Function at 0x425c30
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x436990
mov eax, dword fs:[0]
push eax
sub esp, 0x720
mov eax, dword [0x442f98]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x6c0], eax
lea eax, [ebp - 0x704]
push eax
mov dword [ebp - 0x6f0], 0
mov dword [ebp - 0x704], 0
call main
add esp, 4
test al, al
jne 0x425c9d
mov dword [ebp - 0x6f0], 1
jmp 0x426fcf
mov eax, dword [ebp - 0x704]
test eax, eax
je 0x425cab
mov edi, dword [eax]
jmp 0x425cad
xor edi, edi
mov ecx, edi
mov dword [ebp - 0x6a8], 0
xor eax, eax
mov dword [ebp - 0x6a4], 7
mov word [ebp - 0x6b8], ax
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x425cd0
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x6b8]
call main
push 0x104
push edi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
mov ebx, eax
add esp, 8
xor esi, esi
test ebx, ebx
je 0x425d1a
movzx eax, word [edi + esi*2]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov word [edi + esi*2], ax
add esp, 4
inc esi
cmp esi, ebx
jb 0x425d03
mov ecx, edi
mov dword [ebp - 0x678], 0
xor eax, eax
mov dword [ebp - 0x674], 7
mov word [ebp - 0x688], ax
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x425d40
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x688]
call main
cmp dword [ebp - 0x674], 8
lea edx, [ebp - 0x688]
mov edi, dword [ebp - 0x678]
cmovae edx, dword [ebp - 0x688]
or ebx, 0xffffffff
test edi, edi
je 0x425da4
lea eax, [edi - 1]
mov ecx, ebx
cmp eax, ebx
cmovb ecx, eax
cmp word [edx + ecx*2], 0x2e
lea esi, [edx + ecx*2]
je 0x425d9e
cmp esi, edx
je 0x425da4
sub esi, 2
cmp word [esi], 0x2e
jne 0x425d91
sub esi, edx
sar esi, 1
jmp 0x425da7
or esi, 0xffffffff
cmp edi, esi
jb 0x426ffe
mov eax, edi
mov edx, ebx
sub eax, esi
cmp eax, 0xffffffff
cmovb edx, eax
cmp dword [ebp - 0x674], 8
lea eax, [ebp - 0x688]
cmovae eax, dword [ebp - 0x688]
sub edi, edx
mov dword [ebp - 0x678], edi
sub edi, esi
lea ecx, [eax + esi*2]
lea eax, [edi*2 + 2]
push eax
lea eax, [ecx + edx*2]
push eax
push ecx
call sub.VCRUNTIME140.dll_memmove
mov edi, dword [ebp - 0x674]
lea ecx, [ebp - 0x688]
mov esi, dword [ebp - 0x678]
add esp, 0xc
cmp edi, 8
cmovae ecx, dword [ebp - 0x688]
test esi, esi
je 0x425e37
lea eax, [esi - 1]
cmp eax, 0xffffffff
cmovb ebx, eax
cmp word [ecx + ebx*2], 0x5c
lea edx, [ecx + ebx*2]
je 0x425e31
cmp edx, ecx
je 0x425e37
sub edx, 2
cmp word [edx], 0x5c
jne 0x425e24
sub edx, ecx
sar edx, 1
jmp 0x425e3a
or edx, 0xffffffff
cmp esi, edx
lea ecx, [ebp - 0x688]
cmovb edx, esi
cmp edi, 8
cmovae ecx, dword [ebp - 0x688]
sub esi, edx
mov dword [ebp - 0x678], esi
lea eax, [esi*2 + 2]
push eax
lea eax, [ecx + edx*2]
push eax
push ecx
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov dword [ebp - 0x690], 0
xor eax, eax
mov dword [ebp - 0x68c], 7
lea ecx, [ebp - 0x6a0]
mov word [ebp - 0x6a0], ax
push 0x10
push str._acroiefavclient
call main
lea ecx, [ebp - 0x6c8]
mov dword [ebp - 0x6c8], 0
mov dword [ebp - 0x6c4], 0
call fcn.0042a3f0
cmp dword [ebp + 0x10], 0
mov dword [ebp - 0x6c8], eax
mov dword [ebp - 0x6bc], 0
jle 0x4260b0
mov ebx, dword [ebp - 0x6c0]
add ebx, 8
mov dword [ebp - 0x6e4], ebx
mov edx, dword [ebx - 8]
xor eax, eax
mov ecx, edx
mov dword [ebp - 0x648], 0
mov dword [ebp - 0x644], 7
mov word [ebp - 0x658], ax
lea esi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x425f10
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x658]
call main
push 8
call main
mov ecx, eax
add esp, 4
mov eax, dword [ebx - 4]
mov dword [ebp - 0x6cc], ecx
mov dword [ecx], eax
mov eax, dword [ebx]
mov dword [ecx + 4], eax
lea eax, [ebp - 0x658]
push eax
lea eax, [ebp - 0x6c0]
push eax
lea ecx, [ebp - 0x6c8]
call main
mov esi, dword [ebp - 0x6c0]
cmp esi, dword [ebp - 0x6c8]
je 0x425fec
cmp dword [esi + 0x24], 8
lea eax, [esi + 0x10]
jb 0x425f7b
mov eax, dword [esi + 0x10]
cmp dword [ebp - 0x644], 8
lea ebx, [ebp - 0x658]
mov edx, dword [esi + 0x20]
cmovae ebx, dword [ebp - 0x658]
mov edi, dword [ebp - 0x648]
mov ecx, edi
cmp edx, edi
mov dword [ebp - 0x6e0], edx
cmovb ecx, edx
test ecx, ecx
je 0x425fd0
sub ebx, eax
nop dword [eax + eax]
movzx edx, word [ebx + eax]
movzx edi, word [eax]
cmp dx, di
jne 0x425fd9
add eax, 2
sub ecx, 1
jne 0x425fb0
mov edx, dword [ebp - 0x6e0]
mov edi, dword [ebp - 0x648]
cmp edx, edi
jbe 0x425fe1
or eax, 0xffffffff
jmp 0x425fe5
sbb eax, eax
and eax, 0xfffffffe
inc eax
jmp 0x425fe5
sbb eax, eax
neg eax
shr eax, 0x1f
test al, al
je 0x426034
lea eax, [ebp - 0x658]
mov dword [ebp - 0x6e0], eax
lea ecx, [ebp - 0x6c8]
lea eax, [ebp - 0x6fd]
push eax
lea eax, [ebp - 0x6e0]
push eax
push 0x4396e4
call main
push eax
add eax, 0x10
lea ecx, [ebp - 0x6c8]
push eax
push esi
lea eax, [ebp - 0x6dc]
push eax
call main
mov esi, dword [ebp - 0x6dc]
mov eax, dword [ebp - 0x6cc]
mov dword [esi + 0x28], eax
mov edx, dword [ebp - 0x644]
mov dword [ebp - 4], 0
cmp edx, 8
jb 0x426084
mov ecx, dword [ebp - 0x658]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42607a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x426f33
push edx
push ecx
call main
add esp, 8
mov eax, dword [ebp - 0x6bc]
mov ebx, dword [ebp - 0x6e4]
inc eax
add ebx, 0xc
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x6bc], eax
mov dword [ebp - 0x6e4], ebx
cmp eax, dword [ebp + 0x10]
jl 0x425ee3
push 0xf003f
push dword [0x43f02c]
xor ebx, ebx
lea ecx, [ebp - 0x72c]
xor edi, edi
mov dword [ebp - 0x6d4], ebx
push SysReAllocString
mov dword [ebp - 0x6d8], edi
mov dword [ebp - 0x6d0], ebx
mov dword [ebp - 0x72c], ebx
mov dword [ebp - 0x728], ebx
mov dword [ebp - 0x724], ebx
call main
test eax, eax
jne 0x426e59
push eax
push eax
push 0x2001f
push eax
push eax
push dword [0x43f030]
lea ecx, [ebp - 0x718]
mov dword [ebp - 0x718], ebx
push dword [ebp - 0x72c]
mov dword [ebp - 0x714], ebx
mov dword [ebp - 0x710], ebx
call main
test eax, eax
mov eax, dword [ebp - 0x718]
jne 0x426e4c
xor esi, esi
lea eax, [ebp - 0x628]
push 0x208
push esi
push eax
mov dword [ebp - 0x6c0], esi
call fcn.0043628e
add esp, 0xc
mov dword [ebp - 0x6e0], 0x104
lea eax, [ebp - 0x6f8]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x6e0]
push eax
lea eax, [ebp - 0x628]
push eax
push esi
push dword [ebp - 0x718]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x42698b
lea ecx, [ebp - 0x628]
mov dword [ebp - 0x648], eax
mov dword [ebp - 0x644], 7
lea edx, [ecx + 2]
mov word [ebp - 0x658], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4261b2
sub ecx, edx
lea eax, [ebp - 0x628]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x658]
call main
mov edx, dword [str.SoftwareMicrosoftInternet_Explorer_]
xor eax, eax
mov ecx, edx
mov dword [ebp - 0x630], 0
mov dword [ebp - 0x62c], 7
mov word [ebp - 0x640], ax
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x426200
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x640]
call main
mov edx, dword [str.MenuExt]
xor eax, eax
mov ecx, edx
mov dword [ebp - 0x660], 0
mov dword [ebp - 0x65c], 7
mov word [ebp - 0x670], ax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x426244
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x670]
call main
cmp dword [ebp - 0x65c], 8
lea edx, [ebp - 0x670]
mov ebx, dword [ebp - 0x670]
mov esi, dword [ebp - 0x630]
cmovae edx, ebx
mov eax, dword [ebp - 0x62c]
mov ecx, dword [ebp - 0x660]
sub eax, esi
mov dword [ebp - 0x6cc], esi
cmp ecx, eax
ja 0x4262d0
cmp dword [ebp - 0x62c], 8
lea edi, [ecx + esi]
lea eax, [ecx + ecx]
mov dword [ebp - 0x630], edi
push eax
mov eax, dword [ebp - 0x6cc]
lea esi, [ebp - 0x640]
cmovae esi, dword [ebp - 0x640]
push edx
lea eax, [esi + eax*2]
push eax
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
xor eax, eax
mov word [esi + edi*2], ax
jmp 0x4262f1
push ecx
push edx
mov byte [ebp - 0x708], 0
push dword [ebp - 0x708]
push ecx
lea ecx, [ebp - 0x640]
call main
mov ebx, dword [ebp - 0x670]
mov eax, dword [ebp - 0x65c]
mov dword [ebp - 4], 1
cmp eax, 8
jb 0x426332
lea ecx, [eax*2 + 2]
mov eax, ebx
cmp ecx, 0x1000
jb 0x426328
mov ebx, dword [ebx - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x426f33
push ecx
push ebx
call main
add esp, 8
mov ecx, dword [ebp - 0x630]
mov edx, dword [ebp - 0x62c]
mov dword [ebp - 4], 0xffffffff
cmp ecx, edx
jae 0x42636b
lea eax, [ecx + 1]
cmp edx, 8
mov dword [ebp - 0x630], eax
lea eax, [ebp - 0x640]
cmovae eax, dword [ebp - 0x640]
mov dword [eax + ecx*2], 0x5c
jmp 0x426387
push 0x5c
mov byte [ebp - 0x70c], 0
lea ecx, [ebp - 0x640]
push dword [ebp - 0x70c]
push 1
call main
cmp dword [ebp - 0x644], 8
lea ecx, [ebp - 0x658]
mov eax, dword [ebp - 0x62c]
cmovae ecx, dword [ebp - 0x658]
mov edx, dword [ebp - 0x630]
sub eax, edx
mov ebx, dword [ebp - 0x648]
cmp ebx, eax
ja 0x4263e9
cmp dword [ebp - 0x62c], 8
lea esi, [ebp - 0x640]
lea eax, [ebx + ebx]
cmovae esi, dword [ebp - 0x640]
lea edi, [edx + ebx]
push eax
push ecx
mov dword [ebp - 0x630], edi
lea eax, [esi + edx*2]
push eax
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
xor eax, eax
mov word [esi + edi*2], ax
jmp 0x42640a
push ebx
push ecx
mov byte [ebp - 0x6e8], 0
lea ecx, [ebp - 0x640]
push dword [ebp - 0x6e8]
push ebx
call main
mov ebx, dword [ebp - 0x648]
lea eax, [ebp - 0x658]
push eax
lea eax, [ebp - 0x71c]
push eax
lea ecx, [ebp - 0x6c8]
call main
mov eax, dword [ebp - 0x71c]
cmp eax, dword [ebp - 0x6c8]
je 0x4264e1
cmp dword [eax + 0x24], 8
lea ecx, [eax + 0x10]
mov eax, ecx
jb 0x426442
mov eax, dword [ecx]
cmp dword [ebp - 0x644], 8
lea edi, [ebp - 0x658]
mov edx, dword [ecx + 0x10]
mov ecx, ebx
cmovae edi, dword [ebp - 0x658]
cmp edx, ebx
mov dword [ebp - 0x6cc], edx
cmovb ecx, edx
test ecx, ecx
je 0x42648a
sub edi, eax
nop dword [eax]
movzx edx, word [eax + edi]
movzx esi, word [eax]
cmp dx, si
jne 0x426493
add eax, 2
sub ecx, 1
jne 0x426470
mov edx, dword [ebp - 0x6cc]
cmp edx, ebx
jbe 0x42649b
or eax, 0xffffffff
jmp 0x42649f
sbb eax, eax
and eax, 0xfffffffe
inc eax
jmp 0x42649f
sbb eax, eax
neg eax
shr eax, 0x1f
test al, al
jne 0x4264e1
mov ebx, dword [ebp - 0x6d4]
lea eax, [ebp - 0x658]
push eax
cmp dword [ebp - 0x6d0], ebx
je 0x4264d0
mov ecx, ebx
call main
add ebx, 0x18
mov dword [ebp - 0x6d4], ebx
jmp 0x4268bd
push ebx
lea ecx, [ebp - 0x6d8]
call main
jmp 0x4268b7
xor edi, edi
lea ecx, [ebp - 0x6e4]
cmp dword [ebp - 0x62c], 8
lea eax, [ebp - 0x640]
push ecx
cmovae eax, dword [ebp - 0x640]
push 0x20019
push edi
push eax
push SysReAllocString
mov dword [ebp - 0x6bc], edi
mov dword [ebp - 0x6e4], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4268ac
mov edi, dword [ebp - 0x6e4]
mov dword [ebp - 0x6bc], edi
test eax, eax
jne 0x4268ac
lea eax, [ebp - 0x6dc]
mov dword [ebp - 0x6dc], 0x208
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x6ec]
push eax
push 0
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4268ac
mov eax, dword [ebp - 0x6ec]
cmp eax, 1
je 0x426581
cmp eax, 2
je 0x426581
mov eax, 0xd
jmp 0x4265ae
mov eax, dword [ebp - 0x6dc]
test eax, eax
je 0x4265a3
test al, 1
jne 0x42659c
shr eax, 1
cmp word [ebp + eax*2 - 0x422], 0
je 0x4265ac
mov eax, 0xd
jmp 0x4265ae
xor eax, eax
mov word [ebp - 0x420], ax
xor eax, eax
test eax, eax
jne 0x4268ac
xor esi, esi
nop dword [eax + eax]
movzx eax, word [ebp + esi*2 - 0x420]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov word [ebp + esi*2 - 0x420], ax
add esp, 4
inc esi
cmp esi, 0x104
jb 0x4265c0
xor eax, eax
mov dword [ebp - 0x660], 0
lea ecx, [ebp - 0x420]
mov dword [ebp - 0x65c], 7
mov word [ebp - 0x670], ax
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x426610
sub ecx, edx
lea eax, [ebp - 0x420]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x670]
call main
cmp dword [ebp - 0x65c], 8
lea ecx, [ebp - 0x670]
mov eax, dword [ebp - 0x660]
cmovae ecx, dword [ebp - 0x670]
mov dword [ebp - 0x6cc], ecx
cmp eax, 6
jb 0x426688
lea ebx, [ecx + eax*2]
mov eax, ecx
nop dword [eax]
lea ecx, [ebx - 0xa]
sub ecx, eax
sar ecx, 1
je 0x426682
nop dword [eax]
cmp word [eax], 0x72
je 0x4267a5
add eax, 2
sub ecx, 1
jne 0x426670
mov edi, dword [ebp - 0x6bc]
or eax, 0xffffffff
test eax, eax
jne 0x42685e
push 6
push eax
lea ecx, [ebp - 0x670]
call main
push 0xffffffffffffffff
push 0x2f
lea ecx, [ebp - 0x670]
call main
mov ecx, eax
mov eax, dword [ebp - 0x660]
sub eax, ecx
push eax
push ecx
lea ecx, [ebp - 0x670]
call main
cmp dword [ebp - 0x65c], 8
lea ecx, [ebp - 0x218]
push 0x104
lea eax, [ebp - 0x670]
cmovae eax, dword [ebp - 0x670]
push ecx
push eax
call dword [sym.imp.kernel32.dll_GetLongPathNameW]
test eax, eax
je 0x4267ec
xor esi, esi
nop dword [eax + eax]
movzx eax, word [ebp + esi*2 - 0x218]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov word [ebp + esi*2 - 0x218], ax
add esp, 4
inc esi
cmp esi, 0x104
jb 0x426700
cmp dword [ebp - 0x674], 8
lea eax, [ebp - 0x688]
cmovae eax, dword [ebp - 0x688]
push eax
lea eax, [ebp - 0x218]
push eax
call sub.VCRUNTIME140.dll_wcsstr
add esp, 8
test eax, eax
jne 0x426777
cmp dword [ebp - 0x68c], 8
lea eax, [ebp - 0x6a0]
cmovae eax, dword [ebp - 0x6a0]
push eax
lea eax, [ebp - 0x218]
push eax
call sub.VCRUNTIME140.dll_wcsstr
add esp, 8
test eax, eax
je 0x42685e
mov ebx, dword [ebp - 0x6d4]
lea eax, [ebp - 0x658]
push eax
cmp dword [ebp - 0x6d0], ebx
je 0x426852
mov ecx, ebx
call main
add ebx, 0x18
mov dword [ebp - 0x6d4], ebx
jmp 0x42685e
test eax, eax
je 0x426682
mov edx, str.res:__
mov edi, eax
mov esi, 6
sub edi, edx
nop dword [eax + eax]
mov cx, word [edi + edx]
cmp cx, word [edx]
jne 0x4267e4
add edx, 2
sub esi, 1
jne 0x4267c0
sub eax, dword [ebp - 0x6cc]
mov edi, dword [ebp - 0x6bc]
sar eax, 1
jmp 0x42668b
add eax, 2
jmp 0x426660
cmp dword [ebp - 0x660], 0
jbe 0x42685e
cmp dword [ebp - 0x68c], 8
lea ecx, [ebp - 0x6a0]
lea eax, [ebp - 0x670]
cmovae ecx, dword [ebp - 0x6a0]
cmp dword [ebp - 0x65c], 8
push ecx
cmovae eax, dword [ebp - 0x670]
push eax
call sub.VCRUNTIME140.dll_wcsstr
add esp, 8
test eax, eax
je 0x42685e
mov ebx, dword [ebp - 0x6d4]
lea eax, [ebp - 0x658]
push eax
cmp dword [ebp - 0x6d0], ebx
je 0x426852
mov ecx, ebx
call main
add ebx, 0x18
mov dword [ebp - 0x6d4], ebx
jmp 0x42685e
push ebx
lea ecx, [ebp - 0x6d8]
call main
mov edx, dword [ebp - 0x65c]
mov dword [ebp - 4], 2
cmp edx, 8
jb 0x4268a5
mov ecx, dword [ebp - 0x670]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42689b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x426f33
push edx
push ecx
call main
add esp, 8
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x4268b7
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0x6d4]
mov esi, dword [ebp - 0x6c0]
inc esi
mov dword [ebp - 0x6e0], 0x104
mov dword [ebp - 0x6c0], esi
mov edx, dword [ebp - 0x62c]
mov dword [ebp - 4], 3
cmp edx, 8
jb 0x42691b
mov ecx, dword [ebp - 0x640]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x426911
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x426f33
push edx
push ecx
call main
add esp, 8
xor eax, eax
mov dword [ebp - 0x630], 0
mov dword [ebp - 0x62c], 7
mov word [ebp - 0x640], ax
mov edx, dword [ebp - 0x644]
mov dword [ebp - 4], 4
cmp edx, 8
jb 0x42697f
mov ecx, dword [ebp - 0x658]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x426975
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x426f33
push edx
push ecx
call main
add esp, 8
mov dword [ebp - 4], 0xffffffff
jmp 0x426162
mov edi, dword [ebp - 0x6d8]
mov esi, edi
cmp esi, ebx
je 0x426ae1
mov eax, dword [ebp - 0x714]
or eax, 0x2001f
mov dword [ebp - 0x6ec], eax
nop dword [eax]
cmp dword [esi + 0x14], 8
mov ebx, esi
jb 0x4269ba
mov ebx, dword [esi]
push eax
push ebx
push dword [ebp - 0x718]
lea ecx, [ebp - 0x6fc]
mov dword [ebp - 0x6fc], 0
mov dword [ebp - 0x6f8], 0
mov dword [ebp - 0x6f4], 0
call main
test eax, eax
je 0x426a03
mov eax, dword [ebp - 0x6fc]
test eax, eax
je 0x426abc
push eax
jmp 0x426aac
mov edi, dword [ebp - 0x6fc]
lea eax, [ebp - 0x720]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x6bc]
mov dword [ebp - 0x6bc], 0x100
push eax
lea eax, [ebp - 0x210]
push eax
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x426a8e
nop dword [eax + eax]
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x6fc]
call main
test eax, eax
jne 0x4269ef
mov edi, dword [ebp - 0x6fc]
lea eax, [ebp - 0x720]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x6bc]
mov dword [ebp - 0x6bc], 0x100
push eax
lea eax, [ebp - 0x210]
push eax
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x426a40
test edi, edi
je 0x426a9b
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
push ebx
lea ecx, [ebp - 0x718]
call main
test edi, edi
je 0x426abc
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x6fc], 0
mov eax, dword [ebp - 0x6ec]
add esi, 0x18
mov dword [ebp - 0x6f8], 0
cmp esi, dword [ebp - 0x6d4]
jne 0x4269b0
mov edi, dword [ebp - 0x6d8]
mov eax, dword [ebp - 0x6c8]
mov dword [ebp - 0x708], eax
mov esi, dword [eax]
cmp esi, eax
je 0x426e46
mov edi, dword [esi + 0x28]
lea eax, [esi + 0x10]
xor ebx, ebx
mov dword [ebp - 0x6dc], edi
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x6bc], ebx
jb 0x426b13
mov eax, dword [eax]
lea ecx, [ebp - 0x6cc]
mov dword [ebp - 0x6c0], ebx
push ecx
lea ecx, [ebp - 0x6c0]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push eax
push dword [ebp - 0x718]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x426dd6
mov ebx, dword [ebp - 0x6c0]
mov dword [ebp - 0x6bc], ebx
test eax, eax
jne 0x426dd6
push 6
push str.res:__
lea ecx, [ebp - 0x640]
mov dword [ebp - 0x630], eax
mov dword [ebp - 0x62c], 7
mov word [ebp - 0x640], ax
call main
cmp dword [ebp - 0x6a4], 8
lea ecx, [ebp - 0x6b8]
mov eax, dword [ebp - 0x62c]
cmovae ecx, dword [ebp - 0x6b8]
mov edx, dword [ebp - 0x630]
sub eax, edx
mov ebx, dword [ebp - 0x6a8]
cmp ebx, eax
ja 0x426bf2
mov eax, dword [ebp - 0x6a8]
lea edi, [ebp - 0x640]
add ebx, edx
cmp dword [ebp - 0x62c], 8
mov dword [ebp - 0x630], ebx
cmovae edi, dword [ebp - 0x640]
add eax, eax
push eax
push ecx
lea eax, [edi + edx*2]
push eax
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
xor eax, eax
mov word [edi + ebx*2], ax
mov edi, dword [ebp - 0x6dc]
jmp 0x426c0d
push ebx
push ecx
mov byte [ebp - 0x6ec], 0
lea ecx, [ebp - 0x640]
push dword [ebp - 0x6ec]
push ebx
call main
mov ecx, dword [ebp - 0x630]
mov edx, dword [ebp - 0x62c]
cmp ecx, edx
jae 0x426c3f
lea eax, [ecx + 1]
cmp edx, 8
mov dword [ebp - 0x630], eax
lea eax, [ebp - 0x640]
cmovae eax, dword [ebp - 0x640]
mov dword [eax + ecx*2], 0x2f
jmp 0x426c5b
push 0x2f
mov byte [ebp - 0x71c], 0
lea ecx, [ebp - 0x640]
push dword [ebp - 0x71c]
push 1
call main
mov edx, dword [edi]
xor eax, eax
mov ecx, edx
mov dword [ebp - 0x648], 0
mov dword [ebp - 0x644], 7
mov word [ebp - 0x658], ax
lea edi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x426c80
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x658]
call main
cmp dword [ebp - 0x644], 8
lea edx, [ebp - 0x658]
mov ebx, dword [ebp - 0x630]
cmovae edx, dword [ebp - 0x658]
mov eax, dword [ebp - 0x62c]
mov ecx, dword [ebp - 0x648]
sub eax, ebx
mov dword [ebp - 0x6e8], ebx
cmp ecx, eax
ja 0x426d09
add ebx, ecx
lea eax, [ecx + ecx]
cmp dword [ebp - 0x62c], 8
lea edi, [ebp - 0x640]
push eax
cmovae edi, dword [ebp - 0x640]
mov eax, dword [ebp - 0x6e8]
push edx
mov dword [ebp - 0x630], ebx
lea eax, [edi + eax*2]
push eax
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
xor eax, eax
mov word [edi + ebx*2], ax
jmp 0x426d24
push ecx
push edx
mov byte [ebp - 0x70c], 0
push dword [ebp - 0x70c]
push ecx
lea ecx, [ebp - 0x640]
call main
lea ecx, [ebp - 0x658]
mov dword [ebp - 4], 5
call fcn.0041fcc0
cmp dword [ebp - 0x62c], 8
lea edx, [ebp - 0x640]
mov dword [ebp - 4], 0xffffffff
jb 0x426d56
mov edx, dword [ebp - 0x640]
test edx, edx
je 0x426d8d
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x426d60
mov ebx, dword [ebp - 0x6bc]
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x426d93
mov ebx, dword [ebp - 0x6bc]
mov eax, dword [ebp - 0x6dc]
push 4
mov eax, dword [eax + 4]
mov dword [ebp - 0x6e8], eax
lea eax, [ebp - 0x6e8]
push eax
push 4
push 0
push str.Contexts
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea ecx, [ebp - 0x640]
mov dword [ebp - 4], 6
call fcn.0041fcc0
mov dword [ebp - 4], 0xffffffff
jmp 0x426de0
mov dword [ebp - 0x6f0], 1
cmp byte [esi + 0xd], 0
jne 0x426e29
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
jne 0x426e0e
mov esi, eax
mov ecx, dword [esi]
cmp byte [ecx + 0xd], 0
jne 0x426e29
nop dword [eax]
mov eax, dword [ecx]
mov esi, ecx
mov ecx, eax
cmp byte [eax + 0xd], 0
je 0x426e00
jmp 0x426e29
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x426e27
cmp esi, dword [eax + 8]
jne 0x426e27
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x426e17
mov esi, eax
test ebx, ebx
je 0x426e34
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, dword [ebp - 0x708]
jne 0x426af7
mov edi, dword [ebp - 0x6d8]
mov eax, dword [ebp - 0x718]
test eax, eax
je 0x426e63
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x426e63
mov dword [ebp - 0x6f0], 1
mov ebx, dword [ebp - 0x6c8]
mov esi, dword [ebx]
cmp esi, ebx
je 0x426ec6
nop
push 8
push dword [esi + 0x28]
call main
add esp, 8
cmp byte [esi + 0xd], 0
jne 0x426ec2
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
jne 0x426ea4
mov esi, eax
mov ecx, dword [esi]
cmp byte [ecx + 0xd], 0
jne 0x426ec2
mov eax, dword [ecx]
mov esi, ecx
mov ecx, eax
cmp byte [eax + 0xd], 0
je 0x426e96
jmp 0x426ec2
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x426ec0
nop dword [eax]
cmp esi, dword [eax + 8]
jne 0x426ec0
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x426eb0
mov esi, eax
cmp esi, ebx
jne 0x426e70
mov eax, dword [ebp - 0x72c]
test eax, eax
je 0x426ed7
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 7
test edi, edi
je 0x426f43
push dword [ebp - 0x6d4]
lea ecx, [ebp - 0x6d8]
push edi
call main
mov ecx, dword [ebp - 0x6d0]
mov eax, 0x2aaaaaab
mov esi, dword [ebp - 0x6d8]
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*2]
mov eax, esi
shl ecx, 3
cmp ecx, 0x1000
jb 0x426f39
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x426f39
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push esi
call main
add esp, 8
mov ebx, dword [ebp - 0x6c8]
lea ecx, [ebp - 0x6c8]
mov dword [ebp - 4], 8
push dword [ebx + 4]
call main
mov eax, dword [ebp - 0x6c8]
mov dword [eax + 4], ebx
mov eax, dword [ebp - 0x6c8]
mov dword [eax], ebx
mov eax, dword [ebp - 0x6c8]
mov dword [eax + 8], ebx
mov dword [ebp - 0x6c4], 0
push 0x2c
push dword [ebp - 0x6c8]
mov dword [ebp - 4], 0xb
call main
add esp, 8
lea ecx, [ebp - 0x6a0]
mov dword [ebp - 4], 0xc
call fcn.0041fcc0
lea ecx, [ebp - 0x688]
mov dword [ebp - 4], 0xd
call fcn.0041fcc0
lea ecx, [ebp - 0x6b8]
mov dword [ebp - 4], 0xe
call fcn.0041fcc0
lea ecx, [ebp - 0x704]
call main
mov eax, dword [ebp - 0x6f0]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00434ca0
mov esp, ebp
pop ebp
ret 0x10
call fcn.00420c00
int3