Function at 0x4ec7e0
Capabilities:
Set registry value
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5d0625
push eax
mov dword fs:[0], esp
sub esp, 0xc0
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x4edaf8
push edi
mov ecx, esi
call fcn.004e98d0
cmp dword [ebp + 0x1c], 1
mov edi, dword [ebp + 8]
mov dword [ebp - 0x10], edi
jne 0x4ec832
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4ec823
sub ecx, edx
lea eax, [ecx + edi]
mov dword [ebp - 0x10], eax
push 0x64
lea eax, [ebp - 0xcc]
mov dword [ebp - 0x24], 0
push 0
push eax
call fcn.005889a0
mov edx, dword [esi + 0x64]
add esp, 0xc
cmp byte [esi + 0x60], 0
je 0x4ec87b
test edx, edx
jle 0x4ec8a2
mov ax, word [0x622d98]
nop
lea edi, [ebp - 0xcc]
dec edi
mov cl, byte [edi + 1]
lea edi, [edi + 1]
test cl, cl
jne 0x4ec867
mov word [edi], ax
sub edx, 1
jne 0x4ec860
jmp 0x4ec8a2
test edx, edx
jle 0x4ec8a2
mov ax, word [0x5e8658]
lea edi, [ebp - 0xcc]
dec edi
nop dword [eax]
mov cl, byte [edi + 1]
lea edi, [edi + 1]
test cl, cl
jne 0x4ec890
mov word [edi], ax
sub edx, 1
jne 0x4ec885
push dword [ebp + 0x18]
mov ecx, esi
push 0
call fcn.004eb980
mov edi, dword [ebp + 0x10]
lea esi, [edi + 0x64]
add esi, eax
mov eax, 1
cmove esi, eax
push esi
call fcn.005021d8
push esi
push 0
push eax
mov dword [ebp - 0x30], eax
call fcn.005889a0
add esp, 0x10
mov dword [ebp - 0x2c], esi
mov dword [ebp - 4], 0
test edi, edi
jle 0x4ec91c
mov dword [ebp - 0x18], edi
lea edx, [ebp - 0xcc]
mov esi, edx
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x4ec8f0
mov edi, dword [ebp - 0x30]
sub edx, esi
dec edi
nop dword [eax]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4ec900
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
sub dword [ebp - 0x18], 1
rep movsb byte es:[edi], byte [esi]
jne 0x4ec8e4
mov esi, dword [ebp - 0x30]
lea edi, [esi - 1]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x4ec922
mov ax, word [0x6245f8]
mov ecx, esi
mov word [edi], ax
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4ec940
mov edi, dword [ebp + 0x18]
sub ecx, edx
push edi
lea eax, [esi + ecx]
mov esi, dword [ebp + 0xc]
push eax
mov ecx, esi
call fcn.004eb980
mov eax, dword [ebp + 0x1c]
cmp eax, 1
jne 0x4ec984
push dword [ebp - 0x30]
mov esi, dword [ebp - 0x10]
push 0x61956c
push esi
call fcn.0040e160
add esp, 0xc
add esi, eax
mov dword [ebp - 0x10], esi
mov esi, dword [ebp + 0xc]
jmp 0x4eca1c
cmp eax, 2
jne 0x4ec9f7
mov ecx, esi
call fcn.004eb6b0
xor ecx, ecx
test eax, eax
je 0x4ec9a0
push esi
mov ecx, eax
call fcn.004e8f00
mov ecx, eax
push ecx
push 0x5e865c
push dword [ebp - 0x30]
call fcn.0040e160
mov ecx, dword [ebp - 0x30]
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4ec9b7
push edi
mov edi, dword [ebp - 0x30]
sub ecx, edx
lea eax, [edi + ecx]
mov ecx, esi
push eax
call fcn.004eb980
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
lea eax, [ebp - 0x24]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push edi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
jmp 0x4eca1c
push dword [ebp - 0x30]
cmp eax, 3
jne 0x4eca0c
push dword [ebp + 8]
call fcn.004ebbd0
add esp, 8
jmp 0x4eca1c
push 0x61956c
push dword [ebp + 8]
call fcn.0040e130
add esp, 0xc
mov ecx, esi
call fcn.004eb0f0
mov edi, eax
mov ecx, esi
mov dword [ebp - 0x4c], edi
call fcn.004eaa40
mov dword [ebp - 0x58], eax
test edi, edi
je 0x4ecc4f
xor esi, esi
mov dword [ebp - 0x18], esi
test edi, edi
jle 0x4ecc4c
mov ecx, dword [ebp + 0xc]
call fcn.004eabb0
push dword [ebp + 0x18]
push 0
mov edi, dword [eax + esi*4]
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.004ede60
push dword [ebp + 0x18]
mov ecx, edi
mov esi, eax
push 0
call fcn.004eded0
mov edi, eax
add esi, 0xa
mov eax, 1
cmove esi, eax
push esi
call fcn.005021d8
push esi
push 0
push eax
mov dword [ebp - 0x54], eax
call fcn.005889a0
mov dword [ebp - 0x50], esi
lea esi, [edi + 0xa]
mov byte [ebp - 4], 1
test esi, esi
mov eax, 1
cmove esi, eax
push esi
call fcn.005021d8
push esi
push 0
push eax
mov dword [ebp - 0x48], eax
call fcn.005889a0
add esp, 0x20
mov dword [ebp - 0x44], esi
push dword [ebp + 0x18]
mov edi, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x14]
push edi
mov byte [ebp - 4], 2
call fcn.004ede60
push dword [ebp + 0x18]
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x48]
call fcn.004eded0
mov eax, dword [ebp + 0x1c]
cmp eax, 1
jne 0x4ecb0f
mov esi, dword [ebp - 0x10]
push edi
push str.__s
push esi
call fcn.0040e160
push dword [ebp - 0x48]
add esi, eax
push 0x5e8668
push esi
call fcn.0040e160
add esp, 0x18
add esi, eax
mov dword [ebp - 0x10], esi
jmp 0x4ecc27
cmp eax, 2
jne 0x4ecb8d
mov esi, edi
lea ecx, [esi + 1]
nop dword [eax]
mov al, byte [esi]
inc esi
test al, al
jne 0x4ecb20
sub esi, ecx
mov eax, 1
add esi, 0xa
cmove esi, eax
push esi
call fcn.005021d8
push esi
mov esi, eax
mov dword [ebp - 0x14], eax
push 0
push esi
call fcn.005889a0
push edi
push 0x5e8670
push esi
call fcn.0040e160
mov edx, dword [ebp - 0x48]
add esp, 0x1c
mov ecx, edx
lea eax, [ecx + 1]
mov dword [ebp - 0x14], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4ecb62
sub ecx, dword [ebp - 0x14]
lea eax, [ecx + 1]
push eax
push edx
push 1
push 0
push esi
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push esi
call fcn.00501fb5
add esp, 4
jmp 0x4ecc27
cmp eax, 3
jne 0x4ecc07
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4ecb97
sub ecx, edx
mov edx, dword [ebp - 0x48]
lea esi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x4ecba6
sub edx, esi
lea eax, [edx + ecx]
lea esi, [eax*2 + 0x64]
mov eax, 1
test esi, esi
cmove esi, eax
push esi
call fcn.005021d8
push esi
mov edi, eax
push 0
push edi
mov dword [ebp - 0x60], edi
call fcn.005889a0
mov dword [ebp - 0x5c], esi
push dword [ebp - 0x48]
mov eax, dword [ebp - 0x54]
push eax
push str.__s__s_
push edi
mov byte [ebp - 4], 3
call fcn.0040e160
push edi
push dword [ebp + 8]
call fcn.004ebbd0
push edi
call fcn.00501fb5
mov edi, dword [ebp - 0x54]
add esp, 0x2c
jmp 0x4ecc27
mov esi, dword [ebp + 8]
push edi
push str.__s
push esi
call fcn.0040e130
push dword [ebp - 0x48]
push 0x5e8668
push esi
call fcn.0040e130
add esp, 0x18
push dword [ebp - 0x48]
call fcn.00501fb5
push edi
mov byte [ebp - 4], 0
call fcn.00501fb5
mov esi, dword [ebp - 0x18]
add esp, 8
inc esi
mov dword [ebp - 0x18], esi
cmp esi, dword [ebp - 0x4c]
jl 0x4eca47
mov esi, dword [ebp + 0xc]
mov ecx, esi
call fcn.004ea7d0
mov ecx, esi
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x20], 0
call fcn.004ea650
mov ecx, dword [ebp + 0xc]
xor esi, esi
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x28], esi
call fcn.004eaa20
mov edx, eax
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x58], esi
je 0x4ecc8b
test edi, edi
jne 0x4eccf2
test edx, edx
jne 0x4eccf2
cmp dword [ebp - 0x50], esi
jne 0x4eccf2
cmp dword [ebp - 0x38], esi
jne 0x4eccf2
mov eax, dword [ebp + 0x1c]
cmp eax, 1
jne 0x4eccb6
push 0x5e8680
push dword [ebp - 0x10]
call fcn.0040e160
add esp, 8
jmp 0x4edaec
cmp eax, 2
je 0x4edaec
cmp eax, 3
jne 0x4eccdd
push dword [ebp + 8]
push 4
push 1
push str.___r_n
call fcn.0059ce08
add esp, 0x10
jmp 0x4edaec
push 0x5e8680
push dword [ebp + 8]
call fcn.0040e130
add esp, 8
jmp 0x4edaec
mov eax, dword [ebp + 0x1c]
cmp eax, 1
jne 0x4ecd12
push dword [ebp - 0x30]
push 0x5e8694
push dword [ebp - 0x10]
call fcn.0040e160
add esp, 0xc
add dword [ebp - 0x10], eax
jmp 0x4ecd8f
mov ecx, dword [ebp + 0xc]
cmp byte [ecx + 0x68], 0
jne 0x4ecd21
cmp byte [ecx + 0x69], 0
je 0x4ecd5d
cmp edx, 1
jne 0x4ecd5d
cmp dword [ebp - 0x50], esi
jne 0x4ecd5d
cmp dword [ebp - 0x38], esi
jne 0x4ecd5d
cmp dword [ebp - 0x58], esi
jne 0x4ecd5d
cmp eax, 2
je 0x4ecd92
cmp eax, 3
jne 0x4ecd53
push dword [ebp + 8]
push edx
push edx
push 0x5e86a0
call fcn.0059ce08
add esp, 0x10
jmp 0x4ecd8f
push dword [ebp - 0x30]
push 0x6245f4
jmp 0x4ecd84
cmp eax, 2
je 0x4ecd92
cmp eax, 3
jne 0x4ecd7c
push dword [ebp + 8]
push eax
push 1
push 0x5e8698
call fcn.0059ce08
add esp, 0x10
jmp 0x4ecd8f
push dword [ebp - 0x30]
push 0x5e8694
push dword [ebp + 8]
call fcn.0040e130
add esp, 0xc
mov ecx, dword [ebp + 0xc]
test edi, edi
je 0x4ed425
xor edi, edi
mov dword [ebp - 0x44], edi
cmp dword [ebp - 0x58], esi
jle 0x4ed425
mov esi, dword [ebp + 0x10]
inc esi
mov dword [ebp - 0x34], esi
jmp 0x4ecdb4
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x50]
test eax, eax
je 0x4ecfb0
cmp dword [ebp - 0x28], eax
jge 0x4ecfb0
mov esi, dword [ebp - 0x28]
jmp 0x4ecdd3
mov ecx, dword [ebp + 0xc]
call fcn.004ea5a0
mov ecx, dword [eax + esi*4]
call fcn.004eee70
cmp eax, edi
jg 0x4ecfad
mov ecx, dword [ebp + 0xc]
call fcn.004ea5a0
mov ecx, dword [eax + esi*4]
call fcn.004eec10
mov edx, eax
mov dword [ebp - 0x18], eax
lea esi, [edx + 1]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x4ece00
sub edx, esi
mov eax, 1
mov esi, dword [ebp + 0x10]
add esi, 0xc8
add esi, edx
cmove esi, eax
push esi
call fcn.005021d8
push esi
mov edi, eax
push 0
push edi
mov dword [ebp - 0x68], edi
call fcn.005889a0
add esp, 0x10
mov dword [ebp - 0x64], esi
mov eax, dword [ebp - 0x34]
mov byte [ebp - 4], 4
test eax, eax
jle 0x4ece7f
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0xcc]
mov esi, edx
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x4ece50
sub edx, esi
dec edi
nop word [eax + eax]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4ece60
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
sub dword [ebp - 0x14], 1
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 0x68]
jne 0x4ece44
lea ecx, [edi - 1]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x4ece82
mov eax, dword [0x5e8634]
mov edx, dword [ebp - 0x18]
mov esi, edx
mov dword [ecx], eax
mov al, byte [0x5e8638]
mov byte [ecx + 4], al
mov al, byte [edx]
inc edx
test al, al
jne 0x4ecea0
sub edx, esi
dec edi
nop word [eax + eax]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4eceb0
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 0x68]
lea ecx, [edi - 1]
nop dword [eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x4eced0
mov eax, dword [0x5e86a4]
mov dword [ecx], eax
mov ax, word [0x5e86a8]
mov word [ecx + 4], ax
mov eax, dword [ebp + 0x1c]
cmp eax, 1
jne 0x4ecf0f
mov esi, dword [ebp - 0x10]
push edi
push 0x61956c
push esi
call fcn.0040e160
add esp, 0xc
add esi, eax
mov dword [ebp - 0x10], esi
jmp 0x4ecf8d
cmp eax, 2
jne 0x4ecf6a
push 0x14
call fcn.005021d8
push dword [ebp - 0x28]
mov esi, eax
xorps xmm0, xmm0
push 0x5e86ac
push esi
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
call fcn.0040e160
mov ecx, dword [ebp - 0x18]
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4ecf41
sub ecx, edx
lea eax, [ecx + 1]
push eax
push dword [ebp - 0x18]
push 1
push 0
push esi
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push esi
call fcn.00501fb5
add esp, 4
jmp 0x4ecf8d
push edi
cmp eax, 3
jne 0x4ecf7d
push dword [ebp + 8]
call fcn.004ebbd0
add esp, 8
jmp 0x4ecf8d
push 0x61956c
push dword [ebp + 8]
call fcn.0040e130
add esp, 0xc
mov esi, dword [ebp - 0x28]
inc esi
mov byte [ebp - 4], 0
push edi
mov dword [ebp - 0x28], esi
call fcn.00501fb5
mov edi, dword [ebp - 0x44]
add esp, 4
cmp esi, dword [ebp - 0x50]
jl 0x4ecdd0
mov esi, dword [ebp - 0x34]
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x4ed3b3
cmp dword [ebp - 0x1c], eax
jge 0x4ed3b3
mov esi, dword [ebp + 0xc]
mov ecx, esi
call fcn.004ea8a0
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [eax + ecx*4]
call fcn.004ef790
cmp eax, edi
jg 0x4ed1ac
push 0
push 0
mov ecx, esi
call fcn.004ea8a0
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [eax + ecx*4]
call fcn.004ef0f0
mov esi, dword [ebp + 0x10]
add esi, 0xc8
add esi, eax
mov eax, 1
cmove esi, eax
push esi
call fcn.005021d8
push esi
mov edi, eax
push 0
push edi
mov dword [ebp - 0x60], edi
call fcn.005889a0
add esp, 0x10
mov dword [ebp - 0x5c], esi
mov esi, dword [ebp + 0xc]
mov byte [ebp - 4], 5
cmp byte [esi + 0x68], 0
jne 0x4ed074
mov eax, dword [ebp - 0x34]
test eax, eax
jle 0x4ed074
mov dword [ebp - 0x14], eax
nop dword [eax + eax]
lea edx, [ebp - 0xcc]
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x4ed048
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4ed052
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
sub dword [ebp - 0x14], 1
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 0x60]
jne 0x4ed040
mov esi, dword [ebp + 0xc]
mov ecx, edi
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4ed080
push dword [ebp + 0x18]
sub ecx, edx
lea eax, [edi + ecx]
mov ecx, esi
push eax
call fcn.004ea8a0
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [eax + ecx*4]
call fcn.004ef0f0
cmp byte [esi + 0x68], 0
jne 0x4ed0cc
cmp byte [esi + 0x69], 0
jne 0x4ed0cc
lea ecx, [edi - 1]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x4ed0b1
mov ax, word [0x5e86b0]
mov word [ecx], ax
mov al, byte [0x5e86b2]
mov byte [ecx + 2], al
mov eax, dword [ebp + 0x1c]
cmp eax, 1
jne 0x4ed0f3
mov esi, dword [ebp - 0x10]
push edi
push 0x61956c
push esi
call fcn.0040e160
add esp, 0xc
add esi, eax
mov dword [ebp - 0x10], esi
mov esi, dword [ebp + 0xc]
jmp 0x4ed18d
cmp eax, 2
jne 0x4ed16a
push 0x14
call fcn.005021d8
push dword [ebp - 0x1c]
mov esi, eax
xorps xmm0, xmm0
push 0x5e86b4
push esi
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
call fcn.0040e160
mov ecx, dword [ebp + 0xc]
add esp, 0x10
push dword [ebp + 0x18]
push edi
call fcn.004ea8a0
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [eax + ecx*4]
call fcn.004ef0f0
mov ecx, edi
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4ed140
sub ecx, edx
lea eax, [ecx + 1]
push eax
push edi
push 1
push 0
push esi
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push esi
call fcn.00501fb5
mov esi, dword [ebp + 0xc]
add esp, 4
jmp 0x4ed18d
push edi
cmp eax, 3
jne 0x4ed17d
push dword [ebp + 8]
call fcn.004ebbd0
add esp, 8
jmp 0x4ed18d
push 0x61956c
push dword [ebp + 8]
call fcn.0040e130
add esp, 0xc
inc dword [ebp - 0x1c]
push edi
mov byte [ebp - 4], 0
call fcn.00501fb5
mov eax, dword [ebp - 0x4c]
add esp, 4
mov edi, dword [ebp - 0x44]
cmp dword [ebp - 0x1c], eax
jl 0x4ecfc7
mov eax, dword [ebp - 0x38]
test eax, eax
je 0x4ed3b0
cmp dword [ebp - 0x20], eax
jge 0x4ed3b0
mov ecx, esi
call fcn.004ea720
mov ecx, dword [ebp - 0x20]
mov ecx, dword [eax + ecx*4]
call fcn.004efd10
cmp eax, edi
jg 0x4ed3b0
mov ecx, esi
call fcn.004ea720
mov ecx, dword [ebp - 0x20]
mov ecx, dword [eax + ecx*4]
call fcn.004efab0
mov edx, eax
mov dword [ebp - 0x18], eax
lea esi, [edx + 1]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x4ed1f4
sub edx, esi
mov eax, 1
mov esi, dword [ebp + 0x10]
add esi, 0xc8
add esi, edx
cmove esi, eax
push esi
call fcn.005021d8
push esi
mov edi, eax
push 0
push edi
mov dword [ebp - 0x40], edi
call fcn.005889a0
add esp, 0x10
mov dword [ebp - 0x3c], esi
mov eax, dword [ebp - 0x34]
mov byte [ebp - 4], 6
test eax, eax
jle 0x4ed270
mov edx, eax
nop word [eax + eax]
lea eax, [ebp - 0xcc]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4ed248
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4ed252
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 0x40]
sub edx, 1
jne 0x4ed240
lea ecx, [edi - 1]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x4ed273
mov eax, dword [str.___CDATA_]
mov edx, dword [ebp - 0x18]
mov esi, edx
mov dword [ecx], eax
mov eax, dword [0x5e862c]
mov dword [ecx + 4], eax
mov ax, word [0x5e8630]
mov word [ecx + 8], ax
nop dword [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x4ed2a0
sub edx, esi
dec edi
nop word [eax + eax]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4ed2b0
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 0x40]
lea ecx, [edi - 1]
nop dword [eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x4ed2d0
mov eax, dword [str.____r_n]
mov dword [ecx], eax
mov ax, word [0x5e86bc]
mov word [ecx + 4], ax
mov eax, dword [ebp + 0x1c]
cmp eax, 1
jne 0x4ed30f
mov esi, dword [ebp - 0x10]
push edi
push 0x61956c
push esi
call fcn.0040e160
add esp, 0xc
add esi, eax
mov dword [ebp - 0x10], esi
jmp 0x4ed38d
cmp eax, 2
jne 0x4ed36a
push 0x14
call fcn.005021d8
push dword [ebp - 0x20]
mov esi, eax
xorps xmm0, xmm0
push 0x5e86b4
push esi
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
call fcn.0040e160
mov ecx, dword [ebp - 0x18]
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4ed341
sub ecx, edx
lea eax, [ecx + 1]
push eax
push dword [ebp - 0x18]
push 1
push 0
push esi
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push esi
call fcn.00501fb5
add esp, 4
jmp 0x4ed38d
push edi
cmp eax, 3
jne 0x4ed37d
push dword [ebp + 8]
call fcn.004ebbd0
add esp, 8
jmp 0x4ed38d
push 0x61956c
push dword [ebp + 8]
call fcn.0040e130
add esp, 0xc
mov esi, dword [ebp - 0x20]
inc esi
mov byte [ebp - 4], 0
push edi
mov dword [ebp - 0x20], esi
call fcn.00501fb5
mov edi, dword [ebp - 0x44]
add esp, 4
cmp esi, dword [ebp - 0x38]
mov esi, dword [ebp + 0xc]
jl 0x4ed1c0
mov esi, dword [ebp - 0x34]
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0xc]
cmp eax, 2
jne 0x4ed3dc
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push esi
call fcn.004eaa30
mov eax, dword [eax + edi*4]
push eax
push dword [ebp - 0x24]
call fcn.004ec7e0
add esp, 0x18
jmp 0x4ed415
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push esi
call fcn.004eaa30
mov eax, dword [eax + edi*4]
push eax
push dword [ebp + 8]
call fcn.004ec7e0
add esp, 0x18
cmp dword [ebp + 0x1c], 1
jne 0x4ed415
mov ecx, dword [ebp + 8]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4ed404
mov eax, dword [ebp + 8]
sub ecx, edx
add eax, ecx
mov dword [ebp - 0x10], eax
inc edi
mov dword [ebp - 0x44], edi
cmp edi, dword [ebp - 0x58]
jl 0x4ecdb1
mov esi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x50]
test eax, eax
je 0x4ed60a
cmp esi, eax
jge 0x4ed60a
nop dword [eax + eax]
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
call fcn.004ea5a0
mov ecx, dword [eax + esi*4]
call fcn.004eec10
mov edx, eax
mov dword [ebp - 0x18], eax
lea esi, [edx + 1]
nop dword [eax + eax]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x4ed460
sub edx, esi
mov eax, 1
lea esi, [edi + 0xc8]
add esi, edx
cmove esi, eax
push esi
call fcn.005021d8
push esi
mov edi, eax
push 0
push edi
mov dword [ebp - 0x40], edi
call fcn.005889a0
add esp, 0x10
mov dword [ebp - 0x3c], esi
mov eax, dword [ebp + 0x10]
inc eax
mov byte [ebp - 4], 7
test eax, eax
jle 0x4ed4df
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0xcc]
mov esi, edx
nop word [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x4ed4b0
sub edx, esi
dec edi
nop word [eax + eax]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4ed4c0
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
sub dword [ebp - 0x14], 1
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 0x40]
jne 0x4ed4a2
lea ecx, [edi - 1]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x4ed4e2
mov eax, dword [0x5e8634]
mov edx, dword [ebp - 0x18]
mov esi, edx
mov dword [ecx], eax
mov al, byte [0x5e8638]
mov byte [ecx + 4], al
mov al, byte [edx]
inc edx
test al, al
jne 0x4ed500
sub edx, esi
dec edi
nop word [eax + eax]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4ed510
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 0x40]
lea ecx, [edi - 1]
nop dword [eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x4ed530
mov eax, dword [0x5e86a4]
mov dword [ecx], eax
mov ax, word [0x5e86a8]
mov word [ecx + 4], ax
mov eax, dword [ebp + 0x1c]
cmp eax, 1
jne 0x4ed56f
mov esi, dword [ebp - 0x10]
push edi
push 0x61956c
push esi
call fcn.0040e160
add esp, 0xc
add esi, eax
mov dword [ebp - 0x10], esi
jmp 0x4ed5ed
cmp eax, 2
jne 0x4ed5ca
push 0x14
call fcn.005021d8
push dword [ebp - 0x28]
mov esi, eax
xorps xmm0, xmm0
push 0x5e86ac
push esi
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
call fcn.0040e160
mov ecx, dword [ebp - 0x18]
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4ed5a1
sub ecx, edx
lea eax, [ecx + 1]
push eax
push dword [ebp - 0x18]
push 1
push 0
push esi
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push esi
call fcn.00501fb5
add esp, 4
jmp 0x4ed5ed
push edi
cmp eax, 3
jne 0x4ed5dd
push dword [ebp + 8]
call fcn.004ebbd0
add esp, 8
jmp 0x4ed5ed
push 0x61956c
push dword [ebp + 8]
call fcn.0040e130
add esp, 0xc
mov esi, dword [ebp - 0x28]
inc esi
mov byte [ebp - 4], 0
push edi
mov dword [ebp - 0x28], esi
call fcn.00501fb5
add esp, 4
cmp esi, dword [ebp - 0x50]
jl 0x4ed440
mov eax, dword [ebp - 0x38]
test eax, eax
je 0x4ed7fa
mov esi, dword [ebp - 0x20]
cmp esi, eax
jge 0x4ed7fa
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
call fcn.004ea720
mov ecx, dword [eax + esi*4]
call fcn.004efab0
mov edx, eax
mov dword [ebp - 0x18], eax
lea esi, [edx + 1]
nop dword [eax + eax]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x4ed640
sub edx, esi
mov eax, 1
lea esi, [edi + 0xc8]
add esi, edx
cmove esi, eax
push esi
call fcn.005021d8
push esi
mov edi, eax
push 0
push edi
mov dword [ebp - 0x40], edi
call fcn.005889a0
add esp, 0x10
mov dword [ebp - 0x3c], esi
mov eax, dword [ebp + 0x10]
inc eax
mov byte [ebp - 4], 8
test eax, eax
jle 0x4ed6bf
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0xcc]
mov esi, edx
nop word [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x4ed690
sub edx, esi
dec edi
nop word [eax + eax]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4ed6a0
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
sub dword [ebp - 0x14], 1
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 0x40]
jne 0x4ed682
lea ecx, [edi - 1]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x4ed6c2
mov eax, dword [str.___CDATA_]
mov edx, dword [ebp - 0x18]
mov esi, edx
mov dword [ecx], eax
mov eax, dword [0x5e862c]
mov dword [ecx + 4], eax
mov ax, word [0x5e8630]
mov word [ecx + 8], ax
nop word [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x4ed6f0
sub edx, esi
dec edi
nop word [eax + eax]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4ed700
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 0x40]
lea ecx, [edi - 1]
nop dword [eax]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x4ed720
mov eax, dword [str.____r_n]
mov dword [ecx], eax
mov ax, word [0x5e86bc]
mov word [ecx + 4], ax
mov eax, dword [ebp + 0x1c]
cmp eax, 1
jne 0x4ed75f
mov esi, dword [ebp - 0x10]
push edi
push 0x61956c
push esi
call fcn.0040e160
add esp, 0xc
add esi, eax
mov dword [ebp - 0x10], esi
jmp 0x4ed7dd
cmp eax, 2
jne 0x4ed7ba
push 0x14
call fcn.005021d8
push dword [ebp - 0x20]
mov esi, eax
xorps xmm0, xmm0
push 0x5e86b4
push esi
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
call fcn.0040e160
mov ecx, dword [ebp - 0x18]
add esp, 0x10
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4ed791
sub ecx, edx
lea eax, [ecx + 1]
push eax
push dword [ebp - 0x18]
push 1
push 0
push esi
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push esi
call fcn.00501fb5
add esp, 4
jmp 0x4ed7dd
push edi
cmp eax, 3
jne 0x4ed7cd
push dword [ebp + 8]
call fcn.004ebbd0
add esp, 8
jmp 0x4ed7dd
push 0x61956c
push dword [ebp + 8]
call fcn.0040e130
add esp, 0xc
mov esi, dword [ebp - 0x20]
inc esi
mov byte [ebp - 4], 0
push edi
mov dword [ebp - 0x20], esi
call fcn.00501fb5
add esp, 4
cmp esi, dword [ebp - 0x38]
jl 0x4ed620
mov eax, dword [ebp - 0x4c]
test eax, eax
je 0x4ed9dd
mov edi, dword [ebp - 0x1c]
cmp edi, eax
jge 0x4ed9dd
mov esi, dword [ebp + 0xc]
push 0
push 0
mov ecx, esi
call fcn.004ea8a0
mov ecx, dword [eax + edi*4]
call fcn.004ef0f0
mov esi, dword [ebp + 0x10]
add esi, 0xc8
add esi, eax
mov eax, 1
cmove esi, eax
push esi
call fcn.005021d8
push esi
mov edi, eax
push 0
push edi
mov dword [ebp - 0x60], edi
call fcn.005889a0
add esp, 0x10
mov dword [ebp - 0x5c], esi
mov esi, dword [ebp + 0xc]
mov byte [ebp - 4], 9
cmp byte [esi + 0x68], 0
jne 0x4ed8b2
cmp byte [esi + 0x69], 0
jne 0x4ed8b2
mov eax, dword [ebp + 0x10]
inc eax
mov dword [ebp - 0x14], eax
test eax, eax
jle 0x4ed8b2
lea edx, [ebp - 0xcc]
mov esi, edx
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x4ed880
sub edx, esi
dec edi
nop word [eax + eax]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4ed890
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
sub dword [ebp - 0x14], 1
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 0x60]
jne 0x4ed871
mov esi, dword [ebp + 0xc]
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4ed8b7
push dword [ebp + 0x18]
sub ecx, edx
lea eax, [ecx + edi]
mov ecx, esi
push eax
call fcn.004ea8a0
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [eax + ecx*4]
call fcn.004ef0f0
cmp byte [esi + 0x68], 0
jne 0x4ed903
cmp byte [esi + 0x69], 0
jne 0x4ed903
lea ecx, [edi - 1]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x4ed8e8
mov ax, word [0x5e86b0]
mov word [ecx], ax
mov al, byte [0x5e86b2]
mov byte [ecx + 2], al
mov eax, dword [ebp + 0x1c]
cmp eax, 1
jne 0x4ed92a
mov esi, dword [ebp - 0x10]
push edi
push 0x61956c
push esi
call fcn.0040e160
add esp, 0xc
add esi, eax
mov dword [ebp - 0x10], esi
mov esi, dword [ebp + 0xc]
jmp 0x4ed9bf
cmp eax, 2
jne 0x4ed99c
push 0x14
call fcn.005021d8
push dword [ebp - 0x1c]
mov esi, eax
xorps xmm0, xmm0
push 0x5e86b4
push esi
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
call fcn.0040e160
mov ecx, dword [ebp + 0xc]
add esp, 0x10
push dword [ebp + 0x18]
push edi
call fcn.004ea8a0
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [eax + ecx*4]
call fcn.004ef0f0
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4ed972
sub ecx, edx
lea eax, [ecx + 1]
push eax
push edi
push 1
push 0
push esi
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push esi
call fcn.00501fb5
mov esi, dword [ebp + 0xc]
add esp, 4
jmp 0x4ed9bf
push edi
cmp eax, 3
jne 0x4ed9af
push dword [ebp + 8]
call fcn.004ebbd0
add esp, 8
jmp 0x4ed9bf
push 0x61956c
push dword [ebp + 8]
call fcn.0040e130
add esp, 0xc
inc dword [ebp - 0x1c]
push edi
mov byte [ebp - 4], 0
call fcn.00501fb5
mov edi, dword [ebp - 0x1c]
add esp, 4
mov eax, dword [ebp - 0x4c]
cmp edi, eax
jl 0x4ed813
mov ecx, dword [ebp - 0x30]
mov edi, dword [ebp + 0xc]
mov byte [ecx], 0
cmp byte [edi + 0x68], 0
jne 0x4ed9f2
cmp byte [edi + 0x69], 0
je 0x4eda09
cmp dword [ebp - 0x58], 0
jne 0x4eda09
cmp dword [ebp - 0x38], 0
jne 0x4eda09
cmp dword [ebp - 0x50], 0
jne 0x4eda09
cmp eax, 1
je 0x4eda46
cmp dword [ebp + 0x10], 0
jle 0x4eda46
nop
lea edx, [ebp - 0xcc]
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x4eda18
sub edx, esi
lea edi, [ecx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4eda24
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
sub dword [ebp + 0x10], 1
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x30]
jne 0x4eda10
mov edi, dword [ebp + 0xc]
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x4eda47
mov ax, word [0x5e86c0]
mov word [ecx], ax
mov al, byte [0x5e86c2]
mov byte [ecx + 2], al
mov ecx, dword [ebp - 0x30]
mov edx, ecx
lea esi, [edx + 1]
nop word [eax + eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x4eda70
sub edx, esi
push 0
lea eax, [ecx + edx]
mov ecx, edi
push eax
call fcn.004eb980
mov ecx, dword [ebp - 0x30]
lea edi, [ecx - 1]
nop dword [eax]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x4eda90
mov eax, dword [0x5e8694]
mov dword [edi], eax
mov eax, dword [ebp + 0x1c]
cmp eax, 1
jne 0x4edab9
push ecx
push 0x61956c
push dword [ebp - 0x10]
call fcn.0040e160
jmp 0x4edae9
cmp eax, 2
jne 0x4edac9
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4edaec
push ecx
cmp eax, 3
jne 0x4edadc
push dword [ebp + 8]
call fcn.004ebbd0
add esp, 8
jmp 0x4edaec
push 0x61956c
push dword [ebp + 8]
call fcn.0040e130
add esp, 0xc
push dword [ebp - 0x30]
call fcn.00501fb5
add esp, 4
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret