp, ebp
je 0x472c48
movzx ecx, word [0x522010]
push str.REG_DWORD
mov dword [esp + 0x54], ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [ebx]
mov ebp, eax
lea edi, [ebp + 2]
lea eax, [edi + edi + 4]
push edx
call fcn.00449190
mov esi, eax
add esp, 4
test esi, esi
mov dword [ebx], esi
je 0x472bff
mov word [esi + edi*2 + 2], 0
mov eax, dword [esp + 0x50]
push edi
push esi
push ebp
push str.REG_DWORD
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
test edi, edi
jge 0x472c1c
xor edi, edi
lea eax, [edi + edi + 4]
push esi
mov word [esi + edi*2], 0
call fcn.00449190
add esp, 4
test eax, eax
mov dword [ebx], eax
je 0x472c3c
mov word [eax + edi*2 + 2], 0
mov eax, dword [esp + 0x3c]
test eax, eax
jne 0x473327
mov al, byte [esp + 0x7c]
cmp al, 0x23
mov edi, dword [esp + 0x80]
je 0x472d63
cmp al, 0x2e
je 0x472d63
mov eax, dword [esp + 0x2c]
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
je 0x472c80
mov ecx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push ecx
call esi
mov eax, dword [esp + 0x34]
test eax, eax
je 0x472c97
mov edx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push edx
call esi
test edi, edi
je 0x472ca9
mov eax, dword [0x51d3c8]
add edi, 0xfffffff8
push edi
push 0
push eax
call esi
mov eax, dword [esp + 0x28]
test eax, eax
je 0x472cc0
mov ecx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push ecx
call esi
mov eax, dword [esp + 0x20]
test eax, eax
je 0x472cd7
mov edx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push edx
call esi
mov eax, dword [esp + 0x14]
mov ecx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push ecx
call esi
mov eax, dword [esp + 0x24]
test eax, eax
je 0x472d01
mov edx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push edx
call esi
mov eax, dword [esp + 0x18]
test eax, eax
je 0x472d17
add eax, 0xfffffff8
push eax
mov eax, dword [0x51d3c8]
push 0
push eax
call esi
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x472d2e
mov ecx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push ecx
call esi
mov eax, dword [esp + 0x60]
test eax, eax
je 0x473046
mov edx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push edx
call esi
pop edi
pop esi
pop ebp
mov eax, 0x80070057
pop ebx
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
add esp, 0x68
ret 8
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax]
push ecx
push str.0x_x
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x473323
cmp esi, 3
jne 0x472eb8
test ebp, ebp
je 0x472e11
movzx edx, word [0x522010]
push str.REG_BINARY
mov dword [esp + 0x54], edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebx]
mov ebp, eax
lea edi, [ebp + 2]
lea eax, [edi + edi + 4]
push ecx
call fcn.00449190
mov esi, eax
add esp, 4
test esi, esi
mov dword [ebx], esi
je 0x472dc8
mov word [esi + edi*2 + 2], 0
mov edx, dword [esp + 0x50]
push edi
push esi
push ebp
push str.REG_BINARY
push 0
push edx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
test edi, edi
jge 0x472de5
xor edi, edi
lea eax, [edi + edi + 4]
push esi
mov word [esi + edi*2], 0
call fcn.00449190
add esp, 4
test eax, eax
mov dword [ebx], eax
je 0x472e05
mov word [eax + edi*2 + 2], 0
mov eax, dword [esp + 0x3c]
test eax, eax
jne 0x473327
mov al, byte [esp + 0x7c]
cmp al, 0x40
mov edi, dword [esp + 0x80]
je 0x472e28
cmp al, 0x2e
jne 0x472f66
mov eax, dword [esp + 0x44]
lea esi, [eax + eax*4 + 6]
lea eax, [esi + esi + 2]
push edi
call fcn.00449190
add esp, 4
test eax, eax
mov dword [esp + 0x80], eax
je 0x472e4e
mov word [eax + esi*2], 0
mov eax, dword [esp + 0x80]
mov esi, dword [esp + 0x2c]
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
mov word [eax], 0
mov ecx, dword [esp + 0x44]
test ecx, ecx
jle 0x472e7c
movzx ecx, byte [esi]
push ecx
push str.0x_02X
push eax
call ebx
add esp, 0xc
inc esi
mov ebp, dword [esp + 0x80]
mov eax, dword [esp + 0x44]
mov edi, 1
add ebp, 8
cmp eax, edi
jle 0x473323
movzx eax, byte [esi]
push eax
push str._0x_02X
push ebp
call ebx
mov eax, dword [esp + 0x50]
add esp, 0xc
inc esi
inc edi
add ebp, 0xa
cmp edi, eax
jl 0x472e97
jmp 0x473323
cmp esi, 2
jne 0x4730c8
test ebp, ebp
je 0x472f4b
movzx edx, word [0x522010]
push str.REG_EXPAND_SZ
mov dword [esp + 0x54], edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebx]
mov ebp, eax
lea edi, [ebp + 2]
lea eax, [edi + edi + 4]
push ecx
call fcn.00449190
mov esi, eax
add esp, 4
test esi, esi
mov dword [ebx], esi
je 0x472f02
mov word [esi + edi*2 + 2], 0
mov edx, dword [esp + 0x50]
push edi
push esi
push ebp
push str.REG_EXPAND_SZ
push 0
push edx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
test edi, edi
jge 0x472f1f
xor edi, edi
lea eax, [edi + edi + 4]
push esi
mov word [esi + edi*2], 0
call fcn.00449190
add esp, 4
test eax, eax
mov dword [ebx], eax
je 0x472f3f
mov word [eax + edi*2 + 2], 0
mov eax, dword [esp + 0x3c]
test eax, eax
jne 0x473327
mov al, byte [esp + 0x7c]
cmp al, 0x7e
mov edi, dword [esp + 0x80]
je 0x473060
cmp al, 0x2e
je 0x473060
mov eax, dword [esp + 0x2c]
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
je 0x472f82
add eax, 0xfffffff8
push eax
mov eax, dword [0x51d3c8]
push 0
push eax
call esi
mov eax, dword [esp + 0x34]
test eax, eax
je 0x472f99
mov ecx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push ecx
call esi
test edi, edi
je 0x472fac
mov edx, dword [0x51d3c8]
add edi, 0xfffffff8
push edi
push 0
push edx
call esi
mov eax, dword [esp + 0x28]
test eax, eax
je 0x472fc2
add eax, 0xfffffff8
push eax
mov eax, dword [0x51d3c8]
push 0
push eax
call esi
mov eax, dword [esp + 0x20]
test eax, eax
je 0x472fd9
mov ecx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push ecx
call esi
mov edx, dword [esp + 0x14]
mov eax, dword [0x51d3c8]
add edx, 0xfffffff8
push edx
push 0
push eax
call esi
mov eax, dword [esp + 0x24]
test eax, eax
je 0x473002
mov ecx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push ecx
call esi
mov eax, dword [esp + 0x18]
test eax, eax
je 0x473019
mov edx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push edx
call esi
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x47302f
add eax, 0xfffffff8
push eax
mov eax, dword [0x51d3c8]
push 0
push eax
call esi
mov eax, dword [esp + 0x60]
test eax, eax
je 0x473046
mov ecx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push ecx
call esi
pop edi
pop esi
pop ebp
mov eax, 0x80070057
pop ebx
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
add esp, 0x68
ret 8
mov al, byte [esp + 0x10]
test al, al
je 0x4730b2
mov ecx, dword [esp + 0x40]
mov al, byte [ecx + 0x8e]
test al, al
jne 0x473097
test byte [ecx + 0xb], 0xf
jne 0x473097
mov eax, dword [esp + 0x2c]
push 1
push 0
lea edx, [esp + 0x88]
push edx
push eax
call fcn.004541d0
jmp 0x473323
mov eax, dword [esp + 0x2c]
push 1
push 0
lea edx, [esp + 0x88]
push edx
push eax
call fcn.00452ca0
jmp 0x473323
mov ecx, dword [esp + 0x2c]
mov eax, edi
mov dword [esp + 0x80], ecx
mov dword [esp + 0x2c], eax
jmp 0x473323
cmp esi, 7
jne 0x4732d8
test ebp, ebp
je 0x4730f1
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_MULTI_SZ
mov ecx, ebx
call fcn.00449560
mov eax, dword [esp + 0x3c]
test eax, eax
jne 0x473327
mov al, byte [esp + 0x7c]
cmp al, 0x2a
je 0x473206
cmp al, 0x2e
je 0x473206
mov eax, dword [esp + 0x2c]
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
je 0x473122
mov edx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push edx
call esi
mov eax, dword [esp + 0x34]
test eax, eax
je 0x473138
add eax, 0xfffffff8
push eax
mov eax, dword [0x51d3c8]
push 0
push eax
call esi
mov eax, dword [esp + 0x80]
test eax, eax
je 0x473152
mov ecx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push ecx
call esi
mov eax, dword [esp + 0x28]
test eax, eax
je 0x473169
mov edx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push edx
call esi
mov eax, dword [esp + 0x20]
test eax, eax
je 0x47317f
add eax, 0xfffffff8
push eax
mov eax, dword [0x51d3c8]
push 0
push eax
call esi
mov ecx, dword [esp + 0x14]
mov edx, dword [0x51d3c8]
add ecx, 0xfffffff8
push ecx
push 0
push edx
call esi
mov eax, dword [esp + 0x24]
test eax, eax
je 0x4731a8
add eax, 0xfffffff8
push eax
mov eax, dword [0x51d3c8]
push 0
push eax
call esi
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4731bf
mov ecx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push ecx
call esi
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4731d6
mov edx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push edx
call esi
mov eax, dword [esp + 0x60]
test eax, eax
je 0x4731ec
add eax, 0xfffffff8
push eax
mov eax, dword [0x51d3c8]
push 0
push eax
call esi
pop edi
pop esi
pop ebp
mov eax, 0x80070057
pop ebx
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
add esp, 0x68
ret 8
mov esi, dword [esp + 0x44]
mov ecx, dword [esp + 0x80]
shr esi, 1
lea edi, [esi*4 + 6]
lea eax, [edi + edi + 2]
push ecx
call fcn.00449190
add esp, 4
test eax, eax
mov dword [esp + 0x80], eax
je 0x473238
mov word [eax + edi*2], 0
mov ecx, dword [esp + 0x2c]
lea esi, [ecx + esi*2]
cmp ecx, esi
jae 0x4732d1
mov bl, byte [esp + 0x10]
cmp bl, 0x2a
jne 0x473285
cmp word [ecx], 0x5c
jne 0x473285
mov dx, word [ecx + 2]
cmp dx, 0x30
je 0x47326b
cmp dx, 0x5c
je 0x47326b
test dx, dx
jne 0x473285
mov word [eax], 0x5c
mov dx, word [ecx + 2]
add ecx, 2
add eax, 2
mov word [eax], dx
add eax, 2
add ecx, 2
jmp 0x4732c9
mov dx, word [ecx]
test dx, dx
je 0x473298
mov word [eax], dx
add eax, 2
add ecx, 2
jmp 0x4732c9
add ecx, 2
cmp bl, 0x24
jne 0x4732b9
cmp ecx, esi
jae 0x4732d1
cmp word [ecx], 0
je 0x4732d1
mov word [eax], 0xd
add eax, 2
mov word [eax], 0xa
jmp 0x4732c6
mov word [eax], 0x5c
add eax, 2
mov word [eax], 0x30
add eax, 2
cmp ecx, esi
jb 0x473247
mov word [eax], 0
jmp 0x473323
test ebp, ebp
je 0x473310
mov eax, dword [ebx]
push eax
mov eax, 0x66
call fcn.00449190
add esp, 4
test eax, eax
mov dword [ebx], eax
je 0x4732f8
mov word [eax + 0x64], 0
push esi
push 0x4f93cc
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [esp + 0x48]
add esp, 0xc
test eax, eax
jne 0x473327
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x47331f
mov eax, 1
mov dword [esp + 0x4c], eax
mov ebx, dword [esp + 0x58]
mov ebp, dword [esp + 0x14]
cmp word [ebp], 0
je 0x473344
mov ecx, dword [esp + 0x80]
push ecx
mov ecx, dword [esp + 0x44]
push ebp
call fcn.00448be0
mov edi, dword [esp + 0x28]
cmp word [edi], 0
je 0x47335b
mov edx, dword [ebx]
mov ecx, dword [esp + 0x40]
push edx
push edi
call fcn.00448be0
mov eax, dword [esp + 0x2c]
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
je 0x473377
add eax, 0xfffffff8
push eax
mov eax, dword [0x51d3c8]
push 0
push eax
call esi
mov eax, dword [esp + 0x34]
test eax, eax
je 0x47338e
mov ecx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push ecx
call esi
mov eax, dword [esp + 0x80]
test eax, eax
je 0x4733a8
mov edx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push edx
call esi
mov eax, dword [0x51d3c8]
add edi, 0xfffffff8
push edi
push 0
push eax
call esi
mov eax, dword [esp + 0x20]
test eax, eax
je 0x4733cd
mov ecx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push ecx
call esi
mov edx, dword [0x51d3c8]
add ebp, 0xfffffff8
push ebp
push 0
push edx
call esi
mov eax, dword [esp + 0x24]
test eax, eax
je 0x4733f2
add eax, 0xfffffff8
push eax
mov eax, dword [0x51d3c8]
push 0
push eax
call esi
mov eax, dword [esp + 0x18]
test eax, eax
je 0x473409
mov ecx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push ecx
call esi
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x473420
mov edx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push edx
call esi
mov eax, dword [esp + 0x60]
test eax, eax
je 0x473436
add eax, 0xfffffff8
push eax
mov eax, dword [0x51d3c8]
push 0
push eax
call esi
mov eax, dword [esp + 0x4c]
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
add esp, 0x68
ret 8
mov ebp, dword [esp + 0x2c]
cmp ebp, edi
je 0x473d4d
mov al, byte [esp + 0x7c]
cmp al, 0x2b
je 0x473480
test al, al
jne 0x473572
mov ax, word [ebp]
cmp ax, 0x2b
jne 0x4735b5
add ebp, 2
mov dword [esp + 0x2c], ebp
mov al, byte [esp + 0x11]
test al, al
mov dword [esp + 0x58], edi
mov dword [esp + 0x5c], edi
je 0x473c80
xor eax, eax
mov ax, word [ebp]
cmp ax, 0x30
jb 0x4734aa
cmp ax, 0x39
jbe 0x473b98
mov ecx, eax
or ecx, 0x20
cmp cx, 0x61
jb 0x4734bf
cmp cx, 0x66
jbe 0x473b98
mov eax, dword [esp + 0x28]
cmp eax, edi
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
je 0x4734da
add eax, 0xfffffff8
push eax
mov eax, dword [0x51d3c8]
push edi
push eax
call esi
mov eax, dword [esp + 0x20]
cmp eax, edi
je 0x4734f0
mov ecx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push edi
push ecx
call esi
mov edx, dword [esp + 0x14]
mov eax, dword [0x51d3c8]
add edx, 0xfffffff8
push edx
push edi
push eax
call esi
mov eax, dword [esp + 0x24]
cmp eax, edi
je 0x473517
mov ecx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push edi
push ecx
call esi
mov eax, dword [esp + 0x18]
cmp eax, edi
je 0x47352d
mov edx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push edi
push edx
call esi
mov eax, dword [esp + 0x1c]
cmp eax, edi
je 0x473542
add eax, 0xfffffff8
push eax
mov eax, dword [0x51d3c8]
push edi
push eax
call esi
mov eax, dword [esp + 0x60]
cmp eax, edi
je 0x473558
mov ecx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push edi
push ecx
call esi
pop edi
pop esi
pop ebp
mov eax, 0x80070057
pop ebx
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
add esp, 0x68
ret 8
cmp al, 0x23
je 0x4735c6
cmp al, 0x40
je 0x47366e
cmp al, 0x2a
je 0x473725
cmp al, 0x7e
je 0x4738c3
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x30]
shl eax, 1
push eax
push ebp
push 1
push ecx
push edx
push ebx
call fcn.00444820
add esp, 0x18
mov esi, eax
jmp 0x47394e
cmp ax, 0x23
jne 0x47365d
add ebp, 2
mov dword [esp + 0x2c], ebp
mov al, byte [esp + 0x11]
test al, al
mov dword [esp + 0x80], edi
je 0x473b25
xor eax, eax
mov ax, word [ebp]
cmp ax, 0x30
jb 0x4735ef
cmp ax, 0x39
jbe 0x473aed
mov ecx, eax
or ecx, 0x20
cmp cx, 0x61
jb 0x473604
cmp cx, 0x66
jbe 0x473aed
lea ecx, [esp + 0x28]
call fcn.00443880
lea ecx, [esp + 0x20]
call fcn.00443880
lea ecx, [esp + 0x14]
call fcn.00443880
lea ecx, [esp + 0x24]
call fcn.00443880
lea ecx, [esp + 0x18]
call fcn.00443880
lea ecx, [esp + 0x1c]
call fcn.00443880
lea ecx, [esp + 0x60]
call fcn.00443880
pop edi
pop esi
pop ebp
mov eax, 0x80070057
pop ebx
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
add esp, 0x68
ret 8
cmp ax, 0x40
jne 0x473714
add ebp, 2
mov dword [esp + 0x2c], ebp
mov ecx, dword [esp + 0x2c]
push ecx
xor esi, esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebp, eax
push ebp
lea ecx, [esp + 0x84]
call fcn.004492b0
lea edx, [esp + 0x2c]
push edx
mov byte [esp + 0x78], 0xb
call fcn.00443850
mov edi, dword [esp + 0x84]
add esp, 4
test ebp, ebp
jle 0x473a10
jmp 0x4736b0
mov ecx, dword [esp + 0x2c]
mov ax, word [ecx]
test ax, ax
je 0x473a10
xor edx, edx
mov dword [esp + 0x58], edx
mov dword [esp + 0x5c], edx
mov dl, byte [esp + 0x11]
test dl, dl
je 0x4739dd
cmp ax, 0x30
jne 0x4736f1
mov ax, word [ecx + 2]
or ax, 0x20
cmp ax, 0x78
jne 0x4736f1
add ecx, 4
mov dword [esp + 0x2c], ecx
push 2
lea ecx, [esp + 0x5c]
push ecx
lea edx, [esp + 0x34]
push edx
call fcn.0044a4b0
lea eax, [esp + 0x38]
push eax
call fcn.00443850
add esp, 0x10
jmp 0x473a00
cmp ax, 0x2a
jne 0x4738b6
add ebp, 2
mov dword [esp + 0x2c], ebp
mov ebp, dword [esp + 0x2c]
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
lea edx, [edi + 0x10]
push edx
lea ecx, [esp + 0x84]
xor esi, esi
call fcn.004494b0
mov ebx, dword [esp + 0x80]
lea edi, [ebp + edi*2]
cmp ebp, edi
mov byte [esp + 0x74], 0xc
mov edx, ebx
mov eax, ebp
jae 0x4737a3
mov ebp, 0xa
mov cl, byte [esp + 0x10]
cmp cl, 0x2a
mov word [edx], 0
jne 0x473992
cmp word [eax], 0x5c
jne 0x4739b4
cmp word [eax + 2], 0x5c
jne 0x4739b4
mov cx, word [eax + 2]
add eax, 2
mov word [edx], cx
add eax, 2
add edx, 2
xor esi, esi
cmp eax, edi
jb 0x473761
cmp esi, 2
jge 0x4737be
mov ebp, 2
sub ebp, esi
xor eax, eax
mov ecx, ebp
shr ecx, 1
mov edi, edx
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
add esi, ebp
lea edx, [edx + ebp*2]
mov ecx, dword [esp + 0x38]
mov eax, 2
sub eax, esi
lea eax, [edx + eax*2]
mov edx, dword [esp + 0x30]
mov word [eax], 0
sub eax, ebx
push eax
mov eax, dword [esp + 0x4c]
push ebx
push 7
push ecx
push edx
push eax
call fcn.00444820
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
add esp, 0x18
test ebx, ebx
mov edi, eax
je 0x473805
mov ecx, dword [0x51d3c8]
add ebx, 0xfffffff8
push ebx
push 0
push ecx
call esi
mov eax, dword [esp + 0x28]
test eax, eax
je 0x47381c
mov edx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push edx
call esi
mov eax, dword [esp + 0x20]
test eax, eax
je 0x473832
add eax, 0xfffffff8
push eax
mov eax, dword [0x51d3c8]
push 0
push eax
call esi
mov ecx, dword [esp + 0x14]
mov edx, dword [0x51d3c8]
add ecx, 0xfffffff8
push ecx
push 0
push edx
call esi
mov eax, dword [esp + 0x24]
test eax, eax
je 0x47385b
add eax, 0xfffffff8
push eax
mov eax, dword [0x51d3c8]
push 0
push eax
call esi
mov eax, dword [esp + 0x18]
test eax, eax
je 0x473872
mov ecx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push ecx
call esi
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x473889
mov edx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push edx
call esi
mov eax, dword [esp + 0x60]
test eax, eax
je 0x47389f
add eax, 0xfffffff8
push eax
mov eax, dword [0x51d3c8]
push 0
push eax
call esi
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
add esp, 0x68
ret 8
cmp ax, 0x7e
jne 0x47358e
add ebp, 2
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
push eax
lea ecx, [esp + 0x84]
call fcn.004494b0
cmp word [ebp], di
mov esi, dword [esp + 0x80]
mov byte [esp + 0x74], 0xd
mov ecx, ebp
mov eax, esi
je 0x47391e
mov edi, 0x30
mov dx, word [ecx]
cmp dx, 0x5c
jne 0x47390f
cmp word [ecx + 2], di
jne 0x47390f
mov word [eax], 0
add eax, 2
add ecx, 4
jmp 0x473918
mov word [eax], dx
add eax, 2
add ecx, 2
cmp word [ecx], 0
jne 0x4738f3
mov ecx, dword [esp + 0x30]
mov word [eax], 0
sub eax, esi
sar eax, 1
shl eax, 1
push eax
mov eax, dword [esp + 0x3c]
push esi
push 2
push eax
push ecx
push ebx
call fcn.00444820
add esp, 0x18
lea ecx, [esp + 0x80]
mov esi, eax
call fcn.00443880
lea ecx, [esp + 0x28]
call fcn.00443880
lea ecx, [esp + 0x20]
call fcn.00443880
lea ecx, [esp + 0x14]
call fcn.00443880
lea ecx, [esp + 0x24]
call fcn.00443880
lea ecx, [esp + 0x18]
call fcn.00443880
lea ecx, [esp + 0x1c]
call fcn.00443880
lea ecx, [esp + 0x60]
call fcn.00443880
jmp 0x473e85
cmp cl, 0x24
jne 0x4739b4
cmp word [eax], 0xd
jne 0x4739b4
cmp word [eax + 2], bp
jne 0x4739b4
mov word [edx], 0
add eax, 4
add edx, 2
inc esi
jmp 0x47379a
mov cx, word [eax]
cmp cx, 0x5c
jne 0x47378f
cmp word [eax + 2], 0x30
jne 0x47378f
mov word [edx], 0
add edx, 2
add eax, 4
inc esi
jmp 0x47379a
lea ecx, [esp + 0x58]
push ecx
lea edx, [esp + 0x30]
push edx
call fcn.0044cd70
add esp, 8
test eax, eax
jle 0x473a00
lea eax, [esp + 0x2c]
push eax
call fcn.00443850
add esp, 4
mov cl, byte [esp + 0x58]
mov byte [edi + esi], cl
inc esi
cmp esi, ebp
jl 0x4736b0
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
push esi
push edi
push 3
push edx
push eax
push ebx
call fcn.00444820
add esp, 0x18
test edi, edi
mov esi, eax
je 0x473a44
mov ecx, dword [0x51d3c8]
add edi, 0xfffffff8
push edi
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
push 0
push ecx
call edi
jmp 0x473a4a
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x28]
test eax, eax
je 0x473a61
mov edx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push edx
call edi
mov eax, dword [esp + 0x20]
test eax, eax
je 0x473a77
add eax, 0xfffffff8
push eax
mov eax, dword [0x51d3c8]
push 0
push eax
call edi
mov ecx, dword [esp + 0x14]
mov edx, dword [0x51d3c8]
add ecx, 0xfffffff8
push ecx
push 0
push edx
call edi
mov eax, dword [esp + 0x24]
test eax, eax
je 0x473aa0
add eax, 0xfffffff8
push eax
mov eax, dword [0x51d3c8]
push 0
push eax
call edi
mov eax, dword [esp + 0x18]
test eax, eax
je 0x473ab7
mov ecx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push ecx
call edi
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x473ace
mov edx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push 0
push edx
call edi
mov eax, dword [esp + 0x60]
test eax, eax
je 0x473e85
add eax, 0xfffffff8
push eax
mov eax, dword [0x51d3c8]
push 0
push eax
call edi
jmp 0x473e85
cmp ax, 0x30
jne 0x473b04
mov cx, word [ebp + 2]
or cx, 0x20
cmp cx, 0x78
jne 0x473b04
add ebp, 4
push ebp
call fcn.0044a3f0
add esp, 4
mov dword [esp + 0x80], eax
push 4
lea ecx, [esp + 0x84]
push ecx
push 4
jmp 0x473bc9
lea edx, [esp + 0x80]
push edx
lea eax, [esp + 0x30]
push eax
call fcn.0044ce90
add esp, 8
cmp eax, 1
jge 0x473b14
lea ecx, [esp + 0x28]
call fcn.00443880
lea ecx, [esp + 0x20]
call fcn.00443880
lea ecx, [esp + 0x14]
call fcn.00443880
lea ecx, [esp + 0x24]
call fcn.00443880
lea ecx, [esp + 0x18]
call fcn.00443880
lea ecx, [esp + 0x1c]
call fcn.00443880
lea ecx, [esp + 0x60]
call fcn.00443880
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
add esp, 0x68
ret 8
cmp ax, 0x30
jne 0x473baf
mov dx, word [ebp + 2]
or dx, 0x20
cmp dx, 0x78
jne 0x473baf
add ebp, 4
push ebp
call fcn.0044a3f0
add esp, 4
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], edx
push 8
lea ecx, [esp + 0x5c]
push ecx
push 0xb
mov edx, dword [esp + 0x44]
mov eax, dword [esp + 0x3c]
push edx
push eax
push ebx
call fcn.00444820
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, eax
mov eax, dword [esp + 0x40]
add esp, 0x18
cmp eax, edi
je 0x473bfa
mov ecx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push edi
push ecx
call ebx
mov eax, dword [esp + 0x20]
cmp eax, edi
je 0x473c10
mov edx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push edi
push edx
call ebx
mov eax, dword [esp + 0x14]
mov ecx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push edi
push ecx
call ebx
mov eax, dword [esp + 0x24]
cmp eax, edi
je 0x473c38
mov edx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push edi
push edx
call ebx
mov eax, dword [esp + 0x18]
cmp eax, edi
je 0x473c4d
add eax, 0xfffffff8
push eax
mov eax, dword [0x51d3c8]
push edi
push eax
call ebx
mov eax, dword [esp + 0x1c]
cmp eax, edi
je 0x473c63
mov ecx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push edi
push ecx
call ebx
mov eax, dword [esp + 0x60]
cmp eax, edi
je 0x473e85
mov edx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push edi
push edx
jmp 0x473e83
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x30]
push ecx
call fcn.0044cd70
add esp, 8
test eax, eax
jg 0x473bc0
mov eax, dword [esp + 0x28]
cmp eax, edi
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
je 0x473cb6
mov edx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push edi
push edx
call esi
mov eax, dword [esp + 0x20]
cmp eax, edi
je 0x473ccb
add eax, 0xfffffff8
push eax
mov eax, dword [0x51d3c8]
push edi
push eax
call esi
mov ecx, dword [esp + 0x14]
mov edx, dword [0x51d3c8]
add ecx, 0xfffffff8
push ecx
push edi
push edx
call esi
mov eax, dword [esp + 0x24]
cmp eax, edi
je 0x473cf2
add eax, 0xfffffff8
push eax
mov eax, dword [0x51d3c8]
push edi
push eax
call esi
mov eax, dword [esp + 0x18]
cmp eax, edi
je 0x473d08
mov ecx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push edi
push ecx
call esi
mov eax, dword [esp + 0x1c]
cmp eax, edi
je 0x473d1e
mov edx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push edi
push edx
call esi
mov eax, dword [esp + 0x60]
cmp eax, edi
je 0x473d33
add eax, 0xfffffff8
push eax
mov eax, dword [0x51d3c8]
push edi
push eax
call esi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x5c]
mov dword fs:[0], ecx
add esp, 0x68
ret 8
cmp byte [esp + 0x13], 0x21
jne 0x473d86
mov eax, dword [esp + 0x38]
cmp word [eax], di
jne 0x473d86
mov eax, dword [esp + 0x34]
cmp eax, edi
je 0x473d76
mov ecx, dword [esp + 0x30]
push eax
push ecx
push ebx
call fcn.0044b780
jmp 0x473de0
mov edx, dword [esp + 0x30]
push edx
push ebx
call fcn.00457fe0
add esp, 8
jmp 0x473de3
cmp dword [esp + 0x34], edi
je 0x473dd0
movzx ecx, word [0x51c734]
mov edx, dword [esp + 0x30]
push edi
lea eax, [esp + 0x84]
push eax
push edi
or ecx, 0x2001b
push ecx
push edi
push edi
push edi
push edx
push ebx
mov dword [esp + 0xa4], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
mov eax, dword [esp + 0x80]
cmp eax, edi
je 0x473de5
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x473de5
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x30]
push eax
push ecx
push ebx
call fcn.004448c0
add esp, 0xc
mov esi, eax
cmp esi, 2
jne 0x473dec
xor esi, esi
mov eax, dword [esp + 0x28]
cmp eax, edi
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
je 0x473e08
mov edx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push edi
push edx
call ebx
mov eax, dword [esp + 0x20]
cmp eax, edi
je 0x473e1d
add eax, 0xfffffff8
push eax
mov eax, dword [0x51d3c8]
push edi
push eax
call ebx
mov ecx, dword [esp + 0x14]
mov edx, dword [0x51d3c8]
add ecx, 0xfffffff8
push ecx
push edi
push edx
call ebx
mov eax, dword [esp + 0x24]
cmp eax, edi
je 0x473e44
add eax, 0xfffffff8
push eax
mov eax, dword [0x51d3c8]
push edi
push eax
call ebx
mov eax, dword [esp + 0x18]
cmp eax, edi
je 0x473e5a
mov ecx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push edi
push ecx
call ebx
mov eax, dword [esp + 0x1c]
cmp eax, edi
je 0x473e70
mov edx, dword [0x51d3c8]
add eax, 0xfffffff8
push eax
push edi
push edx
call ebx
mov eax, dword [esp + 0x60]
cmp eax, edi
je 0x473e85
add eax, 0xfffffff8
push eax
mov eax, dword [0x51d3c8]
push edi
push eax
call ebx
mov ecx, dword [esp + 0x6c]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x68
ret 8