Function at 0x44dff0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fb1eb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x280
push ebx
push esi
push edi
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x10], esp
push eax
mov dword [ebp - 4], 0
call fcn.004ab6e0
add esp, 4
lea ecx, [ebp - 0x40]
push ecx
call fcn.00401350
add esp, 4
lea ecx, [ebp - 0x188]
push 1
call fcn.004f0653
mov edx, dword [0x4fe4e8]
lea ecx, [ebp - 0x188]
push edx
push 8
push str.c:endpcacheprocess_log.txt
mov byte [ebp - 4], 1
call fcn.004f0727
lea eax, [ebp - 0x18]
mov dword [ebp - 0x1c], 4
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionInternet_SettingsZones0
push closesocket
mov dword [ebp - 0x20], 0x80
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [ebp - 0x20]
lea edx, [ebp - 0x28c]
push ecx
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x1c]
push edx
push eax
push 0
push str.1200
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x44e34e
mov esi, dword [ebp - 0x28c]
and esi, 0xff
mov dword [ebp - 0x14], esi
jne 0x44e1a7
lea edx, [ebp - 0x40]
mov byte [ebp - 0x140], al
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x140]
push eax
push 0x52061c
push ecx
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x10
test eax, eax
jne 0x44e19f
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x44e171
mov ebx, dword [ebp + 0x1b4]
mov eax, dword [ebp + 0x1b0]
lea edx, [ebp - 0x140]
mov ecx, 0x6a
push edx
push ebx
push eax
lea esi, [ebp + 8]
sub esp, 0x1a8
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
mov esi, dword [ebp - 0x14]
add esp, 0x1b4
lea eax, [ebp - 0x140]
lea ecx, [ebp - 0x17c]
push eax
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
jmp 0x44e1ad
mov ebx, dword [ebp + 0x1b4]
mov edx, dword [ebp + 0x1b0]
lea ecx, [ebp - 0x140]
lea esi, [ebp + 8]
push ecx
push ebx
push edx
mov ecx, 0x6a
sub esp, 0x1a8
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
jmp 0x44e13f
mov ebx, dword [ebp + 0x1b4]
jmp 0x44e148
mov ebx, dword [ebp + 0x1b4]
cmp esi, 1
jne 0x44e27e
lea ecx, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x20c]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x140]
push 0x5205c8
push eax
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x10
test eax, eax
jne 0x44e254
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x44e228
mov edx, dword [ebp + 0x1b0]
lea ecx, [ebp - 0x140]
push ecx
push ebx
push edx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x44e24e
mov ecx, dword [ebp + 0x1b0]
lea eax, [ebp - 0x140]
push eax
push ebx
push ecx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea edx, [ebp - 0x140]
lea ecx, [ebp - 0x17c]
push edx
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov esi, dword [ebp - 0x14]
cmp esi, 3
jne 0x44e354
lea eax, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x20c]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x140]
push eax
push 0x520574
push edx
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x10
test eax, eax
jne 0x44e325
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x44e2f9
mov ecx, dword [ebp + 0x1b0]
lea eax, [ebp - 0x140]
push eax
push ebx
push ecx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x44e31f
mov eax, dword [ebp + 0x1b0]
lea edx, [ebp - 0x140]
push edx
push ebx
push eax
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea ecx, [ebp - 0x140]
push ecx
lea ecx, [ebp - 0x17c]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
jmp 0x44e354
mov ebx, dword [ebp + 0x1b4]
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x28c]
push edx
mov edx, dword [ebp - 0x18]
lea ecx, [ebp - 0x1c]
push eax
push ecx
push 0
push str.1201
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x44e5f7
mov eax, dword [ebp - 0x28c]
and eax, 0xff
mov dword [ebp - 0x14], eax
jne 0x44e458
lea eax, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x20c]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x140]
push eax
push 0x520500
push edx
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x10
test eax, eax
jne 0x44e42e
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x44e402
mov ecx, dword [ebp + 0x1b0]
lea eax, [ebp - 0x140]
push eax
push ebx
push ecx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x44e428
mov eax, dword [ebp + 0x1b0]
lea edx, [ebp - 0x140]
push edx
push ebx
push eax
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea ecx, [ebp - 0x140]
push ecx
lea ecx, [ebp - 0x17c]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov eax, dword [ebp - 0x14]
cmp eax, 1
jne 0x44e529
lea edx, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x140]
push eax
push 0x520490
push ecx
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x10
test eax, eax
jne 0x44e4ff
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x44e4d3
mov eax, dword [ebp + 0x1b0]
lea edx, [ebp - 0x140]
push edx
push ebx
push eax
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x44e4f9
mov edx, dword [ebp + 0x1b0]
lea ecx, [ebp - 0x140]
push ecx
push ebx
push edx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea eax, [ebp - 0x140]
lea ecx, [ebp - 0x17c]
push eax
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov eax, dword [ebp - 0x14]
cmp eax, 3
jne 0x44e5f7
lea ecx, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x20c]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x140]
push 0x520420
push eax
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x10
test eax, eax
jne 0x44e5d0
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x44e5a4
mov edx, dword [ebp + 0x1b0]
lea ecx, [ebp - 0x140]
push ecx
push ebx
push edx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x44e5ca
mov ecx, dword [ebp + 0x1b0]
lea eax, [ebp - 0x140]
push eax
push ebx
push ecx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea edx, [ebp - 0x140]
lea ecx, [ebp - 0x17c]
push edx
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x28c]
push eax
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x1c]
push ecx
push edx
push 0
push str.1400
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x44e89a
mov eax, dword [ebp - 0x28c]
and eax, 0xff
mov dword [ebp - 0x14], eax
jne 0x44e6fb
lea ecx, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x20c]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x140]
push 0x5203d4
push eax
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x10
test eax, eax
jne 0x44e6d1
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x44e6a5
mov edx, dword [ebp + 0x1b0]
lea ecx, [ebp - 0x140]
push ecx
push ebx
push edx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x44e6cb
mov ecx, dword [ebp + 0x1b0]
lea eax, [ebp - 0x140]
push eax
push ebx
push ecx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea edx, [ebp - 0x140]
lea ecx, [ebp - 0x17c]
push edx
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov eax, dword [ebp - 0x14]
cmp eax, 1
jne 0x44e7cc
lea eax, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x20c]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x140]
push eax
push 0x52038c
push edx
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x10
test eax, eax
jne 0x44e7a2
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x44e776
mov ecx, dword [ebp + 0x1b0]
lea eax, [ebp - 0x140]
push eax
push ebx
push ecx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x44e79c
mov eax, dword [ebp + 0x1b0]
lea edx, [ebp - 0x140]
push edx
push ebx
push eax
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea ecx, [ebp - 0x140]
push ecx
lea ecx, [ebp - 0x17c]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov eax, dword [ebp - 0x14]
cmp eax, 3
jne 0x44e89a
lea edx, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x140]
push eax
push 0x520344
push ecx
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x10
test eax, eax
jne 0x44e873
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x44e847
mov eax, dword [ebp + 0x1b0]
lea edx, [ebp - 0x140]
push edx
push ebx
push eax
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x44e86d
mov edx, dword [ebp + 0x1b0]
lea ecx, [ebp - 0x140]
push ecx
push ebx
push edx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea eax, [ebp - 0x140]
lea ecx, [ebp - 0x17c]
push eax
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x18]
push edx
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionInternet_SettingsZones3
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x28c]
push eax
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x1c]
push ecx
push edx
push 0
push str.1001
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x44eb9c
mov eax, dword [ebp - 0x28c]
and eax, 0xff
mov dword [ebp - 0x14], eax
jne 0x44e9d7
lea ecx, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x20c]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x140]
push 0x5202b0
push eax
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x10
test eax, eax
jne 0x44e999
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x44e96d
mov edx, dword [ebp + 0x1b0]
lea ecx, [ebp - 0x140]
push ecx
push ebx
push edx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x44e993
mov ecx, dword [ebp + 0x1b0]
lea eax, [ebp - 0x140]
push eax
push ebx
push ecx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea edx, [ebp - 0x140]
lea ecx, [ebp - 0x17c]
push edx
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov dword [ebp + 0x1b4], 1
push 4
lea eax, [ebp + 0x1b4]
jmp 0x44eb88
cmp eax, 1
jne 0x44eaa8
lea edx, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x140]
push eax
push 0x520264
push ecx
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x10
test eax, eax
jne 0x44ea7e
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x44ea52
mov eax, dword [ebp + 0x1b0]
lea edx, [ebp - 0x140]
push edx
push ebx
push eax
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x44ea78
mov edx, dword [ebp + 0x1b0]
lea ecx, [ebp - 0x140]
push ecx
push ebx
push edx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea eax, [ebp - 0x140]
lea ecx, [ebp - 0x17c]
push eax
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov eax, dword [ebp - 0x14]
cmp eax, 3
jne 0x44eb9c
lea ecx, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x20c]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x140]
push 0x52021c
push eax
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x10
test eax, eax
jne 0x44eb4f
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x44eb23
mov edx, dword [ebp + 0x1b0]
lea ecx, [ebp - 0x140]
push ecx
push ebx
push edx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x44eb49
mov ecx, dword [ebp + 0x1b0]
lea eax, [ebp - 0x140]
push eax
push ebx
push ecx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea edx, [ebp - 0x140]
lea ecx, [ebp - 0x17c]
push edx
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov dword [ebp + 0x1b4], 1
push 4
lea eax, [ebp + 0x1b4]
mov ecx, dword [ebp - 0x18]
push eax
push 4
push 0
push str.1001
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x28c]
push edx
mov edx, dword [ebp - 0x18]
lea ecx, [ebp - 0x1c]
push eax
push ecx
push 0
push str.1004
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x44ee79
mov eax, dword [ebp - 0x28c]
and eax, 0xff
mov dword [ebp - 0x14], eax
jne 0x44ecb4
lea eax, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x20c]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x140]
push eax
push 0x5201cc
push edx
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x10
test eax, eax
jne 0x44ec76
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x44ec4a
mov ecx, dword [ebp + 0x1b0]
lea eax, [ebp - 0x140]
push eax
push ebx
push ecx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x44ec70
mov eax, dword [ebp + 0x1b0]
lea edx, [ebp - 0x140]
push edx
push ebx
push eax
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea ecx, [ebp - 0x140]
push ecx
lea ecx, [ebp - 0x17c]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov dword [ebp + 0x1b4], 1
push 4
lea edx, [ebp + 0x1b4]
jmp 0x44ee65
cmp eax, 1
jne 0x44ed85
lea ecx, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x20c]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x140]
push 0x520180
push eax
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x10
test eax, eax
jne 0x44ed5b
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x44ed2f
mov edx, dword [ebp + 0x1b0]
lea ecx, [ebp - 0x140]
push ecx
push ebx
push edx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x44ed55
mov ecx, dword [ebp + 0x1b0]
lea eax, [ebp - 0x140]
push eax
push ebx
push ecx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea edx, [ebp - 0x140]
lea ecx, [ebp - 0x17c]
push edx
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov eax, dword [ebp - 0x14]
cmp eax, 3
jne 0x44ee79
lea eax, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x20c]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x140]
push eax
push 0x520138
push edx
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x10
test eax, eax
jne 0x44ee2c
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x44ee00
mov ecx, dword [ebp + 0x1b0]
lea eax, [ebp - 0x140]
push eax
push ebx
push ecx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x44ee26
mov eax, dword [ebp + 0x1b0]
lea edx, [ebp - 0x140]
push edx
push ebx
push eax
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea ecx, [ebp - 0x140]
push ecx
lea ecx, [ebp - 0x17c]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov dword [ebp + 0x1b4], 1
push 4
lea edx, [ebp + 0x1b4]
mov eax, dword [ebp - 0x18]
push edx
push 4
push 0
push str.1004
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [ebp - 0x20]
lea edx, [ebp - 0x28c]
push ecx
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x1c]
push edx
push eax
push 0
push str.1200
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x44f11c
mov eax, dword [ebp - 0x28c]
and eax, 0xff
mov dword [ebp - 0x14], eax
jne 0x44ef7d
lea edx, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x140]
push eax
push 0x5200f4
push ecx
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x10
test eax, eax
jne 0x44ef53
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x44ef27
mov eax, dword [ebp + 0x1b0]
lea edx, [ebp - 0x140]
push edx
push ebx
push eax
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x44ef4d
mov edx, dword [ebp + 0x1b0]
lea ecx, [ebp - 0x140]
push ecx
push ebx
push edx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea eax, [ebp - 0x140]
lea ecx, [ebp - 0x17c]
push eax
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov eax, dword [ebp - 0x14]
cmp eax, 1
jne 0x44f04e
lea ecx, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x20c]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x140]
push 0x5200ac
push eax
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x10
test eax, eax
jne 0x44f024
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x44eff8
mov edx, dword [ebp + 0x1b0]
lea ecx, [ebp - 0x140]
push ecx
push ebx
push edx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x44f01e
mov ecx, dword [ebp + 0x1b0]
lea eax, [ebp - 0x140]
push eax
push ebx
push ecx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea edx, [ebp - 0x140]
lea ecx, [ebp - 0x17c]
push edx
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov eax, dword [ebp - 0x14]
cmp eax, 3
jne 0x44f11c
lea eax, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x20c]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x140]
push eax
push 0x520064
push edx
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x10
test eax, eax
jne 0x44f0f5
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x44f0c9
mov ecx, dword [ebp + 0x1b0]
lea eax, [ebp - 0x140]
push eax
push ebx
push ecx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x44f0ef
mov eax, dword [ebp + 0x1b0]
lea edx, [ebp - 0x140]
push edx
push ebx
push eax
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea ecx, [ebp - 0x140]
push ecx
lea ecx, [ebp - 0x17c]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x28c]
push edx
mov edx, dword [ebp - 0x18]
lea ecx, [ebp - 0x1c]
push eax
push ecx
push 0
push str.1201
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x44f3e7
mov eax, dword [ebp - 0x28c]
and eax, 0xff
mov dword [ebp - 0x14], eax
jne 0x44f248
lea eax, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x20c]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x140]
push eax
push 0x520004
push edx
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x10
test eax, eax
jne 0x44f1f6
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x44f1ca
mov ecx, dword [ebp + 0x1b0]
lea eax, [ebp - 0x140]
push eax
push ebx
push ecx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x44f1f0
mov eax, dword [ebp + 0x1b0]
lea edx, [ebp - 0x140]
push edx
push ebx
push eax
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea ecx, [ebp - 0x140]
push ecx
lea ecx, [ebp - 0x17c]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov eax, dword [ebp - 0x18]
lea edx, [ebp + 0x1b4]
push 4
push edx
push 4
push 0
push str.1201
push eax
mov dword [ebp + 0x1b4], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x44f3e7
cmp eax, 1
jne 0x44f319
lea ecx, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x20c]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x140]
push 0x51ffa0
push eax
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x10
test eax, eax
jne 0x44f2ef
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x44f2c3
mov edx, dword [ebp + 0x1b0]
lea ecx, [ebp - 0x140]
push ecx
push ebx
push edx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x44f2e9
mov ecx, dword [ebp + 0x1b0]
lea eax, [ebp - 0x140]
push eax
push ebx
push ecx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea edx, [ebp - 0x140]
lea ecx, [ebp - 0x17c]
push edx
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov eax, dword [ebp - 0x14]
cmp eax, 3
jne 0x44f3e7
lea eax, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x20c]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x140]
push eax
push 0x51ff3c
push edx
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x10
test eax, eax
jne 0x44f3c0
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x44f394
mov ecx, dword [ebp + 0x1b0]
lea eax, [ebp - 0x140]
push eax
push ebx
push ecx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x44f3ba
mov eax, dword [ebp + 0x1b0]
lea edx, [ebp - 0x140]
push edx
push ebx
push eax
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea ecx, [ebp - 0x140]
push ecx
lea ecx, [ebp - 0x17c]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x28c]
push edx
mov edx, dword [ebp - 0x18]
lea ecx, [ebp - 0x1c]
push eax
push ecx
push 0
push str.1400
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x44f6d2
mov eax, dword [ebp - 0x28c]
and eax, 0xff
mov dword [ebp - 0x14], eax
jne 0x44f4eb
lea eax, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x20c]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x140]
push eax
push 0x51ff04
push edx
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x10
test eax, eax
jne 0x44f4c1
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x44f495
mov ecx, dword [ebp + 0x1b0]
lea eax, [ebp - 0x140]
push eax
push ebx
push ecx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x44f4bb
mov eax, dword [ebp + 0x1b0]
lea edx, [ebp - 0x140]
push edx
push ebx
push eax
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea ecx, [ebp - 0x140]
push ecx
lea ecx, [ebp - 0x17c]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov eax, dword [ebp - 0x14]
cmp eax, 1
jne 0x44f5de
lea edx, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x140]
push eax
push 0x51fec8
push ecx
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x10
test eax, eax
jne 0x44f592
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x44f566
mov eax, dword [ebp + 0x1b0]
lea edx, [ebp - 0x140]
push edx
push ebx
push eax
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x44f58c
mov edx, dword [ebp + 0x1b0]
lea ecx, [ebp - 0x140]
push ecx
push ebx
push edx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea eax, [ebp - 0x140]
lea ecx, [ebp - 0x17c]
push eax
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov edx, dword [ebp - 0x18]
lea ecx, [ebp + 0x1b4]
push 4
push ecx
push 4
push 0
push str.1400
mov dword [ebp + 0x1b4], 0
push edx
jmp 0x44f6cc
cmp eax, 3
jne 0x44f6d2
lea eax, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x20c]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x140]
push eax
push 0x51fe8c
push edx
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x10
test eax, eax
jne 0x44f685
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x44f659
mov ecx, dword [ebp + 0x1b0]
lea eax, [ebp - 0x140]
push eax
push ebx
push ecx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x44f67f
mov eax, dword [ebp + 0x1b0]
lea edx, [ebp - 0x140]
push edx
push ebx
push eax
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea ecx, [ebp - 0x140]
push ecx
lea ecx, [ebp - 0x17c]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov eax, dword [ebp - 0x18]
lea edx, [ebp + 0x1b4]
push 4
push edx
push 4
push 0
push str.1400
mov dword [ebp + 0x1b4], 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [ebp - 0x20]
lea edx, [ebp - 0x28c]
push ecx
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x1c]
push edx
push eax
push 0
push str.1402
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x44f9bd
mov eax, dword [ebp - 0x28c]
and eax, 0xff
mov dword [ebp - 0x14], eax
jne 0x44f7d6
lea edx, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x140]
push eax
push 0x51fe44
push ecx
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x10
test eax, eax
jne 0x44f7ac
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x44f780
mov eax, dword [ebp + 0x1b0]
lea edx, [ebp - 0x140]
push edx
push ebx
push eax
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x44f7a6
mov edx, dword [ebp + 0x1b0]
lea ecx, [ebp - 0x140]
push ecx
push ebx
push edx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea eax, [ebp - 0x140]
lea ecx, [ebp - 0x17c]
push eax
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov eax, dword [ebp - 0x14]
cmp eax, 1
jne 0x44f8c9
lea ecx, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x20c]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x140]
push 0x51fe00
push eax
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x10
test eax, eax
jne 0x44f87d
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x44f851
mov edx, dword [ebp + 0x1b0]
lea ecx, [ebp - 0x140]
push ecx
push ebx
push edx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x44f877
mov ecx, dword [ebp + 0x1b0]
lea eax, [ebp - 0x140]
push eax
push ebx
push ecx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea edx, [ebp - 0x140]
lea ecx, [ebp - 0x17c]
push edx
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov ecx, dword [ebp - 0x18]
lea eax, [ebp + 0x1b4]
push 4
push eax
push 4
push 0
push str.1402
mov dword [ebp + 0x1b4], 0
push ecx
jmp 0x44f9b7
cmp eax, 3
jne 0x44f9bd
lea edx, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x140]
push eax
push 0x51fdc0
push ecx
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x10
test eax, eax
jne 0x44f970
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x44f944
mov eax, dword [ebp + 0x1b0]
lea edx, [ebp - 0x140]
push edx
push ebx
push eax
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x44f96a
mov edx, dword [ebp + 0x1b0]
lea ecx, [ebp - 0x140]
push ecx
push ebx
push edx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea eax, [ebp - 0x140]
lea ecx, [ebp - 0x17c]
push eax
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov edx, dword [ebp - 0x18]
lea ecx, [ebp - 0x18c]
push 4
push ecx
push 4
push 0
push str.1402
mov dword [ebp - 0x18c], 0
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x28c]
push eax
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x1c]
push ecx
push edx
push 0
push str.1803
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x44fc60
mov eax, dword [ebp - 0x28c]
and eax, 0xff
mov dword [ebp - 0x14], eax
jne 0x44fac1
lea ecx, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x20c]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x140]
push 0x51fd80
push eax
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x10
test eax, eax
jne 0x44fa97
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x44fa6b
mov edx, dword [ebp + 0x1b0]
lea ecx, [ebp - 0x140]
push ecx
push ebx
push edx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x44fa91
mov ecx, dword [ebp + 0x1b0]
lea eax, [ebp - 0x140]
push eax
push ebx
push ecx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea edx, [ebp - 0x140]
lea ecx, [ebp - 0x17c]
push edx
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov eax, dword [ebp - 0x14]
cmp eax, 1
jne 0x44fb92
lea eax, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x20c]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x140]
push eax
push 0x51fd44
push edx
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x10
test eax, eax
jne 0x44fb68
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x44fb3c
mov ecx, dword [ebp + 0x1b0]
lea eax, [ebp - 0x140]
push eax
push ebx
push ecx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x44fb62
mov eax, dword [ebp + 0x1b0]
lea edx, [ebp - 0x140]
push edx
push ebx
push eax
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea ecx, [ebp - 0x140]
push ecx
lea ecx, [ebp - 0x17c]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov eax, dword [ebp - 0x14]
cmp eax, 3
jne 0x44fc60
lea edx, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x140]
push eax
push 0x51fd08
push ecx
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x10
test eax, eax
jne 0x44fc39
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x44fc0d
mov eax, dword [ebp + 0x1b0]
lea edx, [ebp - 0x140]
push edx
push ebx
push eax
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x44fc33
mov edx, dword [ebp + 0x1b0]
lea ecx, [ebp - 0x140]
push ecx
push ebx
push edx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea eax, [ebp - 0x140]
lea ecx, [ebp - 0x17c]
push eax
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
cmp dword [0x513dfc], 1
jne 0x44ff10
lea ecx, [ebp - 0x20]
lea edx, [ebp - 0x28c]
push ecx
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x1c]
push edx
push eax
push 0
push str.1A02
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x44ff10
mov eax, dword [ebp - 0x28c]
and eax, 0xff
mov dword [ebp - 0x14], eax
jne 0x44fd71
lea edx, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x140]
push eax
push 0x51fcac
push ecx
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x10
test eax, eax
jne 0x44fd47
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x44fd1b
mov eax, dword [ebp + 0x1b0]
lea edx, [ebp - 0x140]
push edx
push ebx
push eax
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x44fd41
mov edx, dword [ebp + 0x1b0]
lea ecx, [ebp - 0x140]
push ecx
push ebx
push edx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea eax, [ebp - 0x140]
lea ecx, [ebp - 0x17c]
push eax
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov eax, dword [ebp - 0x14]
cmp eax, 1
jne 0x44fe42
lea ecx, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x20c]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x140]
push 0x51fc54
push eax
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x10
test eax, eax
jne 0x44fe18
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x44fdec
mov edx, dword [ebp + 0x1b0]
lea ecx, [ebp - 0x140]
push ecx
push ebx
push edx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x44fe12
mov ecx, dword [ebp + 0x1b0]
lea eax, [ebp - 0x140]
push eax
push ebx
push ecx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea edx, [ebp - 0x140]
lea ecx, [ebp - 0x17c]
push edx
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov eax, dword [ebp - 0x14]
cmp eax, 3
jne 0x44ff10
lea eax, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x20c]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x140]
push eax
push 0x51fc00
push edx
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x10
test eax, eax
jne 0x44fee9
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x44febd
mov ecx, dword [ebp + 0x1b0]
lea eax, [ebp - 0x140]
push eax
push ebx
push ecx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x44fee3
mov eax, dword [ebp + 0x1b0]
lea edx, [ebp - 0x140]
push edx
push ebx
push eax
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea ecx, [ebp - 0x140]
push ecx
lea ecx, [ebp - 0x17c]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x28c]
push edx
mov edx, dword [ebp - 0x18]
lea ecx, [ebp - 0x1c]
push eax
push ecx
push 0
push str.CurrentLevel
push edx
mov dword [ebp - 0x1c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4502a2
mov eax, dword [ebp - 0x28c]
and eax, 0xff
cmp eax, 0x2710
mov dword [ebp + 0x1b4], eax
jne 0x450026
lea eax, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x20c]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x140]
push eax
push 0x51fbb8
push edx
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x10
test eax, eax
jne 0x44fff9
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x44ffcd
mov ecx, dword [ebp + 0x1b0]
lea eax, [ebp - 0x140]
push eax
push ebx
push ecx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x44fff3
mov eax, dword [ebp + 0x1b0]
lea edx, [ebp - 0x140]
push edx
push ebx
push eax
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea ecx, [ebp - 0x140]
push ecx
lea ecx, [ebp - 0x17c]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov eax, dword [ebp + 0x1b4]
cmp eax, 0x2904
jne 0x4500fc
lea edx, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x140]
push eax
push 0x51fb7c
push ecx
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x10
test eax, eax
jne 0x4500cf
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x4500a3
mov eax, dword [ebp + 0x1b0]
lea edx, [ebp - 0x140]
push edx
push ebx
push eax
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x4500c9
mov edx, dword [ebp + 0x1b0]
lea ecx, [ebp - 0x140]
push ecx
push ebx
push edx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea eax, [ebp - 0x140]
lea ecx, [ebp - 0x17c]
push eax
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov eax, dword [ebp + 0x1b4]
cmp eax, 0x2af8
jne 0x4501d2
lea ecx, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x20c]
push eax
push edx
call fcn.004fa6c0
add esp, 4
push eax
lea eax, [ebp - 0x140]
push 0x51fb44
push eax
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x10
test eax, eax
jne 0x4501a5
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x450179
mov edx, dword [ebp + 0x1b0]
lea ecx, [ebp - 0x140]
push ecx
push ebx
push edx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x45019f
mov ecx, dword [ebp + 0x1b0]
lea eax, [ebp - 0x140]
push eax
push ebx
push ecx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea edx, [ebp - 0x140]
lea ecx, [ebp - 0x17c]
push edx
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov eax, dword [ebp + 0x1b4]
cmp eax, 0x2ee0
jne 0x4502a2
lea eax, [ebp - 0x40]
mov byte [ebp - 0x140], 0
push eax
call fcn.004fa6c0
add esp, 4
lea ecx, [ebp - 0x20c]
push eax
push ecx
call fcn.004fa6c0
add esp, 4
lea edx, [ebp - 0x140]
push eax
push 0x51fb0c
push edx
call fcn.004f175f
mov eax, dword [0xe56db0]
add esp, 0x10
test eax, eax
jne 0x45027b
mov eax, dword [0xe56dbc]
test eax, eax
jne 0x45024f
mov ecx, dword [ebp + 0x1b0]
lea eax, [ebp - 0x140]
push eax
push ebx
push ecx
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404170
jmp 0x450275
mov eax, dword [ebp + 0x1b0]
lea edx, [ebp - 0x140]
push edx
push ebx
push eax
mov ecx, 0x6a
sub esp, 0x1a8
lea esi, [ebp + 8]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00404560
add esp, 0x1b4
lea ecx, [ebp - 0x140]
push ecx
lea ecx, [ebp - 0x17c]
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x188]
call fcn.004f076e
lea ecx, [ebp - 0x174]
mov byte [ebp - 4], 0
call fcn.004f0714
lea ecx, [ebp - 0x174]
call fcn.004f05fb
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret