Function at 0x463863
Capabilities:
Encode data using base64
Parse credit card information
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x94
push ebx
push esi
push edi
mov dword [ebp + 0x18], ecx
push ecx
lea ecx, [ebp - 0x24]
call fcn.00448948
mov eax, dword [ebp + 0x78]
xor ebx, ebx
mov dword [ebp + 0x20], eax
lea eax, [ebp + 0x78]
push eax
mov byte [ebp + 0x32], 0xff
mov byte [ebp + 0x66], bl
mov byte [ebp + 0x53], bl
mov byte [ebp + 0x43], bl
mov dword [ebp - 8], ebx
call fcn.0043fe57
push 0xa
lea eax, [ebp + 0x78]
push eax
push str.___initram
call fcn.004485c7
add esp, 0x10
test al, al
jne 0x463d8e
mov dword [ebp + 0x68], ebx
mov esi, dword [ebp + 0x78]
mov ax, word [esi]
cmp ax, 0x2d
mov dword [ebp + 0x54], ebx
mov dword [ebp + 0x58], 0xfffffff0
mov byte [ebp + 0x6f], 0
mov byte [ebp + 0x63], 0
mov byte [ebp + 0x65], 0
mov byte [ebp + 0x67], 0
mov byte [ebp + 0x26], 0
mov byte [ebp + 0x64], 0
mov byte [ebp + 0x25], 0
mov byte [ebp + 0x27], 0
mov dword [ebp + 0x48], ebx
mov cl, 0x2a
jne 0x4638f9
mov cl, al
movsx ecx, cl
movzx eax, ax
cmp ecx, eax
mov dword [ebp + 0x14], ecx
jne 0x463b8c
movzx eax, word [esi + 2]
cmp dword [ebp + 0x14], eax
jne 0x463b8c
xor eax, eax
lea ecx, [esi + 4]
mov ax, word [ecx]
mov edx, eax
and dx, 0xffdf
cmp dx, 0x48
je 0x463b8c
call fcn.004b1b03
test al, al
jne 0x463b8c
xor edi, edi
mov esi, ecx
inc edi
push edi
push esi
push 0x4d0580
mov dword [ebp + 0x78], esi
call fcn.00441277
add esp, 0xc
test al, al
je 0x4639a1
lea eax, [ebp + 0x78]
add esi, 2
push eax
mov dword [ebp + 0x28], esi
call fcn.00408f31
cmp word [esi], 0x3a
pop ecx
je 0x463977
or dword [ebp + 0x48], 7
jmp 0x463b7d
lea eax, [ebp + 0x4c]
push eax
inc esi
lea eax, [ebp + 0x28]
inc esi
push eax
mov dword [ebp + 0x4c], ebx
mov dword [ebp + 0x28], esi
call fcn.004429d6
test eax, eax
pop ecx
pop ecx
jle 0x463b7d
mov eax, dword [ebp + 0x4c]
or dword [ebp + 0x48], eax
jmp 0x463b7d
push 2
push esi
push 0x4d057c
call fcn.00441277
add esp, 0xc
test al, al
lea eax, [ebp + 0x78]
je 0x4639ed
add esi, 4
push eax
mov dword [ebp + 0xc], esi
call fcn.00408f31
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp + 0xc]
push eax
mov dword [ebp + 0x4c], ebx
call fcn.00453e89
add esp, 0xc
test eax, eax
jle 0x463b7d
mov eax, dword [ebp + 0x4c]
mov dword [ebp + 0x54], eax
mov dword [ebp + 0x58], ebx
jmp 0x463b7d
push 2
pop esi
push esi
push eax
push 0x4cc58c
call fcn.004485c7
add esp, 0xc
test al, al
je 0x463a0c
mov byte [ebp + 0x65], 1
jmp 0x463b7d
push 3
lea eax, [ebp + 0x78]
push eax
push 0x4d0578
call fcn.004485c7
add esp, 0xc
test al, al
je 0x463a2c
mov byte [ebp + 0x43], 1
jmp 0x463b7d
push 4
lea eax, [ebp + 0x78]
push eax
push 0x4d0570
call fcn.004485c7
add esp, 0xc
test al, al
je 0x463a4c
mov byte [ebp + 0x64], 1
jmp 0x463b7d
push edi
lea eax, [ebp + 0x78]
push eax
push 0x4ca808
call fcn.004485c7
add esp, 0xc
test al, al
je 0x463a6b
mov byte [ebp + 0x67], 3
jmp 0x463b7d
push esi
lea eax, [ebp + 0x78]
push eax
push 0x4d056c
call fcn.004485c7
add esp, 0xc
test al, al
je 0x463a8a
or byte [ebp + 0x67], 1
jmp 0x463b7d
push esi
lea eax, [ebp + 0x78]
push eax
push 0x4d0568
call fcn.004485c7
add esp, 0xc
test al, al
je 0x463aa9
or byte [ebp + 0x67], 2
jmp 0x463b7d
push 4
lea eax, [ebp + 0x78]
push eax
push str.name
call fcn.004485c7
add esp, 0xc
test al, al
je 0x463ac9
mov byte [ebp + 0x26], 1
jmp 0x463b7d
push edi
lea eax, [ebp + 0x78]
push eax
push 0x4d055c
call fcn.004485c7
add esp, 0xc
test al, al
je 0x463ae7
inc byte [ebp + 0x66]
jmp 0x463b7d
push esi
lea eax, [ebp + 0x78]
push eax
push 0x4d0558
call fcn.004485c7
add esp, 0xc
test al, al
je 0x463b02
dec byte [ebp + 0x66]
jmp 0x463b7d
push edi
lea eax, [ebp + 0x78]
push eax
push 0x4d0554
call fcn.004485c7
add esp, 0xc
test al, al
je 0x463b1d
inc byte [ebp + 0x53]
jmp 0x463b7d
push esi
lea eax, [ebp + 0x78]
push eax
push 0x4d0550
call fcn.004485c7
add esp, 0xc
test al, al
je 0x463b39
mov byte [ebp + 0x25], 1
jmp 0x463b7d
push 4
lea eax, [ebp + 0x78]
push eax
push 0x4d0548
call fcn.004485c7
add esp, 0xc
test al, al
je 0x463b56
mov byte [ebp + 0x27], 1
jmp 0x463b7d
push esi
lea eax, [ebp + 0x78]
push eax
push 0x4c7ed8
call fcn.004485c7
add esp, 0xc
test al, al
je 0x463b73
call fcn.004442f4
jmp 0x463b7d
lea eax, [ebp + 0x78]
push eax
call fcn.00408f31
pop ecx
mov esi, dword [ebp + 0x78]
movzx eax, word [esi]
cmp dword [ebp + 0x14], eax
je 0x46390a
lea ecx, [ebp + 8]
call fcn.0044658e
lea ecx, [ebp - 0x14]
call fcn.0044658e
lea ecx, [ebp + 0x10]
call fcn.0044658e
lea ecx, [ebp + 4]
call fcn.0044658e
lea ecx, [ebp - 4]
call fcn.0044658e
xor eax, eax
mov ax, word [esi]
mov ecx, eax
or ecx, 0x20
cmp cx, 0x6e
je 0x463c06
cmp cx, 0x75
je 0x463c06
cmp cx, 0x62
je 0x463c06
cmp ax, 0x5e
je 0x463c06
cmp ax, 0x2b
je 0x463c06
cmp ax, 0x23
je 0x463c06
cmp ax, 0x40
je 0x463c06
cmp ax, 0x24
je 0x463c06
cmp ax, 0x2a
je 0x463c06
cmp ax, 0x7e
je 0x463c06
cmp ax, 0x2e
je 0x463c06
cmp ax, 0x3f
jne 0x463c1f
mov al, byte [esi]
inc esi
inc esi
test al, al
mov byte [ebp + 0x6f], al
mov dword [ebp + 0x78], esi
je 0x463c1f
movzx eax, word [esi]
movsx ecx, byte [ebp + 0x6f]
cmp ecx, eax
je 0x463c25
cmp word [esi], 0x24
jne 0x463c2f
mov al, byte [esi]
inc esi
inc esi
mov byte [ebp + 0x63], al
mov dword [ebp + 0x78], esi
cmp byte [ebp + 0x6f], 0x41
jl 0x463c3f
cmp byte [ebp + 0x6f], 0x5a
jg 0x463c3f
or byte [ebp + 0x6f], 0x20
lea eax, [ebp + 0x78]
push eax
call fcn.0043fe57
mov edi, dword [ebp + 0x78]
mov dword [esp], 0x4d0540
push edi
mov dword [ebp + 0x4c], edi
call dword [sym.imp.SHLWAPI.dll_StrStrW]
mov esi, eax
cmp esi, ebx
je 0x463c65
lea edi, [esi + 4]
mov edx, edi
mov dword [ebp + 0x3c], edx
cmp word [edi], bx
je 0x463cf8
mov ax, word [edx]
cmp ax, 0x2c
je 0x463caf
cmp ax, 0x3d
je 0x463cf8
cmp ax, 0x21
jne 0x463ca3
lea eax, [edx + 2]
mov dword [ebp + 0x28], eax
lea eax, [ebp + 0x28]
push eax
call fcn.0043fe57
mov eax, dword [ebp + 0x28]
cmp word [eax], bx
pop ecx
je 0x463cf8
lea edx, [eax - 2]
inc edx
inc edx
mov dword [ebp + 0x3c], edx
cmp word [edx], bx
jne 0x463c73
jmp 0x463cf8
add edx, 2
push 0x3d
push edx
call dword [sym.imp.SHLWAPI.dll_StrChrW]
cmp eax, ebx
je 0x463cc3
mov edx, eax
jmp 0x463cf0
mov eax, dword [ebp + 0x3c]
add eax, 2
push 0x21
push eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov edx, eax
cmp edx, ebx
je 0x463cf5
lea eax, [edx + 2]
mov dword [ebp + 0x28], eax
lea eax, [ebp + 0x28]
push eax
call fcn.0043fe57
mov eax, dword [ebp + 0x28]
cmp word [eax], bx
pop ecx
jne 0x463cf5
mov dword [ebp + 0x3c], edx
jmp 0x463cf8
mov edx, dword [ebp + 0x3c]
mov ax, word [edx]
cmp ax, 0x2c
je 0x463d0d
cmp ax, 0x3d
je 0x463d0d
cmp ax, 0x21
jne 0x463d21
mov al, byte [edx]
mov word [edx], bx
add dword [ebp + 0x3c], 2
test al, al
mov byte [ebp + 0x33], al
jne 0x463da7
inc byte [ebp + 0x32]
cmp byte [ebp + 0x32], 0
jg 0x463d9d
mov ecx, dword [ebp + 0x18]
push 1
push ebx
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x20]
call fcn.0045937c
mov eax, dword [ebp - 8]
lea ecx, [ebp - 4]
mov dword [ebp + 0x78], eax
call fcn.0043fe25
lea ecx, [ebp + 4]
call fcn.0043fe25
lea ecx, [ebp + 0x10]
call fcn.0043fe25
lea ecx, [ebp - 0x14]
call fcn.0043fe25
lea ecx, [ebp + 8]
call fcn.0043fe25
lea eax, [ebp + 0x78]
push eax
call fcn.0043fe57
push 0xa
lea eax, [ebp + 0x78]
push eax
push str.___initram
call fcn.004485c7
add esp, 0x10
test al, al
je 0x4638bc
push 3
call fcn.004131e2
pop ecx
xor esi, esi
jmp 0x464e12
mov esi, 0x80070057
jmp 0x464dea
cmp esi, ebx
mov dword [ebp - 0xc], ebx
jne 0x463dc0
push 0x5c
push ebx
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_StrRChrW]
call edi
mov esi, eax
cmp esi, ebx
je 0x463e10
mov ecx, dword [ebp + 0x18]
push 1
push ebx
lea eax, [ebp + 8]
mov word [esi], bx
push eax
push dword [ebp + 0x78]
inc esi
inc esi
call fcn.0045937c
mov eax, dword [ebp + 8]
push 0x5c
push eax
mov dword [ebp + 0x4c], eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
cmp eax, ebx
mov dword [ebp + 0x5c], eax
je 0x463df5
mov word [eax], bx
inc eax
inc eax
mov dword [ebp + 0x5c], eax
mov ecx, dword [ebp + 0x18]
push 1
push ebx
lea eax, [ebp - 0xc]
push eax
push esi
call fcn.0045937c
mov eax, dword [ebp - 0xc]
mov dword [ebp + 0x34], eax
jmp 0x463e99
push 1
push 0x2c
lea eax, [ebp + 0x4c]
push eax
lea ecx, [ebp - 0x24]
call fcn.0045bac5
push ebx
lea ecx, [ebp + 8]
push ecx
push eax
call fcn.004494ac
mov eax, dword [ebp + 8]
add esp, 0xc
push 0x5c
push eax
mov dword [ebp + 0x4c], eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov esi, eax
cmp esi, ebx
jne 0x463e4d
mov esi, 0x80070057
jmp 0x464de2
mov word [esi], bx
inc esi
inc esi
push 0x4d0540
push esi
mov dword [ebp + 0x5c], esi
call dword [sym.imp.SHLWAPI.dll_StrStrW]
cmp byte [ebp + 0x67], 0
mov dword [ebp + 0x34], eax
je 0x463e7b
cmp eax, ebx
jne 0x463e8c
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esi + eax*2]
mov dword [ebp + 0x34], eax
cmp eax, ebx
jne 0x463e8c
push 0x5c
push ebx
push esi
call edi
cmp eax, ebx
mov dword [ebp + 0x34], eax
je 0x463e43
cmp word [eax], bx
je 0x463e99
mov word [eax], bx
inc eax
inc eax
mov dword [ebp + 0x34], eax
cmp word [eax], 0x5c
jne 0x463ea4
inc eax
inc eax
mov dword [ebp + 0x34], eax
cmp byte [ebp + 0x26], 0
mov dword [ebp + 0x28], ebx
je 0x463ec8
lea eax, [ebp + 0x28]
push eax
lea eax, [ebp + 0x3c]
push eax
push dword [ebp + 0x18]
call fcn.00457be5
mov eax, dword [ebp + 0x28]
add esp, 0xc
mov dword [ebp + 0x3c], eax
jmp 0x463ecb
mov eax, dword [ebp + 0x3c]
cmp byte [ebp + 0x33], 0x2c
jne 0x463f5c
push 1
push 0x2c
lea eax, [ebp + 0x3c]
push eax
lea ecx, [ebp - 0x24]
call fcn.0045bac5
push ebx
lea ecx, [ebp + 0x10]
push ecx
push eax
call fcn.004494ac
mov ecx, dword [ebp + 0x18]
add esp, 0xc
push ebx
lea eax, [ebp + 0x10]
push eax
call fcn.00402f5e
cmp byte [ebp + 0x6f], 0x2e
jne 0x463f3e
mov eax, dword [ebp + 0x3c]
cmp word [eax], 0x2c
jne 0x463f3e
add dword [ebp + 0x3c], 2
push 1
push 0x2c
lea eax, [ebp + 0x3c]
push eax
lea ecx, [ebp - 0x24]
call fcn.0045bac5
push ebx
lea ecx, [ebp - 4]
push ecx
push eax
call fcn.004494ac
mov ecx, dword [ebp + 0x18]
add esp, 0xc
push ebx
lea eax, [ebp - 4]
push eax
call fcn.00402f5e
mov eax, dword [ebp + 0x10]
cmp word [eax], bx
jne 0x464055
push str.RegDat
lea ecx, [ebp + 0x10]
call fcn.0045066c
jmp 0x464055
cmp byte [ebp + 0x33], 0x21
je 0x464055
cmp word [eax], bx
jne 0x463f8f
cmp byte [ebp + 0x6f], 0x24
je 0x463fae
cmp byte [ebp + 0x6f], 0x2a
je 0x463f8f
cmp byte [ebp + 0x6f], 0x7e
je 0x463f8f
cmp byte [ebp + 0x53], 0
je 0x464055
mov dword [ebp + 0x68], eax
jmp 0x464055
cmp byte [ebp + 0x6f], 0x24
je 0x463fae
cmp byte [ebp + 0x6f], 0x2a
je 0x463fae
cmp byte [ebp + 0x6f], 0x7e
je 0x463fae
lea eax, [ebp + 0x3c]
push eax
call fcn.0043fe57
mov eax, dword [ebp + 0x3c]
pop ecx
push eax
lea ecx, [ebp + 0x14]
call fcn.004505eb
mov edx, dword [ebp + 0x14]
lea eax, [ebp + 0x78]
push eax
mov dword [ebp + 0x78], edx
call fcn.0043fe57
cmp byte [ebp + 0x7c], 0
pop ecx
je 0x463fd8
push edx
lea ecx, [ebp + 4]
call fcn.0045066c
jmp 0x463fe8
mov ecx, dword [ebp + 0x18]
push 1
push ebx
lea eax, [ebp + 4]
push eax
push edx
call fcn.00457f62
mov eax, dword [ebp + 4]
mov dword [ebp + 0x68], eax
mov dword [ebp + 0x7c], eax
lea eax, [ebp + 0x7c]
push eax
call fcn.0043fe57
cmp byte [ebp + 0x6f], 0
pop ecx
jne 0x464033
push dword [ebp + 0x78]
push 0x4d0528
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x46401c
mov dword [ebp + 0x68], 0x4c6a64
jmp 0x46404d
mov ecx, dword [ebp + 0x7c]
mov ax, word [ecx]
cmp ax, 0x23
je 0x46402e
cmp ax, 0x40
jne 0x46404d
mov dword [ebp + 0x68], ecx
jmp 0x46404d
cmp byte [ebp + 0x6f], 0x23
je 0x46403f
cmp byte [ebp + 0x6f], 0x40
jne 0x46404d
mov eax, dword [ebp + 0x7c]
cmp word [eax], bx
mov dword [ebp + 0x68], eax
jne 0x46404d
mov dword [ebp + 0x68], ebx
lea ecx, [ebp + 0x14]
call fcn.0043fe25
mov edi, dword [ebp + 0x4c]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str.HKLM
push edi
mov dword [ebp + 0x78], ebx
call esi
test eax, eax
je 0x46412f
push str.HKEY_LOCAL_MACHINE
push edi
call esi
test eax, eax
je 0x46412f
push str.HKCU
push edi
call esi
test eax, eax
je 0x464126
push str.HKEY_CURRENT_USER
push edi
call esi
test eax, eax
je 0x464126
push str.HKCR
push edi
call esi
test eax, eax
je 0x46411d
push str.HKEY_CLASSES_ROOT
push edi
call esi
test eax, eax
je 0x46411d
push 0x4d048c
push edi
call esi
test eax, eax
je 0x464114
push str.HKEY_USERS
push edi
call esi
test eax, eax
je 0x464114
push str.HKCC
push edi
call esi
test eax, eax
je 0x46410b
push str.HKEY_CURRENT_CONFIG
push edi
call esi
test eax, eax
je 0x46410b
lea eax, [ebp + 0x78]
push eax
lea eax, [ebp + 0x4c]
push eax
call fcn.00449a66
test eax, eax
pop ecx
pop ecx
je 0x464101
cmp dword [ebp + 0x78], ebx
jne 0x464136
mov esi, 0x80070057
jmp 0x464dda
mov dword [ebp + 0x78], 0x80000005
jmp 0x464136
mov dword [ebp + 0x78], 0x80000003
jmp 0x464136
mov dword [ebp + 0x78], 0x80000000
jmp 0x464136
mov dword [ebp + 0x78], 0x80000001
jmp 0x464136
mov dword [ebp + 0x78], 0x80000002
mov eax, dword [ebp + 0x10]
cmp word [eax], bx
je 0x46487a
cmp byte [ebp + 0x6f], 0x2e
je 0x464151
cmp byte [ebp + 0x6f], 0x3f
mov dword [ebp + 0x38], ebx
jne 0x46415e
cmp byte [ebp + 0x6f], 0x3f
mov dword [ebp + 0x38], 1
je 0x46416d
cmp dword [ebp + 0x38], ebx
je 0x464168
cmp word [eax], bx
je 0x46416d
mov dword [ebp + 0x48], ebx
jmp 0x464174
mov dword [ebp + 0x48], 1
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x64
lea ecx, [ebp + 0x68]
mov dword [ebp + 0xc], ebx
call fcn.004465ac
lea ecx, [ebp + 0x4c]
call fcn.0044658e
cmp byte [ebp + 0x6f], 0x2e
lea eax, [ebp + 0x4c]
je 0x46419c
lea eax, [ebp + 0x68]
push 0x1000
lea ecx, [ebp + 0x44]
mov dword [ebp + 0x2c], eax
call fcn.00446437
cmp byte [ebp + 0x67], 0
lea eax, [ebp + 0x7c]
mov dword [ebp], 0xfff
mov dword [ebp + 0x7c], ebx
mov dword [ebp + 0x20], ebx
push eax
je 0x464345
movzx eax, word [0x4e2c20]
or eax, 9
push eax
push ebx
push dword [ebp + 0x5c]
mov dword [ebp + 0x34], ebx
push dword [ebp + 0x78]
mov dword [ebp + 0x38], ebx
mov dword [ebp + 0x48], ebx
mov dword [ebp + 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp + 0x7c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push ebx
push ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp + 0x48]
push eax
lea eax, [ebp + 0x38]
push eax
push ebx
push ebx
push ebx
push dword [ebp + 0x7c]
call esi
push ebx
push ebx
push ebx
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 0x14]
push eax
push ebx
lea eax, [ebp + 0x48]
push eax
lea eax, [ebp + 0x38]
push eax
push ebx
push ebx
push ebx
push dword [ebp + 0x7c]
call esi
mov dword [ebp + 0x78], eax
mov eax, dword [ebp - 0x18]
cmp dword [ebp + 0x48], eax
jae 0x464237
mov dword [ebp + 0x48], eax
mov eax, dword [ebp + 0x48]
lea eax, [eax*4 + 0x20]
mov dword [ebp - 0x10], eax
shr eax, 1
add eax, 8
push eax
lea ecx, [ebp + 0x58]
call fcn.004465ac
mov esi, dword [ebp + 0x58]
mov word [esi], 0xd
mov word [esi + 2], 0xa
lea ebx, [esi + 4]
mov word [ebx], 0x76
lea edi, [esi + 8]
mov word [esi + 6], 0x20
and word [edi], 0
cmp byte [ebp + 0x67], 3
mov dword [ebp + 0x5c], ebx
je 0x464280
mov edi, ebx
cmp dword [ebp + 0x78], 0
jne 0x464329
test byte [ebp + 0x67], 1
je 0x4642d7
and dword [ebp + 0x78], 0
cmp dword [ebp + 0x14], 0
jle 0x4642d7
mov eax, dword [ebp - 0x10]
mov dword [ebp + 0x34], eax
xor eax, eax
push eax
push eax
push eax
push eax
mov word [edi], ax
lea eax, [ebp + 0x34]
push eax
push edi
push dword [ebp + 0x78]
push dword [ebp + 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x4642cc
push dword [ebp + 0x5c]
lea ecx, [ebp + 0x68]
call fcn.004465fa
mov dword [ebp + 0x5c], esi
inc dword [ebp + 0x78]
mov eax, dword [ebp + 0x78]
cmp eax, dword [ebp + 0x14]
jl 0x46429a
test byte [ebp + 0x67], 2
mov word [ebx], 0x6b
je 0x464329
and dword [ebp + 0x78], 0
cmp dword [ebp + 0x38], 0
jle 0x464329
xor ebx, ebx
mov eax, dword [ebp - 0x10]
push ebx
push ebx
push ebx
push ebx
mov dword [ebp + 0x34], eax
lea eax, [ebp + 0x34]
push eax
push edi
push dword [ebp + 0x78]
mov word [edi], bx
push dword [ebp + 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x46431e
push dword [ebp + 0x5c]
lea ecx, [ebp + 0x68]
call fcn.004465fa
mov dword [ebp + 0x5c], esi
inc dword [ebp + 0x78]
mov eax, dword [ebp + 0x78]
cmp eax, dword [ebp + 0x38]
jl 0x4642ee
cmp dword [ebp + 0x7c], 0
je 0x464338
push dword [ebp + 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 0x58]
call fcn.0043fe25
jmp 0x464827
lea eax, [ebp]
push eax
lea eax, [ebp + 0x44]
push eax
push dword [ebp + 0x34]
push dword [ebp + 0x5c]
push dword [ebp + 0x78]
call fcn.0044ad45
mov esi, dword [ebp + 0x7c]
add esp, 0x18
cmp esi, ebx
mov edi, eax
je 0x4643d2
mov eax, dword [ebp + 0x34]
cmp word [eax], bx
jne 0x46438d
cmp esi, 2
jne 0x46438d
cmp edi, 0xfffffffe
jne 0x46438d
cmp dword [ebp + 0x38], ebx
je 0x464829
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x4d043c
jmp 0x46439e
cmp dword [ebp + 0x38], ebx
mov dword [ebp + 0xc], esi
je 0x4643ab
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.ERROR
mov ecx, dword [ebp + 0x2c]
call fcn.00446649
jmp 0x464829
cmp byte [ebp + 0x27], 0
jne 0x464829
lea ecx, [ebp + 0x44]
call fcn.0043fe25
lea ecx, [ebp + 0x4c]
call fcn.0043fe25
lea ecx, [ebp + 0x68]
call fcn.0043fe25
jmp 0x464dda
cmp dword [ebp + 0x58], ebx
jl 0x4643f3
jg 0x4643de
cmp dword [ebp + 0x54], ebx
jb 0x4643f3
xor eax, eax
cmp dword [ebp + 0x54], edi
jne 0x4643ea
cmp dword [ebp + 0x58], eax
je 0x4643f3
mov dword [ebp + 0x5c], 1
jmp 0x4643f6
mov dword [ebp + 0x5c], ebx
cmp edi, 1
mov byte [ebp + 0x7b], 0
mov byte [ebp + 0x7f], 0xff
mov eax, str.REG_SZ
jne 0x464410
mov bl, 0x24
mov byte [ebp + 0x7f], 0
jmp 0x46442a
cmp edi, 6
jne 0x46441e
mov eax, str.REG_LINK
mov bl, 0x5e
jmp 0x46442a
cmp edi, 0x15
jne 0x464481
mov eax, str.REG_MUI_SZ
mov bl, 0x75
xor esi, esi
cmp dword [ebp + 0x38], esi
je 0x464447
mov ecx, dword [ebp + 0x2c]
push 0xffffffffffffffff
push 0xffffffffffffffff
push eax
call fcn.00446649
cmp dword [ebp + 0x48], esi
jne 0x464827
cmp dword [ebp + 0x5c], esi
jne 0x4647b6
cmp dword [ebp + 0x58], esi
jg 0x464470
jl 0x46445c
cmp dword [ebp + 0x54], esi
jae 0x464470
mov al, byte [ebp + 0x6f]
cmp bl, al
je 0x464470
cmp al, 0x2e
je 0x464470
cmp byte [ebp + 0x7f], al
jne 0x4647b6
mov eax, dword [ebp + 0x68]
mov ecx, dword [ebp + 0x44]
mov dword [ebp + 0x68], ecx
mov dword [ebp + 0x44], eax
jmp 0x464827
cmp edi, 0xb
jne 0x4644f3
cmp dword [ebp + 0x38], ebx
je 0x4644a5
mov ecx, dword [ebp + 0x2c]
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_QWORD
call fcn.00446649
cmp dword [ebp + 0x48], ebx
jne 0x464827
cmp dword [ebp + 0x5c], ebx
jne 0x4647b6
cmp dword [ebp + 0x58], ebx
jg 0x4644ca
jl 0x4644ba
cmp dword [ebp + 0x54], ebx
jae 0x4644ca
cmp byte [ebp + 0x6f], 0x2b
je 0x4644ca
cmp byte [ebp + 0x6f], 0x2e
jne 0x4647b6
cmp byte [ebp + 0x43], 0
mov eax, str._I64u
jne 0x4644da
mov eax, str.0x_I64x
push eax
mov eax, dword [ebp + 0x44]
push dword [eax + 4]
push dword [eax]
push dword [ebp + 0x68]
call fcn.004a1252
add esp, 0x10
jmp 0x464827
cmp edi, 4
mov esi, dword [ebp + 0x44]
jne 0x464540
cmp dword [ebp + 0x38], ebx
je 0x46451a
mov ecx, dword [ebp + 0x2c]
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_DWORD
call fcn.00446649
cmp dword [ebp + 0x48], ebx
jne 0x464827
cmp dword [ebp + 0x5c], ebx
jne 0x4647b6
cmp dword [ebp + 0x58], ebx
jg 0x46459f
jl 0x46452f
cmp dword [ebp + 0x54], ebx
jae 0x46459f
cmp byte [ebp + 0x6f], 0x23
je 0x46459f
cmp byte [ebp + 0x6f], 0x2e
je 0x46459f
jmp 0x4647b6
cmp edi, 5
jne 0x4645c3
cmp dword [ebp + 0x38], ebx
je 0x464564
mov ecx, dword [ebp + 0x2c]
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_DWORD_BIG_ENDIAN
call fcn.00446649
cmp dword [ebp + 0x48], ebx
jne 0x464827
cmp dword [ebp + 0x5c], ebx
jne 0x4647b6
cmp dword [ebp + 0x58], ebx
jg 0x464589
jl 0x464579
cmp dword [ebp + 0x54], ebx
jae 0x464589
cmp byte [ebp + 0x6f], 0x62
je 0x464589
cmp byte [ebp + 0x6f], 0x2e
jne 0x4647b6
mov cl, byte [esi + 3]
mov al, byte [esi]
mov byte [esi], cl
mov byte [esi + 3], al
mov cl, byte [esi + 2]
mov al, byte [esi + 1]
mov byte [esi + 1], cl
mov byte [esi + 2], al
cmp byte [ebp + 0x43], 0
mov eax, 0x4cc8f4
jne 0x4645af
mov eax, str.0x_lx
push dword [esi]
push eax
push dword [ebp + 0x68]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x464827
cmp edi, 2
jne 0x464631
cmp dword [ebp + 0x38], ebx
je 0x4645e7
mov ecx, dword [ebp + 0x2c]
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_EXPAND_SZ
call fcn.00446649
cmp dword [ebp + 0x48], ebx
jne 0x464827
cmp dword [ebp + 0x5c], ebx
jne 0x4647b6
cmp dword [ebp + 0x58], ebx
jg 0x46460c
jl 0x4645fc
cmp dword [ebp + 0x54], ebx
jae 0x46460c
cmp byte [ebp + 0x6f], 0x7e
je 0x46460c
cmp byte [ebp + 0x6f], 0x2e
jne 0x4647b6
cmp byte [ebp + 0x63], 0
je 0x464470
mov eax, dword [ebp + 0x44]
push 1
push ebx
lea ecx, [ebp + 0x68]
push ecx
mov ecx, dword [ebp + 0x18]
push eax
mov dword [ebp + 0x3c], eax
call fcn.0045937c
jmp 0x464827
cmp edi, 7
jne 0x464714
cmp dword [ebp + 0x38], ebx
je 0x464659
mov ecx, dword [ebp + 0x2c]
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_MULTI_SZ
call fcn.00446649
cmp dword [ebp + 0x48], ebx
jne 0x464827
cmp dword [ebp + 0x5c], ebx
jne 0x4647b6
cmp dword [ebp + 0x58], ebx
jg 0x46467e
jl 0x46466e
cmp dword [ebp + 0x54], ebx
jae 0x46467e
cmp byte [ebp + 0x6f], 0x2a
je 0x46467e
cmp byte [ebp + 0x6f], 0x2e
jne 0x4647b6
mov esi, dword [ebp]
shr esi, 1
lea eax, [esi*4 + 6]
push eax
lea ecx, [ebp + 0x68]
call fcn.004465d3
mov ecx, dword [ebp + 0x44]
mov eax, dword [ebp + 0x68]
lea esi, [ecx + esi*2]
jmp 0x464708
cmp byte [ebp + 0x63], 0x2a
jne 0x4646cf
cmp word [ecx], 0x5c
jne 0x4646cf
lea edx, [ecx + 2]
mov di, word [edx]
cmp di, 0x30
je 0x4646c1
cmp di, 0x5c
je 0x4646c1
cmp di, bx
jne 0x4646cf
mov word [eax], 0x5c
mov ecx, edx
mov dx, word [ecx]
inc eax
inc eax
jmp 0x4646d7
mov dx, word [ecx]
cmp dx, bx
je 0x4646e0
mov word [eax], dx
inc eax
inc eax
inc ecx
inc ecx
jmp 0x464708
inc ecx
inc ecx
cmp byte [ebp + 0x63], 0x24
jne 0x4646fa
cmp ecx, esi
jae 0x46470c
mov word [eax], 0xd
inc eax
inc eax
mov word [eax], 0xa
jmp 0x464706
mov word [eax], 0x5c
inc eax
inc eax
mov word [eax], 0x30
inc eax
inc eax
cmp ecx, esi
jb 0x46469e
mov word [eax], bx
jmp 0x464827
cmp edi, 3
jne 0x464720
mov eax, str.REG_BINARY
jmp 0x46474d
cmp edi, ebx
jne 0x46472b
mov eax, str.REG_NONE
jmp 0x46474d
cmp edi, 8
jne 0x464737
mov eax, str.REG_RESOURCE_LIST
jmp 0x46474d
cmp edi, 9
jne 0x464743
mov eax, str.REG_FULL_RESOURCE_DESCRIPTOR
jmp 0x46474d
cmp edi, 0xa
jne 0x46476e
mov eax, str.REG_RESOURCE_REQUIREMENTS_LIST
cmp dword [ebp + 0x38], ebx
je 0x464768
mov ecx, dword [ebp + 0x2c]
push 0xffffffffffffffff
push 0xffffffffffffffff
push eax
call fcn.00446649
cmp dword [ebp + 0x48], ebx
jne 0x464827
mov byte [ebp + 0x7b], 0x40
jmp 0x464799
cmp dword [ebp + 0x38], ebx
je 0x464799
mov esi, dword [ebp + 0x2c]
push 0x32
mov ecx, esi
call fcn.004465d3
push edi
push str.0x_lx
push dword [esi]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
cmp dword [ebp + 0x48], ebx
jne 0x464827
cmp dword [ebp + 0x58], ebx
jg 0x4647b1
jl 0x4647a5
cmp dword [ebp + 0x54], ebx
jae 0x4647b1
mov al, byte [ebp + 0x6f]
cmp byte [ebp + 0x7b], al
je 0x4647b1
cmp al, 0x2e
jne 0x4647b6
cmp dword [ebp + 0x5c], ebx
je 0x4647d3
lea ecx, [ebp + 0x44]
call fcn.0043fe25
lea ecx, [ebp + 0x4c]
call fcn.0043fe25
lea ecx, [ebp + 0x68]
call fcn.0043fe25
jmp 0x464101
mov eax, dword [ebp]
lea eax, [eax + eax*4 + 7]
push eax
lea ecx, [ebp + 0x68]
call fcn.004465d3
mov edi, dword [ebp + 0x68]
mov esi, dword [ebp + 0x44]
xor ebx, ebx
mov word [edi], bx
mov word [edi + 2], bx
cmp dword [ebp], ebx
mov dword [ebp + 0x20], 1
jle 0x464827
cmp byte [ebp + 0x43], 0
mov ecx, 0x4d0328
jne 0x46480e
mov ecx, str._0x_02X
movzx eax, byte [esi]
push eax
push ecx
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
inc esi
inc ebx
add edi, 0xa
cmp ebx, dword [ebp]
jl 0x4647fe
xor ebx, ebx
mov eax, dword [ebp + 0x10]
cmp word [eax], bx
je 0x464844
mov edx, dword [ebp + 0x68]
mov ecx, dword [ebp + 0x20]
lea ecx, [edx + ecx*2]
push ecx
mov ecx, dword [ebp + 0x18]
push eax
call fcn.00445c44
mov eax, dword [ebp - 4]
cmp word [eax], bx
je 0x46485a
mov ecx, dword [ebp + 0x2c]
push dword [ecx]
mov ecx, dword [ebp + 0x18]
push eax
call fcn.00445c44
lea ecx, [ebp + 0x44]
call fcn.0043fe25
lea ecx, [ebp + 0x4c]
call fcn.0043fe25
lea ecx, [ebp + 0x68]
call fcn.0043fe25
mov esi, dword [ebp + 0xc]
jmp 0x464dda
cmp dword [ebp + 0x68], ebx
je 0x464d52
xor edx, edx
cmp byte [ebp + 0x66], dl
push 8
mov dword [ebp + 0x7c], edx
pop edi
mov dword [ebp + 0x1c], edx
mov dword [ebp + 0x20], edx
lea ebx, [ebp + 0x1c]
jg 0x46489e
cmp byte [ebp + 0x53], dl
je 0x4648c9
movsx eax, byte [ebp + 0x66]
push eax
push dword [ebp + 0x5c]
push dword [ebp + 0x78]
call fcn.00443719
add esp, 0xc
cmp byte [ebp + 0x66], 2
mov esi, eax
jge 0x464d45
cmp byte [ebp + 0x53], 0
jne 0x464d45
xor edx, edx
mov cl, byte [ebp + 0x6f]
cmp cl, 0x2b
je 0x464c98
test cl, cl
jne 0x4648ef
mov esi, dword [ebp + 0x68]
mov ax, word [esi]
cmp ax, 0x2b
jne 0x46492d
inc esi
inc esi
mov dword [ebp + 0x68], esi
jmp 0x464c9b
cmp cl, 0x23
je 0x464c1e
cmp cl, 0x62
jne 0x4649db
cmp byte [ebp + 0x64], 0
mov dword [ebp + 0x54], 5
mov dword [ebp + 0x58], edx
je 0x464941
movsx eax, byte [ebp + 0x65]
push eax
lea eax, [ebp + 0x7c]
push eax
push dword [ebp + 0x68]
call fcn.0044ae37
mov ebx, dword [ebp + 0x7c]
add esp, 0xc
jmp 0x4649b1
cmp ax, 0x23
jne 0x464a06
inc esi
inc esi
mov dword [ebp + 0x68], esi
jmp 0x464c21
cmp byte [ebp + 0x65], 0
je 0x464981
mov edx, dword [ebp + 0x68]
xor ecx, ecx
mov cx, word [edx]
mov eax, ecx
call fcn.0044601f
test al, al
je 0x464a69
cmp cx, 0x30
jne 0x464975
mov ax, word [edx + 2]
or ax, 0x20
cmp ax, 0x78
jne 0x464975
add edx, 4
push edx
call fcn.004471f2
pop ecx
mov dword [ebp + 0x1c], eax
jmp 0x464999
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.00453e89
cmp eax, 1
pop ecx
pop ecx
jl 0x464d06
mov al, byte [ebp + 0x1c]
mov cl, byte [ebp + 0x1f]
mov byte [ebp + 0x1c], cl
mov cl, byte [ebp + 0x1e]
mov byte [ebp + 0x1f], al
mov al, byte [ebp + 0x1d]
mov byte [ebp + 0x1d], cl
mov byte [ebp + 0x1e], al
push 4
pop edi
push edi
push ebx
push dword [ebp + 0x54]
xor esi, esi
cmp byte [ebp + 0x25], 0
push dword [ebp + 0x34]
push dword [ebp + 0x5c]
push dword [ebp + 0x78]
je 0x464d16
call dword [0x4e327c]
mov esi, eax
jmp 0x464d1e
cmp cl, 0x2a
je 0x464b14
cmp cl, 0x7e
je 0x464aab
cmp cl, 0x40
je 0x464a9c
cmp cl, 0x6e
mov esi, dword [ebp + 0x68]
jne 0x464a30
mov dword [ebp + 0x54], edx
jmp 0x464aa6
cmp ax, 0x2a
jne 0x464a16
inc esi
inc esi
mov dword [ebp + 0x68], esi
jmp 0x464b17
cmp ax, 0x7e
jne 0x464a26
push 2
pop edi
add esi, edi
jmp 0x464ab1
cmp ax, 0x40
jne 0x464a30
inc esi
inc esi
jmp 0x464a9f
cmp dword [ebp + 0x58], edx
jg 0x464b27
jl 0x464a44
cmp dword [ebp + 0x54], edx
jae 0x464b27
cmp cl, 0x5e
jne 0x464a52
mov dword [ebp + 0x54], 6
jmp 0x464a7d
cmp cl, 0x75
jne 0x464a60
mov dword [ebp + 0x54], 0x15
jmp 0x464a7d
test cl, cl
je 0x464a76
cmp cl, 0x24
je 0x464a76
lea ecx, [ebp + 0x7c]
call fcn.0043fe25
jmp 0x464101
mov dword [ebp + 0x54], 1
cmp byte [ebp + 0x64], 0
mov dword [ebp + 0x58], edx
jne 0x464b27
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
shl edi, 1
mov ebx, esi
jmp 0x4649b4
mov esi, dword [ebp + 0x68]
mov dword [ebp + 0x54], 3
mov dword [ebp + 0x58], edx
jmp 0x464b27
mov esi, dword [ebp + 0x68]
push 2
pop edi
cmp byte [ebp + 0x64], 0
mov dword [ebp + 0x54], edi
mov dword [ebp + 0x58], edx
jne 0x464b27
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 2
push eax
lea ecx, [ebp + 0x7c]
call fcn.004465d3
cmp word [esi], 0
mov ebx, dword [ebp + 0x7c]
mov ecx, esi
mov eax, ebx
je 0x464b05
mov dx, word [ecx]
cmp dx, 0x5c
jne 0x464af8
cmp word [ecx + 2], 0x30
jne 0x464af8
and word [eax], 0
add eax, edi
add ecx, 4
jmp 0x464aff
mov word [eax], dx
add eax, edi
add ecx, edi
cmp word [ecx], 0
jne 0x464add
and word [eax], 0
sub eax, ebx
add eax, edi
mov edi, eax
jmp 0x4649b4
mov esi, dword [ebp + 0x68]
cmp byte [ebp + 0x64], 0
mov dword [ebp + 0x54], 7
mov dword [ebp + 0x58], edx
je 0x464b3d
movsx eax, byte [ebp + 0x65]
push eax
lea eax, [ebp + 0x7c]
push eax
push esi
call fcn.0044ae37
mov edi, eax
jmp 0x464c3f
mov esi, dword [ebp + 0x68]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
lea eax, [ebx + 0x10]
push eax
lea ecx, [ebp + 0x7c]
xor edi, edi
call fcn.004465d3
mov edx, dword [ebp + 0x7c]
lea ecx, [esi + ebx*2]
cmp esi, ecx
mov eax, esi
mov dword [ebp + 0xc], ecx
jae 0x464b9b
and word [edx], 0
cmp byte [ebp + 0x63], 0x2a
jne 0x464bd2
cmp word [eax], 0x5c
jne 0x464bff
lea ecx, [eax + 2]
cmp word [ecx], 0x5c
jne 0x464bff
mov eax, ecx
mov cx, word [eax]
mov word [edx], cx
inc edx
inc edx
inc eax
inc eax
xor edi, edi
cmp eax, dword [ebp + 0xc]
jb 0x464b66
cmp edi, 1
jge 0x464ba2
and word [edx], 0
inc edi
inc edx
inc edx
test ebx, ebx
jle 0x464bc2
cmp edi, 2
jge 0x464bc2
push 2
pop esi
sub esi, edi
xor eax, eax
mov ecx, esi
shr ecx, 1
mov edi, edx
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
lea edx, [edx + esi*2]
mov ebx, dword [ebp + 0x7c]
and word [edx], 0
sub edx, ebx
mov edi, edx
jmp 0x4649b4
cmp byte [ebp + 0x63], 0x24
jne 0x464bff
mov cx, word [eax]
cmp cx, 0xd
jne 0x464bee
lea esi, [eax + 2]
cmp word [esi], 0xa
jne 0x464bee
mov eax, esi
jmp 0x464bf4
cmp cx, 0xa
jne 0x464b88
and word [edx], 0
inc eax
inc eax
inc edx
inc edx
inc edi
jmp 0x464b91
mov cx, word [eax]
cmp cx, 0x5c
jne 0x464b88
cmp word [eax + 2], 0x30
jne 0x464b88
and word [edx], 0
inc edx
inc edx
add eax, 4
jmp 0x464bfc
mov esi, dword [ebp + 0x68]
cmp byte [ebp + 0x64], 0
push 4
pop edi
mov dword [ebp + 0x54], edi
mov dword [ebp + 0x58], edx
je 0x464c4a
movsx eax, byte [ebp + 0x65]
push eax
lea eax, [ebp + 0x7c]
push eax
push esi
call fcn.0044ae37
mov ebx, dword [ebp + 0x7c]
add esp, 0xc
jmp 0x4649b4
cmp byte [ebp + 0x65], 0
je 0x464c89
xor ecx, ecx
mov cx, word [esi]
mov eax, ecx
call fcn.0044601f
test al, al
je 0x464a69
cmp cx, 0x30
jne 0x464c7a
mov ax, word [esi + 2]
or ax, 0x20
cmp ax, 0x78
jne 0x464c7a
add esi, edi
push esi
call fcn.004471f2
pop ecx
mov dword [ebp + 0x1c], eax
jmp 0x4649b4
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.00453e89
jmp 0x464cfb
mov esi, dword [ebp + 0x68]
cmp byte [ebp + 0x64], 0
mov dword [ebp + 0x54], 0xb
mov dword [ebp + 0x58], edx
jne 0x464c30
cmp byte [ebp + 0x65], 0
je 0x464cee
xor ecx, ecx
mov cx, word [esi]
mov eax, ecx
call fcn.0044601f
test al, al
je 0x464a69
cmp cx, 0x30
jne 0x464cdc
mov ax, word [esi + 2]
or ax, 0x20
cmp ax, 0x78
jne 0x464cdc
add esi, 4
push esi
call fcn.004471f2
pop ecx
mov dword [ebp + 0x1c], eax
mov dword [ebp + 0x20], edx
jmp 0x4649b4
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.00453c1f
cmp eax, 1
pop ecx
pop ecx
jge 0x4649b4
lea ecx, [ebp + 0x7c]
call fcn.0043fe25
xor esi, esi
inc esi
jmp 0x464dda
call fcn.004410db
add esp, 0x18
cmp esi, 0x3fd
jne 0x464d45
cmp byte [ebp + 0x66], 0
jne 0x464d45
push 1
push dword [ebp + 0x5c]
mov byte [ebp + 0x66], 1
push dword [ebp + 0x78]
call fcn.00443719
add esp, 0xc
jmp 0x4649b4
lea ecx, [ebp + 0x7c]
call fcn.0043fe25
jmp 0x464dda
cmp byte [ebp + 0x33], 0x21
jne 0x464d84
mov eax, dword [ebp + 0x34]
cmp word [eax], bx
jne 0x464d84
cmp dword [ebp + 0x48], ebx
je 0x464d75
push dword [ebp + 0x48]
push dword [ebp + 0x5c]
push dword [ebp + 0x78]
call fcn.00451b31
jmp 0x464dce
push dword [ebp + 0x5c]
push dword [ebp + 0x78]
call fcn.00451930
pop ecx
pop ecx
jmp 0x464dd1
cmp dword [ebp + 0x48], ebx
je 0x464dc0
push ebx
lea eax, [ebp + 0x7c]
push eax
movzx eax, word [0x4e2c20]
push ebx
or eax, 0x2001b
push eax
push ebx
push ebx
push ebx
push dword [ebp + 0x5c]
mov dword [ebp + 0x7c], ebx
push dword [ebp + 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp dword [ebp + 0x7c], ebx
mov esi, eax
je 0x464dd3
push dword [ebp + 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x464dd3
push dword [ebp + 0x34]
push dword [ebp + 0x5c]
push dword [ebp + 0x78]
call fcn.00441136
add esp, 0xc
mov esi, eax
cmp esi, 2
jne 0x464dda
xor esi, esi
lea ecx, [ebp + 0x28]
call fcn.0043fe25
lea ecx, [ebp - 0xc]
call fcn.0043fe25
lea ecx, [ebp - 4]
call fcn.0043fe25
lea ecx, [ebp + 4]
call fcn.0043fe25
lea ecx, [ebp + 0x10]
call fcn.0043fe25
lea ecx, [ebp - 0x14]
call fcn.0043fe25
lea ecx, [ebp + 8]
call fcn.0043fe25
lea ecx, [ebp - 8]
call fcn.0043fe25
lea ecx, [ebp - 0x24]
call fcn.0043fe25
pop edi
mov eax, esi
pop esi
pop ebx
add ebp, 0x70
leave
ret 8