Function at 0x4603f6
Capabilities:
Encode data using base64
Parse credit card information
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x94
push ebx
push esi
push edi
mov dword [ebp + 0x18], ecx
push ecx
lea ecx, [ebp - 0x24]
call fcn.00447166
mov eax, dword [ebp + 0x78]
xor ebx, ebx
mov dword [ebp + 0x20], eax
lea eax, [ebp + 0x78]
push eax
mov byte [ebp + 0x32], 0xff
mov byte [ebp + 0x66], bl
mov byte [ebp + 0x53], bl
mov byte [ebp + 0x43], bl
mov dword [ebp - 8], ebx
call fcn.0043e611
push 0xa
lea eax, [ebp + 0x78]
push eax
push str.___initram
call fcn.00446de5
add esp, 0x10
test al, al
jne 0x460921
mov dword [ebp + 0x68], ebx
mov esi, dword [ebp + 0x78]
mov ax, word [esi]
cmp ax, 0x2d
mov dword [ebp + 0x54], ebx
mov dword [ebp + 0x58], 0xfffffff0
mov byte [ebp + 0x6f], 0
mov byte [ebp + 0x63], 0
mov byte [ebp + 0x65], 0
mov byte [ebp + 0x67], 0
mov byte [ebp + 0x26], 0
mov byte [ebp + 0x64], 0
mov byte [ebp + 0x25], 0
mov byte [ebp + 0x27], 0
mov dword [ebp + 0x48], ebx
mov cl, 0x2a
jne 0x46048c
mov cl, al
movsx ecx, cl
movzx eax, ax
cmp ecx, eax
mov dword [ebp + 0x14], ecx
jne 0x46071f
movzx eax, word [esi + 2]
cmp dword [ebp + 0x14], eax
jne 0x46071f
xor eax, eax
lea ecx, [esi + 4]
mov ax, word [ecx]
mov edx, eax
and dx, 0xffdf
cmp dx, 0x48
je 0x46071f
call fcn.0040f8eb
test al, al
jne 0x46071f
xor edi, edi
mov esi, ecx
inc edi
push edi
push esi
push 0x4ca2c4
mov dword [ebp + 0x78], esi
call fcn.0043fac4
add esp, 0xc
test al, al
je 0x460534
lea eax, [ebp + 0x78]
add esi, 2
push eax
mov dword [ebp + 0x28], esi
call fcn.00405b6e
cmp word [esi], 0x3a
pop ecx
je 0x46050a
or dword [ebp + 0x48], 7
jmp 0x460710
lea eax, [ebp + 0x4c]
push eax
inc esi
lea eax, [ebp + 0x28]
inc esi
push eax
mov dword [ebp + 0x4c], ebx
mov dword [ebp + 0x28], esi
call fcn.00441162
test eax, eax
pop ecx
pop ecx
jle 0x460710
mov eax, dword [ebp + 0x4c]
or dword [ebp + 0x48], eax
jmp 0x460710
push 2
push esi
push 0x4ca2c0
call fcn.0043fac4
add esp, 0xc
test al, al
lea eax, [ebp + 0x78]
je 0x460580
add esi, 4
push eax
mov dword [ebp + 0xc], esi
call fcn.00405b6e
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp + 0xc]
push eax
mov dword [ebp + 0x4c], ebx
call fcn.00451cdf
add esp, 0xc
test eax, eax
jle 0x460710
mov eax, dword [ebp + 0x4c]
mov dword [ebp + 0x54], eax
mov dword [ebp + 0x58], ebx
jmp 0x460710
push 2
pop esi
push esi
push eax
push 0x4c6434
call fcn.00446de5
add esp, 0xc
test al, al
je 0x46059f
mov byte [ebp + 0x65], 1
jmp 0x460710
push 3
lea eax, [ebp + 0x78]
push eax
push 0x4ca2bc
call fcn.00446de5
add esp, 0xc
test al, al
je 0x4605bf
mov byte [ebp + 0x43], 1
jmp 0x460710
push 4
lea eax, [ebp + 0x78]
push eax
push 0x4ca2b4
call fcn.00446de5
add esp, 0xc
test al, al
je 0x4605df
mov byte [ebp + 0x64], 1
jmp 0x460710
push edi
lea eax, [ebp + 0x78]
push eax
push 0x4c475c
call fcn.00446de5
add esp, 0xc
test al, al
je 0x4605fe
mov byte [ebp + 0x67], 3
jmp 0x460710
push esi
lea eax, [ebp + 0x78]
push eax
push 0x4ca2b0
call fcn.00446de5
add esp, 0xc
test al, al
je 0x46061d
or byte [ebp + 0x67], 1
jmp 0x460710
push esi
lea eax, [ebp + 0x78]
push eax
push 0x4ca2ac
call fcn.00446de5
add esp, 0xc
test al, al
je 0x46063c
or byte [ebp + 0x67], 2
jmp 0x460710
push 4
lea eax, [ebp + 0x78]
push eax
push str.name
call fcn.00446de5
add esp, 0xc
test al, al
je 0x46065c
mov byte [ebp + 0x26], 1
jmp 0x460710
push edi
lea eax, [ebp + 0x78]
push eax
push 0x4ca2a0
call fcn.00446de5
add esp, 0xc
test al, al
je 0x46067a
inc byte [ebp + 0x66]
jmp 0x460710
push esi
lea eax, [ebp + 0x78]
push eax
push 0x4ca29c
call fcn.00446de5
add esp, 0xc
test al, al
je 0x460695
dec byte [ebp + 0x66]
jmp 0x460710
push edi
lea eax, [ebp + 0x78]
push eax
push 0x4ca298
call fcn.00446de5
add esp, 0xc
test al, al
je 0x4606b0
inc byte [ebp + 0x53]
jmp 0x460710
push esi
lea eax, [ebp + 0x78]
push eax
push 0x4ca294
call fcn.00446de5
add esp, 0xc
test al, al
je 0x4606cc
mov byte [ebp + 0x25], 1
jmp 0x460710
push 4
lea eax, [ebp + 0x78]
push eax
push str.init
call fcn.00446de5
add esp, 0xc
test al, al
je 0x4606e9
mov byte [ebp + 0x27], 1
jmp 0x460710
push esi
lea eax, [ebp + 0x78]
push eax
push 0x4c1e88
call fcn.00446de5
add esp, 0xc
test al, al
je 0x460706
call fcn.00442a66
jmp 0x460710
lea eax, [ebp + 0x78]
push eax
call fcn.00405b6e
pop ecx
mov esi, dword [ebp + 0x78]
movzx eax, word [esi]
cmp dword [ebp + 0x14], eax
je 0x46049d
lea ecx, [ebp + 8]
call fcn.00444e32
lea ecx, [ebp - 0x14]
call fcn.00444e32
lea ecx, [ebp + 0x10]
call fcn.00444e32
lea ecx, [ebp + 4]
call fcn.00444e32
lea ecx, [ebp - 4]
call fcn.00444e32
xor eax, eax
mov ax, word [esi]
mov ecx, eax
or ecx, 0x20
cmp cx, 0x6e
je 0x460799
cmp cx, 0x75
je 0x460799
cmp cx, 0x62
je 0x460799
cmp ax, 0x5e
je 0x460799
cmp ax, 0x2b
je 0x460799
cmp ax, 0x23
je 0x460799
cmp ax, 0x40
je 0x460799
cmp ax, 0x24
je 0x460799
cmp ax, 0x2a
je 0x460799
cmp ax, 0x7e
je 0x460799
cmp ax, 0x2e
je 0x460799
cmp ax, 0x3f
jne 0x4607b2
mov al, byte [esi]
inc esi
inc esi
test al, al
mov byte [ebp + 0x6f], al
mov dword [ebp + 0x78], esi
je 0x4607b2
movzx eax, word [esi]
movsx ecx, byte [ebp + 0x6f]
cmp ecx, eax
je 0x4607b8
cmp word [esi], 0x24
jne 0x4607c2
mov al, byte [esi]
inc esi
inc esi
mov byte [ebp + 0x63], al
mov dword [ebp + 0x78], esi
cmp byte [ebp + 0x6f], 0x41
jl 0x4607d2
cmp byte [ebp + 0x6f], 0x5a
jg 0x4607d2
or byte [ebp + 0x6f], 0x20
lea eax, [ebp + 0x78]
push eax
call fcn.0043e611
mov edi, dword [ebp + 0x78]
mov dword [esp], 0x4ca284
push edi
mov dword [ebp + 0x4c], edi
call dword [sym.imp.SHLWAPI.dll_StrStrW]
mov esi, eax
cmp esi, ebx
je 0x4607f8
lea edi, [esi + 4]
mov edx, edi
mov dword [ebp + 0x3c], edx
cmp word [edi], bx
je 0x46088b
mov ax, word [edx]
cmp ax, 0x2c
je 0x460842
cmp ax, 0x3d
je 0x46088b
cmp ax, 0x21
jne 0x460836
lea eax, [edx + 2]
mov dword [ebp + 0x28], eax
lea eax, [ebp + 0x28]
push eax
call fcn.0043e611
mov eax, dword [ebp + 0x28]
cmp word [eax], bx
pop ecx
je 0x46088b
lea edx, [eax - 2]
inc edx
inc edx
mov dword [ebp + 0x3c], edx
cmp word [edx], bx
jne 0x460806
jmp 0x46088b
add edx, 2
push 0x3d
push edx
call dword [sym.imp.SHLWAPI.dll_StrChrW]
cmp eax, ebx
je 0x460856
mov edx, eax
jmp 0x460883
mov eax, dword [ebp + 0x3c]
add eax, 2
push 0x21
push eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov edx, eax
cmp edx, ebx
je 0x460888
lea eax, [edx + 2]
mov dword [ebp + 0x28], eax
lea eax, [ebp + 0x28]
push eax
call fcn.0043e611
mov eax, dword [ebp + 0x28]
cmp word [eax], bx
pop ecx
jne 0x460888
mov dword [ebp + 0x3c], edx
jmp 0x46088b
mov edx, dword [ebp + 0x3c]
mov ax, word [edx]
cmp ax, 0x2c
je 0x4608a0
cmp ax, 0x3d
je 0x4608a0
cmp ax, 0x21
jne 0x4608b4
mov al, byte [edx]
mov word [edx], bx
add dword [ebp + 0x3c], 2
test al, al
mov byte [ebp + 0x33], al
jne 0x46093a
inc byte [ebp + 0x32]
cmp byte [ebp + 0x32], 0
jg 0x460930
mov ecx, dword [ebp + 0x18]
push 1
push ebx
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x20]
call fcn.00456647
mov eax, dword [ebp - 8]
lea ecx, [ebp - 4]
mov dword [ebp + 0x78], eax
call fcn.0043e679
lea ecx, [ebp + 4]
call fcn.0043e679
lea ecx, [ebp + 0x10]
call fcn.0043e679
lea ecx, [ebp - 0x14]
call fcn.0043e679
lea ecx, [ebp + 8]
call fcn.0043e679
lea eax, [ebp + 0x78]
push eax
call fcn.0043e611
push 0xa
lea eax, [ebp + 0x78]
push eax
push str.___initram
call fcn.00446de5
add esp, 0x10
test al, al
je 0x46044f
push 3
call fcn.00412cf3
pop ecx
xor esi, esi
jmp 0x4619a5
mov esi, 0x80070057
jmp 0x46197d
cmp esi, ebx
mov dword [ebp - 0xc], ebx
jne 0x460953
push 0x5c
push ebx
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_StrRChrW]
call edi
mov esi, eax
cmp esi, ebx
je 0x4609a3
mov ecx, dword [ebp + 0x18]
push 1
push ebx
lea eax, [ebp + 8]
mov word [esi], bx
push eax
push dword [ebp + 0x78]
inc esi
inc esi
call fcn.00456647
mov eax, dword [ebp + 8]
push 0x5c
push eax
mov dword [ebp + 0x4c], eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
cmp eax, ebx
mov dword [ebp + 0x5c], eax
je 0x460988
mov word [eax], bx
inc eax
inc eax
mov dword [ebp + 0x5c], eax
mov ecx, dword [ebp + 0x18]
push 1
push ebx
lea eax, [ebp - 0xc]
push eax
push esi
call fcn.00456647
mov eax, dword [ebp - 0xc]
mov dword [ebp + 0x34], eax
jmp 0x460a2c
push 1
push 0x2c
lea eax, [ebp + 0x4c]
push eax
lea ecx, [ebp - 0x24]
call fcn.004589f9
push ebx
lea ecx, [ebp + 8]
push ecx
push eax
call fcn.00447c46
mov eax, dword [ebp + 8]
add esp, 0xc
push 0x5c
push eax
mov dword [ebp + 0x4c], eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov esi, eax
cmp esi, ebx
jne 0x4609e0
mov esi, 0x80070057
jmp 0x461975
mov word [esi], bx
inc esi
inc esi
push 0x4ca284
push esi
mov dword [ebp + 0x5c], esi
call dword [sym.imp.SHLWAPI.dll_StrStrW]
cmp byte [ebp + 0x67], 0
mov dword [ebp + 0x34], eax
je 0x460a0e
cmp eax, ebx
jne 0x460a1f
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esi + eax*2]
mov dword [ebp + 0x34], eax
cmp eax, ebx
jne 0x460a1f
push 0x5c
push ebx
push esi
call edi
cmp eax, ebx
mov dword [ebp + 0x34], eax
je 0x4609d6
cmp word [eax], bx
je 0x460a2c
mov word [eax], bx
inc eax
inc eax
mov dword [ebp + 0x34], eax
cmp word [eax], 0x5c
jne 0x460a37
inc eax
inc eax
mov dword [ebp + 0x34], eax
cmp byte [ebp + 0x26], 0
mov dword [ebp + 0x28], ebx
je 0x460a5b
lea eax, [ebp + 0x28]
push eax
lea eax, [ebp + 0x3c]
push eax
push dword [ebp + 0x18]
call fcn.00454eb0
mov eax, dword [ebp + 0x28]
add esp, 0xc
mov dword [ebp + 0x3c], eax
jmp 0x460a5e
mov eax, dword [ebp + 0x3c]
cmp byte [ebp + 0x33], 0x2c
jne 0x460aef
push 1
push 0x2c
lea eax, [ebp + 0x3c]
push eax
lea ecx, [ebp - 0x24]
call fcn.004589f9
push ebx
lea ecx, [ebp + 0x10]
push ecx
push eax
call fcn.00447c46
mov ecx, dword [ebp + 0x18]
add esp, 0xc
push ebx
lea eax, [ebp + 0x10]
push eax
call fcn.00402ecb
cmp byte [ebp + 0x6f], 0x2e
jne 0x460ad1
mov eax, dword [ebp + 0x3c]
cmp word [eax], 0x2c
jne 0x460ad1
add dword [ebp + 0x3c], 2
push 1
push 0x2c
lea eax, [ebp + 0x3c]
push eax
lea ecx, [ebp - 0x24]
call fcn.004589f9
push ebx
lea ecx, [ebp - 4]
push ecx
push eax
call fcn.00447c46
mov ecx, dword [ebp + 0x18]
add esp, 0xc
push ebx
lea eax, [ebp - 4]
push eax
call fcn.00402ecb
mov eax, dword [ebp + 0x10]
cmp word [eax], bx
jne 0x460be8
push str.RegDat
lea ecx, [ebp + 0x10]
call fcn.0044e6d5
jmp 0x460be8
cmp byte [ebp + 0x33], 0x21
je 0x460be8
cmp word [eax], bx
jne 0x460b22
cmp byte [ebp + 0x6f], 0x24
je 0x460b41
cmp byte [ebp + 0x6f], 0x2a
je 0x460b22
cmp byte [ebp + 0x6f], 0x7e
je 0x460b22
cmp byte [ebp + 0x53], 0
je 0x460be8
mov dword [ebp + 0x68], eax
jmp 0x460be8
cmp byte [ebp + 0x6f], 0x24
je 0x460b41
cmp byte [ebp + 0x6f], 0x2a
je 0x460b41
cmp byte [ebp + 0x6f], 0x7e
je 0x460b41
lea eax, [ebp + 0x3c]
push eax
call fcn.0043e611
mov eax, dword [ebp + 0x3c]
pop ecx
push eax
lea ecx, [ebp + 0x14]
call fcn.0044e66d
mov edx, dword [ebp + 0x14]
lea eax, [ebp + 0x78]
push eax
mov dword [ebp + 0x78], edx
call fcn.0043e611
cmp byte [ebp + 0x7c], 0
pop ecx
je 0x460b6b
push edx
lea ecx, [ebp + 4]
call fcn.0044e6d5
jmp 0x460b7b
mov ecx, dword [ebp + 0x18]
push 1
push ebx
lea eax, [ebp + 4]
push eax
push edx
call fcn.0045522d
mov eax, dword [ebp + 4]
mov dword [ebp + 0x68], eax
mov dword [ebp + 0x7c], eax
lea eax, [ebp + 0x7c]
push eax
call fcn.0043e611
cmp byte [ebp + 0x6f], 0
pop ecx
jne 0x460bc6
push dword [ebp + 0x78]
push 0x4ca26c
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x460baf
mov dword [ebp + 0x68], 0x4c0a1c
jmp 0x460be0
mov ecx, dword [ebp + 0x7c]
mov ax, word [ecx]
cmp ax, 0x23
je 0x460bc1
cmp ax, 0x40
jne 0x460be0
mov dword [ebp + 0x68], ecx
jmp 0x460be0
cmp byte [ebp + 0x6f], 0x23
je 0x460bd2
cmp byte [ebp + 0x6f], 0x40
jne 0x460be0
mov eax, dword [ebp + 0x7c]
cmp word [eax], bx
mov dword [ebp + 0x68], eax
jne 0x460be0
mov dword [ebp + 0x68], ebx
lea ecx, [ebp + 0x14]
call fcn.0043e679
mov edi, dword [ebp + 0x4c]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str.HKLM
push edi
mov dword [ebp + 0x78], ebx
call esi
test eax, eax
je 0x460cc2
push str.HKEY_LOCAL_MACHINE
push edi
call esi
test eax, eax
je 0x460cc2
push str.HKCU
push edi
call esi
test eax, eax
je 0x460cb9
push str.HKEY_CURRENT_USER
push edi
call esi
test eax, eax
je 0x460cb9
push str.HKCR
push edi
call esi
test eax, eax
je 0x460cb0
push str.HKEY_CLASSES_ROOT
push edi
call esi
test eax, eax
je 0x460cb0
push 0x4ca1d0
push edi
call esi
test eax, eax
je 0x460ca7
push str.HKEY_USERS
push edi
call esi
test eax, eax
je 0x460ca7
push str.HKCC
push edi
call esi
test eax, eax
je 0x460c9e
push str.HKEY_CURRENT_CONFIG
push edi
call esi
test eax, eax
je 0x460c9e
lea eax, [ebp + 0x78]
push eax
lea eax, [ebp + 0x4c]
push eax
call fcn.004481e9
test eax, eax
pop ecx
pop ecx
je 0x460c94
cmp dword [ebp + 0x78], ebx
jne 0x460cc9
mov esi, 0x80070057
jmp 0x46196d
mov dword [ebp + 0x78], 0x80000005
jmp 0x460cc9
mov dword [ebp + 0x78], 0x80000003
jmp 0x460cc9
mov dword [ebp + 0x78], 0x80000000
jmp 0x460cc9
mov dword [ebp + 0x78], 0x80000001
jmp 0x460cc9
mov dword [ebp + 0x78], 0x80000002
mov eax, dword [ebp + 0x10]
cmp word [eax], bx
je 0x46140d
cmp byte [ebp + 0x6f], 0x2e
je 0x460ce4
cmp byte [ebp + 0x6f], 0x3f
mov dword [ebp + 0x38], ebx
jne 0x460cf1
cmp byte [ebp + 0x6f], 0x3f
mov dword [ebp + 0x38], 1
je 0x460d00
cmp dword [ebp + 0x38], ebx
je 0x460cfb
cmp word [eax], bx
je 0x460d00
mov dword [ebp + 0x48], ebx
jmp 0x460d07
mov dword [ebp + 0x48], 1
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x64
lea ecx, [ebp + 0x68]
mov dword [ebp + 0xc], ebx
call fcn.00444e50
lea ecx, [ebp + 0x4c]
call fcn.00444e32
cmp byte [ebp + 0x6f], 0x2e
lea eax, [ebp + 0x4c]
je 0x460d2f
lea eax, [ebp + 0x68]
push 0x1000
lea ecx, [ebp + 0x44]
mov dword [ebp + 0x2c], eax
call fcn.00444cdb
cmp byte [ebp + 0x67], 0
lea eax, [ebp + 0x7c]
mov dword [ebp], 0xfff
mov dword [ebp + 0x7c], ebx
mov dword [ebp + 0x20], ebx
push eax
je 0x460ed8
movzx eax, word [0x4dbc28]
or eax, 9
push eax
push ebx
push dword [ebp + 0x5c]
mov dword [ebp + 0x34], ebx
push dword [ebp + 0x78]
mov dword [ebp + 0x38], ebx
mov dword [ebp + 0x48], ebx
mov dword [ebp + 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp + 0x7c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push ebx
push ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp + 0x48]
push eax
lea eax, [ebp + 0x38]
push eax
push ebx
push ebx
push ebx
push dword [ebp + 0x7c]
call esi
push ebx
push ebx
push ebx
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 0x14]
push eax
push ebx
lea eax, [ebp + 0x48]
push eax
lea eax, [ebp + 0x38]
push eax
push ebx
push ebx
push ebx
push dword [ebp + 0x7c]
call esi
mov dword [ebp + 0x78], eax
mov eax, dword [ebp - 0x18]
cmp dword [ebp + 0x48], eax
jae 0x460dca
mov dword [ebp + 0x48], eax
mov eax, dword [ebp + 0x48]
lea eax, [eax*4 + 0x20]
mov dword [ebp - 0x10], eax
shr eax, 1
add eax, 8
push eax
lea ecx, [ebp + 0x58]
call fcn.00444e50
mov esi, dword [ebp + 0x58]
mov word [esi], 0xd
mov word [esi + 2], 0xa
lea ebx, [esi + 4]
mov word [ebx], 0x76
lea edi, [esi + 8]
mov word [esi + 6], 0x20
and word [edi], 0
cmp byte [ebp + 0x67], 3
mov dword [ebp + 0x5c], ebx
je 0x460e13
mov edi, ebx
cmp dword [ebp + 0x78], 0
jne 0x460ebc
test byte [ebp + 0x67], 1
je 0x460e6a
and dword [ebp + 0x78], 0
cmp dword [ebp + 0x14], 0
jle 0x460e6a
mov eax, dword [ebp - 0x10]
mov dword [ebp + 0x34], eax
xor eax, eax
push eax
push eax
push eax
push eax
mov word [edi], ax
lea eax, [ebp + 0x34]
push eax
push edi
push dword [ebp + 0x78]
push dword [ebp + 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x460e5f
push dword [ebp + 0x5c]
lea ecx, [ebp + 0x68]
call fcn.00444e9e
mov dword [ebp + 0x5c], esi
inc dword [ebp + 0x78]
mov eax, dword [ebp + 0x78]
cmp eax, dword [ebp + 0x14]
jl 0x460e2d
test byte [ebp + 0x67], 2
mov word [ebx], 0x6b
je 0x460ebc
and dword [ebp + 0x78], 0
cmp dword [ebp + 0x38], 0
jle 0x460ebc
xor ebx, ebx
mov eax, dword [ebp - 0x10]
push ebx
push ebx
push ebx
push ebx
mov dword [ebp + 0x34], eax
lea eax, [ebp + 0x34]
push eax
push edi
push dword [ebp + 0x78]
mov word [edi], bx
push dword [ebp + 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x460eb1
push dword [ebp + 0x5c]
lea ecx, [ebp + 0x68]
call fcn.00444e9e
mov dword [ebp + 0x5c], esi
inc dword [ebp + 0x78]
mov eax, dword [ebp + 0x78]
cmp eax, dword [ebp + 0x38]
jl 0x460e81
cmp dword [ebp + 0x7c], 0
je 0x460ecb
push dword [ebp + 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 0x58]
call fcn.0043e679
jmp 0x4613ba
lea eax, [ebp]
push eax
lea eax, [ebp + 0x44]
push eax
push dword [ebp + 0x34]
push dword [ebp + 0x5c]
push dword [ebp + 0x78]
call fcn.0044947b
mov esi, dword [ebp + 0x7c]
add esp, 0x18
cmp esi, ebx
mov edi, eax
je 0x460f65
mov eax, dword [ebp + 0x34]
cmp word [eax], bx
jne 0x460f20
cmp esi, 2
jne 0x460f20
cmp edi, 0xfffffffe
jne 0x460f20
cmp dword [ebp + 0x38], ebx
je 0x4613bc
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x4ca180
jmp 0x460f31
cmp dword [ebp + 0x38], ebx
mov dword [ebp + 0xc], esi
je 0x460f3e
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.ERROR
mov ecx, dword [ebp + 0x2c]
call fcn.00444eed
jmp 0x4613bc
cmp byte [ebp + 0x27], 0
jne 0x4613bc
lea ecx, [ebp + 0x44]
call fcn.0043e679
lea ecx, [ebp + 0x4c]
call fcn.0043e679
lea ecx, [ebp + 0x68]
call fcn.0043e679
jmp 0x46196d
cmp dword [ebp + 0x58], ebx
jl 0x460f86
jg 0x460f71
cmp dword [ebp + 0x54], ebx
jb 0x460f86
xor eax, eax
cmp dword [ebp + 0x54], edi
jne 0x460f7d
cmp dword [ebp + 0x58], eax
je 0x460f86
mov dword [ebp + 0x5c], 1
jmp 0x460f89
mov dword [ebp + 0x5c], ebx
cmp edi, 1
mov byte [ebp + 0x7b], 0
mov byte [ebp + 0x7f], 0xff
mov eax, str.REG_SZ
jne 0x460fa3
mov bl, 0x24
mov byte [ebp + 0x7f], 0
jmp 0x460fbd
cmp edi, 6
jne 0x460fb1
mov eax, str.REG_LINK
mov bl, 0x5e
jmp 0x460fbd
cmp edi, 0x15
jne 0x461014
mov eax, str.REG_MUI_SZ
mov bl, 0x75
xor esi, esi
cmp dword [ebp + 0x38], esi
je 0x460fda
mov ecx, dword [ebp + 0x2c]
push 0xffffffffffffffff
push 0xffffffffffffffff
push eax
call fcn.00444eed
cmp dword [ebp + 0x48], esi
jne 0x4613ba
cmp dword [ebp + 0x5c], esi
jne 0x461349
cmp dword [ebp + 0x58], esi
jg 0x461003
jl 0x460fef
cmp dword [ebp + 0x54], esi
jae 0x461003
mov al, byte [ebp + 0x6f]
cmp bl, al
je 0x461003
cmp al, 0x2e
je 0x461003
cmp byte [ebp + 0x7f], al
jne 0x461349
mov eax, dword [ebp + 0x68]
mov ecx, dword [ebp + 0x44]
mov dword [ebp + 0x68], ecx
mov dword [ebp + 0x44], eax
jmp 0x4613ba
cmp edi, 0xb
jne 0x461086
cmp dword [ebp + 0x38], ebx
je 0x461038
mov ecx, dword [ebp + 0x2c]
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_QWORD
call fcn.00444eed
cmp dword [ebp + 0x48], ebx
jne 0x4613ba
cmp dword [ebp + 0x5c], ebx
jne 0x461349
cmp dword [ebp + 0x58], ebx
jg 0x46105d
jl 0x46104d
cmp dword [ebp + 0x54], ebx
jae 0x46105d
cmp byte [ebp + 0x6f], 0x2b
je 0x46105d
cmp byte [ebp + 0x6f], 0x2e
jne 0x461349
cmp byte [ebp + 0x43], 0
mov eax, str._I64u
jne 0x46106d
mov eax, str.0x_I64x
push eax
mov eax, dword [ebp + 0x44]
push dword [eax + 4]
push dword [eax]
push dword [ebp + 0x68]
call fcn.0049b74b
add esp, 0x10
jmp 0x4613ba
cmp edi, 4
mov esi, dword [ebp + 0x44]
jne 0x4610d3
cmp dword [ebp + 0x38], ebx
je 0x4610ad
mov ecx, dword [ebp + 0x2c]
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_DWORD
call fcn.00444eed
cmp dword [ebp + 0x48], ebx
jne 0x4613ba
cmp dword [ebp + 0x5c], ebx
jne 0x461349
cmp dword [ebp + 0x58], ebx
jg 0x461132
jl 0x4610c2
cmp dword [ebp + 0x54], ebx
jae 0x461132
cmp byte [ebp + 0x6f], 0x23
je 0x461132
cmp byte [ebp + 0x6f], 0x2e
je 0x461132
jmp 0x461349
cmp edi, 5
jne 0x461156
cmp dword [ebp + 0x38], ebx
je 0x4610f7
mov ecx, dword [ebp + 0x2c]
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_DWORD_BIG_ENDIAN
call fcn.00444eed
cmp dword [ebp + 0x48], ebx
jne 0x4613ba
cmp dword [ebp + 0x5c], ebx
jne 0x461349
cmp dword [ebp + 0x58], ebx
jg 0x46111c
jl 0x46110c
cmp dword [ebp + 0x54], ebx
jae 0x46111c
cmp byte [ebp + 0x6f], 0x62
je 0x46111c
cmp byte [ebp + 0x6f], 0x2e
jne 0x461349
mov cl, byte [esi + 3]
mov al, byte [esi]
mov byte [esi], cl
mov byte [esi + 3], al
mov cl, byte [esi + 2]
mov al, byte [esi + 1]
mov byte [esi + 1], cl
mov byte [esi + 2], al
cmp byte [ebp + 0x43], 0
mov eax, 0x4c67f4
jne 0x461142
mov eax, str.0x_lx
push dword [esi]
push eax
push dword [ebp + 0x68]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x4613ba
cmp edi, 2
jne 0x4611c4
cmp dword [ebp + 0x38], ebx
je 0x46117a
mov ecx, dword [ebp + 0x2c]
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_EXPAND_SZ
call fcn.00444eed
cmp dword [ebp + 0x48], ebx
jne 0x4613ba
cmp dword [ebp + 0x5c], ebx
jne 0x461349
cmp dword [ebp + 0x58], ebx
jg 0x46119f
jl 0x46118f
cmp dword [ebp + 0x54], ebx
jae 0x46119f
cmp byte [ebp + 0x6f], 0x7e
je 0x46119f
cmp byte [ebp + 0x6f], 0x2e
jne 0x461349
cmp byte [ebp + 0x63], 0
je 0x461003
mov eax, dword [ebp + 0x44]
push 1
push ebx
lea ecx, [ebp + 0x68]
push ecx
mov ecx, dword [ebp + 0x18]
push eax
mov dword [ebp + 0x3c], eax
call fcn.00456647
jmp 0x4613ba
cmp edi, 7
jne 0x4612a7
cmp dword [ebp + 0x38], ebx
je 0x4611ec
mov ecx, dword [ebp + 0x2c]
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_MULTI_SZ
call fcn.00444eed
cmp dword [ebp + 0x48], ebx
jne 0x4613ba
cmp dword [ebp + 0x5c], ebx
jne 0x461349
cmp dword [ebp + 0x58], ebx
jg 0x461211
jl 0x461201
cmp dword [ebp + 0x54], ebx
jae 0x461211
cmp byte [ebp + 0x6f], 0x2a
je 0x461211
cmp byte [ebp + 0x6f], 0x2e
jne 0x461349
mov esi, dword [ebp]
shr esi, 1
lea eax, [esi*4 + 6]
push eax
lea ecx, [ebp + 0x68]
call fcn.00444e77
mov ecx, dword [ebp + 0x44]
mov eax, dword [ebp + 0x68]
lea esi, [ecx + esi*2]
jmp 0x46129b
cmp byte [ebp + 0x63], 0x2a
jne 0x461262
cmp word [ecx], 0x5c
jne 0x461262
lea edx, [ecx + 2]
mov di, word [edx]
cmp di, 0x30
je 0x461254
cmp di, 0x5c
je 0x461254
cmp di, bx
jne 0x461262
mov word [eax], 0x5c
mov ecx, edx
mov dx, word [ecx]
inc eax
inc eax
jmp 0x46126a
mov dx, word [ecx]
cmp dx, bx
je 0x461273
mov word [eax], dx
inc eax
inc eax
inc ecx
inc ecx
jmp 0x46129b
inc ecx
inc ecx
cmp byte [ebp + 0x63], 0x24
jne 0x46128d
cmp ecx, esi
jae 0x46129f
mov word [eax], 0xd
inc eax
inc eax
mov word [eax], 0xa
jmp 0x461299
mov word [eax], 0x5c
inc eax
inc eax
mov word [eax], 0x30
inc eax
inc eax
cmp ecx, esi
jb 0x461231
mov word [eax], bx
jmp 0x4613ba
cmp edi, 3
jne 0x4612b3
mov eax, str.REG_BINARY
jmp 0x4612e0
cmp edi, ebx
jne 0x4612be
mov eax, str.REG_NONE
jmp 0x4612e0
cmp edi, 8
jne 0x4612ca
mov eax, str.REG_RESOURCE_LIST
jmp 0x4612e0
cmp edi, 9
jne 0x4612d6
mov eax, str.REG_FULL_RESOURCE_DESCRIPTOR
jmp 0x4612e0
cmp edi, 0xa
jne 0x461301
mov eax, str.REG_RESOURCE_REQUIREMENTS_LIST
cmp dword [ebp + 0x38], ebx
je 0x4612fb
mov ecx, dword [ebp + 0x2c]
push 0xffffffffffffffff
push 0xffffffffffffffff
push eax
call fcn.00444eed
cmp dword [ebp + 0x48], ebx
jne 0x4613ba
mov byte [ebp + 0x7b], 0x40
jmp 0x46132c
cmp dword [ebp + 0x38], ebx
je 0x46132c
mov esi, dword [ebp + 0x2c]
push 0x32
mov ecx, esi
call fcn.00444e77
push edi
push str.0x_lx
push dword [esi]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
cmp dword [ebp + 0x48], ebx
jne 0x4613ba
cmp dword [ebp + 0x58], ebx
jg 0x461344
jl 0x461338
cmp dword [ebp + 0x54], ebx
jae 0x461344
mov al, byte [ebp + 0x6f]
cmp byte [ebp + 0x7b], al
je 0x461344
cmp al, 0x2e
jne 0x461349
cmp dword [ebp + 0x5c], ebx
je 0x461366
lea ecx, [ebp + 0x44]
call fcn.0043e679
lea ecx, [ebp + 0x4c]
call fcn.0043e679
lea ecx, [ebp + 0x68]
call fcn.0043e679
jmp 0x460c94
mov eax, dword [ebp]
lea eax, [eax + eax*4 + 7]
push eax
lea ecx, [ebp + 0x68]
call fcn.00444e77
mov edi, dword [ebp + 0x68]
mov esi, dword [ebp + 0x44]
xor ebx, ebx
mov word [edi], bx
mov word [edi + 2], bx
cmp dword [ebp], ebx
mov dword [ebp + 0x20], 1
jle 0x4613ba
cmp byte [ebp + 0x43], 0
mov ecx, 0x4ca06c
jne 0x4613a1
mov ecx, str._0x_02X
movzx eax, byte [esi]
push eax
push ecx
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
inc esi
inc ebx
add edi, 0xa
cmp ebx, dword [ebp]
jl 0x461391
xor ebx, ebx
mov eax, dword [ebp + 0x10]
cmp word [eax], bx
je 0x4613d7
mov edx, dword [ebp + 0x68]
mov ecx, dword [ebp + 0x20]
lea ecx, [edx + ecx*2]
push ecx
mov ecx, dword [ebp + 0x18]
push eax
call fcn.0044451e
mov eax, dword [ebp - 4]
cmp word [eax], bx
je 0x4613ed
mov ecx, dword [ebp + 0x2c]
push dword [ecx]
mov ecx, dword [ebp + 0x18]
push eax
call fcn.0044451e
lea ecx, [ebp + 0x44]
call fcn.0043e679
lea ecx, [ebp + 0x4c]
call fcn.0043e679
lea ecx, [ebp + 0x68]
call fcn.0043e679
mov esi, dword [ebp + 0xc]
jmp 0x46196d
cmp dword [ebp + 0x68], ebx
je 0x4618e5
xor edx, edx
cmp byte [ebp + 0x66], dl
push 8
mov dword [ebp + 0x7c], edx
pop edi
mov dword [ebp + 0x1c], edx
mov dword [ebp + 0x20], edx
lea ebx, [ebp + 0x1c]
jg 0x461431
cmp byte [ebp + 0x53], dl
je 0x46145c
movsx eax, byte [ebp + 0x66]
push eax
push dword [ebp + 0x5c]
push dword [ebp + 0x78]
call fcn.00441e0f
add esp, 0xc
cmp byte [ebp + 0x66], 2
mov esi, eax
jge 0x4618d8
cmp byte [ebp + 0x53], 0
jne 0x4618d8
xor edx, edx
mov cl, byte [ebp + 0x6f]
cmp cl, 0x2b
je 0x46182b
test cl, cl
jne 0x461482
mov esi, dword [ebp + 0x68]
mov ax, word [esi]
cmp ax, 0x2b
jne 0x4614c0
inc esi
inc esi
mov dword [ebp + 0x68], esi
jmp 0x46182e
cmp cl, 0x23
je 0x4617b1
cmp cl, 0x62
jne 0x46156e
cmp byte [ebp + 0x64], 0
mov dword [ebp + 0x54], 5
mov dword [ebp + 0x58], edx
je 0x4614d4
movsx eax, byte [ebp + 0x65]
push eax
lea eax, [ebp + 0x7c]
push eax
push dword [ebp + 0x68]
call fcn.0044956d
mov ebx, dword [ebp + 0x7c]
add esp, 0xc
jmp 0x461544
cmp ax, 0x23
jne 0x461599
inc esi
inc esi
mov dword [ebp + 0x68], esi
jmp 0x4617b4
cmp byte [ebp + 0x65], 0
je 0x461514
mov edx, dword [ebp + 0x68]
xor ecx, ecx
mov cx, word [edx]
mov eax, ecx
call fcn.004448f5
test al, al
je 0x4615fc
cmp cx, 0x30
jne 0x461508
mov ax, word [edx + 2]
or ax, 0x20
cmp ax, 0x78
jne 0x461508
add edx, 4
push edx
call fcn.00445a10
pop ecx
mov dword [ebp + 0x1c], eax
jmp 0x46152c
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.00451cdf
cmp eax, 1
pop ecx
pop ecx
jl 0x461899
mov al, byte [ebp + 0x1c]
mov cl, byte [ebp + 0x1f]
mov byte [ebp + 0x1c], cl
mov cl, byte [ebp + 0x1e]
mov byte [ebp + 0x1f], al
mov al, byte [ebp + 0x1d]
mov byte [ebp + 0x1d], cl
mov byte [ebp + 0x1e], al
push 4
pop edi
push edi
push ebx
push dword [ebp + 0x54]
xor esi, esi
cmp byte [ebp + 0x25], 0
push dword [ebp + 0x34]
push dword [ebp + 0x5c]
push dword [ebp + 0x78]
je 0x4618a9
call dword [0x4dc264]
mov esi, eax
jmp 0x4618b1
cmp cl, 0x2a
je 0x4616a7
cmp cl, 0x7e
je 0x46163e
cmp cl, 0x40
je 0x46162f
cmp cl, 0x6e
mov esi, dword [ebp + 0x68]
jne 0x4615c3
mov dword [ebp + 0x54], edx
jmp 0x461639
cmp ax, 0x2a
jne 0x4615a9
inc esi
inc esi
mov dword [ebp + 0x68], esi
jmp 0x4616aa
cmp ax, 0x7e
jne 0x4615b9
push 2
pop edi
add esi, edi
jmp 0x461644
cmp ax, 0x40
jne 0x4615c3
inc esi
inc esi
jmp 0x461632
cmp dword [ebp + 0x58], edx
jg 0x4616ba
jl 0x4615d7
cmp dword [ebp + 0x54], edx
jae 0x4616ba
cmp cl, 0x5e
jne 0x4615e5
mov dword [ebp + 0x54], 6
jmp 0x461610
cmp cl, 0x75
jne 0x4615f3
mov dword [ebp + 0x54], 0x15
jmp 0x461610
test cl, cl
je 0x461609
cmp cl, 0x24
je 0x461609
lea ecx, [ebp + 0x7c]
call fcn.0043e679
jmp 0x460c94
mov dword [ebp + 0x54], 1
cmp byte [ebp + 0x64], 0
mov dword [ebp + 0x58], edx
jne 0x4616ba
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
shl edi, 1
mov ebx, esi
jmp 0x461547
mov esi, dword [ebp + 0x68]
mov dword [ebp + 0x54], 3
mov dword [ebp + 0x58], edx
jmp 0x4616ba
mov esi, dword [ebp + 0x68]
push 2
pop edi
cmp byte [ebp + 0x64], 0
mov dword [ebp + 0x54], edi
mov dword [ebp + 0x58], edx
jne 0x4616ba
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 2
push eax
lea ecx, [ebp + 0x7c]
call fcn.00444e77
cmp word [esi], 0
mov ebx, dword [ebp + 0x7c]
mov ecx, esi
mov eax, ebx
je 0x461698
mov dx, word [ecx]
cmp dx, 0x5c
jne 0x46168b
cmp word [ecx + 2], 0x30
jne 0x46168b
and word [eax], 0
add eax, edi
add ecx, 4
jmp 0x461692
mov word [eax], dx
add eax, edi
add ecx, edi
cmp word [ecx], 0
jne 0x461670
and word [eax], 0
sub eax, ebx
add eax, edi
mov edi, eax
jmp 0x461547
mov esi, dword [ebp + 0x68]
cmp byte [ebp + 0x64], 0
mov dword [ebp + 0x54], 7
mov dword [ebp + 0x58], edx
je 0x4616d0
movsx eax, byte [ebp + 0x65]
push eax
lea eax, [ebp + 0x7c]
push eax
push esi
call fcn.0044956d
mov edi, eax
jmp 0x4617d2
mov esi, dword [ebp + 0x68]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
lea eax, [ebx + 0x10]
push eax
lea ecx, [ebp + 0x7c]
xor edi, edi
call fcn.00444e77
mov edx, dword [ebp + 0x7c]
lea ecx, [esi + ebx*2]
cmp esi, ecx
mov eax, esi
mov dword [ebp + 0xc], ecx
jae 0x46172e
and word [edx], 0
cmp byte [ebp + 0x63], 0x2a
jne 0x461765
cmp word [eax], 0x5c
jne 0x461792
lea ecx, [eax + 2]
cmp word [ecx], 0x5c
jne 0x461792
mov eax, ecx
mov cx, word [eax]
mov word [edx], cx
inc edx
inc edx
inc eax
inc eax
xor edi, edi
cmp eax, dword [ebp + 0xc]
jb 0x4616f9
cmp edi, 1
jge 0x461735
and word [edx], 0
inc edi
inc edx
inc edx
test ebx, ebx
jle 0x461755
cmp edi, 2
jge 0x461755
push 2
pop esi
sub esi, edi
xor eax, eax
mov ecx, esi
shr ecx, 1
mov edi, edx
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
lea edx, [edx + esi*2]
mov ebx, dword [ebp + 0x7c]
and word [edx], 0
sub edx, ebx
mov edi, edx
jmp 0x461547
cmp byte [ebp + 0x63], 0x24
jne 0x461792
mov cx, word [eax]
cmp cx, 0xd
jne 0x461781
lea esi, [eax + 2]
cmp word [esi], 0xa
jne 0x461781
mov eax, esi
jmp 0x461787
cmp cx, 0xa
jne 0x46171b
and word [edx], 0
inc eax
inc eax
inc edx
inc edx
inc edi
jmp 0x461724
mov cx, word [eax]
cmp cx, 0x5c
jne 0x46171b
cmp word [eax + 2], 0x30
jne 0x46171b
and word [edx], 0
inc edx
inc edx
add eax, 4
jmp 0x46178f
mov esi, dword [ebp + 0x68]
cmp byte [ebp + 0x64], 0
push 4
pop edi
mov dword [ebp + 0x54], edi
mov dword [ebp + 0x58], edx
je 0x4617dd
movsx eax, byte [ebp + 0x65]
push eax
lea eax, [ebp + 0x7c]
push eax
push esi
call fcn.0044956d
mov ebx, dword [ebp + 0x7c]
add esp, 0xc
jmp 0x461547
cmp byte [ebp + 0x65], 0
je 0x46181c
xor ecx, ecx
mov cx, word [esi]
mov eax, ecx
call fcn.004448f5
test al, al
je 0x4615fc
cmp cx, 0x30
jne 0x46180d
mov ax, word [esi + 2]
or ax, 0x20
cmp ax, 0x78
jne 0x46180d
add esi, edi
push esi
call fcn.00445a10
pop ecx
mov dword [ebp + 0x1c], eax
jmp 0x461547
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.00451cdf
jmp 0x46188e
mov esi, dword [ebp + 0x68]
cmp byte [ebp + 0x64], 0
mov dword [ebp + 0x54], 0xb
mov dword [ebp + 0x58], edx
jne 0x4617c3
cmp byte [ebp + 0x65], 0
je 0x461881
xor ecx, ecx
mov cx, word [esi]
mov eax, ecx
call fcn.004448f5
test al, al
je 0x4615fc
cmp cx, 0x30
jne 0x46186f
mov ax, word [esi + 2]
or ax, 0x20
cmp ax, 0x78
jne 0x46186f
add esi, 4
push esi
call fcn.00445a10
pop ecx
mov dword [ebp + 0x1c], eax
mov dword [ebp + 0x20], edx
jmp 0x461547
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.00451a75
cmp eax, 1
pop ecx
pop ecx
jge 0x461547
lea ecx, [ebp + 0x7c]
call fcn.0043e679
xor esi, esi
inc esi
jmp 0x46196d
call fcn.0043f928
add esp, 0x18
cmp esi, 0x3fd
jne 0x4618d8
cmp byte [ebp + 0x66], 0
jne 0x4618d8
push 1
push dword [ebp + 0x5c]
mov byte [ebp + 0x66], 1
push dword [ebp + 0x78]
call fcn.00441e0f
add esp, 0xc
jmp 0x461547
lea ecx, [ebp + 0x7c]
call fcn.0043e679
jmp 0x46196d
cmp byte [ebp + 0x33], 0x21
jne 0x461917
mov eax, dword [ebp + 0x34]
cmp word [eax], bx
jne 0x461917
cmp dword [ebp + 0x48], ebx
je 0x461908
push dword [ebp + 0x48]
push dword [ebp + 0x5c]
push dword [ebp + 0x78]
call fcn.0044fbb4
jmp 0x461961
push dword [ebp + 0x5c]
push dword [ebp + 0x78]
call fcn.0044f9b3
pop ecx
pop ecx
jmp 0x461964
cmp dword [ebp + 0x48], ebx
je 0x461953
push ebx
lea eax, [ebp + 0x7c]
push eax
movzx eax, word [0x4dbc28]
push ebx
or eax, 0x2001b
push eax
push ebx
push ebx
push ebx
push dword [ebp + 0x5c]
mov dword [ebp + 0x7c], ebx
push dword [ebp + 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp dword [ebp + 0x7c], ebx
mov esi, eax
je 0x461966
push dword [ebp + 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x461966
push dword [ebp + 0x34]
push dword [ebp + 0x5c]
push dword [ebp + 0x78]
call fcn.0043f983
add esp, 0xc
mov esi, eax
cmp esi, 2
jne 0x46196d
xor esi, esi
lea ecx, [ebp + 0x28]
call fcn.0043e679
lea ecx, [ebp - 0xc]
call fcn.0043e679
lea ecx, [ebp - 4]
call fcn.0043e679
lea ecx, [ebp + 4]
call fcn.0043e679
lea ecx, [ebp + 0x10]
call fcn.0043e679
lea ecx, [ebp - 0x14]
call fcn.0043e679
lea ecx, [ebp + 8]
call fcn.0043e679
lea ecx, [ebp - 8]
call fcn.0043e679
lea ecx, [ebp - 0x24]
call fcn.0043e679
pop edi
mov eax, esi
pop esi
pop ebx
add ebp, 0x70
leave
ret 8