Function at 0x10063431
Capabilities:
Encode data using base64
Parse credit card information
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x94
push ebx
push esi
push edi
mov dword [ebp + 0x18], ecx
push ecx
lea ecx, [ebp - 0x24]
call fcn.10048516
mov eax, dword [ebp + 0x78]
xor ebx, ebx
mov dword [ebp + 0x20], eax
lea eax, [ebp + 0x78]
push eax
mov byte [ebp + 0x32], 0xff
mov byte [ebp + 0x66], bl
mov byte [ebp + 0x53], bl
mov byte [ebp + 0x43], bl
mov dword [ebp - 8], ebx
call fcn.1003f9c4
push 0xa
lea eax, [ebp + 0x78]
push eax
push str.___initram
call fcn.10048195
add esp, 0x10
test al, al
jne 0x1006395c
mov dword [ebp + 0x68], ebx
mov esi, dword [ebp + 0x78]
mov ax, word [esi]
cmp ax, 0x2d
mov dword [ebp + 0x54], ebx
mov dword [ebp + 0x58], 0xfffffff0
mov byte [ebp + 0x6f], 0
mov byte [ebp + 0x63], 0
mov byte [ebp + 0x65], 0
mov byte [ebp + 0x67], 0
mov byte [ebp + 0x26], 0
mov byte [ebp + 0x64], 0
mov byte [ebp + 0x25], 0
mov byte [ebp + 0x27], 0
mov dword [ebp + 0x48], ebx
mov cl, 0x2a
jne 0x100634c7
mov cl, al
movsx ecx, cl
movzx eax, ax
cmp ecx, eax
mov dword [ebp + 0x14], ecx
jne 0x1006375a
movzx eax, word [esi + 2]
cmp dword [ebp + 0x14], eax
jne 0x1006375a
xor eax, eax
lea ecx, [esi + 4]
mov ax, word [ecx]
mov edx, eax
and dx, 0xffdf
cmp dx, 0x48
je 0x1006375a
call fcn.10002df6
test al, al
jne 0x1006375a
xor edi, edi
mov esi, ecx
inc edi
push edi
push esi
push 0x100d05d0
mov dword [ebp + 0x78], esi
call fcn.10040df5
add esp, 0xc
test al, al
je 0x1006356f
lea eax, [ebp + 0x78]
add esi, 2
push eax
mov dword [ebp + 0x28], esi
call fcn.10008e60
cmp word [esi], 0x3a
pop ecx
je 0x10063545
or dword [ebp + 0x48], 7
jmp 0x1006374b
lea eax, [ebp + 0x4c]
push eax
inc esi
lea eax, [ebp + 0x28]
inc esi
push eax
mov dword [ebp + 0x4c], ebx
mov dword [ebp + 0x28], esi
call fcn.10042554
test eax, eax
pop ecx
pop ecx
jle 0x1006374b
mov eax, dword [ebp + 0x4c]
or dword [ebp + 0x48], eax
jmp 0x1006374b
push 2
push esi
push 0x100d05cc
call fcn.10040df5
add esp, 0xc
test al, al
lea eax, [ebp + 0x78]
je 0x100635bb
add esi, 4
push eax
mov dword [ebp + 0xc], esi
call fcn.10008e60
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp + 0xc]
push eax
mov dword [ebp + 0x4c], ebx
call fcn.10053a89
add esp, 0xc
test eax, eax
jle 0x1006374b
mov eax, dword [ebp + 0x4c]
mov dword [ebp + 0x54], eax
mov dword [ebp + 0x58], ebx
jmp 0x1006374b
push 2
pop esi
push esi
push eax
push 0x100cc5c4
call fcn.10048195
add esp, 0xc
test al, al
je 0x100635da
mov byte [ebp + 0x65], 1
jmp 0x1006374b
push 3
lea eax, [ebp + 0x78]
push eax
push 0x100d05c8
call fcn.10048195
add esp, 0xc
test al, al
je 0x100635fa
mov byte [ebp + 0x43], 1
jmp 0x1006374b
push 4
lea eax, [ebp + 0x78]
push eax
push 0x100d05c0
call fcn.10048195
add esp, 0xc
test al, al
je 0x1006361a
mov byte [ebp + 0x64], 1
jmp 0x1006374b
push edi
lea eax, [ebp + 0x78]
push eax
push 0x100ca818
call fcn.10048195
add esp, 0xc
test al, al
je 0x10063639
mov byte [ebp + 0x67], 3
jmp 0x1006374b
push esi
lea eax, [ebp + 0x78]
push eax
push 0x100d05bc
call fcn.10048195
add esp, 0xc
test al, al
je 0x10063658
or byte [ebp + 0x67], 1
jmp 0x1006374b
push esi
lea eax, [ebp + 0x78]
push eax
push 0x100d05b8
call fcn.10048195
add esp, 0xc
test al, al
je 0x10063677
or byte [ebp + 0x67], 2
jmp 0x1006374b
push 4
lea eax, [ebp + 0x78]
push eax
push str.name
call fcn.10048195
add esp, 0xc
test al, al
je 0x10063697
mov byte [ebp + 0x26], 1
jmp 0x1006374b
push edi
lea eax, [ebp + 0x78]
push eax
push 0x100d05ac
call fcn.10048195
add esp, 0xc
test al, al
je 0x100636b5
inc byte [ebp + 0x66]
jmp 0x1006374b
push esi
lea eax, [ebp + 0x78]
push eax
push 0x100d05a8
call fcn.10048195
add esp, 0xc
test al, al
je 0x100636d0
dec byte [ebp + 0x66]
jmp 0x1006374b
push edi
lea eax, [ebp + 0x78]
push eax
push 0x100d05a4
call fcn.10048195
add esp, 0xc
test al, al
je 0x100636eb
inc byte [ebp + 0x53]
jmp 0x1006374b
push esi
lea eax, [ebp + 0x78]
push eax
push 0x100d05a0
call fcn.10048195
add esp, 0xc
test al, al
je 0x10063707
mov byte [ebp + 0x25], 1
jmp 0x1006374b
push 4
lea eax, [ebp + 0x78]
push eax
push 0x100d0598
call fcn.10048195
add esp, 0xc
test al, al
je 0x10063724
mov byte [ebp + 0x27], 1
jmp 0x1006374b
push esi
lea eax, [ebp + 0x78]
push eax
push 0x100c7ed8
call fcn.10048195
add esp, 0xc
test al, al
je 0x10063741
call fcn.10043e72
jmp 0x1006374b
lea eax, [ebp + 0x78]
push eax
call fcn.10008e60
pop ecx
mov esi, dword [ebp + 0x78]
movzx eax, word [esi]
cmp dword [ebp + 0x14], eax
je 0x100634d8
lea ecx, [ebp + 8]
call fcn.10046123
lea ecx, [ebp - 0x14]
call fcn.10046123
lea ecx, [ebp + 0x10]
call fcn.10046123
lea ecx, [ebp + 4]
call fcn.10046123
lea ecx, [ebp - 4]
call fcn.10046123
xor eax, eax
mov ax, word [esi]
mov ecx, eax
or ecx, 0x20
cmp cx, 0x6e
je 0x100637d4
cmp cx, 0x75
je 0x100637d4
cmp cx, 0x62
je 0x100637d4
cmp ax, 0x5e
je 0x100637d4
cmp ax, 0x2b
je 0x100637d4
cmp ax, 0x23
je 0x100637d4
cmp ax, 0x40
je 0x100637d4
cmp ax, 0x24
je 0x100637d4
cmp ax, 0x2a
je 0x100637d4
cmp ax, 0x7e
je 0x100637d4
cmp ax, 0x2e
je 0x100637d4
cmp ax, 0x3f
jne 0x100637ed
mov al, byte [esi]
inc esi
inc esi
test al, al
mov byte [ebp + 0x6f], al
mov dword [ebp + 0x78], esi
je 0x100637ed
movzx eax, word [esi]
movsx ecx, byte [ebp + 0x6f]
cmp ecx, eax
je 0x100637f3
cmp word [esi], 0x24
jne 0x100637fd
mov al, byte [esi]
inc esi
inc esi
mov byte [ebp + 0x63], al
mov dword [ebp + 0x78], esi
cmp byte [ebp + 0x6f], 0x41
jl 0x1006380d
cmp byte [ebp + 0x6f], 0x5a
jg 0x1006380d
or byte [ebp + 0x6f], 0x20
lea eax, [ebp + 0x78]
push eax
call fcn.1003f9c4
mov edi, dword [ebp + 0x78]
mov dword [esp], 0x100d0590
push edi
mov dword [ebp + 0x4c], edi
call dword [sym.imp.SHLWAPI.dll_StrStrW]
mov esi, eax
cmp esi, ebx
je 0x10063833
lea edi, [esi + 4]
mov edx, edi
mov dword [ebp + 0x3c], edx
cmp word [edi], bx
je 0x100638c6
mov ax, word [edx]
cmp ax, 0x2c
je 0x1006387d
cmp ax, 0x3d
je 0x100638c6
cmp ax, 0x21
jne 0x10063871
lea eax, [edx + 2]
mov dword [ebp + 0x28], eax
lea eax, [ebp + 0x28]
push eax
call fcn.1003f9c4
mov eax, dword [ebp + 0x28]
cmp word [eax], bx
pop ecx
je 0x100638c6
lea edx, [eax - 2]
inc edx
inc edx
mov dword [ebp + 0x3c], edx
cmp word [edx], bx
jne 0x10063841
jmp 0x100638c6
add edx, 2
push 0x3d
push edx
call dword [sym.imp.SHLWAPI.dll_StrChrW]
cmp eax, ebx
je 0x10063891
mov edx, eax
jmp 0x100638be
mov eax, dword [ebp + 0x3c]
add eax, 2
push 0x21
push eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov edx, eax
cmp edx, ebx
je 0x100638c3
lea eax, [edx + 2]
mov dword [ebp + 0x28], eax
lea eax, [ebp + 0x28]
push eax
call fcn.1003f9c4
mov eax, dword [ebp + 0x28]
cmp word [eax], bx
pop ecx
jne 0x100638c3
mov dword [ebp + 0x3c], edx
jmp 0x100638c6
mov edx, dword [ebp + 0x3c]
mov ax, word [edx]
cmp ax, 0x2c
je 0x100638db
cmp ax, 0x3d
je 0x100638db
cmp ax, 0x21
jne 0x100638ef
mov al, byte [edx]
mov word [edx], bx
add dword [ebp + 0x3c], 2
test al, al
mov byte [ebp + 0x33], al
jne 0x10063975
inc byte [ebp + 0x32]
cmp byte [ebp + 0x32], 0
jg 0x1006396b
mov ecx, dword [ebp + 0x18]
push 1
push ebx
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x20]
call fcn.10058f7c
mov eax, dword [ebp - 8]
lea ecx, [ebp - 4]
mov dword [ebp + 0x78], eax
call fcn.1003f96c
lea ecx, [ebp + 4]
call fcn.1003f96c
lea ecx, [ebp + 0x10]
call fcn.1003f96c
lea ecx, [ebp - 0x14]
call fcn.1003f96c
lea ecx, [ebp + 8]
call fcn.1003f96c
lea eax, [ebp + 0x78]
push eax
call fcn.1003f9c4
push 0xa
lea eax, [ebp + 0x78]
push eax
push str.___initram
call fcn.10048195
add esp, 0x10
test al, al
je 0x1006348a
push 3
call fcn.10012ea8
pop ecx
xor esi, esi
jmp 0x100649e0
mov esi, 0x80070057
jmp 0x100649b8
cmp esi, ebx
mov dword [ebp - 0xc], ebx
jne 0x1006398e
push 0x5c
push ebx
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_StrRChrW]
call edi
mov esi, eax
cmp esi, ebx
je 0x100639de
mov ecx, dword [ebp + 0x18]
push 1
push ebx
lea eax, [ebp + 8]
mov word [esi], bx
push eax
push dword [ebp + 0x78]
inc esi
inc esi
call fcn.10058f7c
mov eax, dword [ebp + 8]
push 0x5c
push eax
mov dword [ebp + 0x4c], eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
cmp eax, ebx
mov dword [ebp + 0x5c], eax
je 0x100639c3
mov word [eax], bx
inc eax
inc eax
mov dword [ebp + 0x5c], eax
mov ecx, dword [ebp + 0x18]
push 1
push ebx
lea eax, [ebp - 0xc]
push eax
push esi
call fcn.10058f7c
mov eax, dword [ebp - 0xc]
mov dword [ebp + 0x34], eax
jmp 0x10063a67
push 1
push 0x2c
lea eax, [ebp + 0x4c]
push eax
lea ecx, [ebp - 0x24]
call fcn.1005b693
push ebx
lea ecx, [ebp + 8]
push ecx
push eax
call fcn.1004907a
mov eax, dword [ebp + 8]
add esp, 0xc
push 0x5c
push eax
mov dword [ebp + 0x4c], eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov esi, eax
cmp esi, ebx
jne 0x10063a1b
mov esi, 0x80070057
jmp 0x100649b0
mov word [esi], bx
inc esi
inc esi
push 0x100d0590
push esi
mov dword [ebp + 0x5c], esi
call dword [sym.imp.SHLWAPI.dll_StrStrW]
cmp byte [ebp + 0x67], 0
mov dword [ebp + 0x34], eax
je 0x10063a49
cmp eax, ebx
jne 0x10063a5a
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esi + eax*2]
mov dword [ebp + 0x34], eax
cmp eax, ebx
jne 0x10063a5a
push 0x5c
push ebx
push esi
call edi
cmp eax, ebx
mov dword [ebp + 0x34], eax
je 0x10063a11
cmp word [eax], bx
je 0x10063a67
mov word [eax], bx
inc eax
inc eax
mov dword [ebp + 0x34], eax
cmp word [eax], 0x5c
jne 0x10063a72
inc eax
inc eax
mov dword [ebp + 0x34], eax
cmp byte [ebp + 0x26], 0
mov dword [ebp + 0x28], ebx
je 0x10063a96
lea eax, [ebp + 0x28]
push eax
lea eax, [ebp + 0x3c]
push eax
push dword [ebp + 0x18]
call fcn.100577e5
mov eax, dword [ebp + 0x28]
add esp, 0xc
mov dword [ebp + 0x3c], eax
jmp 0x10063a99
mov eax, dword [ebp + 0x3c]
cmp byte [ebp + 0x33], 0x2c
jne 0x10063b2a
push 1
push 0x2c
lea eax, [ebp + 0x3c]
push eax
lea ecx, [ebp - 0x24]
call fcn.1005b693
push ebx
lea ecx, [ebp + 0x10]
push ecx
push eax
call fcn.1004907a
mov ecx, dword [ebp + 0x18]
add esp, 0xc
push ebx
lea eax, [ebp + 0x10]
push eax
call fcn.10002f54
cmp byte [ebp + 0x6f], 0x2e
jne 0x10063b0c
mov eax, dword [ebp + 0x3c]
cmp word [eax], 0x2c
jne 0x10063b0c
add dword [ebp + 0x3c], 2
push 1
push 0x2c
lea eax, [ebp + 0x3c]
push eax
lea ecx, [ebp - 0x24]
call fcn.1005b693
push ebx
lea ecx, [ebp - 4]
push ecx
push eax
call fcn.1004907a
mov ecx, dword [ebp + 0x18]
add esp, 0xc
push ebx
lea eax, [ebp - 4]
push eax
call fcn.10002f54
mov eax, dword [ebp + 0x10]
cmp word [eax], bx
jne 0x10063c23
push str.RegDat
lea ecx, [ebp + 0x10]
call fcn.1005026c
jmp 0x10063c23
cmp byte [ebp + 0x33], 0x21
je 0x10063c23
cmp word [eax], bx
jne 0x10063b5d
cmp byte [ebp + 0x6f], 0x24
je 0x10063b7c
cmp byte [ebp + 0x6f], 0x2a
je 0x10063b5d
cmp byte [ebp + 0x6f], 0x7e
je 0x10063b5d
cmp byte [ebp + 0x53], 0
je 0x10063c23
mov dword [ebp + 0x68], eax
jmp 0x10063c23
cmp byte [ebp + 0x6f], 0x24
je 0x10063b7c
cmp byte [ebp + 0x6f], 0x2a
je 0x10063b7c
cmp byte [ebp + 0x6f], 0x7e
je 0x10063b7c
lea eax, [ebp + 0x3c]
push eax
call fcn.1003f9c4
mov eax, dword [ebp + 0x3c]
pop ecx
push eax
lea ecx, [ebp + 0x14]
call fcn.100501eb
mov edx, dword [ebp + 0x14]
lea eax, [ebp + 0x78]
push eax
mov dword [ebp + 0x78], edx
call fcn.1003f9c4
cmp byte [ebp + 0x7c], 0
pop ecx
je 0x10063ba6
push edx
lea ecx, [ebp + 4]
call fcn.1005026c
jmp 0x10063bb6
mov ecx, dword [ebp + 0x18]
push 1
push ebx
lea eax, [ebp + 4]
push eax
push edx
call fcn.10057b62
mov eax, dword [ebp + 4]
mov dword [ebp + 0x68], eax
mov dword [ebp + 0x7c], eax
lea eax, [ebp + 0x7c]
push eax
call fcn.1003f9c4
cmp byte [ebp + 0x6f], 0
pop ecx
jne 0x10063c01
push dword [ebp + 0x78]
push 0x100d0578
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x10063bea
mov dword [ebp + 0x68], 0x100c6a64
jmp 0x10063c1b
mov ecx, dword [ebp + 0x7c]
mov ax, word [ecx]
cmp ax, 0x23
je 0x10063bfc
cmp ax, 0x40
jne 0x10063c1b
mov dword [ebp + 0x68], ecx
jmp 0x10063c1b
cmp byte [ebp + 0x6f], 0x23
je 0x10063c0d
cmp byte [ebp + 0x6f], 0x40
jne 0x10063c1b
mov eax, dword [ebp + 0x7c]
cmp word [eax], bx
mov dword [ebp + 0x68], eax
jne 0x10063c1b
mov dword [ebp + 0x68], ebx
lea ecx, [ebp + 0x14]
call fcn.1003f96c
mov edi, dword [ebp + 0x4c]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str.HKLM
push edi
mov dword [ebp + 0x78], ebx
call esi
test eax, eax
je 0x10063cfd
push str.HKEY_LOCAL_MACHINE
push edi
call esi
test eax, eax
je 0x10063cfd
push str.HKCU
push edi
call esi
test eax, eax
je 0x10063cf4
push str.HKEY_CURRENT_USER
push edi
call esi
test eax, eax
je 0x10063cf4
push str.HKCR
push edi
call esi
test eax, eax
je 0x10063ceb
push str.HKEY_CLASSES_ROOT
push edi
call esi
test eax, eax
je 0x10063ceb
push 0x100d04dc
push edi
call esi
test eax, eax
je 0x10063ce2
push str.HKEY_USERS
push edi
call esi
test eax, eax
je 0x10063ce2
push str.HKCC
push edi
call esi
test eax, eax
je 0x10063cd9
push str.HKEY_CURRENT_CONFIG
push edi
call esi
test eax, eax
je 0x10063cd9
lea eax, [ebp + 0x78]
push eax
lea eax, [ebp + 0x4c]
push eax
call fcn.10049634
test eax, eax
pop ecx
pop ecx
je 0x10063ccf
cmp dword [ebp + 0x78], ebx
jne 0x10063d04
mov esi, 0x80070057
jmp 0x100649a8
mov dword [ebp + 0x78], 0x80000005
jmp 0x10063d04
mov dword [ebp + 0x78], 0x80000003
jmp 0x10063d04
mov dword [ebp + 0x78], 0x80000000
jmp 0x10063d04
mov dword [ebp + 0x78], 0x80000001
jmp 0x10063d04
mov dword [ebp + 0x78], 0x80000002
mov eax, dword [ebp + 0x10]
cmp word [eax], bx
je 0x10064448
cmp byte [ebp + 0x6f], 0x2e
je 0x10063d1f
cmp byte [ebp + 0x6f], 0x3f
mov dword [ebp + 0x38], ebx
jne 0x10063d2c
cmp byte [ebp + 0x6f], 0x3f
mov dword [ebp + 0x38], 1
je 0x10063d3b
cmp dword [ebp + 0x38], ebx
je 0x10063d36
cmp word [eax], bx
je 0x10063d3b
mov dword [ebp + 0x48], ebx
jmp 0x10063d42
mov dword [ebp + 0x48], 1
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x64
lea ecx, [ebp + 0x68]
mov dword [ebp + 0xc], ebx
call fcn.10046141
lea ecx, [ebp + 0x4c]
call fcn.10046123
cmp byte [ebp + 0x6f], 0x2e
lea eax, [ebp + 0x4c]
je 0x10063d6a
lea eax, [ebp + 0x68]
push 0x1000
lea ecx, [ebp + 0x44]
mov dword [ebp + 0x2c], eax
call fcn.10045fcc
cmp byte [ebp + 0x67], 0
lea eax, [ebp + 0x7c]
mov dword [ebp], 0xfff
mov dword [ebp + 0x7c], ebx
mov dword [ebp + 0x20], ebx
push eax
je 0x10063f13
movzx eax, word [0x100e2c20]
or eax, 9
push eax
push ebx
push dword [ebp + 0x5c]
mov dword [ebp + 0x34], ebx
push dword [ebp + 0x78]
mov dword [ebp + 0x38], ebx
mov dword [ebp + 0x48], ebx
mov dword [ebp + 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp + 0x7c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push ebx
push ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp + 0x48]
push eax
lea eax, [ebp + 0x38]
push eax
push ebx
push ebx
push ebx
push dword [ebp + 0x7c]
call esi
push ebx
push ebx
push ebx
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 0x14]
push eax
push ebx
lea eax, [ebp + 0x48]
push eax
lea eax, [ebp + 0x38]
push eax
push ebx
push ebx
push ebx
push dword [ebp + 0x7c]
call esi
mov dword [ebp + 0x78], eax
mov eax, dword [ebp - 0x18]
cmp dword [ebp + 0x48], eax
jae 0x10063e05
mov dword [ebp + 0x48], eax
mov eax, dword [ebp + 0x48]
lea eax, [eax*4 + 0x20]
mov dword [ebp - 0x10], eax
shr eax, 1
add eax, 8
push eax
lea ecx, [ebp + 0x58]
call fcn.10046141
mov esi, dword [ebp + 0x58]
mov word [esi], 0xd
mov word [esi + 2], 0xa
lea ebx, [esi + 4]
mov word [ebx], 0x76
lea edi, [esi + 8]
mov word [esi + 6], 0x20
and word [edi], 0
cmp byte [ebp + 0x67], 3
mov dword [ebp + 0x5c], ebx
je 0x10063e4e
mov edi, ebx
cmp dword [ebp + 0x78], 0
jne 0x10063ef7
test byte [ebp + 0x67], 1
je 0x10063ea5
and dword [ebp + 0x78], 0
cmp dword [ebp + 0x14], 0
jle 0x10063ea5
mov eax, dword [ebp - 0x10]
mov dword [ebp + 0x34], eax
xor eax, eax
push eax
push eax
push eax
push eax
mov word [edi], ax
lea eax, [ebp + 0x34]
push eax
push edi
push dword [ebp + 0x78]
push dword [ebp + 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x10063e9a
push dword [ebp + 0x5c]
lea ecx, [ebp + 0x68]
call fcn.1004618f
mov dword [ebp + 0x5c], esi
inc dword [ebp + 0x78]
mov eax, dword [ebp + 0x78]
cmp eax, dword [ebp + 0x14]
jl 0x10063e68
test byte [ebp + 0x67], 2
mov word [ebx], 0x6b
je 0x10063ef7
and dword [ebp + 0x78], 0
cmp dword [ebp + 0x38], 0
jle 0x10063ef7
xor ebx, ebx
mov eax, dword [ebp - 0x10]
push ebx
push ebx
push ebx
push ebx
mov dword [ebp + 0x34], eax
lea eax, [ebp + 0x34]
push eax
push edi
push dword [ebp + 0x78]
mov word [edi], bx
push dword [ebp + 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x10063eec
push dword [ebp + 0x5c]
lea ecx, [ebp + 0x68]
call fcn.1004618f
mov dword [ebp + 0x5c], esi
inc dword [ebp + 0x78]
mov eax, dword [ebp + 0x78]
cmp eax, dword [ebp + 0x38]
jl 0x10063ebc
cmp dword [ebp + 0x7c], 0
je 0x10063f06
push dword [ebp + 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 0x58]
call fcn.1003f96c
jmp 0x100643f5
lea eax, [ebp]
push eax
lea eax, [ebp + 0x44]
push eax
push dword [ebp + 0x34]
push dword [ebp + 0x5c]
push dword [ebp + 0x78]
call fcn.1004a913
mov esi, dword [ebp + 0x7c]
add esp, 0x18
cmp esi, ebx
mov edi, eax
je 0x10063fa0
mov eax, dword [ebp + 0x34]
cmp word [eax], bx
jne 0x10063f5b
cmp esi, 2
jne 0x10063f5b
cmp edi, 0xfffffffe
jne 0x10063f5b
cmp dword [ebp + 0x38], ebx
je 0x100643f7
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x100d048c
jmp 0x10063f6c
cmp dword [ebp + 0x38], ebx
mov dword [ebp + 0xc], esi
je 0x10063f79
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.ERROR
mov ecx, dword [ebp + 0x2c]
call fcn.100461de
jmp 0x100643f7
cmp byte [ebp + 0x27], 0
jne 0x100643f7
lea ecx, [ebp + 0x44]
call fcn.1003f96c
lea ecx, [ebp + 0x4c]
call fcn.1003f96c
lea ecx, [ebp + 0x68]
call fcn.1003f96c
jmp 0x100649a8
cmp dword [ebp + 0x58], ebx
jl 0x10063fc1
jg 0x10063fac
cmp dword [ebp + 0x54], ebx
jb 0x10063fc1
xor eax, eax
cmp dword [ebp + 0x54], edi
jne 0x10063fb8
cmp dword [ebp + 0x58], eax
je 0x10063fc1
mov dword [ebp + 0x5c], 1
jmp 0x10063fc4
mov dword [ebp + 0x5c], ebx
cmp edi, 1
mov byte [ebp + 0x7b], 0
mov byte [ebp + 0x7f], 0xff
mov eax, str.REG_SZ
jne 0x10063fde
mov bl, 0x24
mov byte [ebp + 0x7f], 0
jmp 0x10063ff8
cmp edi, 6
jne 0x10063fec
mov eax, str.REG_LINK
mov bl, 0x5e
jmp 0x10063ff8
cmp edi, 0x15
jne 0x1006404f
mov eax, str.REG_MUI_SZ
mov bl, 0x75
xor esi, esi
cmp dword [ebp + 0x38], esi
je 0x10064015
mov ecx, dword [ebp + 0x2c]
push 0xffffffffffffffff
push 0xffffffffffffffff
push eax
call fcn.100461de
cmp dword [ebp + 0x48], esi
jne 0x100643f5
cmp dword [ebp + 0x5c], esi
jne 0x10064384
cmp dword [ebp + 0x58], esi
jg 0x1006403e
jl 0x1006402a
cmp dword [ebp + 0x54], esi
jae 0x1006403e
mov al, byte [ebp + 0x6f]
cmp bl, al
je 0x1006403e
cmp al, 0x2e
je 0x1006403e
cmp byte [ebp + 0x7f], al
jne 0x10064384
mov eax, dword [ebp + 0x68]
mov ecx, dword [ebp + 0x44]
mov dword [ebp + 0x68], ecx
mov dword [ebp + 0x44], eax
jmp 0x100643f5
cmp edi, 0xb
jne 0x100640c1
cmp dword [ebp + 0x38], ebx
je 0x10064073
mov ecx, dword [ebp + 0x2c]
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_QWORD
call fcn.100461de
cmp dword [ebp + 0x48], ebx
jne 0x100643f5
cmp dword [ebp + 0x5c], ebx
jne 0x10064384
cmp dword [ebp + 0x58], ebx
jg 0x10064098
jl 0x10064088
cmp dword [ebp + 0x54], ebx
jae 0x10064098
cmp byte [ebp + 0x6f], 0x2b
je 0x10064098
cmp byte [ebp + 0x6f], 0x2e
jne 0x10064384
cmp byte [ebp + 0x43], 0
mov eax, str._I64u
jne 0x100640a8
mov eax, str.0x_I64x
push eax
mov eax, dword [ebp + 0x44]
push dword [eax + 4]
push dword [eax]
push dword [ebp + 0x68]
call fcn.100a0df8
add esp, 0x10
jmp 0x100643f5
cmp edi, 4
mov esi, dword [ebp + 0x44]
jne 0x1006410e
cmp dword [ebp + 0x38], ebx
je 0x100640e8
mov ecx, dword [ebp + 0x2c]
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_DWORD
call fcn.100461de
cmp dword [ebp + 0x48], ebx
jne 0x100643f5
cmp dword [ebp + 0x5c], ebx
jne 0x10064384
cmp dword [ebp + 0x58], ebx
jg 0x1006416d
jl 0x100640fd
cmp dword [ebp + 0x54], ebx
jae 0x1006416d
cmp byte [ebp + 0x6f], 0x23
je 0x1006416d
cmp byte [ebp + 0x6f], 0x2e
je 0x1006416d
jmp 0x10064384
cmp edi, 5
jne 0x10064191
cmp dword [ebp + 0x38], ebx
je 0x10064132
mov ecx, dword [ebp + 0x2c]
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_DWORD_BIG_ENDIAN
call fcn.100461de
cmp dword [ebp + 0x48], ebx
jne 0x100643f5
cmp dword [ebp + 0x5c], ebx
jne 0x10064384
cmp dword [ebp + 0x58], ebx
jg 0x10064157
jl 0x10064147
cmp dword [ebp + 0x54], ebx
jae 0x10064157
cmp byte [ebp + 0x6f], 0x62
je 0x10064157
cmp byte [ebp + 0x6f], 0x2e
jne 0x10064384
mov cl, byte [esi + 3]
mov al, byte [esi]
mov byte [esi], cl
mov byte [esi + 3], al
mov cl, byte [esi + 2]
mov al, byte [esi + 1]
mov byte [esi + 1], cl
mov byte [esi + 2], al
cmp byte [ebp + 0x43], 0
mov eax, 0x100cc934
jne 0x1006417d
mov eax, str.0x_lx
push dword [esi]
push eax
push dword [ebp + 0x68]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x100643f5
cmp edi, 2
jne 0x100641ff
cmp dword [ebp + 0x38], ebx
je 0x100641b5
mov ecx, dword [ebp + 0x2c]
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_EXPAND_SZ
call fcn.100461de
cmp dword [ebp + 0x48], ebx
jne 0x100643f5
cmp dword [ebp + 0x5c], ebx
jne 0x10064384
cmp dword [ebp + 0x58], ebx
jg 0x100641da
jl 0x100641ca
cmp dword [ebp + 0x54], ebx
jae 0x100641da
cmp byte [ebp + 0x6f], 0x7e
je 0x100641da
cmp byte [ebp + 0x6f], 0x2e
jne 0x10064384
cmp byte [ebp + 0x63], 0
je 0x1006403e
mov eax, dword [ebp + 0x44]
push 1
push ebx
lea ecx, [ebp + 0x68]
push ecx
mov ecx, dword [ebp + 0x18]
push eax
mov dword [ebp + 0x3c], eax
call fcn.10058f7c
jmp 0x100643f5
cmp edi, 7
jne 0x100642e2
cmp dword [ebp + 0x38], ebx
je 0x10064227
mov ecx, dword [ebp + 0x2c]
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_MULTI_SZ
call fcn.100461de
cmp dword [ebp + 0x48], ebx
jne 0x100643f5
cmp dword [ebp + 0x5c], ebx
jne 0x10064384
cmp dword [ebp + 0x58], ebx
jg 0x1006424c
jl 0x1006423c
cmp dword [ebp + 0x54], ebx
jae 0x1006424c
cmp byte [ebp + 0x6f], 0x2a
je 0x1006424c
cmp byte [ebp + 0x6f], 0x2e
jne 0x10064384
mov esi, dword [ebp]
shr esi, 1
lea eax, [esi*4 + 6]
push eax
lea ecx, [ebp + 0x68]
call fcn.10046168
mov ecx, dword [ebp + 0x44]
mov eax, dword [ebp + 0x68]
lea esi, [ecx + esi*2]
jmp 0x100642d6
cmp byte [ebp + 0x63], 0x2a
jne 0x1006429d
cmp word [ecx], 0x5c
jne 0x1006429d
lea edx, [ecx + 2]
mov di, word [edx]
cmp di, 0x30
je 0x1006428f
cmp di, 0x5c
je 0x1006428f
cmp di, bx
jne 0x1006429d
mov word [eax], 0x5c
mov ecx, edx
mov dx, word [ecx]
inc eax
inc eax
jmp 0x100642a5
mov dx, word [ecx]
cmp dx, bx
je 0x100642ae
mov word [eax], dx
inc eax
inc eax
inc ecx
inc ecx
jmp 0x100642d6
inc ecx
inc ecx
cmp byte [ebp + 0x63], 0x24
jne 0x100642c8
cmp ecx, esi
jae 0x100642da
mov word [eax], 0xd
inc eax
inc eax
mov word [eax], 0xa
jmp 0x100642d4
mov word [eax], 0x5c
inc eax
inc eax
mov word [eax], 0x30
inc eax
inc eax
cmp ecx, esi
jb 0x1006426c
mov word [eax], bx
jmp 0x100643f5
cmp edi, 3
jne 0x100642ee
mov eax, str.REG_BINARY
jmp 0x1006431b
cmp edi, ebx
jne 0x100642f9
mov eax, str.REG_NONE
jmp 0x1006431b
cmp edi, 8
jne 0x10064305
mov eax, str.REG_RESOURCE_LIST
jmp 0x1006431b
cmp edi, 9
jne 0x10064311
mov eax, str.REG_FULL_RESOURCE_DESCRIPTOR
jmp 0x1006431b
cmp edi, 0xa
jne 0x1006433c
mov eax, str.REG_RESOURCE_REQUIREMENTS_LIST
cmp dword [ebp + 0x38], ebx
je 0x10064336
mov ecx, dword [ebp + 0x2c]
push 0xffffffffffffffff
push 0xffffffffffffffff
push eax
call fcn.100461de
cmp dword [ebp + 0x48], ebx
jne 0x100643f5
mov byte [ebp + 0x7b], 0x40
jmp 0x10064367
cmp dword [ebp + 0x38], ebx
je 0x10064367
mov esi, dword [ebp + 0x2c]
push 0x32
mov ecx, esi
call fcn.10046168
push edi
push str.0x_lx
push dword [esi]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
cmp dword [ebp + 0x48], ebx
jne 0x100643f5
cmp dword [ebp + 0x58], ebx
jg 0x1006437f
jl 0x10064373
cmp dword [ebp + 0x54], ebx
jae 0x1006437f
mov al, byte [ebp + 0x6f]
cmp byte [ebp + 0x7b], al
je 0x1006437f
cmp al, 0x2e
jne 0x10064384
cmp dword [ebp + 0x5c], ebx
je 0x100643a1
lea ecx, [ebp + 0x44]
call fcn.1003f96c
lea ecx, [ebp + 0x4c]
call fcn.1003f96c
lea ecx, [ebp + 0x68]
call fcn.1003f96c
jmp 0x10063ccf
mov eax, dword [ebp]
lea eax, [eax + eax*4 + 7]
push eax
lea ecx, [ebp + 0x68]
call fcn.10046168
mov edi, dword [ebp + 0x68]
mov esi, dword [ebp + 0x44]
xor ebx, ebx
mov word [edi], bx
mov word [edi + 2], bx
cmp dword [ebp], ebx
mov dword [ebp + 0x20], 1
jle 0x100643f5
cmp byte [ebp + 0x43], 0
mov ecx, 0x100d0378
jne 0x100643dc
mov ecx, str._0x_02X
movzx eax, byte [esi]
push eax
push ecx
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
inc esi
inc ebx
add edi, 0xa
cmp ebx, dword [ebp]
jl 0x100643cc
xor ebx, ebx
mov eax, dword [ebp + 0x10]
cmp word [eax], bx
je 0x10064412
mov edx, dword [ebp + 0x68]
mov ecx, dword [ebp + 0x20]
lea ecx, [edx + ecx*2]
push ecx
mov ecx, dword [ebp + 0x18]
push eax
call fcn.100457c2
mov eax, dword [ebp - 4]
cmp word [eax], bx
je 0x10064428
mov ecx, dword [ebp + 0x2c]
push dword [ecx]
mov ecx, dword [ebp + 0x18]
push eax
call fcn.100457c2
lea ecx, [ebp + 0x44]
call fcn.1003f96c
lea ecx, [ebp + 0x4c]
call fcn.1003f96c
lea ecx, [ebp + 0x68]
call fcn.1003f96c
mov esi, dword [ebp + 0xc]
jmp 0x100649a8
cmp dword [ebp + 0x68], ebx
je 0x10064920
xor edx, edx
cmp byte [ebp + 0x66], dl
push 8
mov dword [ebp + 0x7c], edx
pop edi
mov dword [ebp + 0x1c], edx
mov dword [ebp + 0x20], edx
lea ebx, [ebp + 0x1c]
jg 0x1006446c
cmp byte [ebp + 0x53], dl
je 0x10064497
movsx eax, byte [ebp + 0x66]
push eax
push dword [ebp + 0x5c]
push dword [ebp + 0x78]
call fcn.10043297
add esp, 0xc
cmp byte [ebp + 0x66], 2
mov esi, eax
jge 0x10064913
cmp byte [ebp + 0x53], 0
jne 0x10064913
xor edx, edx
mov cl, byte [ebp + 0x6f]
cmp cl, 0x2b
je 0x10064866
test cl, cl
jne 0x100644bd
mov esi, dword [ebp + 0x68]
mov ax, word [esi]
cmp ax, 0x2b
jne 0x100644fb
inc esi
inc esi
mov dword [ebp + 0x68], esi
jmp 0x10064869
cmp cl, 0x23
je 0x100647ec
cmp cl, 0x62
jne 0x100645a9
cmp byte [ebp + 0x64], 0
mov dword [ebp + 0x54], 5
mov dword [ebp + 0x58], edx
je 0x1006450f
movsx eax, byte [ebp + 0x65]
push eax
lea eax, [ebp + 0x7c]
push eax
push dword [ebp + 0x68]
call fcn.1004aa05
mov ebx, dword [ebp + 0x7c]
add esp, 0xc
jmp 0x1006457f
cmp ax, 0x23
jne 0x100645d4
inc esi
inc esi
mov dword [ebp + 0x68], esi
jmp 0x100647ef
cmp byte [ebp + 0x65], 0
je 0x1006454f
mov edx, dword [ebp + 0x68]
xor ecx, ecx
mov cx, word [edx]
mov eax, ecx
call fcn.10045bb4
test al, al
je 0x10064637
cmp cx, 0x30
jne 0x10064543
mov ax, word [edx + 2]
or ax, 0x20
cmp ax, 0x78
jne 0x10064543
add edx, 4
push edx
call fcn.10046dc0
pop ecx
mov dword [ebp + 0x1c], eax
jmp 0x10064567
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.10053a89
cmp eax, 1
pop ecx
pop ecx
jl 0x100648d4
mov al, byte [ebp + 0x1c]
mov cl, byte [ebp + 0x1f]
mov byte [ebp + 0x1c], cl
mov cl, byte [ebp + 0x1e]
mov byte [ebp + 0x1f], al
mov al, byte [ebp + 0x1d]
mov byte [ebp + 0x1d], cl
mov byte [ebp + 0x1e], al
push 4
pop edi
push edi
push ebx
push dword [ebp + 0x54]
xor esi, esi
cmp byte [ebp + 0x25], 0
push dword [ebp + 0x34]
push dword [ebp + 0x5c]
push dword [ebp + 0x78]
je 0x100648e4
call dword [0x100e3274]
mov esi, eax
jmp 0x100648ec
cmp cl, 0x2a
je 0x100646e2
cmp cl, 0x7e
je 0x10064679
cmp cl, 0x40
je 0x1006466a
cmp cl, 0x6e
mov esi, dword [ebp + 0x68]
jne 0x100645fe
mov dword [ebp + 0x54], edx
jmp 0x10064674
cmp ax, 0x2a
jne 0x100645e4
inc esi
inc esi
mov dword [ebp + 0x68], esi
jmp 0x100646e5
cmp ax, 0x7e
jne 0x100645f4
push 2
pop edi
add esi, edi
jmp 0x1006467f
cmp ax, 0x40
jne 0x100645fe
inc esi
inc esi
jmp 0x1006466d
cmp dword [ebp + 0x58], edx
jg 0x100646f5
jl 0x10064612
cmp dword [ebp + 0x54], edx
jae 0x100646f5
cmp cl, 0x5e
jne 0x10064620
mov dword [ebp + 0x54], 6
jmp 0x1006464b
cmp cl, 0x75
jne 0x1006462e
mov dword [ebp + 0x54], 0x15
jmp 0x1006464b
test cl, cl
je 0x10064644
cmp cl, 0x24
je 0x10064644
lea ecx, [ebp + 0x7c]
call fcn.1003f96c
jmp 0x10063ccf
mov dword [ebp + 0x54], 1
cmp byte [ebp + 0x64], 0
mov dword [ebp + 0x58], edx
jne 0x100646f5
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
shl edi, 1
mov ebx, esi
jmp 0x10064582
mov esi, dword [ebp + 0x68]
mov dword [ebp + 0x54], 3
mov dword [ebp + 0x58], edx
jmp 0x100646f5
mov esi, dword [ebp + 0x68]
push 2
pop edi
cmp byte [ebp + 0x64], 0
mov dword [ebp + 0x54], edi
mov dword [ebp + 0x58], edx
jne 0x100646f5
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 2
push eax
lea ecx, [ebp + 0x7c]
call fcn.10046168
cmp word [esi], 0
mov ebx, dword [ebp + 0x7c]
mov ecx, esi
mov eax, ebx
je 0x100646d3
mov dx, word [ecx]
cmp dx, 0x5c
jne 0x100646c6
cmp word [ecx + 2], 0x30
jne 0x100646c6
and word [eax], 0
add eax, edi
add ecx, 4
jmp 0x100646cd
mov word [eax], dx
add eax, edi
add ecx, edi
cmp word [ecx], 0
jne 0x100646ab
and word [eax], 0
sub eax, ebx
add eax, edi
mov edi, eax
jmp 0x10064582
mov esi, dword [ebp + 0x68]
cmp byte [ebp + 0x64], 0
mov dword [ebp + 0x54], 7
mov dword [ebp + 0x58], edx
je 0x1006470b
movsx eax, byte [ebp + 0x65]
push eax
lea eax, [ebp + 0x7c]
push eax
push esi
call fcn.1004aa05
mov edi, eax
jmp 0x1006480d
mov esi, dword [ebp + 0x68]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
lea eax, [ebx + 0x10]
push eax
lea ecx, [ebp + 0x7c]
xor edi, edi
call fcn.10046168
mov edx, dword [ebp + 0x7c]
lea ecx, [esi + ebx*2]
cmp esi, ecx
mov eax, esi
mov dword [ebp + 0xc], ecx
jae 0x10064769
and word [edx], 0
cmp byte [ebp + 0x63], 0x2a
jne 0x100647a0
cmp word [eax], 0x5c
jne 0x100647cd
lea ecx, [eax + 2]
cmp word [ecx], 0x5c
jne 0x100647cd
mov eax, ecx
mov cx, word [eax]
mov word [edx], cx
inc edx
inc edx
inc eax
inc eax
xor edi, edi
cmp eax, dword [ebp + 0xc]
jb 0x10064734
cmp edi, 1
jge 0x10064770
and word [edx], 0
inc edi
inc edx
inc edx
test ebx, ebx
jle 0x10064790
cmp edi, 2
jge 0x10064790
push 2
pop esi
sub esi, edi
xor eax, eax
mov ecx, esi
shr ecx, 1
mov edi, edx
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
lea edx, [edx + esi*2]
mov ebx, dword [ebp + 0x7c]
and word [edx], 0
sub edx, ebx
mov edi, edx
jmp 0x10064582
cmp byte [ebp + 0x63], 0x24
jne 0x100647cd
mov cx, word [eax]
cmp cx, 0xd
jne 0x100647bc
lea esi, [eax + 2]
cmp word [esi], 0xa
jne 0x100647bc
mov eax, esi
jmp 0x100647c2
cmp cx, 0xa
jne 0x10064756
and word [edx], 0
inc eax
inc eax
inc edx
inc edx
inc edi
jmp 0x1006475f
mov cx, word [eax]
cmp cx, 0x5c
jne 0x10064756
cmp word [eax + 2], 0x30
jne 0x10064756
and word [edx], 0
inc edx
inc edx
add eax, 4
jmp 0x100647ca
mov esi, dword [ebp + 0x68]
cmp byte [ebp + 0x64], 0
push 4
pop edi
mov dword [ebp + 0x54], edi
mov dword [ebp + 0x58], edx
je 0x10064818
movsx eax, byte [ebp + 0x65]
push eax
lea eax, [ebp + 0x7c]
push eax
push esi
call fcn.1004aa05
mov ebx, dword [ebp + 0x7c]
add esp, 0xc
jmp 0x10064582
cmp byte [ebp + 0x65], 0
je 0x10064857
xor ecx, ecx
mov cx, word [esi]
mov eax, ecx
call fcn.10045bb4
test al, al
je 0x10064637
cmp cx, 0x30
jne 0x10064848
mov ax, word [esi + 2]
or ax, 0x20
cmp ax, 0x78
jne 0x10064848
add esi, edi
push esi
call fcn.10046dc0
pop ecx
mov dword [ebp + 0x1c], eax
jmp 0x10064582
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.10053a89
jmp 0x100648c9
mov esi, dword [ebp + 0x68]
cmp byte [ebp + 0x64], 0
mov dword [ebp + 0x54], 0xb
mov dword [ebp + 0x58], edx
jne 0x100647fe
cmp byte [ebp + 0x65], 0
je 0x100648bc
xor ecx, ecx
mov cx, word [esi]
mov eax, ecx
call fcn.10045bb4
test al, al
je 0x10064637
cmp cx, 0x30
jne 0x100648aa
mov ax, word [esi + 2]
or ax, 0x20
cmp ax, 0x78
jne 0x100648aa
add esi, 4
push esi
call fcn.10046dc0
pop ecx
mov dword [ebp + 0x1c], eax
mov dword [ebp + 0x20], edx
jmp 0x10064582
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.1005381f
cmp eax, 1
pop ecx
pop ecx
jge 0x10064582
lea ecx, [ebp + 0x7c]
call fcn.1003f96c
xor esi, esi
inc esi
jmp 0x100649a8
call fcn.10040c59
add esp, 0x18
cmp esi, 0x3fd
jne 0x10064913
cmp byte [ebp + 0x66], 0
jne 0x10064913
push 1
push dword [ebp + 0x5c]
mov byte [ebp + 0x66], 1
push dword [ebp + 0x78]
call fcn.10043297
add esp, 0xc
jmp 0x10064582
lea ecx, [ebp + 0x7c]
call fcn.1003f96c
jmp 0x100649a8
cmp byte [ebp + 0x33], 0x21
jne 0x10064952
mov eax, dword [ebp + 0x34]
cmp word [eax], bx
jne 0x10064952
cmp dword [ebp + 0x48], ebx
je 0x10064943
push dword [ebp + 0x48]
push dword [ebp + 0x5c]
push dword [ebp + 0x78]
call fcn.10051731
jmp 0x1006499c
push dword [ebp + 0x5c]
push dword [ebp + 0x78]
call fcn.10051530
pop ecx
pop ecx
jmp 0x1006499f
cmp dword [ebp + 0x48], ebx
je 0x1006498e
push ebx
lea eax, [ebp + 0x7c]
push eax
movzx eax, word [0x100e2c20]
push ebx
or eax, 0x2001b
push eax
push ebx
push ebx
push ebx
push dword [ebp + 0x5c]
mov dword [ebp + 0x7c], ebx
push dword [ebp + 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp dword [ebp + 0x7c], ebx
mov esi, eax
je 0x100649a1
push dword [ebp + 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100649a1
push dword [ebp + 0x34]
push dword [ebp + 0x5c]
push dword [ebp + 0x78]
call fcn.10040cb4
add esp, 0xc
mov esi, eax
cmp esi, 2
jne 0x100649a8
xor esi, esi
lea ecx, [ebp + 0x28]
call fcn.1003f96c
lea ecx, [ebp - 0xc]
call fcn.1003f96c
lea ecx, [ebp - 4]
call fcn.1003f96c
lea ecx, [ebp + 4]
call fcn.1003f96c
lea ecx, [ebp + 0x10]
call fcn.1003f96c
lea ecx, [ebp - 0x14]
call fcn.1003f96c
lea ecx, [ebp + 8]
call fcn.1003f96c
lea ecx, [ebp - 8]
call fcn.1003f96c
lea ecx, [ebp - 0x24]
call fcn.1003f96c
pop edi
mov eax, esi
pop esi
pop ebx
add ebp, 0x70
leave
ret 8