Function at 0x3001c230
Capabilities:
Link many functions at runtime
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x61c
push ebx
push esi
and byte [ebp - 0x218], 0
and byte [ebp - 0x114], 0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
push 0x3001dd50
lea eax, [ebp - 0x114]
mov dword [ebp - 8], 0x104
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.mso97rt
lea eax, [ebp - 0x114]
push eax
call edi
and dword [0x3017be28], 0
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x31c]
push eax
call esi
push str..dll
lea eax, [ebp - 0x31c]
push eax
call edi
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x114]
push eax
push reloc.GRINTL32.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x30042c17
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x31c]
push eax
push reloc.GRINTL32.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x30042c17
mov eax, dword [0x3017be28]
test eax, eax
jne 0x3001c3ae
push 0x104
lea eax, [ebp - 0x114]
push eax
push dword [0x3017dd10]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x51c]
push eax
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.3001dd80
add esp, 0x14
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x114]
push eax
call esi
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x114]
push eax
call edi
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x218]
push eax
call esi
mov edi, 0x3001dd74
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x218]
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
shr ecx, 2
dec edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
lea eax, [ebp - 0x218]
rep movsb byte es:[edi], byte [esi]
push eax
call ebx
test eax, eax
mov dword [0x3017be28], eax
je 0x30042c83
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0xd
push eax
call esi
push 0x102
push dword [0x3017be28]
mov dword [0x3017be58], eax
call esi
push 0x10a
push dword [0x3017be28]
mov dword [0x3017b9e8], eax
call esi
push 0x10e
push dword [0x3017be28]
mov dword [0x3017bbe8], eax
call esi
push 0x110
push dword [0x3017be28]
mov dword [0x3017bccc], eax
call esi
push 0x127
push dword [0x3017be28]
mov dword [0x3017bc20], eax
call esi
push 0x128
push dword [0x3017be28]
mov dword [0x3017b93c], eax
call esi
push 0x132
push dword [0x3017be28]
mov dword [0x3017be80], eax
call esi
push 0x133
push dword [0x3017be28]
mov dword [0x3017bce8], eax
call esi
push 0x13e
push dword [0x3017be28]
mov dword [0x3017bab8], eax
call esi
push 0x141
push dword [0x3017be28]
mov dword [0x3017bea0], eax
call esi
push 0x142
push dword [0x3017be28]
mov dword [0x3017ba74], eax
call esi
push 0x144
push dword [0x3017be28]
mov dword [0x3017b970], eax
call esi
push 0x146
push dword [0x3017be28]
mov dword [0x3017bb08], eax
call esi
push 0x150
push dword [0x3017be28]
mov dword [0x3017bb2c], eax
call esi
push 0x151
push dword [0x3017be28]
mov dword [0x3017bb48], eax
call esi
push 0x152
push dword [0x3017be28]
mov dword [0x3017bcc4], eax
call esi
push 0x158
push dword [0x3017be28]
mov dword [0x3017be94], eax
call esi
push 0x15e
push dword [0x3017be28]
mov dword [0x3017ba8c], eax
call esi
push 0x173
push dword [0x3017be28]
mov dword [0x3017b978], eax
call esi
mov dword [0x3017b944], eax
push 0x17c
push dword [0x3017be28]
call esi
push 0x17d
push dword [0x3017be28]
mov dword [0x3017bdc4], eax
call esi
push 0x17f
push dword [0x3017be28]
mov dword [0x3017b980], eax
call esi
push 0x18a
push dword [0x3017be28]
mov dword [0x3017bd70], eax
call esi
push 0x18b
push dword [0x3017be28]
mov dword [0x3017ba1c], eax
call esi
push 0x194
push dword [0x3017be28]
mov dword [0x3017ba80], eax
call esi
push 0x196
push dword [0x3017be28]
mov dword [0x3017bea4], eax
call esi
push 0x198
push dword [0x3017be28]
mov dword [0x3017bd74], eax
call esi
push 0x199
push dword [0x3017be28]
mov dword [0x3017be6c], eax
call esi
push 0x19c
push dword [0x3017be28]
mov dword [0x3017bc74], eax
call esi
push 0x19f
push dword [0x3017be28]
mov dword [0x3017bc98], eax
call esi
push 0x1a8
push dword [0x3017be28]
mov dword [0x3017b9f0], eax
call esi
push 0x1a9
push dword [0x3017be28]
mov dword [0x3017bbc4], eax
call esi
push 0x1ae
push dword [0x3017be28]
mov dword [0x3017bca8], eax
call esi
push 0x1af
push dword [0x3017be28]
mov dword [0x3017bc84], eax
call esi
push 0x1b0
push dword [0x3017be28]
mov dword [0x3017beb8], eax
call esi
push 0x1ba
push dword [0x3017be28]
mov dword [0x3017ba40], eax
call esi
push 0x1bb
push dword [0x3017be28]
mov dword [0x3017ba14], eax
call esi
push 0x1c0
push dword [0x3017be28]
mov dword [0x3017bec0], eax
call esi
push 0x1c5
push dword [0x3017be28]
mov dword [0x3017bd90], eax
call esi
mov dword [0x3017bc3c], eax
push 0x1cb
push dword [0x3017be28]
call esi
push 0x1d1
push dword [0x3017be28]
mov dword [0x3017bd6c], eax
call esi
push 0x1d5
push dword [0x3017be28]
mov dword [0x3017baa8], eax
call esi
push 0x1d8
push dword [0x3017be28]
mov dword [0x3017bc2c], eax
call esi
push 0x1dd
push dword [0x3017be28]
mov dword [0x3017ba60], eax
call esi
push 0x1df
push dword [0x3017be28]
mov dword [0x3017bde0], eax
call esi
push 0x1e1
push dword [0x3017be28]
mov dword [0x3017bebc], eax
call esi
push 0x1e7
push dword [0x3017be28]
mov dword [0x3017ba3c], eax
call esi
push 0x1ea
push dword [0x3017be28]
mov dword [0x3017bdcc], eax
call esi
push 0x1ed
push dword [0x3017be28]
mov dword [0x3017be00], eax
call esi
push 0x1f3
push dword [0x3017be28]
mov dword [0x3017bed8], eax
call esi
push 0x20d
push dword [0x3017be28]
mov dword [0x3017be18], eax
call esi
push 0x223
push dword [0x3017be28]
mov dword [0x3017bb68], eax
call esi
push 0x22b
push dword [0x3017be28]
mov dword [0x3017ba34], eax
call esi
push 0x22c
push dword [0x3017be28]
mov dword [0x3017bc00], eax
call esi
push 0x22d
push dword [0x3017be28]
mov dword [0x3017bacc], eax
call esi
push 0x23e
push dword [0x3017be28]
mov dword [0x3017be64], eax
call esi
push 0x23f
push dword [0x3017be28]
mov dword [0x3017b9a8], eax
call esi
push 0x240
push dword [0x3017be28]
mov dword [0x3017be8c], eax
call esi
push 0x24b
push dword [0x3017be28]
mov dword [0x3017bcf8], eax
call esi
push 0x24c
push dword [0x3017be28]
mov dword [0x3017bbf0], eax
call esi
push 0x24d
push dword [0x3017be28]
mov dword [0x3017b9fc], eax
call esi
push 0x24e
push dword [0x3017be28]
mov dword [0x3017bc80], eax
call esi
push 0x251
push dword [0x3017be28]
mov dword [0x3017b984], eax
call esi
push 0x252
push dword [0x3017be28]
mov dword [0x3017bb7c], eax
call esi
push 0x253
push dword [0x3017be28]
mov dword [0x3017bbf4], eax
call esi
push 0x259
push dword [0x3017be28]
mov dword [0x3017bd60], eax
call esi
push 0x25d
push dword [0x3017be28]
mov dword [0x3017be74], eax
call esi
push 0x25e
push dword [0x3017be28]
mov dword [0x3017befc], eax
call esi
push 0x25f
push dword [0x3017be28]
mov dword [0x3017bdb8], eax
call esi
push 0x260
push dword [0x3017be28]
mov dword [0x3017bd68], eax
call esi
push 0x267
push dword [0x3017be28]
mov dword [0x3017bba8], eax
call esi
push 0x26a
push dword [0x3017be28]
mov dword [0x3017ba08], eax
call esi
push 0x26f
push dword [0x3017be28]
mov dword [0x3017ba98], eax
call esi
push 0x270
push dword [0x3017be28]
mov dword [0x3017bbe0], eax
call esi
push 0x272
push dword [0x3017be28]
mov dword [0x3017b9c4], eax
call esi
push 0x274
push dword [0x3017be28]
mov dword [0x3017ba20], eax
call esi
push 0x275
push dword [0x3017be28]
mov dword [0x3017be70], eax
call esi
push 0x276
push dword [0x3017be28]
mov dword [0x3017baa4], eax
call esi
push 0x27c
push dword [0x3017be28]
mov dword [0x3017bbd8], eax
call esi
push 0x294
push dword [0x3017be28]
mov dword [0x3017bd34], eax
call esi
push 0x295
push dword [0x3017be28]
mov dword [0x3017b990], eax
call esi
push 0x297
push dword [0x3017be28]
mov dword [0x3017b964], eax
call esi
push 0x29e
push dword [0x3017be28]
mov dword [0x3017bac8], eax
call esi
push 0x2a0
push dword [0x3017be28]
mov dword [0x3017bc40], eax
call esi
push 0x2a1
push dword [0x3017be28]
mov dword [0x3017bb84], eax
call esi
push 0x2af
push dword [0x3017be28]
mov dword [0x3017ba28], eax
call esi
push 0x2b2
push dword [0x3017be28]
mov dword [0x3017becc], eax
call esi
push 0x2b4
push dword [0x3017be28]
mov dword [0x3017bb30], eax
call esi
push 0x2b6
push dword [0x3017be28]
mov dword [0x3017ba88], eax
call esi
push 0x2b7
push dword [0x3017be28]
mov dword [0x3017bbac], eax
call esi
push 0x2b8
push dword [0x3017be28]
mov dword [0x3017bca4], eax
call esi
push 0x2ba
push dword [0x3017be28]
mov dword [0x3017bdf8], eax
call esi
push 0x2bd
push dword [0x3017be28]
mov dword [0x3017bbfc], eax
call esi
push 0x2be
push dword [0x3017be28]
mov dword [0x3017bbb8], eax
call esi
push 0x2c4
push dword [0x3017be28]
mov dword [0x3017ba50], eax
call esi
push 0x2c5
push dword [0x3017be28]
mov dword [0x3017baf0], eax
call esi
push 0x2c6
push dword [0x3017be28]
mov dword [0x3017be2c], eax
call esi
push 0x2c7
push dword [0x3017be28]
mov dword [0x3017bc04], eax
call esi
push 0x2d0
push dword [0x3017be28]
mov dword [0x3017b97c], eax
call esi
push 0x2d1
push dword [0x3017be28]
mov dword [0x3017bcec], eax
call esi
mov dword [0x3017bb3c], eax
push 0x2d2
push dword [0x3017be28]
call esi
push 0x2d4
push dword [0x3017be28]
mov dword [0x3017bd88], eax
call esi
push 0x2d5
push dword [0x3017be28]
mov dword [0x3017bb78], eax
call esi
push 0x2d6
push dword [0x3017be28]
mov dword [0x3017bd54], eax
call esi
push 0x2d9
push dword [0x3017be28]
mov dword [0x3017baac], eax
call esi
push 0x2f8
push dword [0x3017be28]
mov dword [0x3017bdbc], eax
call esi
push 0x300
push dword [0x3017be28]
mov dword [0x3017bb6c], eax
call esi
push 0x302
push dword [0x3017be28]
mov dword [0x3017be88], eax
call esi
push 0x30f
push dword [0x3017be28]
mov dword [0x3017bcb8], eax
call esi
push 0x310
push dword [0x3017be28]
mov dword [0x3017bad4], eax
call esi
push 0x311
push dword [0x3017be28]
mov dword [0x3017b9bc], eax
call esi
push 0x312
push dword [0x3017be28]
mov dword [0x3017b954], eax
call esi
push 0x314
push dword [0x3017be28]
mov dword [0x3017bbb0], eax
call esi
push 0x320
push dword [0x3017be28]
mov dword [0x3017b958], eax
call esi
push 0x325
push dword [0x3017be28]
mov dword [0x3017be68], eax
call esi
push 0x334
push dword [0x3017be28]
mov dword [0x3017bb98], eax
call esi
push 0x335
push dword [0x3017be28]
mov dword [0x3017bafc], eax
call esi
push 0x33a
push dword [0x3017be28]
mov dword [0x3017bc70], eax
call esi
push 0x341
push dword [0x3017be28]
mov dword [0x3017bd40], eax
call esi
push 0x34c
push dword [0x3017be28]
mov dword [0x3017bd14], eax
call esi
mov dword [0x3017ba04], eax
push 0x352
push dword [0x3017be28]
call esi
push 0x35b
push dword [0x3017be28]
mov dword [0x3017be5c], eax
call esi
push 0x367
push dword [0x3017be28]
mov dword [0x3017b9dc], eax
call esi
push 0x369
push dword [0x3017be28]
mov dword [0x3017b94c], eax
call esi
push 0x36c
push dword [0x3017be28]
mov dword [0x3017be40], eax
call esi
push 0x36e
push dword [0x3017be28]
mov dword [0x3017be60], eax
call esi
push 0x371
push dword [0x3017be28]
mov dword [0x3017ba94], eax
call esi
push 0x376
push dword [0x3017be28]
mov dword [0x3017be1c], eax
call esi
push 0x377
push dword [0x3017be28]
mov dword [0x3017bc44], eax
call esi
push 0x37b
push dword [0x3017be28]
mov dword [0x3017bda4], eax
call esi
push 0x37d
push dword [0x3017be28]
mov dword [0x3017bcf0], eax
call esi
push 0x37e
push dword [0x3017be28]
mov dword [0x3017b938], eax
call esi
push 0x385
push dword [0x3017be28]
mov dword [0x3017bb44], eax
call esi
push 0x386
push dword [0x3017be28]
mov dword [0x3017bef8], eax
call esi
push 0x391
push dword [0x3017be28]
mov dword [0x3017baf8], eax
call esi
push 0x396
push dword [0x3017be28]
mov dword [0x3017beb4], eax
call esi
push 0x397
push dword [0x3017be28]
mov dword [0x3017bd50], eax
call esi
push 0x398
push dword [0x3017be28]
mov dword [0x3017b95c], eax
call esi
push 0x399
push dword [0x3017be28]
mov dword [0x3017be3c], eax
call esi
push 0x39f
push dword [0x3017be28]
mov dword [0x3017b960], eax
call esi
push 0x3a5
push dword [0x3017be28]
mov dword [0x3017bb90], eax
call esi
push 0x3a6
push dword [0x3017be28]
mov dword [0x3017bee0], eax
call esi
push 0x3cb
push dword [0x3017be28]
mov dword [0x3017bae4], eax
call esi
push 0x3d0
push dword [0x3017be28]
mov dword [0x3017bd04], eax
call esi
push 0x3bd
push dword [0x3017be28]
mov dword [0x3017bc7c], eax
call esi
push 0x30
push dword [0x3017be28]
mov dword [0x3017ba7c], eax
call esi
push 0x51
push dword [0x3017be28]
mov dword [0x3017b9c0], eax
call esi
push 0xa
push dword [0x3017be28]
mov dword [0x3017b9ac], eax
call esi
push 0xa8
push dword [0x3017be28]
mov dword [0x3017bbf8], eax
call esi
mov ebx, 0xdd
push ebx
push dword [0x3017be28]
mov dword [0x3017bae8], eax
call esi
push 0xa5
push dword [0x3017be28]
mov dword [0x3017bea8], eax
call esi
push 0x50
push dword [0x3017be28]
mov dword [0x3017bec8], eax
call esi
push 0x3b
push dword [0x3017be28]
mov dword [0x3017bbd4], eax
call esi
push 0x26
push dword [0x3017be28]
mov dword [0x3017be08], eax
call esi
push 0xf5
push dword [0x3017be28]
mov dword [0x3017bcc8], eax
call esi
push 0x3a
push dword [0x3017be28]
mov dword [0x3017bdd8], eax
call esi
push 0x28
push dword [0x3017be28]
mov dword [0x3017be54], eax
call esi
push 0x1f0
push dword [0x3017be28]
mov dword [0x3017b96c], eax
call esi
push 0x5b
push dword [0x3017be28]
mov dword [0x3017be04], eax
call esi
push 0x69
push dword [0x3017be28]
mov dword [0x3017bd3c], eax
call esi
push 0x59
push dword [0x3017be28]
mov dword [0x3017bbec], eax
call esi
push 0x15
push dword [0x3017be28]
mov dword [0x3017be98], eax
call esi
push 0x57
push dword [0x3017be28]
mov dword [0x3017be7c], eax
call esi
push 0x1d
push dword [0x3017be28]
mov dword [0x3017bd08], eax
call esi
push 0x1b
push dword [0x3017be28]
mov dword [0x3017b994], eax
call esi
push 0xf
push dword [0x3017be28]
mov dword [0x3017bc48], eax
call esi
push 0x22
push dword [0x3017be28]
mov dword [0x3017bb20], eax
call esi
push 0xb1
push dword [0x3017be28]
mov dword [0x3017bd78], eax
call esi
push 0x82
push dword [0x3017be28]
mov dword [0x3017bdc8], eax
call esi
push 0xf4
push dword [0x3017be28]
mov dword [0x3017b974], eax
call esi
push 9
push dword [0x3017be28]
mov dword [0x3017bb94], eax
call esi
push 0x44
push dword [0x3017be28]
mov dword [0x3017bd8c], eax
call esi
push 0x1c
push dword [0x3017be28]
mov dword [0x3017ba4c], eax
call esi
push 0xa4
push dword [0x3017be28]
mov dword [0x3017bee4], eax
call esi
push 0x2c
push dword [0x3017be28]
mov dword [0x3017bb10], eax
call esi
push 0x6a
push dword [0x3017be28]
mov dword [0x3017bb18], eax
call esi
push 0x2f
push dword [0x3017be28]
mov dword [0x3017bba4], eax
call esi
push 0x11
push dword [0x3017be28]
mov dword [0x3017bb60], eax
call esi
push 0x40
push dword [0x3017be28]
mov dword [0x3017b9b8], eax
call esi
push 0x1f1
push dword [0x3017be28]
mov dword [0x3017bd98], eax
call esi
push 0x1f2
push dword [0x3017be28]
mov dword [0x3017bb9c], eax
call esi
push 0x42
push dword [0x3017be28]
mov dword [0x3017bdb4], eax
call esi
push 0x49
push dword [0x3017be28]
mov dword [0x3017ba84], eax
call esi
push 0x25
push dword [0x3017be28]
mov dword [0x3017bb74], eax
call esi
push ebx
push dword [0x3017be28]
mov dword [0x3017bd2c], eax
call esi
push 0xa0
push dword [0x3017be28]
mov dword [0x3017bea8], eax
call esi
push 0x6f
push dword [0x3017be28]
mov dword [0x3017b9f4], eax
call esi
push 0x55
push dword [0x3017be28]
mov dword [0x3017bdb0], eax
call esi
push 0x83
push dword [0x3017be28]
mov dword [0x3017bee8], eax
call esi
push 0x81
push dword [0x3017be28]
mov dword [0x3017bd80], eax
call esi
push 0x84
push dword [0x3017be28]
mov dword [0x3017be9c], eax
call esi
push 0x67
push dword [0x3017be28]
mov dword [0x3017bb58], eax
call esi
push 0x47
push dword [0x3017be28]
mov dword [0x3017bd48], eax
call esi
push 0x111
push dword [0x3017be28]
mov dword [0x3017bd44], eax
call esi
push 0x114
push dword [0x3017be28]
mov dword [0x3017beb0], eax
call esi
push 0x11c
push dword [0x3017be28]
mov dword [0x3017bef0], eax
call esi
mov edi, 0x125
push edi
push dword [0x3017be28]
mov dword [0x3017bb4c], eax
call esi
push edi
push dword [0x3017be28]
mov dword [0x3017beec], eax
call esi
push 0x126
push dword [0x3017be28]
mov dword [0x3017beec], eax
call esi
push 0x186
push dword [0x3017be28]
mov dword [0x3017ba44], eax
call esi
push 0x131
push dword [0x3017be28]
mov dword [0x3017bb24], eax
call esi
push 0x357
push dword [0x3017be28]
mov dword [0x3017be78], eax
call esi
push 0x359
push dword [0x3017be28]
mov dword [0x3017b9b4], eax
call esi
push 0x156
push dword [0x3017be28]
mov dword [0x3017ba30], eax
call esi
push 0x15a
push dword [0x3017be28]
mov dword [0x3017bb40], eax
call esi
push 0x15b
push dword [0x3017be28]
mov dword [0x3017bdfc], eax
call esi
push 0x15c
push dword [0x3017be28]
mov dword [0x3017b9d8], eax
call esi
push 0x15d
push dword [0x3017be28]
mov dword [0x3017bd10], eax
call esi
push 0x175
push dword [0x3017be28]
mov dword [0x3017bcd0], eax
call esi
push 0x179
push dword [0x3017be28]
mov dword [0x3017ba90], eax
call esi
push 0x17a
push dword [0x3017be28]
mov dword [0x3017ba10], eax
call esi
push 0x17b
push dword [0x3017be28]
mov dword [0x3017bc68], eax
call esi
push 0x1c8
push dword [0x3017be28]
mov dword [0x3017bd84], eax
call esi
push 0x1c3
push dword [0x3017be28]
mov dword [0x3017bd24], eax
call esi
push 0x1d2
push dword [0x3017be28]
mov dword [0x3017b9e0], eax
call esi
push 0x1e5
push dword [0x3017be28]
mov dword [0x3017bec4], eax
call esi
push 0x1cc
push dword [0x3017be28]
mov dword [0x3017bdd0], eax
call esi
push 0x1eb
push dword [0x3017be28]
mov dword [0x3017bcd4], eax
call esi
push 0x1f4
push dword [0x3017be28]
mov dword [0x3017ba2c], eax
call esi
push 0x1f5
push dword [0x3017be28]
mov dword [0x3017bef4], eax
call esi
push 0x1fb
push dword [0x3017be28]
mov dword [0x3017ba5c], eax
call esi
mov dword [0x3017bd38], eax
push 0x202
push dword [0x3017be28]
call esi
push 0x211
push dword [0x3017be28]
mov dword [0x3017be10], eax
call esi
push 0x214
push dword [0x3017be28]
mov dword [0x3017baf4], eax
call esi
push 0x227
push dword [0x3017be28]
mov dword [0x3017bce0], eax
call esi
push 0x230
push dword [0x3017be28]
mov dword [0x3017be50], eax
call esi
push 0x23c
push dword [0x3017be28]
mov dword [0x3017beac], eax
call esi
push 0x23d
push dword [0x3017be28]
mov dword [0x3017b9cc], eax
call esi
push 0x286
push dword [0x3017be28]
mov dword [0x3017bc64], eax
call esi
push 0x28a
push dword [0x3017be28]
mov dword [0x3017ba64], eax
call esi
push 0x28b
push dword [0x3017be28]
mov dword [0x3017bde4], eax
call esi
push 0x28c
push dword [0x3017be28]
mov dword [0x3017bc4c], eax
call esi
push 0x28d
push dword [0x3017be28]
mov dword [0x3017bbdc], eax
call esi
push 0x249
push dword [0x3017be28]
mov dword [0x3017bbc8], eax
call esi
push 0x250
push dword [0x3017be28]
mov dword [0x3017bcfc], eax
call esi
push 0x256
push dword [0x3017be28]
mov dword [0x3017bed4], eax
call esi
push 0x277
push dword [0x3017be28]
mov dword [0x3017baec], eax
call esi
push 0x278
push dword [0x3017be28]
mov dword [0x3017bed0], eax
call esi
push 0x290
push dword [0x3017be28]
mov dword [0x3017b948], eax
call esi
push 0x291
push dword [0x3017be28]
mov dword [0x3017b998], eax
call esi
push 0x298
push dword [0x3017be28]
mov dword [0x3017bc88], eax
call esi
mov dword [0x3017be84], eax
push 0x29a
push dword [0x3017be28]
call esi
push 0x29b
push dword [0x3017be28]
mov dword [0x3017b9a4], eax
call esi
push 0x29c
push dword [0x3017be28]
mov dword [0x3017bb14], eax
call esi
push 0x2a2
push dword [0x3017be28]
mov dword [0x3017bbe4], eax
call esi
push 0x2ac
push dword [0x3017be28]
mov dword [0x3017bac4], eax
call esi
push 0x2ad
push dword [0x3017be28]
mov dword [0x3017bc8c], eax
call esi
push 0x2b0
push dword [0x3017be28]
mov dword [0x3017bae0], eax
call esi
push 0x2b1
push dword [0x3017be28]
mov dword [0x3017ba78], eax
call esi
push 0x3ce
push dword [0x3017be28]
mov dword [0x3017bd4c], eax
call esi
push 0x2d8
push dword [0x3017be28]
mov dword [0x3017bc60], eax
call esi
push 0x2da
push dword [0x3017be28]
mov dword [0x3017bc28], eax
call esi
push 0x2db
push dword [0x3017be28]
mov dword [0x3017bd1c], eax
call esi
push 0x2e2
push dword [0x3017be28]
mov dword [0x3017bcdc], eax
call esi
push 0x2e3
push dword [0x3017be28]
mov dword [0x3017bab0], eax
call esi
push 0x2e5
push dword [0x3017be28]
mov dword [0x3017bb0c], eax
call esi
push 0x2e6
push dword [0x3017be28]
mov dword [0x3017badc], eax
call esi
push 0x2e8
push dword [0x3017be28]
mov dword [0x3017bc54], eax
call esi
push 0x2ea
push dword [0x3017be28]
mov dword [0x3017bb1c], eax
call esi
push 0x2eb
push dword [0x3017be28]
mov dword [0x3017bc50], eax
call esi
push 0x3d1
push dword [0x3017be28]
mov dword [0x3017bb80], eax
call esi
push 0x2ee
push dword [0x3017be28]
mov dword [0x3017bc1c], eax
call esi
push 0x3b3
push dword [0x3017be28]
mov dword [0x3017bac0], eax
call esi
push 0x2f4
push dword [0x3017be28]
mov dword [0x3017babc], eax
call esi
push 0x2f7
push dword [0x3017be28]
mov dword [0x3017ba54], eax
call esi
push 0x30b
push dword [0x3017be28]
mov dword [0x3017bb38], eax
call esi
push 0x30d
push dword [0x3017be28]
mov dword [0x3017bc94], eax
call esi
push 0x313
push dword [0x3017be28]
mov dword [0x3017bcb0], eax
call esi
push 0x31c
push dword [0x3017be28]
mov dword [0x3017bc34], eax
call esi
push 0x323
push dword [0x3017be28]
mov dword [0x3017bb04], eax
call esi
push 0x324
push dword [0x3017be28]
mov dword [0x3017bbb4], eax
call esi
push 0x32b
push dword [0x3017be28]
mov dword [0x3017bcac], eax
call esi
push 0x3da
push dword [0x3017be28]
mov dword [0x3017bdac], eax
call esi
push 0x32f
push dword [0x3017be28]
mov dword [0x3017bcc0], eax
call esi
push 0x3d5
push dword [0x3017be28]
mov dword [0x3017bb28], eax
call esi
push 0x342
push dword [0x3017be28]
mov dword [0x3017bdf0], eax
call esi
push 0x343
push dword [0x3017be28]
mov dword [0x3017b968], eax
call esi
push 0x344
push dword [0x3017be28]
mov dword [0x3017bd0c], eax
call esi
push 0x349
push dword [0x3017be28]
mov dword [0x3017bc08], eax
call esi
push 0x3e1
push dword [0x3017be28]
mov dword [0x3017be34], eax
call esi
push 0x3dc
push dword [0x3017be28]
mov dword [0x3017b950], eax
call esi
push 0x356
push dword [0x3017be28]
mov dword [0x3017bddc], eax
call esi
push 0x358
push dword [0x3017be28]
mov dword [0x3017bbcc], eax
call esi
push 0x373
push dword [0x3017be28]
mov dword [0x3017bdd4], eax
call esi
push 0x37f
push dword [0x3017be28]
mov dword [0x3017be30], eax
call esi
push 0x38e
push dword [0x3017be28]
mov dword [0x3017bc38], eax
call esi
push 0x392
push dword [0x3017be28]
mov dword [0x3017ba24], eax
call esi
push 0x39b
push dword [0x3017be28]
mov dword [0x3017bce4], eax
call esi
push 0x39d
push dword [0x3017be28]
mov dword [0x3017be38], eax
call esi
push 0x3a2
push dword [0x3017be28]
mov dword [0x3017bedc], eax
call esi
push 0x3a3
push dword [0x3017be28]
mov dword [0x3017bc18], eax
call esi
push 0xad
push dword [0x3017be28]
mov dword [0x3017bc90], eax
call esi
push 0x39
push dword [0x3017be28]
mov dword [0x3017bcf4], eax
call esi
push 0x45
push dword [0x3017be28]
mov dword [0x3017be4c], eax
call esi
push 0x48
push dword [0x3017be28]
mov dword [0x3017bd5c], eax
call esi
push 0x61
push dword [0x3017be28]
mov dword [0x3017bb88], eax
call esi
push 0x6e
push dword [0x3017be28]
mov dword [0x3017bd00], eax
call esi
push 0x31
push dword [0x3017be28]
mov dword [0x3017bc30], eax
call esi
push 0xae
push dword [0x3017be28]
mov dword [0x3017bb34], eax
call esi
push 0xa1
push dword [0x3017be28]
mov dword [0x3017bd7c], eax
call esi
push 0xde
push dword [0x3017be28]
mov dword [0x3017b9e4], eax
call esi
push 0x65
push dword [0x3017be28]
mov dword [0x3017b98c], eax
call esi
mov dword [0x3017ba00], eax
push 0x85
push dword [0x3017be28]
call esi
push 0x6b
push dword [0x3017be28]
mov dword [0x3017ba70], eax
call esi
push 0x2e
push dword [0x3017be28]
mov dword [0x3017bc5c], eax
call esi
push 0x36
push dword [0x3017be28]
mov dword [0x3017bdc0], eax
call esi
push 0x2a
push dword [0x3017be28]
mov dword [0x3017bd30], eax
call esi
push 0x68
push dword [0x3017be28]
mov dword [0x3017bcbc], eax
call esi
push 0x43
push dword [0x3017be28]
mov dword [0x3017bc6c], eax
call esi
push 0x24
push dword [0x3017be28]
mov dword [0x3017bb70], eax
call esi
push 0x62
push dword [0x3017be28]
mov dword [0x3017baa0], eax
call esi
push 0x32
push dword [0x3017be28]
mov dword [0x3017bda8], eax
call esi
push 0x5f
push dword [0x3017be28]
mov dword [0x3017be0c], eax
call esi
push 0x38
push dword [0x3017be28]
mov dword [0x3017b99c], eax
call esi
push 0x97
push dword [0x3017be28]
mov dword [0x3017bc58], eax
call esi
push 0x2b
push dword [0x3017be28]
mov dword [0x3017bde8], eax
call esi
push 0x72
push dword [0x3017be28]
mov dword [0x3017be24], eax
call esi
push 0x6c
push dword [0x3017be28]
mov dword [0x3017ba58], eax
call esi
push 0x71
push dword [0x3017be28]
mov dword [0x3017bda0], eax
call esi
push ebx
push dword [0x3017be28]
mov dword [0x3017bc24], eax
call esi
push edi
push dword [0x3017be28]
mov dword [0x3017bea8], eax
call esi
push 0x12b
push dword [0x3017be28]
mov dword [0x3017beec], eax
call esi
mov dword [0x3017bb54], eax
push 0x138
push dword [0x3017be28]
call esi
push 0x183
push dword [0x3017be28]
mov dword [0x3017bc0c], eax
call esi
push 0x185
push dword [0x3017be28]
mov dword [0x3017ba48], eax
call esi
push 0x18c
push dword [0x3017be28]
mov dword [0x3017ba18], eax
call esi
push 0x1bd
push dword [0x3017be28]
mov dword [0x3017bb00], eax
call esi
push 0x1cf
push dword [0x3017be28]
mov dword [0x3017bba0], eax
call esi
push 0x1de
push dword [0x3017be28]
mov dword [0x3017bd58], eax
call esi
push 0x1fe
push dword [0x3017be28]
mov dword [0x3017bdf4], eax
call esi
push 0x226
push dword [0x3017be28]
mov dword [0x3017be48], eax
call esi
push 0x237
push dword [0x3017be28]
mov dword [0x3017bab4], eax
call esi
push 0x257
push dword [0x3017be28]
mov dword [0x3017bf00], eax
call esi
push 0x2e4
push dword [0x3017be28]
mov dword [0x3017ba9c], eax
call esi
push 0x3d2
push dword [0x3017be28]
mov dword [0x3017bad8], eax
call esi
push 0x322
push dword [0x3017be28]
mov dword [0x3017bd64], eax
call esi
push 0x32d
push dword [0x3017be28]
mov dword [0x3017bd9c], eax
call esi
push 0x34e
push dword [0x3017be28]
mov dword [0x3017ba0c], eax
call esi
push 0x38a
push dword [0x3017be28]
mov dword [0x3017bd94], eax
call esi
push 0x3a1
push dword [0x3017be28]
mov dword [0x3017b9d0], eax
call esi
push 0x307
push dword [0x3017be28]
mov dword [0x3017bb50], eax
call esi
push 0xe
push dword [0x3017be28]
mov dword [0x3017be90], eax
call esi
push 0x124
push dword [0x3017be28]
mov dword [0x3017bbd0], eax
call esi
push 0x17e
push dword [0x3017be28]
mov dword [0x3017bc14], eax
call esi
push 0x190
push dword [0x3017be28]
mov dword [0x3017b9d4], eax
call esi
push 0x184
push dword [0x3017be28]
mov dword [0x3017bd28], eax
call esi
push 0x19a
push dword [0x3017be28]
mov dword [0x3017ba68], eax
call esi
push 0x1a3
push dword [0x3017be28]
mov dword [0x3017b9f8], eax
call esi
push 0x1d9
push dword [0x3017be28]
mov dword [0x3017bd20], eax
call esi
push 0x1e0
push dword [0x3017be28]
mov dword [0x3017bc9c], eax
call esi
push 0x219
push dword [0x3017be28]
mov dword [0x3017b9b0], eax
call esi
push 0x236
push dword [0x3017be28]
mov dword [0x3017b9a0], eax
call esi
push 0x23a
push dword [0x3017be28]
mov dword [0x3017b9c8], eax
call esi
push 0x27a
push dword [0x3017be28]
mov dword [0x3017bc78], eax
call esi
push 0x2ef
push dword [0x3017be28]
mov dword [0x3017bb5c], eax
call esi
push 0x32a
push dword [0x3017be28]
mov dword [0x3017bad0], eax
call esi
push 0x339
push dword [0x3017be28]
mov dword [0x3017b988], eax
call esi
push 0x33e
push dword [0x3017be28]
mov dword [0x3017be20], eax
call esi
push 0x379
push dword [0x3017be28]
mov dword [0x3017bbc0], eax
call esi
push 0x387
push dword [0x3017be28]
mov dword [0x3017bd18], eax
call esi
push 0x388
push dword [0x3017be28]
mov dword [0x3017bcd8], eax
call esi
push 0x38b
push dword [0x3017be28]
mov dword [0x3017bdec], eax
call esi
push 0xe8
push dword [0x3017be28]
mov dword [0x3017b9ec], eax
call esi
push 0xc8
push dword [0x3017be28]
mov dword [0x3017be14], eax
call esi
push 0x90
push dword [0x3017be28]
mov dword [0x3017ba6c], eax
call esi
push 0x91
push dword [0x3017be28]
mov dword [0x3017bb64], eax
call esi
push 0x8a
push dword [0x3017be28]
mov dword [0x3017b940], eax
call esi
push 0x8d
push dword [0x3017be28]
mov dword [0x3017bcb4], eax
call esi
push 0x1a2
push dword [0x3017be28]
mov dword [0x3017bbbc], eax
call esi
push 0x107
push dword [0x3017be28]
mov dword [0x3017bca0], eax
call esi
push 0x3df
push dword [0x3017be28]
mov dword [0x3017bb8c], eax
call esi
push 0x182
push dword [0x3017be28]
mov dword [0x3017ba38], eax
call esi
push 0x193
push dword [0x3017be28]
mov dword [0x3017be44], eax
call esi
push 1
mov dword [0x3017bc10], eax
pop eax
pop edi
pop esi
pop ebx
leave
ret
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.Path
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x218]
push eax
call ebx
test eax, eax
mov dword [0x3017be28], eax
jne 0x30042c75
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x3017a9b0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x218]
push eax
call ebx
mov dword [0x3017be28], eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x3001c2ee
cmp byte [ebp - 0x114], al
je 0x30042c9c
and byte [ebp - 0x218], al
and byte [ebp - 0x114], al
jmp 0x3001c368
xor eax, eax
jmp 0x3001dd48