Function at 0x44bc2c
Capabilities:
Delete file
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.0044bc2c
xor esi, esi
xor edi, edi
mov ecx, 0xa4
push esi
dec ecx
jne 0x44bc48
mov eax, 3
call fcn.0045a309
xor eax, eax
call fcn.00452fc5
mov eax, 3
call fcn.00454296
mov edx, 0x186b0d8
call fcn.0045d0ba
call fcn.0045c602
je 0x44bc81
jmp 0x44de33
xor eax, eax
call fcn.0045a290
mov ebx, 0x460010
mov ecx, 0x104
call fcn.0045ced6
mov eax, dword [ebp + 8]
mov dword [str.SYSTEMCurrentControlSetControlSystemInformation], eax
push 0
xor eax, eax
lea ebx, [esp]
push ebx
mov word [ebx], ax
push 1
call fcn.00424b2d
add esp, 4
mov ebx, 0x460010
call fcn.0045ce8d
mov edx, 0x186b0e0
call fcn.0045d0ba
call fcn.0045c602
jne 0x44bdc0
push 0
push 1
mov edx, 0x1868df4
call fcn.0045d0ba
lea ebx, [esp + 4]
call fcn.0045c36b
call fcn.00412768
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 4
push 0
mov edx, 0x186a388
call fcn.0045d0ba
lea ebx, [esp]
call fcn.0045c36b
call fcn.00412511
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 4
call fcn.0045d0d1
lea ebx, [ebp - 0x1a4]
mov ecx, 0x104
call fcn.0045ced6
lea ebx, [ebp - 0x1a4]
call fcn.0045ce8d
mov eax, 0x80000080
call fcn.00454915
call fcn.00423931
mov eax, 0x64
call fcn.00457053
push 0
mov edx, 0x1863028
call fcn.0045d0ba
lea ebx, [ebp - 0x1a4]
call fcn.0045ce8d
call fcn.0045c56d
lea ebx, [esp]
call fcn.0045c36b
call fcn.004339a3
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 4
test eax, eax
je 0x44bdbb
mov edx, 0x1865e0c
call fcn.0045d0ba
push 0
mov ebx, esp
call fcn.0045c2a9
call fcn.00417148
jmp 0x44de33
mov ebx, 0x460010
call fcn.0045ce8d
mov edx, 0x18609c8
call fcn.0045d0ba
call fcn.0045c602
jne 0x44be27
mov edx, 0x186b0f4
call fcn.0045d0ba
push 0
mov ebx, esp
call fcn.0045c2a9
call fcn.00417148
mov edx, 0x186b130
call fcn.0045d0ba
push 0
mov ebx, esp
call fcn.0045c2a9
call fcn.00417148
mov edx, 0x186b154
call fcn.0045d0ba
push 0
mov ebx, esp
call fcn.0045c2a9
call fcn.00417148
mov eax, 4
call fcn.0045a309
mov ebx, 0x45fa18
mov ecx, 0x40
call fcn.0045ced6
lea ebx, [ebp - 0x1b4]
push ebx
call dword [sym.imp.KERNEL32.DLL_GetLocalTime]
fldcw word [ebp - 0x10]
mov ax, word [ebp - 0x1b4]
call fcn.0045c271
mov edx, 0x1860b20
call fcn.0045d0ba
call fcn.00451819
mov ax, word [ebp - 0x1b2]
call fcn.0045c271
mov edx, 0x1860b34
call fcn.0045d0ba
call fcn.00451819
call fcn.0045c56d
mov ax, word [ebp - 0x1ae]
call fcn.0045c271
mov edx, 0x1860b34
call fcn.0045d0ba
call fcn.00451819
call fcn.0045c56d
mov ax, word [ebp - 0x1ac]
call fcn.0045c271
mov edx, 0x1860b34
call fcn.0045d0ba
call fcn.00451819
call fcn.0045c56d
mov ax, word [ebp - 0x1aa]
call fcn.0045c271
mov edx, 0x1860b34
call fcn.0045d0ba
call fcn.00451819
call fcn.0045c56d
mov ax, word [ebp - 0x1a8]
call fcn.0045c271
mov edx, 0x1860b34
call fcn.0045d0ba
call fcn.00451819
call fcn.0045c56d
mov ebx, 0x45feb8
mov ecx, 0xf
call fcn.0045ced6
push 0
mov edx, 0x186b170
call fcn.0045d0ba
push 0
mov ebx, esp
call fcn.0045c2a9
mov edx, 0x186a398
call fcn.0045d0ba
push 0
mov ebx, esp
call fcn.0045c2a9
call fcn.00417832
call fcn.0045d0d1
mov ebx, 0x45f844
mov ecx, 0x40
call fcn.0045ced6
mov ebx, 0x45f844
call fcn.0045ce8d
mov edx, 0x18609c8
call fcn.0045d0ba
call fcn.0045c602
jne 0x44bfbb
push 0
mov edx, 0x186b17c
call fcn.0045d0ba
push 0
mov ebx, esp
call fcn.0045c2a9
mov edx, 0x186a398
call fcn.0045d0ba
push 0
mov ebx, esp
call fcn.0045c2a9
call fcn.00417832
call fcn.0045d0d1
mov ebx, 0x45f844
mov ecx, 0x40
call fcn.0045ced6
mov ebx, 0x45f844
call fcn.0045ce8d
mov edx, 0x1860a3c
call fcn.0045d0ba
call fcn.0045b2a4
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 4
je 0x44c004
mov edx, 0x186b18c
call fcn.0045d0ba
push 0
mov ebx, esp
call fcn.0045c2a9
call fcn.00417148
jmp 0x44de33
mov ebx, 0x45fa70
push ebx
call dword [sym.imp.KERNEL32.DLL_InitializeCriticalSection]
fldcw word [ebp - 0x10]
mov ebx, 0x460010
call fcn.0045ce8d
mov edx, 0x1861a74
call fcn.0045d0ba
call fcn.0045c602
je 0x44c04d
mov ebx, 0x460010
call fcn.0045ce8d
mov edx, 0x1861ae4
call fcn.0045d0ba
call fcn.0045c602
jne 0x44c0dd
mov eax, 6
mov edx, 0x186b1ac
call fcn.0045d0ba
mov edx, 0x186b1bc
call fcn.0045d0ba
call fcn.0045c56d
mov edx, 0x1860824
call fcn.0045d0ba
call fcn.0045c56d
mov edx, 0x186b1dc
call fcn.0045d0ba
call fcn.0045c56d
mov edx, 0x1860824
call fcn.0045d0ba
call fcn.0045c56d
mov edx, 0x186b20c
call fcn.0045d0ba
call fcn.0045c56d
mov ecx, 0x134
mov edx, 0x186b220
call fcn.0045d0ba
xchg ecx, eax
call fcn.00450a1f
cmp eax, ecx
jne 0x44c0c9
call fcn.0041c85e
mov ebx, 0x45fa70
push ebx
call dword [sym.imp.KERNEL32.DLL_DeleteCriticalSection]
fldcw word [ebp - 0x10]
jmp 0x44de33
call fcn.00417bf4
mov dword [0x45fedc], eax
fild dword [0x186d70c]
mov eax, dword [0x45fedc]
call fcn.0045c27b
fcompp
fnstsw ax
sahf
jne 0x44c1c0
mov edx, 0x186b22c
call fcn.0045d0ba
push 0
mov ebx, esp
call fcn.0045c2a9
call fcn.00417148
push 0
push 0
push 0
push 0
mov edx, 0x186b290
call fcn.0045d0ba
lea ebx, [esp + 0xc]
call fcn.0045c36b
mov edx, 0x186b27c
call fcn.0045d0ba
lea ebx, [esp + 0xc]
call fcn.0045c36b
mov edx, 0x186b244
call fcn.0045d0ba
lea ebx, [esp + 0xc]
call fcn.0045c36b
fild qword [0x186d0c4]
fistp qword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
lea ebx, [esp + 0xc]
push ebx
mov dword [ebx], eax
call fcn.00430e85
mov ebx, esp
mov eax, dword [ebx + 0xc]
call fcn.00457d88
mov eax, dword [ebx + 8]
call fcn.00457d88
mov eax, dword [ebx + 4]
call fcn.00457d88
add esp, 0x10
push 0
mov edx, 0x186b2bc
call fcn.0045d0ba
lea ebx, [esp]
call fcn.0045c36b
call fcn.00418529
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 4
jmp 0x44c6ad
fild dword [0x186d720]
mov eax, dword [0x45fedc]
call fcn.0045c27b
fcompp
fnstsw ax
sahf
jne 0x44c4b5
mov edx, 0x186b2c8
call fcn.0045d0ba
push 0
mov ebx, esp
call fcn.0045c2a9
call fcn.00417148
push 0
push 0
push 0
mov edx, 0x186b320
call fcn.0045d0ba
lea ebx, [esp + 8]
call fcn.0045c36b
mov edx, 0x186b2e0
call fcn.0045d0ba
lea ebx, [esp + 8]
call fcn.0045c36b
fild qword [0x186d0bc]
fistp qword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
lea ebx, [esp + 8]
push ebx
mov dword [ebx], eax
call fcn.004311e9
mov ebx, esp
mov eax, dword [ebx + 8]
call fcn.00457d88
mov eax, dword [ebx + 4]
call fcn.00457d88
add esp, 0xc
push 0
push 0
push 0
push 0
xor eax, eax
lea ebx, [esp + 0xc]
push ebx
mov dword [ebx], eax
mov edx, 0x186b350
call fcn.0045d0ba
lea ebx, [esp + 0xc]
call fcn.0045c36b
mov edx, 0x186b330
call fcn.0045d0ba
lea ebx, [esp + 0xc]
call fcn.0045c36b
fild qword [0x186d0c4]
fistp qword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
lea ebx, [esp + 0xc]
push ebx
mov dword [ebx], eax
call fcn.00430f3a
mov ebx, esp
mov eax, dword [ebx + 8]
call fcn.00457d88
mov eax, dword [ebx + 4]
call fcn.00457d88
add esp, 0x10
push 0
push 0
push 0
push 0
mov edx, 0x186b3a8
call fcn.0045d0ba
lea ebx, [esp + 0xc]
push ebx
call fcn.0045c2a9
mov edx, 0x186b364
call fcn.0045d0ba
lea ebx, [esp + 0xc]
push ebx
call fcn.0045c2a9
fild qword [0x186d0c4]
fistp qword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
lea ebx, [esp + 0xc]
push ebx
mov dword [ebx], eax
call fcn.0043105b
mov ebx, esp
mov eax, dword [ebx + 8]
call fcn.00457d88
mov eax, dword [ebx + 4]
call fcn.00457d88
add esp, 0xc
push 0
push 0
push 0
mov edx, 0x186b3d4
call fcn.0045d0ba
lea ebx, [esp + 8]
call fcn.0045c36b
mov edx, 0x186b3bc
call fcn.0045d0ba
lea ebx, [esp + 8]
call fcn.0045c36b
fild qword [0x186d0c4]
fistp qword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
lea ebx, [esp + 8]
push ebx
mov dword [ebx], eax
call fcn.00431284
push eax
mov ebx, esp
mov eax, dword [ebx + 0xc]
call fcn.00457d88
mov eax, dword [ebx + 8]
call fcn.00457d88
pop eax
add esp, 0xc
push 0
push 0
push 0
mov edx, 0x186b3e0
call fcn.0045d0ba
lea ebx, [esp + 8]
call fcn.0045c36b
mov edx, 0x186b3bc
call fcn.0045d0ba
lea ebx, [esp + 8]
call fcn.0045c36b
fild qword [0x186d0c4]
fistp qword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
lea ebx, [esp + 8]
push ebx
mov dword [ebx], eax
call fcn.00431284
push eax
mov ebx, esp
mov eax, dword [ebx + 0xc]
call fcn.00457d88
mov eax, dword [ebx + 8]
call fcn.00457d88
pop eax
add esp, 0xc
push 0
push 0
push 0
push 0
mov edx, 0x186b410
call fcn.0045d0ba
lea ebx, [esp + 0xc]
call fcn.0045c36b
mov edx, 0x18655f8
call fcn.0045d0ba
lea ebx, [esp + 0xc]
call fcn.0045c36b
mov edx, 0x186b3f0
call fcn.0045d0ba
lea ebx, [esp + 0xc]
call fcn.0045c36b
fild qword [0x186d0c4]
fistp qword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
lea ebx, [esp + 0xc]
push ebx
mov dword [ebx], eax
call fcn.00430d7a
mov ebx, esp
mov eax, dword [ebx + 0xc]
call fcn.00457d88
mov eax, dword [ebx + 8]
call fcn.00457d88
mov eax, dword [ebx + 4]
call fcn.00457d88
add esp, 0x10
push 0
push 0
push 0
push 0
mov edx, 0x186b444
call fcn.0045d0ba
lea ebx, [esp + 0xc]
call fcn.0045c36b
mov edx, 0x186b410
call fcn.0045d0ba
lea ebx, [esp + 0xc]
call fcn.0045c36b
mov edx, 0x186b420
call fcn.0045d0ba
lea ebx, [esp + 0xc]
call fcn.0045c36b
fild qword [0x186d0c4]
fistp qword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
lea ebx, [esp + 0xc]
push ebx
mov dword [ebx], eax
call fcn.00430d7a
mov ebx, esp
mov eax, dword [ebx + 0xc]
call fcn.00457d88
mov eax, dword [ebx + 8]
call fcn.00457d88
mov eax, dword [ebx + 4]
call fcn.00457d88
add esp, 0x10
jmp 0x44c6ad
fild dword [0x186d738]
mov eax, dword [0x45fedc]
call fcn.0045c27b
fcompp
fnstsw ax
sahf
jne 0x44c695
mov edx, 0x186b454
call fcn.0045d0ba
push 0
mov ebx, esp
call fcn.0045c2a9
call fcn.00417148
push 0
push 0
push 0
mov edx, 0x186b3d4
call fcn.0045d0ba
lea ebx, [esp + 8]
call fcn.0045c36b
mov edx, 0x186b3bc
call fcn.0045d0ba
lea ebx, [esp + 8]
call fcn.0045c36b
fild qword [0x186d0c4]
fistp qword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
lea ebx, [esp + 8]
push ebx
mov dword [ebx], eax
call fcn.00431284
push eax
mov ebx, esp
mov eax, dword [ebx + 0xc]
call fcn.00457d88
mov eax, dword [ebx + 8]
call fcn.00457d88
pop eax
add esp, 0xc
push 0
push 0
push 0
mov edx, 0x186b3e0
call fcn.0045d0ba
lea ebx, [esp + 8]
call fcn.0045c36b
mov edx, 0x186b3bc
call fcn.0045d0ba
lea ebx, [esp + 8]
call fcn.0045c36b
fild qword [0x186d0c4]
fistp qword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
lea ebx, [esp + 8]
push ebx
mov dword [ebx], eax
call fcn.00431284
push eax
mov ebx, esp
mov eax, dword [ebx + 0xc]
call fcn.00457d88
mov eax, dword [ebx + 8]
call fcn.00457d88
pop eax
add esp, 0xc
push 0
push 0
push 0
push 0
mov edx, 0x186b410
call fcn.0045d0ba
lea ebx, [esp + 0xc]
call fcn.0045c36b
mov edx, 0x18655f8
call fcn.0045d0ba
lea ebx, [esp + 0xc]
call fcn.0045c36b
mov edx, 0x186b3f0
call fcn.0045d0ba
lea ebx, [esp + 0xc]
call fcn.0045c36b
fild qword [0x186d0c4]
fistp qword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
lea ebx, [esp + 0xc]
push ebx
mov dword [ebx], eax
call fcn.00430d7a
mov ebx, esp
mov eax, dword [ebx + 0xc]
call fcn.00457d88
mov eax, dword [ebx + 8]
call fcn.00457d88
mov eax, dword [ebx + 4]
call fcn.00457d88
add esp, 0x10
push 0
push 0
push 0
push 0
mov edx, 0x186b444
call fcn.0045d0ba
lea ebx, [esp + 0xc]
call fcn.0045c36b
mov edx, 0x186b410
call fcn.0045d0ba
lea ebx, [esp + 0xc]
call fcn.0045c36b
mov edx, 0x186b420
call fcn.0045d0ba
lea ebx, [esp + 0xc]
call fcn.0045c36b
fild qword [0x186d0c4]
fistp qword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
lea ebx, [esp + 0xc]
push ebx
mov dword [ebx], eax
call fcn.00430d7a
mov ebx, esp
mov eax, dword [ebx + 0xc]
call fcn.00457d88
mov eax, dword [ebx + 8]
call fcn.00457d88
mov eax, dword [ebx + 4]
call fcn.00457d88
add esp, 0x10
call fcn.00436b00
jmp 0x44c6ad
mov edx, 0x186b46c
call fcn.0045d0ba
push 0
mov ebx, esp
call fcn.0045c2a9
call fcn.00417148
push 0
push 0
push 0
push 0
mov edx, 0x1862100
call fcn.0045d0ba
lea ebx, [esp + 0xc]
push ebx
call fcn.0045c2a9
mov edx, 0x186b4a0
call fcn.0045d0ba
lea ebx, [esp + 0xc]
push ebx
call fcn.0045c2a9
fild qword [0x186d0cc]
fistp qword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
lea ebx, [esp + 0xc]
push ebx
mov dword [ebx], eax
call fcn.0043105b
mov ebx, esp
mov eax, dword [ebx + 8]
call fcn.00457d88
mov eax, dword [ebx + 4]
call fcn.00457d88
add esp, 0xc
push 0
push 0
push 0
push 0
xor eax, eax
lea ebx, [esp + 0xc]
push ebx
mov dword [ebx], eax
mov edx, 0x186b4e8
call fcn.0045d0ba
lea ebx, [esp + 0xc]
call fcn.0045c36b
mov edx, 0x186b4c0
call fcn.0045d0ba
lea ebx, [esp + 0xc]
call fcn.0045c36b
fild qword [0x186d0cc]
fistp qword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
lea ebx, [esp + 0xc]
push ebx
mov dword [ebx], eax
call fcn.00430f3a
mov ebx, esp
mov eax, dword [ebx + 8]
call fcn.00457d88
mov eax, dword [ebx + 4]
call fcn.00457d88
add esp, 0x10
mov ebx, 0x18606ac
mov eax, 2
call fcn.00450535
push 1
push 0x64
push 4
push 0x10a0008
push 0
mov ebx, 0x18606ac
call fcn.004501f1
push 0
mov edx, 0x1869cf4
call fcn.0045d0ba
lea ebx, [esp]
call fcn.0045c36b
call fcn.004124a4
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 4
push 0
mov edx, 0x186b4f4
call fcn.0045d0ba
lea ebx, [esp]
call fcn.0045c36b
call fcn.004124a4
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 4
push 0
mov edx, 0x186a388
call fcn.0045d0ba
lea ebx, [esp]
call fcn.0045c36b
call fcn.004124a4
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 4
push 0
mov edx, 0x1860cec
call fcn.0045d0ba
lea ebx, [esp]
call fcn.0045c36b
call fcn.004124a4
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 4
push 0
mov edx, 0x1868df4
call fcn.0045d0ba
lea ebx, [esp]
call fcn.0045c36b
call fcn.004124a4
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 4
push 0
mov edx, 0x186b504
call fcn.0045d0ba
lea ebx, [esp]
call fcn.0045c36b
call fcn.004124a4
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 4
push 0
mov edx, 0x186b514
call fcn.0045d0ba
lea ebx, [esp]
call fcn.0045c36b
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 4
fldcw word [ebp - 0x10]
push 0
mov edx, 0x186b524
call fcn.0045d0ba
lea ebx, [esp]
call fcn.0045c36b
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 4
fldcw word [ebp - 0x10]
push 0
mov edx, 0x186b534
call fcn.0045d0ba
lea ebx, [esp]
call fcn.0045c36b
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 4
fldcw word [ebp - 0x10]
push 0
mov edx, 0x186b54c
call fcn.0045d0ba
lea ebx, [esp]
call fcn.0045c36b
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 4
fldcw word [ebp - 0x10]
push 0
mov ebx, 0x45fa18
call fcn.0045ce8d
mov edx, 0x186b56c
call fcn.0045d0ba
call fcn.0045c56d
lea ebx, [esp]
call fcn.0045c36b
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 4
fldcw word [ebp - 0x10]
push 0
mov ebx, 0x45fa18
call fcn.0045ce8d
mov edx, 0x186b580
call fcn.0045d0ba
call fcn.0045c56d
lea ebx, [esp]
call fcn.0045c36b
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 4
fldcw word [ebp - 0x10]
push 0
mov ebx, 0x45fa18
call fcn.0045ce8d
mov edx, 0x186b594
call fcn.0045d0ba
call fcn.0045c56d
lea ebx, [esp]
call fcn.0045c36b
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 4
fldcw word [ebp - 0x10]
push 0
mov ebx, 0x45fa18
call fcn.0045ce8d
mov edx, 0x186b5a8
call fcn.0045d0ba
call fcn.0045c56d
lea ebx, [esp]
call fcn.0045c36b
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 4
fldcw word [ebp - 0x10]
push 0
mov ebx, 0x45fa18
call fcn.0045ce8d
mov edx, 0x186b5bc
call fcn.0045d0ba
call fcn.0045c56d
lea ebx, [esp]
call fcn.0045c36b
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 4
fldcw word [ebp - 0x10]
push 0
mov ebx, 0x45fa18
call fcn.0045ce8d
mov edx, 0x186b5c8
call fcn.0045d0ba
call fcn.0045c56d
lea ebx, [esp]
call fcn.0045c36b
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 4
fldcw word [ebp - 0x10]
push 0
mov ebx, 0x45fa18
call fcn.0045ce8d
mov edx, 0x1860b4c
call fcn.0045d0ba
call fcn.0045c56d
lea ebx, [esp]
call fcn.0045c36b
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 4
fldcw word [ebp - 0x10]
push 0
mov ebx, 0x45fa18
call fcn.0045ce8d
mov edx, 0x1869874
call fcn.0045d0ba
call fcn.0045c56d
lea ebx, [esp]
call fcn.0045c36b
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 4
fldcw word [ebp - 0x10]
push 0
mov ebx, 0x45fa18
call fcn.0045ce8d
mov edx, 0x1869908
call fcn.0045d0ba
call fcn.0045c56d
lea ebx, [esp]
call fcn.0045c36b
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 4
fldcw word [ebp - 0x10]
push 0
mov ebx, 0x45fa18
call fcn.0045ce8d
mov edx, 0x1862b24
call fcn.0045d0ba
call fcn.0045c56d
lea ebx, [esp]
call fcn.0045c36b
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 4
fldcw word [ebp - 0x10]
push 0
mov edx, 0x1867684
call fcn.0045d0ba
lea ebx, [esp]
call fcn.0045c36b
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 4
fldcw word [ebp - 0x10]
mov ebx, 0x45fa18
call fcn.0045ce8d
mov eax, 0x80000104
call fcn.00454915
call fcn.0042d302
mov ebx, 0x45fa18
call fcn.0045ce8d
mov edx, 0x186b5d4
call fcn.0045d0ba
call fcn.0045c56d
mov eax, 0x80000104
call fcn.00454915
call fcn.004253b7
mov ebx, 0x45fa18
call fcn.0045ce8d
mov edx, 0x1860be4
call fcn.0045d0ba
call fcn.0045c56d
mov eax, 0x80000104
call fcn.00454915
call fcn.004253b7
call fcn.004437d3
mov ecx, 0x432264
push ecx
push 0
push 0x100000
push 0
lea ebx, [ebp - 0x9c]
call fcn.0045173d
mov esi, dword [ebx]
mov eax, esi
lea ebx, [ebp - 0x9c]
call fcn.00451717
mov esi, dword [ebx]
mov ecx, 0x43d208
push ecx
push 0
push 0x100000
push 0
lea ebx, [ebp - 0x9c]
call fcn.0045173d
mov esi, dword [ebx]
mov eax, esi
lea ebx, [ebp - 0x9c]
call fcn.00451717
mov esi, dword [ebx]
mov eax, dword [0x45fb14]
test eax, eax
je 0x44ccac
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, 0x186a0
call fcn.00457053
jmp 0x44cca0
mov eax, dword [0x45fb1c]
test eax, eax
je 0x44da11
fild dword [0x186d720]
mov eax, dword [0x45fedc]
call fcn.0045c27b
fcompp
fnstsw ax
sahf
jne 0x44d175
call fcn.00431b18
push 0
push 0
push 0
push 1
mov edx, 0x186b630
call fcn.0045d0ba
lea ebx, [esp + 0xc]
push ebx
call fcn.0045c2a9
mov edx, 0x186b5e8
call fcn.0045d0ba
lea ebx, [esp + 0xc]
push ebx
call fcn.0045c2a9
fild qword [0x186d0cc]
fistp qword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
lea ebx, [esp + 0xc]
push ebx
mov dword [ebx], eax
call fcn.0043105b
mov ebx, esp
mov eax, dword [ebx + 8]
call fcn.00457d88
mov eax, dword [ebx + 4]
call fcn.00457d88
add esp, 0xc
push 0
push 0
push 0
push 0
mov eax, 1
lea ebx, [esp + 0xc]
push ebx
mov dword [ebx], eax
mov edx, 0x186b664
call fcn.0045d0ba
lea ebx, [esp + 0xc]
call fcn.0045c36b
mov edx, 0x186b648
call fcn.0045d0ba
lea ebx, [esp + 0xc]
call fcn.0045c36b
fild qword [0x186d0c4]
fistp qword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
lea ebx, [esp + 0xc]
push ebx
mov dword [ebx], eax
call fcn.00430f3a
mov ebx, esp
mov eax, dword [ebx + 8]
call fcn.00457d88
mov eax, dword [ebx + 4]
call fcn.00457d88
add esp, 0x10
push 0
push 0
push 0
push 0
mov eax, 0x60
lea ebx, [esp + 0xc]
push ebx
mov dword [ebx], eax
mov edx, 0x186b678
call fcn.0045d0ba
lea ebx, [esp + 0xc]
call fcn.0045c36b
mov edx, 0x186b648
call fcn.0045d0ba
lea ebx, [esp + 0xc]
call fcn.0045c36b
fild qword [0x186d0c4]
fistp qword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
lea ebx, [esp + 0xc]
push ebx
mov dword [ebx], eax
call fcn.00430f3a
mov ebx, esp
mov eax, dword [ebx + 8]
call fcn.00457d88
mov eax, dword [ebx + 4]
call fcn.00457d88
add esp, 0x10
push 0
push 0
push 0
push 0
mov edx, 0x186b3a8
call fcn.0045d0ba
lea ebx, [esp + 0xc]
push ebx
call fcn.0045c2a9
mov edx, 0x186b364
call fcn.0045d0ba
lea ebx, [esp + 0xc]
push ebx
call fcn.0045c2a9
fild qword [0x186d0c4]
fistp qword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
lea ebx, [esp + 0xc]
push ebx
mov dword [ebx], eax
call fcn.0043105b
mov ebx, esp
mov eax, dword [ebx + 8]
call fcn.00457d88
mov eax, dword [ebx + 4]
call fcn.00457d88
add esp, 0xc
push 0
push 0
push 0
push 0
mov edx, 0x186b6d0
call fcn.0045d0ba
lea ebx, [esp + 0xc]
push ebx
call fcn.0045c2a9
mov edx, 0x186b688
call fcn.0045d0ba
lea ebx, [esp + 0xc]
push ebx
call fcn.0045c2a9
fild qword [0x186d0c4]
fistp qword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
lea ebx, [esp + 0xc]
push ebx
mov dword [ebx], eax
call fcn.0043105b
mov ebx, esp
mov eax, dword [ebx + 8]
call fcn.00457d88
mov eax, dword [ebx + 4]
call fcn.00457d88
add esp, 0xc
push 0
push 0
push 0
push 0
mov edx, 0x186b718
call fcn.0045d0ba
lea ebx, [esp + 0xc]
call fcn.0045c36b
mov edx, 0x186b70c
call fcn.0045d0ba
lea ebx, [esp + 0xc]
call fcn.0045c36b
mov edx, 0x186b6f0
call fcn.0045d0ba
lea ebx, [esp + 0xc]
call fcn.0045c36b
fild qword [0x186d0c4]
fistp qword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
lea ebx, [esp + 0xc]
push ebx
mov dword [ebx], eax
call fcn.00430d7a
mov ebx, esp
mov eax, dword [ebx + 0xc]
call fcn.00457d88
mov eax, dword [ebx + 8]
call fcn.00457d88
mov eax, dword [ebx + 4]
call fcn.00457d88
add esp, 0x10
push 0
push 0
push 0
push 0
mov edx, 0x186b718
call fcn.0045d0ba
lea ebx, [esp + 0xc]
call fcn.0045c36b
mov edx, 0x186b720
call fcn.0045d0ba
lea ebx, [esp + 0xc]
call fcn.0045c36b
mov edx, 0x186b6f0
call fcn.0045d0ba
lea ebx, [esp + 0xc]
call fcn.0045c36b
fild qword [0x186d0c4]
fistp qword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
lea ebx, [esp + 0xc]
push ebx
mov dword [ebx], eax
call fcn.00430d7a
mov ebx, esp
mov eax, dword [ebx + 0xc]
call fcn.00457d88
mov eax, dword [ebx + 8]
call fcn.00457d88
mov eax, dword [ebx + 4]
call fcn.00457d88
add esp, 0x10
push 0
push 0
push 0
push 0
mov edx, 0x186b748
call fcn.0045d0ba
lea ebx, [esp + 0xc]
call fcn.0045c36b
mov edx, 0x186b734
call fcn.0045d0ba
lea ebx, [esp + 0xc]
call fcn.0045c36b
mov edx, 0x186b6f0
call fcn.0045d0ba
lea ebx, [esp + 0xc]
call fcn.0045c36b
fild qword [0x186d0c4]
fistp qword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
lea ebx, [esp + 0xc]
push ebx
mov dword [ebx], eax
call fcn.00430d7a
mov ebx, esp
mov eax, dword [ebx + 0xc]
call fcn.00457d88
mov eax, dword [ebx + 8]
call fcn.00457d88
mov eax, dword [ebx + 4]
call fcn.00457d88
add esp, 0x10
push 0
mov edx, 0x186b750
call fcn.0045d0ba
lea ebx, [esp]
call fcn.0045c36b
call fcn.004186bc
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 4
push 0
mov edx, 0x186b750
call fcn.0045d0ba
lea ebx, [esp]
call fcn.0045c36b
call fcn.00418415
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 4
lea ebx, [ebp - 0x204]
push ebx
call dword [sym.imp.KERNEL32.DLL_Wow64DisableWow64FsRedirection]
fldcw word [ebp - 0x10]
test eax, eax
je 0x44d0c9
push 0
mov edx, 0x186b75c
call fcn.0045d0ba
lea ebx, [esp]
call fcn.0045c36b
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 4
fldcw word [ebp - 0x10]
lea ebx, [ebp - 0x204]
push ebx
call dword [sym.imp.KERNEL32.DLL_Wow64RevertWow64FsRedirection]
fldcw word [ebp - 0x10]
push 0
mov edx, 0x186b788
call fcn.0045d0ba
lea ebx, [esp]
call fcn.0045c36b
call fcn.004186bc
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 4
push 0
mov edx, 0x186b788
call fcn.0045d0ba
lea ebx, [esp]
call fcn.0045c36b
call fcn.00418415
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 4
lea ebx, [ebp - 0x204]
push ebx
call dword [sym.imp.KERNEL32.DLL_Wow64DisableWow64FsRedirection]
fldcw word [ebp - 0x10]
test eax, eax
je 0x44d170
push 0
mov edx, 0x186b794
call fcn.0045d0ba
lea ebx, [esp]
call fcn.0045c36b
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 4
fldcw word [ebp - 0x10]
lea ebx, [ebp - 0x204]
push ebx
call dword [sym.imp.KERNEL32.DLL_Wow64RevertWow64FsRedirection]
fldcw word [ebp - 0x10]
jmp 0x44d333
fild dword [0x186d738]
mov eax, dword [0x45fedc]
call fcn.0045c27b
fcompp
fnstsw ax
sahf
jne 0x44d333
push 0
push 0
push 0
mov edx, 0x186b3d4
call fcn.0045d0ba
lea ebx, [esp + 8]
call fcn.0045c36b
mov edx, 0x186b3bc
call fcn.0045d0ba
lea ebx, [esp + 8]
call fcn.0045c36b
fild qword [0x186d0c4]
fistp qword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
lea ebx, [esp + 8]
push ebx
mov dword [ebx], eax
call fcn.00431284
push eax
mov ebx, esp
mov eax, dword [ebx + 0xc]
call fcn.00457d88
mov eax, dword [ebx + 8]
call fcn.00457d88
pop eax
add esp, 0xc
push 0
push 0
push 0
mov edx, 0x186b3e0
call fcn.0045d0ba
lea ebx, [esp + 8]
call fcn.0045c36b
mov edx, 0x186b3bc
call fcn.0045d0ba
lea ebx, [esp + 8]
call fcn.0045c36b
fild qword [0x186d0c4]
fistp qword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
lea ebx, [esp + 8]
push ebx
mov dword [ebx], eax
call fcn.00431284
push eax
mov ebx, esp
mov eax, dword [ebx + 0xc]
call fcn.00457d88
mov eax, dword [ebx + 8]
call fcn.00457d88
pop eax
add esp, 0xc
push 0
push 0
push 0
push 0
mov edx, 0x186b410
call fcn.0045d0ba
lea ebx, [esp + 0xc]
call fcn.0045c36b
mov edx, 0x18655f8
call fcn.0045d0ba
lea ebx, [esp + 0xc]
call fcn.0045c36b
mov edx, 0x186b3f0
call fcn.0045d0ba
lea ebx, [esp + 0xc]
call fcn.0045c36b
fild qword [0x186d0c4]
fistp qword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
lea ebx, [esp + 0xc]
push ebx
mov dword [ebx], eax
call fcn.00430d7a
mov ebx, esp
mov eax, dword [ebx + 0xc]
call fcn.00457d88
mov eax, dword [ebx + 8]
call fcn.00457d88
mov eax, dword [ebx + 4]
call fcn.00457d88
add esp, 0x10
push 0
push 0
push 0
push 0
mov edx, 0x186b444
call fcn.0045d0ba
lea ebx, [esp + 0xc]
call fcn.0045c36b
mov edx, 0x186b410
call fcn.0045d0ba
lea ebx, [esp + 0xc]
call fcn.0045c36b
mov edx, 0x186b420
call fcn.0045d0ba
lea ebx, [esp + 0xc]
call fcn.0045c36b
fild qword [0x186d0c4]
fistp qword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
lea ebx, [esp + 0xc]
push ebx
mov dword [ebx], eax
call fcn.00430d7a
mov ebx, esp
mov eax, dword [ebx + 0xc]
call fcn.00457d88
mov eax, dword [ebx + 8]
call fcn.00457d88
mov eax, dword [ebx + 4]
call fcn.00457d88
add esp, 0x10
push 0
push 0
push 0
push 0
mov edx, 0x18655f8
call fcn.0045d0ba
lea ebx, [esp + 0xc]
call fcn.0045c36b
mov edx, 0x186b7dc
call fcn.0045d0ba
lea ebx, [esp + 0xc]
call fcn.0045c36b
mov edx, 0x186b7c0
call fcn.0045d0ba
lea ebx, [esp + 0xc]
call fcn.0045c36b
fild qword [0x186d0c4]
fistp qword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
lea ebx, [esp + 0xc]
push ebx
mov dword [ebx], eax
call fcn.00430d7a
mov ebx, esp
mov eax, dword [ebx + 0xc]
call fcn.00457d88
mov eax, dword [ebx + 8]
call fcn.00457d88
mov eax, dword [ebx + 4]
call fcn.00457d88
add esp, 0x10
push 0
push 0
push 0
push 0
mov edx, 0x186b804
call fcn.0045d0ba
lea ebx, [esp + 0xc]
call fcn.0045c36b
mov edx, 0x186b7f0
call fcn.0045d0ba
lea ebx, [esp + 0xc]
call fcn.0045c36b
mov edx, 0x186b7c0
call fcn.0045d0ba
lea ebx, [esp + 0xc]
call fcn.0045c36b
fild qword [0x186d0c4]
fistp qword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
lea ebx, [esp + 0xc]
push ebx
mov dword [ebx], eax
call fcn.00430d7a
mov ebx, esp
mov eax, dword [ebx + 0xc]
call fcn.00457d88
mov eax, dword [ebx + 8]
call fcn.00457d88
mov eax, dword [ebx + 4]
call fcn.00457d88
add esp, 0x10
push 0
push 0
push 0
push 0
mov edx, 0x186b82c
call fcn.0045d0ba
lea ebx, [esp + 0xc]
call fcn.0045c36b
mov edx, 0x186b810
call fcn.0045d0ba
lea ebx, [esp + 0xc]
call fcn.0045c36b
mov edx, 0x186b7c0
call fcn.0045d0ba
lea ebx, [esp + 0xc]
call fcn.0045c36b
fild qword [0x186d0c4]
fistp qword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
lea ebx, [esp + 0xc]
push ebx
mov dword [ebx], eax
call fcn.00430d7a
mov ebx, esp
mov eax, dword [ebx + 0xc]
call fcn.00457d88
mov eax, dword [ebx + 8]
call fcn.00457d88
mov eax, dword [ebx + 4]
call fcn.00457d88
add esp, 0x10
push 0
push 0
push 0
push 0
mov edx, 0x186b82c
call fcn.0045d0ba
lea ebx, [esp + 0xc]
call fcn.0045c36b
mov edx, 0x186b85c
call fcn.0045d0ba
lea ebx, [esp + 0xc]
call fcn.0045c36b
mov edx, 0x186b838
call fcn.0045d0ba
lea ebx, [esp + 0xc]
call fcn.0045c36b
fild qword [0x186d0cc]
fistp qword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
lea ebx, [esp + 0xc]
push ebx
mov dword [ebx], eax
call fcn.00430d7a
mov ebx, esp
mov eax, dword [ebx + 0xc]
call fcn.00457d88
mov eax, dword [ebx + 8]
call fcn.00457d88
mov eax, dword [ebx + 4]
call fcn.00457d88
add esp, 0x10
push 0
push 0
push 0
xor eax, eax
lea ebx, [esp + 4]
push ebx
mov dword [ebx], eax
lea ebx, [ebp - 0x208]
push ebx
push 0
fild dword [0x186d63c]
fild dword [0x186cde8]
call fcn.0045c11c
call fcn.0045c2a2
push eax
push 0
push 0
push 0
mov edx, 0x186b87c
call fcn.0045d0ba
lea ebx, [esp + 0x1c]
call fcn.0045c36b
fild qword [0x186d0cc]
call fcn.0045c2a2
push eax
call dword [sym.imp.ADVAPI32.DLL_RegCreateKeyExA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 8
fldcw word [ebp - 0x10]
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x44d592
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
fldcw word [ebp - 0x10]
push 0
push 0
push 0
push 0
mov edx, 0x186b748
call fcn.0045d0ba
lea ebx, [esp + 0xc]
call fcn.0045c36b
mov edx, 0x186b8dc
call fcn.0045d0ba
lea ebx, [esp + 0xc]
call fcn.0045c36b
mov edx, 0x186b8c0
call fcn.0045d0ba
lea ebx, [esp + 0xc]
call fcn.0045c36b
fild qword [0x186d0c4]
fistp qword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
lea ebx, [esp + 0xc]
push ebx
mov dword [ebx], eax
call fcn.00430d7a
mov ebx, esp
mov eax, dword [ebx + 0xc]
call fcn.00457d88
mov eax, dword [ebx + 8]
call fcn.00457d88
mov eax, dword [ebx + 4]
call fcn.00457d88
add esp, 0x10
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, 0x1f4
call fcn.00457053
push 0
push 0
push 0
mov edx, 0x186a488
call fcn.0045d0ba
lea ebx, [esp + 8]
call fcn.0045c36b
mov edx, 0x186a454
call fcn.0045d0ba
lea ebx, [esp + 8]
call fcn.0045c36b
fild qword [0x186d0cc]
fistp qword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
lea ebx, [esp + 8]
push ebx
mov dword [ebx], eax
call fcn.004310f6
mov ebx, esp
mov eax, dword [ebx + 8]
call fcn.00457d88
mov eax, dword [ebx + 4]
call fcn.00457d88
add esp, 0xc
push 0
push 0
push 0
mov edx, 0x186a4a0
call fcn.0045d0ba
lea ebx, [esp + 8]
call fcn.0045c36b
mov edx, 0x186a454
call fcn.0045d0ba
lea ebx, [esp + 8]
call fcn.0045c36b
fild qword [0x186d0c4]
fistp qword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
lea ebx, [esp + 8]
push ebx
mov dword [ebx], eax
call fcn.004310f6
mov ebx, esp
mov eax, dword [ebx + 8]
call fcn.00457d88
mov eax, dword [ebx + 4]
call fcn.00457d88
add esp, 0xc
push 0
push 0
push 0
mov edx, 0x186a498
call fcn.0045d0ba
lea ebx, [esp + 8]
call fcn.0045c36b
mov edx, 0x186a454
call fcn.0045d0ba
lea ebx, [esp + 8]
call fcn.0045c36b
fild qword [0x186d0c4]
fistp qword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
lea ebx, [esp + 8]
push ebx
mov dword [ebx], eax
call fcn.004310f6
mov ebx, esp
mov eax, dword [ebx + 8]
call fcn.00457d88
mov eax, dword [ebx + 4]
call fcn.00457d88
add esp, 0xc
push 0
push 0
push 0
mov edx, 0x186a498
call fcn.0045d0ba
lea ebx, [esp + 8]
call fcn.0045c36b
mov edx, 0x186a454
call fcn.0045d0ba
lea ebx, [esp + 8]
call fcn.0045c36b
fild qword [0x186d0cc]
fistp qword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
lea ebx, [esp + 8]
push ebx
mov dword [ebx], eax
call fcn.004310f6
mov ebx, esp
mov eax, dword [ebx + 8]
call fcn.00457d88
mov eax, dword [ebx + 4]
call fcn.00457d88
add esp, 0xc
push 0
push 0
push 0
mov edx, 0x186b8fc
call fcn.0045d0ba
lea ebx, [esp + 8]
call fcn.0045c36b
mov edx, 0x186a454
call fcn.0045d0ba
lea ebx, [esp + 8]
call fcn.0045c36b
fild qword [0x186d0cc]
fistp qword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
lea ebx, [esp + 8]
push ebx
mov dword [ebx], eax
call fcn.004310f6
mov ebx, esp
mov eax, dword [ebx + 8]
call fcn.00457d88
mov eax, dword [ebx + 4]
call fcn.00457d88
add esp, 0xc
push 0
push 0
push 0
mov edx, 0x186b90c
call fcn.0045d0ba
lea ebx, [esp + 8]
call fcn.0045c36b
mov edx, 0x186a454
call fcn.0045d0ba
lea ebx, [esp + 8]
call fcn.0045c36b
fild qword [0x186d0cc]
fistp qword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
lea ebx, [esp + 8]
push ebx
mov dword [ebx], eax
call fcn.004310f6
mov ebx, esp
mov eax, dword [ebx + 8]
call fcn.00457d88
mov eax, dword [ebx + 4]
call fcn.00457d88
add esp, 0xc
push 0
push 0
push 0
mov edx, 0x186b924
call fcn.0045d0ba
lea ebx, [esp + 8]
call fcn.0045c36b
mov edx, 0x186a454
call fcn.0045d0ba
lea ebx, [esp + 8]
call fcn.0045c36b
fild qword [0x186d0cc]
fistp qword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
lea ebx, [esp + 8]
push ebx
mov dword [ebx], eax
call fcn.004310f6
mov ebx, esp
mov eax, dword [ebx + 8]
call fcn.00457d88
mov eax, dword [ebx + 4]
call fcn.00457d88
add esp, 0xc
push 0
mov edx, 0x186b930
call fcn.0045d0ba
lea ebx, [esp]
call fcn.0045c36b
call fcn.00419351
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 4
test eax, eax
je 0x44d8d9
mov edx, 0x186b964
call fcn.0045d0ba
lea ebx, [ebp - 0x308]
mov ecx, 0x100
call fcn.0045ced6
jmp 0x44d8f3
mov edx, 0x186b9d8
call fcn.0045d0ba
lea ebx, [ebp - 0x308]
mov ecx, 0x100
call fcn.0045ced6
push 0
push 0
push 0
xor eax, eax
lea ebx, [esp + 4]
push ebx
mov dword [ebx], eax
lea ebx, [ebp - 0x208]
push ebx
push 0
fild dword [0x186d63c]
fild dword [0x186cde8]
call fcn.0045c11c
call fcn.0045c2a2
push eax
push 0
push 0
push 0
mov edx, 0x18655a8
call fcn.0045d0ba
lea ebx, [esp + 0x1c]
call fcn.0045c36b
fild qword [0x186d0cc]
call fcn.0045c2a2
push eax
call dword [sym.imp.ADVAPI32.DLL_RegCreateKeyExA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 8
fldcw word [ebp - 0x10]
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x44d9e1
push 0
push 0
lea ebx, [ebp - 0x308]
call fcn.0045ce8d
call fcn.0045d088
push eax
lea ebx, [ebp - 0x308]
push ebx
push 1
push 0
mov edx, 0x1865f74
call fcn.0045d0ba
lea ebx, [esp + 0x10]
call fcn.0045c36b
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.DLL_RegSetValueExA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 4
fldcw word [ebp - 0x10]
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x44d9d2
mov dword [ebp - 0x98], 1
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
fldcw word [ebp - 0x10]
push 0
push 3
mov edx, 0x186ba20
call fcn.0045d0ba
lea ebx, [esp + 4]
call fcn.0045c36b
call fcn.00431925
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 4
jmp 0x44d610
mov eax, dword [0x45fed0]
test eax, eax
je 0x44da30
call fcn.00432b25
push 1
call fcn.00424cf0
jmp 0x44de33
mov ecx, 0x44de59
push ecx
push 0
push 0x100000
push 0
lea ebx, [ebp - 0x9c]
call fcn.0045173d
mov esi, dword [ebx]
mov eax, esi
lea ebx, [ebp - 0x9c]
call fcn.00451717
mov esi, dword [ebx]
mov esi, 0
mov dword [0x45feec], 1
mov eax, dword [0x45fec8]
test eax, eax
je 0x44da7a
call fcn.00424f38
mov dword [str.SYSTEMCurrentControlSetServicesTPMWMI], 1
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc esi
call fcn.004320f6
call fcn.0041eecf
call fcn.004467b2
call fcn.0041f2e7
call fcn.0041f6fc
call fcn.00441111
call fcn.00441e9f
call fcn.0042cba1
call fcn.00436354
fild dword [0x186d784]
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], 0
fild qword [ebp - 0x6c]
fcompp
fnstsw ax
sahf
jne 0x44db36
mov eax, dword [0x45fab4]
test eax, eax
je 0x44db27
mov edx, 0x18609c8
call fcn.0045d0ba
mov eax, 0x800000ff
call fcn.00454915
mov ebx, 0x45fa18
call fcn.0045ce8d
mov edx, 0x186ba30
call fcn.0045d0ba
call fcn.0045c56d
mov eax, 0x800000ff
call fcn.00454915
call fcn.004174f2
mov eax, dword [str.MotherboardUUID]
test eax, eax
je 0x44db36
call fcn.00422908
fild dword [0x186d894]
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], 0
fild qword [ebp - 0x6c]
fcompp
fnstsw ax
sahf
jne 0x44dcf8
mov eax, dword [0x45fab0]
test eax, eax
je 0x44db84
mov edx, 0x186ba44
call fcn.0045d0ba
push 0
mov ebx, esp
call fcn.0045c2a9
call fcn.00417148
mov dword [0x45fab0], 0
mov eax, dword [0x45faa8]
test eax, eax
je 0x44dbd8
mov edx, 0x18621d8
call fcn.0045d0ba
mov eax, dword [0x45faa8]
call fcn.0045c27b
call fcn.0045ad27
call fcn.0045c56d
mov edx, 0x186ba60
call fcn.0045d0ba
call fcn.0045c56d
push 0
mov ebx, esp
call fcn.0045c2a9
call fcn.00417148
mov dword [0x45faa8], 0
mov eax, dword [0x45fb0c]
test eax, eax
je 0x44dc08
mov edx, 0x186ba6c
call fcn.0045d0ba
push 0
mov ebx, esp
call fcn.0045c2a9
call fcn.00417148
mov dword [0x45fb0c], 0
mov eax, dword [0x45fb10]
test eax, eax
je 0x44dc38
mov edx, 0x186ba88
call fcn.0045d0ba
push 0
mov ebx, esp
call fcn.0045c2a9
call fcn.00417148
mov dword [0x45fb10], 0
mov eax, dword [0x45fadc]
test eax, eax
je 0x44dc68
mov edx, 0x186baa4
call fcn.0045d0ba
push 0
mov ebx, esp
call fcn.0045c2a9
call fcn.00417148
mov dword [0x45fadc], 0
mov eax, dword [0x45feec]
test eax, eax
je 0x44dc98
mov edx, 0x186babc
call fcn.0045d0ba
push 0
mov ebx, esp
call fcn.0045c2a9
call fcn.00417148
mov dword [0x45feec], 0
mov eax, dword [0x45fae4]
test eax, eax
je 0x44dcc8
mov edx, 0x186bad8
call fcn.0045d0ba
push 0
mov ebx, esp
call fcn.0045c2a9
call fcn.00417148
mov dword [0x45fae4], 0
mov eax, dword [str.SYSTEMCurrentControlSetServicesTPMWMI]
test eax, eax
je 0x44dcf8
mov edx, 0x186baf4
call fcn.0045d0ba
push 0
mov ebx, esp
call fcn.0045c2a9
call fcn.00417148
mov dword [str.SYSTEMCurrentControlSetServicesTPMWMI], 0
fild dword [0x186d94c]
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], 0
fild qword [ebp - 0x6c]
fcompp
fnstsw ax
sahf
jne 0x44dd78
mov edx, 0x186bb0c
call fcn.0045d0ba
push 0
mov ebx, esp
call fcn.0045c2a9
call fcn.00417148
mov edi, 1
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, edi
sub eax, dword [0x18606c4]
mov ebx, dword [0x18606ac]
mov eax, dword [ebx + eax*4]
test eax, eax
je 0x44dd71
xor ecx, ecx
mov eax, edi
sub eax, dword [0x18606c4]
mov ebx, dword [0x18606ac]
mov eax, dword [ebx + eax*4]
call fcn.00457e4c
inc edi
cmp edi, 0x64
jbe 0x44dd40
mov eax, dword [0x45fec8]
test eax, eax
je 0x44de15
fild dword [0x186d9a8]
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], 0
fild qword [ebp - 0x6c]
fcompp
fnstsw ax
sahf
jne 0x44de15
cmp dword [0x460114], 0
jne 0x44ddfd
mov edx, 0x186bb2c
call fcn.0045d0ba
push 0
mov ebx, esp
call fcn.0045c2a9
call fcn.00417148
mov dword [0x45fecc], 2
call fcn.0042cba1
mov eax, 0x3e8
call fcn.00457053
call fcn.0042cba1
mov eax, 0x3e8
call fcn.00457053
push 1
call fcn.00424cf0
jmp 0x44de15
mov edx, 0x186bb44
call fcn.0045d0ba
push 0
mov ebx, esp
call fcn.0045c2a9
call fcn.00417148
mov eax, 0x3e8
call fcn.00457053
jmp 0x44da90
call fcn.0045cf2c
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x10