Function at 0x4509d7
Capabilities:
Encode data using base64
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
push ebx
push esi
push edi
mov dword [ebp - 0x40], ecx
push ecx
lea ecx, [ebp - 0x84]
call fcn.00437de1
mov eax, dword [ebp + 8]
xor ebx, ebx
mov byte [ebp - 0x26], 0xff
mov byte [ebp - 0x1e], bl
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x6c], eax
mov dword [ebp - 8], ebx
lea eax, [ebp + 8]
push eax
call fcn.00430961
mov esi, dword [ebp + 8]
mov ax, word [esi]
cmp ax, 0x2d
pop ecx
mov byte [ebp - 1], bl
mov byte [ebp - 9], bl
mov byte [ebp - 0x1d], bl
mov byte [ebp - 2], bl
mov byte [ebp - 0x31], bl
mov dword [ebp - 0x14], ebx
mov cl, 0x2a
jne 0x450a33
mov cl, al
movsx edi, cl
movzx eax, ax
jmp 0x450b8c
movzx eax, word [esi + 2]
cmp edi, eax
jne 0x450b94
xor eax, eax
lea ecx, [esi + 4]
mov ax, word [ecx]
mov edx, eax
and dx, 0xffdf
cmp dx, 0x48
je 0x450b94
call fcn.0040bc38
test al, al
jne 0x450b94
mov esi, ecx
push 1
push esi
push 0x49c430
mov dword [ebp + 8], esi
call fcn.004318b1
add esp, 0xc
test al, al
lea eax, [ebp + 8]
je 0x450acf
push eax
add esi, 2
call fcn.0040459d
cmp word [esi], 0x3a
pop ecx
je 0x450aa5
or dword [ebp - 0x14], 7
jmp 0x450b86
lea eax, [ebp - 0x5c]
push eax
inc esi
lea eax, [ebp - 0x38]
inc esi
push eax
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x38], esi
call fcn.00438b8e
test eax, eax
pop ecx
pop ecx
jle 0x450b86
mov eax, dword [ebp - 0x5c]
or dword [ebp - 0x14], eax
jmp 0x450b86
push 2
push eax
push 0x49c42c
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x450aec
mov byte [ebp - 0x1d], 1
jmp 0x450b86
push 1
lea eax, [ebp + 8]
push eax
push 0x497940
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x450b09
mov byte [ebp - 2], 3
jmp 0x450b86
push 2
lea eax, [ebp + 8]
push eax
push 0x49c428
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x450b26
or byte [ebp - 2], 1
jmp 0x450b86
push 2
lea eax, [ebp + 8]
push eax
push 0x49c424
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x450b43
or byte [ebp - 2], 2
jmp 0x450b86
push 4
lea eax, [ebp + 8]
push eax
push str.name
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x450b60
mov byte [ebp - 0x31], 1
jmp 0x450b86
push 1
lea eax, [ebp + 8]
push eax
push 0x49c418
call fcn.00437ad0
add esp, 0xc
test al, al
je 0x450b7c
inc byte [ebp - 0x1e]
jmp 0x450b86
lea eax, [ebp + 8]
push eax
call fcn.0040459d
pop ecx
mov esi, dword [ebp + 8]
movzx eax, word [esi]
cmp edi, eax
je 0x450a3e
lea ecx, [ebp - 0x24]
call fcn.00435d62
lea ecx, [ebp - 0x78]
call fcn.00435d62
lea ecx, [ebp - 0x4c]
call fcn.00435d62
lea ecx, [ebp - 0x60]
call fcn.00435d62
lea ecx, [ebp - 0x64]
call fcn.00435d62
mov ax, word [esi]
cmp ax, 0x2b
je 0x450bef
cmp ax, 0x23
je 0x450bef
cmp ax, 0x40
je 0x450bef
cmp ax, 0x24
je 0x450bef
cmp ax, 0x2a
je 0x450bef
cmp ax, 0x7e
je 0x450bef
cmp ax, 0x2e
je 0x450bef
cmp ax, 0x3f
jne 0x450c07
mov al, byte [esi]
inc esi
inc esi
cmp al, bl
mov byte [ebp - 1], al
mov dword [ebp + 8], esi
je 0x450c07
movzx ecx, word [esi]
movsx eax, al
cmp eax, ecx
je 0x450c0d
cmp word [esi], 0x24
jne 0x450c17
mov al, byte [esi]
inc esi
inc esi
mov byte [ebp - 9], al
mov dword [ebp + 8], esi
lea eax, [ebp + 8]
push eax
call fcn.00430961
mov eax, dword [ebp + 8]
pop ecx
mov dword [ebp - 0x38], eax
xor ecx, ecx
jmp 0x450c3f
cmp cx, 0x2c
je 0x450c4a
cmp cx, 0x3d
je 0x450c4a
cmp cx, 0x21
je 0x450c4a
inc eax
inc eax
mov dword [ebp - 0x2c], eax
mov cx, word [eax]
cmp cx, bx
jne 0x450c2b
mov cx, word [eax]
cmp cx, 0x2c
je 0x450c5f
cmp cx, 0x3d
je 0x450c5f
cmp cx, 0x21
jne 0x450c6f
mov cl, byte [eax]
mov word [eax], bx
add dword [ebp - 0x2c], 2
cmp cl, bl
mov byte [ebp - 0x25], cl
jne 0x450cc6
inc byte [ebp - 0x26]
cmp byte [ebp - 0x26], bl
jg 0x450cbc
mov ecx, dword [ebp - 0x40]
push 1
push ebx
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x6c]
call fcn.0043e7f3
mov eax, dword [ebp - 0x74]
lea ecx, [ebp - 0x64]
mov dword [ebp + 8], eax
call fcn.0043092f
lea ecx, [ebp - 0x60]
call fcn.0043092f
lea ecx, [ebp - 0x4c]
call fcn.0043092f
lea ecx, [ebp - 0x78]
call fcn.0043092f
lea ecx, [ebp - 0x24]
call fcn.0043092f
jmp 0x450a07
mov esi, 0x80070057
jmp 0x451aa8
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrW]
push 0x49c410
push dword [ebp + 8]
mov dword [ebp - 0x5c], ebx
call edi
mov esi, eax
cmp esi, ebx
jne 0x450cef
push 0x5c
push ebx
push ebx
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
mov esi, eax
cmp esi, ebx
je 0x450d43
mov ecx, dword [ebp - 0x40]
push 1
push ebx
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 8]
mov word [esi], bx
call fcn.0043e7f3
push 0x5c
push dword [ebp - 0x24]
call dword [sym.imp.SHLWAPI.dll_StrChrW]
cmp eax, ebx
jne 0x450d1d
mov esi, 0x80070057
jmp 0x451aa0
mov ecx, dword [ebp - 0x40]
mov word [eax], bx
inc eax
inc eax
push 1
mov dword [ebp - 0x1c], eax
push ebx
lea eax, [ebp - 0x5c]
push eax
add esi, 2
push esi
call fcn.0043e7f3
mov eax, dword [ebp - 0x5c]
mov dword [ebp + 8], eax
jmp 0x450dc7
push 1
push 0x2c
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x84]
call fcn.0044212f
push ebx
lea ecx, [ebp - 0x24]
push ecx
push eax
call fcn.004386e6
add esp, 0xc
push 0x5c
push dword [ebp - 0x24]
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov esi, eax
cmp esi, ebx
je 0x450d13
mov word [esi], bx
inc esi
inc esi
push 0x49c410
push esi
mov dword [ebp - 0x1c], esi
call edi
cmp byte [ebp - 2], bl
mov dword [ebp + 8], eax
je 0x450d9e
cmp eax, ebx
jne 0x450db8
push esi
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
lea eax, [esi + eax*2]
mov dword [ebp + 8], eax
cmp dword [ebp + 8], ebx
jne 0x450db8
push 0x5c
push ebx
push esi
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
cmp eax, ebx
mov dword [ebp + 8], eax
je 0x450d13
mov eax, dword [ebp + 8]
cmp word [eax], bx
je 0x450dc7
add dword [ebp + 8], 2
mov word [eax], bx
mov eax, dword [ebp + 8]
cmp word [eax], 0x5c
jne 0x450dd4
add dword [ebp + 8], 2
cmp byte [ebp - 0x31], bl
mov dword [ebp - 0x70], ebx
je 0x450df5
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x40]
call fcn.00448333
mov eax, dword [ebp - 0x70]
add esp, 0xc
mov dword [ebp - 0x2c], eax
cmp byte [ebp - 0x25], 0x2c
jne 0x450f4a
push 1
push 0x2c
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x84]
call fcn.0044212f
push ebx
lea ecx, [ebp - 0x4c]
push ecx
push eax
call fcn.004386e6
mov ecx, dword [ebp - 0x40]
add esp, 0xc
push ebx
lea eax, [ebp - 0x4c]
push eax
call fcn.00402c4d
cmp byte [ebp - 1], 0x2e
jne 0x450e6e
mov eax, dword [ebp - 0x2c]
cmp word [eax], 0x2c
jne 0x450e6e
add dword [ebp - 0x2c], 2
push 1
push 0x2c
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x84]
call fcn.0044212f
push ebx
lea ecx, [ebp - 0x64]
push ecx
push eax
call fcn.004386e6
mov ecx, dword [ebp - 0x40]
add esp, 0xc
push ebx
lea eax, [ebp - 0x64]
push eax
call fcn.00402c4d
mov eax, dword [ebp - 0x4c]
cmp word [eax], bx
jne 0x450e83
push str.RegDat
lea ecx, [ebp - 0x4c]
call fcn.0044042b
mov edi, dword [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.DLL_lstrcmpiW]
push str.HKLM
push dword [ebp - 0x24]
call esi
test eax, eax
je 0x45105d
push str.HKEY_LOCAL_MACHINE
push dword [ebp - 0x24]
call esi
test eax, eax
je 0x45105d
push str.HKCU
push dword [ebp - 0x24]
call esi
test eax, eax
je 0x451054
push str.HKEY_CURRENT_USER
push dword [ebp - 0x24]
call esi
test eax, eax
je 0x451054
push str.HKCR
push dword [ebp - 0x24]
call esi
test eax, eax
je 0x45104b
push str.HKEY_CLASSES_ROOT
push dword [ebp - 0x24]
call esi
test eax, eax
je 0x45104b
push 0x49c364
push dword [ebp - 0x24]
call esi
test eax, eax
je 0x451042
push str.HKEY_USERS
push dword [ebp - 0x24]
call esi
test eax, eax
je 0x451042
push str.HKCC
push dword [ebp - 0x24]
call esi
test eax, eax
je 0x451039
push str.HKEY_CURRENT_CONFIG
push dword [ebp - 0x24]
call esi
test eax, eax
je 0x451039
mov esi, 0x80070057
jmp 0x451a98
cmp byte [ebp - 0x25], 0x21
je 0x450e83
mov eax, dword [ebp - 0x2c]
cmp word [eax], bx
jne 0x450f72
cmp byte [ebp - 1], 0x24
je 0x450f8e
cmp byte [ebp - 1], 0x2a
je 0x450f72
cmp byte [ebp - 1], 0x7e
jne 0x450e83
cmp byte [ebp - 1], 0x24
je 0x450f8e
cmp byte [ebp - 1], 0x2a
je 0x450f8e
cmp byte [ebp - 1], 0x7e
je 0x450f8e
lea eax, [ebp - 0x2c]
push eax
call fcn.00430961
pop ecx
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x54]
call fcn.004403c3
mov edx, dword [ebp - 0x54]
lea eax, [ebp - 0x44]
push eax
mov dword [ebp - 0x44], edx
call fcn.00430961
cmp byte [ebp + 0xc], bl
pop ecx
je 0x450fb9
push edx
lea ecx, [ebp - 0x60]
call fcn.0044042b
jmp 0x450fc9
mov ecx, dword [ebp - 0x40]
push 1
push ebx
lea eax, [ebp - 0x60]
push eax
push edx
call fcn.0043d5b3
mov edi, dword [ebp - 0x60]
lea eax, [ebp + 0xc]
push eax
mov dword [ebp - 8], edi
mov dword [ebp + 0xc], edi
call fcn.00430961
cmp byte [ebp - 1], bl
pop ecx
jne 0x451010
push dword [ebp - 0x44]
push 0x49c310
call dword [sym.imp.KERNEL32.DLL_lstrcmpW]
test eax, eax
jne 0x450ffa
mov edi, 0x4949a4
jmp 0x451029
mov ecx, dword [ebp + 0xc]
mov ax, word [ecx]
cmp ax, 0x23
je 0x45100c
cmp ax, 0x40
jne 0x45102c
mov edi, ecx
jmp 0x451029
cmp byte [ebp - 1], 0x23
je 0x45101c
cmp byte [ebp - 1], 0x40
jne 0x45102c
mov edi, dword [ebp + 0xc]
cmp word [edi], bx
mov dword [ebp - 8], edi
jne 0x45102c
xor edi, edi
mov dword [ebp - 8], edi
lea ecx, [ebp - 0x54]
call fcn.0043092f
jmp 0x450e86
mov dword [ebp - 0x18], 0x80000005
jmp 0x451064
mov dword [ebp - 0x18], 0x80000003
jmp 0x451064
mov dword [ebp - 0x18], 0x80000000
jmp 0x451064
mov dword [ebp - 0x18], 0x80000001
jmp 0x451064
mov dword [ebp - 0x18], 0x80000002
mov eax, dword [ebp - 0x4c]
cmp word [eax], bx
je 0x451635
cmp byte [ebp - 1], 0x2e
je 0x45107f
cmp byte [ebp - 1], 0x3f
mov dword [ebp - 0x10], ebx
jne 0x45108c
cmp byte [ebp - 1], 0x3f
mov dword [ebp - 0x10], 1
je 0x45109b
cmp dword [ebp - 0x10], ebx
je 0x451096
cmp word [eax], bx
je 0x45109b
mov dword [ebp - 0x14], ebx
jmp 0x4510a2
mov dword [ebp - 0x14], 1
push ebx
call dword [sym.imp.KERNEL32.DLL_SetLastError]
push 0x64
lea ecx, [ebp + 0xc]
mov dword [ebp - 0x44], ebx
call fcn.00435d80
lea ecx, [ebp - 0x48]
call fcn.00435d62
cmp byte [ebp - 1], 0x2e
lea eax, [ebp - 0x48]
je 0x4510ca
lea eax, [ebp + 0xc]
push 0x1000
lea ecx, [ebp - 8]
mov dword [ebp - 0x30], eax
call fcn.00435c56
cmp byte [ebp - 2], bl
mov dword [ebp - 0x58], 0xfff
mov dword [ebp - 0x38], ebx
je 0x45125d
lea eax, [ebp + 8]
push eax
push 9
push ebx
push dword [ebp - 0x1c]
mov dword [ebp - 0x68], ebx
push dword [ebp - 0x18]
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp + 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push ebx
push ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x50]
push eax
push ebx
push ebx
push ebx
push dword [ebp + 8]
call esi
push ebx
push ebx
push ebx
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x54]
push eax
push ebx
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x50]
push eax
push ebx
push ebx
push ebx
push dword [ebp + 8]
call esi
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x14], eax
jae 0x451158
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
lea eax, [eax*4 + 0x20]
mov dword [ebp - 0x18], eax
shr eax, 1
add eax, 8
push eax
lea ecx, [ebp - 0x38]
call fcn.00435d80
cmp byte [ebp - 2], 3
mov esi, dword [ebp - 0x38]
mov word [esi], 0xd
mov word [esi + 2], 0xa
lea eax, [esi + 4]
mov word [eax], 0x76
lea edi, [esi + 8]
mov word [esi + 6], 0x20
mov dword [ebp - 0x1c], eax
mov word [edi], bx
je 0x4511a1
lea edi, [esi + 4]
cmp dword [ebp - 0x10], ebx
jne 0x451242
test byte [ebp - 2], 1
je 0x4511f3
cmp dword [ebp - 0x54], ebx
mov dword [ebp - 0x10], ebx
jle 0x4511f3
mov eax, dword [ebp - 0x18]
push ebx
push ebx
push ebx
push ebx
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x68]
push eax
push edi
push dword [ebp - 0x10]
mov word [edi], bx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x4511e8
push dword [ebp - 0x1c]
lea ecx, [ebp + 0xc]
call fcn.00435dd0
mov dword [ebp - 0x1c], esi
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x54]
jl 0x4511b8
test byte [ebp - 2], 2
mov word [esi + 4], 0x6b
je 0x451242
cmp dword [ebp - 0x50], ebx
mov dword [ebp - 0x10], ebx
jle 0x451242
mov eax, dword [ebp - 0x18]
push ebx
push ebx
push ebx
push ebx
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x68]
push eax
push edi
push dword [ebp - 0x10]
mov word [edi], bx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x451237
push dword [ebp - 0x1c]
lea ecx, [ebp + 0xc]
call fcn.00435dd0
mov dword [ebp - 0x1c], esi
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x50]
jl 0x451207
cmp dword [ebp + 8], ebx
je 0x451250
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x38]
call fcn.0043092f
jmp 0x4515eb
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
call fcn.00439eeb
mov edi, eax
add esp, 0x18
cmp edi, ebx
jge 0x4512e9
cmp word [esi], bx
mov esi, dword [ebp - 0x38]
jne 0x4512a7
cmp esi, 2
jne 0x4512a7
cmp edi, 0xfffffffe
jne 0x4512a7
cmp dword [ebp - 0x10], ebx
je 0x4515eb
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x49c30c
jmp 0x4512bf
cmp esi, ebx
jne 0x4512ae
xor esi, esi
inc esi
cmp dword [ebp - 0x10], ebx
mov dword [ebp - 0x44], esi
je 0x4512cc
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.ERROR
mov ecx, dword [ebp - 0x30]
call fcn.00435e1f
jmp 0x4515eb
lea ecx, [ebp - 8]
call fcn.0043092f
lea ecx, [ebp - 0x48]
call fcn.0043092f
lea ecx, [ebp + 0xc]
call fcn.0043092f
jmp 0x451a98
cmp edi, 1
jne 0x45134c
cmp dword [ebp - 0x10], ebx
je 0x45130d
mov ecx, dword [ebp - 0x30]
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_SZ
call fcn.00435e1f
cmp dword [ebp - 0x14], ebx
jne 0x4515eb
cmp byte [ebp - 1], 0x24
je 0x45133b
cmp byte [ebp - 1], 0x2e
je 0x45133b
cmp byte [ebp - 1], bl
je 0x45133b
lea ecx, [ebp - 8]
call fcn.0043092f
lea ecx, [ebp - 0x48]
call fcn.0043092f
lea ecx, [ebp + 0xc]
call fcn.0043092f
jmp 0x450f40
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
mov dword [ebp + 0xc], ecx
mov dword [ebp - 8], eax
jmp 0x4515eb
cmp edi, 0xb
jne 0x451399
cmp dword [ebp - 0x10], ebx
je 0x451370
mov ecx, dword [ebp - 0x30]
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_QWORD
call fcn.00435e1f
cmp dword [ebp - 0x14], ebx
jne 0x4515eb
cmp byte [ebp - 1], 0x2b
je 0x45137c
cmp byte [ebp - 1], 0x2e
jne 0x45131e
mov eax, dword [ebp - 8]
push str.0x_I64x
push dword [eax + 4]
push dword [eax]
push dword [ebp + 0xc]
call fcn.004752a8
add esp, 0x10
jmp 0x4515eb
cmp edi, 4
jne 0x4513e8
cmp dword [ebp - 0x10], ebx
je 0x4513bd
mov ecx, dword [ebp - 0x30]
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_DWORD
call fcn.00435e1f
cmp dword [ebp - 0x14], ebx
jne 0x4515eb
cmp byte [ebp - 1], 0x23
je 0x4513cd
cmp byte [ebp - 1], 0x2e
jne 0x45131e
mov eax, dword [ebp - 8]
push dword [eax]
push str.0x_x
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x4515eb
cmp edi, 3
jne 0x451489
cmp dword [ebp - 0x10], ebx
je 0x451410
mov ecx, dword [ebp - 0x30]
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_BINARY
call fcn.00435e1f
cmp dword [ebp - 0x14], ebx
jne 0x4515eb
cmp byte [ebp - 1], 0x40
je 0x451420
cmp byte [ebp - 1], 0x2e
jne 0x45131e
mov eax, dword [ebp - 0x58]
lea eax, [eax + eax*4 + 6]
push eax
lea ecx, [ebp + 0xc]
call fcn.00435da9
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp - 8]
mov word [edi], bx
cmp dword [ebp - 0x58], ebx
jle 0x451452
movzx eax, byte [esi]
push eax
push str.0x_02X
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
inc esi
add edi, 8
mov dword [ebp + 8], edi
xor edi, edi
inc edi
cmp dword [ebp - 0x58], edi
jle 0x4515eb
movzx eax, byte [esi]
push eax
push str._0x_02X
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_wsprintfW]
add dword [ebp + 8], 0xa
add esp, 0xc
inc esi
inc edi
cmp edi, dword [ebp - 0x58]
jl 0x451464
jmp 0x4515eb
cmp edi, 2
jne 0x4514e1
cmp dword [ebp - 0x10], ebx
je 0x4514ad
mov ecx, dword [ebp - 0x30]
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_EXPAND_SZ
call fcn.00435e1f
cmp dword [ebp - 0x14], ebx
jne 0x4515eb
cmp byte [ebp - 1], 0x7e
je 0x4514bd
cmp byte [ebp - 1], 0x2e
jne 0x45131e
cmp byte [ebp - 9], bl
je 0x45133b
mov eax, dword [ebp - 8]
push 1
push ebx
lea ecx, [ebp + 0xc]
push ecx
mov ecx, dword [ebp - 0x40]
push eax
mov dword [ebp - 0x2c], eax
call fcn.0043e7f3
jmp 0x4515eb
cmp edi, 7
jne 0x4515b4
cmp dword [ebp - 0x10], ebx
je 0x451509
mov ecx, dword [ebp - 0x30]
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_MULTI_SZ
call fcn.00435e1f
cmp dword [ebp - 0x14], ebx
jne 0x4515eb
cmp byte [ebp - 1], 0x2a
je 0x451519
cmp byte [ebp - 1], 0x2e
jne 0x45131e
mov esi, dword [ebp - 0x58]
shr esi, 1
lea eax, [esi*4 + 6]
push eax
lea ecx, [ebp + 0xc]
call fcn.00435da9
mov edi, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
lea esi, [edi + esi*2]
cmp edi, esi
mov dword [ebp + 8], esi
jae 0x4515af
push 2
pop esi
cmp byte [ebp - 9], 0x2a
jne 0x451579
cmp word [edi], 0x5c
jne 0x451579
lea ecx, [edi + 2]
mov dx, word [ecx]
cmp dx, 0x30
je 0x451564
cmp dx, 0x5c
je 0x451564
cmp dx, bx
jne 0x451579
mov edi, ecx
mov word [eax], 0x5c
mov cx, word [edi]
add eax, esi
mov word [eax], cx
add eax, esi
add edi, esi
jmp 0x4515aa
mov cx, word [edi]
cmp cx, bx
jne 0x451570
add edi, esi
cmp byte [ebp - 9], 0x24
jne 0x45159c
cmp edi, dword [ebp + 8]
jae 0x4515af
mov word [eax], 0xd
add eax, esi
mov word [eax], 0xa
jmp 0x4515a8
mov word [eax], 0x5c
add eax, esi
mov word [eax], 0x30
add eax, esi
cmp edi, dword [ebp + 8]
jb 0x451541
mov word [eax], bx
jmp 0x4515eb
cmp dword [ebp - 0x10], ebx
je 0x4515db
mov esi, dword [ebp - 0x30]
push 0x32
mov ecx, esi
call fcn.00435da9
push edi
push 0x49b0b0
push dword [esi]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
cmp dword [ebp - 0x14], ebx
jne 0x4515eb
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, ebx
jne 0x4515e8
xor eax, eax
inc eax
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x4c]
cmp word [eax], bx
je 0x4515ff
push dword [ebp + 0xc]
mov ecx, dword [ebp - 0x40]
push eax
call fcn.00435749
mov eax, dword [ebp - 0x64]
cmp word [eax], bx
je 0x451615
mov ecx, dword [ebp - 0x30]
push dword [ecx]
mov ecx, dword [ebp - 0x40]
push eax
call fcn.00435749
lea ecx, [ebp - 8]
call fcn.0043092f
lea ecx, [ebp - 0x48]
call fcn.0043092f
lea ecx, [ebp + 0xc]
call fcn.0043092f
mov esi, dword [ebp - 0x44]
jmp 0x451a98
cmp edi, ebx
je 0x451a10
cmp byte [ebp - 0x1e], bl
je 0x451676
push ebx
lea eax, [ebp - 0x44]
push eax
push ebx
push 1
push ebx
push ebx
push ebx
push dword [ebp - 0x1c]
mov dword [ebp - 0x44], ebx
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp dword [ebp - 0x44], ebx
mov esi, eax
je 0x45166c
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x1e], 2
jge 0x451a98
mov al, byte [ebp - 1]
cmp al, 0x2b
je 0x451693
cmp al, bl
jne 0x4516fa
mov ax, word [edi]
cmp ax, 0x2b
jne 0x451721
inc edi
inc edi
mov dword [ebp - 8], edi
cmp byte [ebp - 0x1d], bl
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
je 0x4519f0
xor ecx, ecx
mov cx, word [edi]
mov eax, ecx
call fcn.00435990
test al, al
je 0x450f40
cmp cx, 0x30
jne 0x4516cd
mov ax, word [edi + 2]
or ax, 0x20
cmp ax, 0x78
jne 0x4516cd
add edi, 4
push edi
call fcn.004367f2
pop ecx
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], edx
push 8
lea eax, [ebp - 0x3c]
push eax
push 0xb
push dword [ebp + 8]
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
call fcn.00431794
add esp, 0x18
mov esi, eax
jmp 0x451a98
cmp al, 0x23
je 0x45172c
cmp al, 0x40
je 0x451781
cmp al, 0x2a
je 0x45180b
cmp al, 0x7e
je 0x4518cd
push edi
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
shl eax, 1
push eax
push edi
push 1
jmp 0x4516e2
cmp ax, 0x23
jne 0x451772
inc edi
inc edi
mov dword [ebp - 8], edi
cmp byte [ebp - 0x1d], bl
mov dword [ebp + 0xc], ebx
je 0x4519cf
xor ecx, ecx
mov cx, word [edi]
mov eax, ecx
call fcn.00435990
test al, al
je 0x450f40
cmp cx, 0x30
jne 0x451763
mov ax, word [edi + 2]
or ax, 0x20
cmp ax, 0x78
jne 0x451763
add edi, 4
push edi
call fcn.004367f2
pop ecx
mov dword [ebp + 0xc], eax
jmp 0x4519e3
cmp ax, 0x40
jne 0x4517ff
inc edi
inc edi
mov dword [ebp - 8], edi
push edi
xor esi, esi
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
mov edi, eax
push edi
lea ecx, [ebp + 0xc]
call fcn.00435c56
lea eax, [ebp - 8]
push eax
call fcn.00430961
cmp edi, ebx
pop ecx
jle 0x4519a9
mov eax, dword [ebp - 8]
mov cx, word [eax]
cmp cx, bx
je 0x4519a9
cmp byte [ebp - 0x1d], bl
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
je 0x451988
cmp cx, 0x30
jne 0x4517df
mov cx, word [eax + 2]
or cx, 0x20
cmp cx, 0x78
jne 0x4517df
add eax, 4
mov dword [ebp - 8], eax
push 2
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 8]
push eax
call fcn.004368b7
lea eax, [ebp - 8]
push eax
call fcn.00430961
add esp, 0x10
jmp 0x451997
cmp ax, 0x2a
jne 0x4518c1
inc edi
inc edi
push edi
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
mov esi, eax
lea eax, [esi + 0x10]
push eax
lea ecx, [ebp - 0x50]
mov dword [ebp + 0xc], ebx
call fcn.00435d80
mov edx, dword [ebp - 0x50]
lea ecx, [edi + esi*2]
cmp edi, ecx
mov eax, edi
mov dword [ebp - 0x38], ecx
jae 0x451870
cmp byte [ebp - 9], 0x2a
mov word [edx], bx
jne 0x451931
cmp word [eax], 0x5c
jne 0x451966
lea ecx, [eax + 2]
cmp word [ecx], 0x5c
jne 0x451966
mov eax, ecx
mov cx, word [eax]
mov word [edx], cx
inc edx
inc edx
inc eax
inc eax
mov dword [ebp + 0xc], ebx
cmp eax, dword [ebp - 0x38]
jb 0x451832
cmp dword [ebp + 0xc], 1
jge 0x451878
inc dword [ebp + 0xc]
mov word [edx], bx
inc edx
inc edx
cmp esi, ebx
jle 0x45189a
cmp dword [ebp + 0xc], 2
jge 0x45189a
push 2
pop esi
sub esi, dword [ebp + 0xc]
xor eax, eax
mov ecx, esi
shr ecx, 1
mov edi, edx
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
lea edx, [edx + esi*2]
mov word [edx], bx
sub edx, dword [ebp - 0x50]
push edx
push dword [ebp - 0x50]
push 7
push dword [ebp + 8]
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
call fcn.00431794
add esp, 0x18
mov esi, eax
lea ecx, [ebp - 0x50]
jmp 0x4512df
cmp ax, 0x7e
jne 0x451712
inc edi
inc edi
push edi
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
inc eax
push eax
lea ecx, [ebp + 0xc]
call fcn.00435d80
mov eax, dword [ebp + 0xc]
jmp 0x451904
mov cx, word [edi]
cmp cx, 0x5c
jne 0x4518fd
cmp word [edi + 2], 0x30
jne 0x4518fd
mov word [eax], bx
inc eax
inc eax
add edi, 4
jmp 0x451904
mov word [eax], cx
inc eax
inc eax
inc edi
inc edi
cmp word [edi], bx
jne 0x4518e3
mov word [eax], bx
sub eax, dword [ebp + 0xc]
sar eax, 1
shl eax, 1
push eax
push dword [ebp + 0xc]
push 2
push dword [ebp + 8]
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
call fcn.00431794
add esp, 0x18
mov esi, eax
jmp 0x4512dc
cmp byte [ebp - 9], 0x24
jne 0x451966
mov cx, word [eax]
cmp cx, 0xd
jne 0x45194d
lea edi, [eax + 2]
cmp word [edi], 0xa
jne 0x45194d
mov eax, edi
jmp 0x451957
cmp cx, 0xa
jne 0x45185b
inc eax
inc eax
mov word [edx], bx
inc edx
inc edx
inc dword [ebp + 0xc]
jmp 0x451865
mov cx, word [eax]
cmp cx, 0x5c
jne 0x45185b
cmp word [eax + 2], 0x30
jne 0x45185b
mov word [edx], bx
inc edx
inc edx
add eax, 4
jmp 0x45195e
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 8]
push eax
call fcn.00438b6a
pop ecx
pop ecx
mov al, byte [ebp - 0x3c]
mov ecx, dword [ebp + 0xc]
mov byte [ecx + esi], al
inc esi
cmp esi, edi
jl 0x4517a7
push esi
push dword [ebp + 0xc]
push 3
push dword [ebp + 8]
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
call fcn.00431794
add esp, 0x18
lea ecx, [ebp + 0xc]
mov esi, eax
call fcn.0043092f
jmp 0x451a98
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 8]
push eax
call fcn.00438b8e
cmp eax, 1
pop ecx
pop ecx
jl 0x451a08
push 4
lea eax, [ebp + 0xc]
push eax
push 4
jmp 0x4516e2
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 8]
push eax
call fcn.00438b6a
cmp eax, 1
pop ecx
pop ecx
jge 0x4516da
xor esi, esi
inc esi
jmp 0x451a98
cmp byte [ebp - 0x25], 0x21
jne 0x451a42
mov eax, dword [ebp + 8]
cmp word [eax], bx
jne 0x451a42
cmp dword [ebp - 0x14], ebx
je 0x451a33
push dword [ebp - 0x14]
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
call fcn.00437981
jmp 0x451a8c
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
call fcn.0044176d
pop ecx
pop ecx
jmp 0x451a8f
cmp dword [ebp - 0x14], ebx
je 0x451a7e
push ebx
lea eax, [ebp + 0xc]
push eax
movzx eax, word [0x4acb6c]
push ebx
or eax, 0x2001b
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x1c]
mov dword [ebp + 0xc], ebx
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp dword [ebp + 0xc], ebx
mov esi, eax
je 0x451a91
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x451a91
push dword [ebp + 8]
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
call fcn.004317de
add esp, 0xc
mov esi, eax
cmp esi, 2
jne 0x451a98
xor esi, esi
lea ecx, [ebp - 0x70]
call fcn.0043092f
lea ecx, [ebp - 0x5c]
call fcn.0043092f
lea ecx, [ebp - 0x64]
call fcn.0043092f
lea ecx, [ebp - 0x60]
call fcn.0043092f
lea ecx, [ebp - 0x4c]
call fcn.0043092f
lea ecx, [ebp - 0x78]
call fcn.0043092f
lea ecx, [ebp - 0x24]
call fcn.0043092f
lea ecx, [ebp - 0x74]
call fcn.0043092f
lea ecx, [ebp - 0x84]
call fcn.0043092f
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8