Function at 0x11f3c80
Capabilities:
Persist via winlogon helper dll registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x125c20f
mov eax, dword fs:[0]
push eax
sub esp, 0x270
mov eax, dword [0x1286d50]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor esi, esi
mov edi, ecx
mov ebx, 7
xor ecx, ecx
mov dword [ebp - 0x268], eax
mov dword [ebp - 0x270], edi
mov dword [ebp - 0x258], esi
mov dword [ebp - 0x260], esi
mov dword [ebp - 0x27c], esi
mov dword [ebp - 0x254], esi
mov dword [ebp - 0x1ac], ebx
mov dword [ebp - 0x1b0], esi
mov word [ebp - 0x1c0], cx
mov dword [ebp - 4], esi
push esi
xor edx, edx
push 0x1263064
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x200], ebx
mov dword [ebp - 0x204], esi
mov word [ebp - 0x214], dx
call fcn.011f1740
mov byte [ebp - 4], 1
push esi
xor eax, eax
push 0x1263064
lea ecx, [ebp - 0x1dc]
mov dword [ebp - 0x1c8], ebx
mov dword [ebp - 0x1cc], esi
mov word [ebp - 0x1dc], ax
call fcn.011f1740
mov byte [ebp - 4], 2
xor ecx, ecx
push esi
mov word [ebp - 0x230], cx
push 0x1263064
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x220], esi
call fcn.011f1740
mov byte [ebp - 4], 3
push 1
xor edx, edx
push 0x12631cc
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 0x1e4], ebx
mov dword [ebp - 0x1e8], esi
mov word [ebp - 0x1f8], dx
call fcn.011f1740
mov ecx, 0x12631d0
mov ebx, 0x12631e0
mov edx, 0x80000002
lea esi, [ebp - 0x24c]
mov byte [ebp - 4], 4
call fcn.01209920
push eax
lea ecx, [ebp - 0x214]
mov byte [ebp - 4], 5
call fcn.011f1560
mov byte [ebp - 4], 4
cmp dword [ebp - 0x238], 8
jb 0x11f3de5
mov eax, dword [ebp - 0x24c]
push eax
call fcn.0123e60d
add esp, 4
cmp dword [ebp - 0x204], 0
je 0x11f415d
push 0xffffffffffffffff
push 0
lea ecx, [ebp - 0x214]
push ecx
lea ecx, [ebp - 0x1dc]
call fcn.011f15e0
jmp 0x11f3e10
cmp dword [ebp - 0x1e4], 8
mov eax, dword [ebp - 0x1f8]
jae 0x11f3e25
lea eax, [ebp - 0x1f8]
mov edx, dword [ebp - 0x1e8]
push edx
push eax
lea eax, [ebp - 0x1dc]
push eax
call fcn.01200740
mov edi, eax
cmp edi, 0xffffffff
je 0x11f3fff
lea ecx, [ebp - 0x1dc]
push ecx
mov ecx, edi
xor edx, edx
lea esi, [ebp - 0x24c]
call fcn.011feb80
mov esi, eax
lea edx, [ebp - 0x1c0]
cmp edx, esi
je 0x11f3eef
cmp dword [ebp - 0x1ac], 8
jb 0x11f3e82
mov eax, dword [ebp - 0x1c0]
push eax
call fcn.0123e60d
add esp, 4
xor ecx, ecx
mov ebx, 7
mov dword [ebp - 0x1ac], ebx
mov dword [ebp - 0x1b0], 0
mov word [ebp - 0x1c0], cx
cmp dword [esi + 0x14], 8
jae 0x11f3ec0
mov eax, dword [esi + 0x10]
lea edx, [eax + eax + 2]
push edx
lea eax, [ebp - 0x1c0]
push esi
push eax
call fcn.0123e620
add esp, 0xc
jmp 0x11f3ece
mov ecx, dword [esi]
mov dword [ebp - 0x1c0], ecx
mov dword [esi], 0
mov edx, dword [esi + 0x10]
mov dword [ebp - 0x1b0], edx
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x1ac], eax
xor ecx, ecx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x10], 0
mov word [esi], cx
mov byte [ebp - 4], 4
cmp dword [ebp - 0x238], 8
jb 0x11f3f0b
mov edx, dword [ebp - 0x24c]
push edx
call fcn.0123e60d
add esp, 4
call fcn.0122a1b1
mov esi, eax
mov dword [ebp - 0x278], esi
call fcn.0122a06b
push 0
lea ecx, [ebp - 0x274]
mov ebx, eax
call fcn.01229fa0
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x11f3f38
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x274]
call fcn.01229fc8
push ecx
mov byte [ebp - 4], 7
mov eax, esp
mov dword [ebp - 0x264], esp
push 0
lea ecx, [ebp - 0x26c]
mov dword [eax], esi
call fcn.01229fa0
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
jae 0x11f3f6b
inc eax
mov dword [esi + 4], eax
lea ecx, [ebp - 0x26c]
call fcn.01229fc8
lea eax, [ebp - 0x1c0]
push eax
call fcn.01206860
add esp, 8
test al, al
push 0
lea ecx, [ebp - 0x25c]
sete byte [ebp - 0x24d]
mov byte [ebp - 4], 4
call fcn.01229fa0
mov eax, dword [esi + 4]
test eax, eax
je 0x11f3faf
cmp eax, 0xffffffff
jae 0x11f3faf
dec eax
mov dword [esi + 4], eax
mov ebx, dword [esi + 4]
neg ebx
sbb ebx, ebx
lea ecx, [ebp - 0x25c]
not ebx
call fcn.01229fc8
and ebx, esi
je 0x11f3fd1
mov edx, dword [ebx]
mov eax, dword [edx]
push 1
mov ecx, ebx
call eax
cmp byte [ebp - 0x24d], 0
je 0x11f3fe4
mov dword [ebp - 0x27c], 1
mov ecx, dword [ebp - 0x1e8]
add ecx, edi
push ecx
push 0
lea ecx, [ebp - 0x1dc]
call fcn.011f1830
jmp 0x11f3e10
call fcn.0122a1b1
mov esi, eax
mov dword [ebp - 0x264], esi
call fcn.0122a06b
push 0
lea ecx, [ebp - 0x25c]
mov ebx, eax
call fcn.01229fa0
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x11f402c
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x25c]
call fcn.01229fc8
push ecx
mov byte [ebp - 4], 8
mov eax, esp
mov dword [ebp - 0x278], esp
push 0
lea ecx, [ebp - 0x26c]
mov dword [eax], esi
call fcn.01229fa0
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
jae 0x11f405f
inc eax
mov dword [esi + 4], eax
lea ecx, [ebp - 0x26c]
call fcn.01229fc8
lea edx, [ebp - 0x1dc]
push edx
call fcn.01206860
add esp, 8
test al, al
push 0
lea ecx, [ebp - 0x25c]
sete byte [ebp - 0x24d]
mov byte [ebp - 4], 4
call fcn.01229fa0
mov eax, dword [esi + 4]
test eax, eax
je 0x11f40a3
cmp eax, 0xffffffff
jae 0x11f40a3
dec eax
mov dword [esi + 4], eax
mov ebx, dword [esi + 4]
neg ebx
sbb ebx, ebx
lea ecx, [ebp - 0x25c]
not ebx
call fcn.01229fc8
and ebx, esi
je 0x11f40c5
mov eax, dword [ebx]
mov edx, dword [eax]
push 1
mov ecx, ebx
call edx
cmp byte [ebp - 0x24d], 0
jne 0x11f40db
cmp dword [ebp - 0x27c], 1
jne 0x11f41ce
push 0x126325c
push ecx
lea eax, [ebp - 0x214]
push eax
push ecx
mov ecx, dword [ebp - 0x270]
push 0x1263268
push ecx
call fcn.01204730
add esp, 0xc
push eax
call fcn.012049f0
add esp, 0xc
push eax
call fcn.01204730
mov esi, eax
mov edx, dword [esi]
mov eax, dword [edx + 4]
add esp, 8
xor ebx, ebx
test byte [eax + esi + 0xc], 6
jne 0x11f4136
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x11f4136
mov ebx, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test ebx, ebx
je 0x11f41ce
mov eax, dword [ecx + 0xc]
or eax, ebx
cmp dword [ecx + 0x38], 0
jne 0x11f4153
or eax, 4
push 0
push eax
call fcn.011f2d10
jmp 0x11f41ce
push 0x12632c8
push edi
call fcn.01204730
mov esi, eax
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, dword [eax + esi + 0xc]
add esp, 8
xor ebx, ebx
test cl, 6
jne 0x11f4194
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x11f4194
mov ebx, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test ebx, ebx
je 0x11f41b5
mov eax, dword [ecx + 0xc]
or eax, ebx
cmp dword [ecx + 0x38], 0
jne 0x11f41ad
or eax, 4
push 0
push eax
call fcn.011f2d10
push 1
push 0x12631d0
mov esi, 0x1263354
mov ecx, 0x12631e0
call fcn.01209a40
add esp, 8
push 0
push 0x1263064
lea ecx, [ebp - 0x1dc]
call fcn.011f1740
push 0
push 0x1263064
lea ecx, [ebp - 0x1c0]
call fcn.011f1740
mov ecx, 0x12631d0
mov ebx, 0x12631e0
mov edx, 0x80000001
lea esi, [ebp - 0x24c]
call fcn.01209920
push eax
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 9
call fcn.011f1560
mov byte [ebp - 4], 4
cmp dword [ebp - 0x238], 8
jb 0x11f4238
mov edx, dword [ebp - 0x24c]
push edx
call fcn.0123e60d
add esp, 4
cmp dword [ebp - 0x220], 0
je 0x11f45a7
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x1dc]
call fcn.011f15e0
jmp 0x11f4260
cmp dword [ebp - 0x1e4], 8
mov eax, dword [ebp - 0x1f8]
jae 0x11f4275
lea eax, [ebp - 0x1f8]
mov ecx, dword [ebp - 0x1e8]
push ecx
push eax
lea edx, [ebp - 0x1dc]
push edx
call fcn.01200740
mov edi, eax
cmp edi, 0xffffffff
je 0x11f444f
lea eax, [ebp - 0x1dc]
push eax
mov ecx, edi
xor edx, edx
lea esi, [ebp - 0x24c]
call fcn.011feb80
mov esi, eax
lea ecx, [ebp - 0x1c0]
cmp ecx, esi
je 0x11f433f
cmp dword [ebp - 0x1ac], 8
jb 0x11f42d2
mov edx, dword [ebp - 0x1c0]
push edx
call fcn.0123e60d
add esp, 4
xor eax, eax
mov ebx, 7
mov dword [ebp - 0x1ac], ebx
mov dword [ebp - 0x1b0], 0
mov word [ebp - 0x1c0], ax
cmp dword [esi + 0x14], 8
jae 0x11f4310
mov eax, dword [esi + 0x10]
lea ecx, [eax + eax + 2]
push ecx
lea edx, [ebp - 0x1c0]
push esi
push edx
call fcn.0123e620
add esp, 0xc
jmp 0x11f431e
mov eax, dword [esi]
mov dword [ebp - 0x1c0], eax
mov dword [esi], 0
mov ecx, dword [esi + 0x10]
mov dword [ebp - 0x1b0], ecx
mov edx, dword [esi + 0x14]
mov dword [ebp - 0x1ac], edx
xor eax, eax
mov dword [esi + 0x14], ebx
mov dword [esi + 0x10], 0
mov word [esi], ax
mov byte [ebp - 4], 4
cmp dword [ebp - 0x238], 8
jb 0x11f435b
mov ecx, dword [ebp - 0x24c]
push ecx
call fcn.0123e60d
add esp, 4
call fcn.0122a1b1
mov esi, eax
mov dword [ebp - 0x264], esi
call fcn.0122a06b
push 0
lea ecx, [ebp - 0x25c]
mov ebx, eax
call fcn.01229fa0
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x11f4388
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x25c]
call fcn.01229fc8
push ecx
mov byte [ebp - 4], 0xb
mov eax, esp
mov dword [ebp - 0x278], esp
push 0
lea ecx, [ebp - 0x26c]
mov dword [eax], esi
call fcn.01229fa0
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
jae 0x11f43bb
inc eax
mov dword [esi + 4], eax
lea ecx, [ebp - 0x26c]
call fcn.01229fc8
lea edx, [ebp - 0x1c0]
push edx
call fcn.01206860
add esp, 8
test al, al
push 0
lea ecx, [ebp - 0x274]
sete byte [ebp - 0x24d]
mov byte [ebp - 4], 4
call fcn.01229fa0
mov eax, dword [esi + 4]
test eax, eax
je 0x11f43ff
cmp eax, 0xffffffff
jae 0x11f43ff
dec eax
mov dword [esi + 4], eax
mov ebx, dword [esi + 4]
neg ebx
sbb ebx, ebx
lea ecx, [ebp - 0x274]
not ebx
call fcn.01229fc8
and ebx, esi
je 0x11f4421
mov eax, dword [ebx]
mov edx, dword [eax]
push 1
mov ecx, ebx
call edx
cmp byte [ebp - 0x24d], 0
je 0x11f4434
mov dword [ebp - 0x254], 1
mov eax, dword [ebp - 0x1e8]
add eax, edi
push eax
push 0
lea ecx, [ebp - 0x1dc]
call fcn.011f1830
jmp 0x11f4260
call fcn.0122a1b1
mov esi, eax
mov dword [ebp - 0x264], esi
call fcn.0122a06b
push 0
lea ecx, [ebp - 0x25c]
mov ebx, eax
call fcn.01229fa0
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x11f447c
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x25c]
call fcn.01229fc8
push ecx
mov byte [ebp - 4], 0xc
mov eax, esp
mov dword [ebp - 0x278], esp
push 0
lea ecx, [ebp - 0x26c]
mov dword [eax], esi
call fcn.01229fa0
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
jae 0x11f44af
inc eax
mov dword [esi + 4], eax
lea ecx, [ebp - 0x26c]
call fcn.01229fc8
lea ecx, [ebp - 0x1dc]
push ecx
call fcn.01206860
add esp, 8
test al, al
push 0
lea ecx, [ebp - 0x25c]
sete byte [ebp - 0x24d]
mov byte [ebp - 4], 4
call fcn.01229fa0
mov eax, dword [esi + 4]
test eax, eax
je 0x11f44f3
cmp eax, 0xffffffff
jae 0x11f44f3
dec eax
mov dword [esi + 4], eax
mov ebx, dword [esi + 4]
neg ebx
sbb ebx, ebx
lea ecx, [ebp - 0x25c]
not ebx
call fcn.01229fc8
and ebx, esi
je 0x11f4515
mov edx, dword [ebx]
mov eax, dword [edx]
push 1
mov ecx, ebx
call eax
cmp byte [ebp - 0x24d], 0
jne 0x11f452b
cmp dword [ebp - 0x254], 1
jne 0x11f45a7
mov edx, dword [ebp - 0x270]
push 0x126325c
push ecx
lea ecx, [ebp - 0x230]
push ecx
push ecx
push 0x1263370
push edx
call fcn.01204730
add esp, 0xc
push eax
call fcn.012049f0
add esp, 0xc
push eax
call fcn.01204730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor ebx, ebx
test byte [eax + esi + 0xc], 6
jne 0x11f4586
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x11f4586
mov ebx, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test ebx, ebx
je 0x11f45a7
mov eax, dword [ecx + 0xc]
or eax, ebx
cmp dword [ecx + 0x38], 0
jne 0x11f459f
or eax, 4
push 0
push eax
call fcn.011f2d10
lea edx, [ebp - 0x254]
push edx
push 0x20019
push 0
push 0x12633e8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x11f46c2
lea eax, [ebp - 0x25c]
push eax
mov eax, dword [ebp - 0x254]
lea ecx, [ebp - 0x260]
push ecx
lea edx, [ebp - 0x264]
push edx
push 0
push 0x12633cc
push eax
mov dword [ebp - 0x25c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x254]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x11f46c2
mov eax, dword [ebp - 0x260]
test eax, eax
je 0x11f46c2
push eax
push 0x1263454
mov eax, 0x190
lea ebx, [ebp - 0x1a4]
call fcn.011f3130
mov edi, dword [ebp - 0x270]
add esp, 8
push 0x126325c
push ecx
mov edx, ebx
push edx
push ecx
push 0x1263470
push edi
call fcn.01204730
add esp, 0xc
push eax
call fcn.01204730
add esp, 0xc
push eax
call fcn.01204730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor ebx, ebx
test byte [eax + esi + 0xc], 6
jne 0x11f4695
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x11f4695
mov ebx, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test ebx, ebx
je 0x11f46b6
mov eax, dword [ecx + 0xc]
or eax, ebx
cmp dword [ecx + 0x38], 0
jne 0x11f46ae
or eax, 4
push 0
push eax
call fcn.011f2d10
mov dword [ebp - 0x258], 1
jmp 0x11f46c8
mov edi, dword [ebp - 0x270]
lea edx, [ebp - 0x254]
push edx
push 0x20019
push 0
push 0x1263590
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x11f47d7
lea eax, [ebp - 0x25c]
push eax
mov eax, dword [ebp - 0x254]
lea ecx, [ebp - 0x260]
push ecx
lea edx, [ebp - 0x264]
push edx
push 0
push 0x1263570
push eax
mov dword [ebp - 0x25c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x254]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x11f47d7
mov eax, dword [ebp - 0x260]
test eax, eax
je 0x11f47d7
push eax
push 0x1263454
mov eax, 0x190
lea ebx, [ebp - 0x1a4]
call fcn.011f3130
add esp, 8
push 0x126325c
push ecx
mov edx, ebx
push edx
push ecx
push 0x1263600
push edi
call fcn.01204730
add esp, 0xc
push eax
call fcn.01204730
add esp, 0xc
push eax
call fcn.01204730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor ebx, ebx
test byte [eax + esi + 0xc], 6
jne 0x11f47b0
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x11f47b0
mov ebx, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test ebx, ebx
je 0x11f47d1
mov eax, dword [ecx + 0xc]
or eax, ebx
cmp dword [ecx + 0x38], 0
jne 0x11f47c9
or eax, 4
push 0
push eax
call fcn.011f2d10
inc dword [ebp - 0x258]
lea edx, [ebp - 0x254]
push edx
push 0x20019
push 0
push 0x1263590
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x11f48e6
lea eax, [ebp - 0x25c]
push eax
mov eax, dword [ebp - 0x254]
lea ecx, [ebp - 0x260]
push ecx
lea edx, [ebp - 0x264]
push edx
push 0
push 0x12636ec
push eax
mov dword [ebp - 0x25c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x254]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x11f48e6
mov eax, dword [ebp - 0x260]
test eax, eax
je 0x11f48e6
push eax
push 0x1263454
mov eax, 0x190
lea ebx, [ebp - 0x1a4]
call fcn.011f3130
add esp, 8
push 0x126325c
push ecx
mov edx, ebx
push edx
push ecx
push 0x1263700
push edi
call fcn.01204730
add esp, 0xc
push eax
call fcn.01204730
add esp, 0xc
push eax
call fcn.01204730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor ebx, ebx
test byte [eax + esi + 0xc], 6
jne 0x11f48bf
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x11f48bf
mov ebx, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test ebx, ebx
je 0x11f48e0
mov eax, dword [ecx + 0xc]
or eax, ebx
cmp dword [ecx + 0x38], 0
jne 0x11f48d8
or eax, 4
push 0
push eax
call fcn.011f2d10
inc dword [ebp - 0x258]
lea edx, [ebp - 0x254]
push edx
push 0x20019
push 0
push 0x12637e8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x11f49f5
lea eax, [ebp - 0x25c]
push eax
mov eax, dword [ebp - 0x254]
lea ecx, [ebp - 0x260]
push ecx
lea edx, [ebp - 0x264]
push edx
push 0
push 0x12636ec
push eax
mov dword [ebp - 0x25c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x254]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x11f49f5
mov eax, dword [ebp - 0x260]
test eax, eax
je 0x11f49f5
push eax
push 0x1263454
mov eax, 0x190
lea ebx, [ebp - 0x1a4]
call fcn.011f3130
add esp, 8
push 0x126325c
push ecx
mov edx, ebx
push edx
push ecx
push 0x1263860
push edi
call fcn.01204730
add esp, 0xc
push eax
call fcn.01204730
add esp, 0xc
push eax
call fcn.01204730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor ebx, ebx
test byte [eax + esi + 0xc], 6
jne 0x11f49ce
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x11f49ce
mov ebx, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test ebx, ebx
je 0x11f49ef
mov eax, dword [ecx + 0xc]
or eax, ebx
cmp dword [ecx + 0x38], 0
jne 0x11f49e7
or eax, 4
push 0
push eax
call fcn.011f2d10
inc dword [ebp - 0x258]
mov edx, dword [ebp - 0x268]
push edx
call fcn.011fce90
add esp, 4
test eax, eax
jne 0x11f4b1b
lea eax, [ebp - 0x254]
push eax
push 0x20019
push 0
push 0x1263978
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x11f4b1b
lea ecx, [ebp - 0x268]
push ecx
mov ecx, dword [ebp - 0x254]
lea edx, [ebp - 0x260]
push edx
lea eax, [ebp - 0x264]
push eax
push 0
push 0x1263950
push ecx
mov dword [ebp - 0x268], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 0x254]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x11f4b1b
mov eax, dword [ebp - 0x260]
test eax, eax
je 0x11f4b1b
push eax
push 0x1263454
mov eax, 0x190
lea ebx, [ebp - 0x1a4]
call fcn.011f3130
add esp, 8
push 0x126325c
push ecx
mov eax, ebx
push eax
push ecx
push 0x12639c0
push edi
call fcn.01204730
add esp, 0xc
push eax
call fcn.01204730
add esp, 0xc
push eax
call fcn.01204730
mov esi, eax
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
add esp, 8
xor ebx, ebx
test byte [eax + esi + 0xc], 6
jne 0x11f4af4
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x11f4af4
mov ebx, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test ebx, ebx
je 0x11f4b15
mov eax, dword [ecx + 0xc]
or eax, ebx
cmp dword [ecx + 0x38], 0
jne 0x11f4b0d
or eax, 4
push 0
push eax
call fcn.011f2d10
inc dword [ebp - 0x258]
lea edx, [ebp - 0x254]
push edx
push 0x20019
push 0
push 0x1263a98
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x11f4c2a
lea eax, [ebp - 0x268]
push eax
mov eax, dword [ebp - 0x254]
lea ecx, [ebp - 0x260]
push ecx
lea edx, [ebp - 0x264]
push edx
push 0
push 0x1263950
push eax
mov dword [ebp - 0x268], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x254]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x11f4c2a
mov eax, dword [ebp - 0x260]
test eax, eax
je 0x11f4c2a
push eax
push 0x1263454
mov eax, 0x190
lea ebx, [ebp - 0x1a4]
call fcn.011f3130
add esp, 8
push 0x126325c
push ecx
mov edx, ebx
push edx
push ecx
push 0x1263af8
push edi
call fcn.01204730
add esp, 0xc
push eax
call fcn.01204730
add esp, 0xc
push eax
call fcn.01204730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor ebx, ebx
test byte [eax + esi + 0xc], 6
jne 0x11f4c03
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x11f4c03
mov ebx, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test ebx, ebx
je 0x11f4c24
mov eax, dword [ecx + 0xc]
or eax, ebx
cmp dword [ecx + 0x38], 0
jne 0x11f4c1c
or eax, 4
push 0
push eax
call fcn.011f2d10
inc dword [ebp - 0x258]
lea edx, [ebp - 0x254]
push edx
push 0x20019
push 0
push 0x1263c18
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x11f4d39
lea eax, [ebp - 0x268]
push eax
mov eax, dword [ebp - 0x254]
lea ecx, [ebp - 0x260]
push ecx
lea edx, [ebp - 0x264]
push edx
push 0
push 0x1263be4
push eax
mov dword [ebp - 0x268], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x254]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x11f4d39
mov eax, dword [ebp - 0x260]
test eax, eax
je 0x11f4d39
push eax
push 0x1263454
mov eax, 0x190
lea ebx, [ebp - 0x1a4]
call fcn.011f3130
add esp, 8
push 0x126325c
push ecx
mov edx, ebx
push edx
push ecx
push 0x1263ca0
push edi
call fcn.01204730
add esp, 0xc
push eax
call fcn.01204730
add esp, 0xc
push eax
call fcn.01204730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor ebx, ebx
test byte [eax + esi + 0xc], 6
jne 0x11f4d12
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x11f4d12
mov ebx, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test ebx, ebx
je 0x11f4d33
mov eax, dword [ecx + 0xc]
or eax, ebx
cmp dword [ecx + 0x38], 0
jne 0x11f4d2b
or eax, 4
push 0
push eax
call fcn.011f2d10
inc dword [ebp - 0x258]
lea edx, [ebp - 0x254]
push edx
push 0x20019
push 0
push 0x1263e10
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x11f4e46
lea eax, [ebp - 0x268]
push eax
mov eax, dword [ebp - 0x254]
lea ecx, [ebp - 0x260]
push ecx
lea edx, [ebp - 0x264]
push edx
push 0
push 0x1263dec
push eax
mov dword [ebp - 0x268], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x254]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x11f4e46
cmp dword [ebp - 0x260], esi
jne 0x11f4e46
push esi
push 0x1263454
mov eax, 0x190
lea ebx, [ebp - 0x1a4]
call fcn.011f3130
add esp, 8
push 0x126325c
push ecx
mov edx, ebx
push edx
push ecx
push 0x1263e88
push edi
call fcn.01204730
add esp, 0xc
push eax
call fcn.01204730
add esp, 0xc
push eax
call fcn.01204730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor ebx, ebx
test byte [eax + esi + 0xc], 6
jne 0x11f4e1f
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x11f4e1f
mov ebx, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test ebx, ebx
je 0x11f4e40
mov eax, dword [ecx + 0xc]
or eax, ebx
cmp dword [ecx + 0x38], 0
jne 0x11f4e38
or eax, 4
push 0
push eax
call fcn.011f2d10
inc dword [ebp - 0x258]
lea edx, [ebp - 0x254]
push edx
push 0x20019
push 0
push 0x1263f88
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x11f4f53
lea eax, [ebp - 0x268]
push eax
mov eax, dword [ebp - 0x254]
lea ecx, [ebp - 0x260]
push ecx
lea edx, [ebp - 0x264]
push edx
push 0
push 0x1263dec
push eax
mov dword [ebp - 0x268], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x254]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x11f4f53
cmp dword [ebp - 0x260], esi
jne 0x11f4f53
push esi
push 0x1263454
mov eax, 0x190
lea ebx, [ebp - 0x1a4]
call fcn.011f3130
add esp, 8
push 0x126325c
push ecx
mov edx, ebx
push edx
push ecx
push 0x1264040
push edi
call fcn.01204730
add esp, 0xc
push eax
call fcn.01204730
add esp, 0xc
push eax
call fcn.01204730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor ebx, ebx
test byte [eax + esi + 0xc], 6
jne 0x11f4f2c
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x11f4f2c
mov ebx, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test ebx, ebx
je 0x11f4f4d
mov eax, dword [ecx + 0xc]
or eax, ebx
cmp dword [ecx + 0x38], 0
jne 0x11f4f45
or eax, 4
push 0
push eax
call fcn.011f2d10
inc dword [ebp - 0x258]
mov edi, 8
cmp dword [ebp - 0x1e4], edi
jb 0x11f4f6f
mov edx, dword [ebp - 0x1f8]
push edx
call fcn.0123e60d
add esp, 4
xor ebx, ebx
xor eax, eax
mov esi, 7
mov dword [ebp - 0x1e4], esi
mov dword [ebp - 0x1e8], ebx
mov word [ebp - 0x1f8], ax
cmp dword [ebp - 0x21c], edi
jb 0x11f4fa2
mov ecx, dword [ebp - 0x230]
push ecx
call fcn.0123e60d
add esp, 4
xor edx, edx
mov dword [ebp - 0x21c], esi
mov dword [ebp - 0x220], ebx
mov word [ebp - 0x230], dx
cmp dword [ebp - 0x1c8], edi
jb 0x11f4fce
mov eax, dword [ebp - 0x1dc]
push eax
call fcn.0123e60d
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x1c8], esi
mov dword [ebp - 0x1cc], ebx
mov word [ebp - 0x1dc], cx
cmp dword [ebp - 0x200], edi
jb 0x11f4ffa
mov edx, dword [ebp - 0x214]
push edx
call fcn.0123e60d
add esp, 4
xor eax, eax
mov dword [ebp - 0x200], esi
mov dword [ebp - 0x204], ebx
mov word [ebp - 0x214], ax
cmp dword [ebp - 0x1ac], edi
jb 0x11f5026
mov ecx, dword [ebp - 0x1c0]
push ecx
call fcn.0123e60d
add esp, 4
mov eax, dword [ebp - 0x258]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0123e488
mov esp, ebp
pop ebp
ret