Function at 0x448fce
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
mov dword [ebp - 0x24], ecx
push ecx
lea ecx, [ebp - 0x54]
call fcn.0042fe12
mov eax, dword [ebp + 8]
xor edi, edi
mov byte [ebp - 4], 0xff
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x34], eax
mov dword [ebp - 8], edi
lea eax, [ebp + 8]
push eax
call fcn.00428a5b
mov esi, dword [ebp + 8]
mov ax, word [esi]
cmp ax, 0x2d
pop ecx
mov byte [ebp - 1], 0
mov byte [ebp - 2], 0
mov byte [ebp - 3], 0
mov dword [ebp - 0x28], edi
mov cl, 0x2a
jne 0x44901e
mov cl, al
movsx ebx, cl
movzx eax, ax
jmp 0x4490da
movzx eax, word [esi + 2]
cmp ebx, eax
jne 0x4490e2
xor eax, eax
lea ecx, [esi + 4]
mov ax, word [ecx]
mov edx, eax
and dx, 0xffdf
cmp dx, 0x48
je 0x4490e2
call fcn.0040ac1b
test al, al
jne 0x4490e2
mov esi, ecx
push 1
push esi
push 0x48b9a8
mov dword [ebp + 8], esi
call fcn.0042996a
add esp, 0xc
test al, al
lea eax, [ebp + 8]
je 0x4490b0
push eax
add esi, 2
call fcn.00404037
cmp word [esi], 0x3a
pop ecx
je 0x44908d
or dword [ebp - 0x28], 7
jmp 0x4490d4
lea eax, [ebp - 0x38]
push eax
inc esi
lea eax, [ebp - 0x40]
inc esi
push eax
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x40], esi
call fcn.00430ad7
test eax, eax
pop ecx
pop ecx
jle 0x4490d4
mov eax, dword [ebp - 0x38]
or dword [ebp - 0x28], eax
jmp 0x4490d4
push 2
push eax
push 0x48b9a4
call fcn.0042fc5f
add esp, 0xc
test al, al
je 0x4490ca
mov byte [ebp - 3], 1
jmp 0x4490d4
lea eax, [ebp + 8]
push eax
call fcn.00404037
pop ecx
mov esi, dword [ebp + 8]
movzx eax, word [esi]
cmp ebx, eax
je 0x449029
lea ecx, [ebp - 0x10]
call fcn.0042e1c4
lea ecx, [ebp - 0x48]
call fcn.0042e1c4
lea ecx, [ebp - 0x20]
call fcn.0042e1c4
lea ecx, [ebp - 0x30]
call fcn.0042e1c4
lea ecx, [ebp - 0x2c]
call fcn.0042e1c4
mov ax, word [esi]
cmp ax, 0x2b
je 0x44913d
cmp ax, 0x23
je 0x44913d
cmp ax, 0x40
je 0x44913d
cmp ax, 0x24
je 0x44913d
cmp ax, 0x2a
je 0x44913d
cmp ax, 0x7e
je 0x44913d
cmp ax, 0x2e
je 0x44913d
cmp ax, 0x3f
jne 0x449156
mov al, byte [esi]
inc esi
inc esi
test al, al
mov byte [ebp - 1], al
mov dword [ebp + 8], esi
je 0x449156
movzx eax, word [esi]
movsx ecx, byte [ebp - 1]
cmp ecx, eax
je 0x44915c
cmp word [esi], 0x24
jne 0x449166
mov al, byte [esi]
inc esi
inc esi
mov byte [ebp - 2], al
mov dword [ebp + 8], esi
lea eax, [ebp + 8]
push eax
call fcn.00428a5b
mov eax, dword [ebp + 8]
mov dword [ebp - 0x40], eax
mov esi, eax
movzx eax, word [eax]
pop ecx
jmp 0x449194
cmp ax, 0x2c
je 0x449199
cmp ax, 0x3d
je 0x449199
cmp ax, 0x21
je 0x449199
inc esi
inc esi
mov ax, word [esi]
cmp ax, di
jne 0x44917d
mov ax, word [esi]
cmp ax, 0x2c
je 0x4491ae
cmp ax, 0x3d
je 0x4491ae
cmp ax, 0x21
jne 0x4491bf
mov al, byte [esi]
mov word [esi], di
inc esi
inc esi
test al, al
mov byte [ebp + 0xb], al
mov dword [ebp - 0x1c], esi
jne 0x449211
inc byte [ebp - 4]
cmp byte [ebp - 4], 0
jg 0x449642
mov ecx, dword [ebp - 0x24]
push 1
push edi
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x34]
call fcn.00437546
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0x2c]
mov dword [ebp + 8], eax
call fcn.00428a48
lea ecx, [ebp - 0x30]
call fcn.00428a48
lea ecx, [ebp - 0x20]
call fcn.00428a48
lea ecx, [ebp - 0x48]
call fcn.00428a48
lea ecx, [ebp - 0x10]
call fcn.00428a48
jmp 0x448ff5
push 1
push 0x2c
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x54]
call fcn.0043c3b4
push edi
lea ecx, [ebp - 0x10]
push ecx
push eax
call fcn.0043060a
add esp, 0xc
push 0x5c
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov ebx, eax
cmp ebx, edi
je 0x449642
mov word [ebx], di
inc ebx
inc ebx
push 0x48b99c
push ebx
mov dword [ebp - 0x18], ebx
call dword [sym.imp.SHLWAPI.dll_StrStrW]
cmp eax, edi
jne 0x44926e
push 0x5c
push edi
push ebx
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
cmp eax, edi
je 0x449642
mov word [eax], di
inc eax
inc eax
cmp word [eax], 0x5c
mov dword [ebp - 0x14], eax
jne 0x449287
add eax, 2
cmp word [eax], di
jne 0x449287
mov dword [ebp - 0x14], eax
cmp byte [ebp + 0xb], 0x2c
jne 0x4493d4
push 1
push 0x2c
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x54]
call fcn.0043c3b4
push edi
lea ecx, [ebp - 0x20]
push ecx
push eax
call fcn.0043060a
mov ecx, dword [ebp - 0x24]
add esp, 0xc
push edi
lea eax, [ebp - 0x20]
push eax
call fcn.00402bdd
cmp byte [ebp - 1], 0x2e
jne 0x4492fa
mov eax, dword [ebp - 0x1c]
cmp word [eax], 0x2c
jne 0x4492fa
add dword [ebp - 0x1c], 2
push 1
push 0x2c
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x54]
call fcn.0043c3b4
push edi
lea ecx, [ebp - 0x2c]
push ecx
push eax
call fcn.0043060a
mov ecx, dword [ebp - 0x24]
add esp, 0xc
push edi
lea eax, [ebp - 0x2c]
push eax
call fcn.00402bdd
mov eax, dword [ebp - 0x20]
cmp word [eax], di
jne 0x44930f
push 0x48b98c
lea ecx, [ebp - 0x20]
call fcn.0043a522
mov ebx, dword [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str.HKLM
push dword [ebp - 0x10]
call esi
test eax, eax
je 0x4494e2
push str.HKEY_LOCAL_MACHINE
push dword [ebp - 0x10]
call esi
test eax, eax
je 0x4494e2
push str.HKCU
push dword [ebp - 0x10]
call esi
test eax, eax
je 0x4494d9
push str.HKEY_CURRENT_USER
push dword [ebp - 0x10]
call esi
test eax, eax
je 0x4494d9
push str.HKCR
push dword [ebp - 0x10]
call esi
test eax, eax
je 0x4494d0
push str.HKEY_CLASSES_ROOT
push dword [ebp - 0x10]
call esi
test eax, eax
je 0x4494d0
push 0x48b8f0
push dword [ebp - 0x10]
call esi
test eax, eax
je 0x4494c7
push str.HKEY_USERS
push dword [ebp - 0x10]
call esi
test eax, eax
je 0x4494c7
push str.HKCC
push dword [ebp - 0x10]
call esi
test eax, eax
je 0x4493c8
push str.HKEY_CURRENT_CONFIG
push dword [ebp - 0x10]
call esi
test eax, eax
jne 0x449642
mov dword [ebp - 0xc], 0x80000005
jmp 0x4494e9
cmp byte [ebp + 0xb], 0x21
je 0x44930f
cmp word [esi], di
jne 0x4493f9
cmp byte [ebp - 1], 0x24
je 0x449418
cmp byte [ebp - 1], 0x2a
je 0x4493f9
cmp byte [ebp - 1], 0x7e
jne 0x44930f
cmp byte [ebp - 1], 0x24
je 0x449418
cmp byte [ebp - 1], 0x2a
je 0x449418
cmp byte [ebp - 1], 0x7e
je 0x449418
lea eax, [ebp - 0x1c]
push eax
call fcn.00428a5b
mov esi, dword [ebp - 0x1c]
pop ecx
push esi
lea ecx, [ebp - 0x34]
call fcn.0043a4ba
mov edx, dword [ebp - 0x34]
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 0x38], edx
call fcn.00428a5b
cmp byte [ebp + 0xc], 0
pop ecx
je 0x449442
push edx
lea ecx, [ebp - 0x30]
call fcn.0043a522
jmp 0x449452
mov ecx, dword [ebp - 0x24]
push 1
push edi
lea eax, [ebp - 0x30]
push eax
push edx
call fcn.00436312
mov eax, dword [ebp - 0x30]
mov ebx, eax
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
mov dword [ebp - 8], ebx
call fcn.00428a5b
cmp byte [ebp - 1], 0
pop ecx
jne 0x44949c
push dword [ebp - 0x38]
push 0x48b89c
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x449486
mov ebx, 0x484964
jmp 0x4494b7
mov ecx, dword [ebp + 0xc]
mov ax, word [ecx]
cmp ax, 0x23
je 0x449498
cmp ax, 0x40
jne 0x4494ba
mov ebx, ecx
jmp 0x4494b7
cmp byte [ebp - 1], 0x23
je 0x4494a8
cmp byte [ebp - 1], 0x40
jne 0x4494ba
mov eax, dword [ebp + 0xc]
cmp word [eax], di
mov ebx, eax
mov dword [ebp - 8], ebx
jne 0x4494ba
xor ebx, ebx
mov dword [ebp - 8], ebx
lea ecx, [ebp - 0x34]
call fcn.00428a48
jmp 0x449312
mov dword [ebp - 0xc], 0x80000003
jmp 0x4494e9
mov dword [ebp - 0xc], 0x80000000
jmp 0x4494e9
mov dword [ebp - 0xc], 0x80000001
jmp 0x4494e9
mov dword [ebp - 0xc], 0x80000002
mov eax, dword [ebp - 0x20]
cmp word [eax], di
je 0x44993e
cmp byte [ebp - 1], 0x2e
je 0x449504
cmp byte [ebp - 1], 0x3f
mov dword [ebp - 8], edi
jne 0x449511
cmp byte [ebp - 1], 0x3f
mov dword [ebp - 8], 1
je 0x44951f
cmp dword [ebp - 8], edi
je 0x44951b
cmp word [eax], di
je 0x44951f
xor ebx, ebx
jmp 0x449522
xor ebx, ebx
inc ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x64
lea ecx, [ebp + 0xc]
mov dword [ebp - 0x38], edi
call fcn.0042e1e2
lea ecx, [ebp - 0x1c]
call fcn.0042e1c4
cmp byte [ebp - 1], 0x2e
lea edi, [ebp - 0x1c]
je 0x44954a
lea edi, [ebp + 0xc]
push 0x1000
lea ecx, [ebp + 8]
mov dword [ebp - 0x40], edi
call fcn.0042e06b
and dword [ebp - 0x34], 0
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp + 8]
push eax
push dword [ebp - 0x14]
mov dword [ebp - 0x28], 0xfff
push dword [ebp - 0x18]
push dword [ebp - 0xc]
call fcn.004317e3
mov esi, eax
add esp, 0x18
test esi, esi
jge 0x4495f5
mov eax, dword [ebp - 0x14]
xor ebx, ebx
cmp word [eax], bx
jne 0x4495b1
cmp dword [ebp - 0x34], 2
jne 0x4495b1
cmp esi, 0xfffffffe
jne 0x4495b1
cmp dword [ebp - 8], ebx
je 0x4498f7
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x48b898
jmp 0x4495cc
mov esi, dword [ebp - 0x34]
cmp esi, ebx
jne 0x4495bb
xor esi, esi
inc esi
cmp dword [ebp - 8], ebx
mov dword [ebp - 0x38], esi
je 0x4495d8
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.ERROR
mov ecx, edi
call fcn.0042e281
jmp 0x4498f7
lea ecx, [ebp + 8]
call fcn.00428a48
lea ecx, [ebp - 0x1c]
call fcn.00428a48
lea ecx, [ebp + 0xc]
call fcn.00428a48
jmp 0x449d43
cmp esi, 1
jne 0x44965d
cmp dword [ebp - 8], 0
je 0x449618
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_SZ
mov ecx, edi
call fcn.0042e281
test ebx, ebx
jne 0x4498f5
cmp byte [ebp - 1], 0x24
je 0x44964c
cmp byte [ebp - 1], 0x2e
je 0x44964c
cmp byte [ebp - 1], 0
je 0x44964c
lea ecx, [ebp + 8]
call fcn.00428a48
lea ecx, [ebp - 0x1c]
call fcn.00428a48
lea ecx, [ebp + 0xc]
call fcn.00428a48
mov esi, 0x80070057
jmp 0x449d43
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [ebp + 0xc], ecx
mov dword [ebp + 8], eax
jmp 0x4498f2
cmp esi, 0xb
jne 0x4496a9
cmp dword [ebp - 8], 0
je 0x449680
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_QWORD
mov ecx, edi
call fcn.0042e281
test ebx, ebx
jne 0x4498f5
cmp byte [ebp - 1], 0x2b
je 0x44968c
cmp byte [ebp - 1], 0x2e
jne 0x44962a
mov eax, dword [ebp + 8]
push str.0x_I64x
push dword [eax + 4]
push dword [eax]
push dword [ebp + 0xc]
call fcn.0042dbb3
add esp, 0x10
jmp 0x4498f2
cmp esi, 4
jne 0x4496f7
cmp dword [ebp - 8], 0
je 0x4496cc
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_DWORD
mov ecx, edi
call fcn.0042e281
test ebx, ebx
jne 0x4498f5
cmp byte [ebp - 1], 0x23
je 0x4496dc
cmp byte [ebp - 1], 0x2e
jne 0x44962a
mov eax, dword [ebp + 8]
push dword [eax]
push str.0x_x
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x4498f2
cmp esi, 3
jne 0x44979a
cmp dword [ebp - 8], 0
je 0x44971e
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_BINARY
mov ecx, edi
call fcn.0042e281
test ebx, ebx
jne 0x4498f5
cmp byte [ebp - 1], 0x40
je 0x44972e
cmp byte [ebp - 1], 0x2e
jne 0x44962a
mov eax, dword [ebp - 0x28]
lea eax, [eax + eax*4 + 6]
push eax
lea ecx, [ebp + 0xc]
call fcn.0042e20b
mov eax, dword [ebp + 0xc]
and word [eax], 0
cmp dword [ebp - 0x28], 0
mov esi, dword [ebp + 8]
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
jle 0x449764
movzx ecx, byte [esi]
push ecx
push str.0x_02X
push eax
call edi
add esp, 0xc
inc esi
mov eax, dword [ebp + 0xc]
xor ebx, ebx
add eax, 8
inc ebx
cmp dword [ebp - 0x28], ebx
mov dword [ebp - 0x34], eax
jle 0x4498f2
movzx eax, byte [esi]
push eax
push str._0x_02X
push dword [ebp - 0x34]
call edi
add dword [ebp - 0x34], 0xa
add esp, 0xc
inc esi
inc ebx
cmp ebx, dword [ebp - 0x28]
jl 0x449779
jmp 0x4498f2
cmp esi, 2
jne 0x4497ef
cmp dword [ebp - 8], 0
je 0x4497bd
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_EXPAND_SZ
mov ecx, edi
call fcn.0042e281
test ebx, ebx
jne 0x4498f5
cmp byte [ebp - 1], 0x7e
je 0x4497cd
cmp byte [ebp - 1], 0x2e
jne 0x44962a
cmp byte [ebp - 2], 0
je 0x44964c
mov ecx, dword [ebp - 0x24]
push 1
push 0
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
call fcn.00437546
jmp 0x4498f2
cmp esi, 7
jne 0x4498c0
cmp dword [ebp - 8], 0
je 0x449816
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_MULTI_SZ
mov ecx, edi
call fcn.0042e281
test ebx, ebx
jne 0x4498f5
cmp byte [ebp - 1], 0x2a
je 0x449826
cmp byte [ebp - 1], 0x2e
jne 0x44962a
mov esi, dword [ebp - 0x28]
shr esi, 1
lea eax, [esi*4 + 6]
push eax
lea ecx, [ebp + 0xc]
call fcn.0042e20b
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
lea esi, [ecx + esi*2]
jmp 0x4498b6
cmp byte [ebp - 2], 0x2a
jne 0x449877
cmp word [ecx], 0x5c
jne 0x449877
lea edx, [ecx + 2]
mov bx, word [edx]
cmp bx, 0x30
je 0x449869
cmp bx, 0x5c
je 0x449869
test bx, bx
jne 0x449877
mov word [eax], 0x5c
mov ecx, edx
mov dx, word [ecx]
inc eax
inc eax
jmp 0x44987f
mov dx, word [ecx]
test dx, dx
je 0x449888
mov word [eax], dx
inc eax
inc eax
inc ecx
inc ecx
jmp 0x4498b6
inc ecx
inc ecx
cmp byte [ebp - 2], 0x24
jne 0x4498a8
cmp ecx, esi
jae 0x4498ba
cmp word [ecx], 0
je 0x4498ba
mov word [eax], 0xd
inc eax
inc eax
mov word [eax], 0xa
jmp 0x4498b4
mov word [eax], 0x5c
inc eax
inc eax
mov word [eax], 0x30
inc eax
inc eax
cmp ecx, esi
jb 0x449846
and word [eax], 0
jmp 0x4498f2
cmp dword [ebp - 8], 0
je 0x4498e4
push 0x32
mov ecx, edi
call fcn.0042e20b
push esi
push 0x48a3a4
push dword [edi]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
test ebx, ebx
jne 0x4498f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4498ef
inc eax
mov dword [ebp - 0x38], eax
mov edi, dword [ebp - 0x40]
xor ebx, ebx
mov eax, dword [ebp - 0x20]
cmp word [eax], bx
je 0x44990b
push dword [ebp + 0xc]
mov ecx, dword [ebp - 0x24]
push eax
call fcn.0042cbf7
mov eax, dword [ebp - 0x2c]
cmp word [eax], bx
je 0x44991e
push dword [edi]
mov ecx, dword [ebp - 0x24]
push eax
call fcn.0042cbf7
lea ecx, [ebp + 8]
call fcn.00428a48
lea ecx, [ebp - 0x1c]
call fcn.00428a48
lea ecx, [ebp + 0xc]
call fcn.00428a48
mov esi, dword [ebp - 0x38]
jmp 0x449d43
cmp ebx, edi
je 0x449cbb
mov al, byte [ebp - 1]
cmp al, 0x2b
je 0x449963
test al, al
jne 0x4499cb
mov ax, word [ebx]
cmp ax, 0x2b
jne 0x4499f6
inc ebx
inc ebx
mov dword [ebp - 8], ebx
cmp byte [ebp - 3], 0
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], edi
je 0x449c9b
xor ecx, ecx
mov cx, word [ebx]
mov eax, ecx
call fcn.0042dcf4
test al, al
je 0x449642
cmp cx, 0x30
jne 0x44999e
mov ax, word [ebx + 2]
or ax, 0x20
cmp ax, 0x78
jne 0x44999e
add ebx, 4
push ebx
call fcn.0042eb10
pop ecx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], edx
push 8
lea eax, [ebp - 0x44]
push eax
push 0xb
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0xc]
call fcn.004297ff
add esp, 0x18
mov esi, eax
jmp 0x449d43
cmp al, 0x23
je 0x449a01
cmp al, 0x40
je 0x449a57
cmp al, 0x2a
je 0x449aec
cmp al, 0x7e
je 0x449b8a
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
push eax
push ebx
push 1
jmp 0x4499b3
cmp ax, 0x23
jne 0x449a48
inc ebx
inc ebx
mov dword [ebp - 8], ebx
cmp byte [ebp - 3], 0
mov dword [ebp + 0xc], edi
je 0x449c7a
xor ecx, ecx
mov cx, word [ebx]
mov eax, ecx
call fcn.0042dcf4
test al, al
je 0x449642
cmp cx, 0x30
jne 0x449a39
mov ax, word [ebx + 2]
or ax, 0x20
cmp ax, 0x78
jne 0x449a39
add ebx, 4
push ebx
call fcn.0042eb10
pop ecx
mov dword [ebp + 0xc], eax
jmp 0x449c8e
cmp ax, 0x40
jne 0x449add
inc ebx
inc ebx
mov dword [ebp - 8], ebx
push dword [ebp - 8]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
push edi
lea ecx, [ebp + 0xc]
call fcn.0042e06b
lea eax, [ebp - 8]
push eax
call fcn.00428a5b
test edi, edi
mov ebx, dword [ebp + 0xc]
pop ecx
jle 0x449c56
mov eax, dword [ebp - 8]
mov cx, word [eax]
test cx, cx
je 0x449c56
and dword [ebp - 0x44], 0
and dword [ebp - 0x40], 0
cmp byte [ebp - 3], 0
je 0x449c38
cmp cx, 0x30
jne 0x449abd
mov cx, word [eax + 2]
or cx, 0x20
cmp cx, 0x78
jne 0x449abd
add eax, 4
mov dword [ebp - 8], eax
push 2
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 8]
push eax
call fcn.0042ebd5
lea eax, [ebp - 8]
push eax
call fcn.00428a5b
add esp, 0x10
jmp 0x449c47
cmp ax, 0x2a
jne 0x449b7e
inc ebx
inc ebx
mov dword [ebp - 8], ebx
mov edi, dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
lea eax, [esi + 0x10]
push eax
lea ecx, [ebp + 0xc]
xor ebx, ebx
call fcn.0042e1e2
mov edx, dword [ebp + 0xc]
lea esi, [edi + esi*2]
cmp edi, esi
mov eax, edi
jae 0x449b4e
and word [edx], 0
cmp byte [ebp - 2], 0x2a
jne 0x449bf3
cmp word [eax], 0x5c
jne 0x449c15
lea ecx, [eax + 2]
cmp word [ecx], 0x5c
jne 0x449c15
mov eax, ecx
mov cx, word [eax]
mov word [edx], cx
inc edx
inc edx
inc eax
inc eax
xor ebx, ebx
cmp eax, esi
jb 0x449b12
cmp ebx, 2
jge 0x449b67
push 2
pop esi
sub esi, ebx
xor eax, eax
mov ecx, esi
shr ecx, 1
mov edi, edx
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
add ebx, esi
lea edx, [edx + esi*2]
push 2
pop eax
sub eax, ebx
lea eax, [edx + eax*2]
and word [eax], 0
sub eax, dword [ebp + 0xc]
push eax
push dword [ebp + 0xc]
push 7
jmp 0x449bdb
cmp ax, 0x7e
jne 0x4499e7
inc ebx
inc ebx
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
push eax
lea ecx, [ebp + 0xc]
call fcn.0042e1e2
cmp word [ebx], di
mov eax, dword [ebp + 0xc]
mov ecx, ebx
je 0x449bcb
mov dx, word [ecx]
cmp dx, 0x5c
jne 0x449bbf
cmp word [ecx + 2], 0x30
jne 0x449bbf
mov word [eax], di
inc eax
inc eax
add ecx, 4
jmp 0x449bc6
mov word [eax], dx
inc eax
inc eax
inc ecx
inc ecx
cmp word [ecx], di
jne 0x449ba5
mov word [eax], di
sub eax, dword [ebp + 0xc]
sar eax, 1
shl eax, 1
push eax
push dword [ebp + 0xc]
push 2
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0xc]
call fcn.004297ff
add esp, 0x18
mov esi, eax
jmp 0x4495e8
cmp byte [ebp - 2], 0x24
jne 0x449c15
cmp word [eax], 0xd
jne 0x449c15
cmp word [eax + 2], 0xa
jne 0x449c15
and word [edx], 0
add eax, 4
inc edx
inc edx
inc ebx
jmp 0x449b45
mov cx, word [eax]
cmp cx, 0x5c
jne 0x449b3c
cmp word [eax + 2], 0x30
jne 0x449b3c
and word [edx], 0
inc edx
inc edx
add eax, 4
jmp 0x449c0f
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 8]
push eax
call fcn.00430ab3
pop ecx
pop ecx
mov al, byte [ebp - 0x44]
mov byte [ebx + esi], al
inc esi
cmp esi, edi
jl 0x449a82
push esi
push ebx
push 3
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0xc]
call fcn.004297ff
add esp, 0x18
lea ecx, [ebp + 0xc]
mov esi, eax
call fcn.00428a48
jmp 0x449d43
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 8]
push eax
call fcn.00430ad7
cmp eax, 1
pop ecx
pop ecx
jl 0x449cb3
push 4
lea eax, [ebp + 0xc]
push eax
push 4
jmp 0x4499b3
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 8]
push eax
call fcn.00430ab3
cmp eax, 1
pop ecx
pop ecx
jge 0x4499ab
xor esi, esi
inc esi
jmp 0x449d43
cmp byte [ebp + 0xb], 0x21
jne 0x449ced
mov eax, dword [ebp - 0x14]
cmp word [eax], di
jne 0x449ced
cmp dword [ebp - 0x28], edi
je 0x449cde
push dword [ebp - 0x28]
push dword [ebp - 0x18]
push dword [ebp - 0xc]
call fcn.0042fb09
jmp 0x449d37
push dword [ebp - 0x18]
push dword [ebp - 0xc]
call fcn.0043b8d5
pop ecx
pop ecx
jmp 0x449d3a
cmp dword [ebp - 0x28], edi
je 0x449d29
push edi
lea eax, [ebp + 0xc]
push eax
movzx eax, word [0x49ab68]
push edi
or eax, 0x2001b
push eax
push edi
push edi
push edi
push dword [ebp - 0x18]
mov dword [ebp + 0xc], edi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp dword [ebp + 0xc], edi
mov esi, eax
je 0x449d3c
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x449d3c
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0xc]
call fcn.00429876
add esp, 0xc
mov esi, eax
cmp esi, 2
jne 0x449d43
xor esi, esi
lea ecx, [ebp - 0x2c]
call fcn.00428a48
lea ecx, [ebp - 0x30]
call fcn.00428a48
lea ecx, [ebp - 0x20]
call fcn.00428a48
lea ecx, [ebp - 0x48]
call fcn.00428a48
lea ecx, [ebp - 0x10]
call fcn.00428a48
lea ecx, [ebp - 0x3c]
call fcn.00428a48
lea ecx, [ebp - 0x54]
call fcn.00428a48
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8