Function at 0x455ccf
Capabilities:
Encode data using base64
Parse credit card information
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x94
push ebx
push esi
push edi
mov dword [ebp + 0x18], ecx
push ecx
lea ecx, [ebp - 0x24]
call fcn.0043f42c
mov eax, dword [ebp + 0x78]
mov dword [ebp - 4], eax
xor ebx, ebx
lea eax, [ebp + 0x78]
push eax
mov byte [ebp + 0x32], 0xff
mov byte [ebp + 0x47], bl
mov byte [ebp + 0x46], bl
mov dword [ebp - 8], ebx
call fcn.004378b6
push 0xa
lea eax, [ebp + 0x78]
push eax
push str.___initram
call fcn.0043f0e5
add esp, 0x10
test al, al
jne 0x456174
mov dword [ebp + 0x60], ebx
mov esi, dword [ebp + 0x78]
mov ax, word [esi]
cmp ax, 0x2d
mov dword [ebp + 0x34], ebx
mov dword [ebp + 0x38], 0xfffffff0
mov byte [ebp + 0x6f], 0
mov byte [ebp + 0x53], 0
mov byte [ebp + 0x66], 0
mov byte [ebp + 0x6e], 0
mov byte [ebp + 0x23], 0
mov byte [ebp + 0x5f], 0
mov byte [ebp + 0x67], 0
mov dword [ebp + 0x4c], ebx
mov cl, 0x2a
jne 0x455d5e
mov cl, al
movsx ecx, cl
movzx eax, ax
cmp ecx, eax
mov dword [ebp + 0x2c], ecx
jne 0x455f73
movzx eax, word [esi + 2]
cmp dword [ebp + 0x2c], eax
jne 0x455f73
xor eax, eax
lea ecx, [esi + 4]
mov ax, word [ecx]
mov edx, eax
and dx, 0xffdf
cmp dx, 0x48
je 0x455f73
call fcn.004820ac
test al, al
jne 0x455f73
xor edi, edi
mov esi, ecx
inc edi
push edi
push esi
push 0x4acc90
mov dword [ebp + 0x78], esi
call fcn.00438aa1
add esp, 0xc
test al, al
je 0x455e06
lea eax, [ebp + 0x78]
add esi, 2
push eax
mov dword [ebp + 0x24], esi
call fcn.00407fcf
cmp word [esi], 0x3a
pop ecx
je 0x455ddc
or dword [ebp + 0x4c], 7
jmp 0x455f64
lea eax, [ebp + 0x58]
push eax
inc esi
lea eax, [ebp + 0x24]
inc esi
push eax
mov dword [ebp + 0x58], ebx
mov dword [ebp + 0x24], esi
call fcn.00439ff7
test eax, eax
pop ecx
pop ecx
jle 0x455f64
mov eax, dword [ebp + 0x58]
or dword [ebp + 0x4c], eax
jmp 0x455f64
push 2
push esi
push 0x4acc8c
call fcn.00438aa1
add esp, 0xc
test al, al
lea eax, [ebp + 0x78]
je 0x455e52
add esi, 4
push eax
mov dword [ebp + 0xc], esi
call fcn.00407fcf
lea eax, [ebp + 0x58]
push eax
lea eax, [ebp + 0xc]
push eax
mov dword [ebp + 0x58], ebx
call fcn.0044880d
add esp, 0xc
test eax, eax
jle 0x455f64
mov eax, dword [ebp + 0x58]
mov dword [ebp + 0x34], eax
mov dword [ebp + 0x38], ebx
jmp 0x455f64
push 2
pop esi
push esi
push eax
push 0x4a7fec
call fcn.0043f0e5
add esp, 0xc
test al, al
je 0x455e71
mov byte [ebp + 0x66], 1
jmp 0x455f64
push 4
lea eax, [ebp + 0x78]
push eax
push str.byte
call fcn.0043f0e5
add esp, 0xc
test al, al
je 0x455e91
mov byte [ebp + 0x5f], 1
jmp 0x455f64
push edi
lea eax, [ebp + 0x78]
push eax
push 0x4a7534
call fcn.0043f0e5
add esp, 0xc
test al, al
je 0x455eb0
mov byte [ebp + 0x6e], 3
jmp 0x455f64
push esi
lea eax, [ebp + 0x78]
push eax
push 0x4acc88
call fcn.0043f0e5
add esp, 0xc
test al, al
je 0x455ecf
or byte [ebp + 0x6e], 1
jmp 0x455f64
push esi
lea eax, [ebp + 0x78]
push eax
push 0x4acc84
call fcn.0043f0e5
add esp, 0xc
test al, al
je 0x455eeb
or byte [ebp + 0x6e], 2
jmp 0x455f64
push 4
lea eax, [ebp + 0x78]
push eax
push str.name
call fcn.0043f0e5
add esp, 0xc
test al, al
je 0x455f08
mov byte [ebp + 0x23], 1
jmp 0x455f64
push edi
lea eax, [ebp + 0x78]
push eax
push 0x4acc78
call fcn.0043f0e5
add esp, 0xc
test al, al
je 0x455f23
inc byte [ebp + 0x47]
jmp 0x455f64
push edi
lea eax, [ebp + 0x78]
push eax
push 0x4acc74
call fcn.0043f0e5
add esp, 0xc
test al, al
je 0x455f3e
inc byte [ebp + 0x46]
jmp 0x455f64
push esi
lea eax, [ebp + 0x78]
push eax
push 0x4acc70
call fcn.0043f0e5
add esp, 0xc
test al, al
je 0x455f5a
mov byte [ebp + 0x67], 1
jmp 0x455f64
lea eax, [ebp + 0x78]
push eax
call fcn.00407fcf
pop ecx
mov esi, dword [ebp + 0x78]
movzx eax, word [esi]
cmp dword [ebp + 0x2c], eax
je 0x455d6f
lea ecx, [ebp + 0x10]
call fcn.0043d3a5
lea ecx, [ebp - 0x14]
call fcn.0043d3a5
lea ecx, [ebp + 0x14]
call fcn.0043d3a5
lea ecx, [ebp + 4]
call fcn.0043d3a5
lea ecx, [ebp]
call fcn.0043d3a5
xor eax, eax
mov ax, word [esi]
mov ecx, eax
or ecx, 0x20
cmp cx, 0x6e
je 0x455fed
cmp cx, 0x75
je 0x455fed
cmp cx, 0x62
je 0x455fed
cmp ax, 0x5e
je 0x455fed
cmp ax, 0x2b
je 0x455fed
cmp ax, 0x23
je 0x455fed
cmp ax, 0x40
je 0x455fed
cmp ax, 0x24
je 0x455fed
cmp ax, 0x2a
je 0x455fed
cmp ax, 0x7e
je 0x455fed
cmp ax, 0x2e
je 0x455fed
cmp ax, 0x3f
jne 0x456005
mov al, byte [esi]
inc esi
inc esi
test al, al
mov byte [ebp + 0x6f], al
mov dword [ebp + 0x78], esi
je 0x456005
movzx ecx, word [esi]
movsx eax, al
cmp eax, ecx
je 0x45600b
cmp word [esi], 0x24
jne 0x456015
mov al, byte [esi]
inc esi
inc esi
mov byte [ebp + 0x53], al
mov dword [ebp + 0x78], esi
cmp byte [ebp + 0x6f], 0x41
jl 0x456025
cmp byte [ebp + 0x6f], 0x5a
jg 0x456025
or byte [ebp + 0x6f], 0x20
lea eax, [ebp + 0x78]
push eax
call fcn.004378b6
mov edi, dword [ebp + 0x78]
mov dword [esp], 0x4acc68
push edi
mov dword [ebp + 0x1c], edi
call dword [sym.imp.SHLWAPI.dll_StrStrW]
mov esi, eax
cmp esi, ebx
je 0x45604b
lea edi, [esi + 4]
mov edx, edi
mov dword [ebp + 0x40], edx
cmp word [edi], bx
je 0x4560de
mov ax, word [edx]
cmp ax, 0x2c
je 0x456095
cmp ax, 0x3d
je 0x4560de
cmp ax, 0x21
jne 0x456089
lea eax, [edx + 2]
mov dword [ebp + 0x24], eax
lea eax, [ebp + 0x24]
push eax
call fcn.004378b6
mov eax, dword [ebp + 0x24]
cmp word [eax], bx
pop ecx
je 0x4560de
lea edx, [eax - 2]
inc edx
inc edx
mov dword [ebp + 0x40], edx
cmp word [edx], bx
jne 0x456059
jmp 0x4560de
add edx, 2
push 0x3d
push edx
call dword [sym.imp.SHLWAPI.dll_StrChrW]
cmp eax, ebx
je 0x4560a9
mov edx, eax
jmp 0x4560d6
mov eax, dword [ebp + 0x40]
add eax, 2
push 0x21
push eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov edx, eax
cmp edx, ebx
je 0x4560db
lea eax, [edx + 2]
mov dword [ebp + 0x24], eax
lea eax, [ebp + 0x24]
push eax
call fcn.004378b6
mov eax, dword [ebp + 0x24]
cmp word [eax], bx
pop ecx
jne 0x4560db
mov dword [ebp + 0x40], edx
jmp 0x4560de
mov edx, dword [ebp + 0x40]
mov ax, word [edx]
cmp ax, 0x2c
je 0x4560f3
cmp ax, 0x3d
je 0x4560f3
cmp ax, 0x21
jne 0x456107
mov al, byte [edx]
mov word [edx], bx
add dword [ebp + 0x40], 2
test al, al
mov byte [ebp + 0x33], al
jne 0x45618d
inc byte [ebp + 0x32]
cmp byte [ebp + 0x32], 0
jg 0x456183
mov ecx, dword [ebp + 0x18]
push 1
push ebx
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
call fcn.0044c04c
mov eax, dword [ebp - 8]
lea ecx, [ebp]
mov dword [ebp + 0x78], eax
call fcn.00437884
lea ecx, [ebp + 4]
call fcn.00437884
lea ecx, [ebp + 0x14]
call fcn.00437884
lea ecx, [ebp - 0x14]
call fcn.00437884
lea ecx, [ebp + 0x10]
call fcn.00437884
lea eax, [ebp + 0x78]
push eax
call fcn.004378b6
push 0xa
lea eax, [ebp + 0x78]
push eax
push str.___initram
call fcn.0043f0e5
add esp, 0x10
test al, al
je 0x455d25
push 3
call fcn.00410d11
pop ecx
xor esi, esi
jmp 0x457189
mov esi, 0x80070057
jmp 0x457161
cmp esi, ebx
mov dword [ebp - 0xc], ebx
jne 0x4561a6
push 0x5c
push ebx
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_StrRChrW]
call edi
mov esi, eax
cmp esi, ebx
je 0x4561fe
mov ecx, dword [ebp + 0x18]
push 1
push ebx
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x78]
mov word [esi], bx
call fcn.0044c04c
mov eax, dword [ebp + 0x10]
push 0x5c
push eax
mov dword [ebp + 0x1c], eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
cmp eax, ebx
jne 0x4561d8
mov esi, 0x80070057
jmp 0x457159
mov ecx, dword [ebp + 0x18]
mov word [eax], bx
inc eax
inc eax
push 1
mov dword [ebp + 0x68], eax
push ebx
lea eax, [ebp - 0xc]
push eax
add esi, 2
push esi
call fcn.0044c04c
mov eax, dword [ebp - 0xc]
mov dword [ebp + 0x54], eax
jmp 0x456281
push 1
push 0x2c
lea eax, [ebp + 0x1c]
push eax
lea ecx, [ebp - 0x24]
call fcn.0044e4ae
push ebx
lea ecx, [ebp + 0x10]
push ecx
push eax
call fcn.0043fd51
mov eax, dword [ebp + 0x10]
add esp, 0xc
push 0x5c
push eax
mov dword [ebp + 0x1c], eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov esi, eax
cmp esi, ebx
je 0x4561ce
mov word [esi], bx
inc esi
inc esi
push 0x4acc68
push esi
mov dword [ebp + 0x68], esi
call dword [sym.imp.SHLWAPI.dll_StrStrW]
cmp byte [ebp + 0x6e], 0
mov dword [ebp + 0x54], eax
je 0x45625f
cmp eax, ebx
jne 0x456274
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esi + eax*2]
mov dword [ebp + 0x54], eax
cmp eax, ebx
jne 0x456274
push 0x5c
push ebx
push esi
call edi
cmp eax, ebx
mov dword [ebp + 0x54], eax
je 0x4561ce
cmp word [eax], bx
je 0x456281
mov word [eax], bx
inc eax
inc eax
mov dword [ebp + 0x54], eax
cmp word [eax], 0x5c
jne 0x45628c
inc eax
inc eax
mov dword [ebp + 0x54], eax
cmp byte [ebp + 0x23], 0
mov dword [ebp + 0x24], ebx
je 0x4562b0
lea eax, [ebp + 0x24]
push eax
lea eax, [ebp + 0x40]
push eax
push dword [ebp + 0x18]
call fcn.0044afdb
mov eax, dword [ebp + 0x24]
add esp, 0xc
mov dword [ebp + 0x40], eax
jmp 0x4562b3
mov eax, dword [ebp + 0x40]
cmp byte [ebp + 0x33], 0x2c
jne 0x456344
push 1
push 0x2c
lea eax, [ebp + 0x40]
push eax
lea ecx, [ebp - 0x24]
call fcn.0044e4ae
push ebx
lea ecx, [ebp + 0x14]
push ecx
push eax
call fcn.0043fd51
mov ecx, dword [ebp + 0x18]
add esp, 0xc
push ebx
lea eax, [ebp + 0x14]
push eax
call fcn.00402db0
cmp byte [ebp + 0x6f], 0x2e
jne 0x456326
mov eax, dword [ebp + 0x40]
cmp word [eax], 0x2c
jne 0x456326
add dword [ebp + 0x40], 2
push 1
push 0x2c
lea eax, [ebp + 0x40]
push eax
lea ecx, [ebp - 0x24]
call fcn.0044e4ae
push ebx
lea ecx, [ebp]
push ecx
push eax
call fcn.0043fd51
mov ecx, dword [ebp + 0x18]
add esp, 0xc
push ebx
lea eax, [ebp]
push eax
call fcn.00402db0
mov eax, dword [ebp + 0x14]
cmp word [eax], bx
jne 0x45643d
push str.RegDat
lea ecx, [ebp + 0x14]
call fcn.004457ae
jmp 0x45643d
cmp byte [ebp + 0x33], 0x21
je 0x45643d
cmp word [eax], bx
jne 0x456377
cmp byte [ebp + 0x6f], 0x24
je 0x456396
cmp byte [ebp + 0x6f], 0x2a
je 0x456377
cmp byte [ebp + 0x6f], 0x7e
je 0x456377
cmp byte [ebp + 0x46], 0
je 0x45643d
mov dword [ebp + 0x60], eax
jmp 0x45643d
cmp byte [ebp + 0x6f], 0x24
je 0x456396
cmp byte [ebp + 0x6f], 0x2a
je 0x456396
cmp byte [ebp + 0x6f], 0x7e
je 0x456396
lea eax, [ebp + 0x40]
push eax
call fcn.004378b6
mov eax, dword [ebp + 0x40]
pop ecx
push eax
lea ecx, [ebp + 0x2c]
call fcn.00445746
mov edx, dword [ebp + 0x2c]
lea eax, [ebp + 0x78]
push eax
mov dword [ebp + 0x78], edx
call fcn.004378b6
cmp byte [ebp + 0x7c], 0
pop ecx
je 0x4563c0
push edx
lea ecx, [ebp + 4]
call fcn.004457ae
jmp 0x4563d0
mov ecx, dword [ebp + 0x18]
push 1
push ebx
lea eax, [ebp + 4]
push eax
push edx
call fcn.0044b25d
mov eax, dword [ebp + 4]
mov dword [ebp + 0x60], eax
mov dword [ebp + 0x7c], eax
lea eax, [ebp + 0x7c]
push eax
call fcn.004378b6
cmp byte [ebp + 0x6f], 0
pop ecx
jne 0x45641b
push dword [ebp + 0x78]
push 0x4acc50
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x456404
mov dword [ebp + 0x60], 0x4a39d4
jmp 0x456435
mov ecx, dword [ebp + 0x7c]
mov ax, word [ecx]
cmp ax, 0x23
je 0x456416
cmp ax, 0x40
jne 0x456435
mov dword [ebp + 0x60], ecx
jmp 0x456435
cmp byte [ebp + 0x6f], 0x23
je 0x456427
cmp byte [ebp + 0x6f], 0x40
jne 0x456435
mov eax, dword [ebp + 0x7c]
cmp word [eax], bx
mov dword [ebp + 0x60], eax
jne 0x456435
mov dword [ebp + 0x60], ebx
lea ecx, [ebp + 0x2c]
call fcn.00437884
mov edi, dword [ebp + 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str.HKLM
push edi
call esi
test eax, eax
je 0x4564f4
push str.HKEY_LOCAL_MACHINE
push edi
call esi
test eax, eax
je 0x4564f4
push str.HKCU
push edi
call esi
test eax, eax
je 0x4564eb
push str.HKEY_CURRENT_USER
push edi
call esi
test eax, eax
je 0x4564eb
push str.HKCR
push edi
call esi
test eax, eax
je 0x4564e2
push str.HKEY_CLASSES_ROOT
push edi
call esi
test eax, eax
je 0x4564e2
push 0x4acbb4
push edi
call esi
test eax, eax
je 0x4564d9
push str.HKEY_USERS
push edi
call esi
test eax, eax
je 0x4564d9
push str.HKCC
push edi
call esi
test eax, eax
je 0x4564d0
push str.HKEY_CURRENT_CONFIG
push edi
call esi
test eax, eax
je 0x4564d0
mov esi, 0x80070057
jmp 0x457151
mov dword [ebp + 0x78], 0x80000005
jmp 0x4564fb
mov dword [ebp + 0x78], 0x80000003
jmp 0x4564fb
mov dword [ebp + 0x78], 0x80000000
jmp 0x4564fb
mov dword [ebp + 0x78], 0x80000001
jmp 0x4564fb
mov dword [ebp + 0x78], 0x80000002
mov eax, dword [ebp + 0x14]
cmp word [eax], bx
je 0x456c0b
cmp byte [ebp + 0x6f], 0x2e
je 0x456516
cmp byte [ebp + 0x6f], 0x3f
mov dword [ebp + 0x3c], ebx
jne 0x456523
cmp byte [ebp + 0x6f], 0x3f
mov dword [ebp + 0x3c], 1
je 0x456532
cmp dword [ebp + 0x3c], ebx
je 0x45652d
cmp word [eax], bx
je 0x456532
mov dword [ebp + 0x4c], ebx
jmp 0x456539
mov dword [ebp + 0x4c], 1
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x64
lea ecx, [ebp + 0x48]
mov dword [ebp + 0xc], ebx
call fcn.0043d3c3
lea ecx, [ebp + 0x58]
call fcn.0043d3a5
cmp byte [ebp + 0x6f], 0x2e
lea eax, [ebp + 0x58]
je 0x456561
lea eax, [ebp + 0x48]
push 0x1000
lea ecx, [ebp + 0x60]
mov dword [ebp + 0x28], eax
call fcn.0043d29b
cmp byte [ebp + 0x6e], 0
lea eax, [ebp + 0x7c]
mov dword [ebp + 0x1c], 0xfff
mov dword [ebp + 0x7c], ebx
mov dword [ebp - 4], ebx
push eax
je 0x456701
push 9
push ebx
push dword [ebp + 0x68]
mov dword [ebp + 0x3c], ebx
push dword [ebp + 0x78]
mov dword [ebp + 0x54], ebx
mov dword [ebp + 0x4c], ebx
mov dword [ebp + 0x2c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp + 0x7c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push ebx
push ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp + 0x54]
push eax
push ebx
push ebx
push ebx
push dword [ebp + 0x7c]
call esi
push ebx
push ebx
push ebx
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 0x2c]
push eax
push ebx
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp + 0x54]
push eax
push ebx
push ebx
push ebx
push dword [ebp + 0x7c]
call esi
mov dword [ebp + 0x78], eax
mov eax, dword [ebp - 0x18]
cmp dword [ebp + 0x4c], eax
jae 0x4565f3
mov dword [ebp + 0x4c], eax
mov eax, dword [ebp + 0x4c]
lea eax, [eax*4 + 0x20]
mov dword [ebp - 0x10], eax
shr eax, 1
add eax, 8
push eax
lea ecx, [ebp + 0x38]
call fcn.0043d3c3
mov esi, dword [ebp + 0x38]
mov word [esi], 0xd
mov word [esi + 2], 0xa
lea ebx, [esi + 4]
mov word [ebx], 0x76
lea edi, [esi + 8]
mov word [esi + 6], 0x20
and word [edi], 0
cmp byte [ebp + 0x6e], 3
mov dword [ebp + 0x68], ebx
je 0x45663c
mov edi, ebx
cmp dword [ebp + 0x78], 0
jne 0x4566e5
test byte [ebp + 0x6e], 1
je 0x456693
and dword [ebp + 0x78], 0
cmp dword [ebp + 0x2c], 0
jle 0x456693
mov eax, dword [ebp - 0x10]
mov dword [ebp + 0x3c], eax
xor eax, eax
push eax
push eax
push eax
push eax
mov word [edi], ax
lea eax, [ebp + 0x3c]
push eax
push edi
push dword [ebp + 0x78]
push dword [ebp + 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x456688
push dword [ebp + 0x68]
lea ecx, [ebp + 0x48]
call fcn.0043d411
mov dword [ebp + 0x68], esi
inc dword [ebp + 0x78]
mov eax, dword [ebp + 0x78]
cmp eax, dword [ebp + 0x2c]
jl 0x456656
test byte [ebp + 0x6e], 2
mov word [ebx], 0x6b
je 0x4566e5
and dword [ebp + 0x78], 0
cmp dword [ebp + 0x54], 0
jle 0x4566e5
xor ebx, ebx
mov eax, dword [ebp - 0x10]
push ebx
push ebx
push ebx
push ebx
mov dword [ebp + 0x3c], eax
lea eax, [ebp + 0x3c]
push eax
push edi
push dword [ebp + 0x78]
mov word [edi], bx
push dword [ebp + 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x4566da
push dword [ebp + 0x68]
lea ecx, [ebp + 0x48]
call fcn.0043d411
mov dword [ebp + 0x68], esi
inc dword [ebp + 0x78]
mov eax, dword [ebp + 0x78]
cmp eax, dword [ebp + 0x54]
jl 0x4566aa
cmp dword [ebp + 0x7c], 0
je 0x4566f4
push dword [ebp + 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 0x38]
call fcn.00437884
jmp 0x456bb8
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp + 0x60]
push eax
push dword [ebp + 0x54]
push dword [ebp + 0x68]
push dword [ebp + 0x78]
call fcn.00441192
mov esi, dword [ebp + 0x7c]
add esp, 0x18
cmp esi, ebx
mov edi, eax
je 0x456784
mov eax, dword [ebp + 0x54]
cmp word [eax], bx
jne 0x456749
cmp esi, 2
jne 0x456749
cmp edi, 0xfffffffe
jne 0x456749
cmp dword [ebp + 0x3c], ebx
je 0x456bba
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x4acb64
jmp 0x45675a
cmp dword [ebp + 0x3c], ebx
mov dword [ebp + 0xc], esi
je 0x456767
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.ERROR
mov ecx, dword [ebp + 0x28]
call fcn.0043d460
jmp 0x456bba
lea ecx, [ebp + 0x60]
call fcn.00437884
lea ecx, [ebp + 0x58]
call fcn.00437884
lea ecx, [ebp + 0x48]
call fcn.00437884
jmp 0x457151
cmp dword [ebp + 0x38], ebx
jl 0x4567a3
jg 0x456790
cmp dword [ebp + 0x34], ebx
jb 0x4567a3
cmp dword [ebp + 0x34], edi
jne 0x45679a
cmp dword [ebp + 0x38], ebx
je 0x4567a3
mov dword [ebp + 0x68], 1
jmp 0x4567a6
mov dword [ebp + 0x68], ebx
cmp edi, 1
mov byte [ebp + 0x7f], 0
mov byte [ebp + 0x7b], 0xff
mov eax, str.REG_SZ
jne 0x4567c2
mov byte [ebp + 0x7f], 0x24
mov byte [ebp + 0x7b], 0
jmp 0x4567e0
cmp edi, 6
jne 0x4567d2
mov eax, str.REG_LINK
mov byte [ebp + 0x7f], 0x5e
jmp 0x4567e0
cmp edi, 0x15
jne 0x456836
mov eax, str.REG_MUI_SZ
mov byte [ebp + 0x7f], 0x75
cmp dword [ebp + 0x3c], ebx
je 0x4567fb
mov ecx, dword [ebp + 0x28]
push 0xffffffffffffffff
push 0xffffffffffffffff
push eax
call fcn.0043d460
cmp dword [ebp + 0x4c], ebx
jne 0x456bba
cmp dword [ebp + 0x68], ebx
jne 0x456b53
cmp dword [ebp + 0x38], ebx
jg 0x456825
jl 0x456810
cmp dword [ebp + 0x34], ebx
jae 0x456825
mov al, byte [ebp + 0x6f]
cmp byte [ebp + 0x7f], al
je 0x456825
cmp al, 0x2e
je 0x456825
cmp byte [ebp + 0x7b], al
jne 0x456b53
mov eax, dword [ebp + 0x48]
mov ecx, dword [ebp + 0x60]
mov dword [ebp + 0x48], ecx
mov dword [ebp + 0x60], eax
jmp 0x456bb8
cmp edi, 0xb
jne 0x45689c
cmp dword [ebp + 0x3c], ebx
je 0x45685a
mov ecx, dword [ebp + 0x28]
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_QWORD
call fcn.0043d460
cmp dword [ebp + 0x4c], ebx
jne 0x456bba
cmp dword [ebp + 0x68], ebx
jne 0x456b53
cmp dword [ebp + 0x38], ebx
jg 0x45687f
jl 0x45686f
cmp dword [ebp + 0x34], ebx
jae 0x45687f
cmp byte [ebp + 0x6f], 0x2b
je 0x45687f
cmp byte [ebp + 0x6f], 0x2e
jne 0x456b53
mov eax, dword [ebp + 0x60]
push str.0x_I64x
push dword [eax + 4]
push dword [eax]
push dword [ebp + 0x48]
call fcn.0048425e
add esp, 0x10
jmp 0x456bb8
cmp edi, 4
mov esi, dword [ebp + 0x60]
jne 0x4568e9
cmp dword [ebp + 0x3c], ebx
je 0x4568c3
mov ecx, dword [ebp + 0x28]
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_DWORD
call fcn.0043d460
cmp dword [ebp + 0x4c], ebx
jne 0x456bba
cmp dword [ebp + 0x68], ebx
jne 0x456b53
cmp dword [ebp + 0x38], ebx
jg 0x456948
jl 0x4568d8
cmp dword [ebp + 0x34], ebx
jae 0x456948
cmp byte [ebp + 0x6f], 0x23
je 0x456948
cmp byte [ebp + 0x6f], 0x2e
je 0x456948
jmp 0x456b53
cmp edi, 5
jne 0x456960
cmp dword [ebp + 0x3c], ebx
je 0x45690d
mov ecx, dword [ebp + 0x28]
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_DWORD_BIG_ENDIAN
call fcn.0043d460
cmp dword [ebp + 0x4c], ebx
jne 0x456bba
cmp dword [ebp + 0x68], ebx
jne 0x456b53
cmp dword [ebp + 0x38], ebx
jg 0x456932
jl 0x456922
cmp dword [ebp + 0x34], ebx
jae 0x456932
cmp byte [ebp + 0x6f], 0x62
je 0x456932
cmp byte [ebp + 0x6f], 0x2e
jne 0x456b53
mov cl, byte [esi + 3]
mov al, byte [esi]
mov byte [esi], cl
mov byte [esi + 3], al
mov cl, byte [esi + 2]
mov al, byte [esi + 1]
mov byte [esi + 1], cl
mov byte [esi + 2], al
push dword [esi]
push str.0x_x
push dword [ebp + 0x48]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x456bb8
cmp edi, 2
jne 0x4569ce
cmp dword [ebp + 0x3c], ebx
je 0x456984
mov ecx, dword [ebp + 0x28]
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_EXPAND_SZ
call fcn.0043d460
cmp dword [ebp + 0x4c], ebx
jne 0x456bba
cmp dword [ebp + 0x68], ebx
jne 0x456b53
cmp dword [ebp + 0x38], ebx
jg 0x4569a9
jl 0x456999
cmp dword [ebp + 0x34], ebx
jae 0x4569a9
cmp byte [ebp + 0x6f], 0x7e
je 0x4569a9
cmp byte [ebp + 0x6f], 0x2e
jne 0x456b53
cmp byte [ebp + 0x53], 0
je 0x456825
mov eax, dword [ebp + 0x60]
push 1
push ebx
lea ecx, [ebp + 0x48]
push ecx
mov ecx, dword [ebp + 0x18]
push eax
mov dword [ebp + 0x40], eax
call fcn.0044c04c
jmp 0x456bb8
cmp edi, 7
jne 0x456ab1
cmp dword [ebp + 0x3c], ebx
je 0x4569f6
mov ecx, dword [ebp + 0x28]
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_MULTI_SZ
call fcn.0043d460
cmp dword [ebp + 0x4c], ebx
jne 0x456bba
cmp dword [ebp + 0x68], ebx
jne 0x456b53
cmp dword [ebp + 0x38], ebx
jg 0x456a1b
jl 0x456a0b
cmp dword [ebp + 0x34], ebx
jae 0x456a1b
cmp byte [ebp + 0x6f], 0x2a
je 0x456a1b
cmp byte [ebp + 0x6f], 0x2e
jne 0x456b53
mov esi, dword [ebp + 0x1c]
shr esi, 1
lea eax, [esi*4 + 6]
push eax
lea ecx, [ebp + 0x48]
call fcn.0043d3ea
mov ecx, dword [ebp + 0x60]
mov eax, dword [ebp + 0x48]
lea esi, [ecx + esi*2]
jmp 0x456aa5
cmp byte [ebp + 0x53], 0x2a
jne 0x456a6c
cmp word [ecx], 0x5c
jne 0x456a6c
lea edx, [ecx + 2]
mov di, word [edx]
cmp di, 0x30
je 0x456a5e
cmp di, 0x5c
je 0x456a5e
cmp di, bx
jne 0x456a6c
mov word [eax], 0x5c
mov ecx, edx
mov dx, word [ecx]
inc eax
inc eax
jmp 0x456a74
mov dx, word [ecx]
cmp dx, bx
je 0x456a7d
mov word [eax], dx
inc eax
inc eax
inc ecx
inc ecx
jmp 0x456aa5
inc ecx
inc ecx
cmp byte [ebp + 0x53], 0x24
jne 0x456a97
cmp ecx, esi
jae 0x456aa9
mov word [eax], 0xd
inc eax
inc eax
mov word [eax], 0xa
jmp 0x456aa3
mov word [eax], 0x5c
inc eax
inc eax
mov word [eax], 0x30
inc eax
inc eax
cmp ecx, esi
jb 0x456a3b
mov word [eax], bx
jmp 0x456bb8
cmp edi, 3
jne 0x456abd
mov eax, str.REG_BINARY
jmp 0x456aea
cmp edi, ebx
jne 0x456ac8
mov eax, str.REG_NONE
jmp 0x456aea
cmp edi, 8
jne 0x456ad4
mov eax, str.REG_RESOURCE_LIST
jmp 0x456aea
cmp edi, 9
jne 0x456ae0
mov eax, str.REG_FULL_RESOURCE_DESCRIPTOR
jmp 0x456aea
cmp edi, 0xa
jne 0x456b0b
mov eax, str.REG_RESOURCE_REQUIREMENTS_LIST
cmp dword [ebp + 0x3c], ebx
je 0x456b05
mov ecx, dword [ebp + 0x28]
push 0xffffffffffffffff
push 0xffffffffffffffff
push eax
call fcn.0043d460
cmp dword [ebp + 0x4c], ebx
jne 0x456bba
mov byte [ebp + 0x7f], 0x40
jmp 0x456b36
cmp dword [ebp + 0x3c], ebx
je 0x456b36
mov esi, dword [ebp + 0x28]
push 0x32
mov ecx, esi
call fcn.0043d3ea
push edi
push str.0x_lx
push dword [esi]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
cmp dword [ebp + 0x4c], ebx
jne 0x456bba
cmp dword [ebp + 0x38], ebx
jg 0x456b4e
jl 0x456b42
cmp dword [ebp + 0x34], ebx
jae 0x456b4e
mov al, byte [ebp + 0x6f]
cmp byte [ebp + 0x7f], al
je 0x456b4e
cmp al, 0x2e
jne 0x456b53
cmp dword [ebp + 0x68], ebx
je 0x456b70
lea ecx, [ebp + 0x60]
call fcn.00437884
lea ecx, [ebp + 0x58]
call fcn.00437884
lea ecx, [ebp + 0x48]
call fcn.00437884
jmp 0x4564c6
mov eax, dword [ebp + 0x1c]
lea eax, [eax + eax*4 + 7]
push eax
lea ecx, [ebp + 0x48]
call fcn.0043d3ea
mov edi, dword [ebp + 0x48]
mov esi, dword [ebp + 0x60]
xor ebx, ebx
mov word [edi], bx
mov word [edi + 2], bx
cmp dword [ebp + 0x1c], ebx
mov dword [ebp - 4], 1
jle 0x456bb8
movzx eax, byte [esi]
push eax
push str._0x_02X
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
inc esi
inc ebx
add edi, 0xa
cmp ebx, dword [ebp + 0x1c]
jl 0x456b9b
xor ebx, ebx
mov eax, dword [ebp + 0x14]
cmp word [eax], bx
je 0x456bd5
mov edx, dword [ebp + 0x48]
mov ecx, dword [ebp - 4]
lea ecx, [edx + ecx*2]
push ecx
mov ecx, dword [ebp + 0x18]
push eax
call fcn.0043cc80
mov eax, dword [ebp]
cmp word [eax], bx
je 0x456beb
mov ecx, dword [ebp + 0x28]
push dword [ecx]
mov ecx, dword [ebp + 0x18]
push eax
call fcn.0043cc80
lea ecx, [ebp + 0x60]
call fcn.00437884
lea ecx, [ebp + 0x58]
call fcn.00437884
lea ecx, [ebp + 0x48]
call fcn.00437884
mov esi, dword [ebp + 0xc]
jmp 0x457151
mov edi, dword [ebp + 0x60]
cmp edi, ebx
je 0x4570c9
cmp byte [ebp + 0x47], 0
mov dword [ebp + 0x7c], ebx
jne 0x456c25
cmp byte [ebp + 0x46], 0
je 0x456c76
push ebx
lea eax, [ebp + 0x2c]
push eax
movzx eax, word [0x4bdbc8]
push ebx
or eax, 0x2001b
push eax
xor eax, eax
cmp byte [ebp + 0x47], al
mov dword [ebp + 0x2c], ebx
setne al
push eax
push ebx
push ebx
push dword [ebp + 0x68]
push dword [ebp + 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp dword [ebp + 0x2c], ebx
mov esi, eax
je 0x456c62
push dword [ebp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp + 0x47], 2
jge 0x4570bc
cmp byte [ebp + 0x46], 0
jne 0x4570bc
mov cl, byte [ebp + 0x6f]
cmp cl, 0x2b
je 0x456c94
test cl, cl
jne 0x456cdf
mov ax, word [edi]
cmp ax, 0x2b
jne 0x456d13
inc edi
inc edi
mov dword [ebp + 0x60], edi
cmp byte [ebp + 0x5f], 0
mov dword [ebp + 8], ebx
mov dword [ebp + 0xc], ebx
lea esi, [ebp + 8]
je 0x457047
movsx eax, byte [ebp + 0x66]
push eax
lea eax, [ebp + 0x7c]
push eax
push edi
call fcn.00441281
mov esi, dword [ebp + 0x7c]
add esp, 0xc
push 8
push esi
push 0xb
cmp byte [ebp + 0x67], 0
push dword [ebp + 0x54]
push dword [ebp + 0x68]
push dword [ebp + 0x78]
je 0x4570b2
call dword [0x4be108]
jmp 0x4570ba
cmp cl, 0x23
je 0x456d22
cmp cl, 0x62
jne 0x456dc3
cmp byte [ebp + 0x5f], 0
mov dword [ebp + 0x58], ebx
lea esi, [ebp + 0x58]
je 0x456d4c
movsx eax, byte [ebp + 0x66]
push eax
lea eax, [ebp + 0x7c]
push eax
push edi
call fcn.00441281
mov esi, dword [ebp + 0x7c]
add esp, 0xc
jmp 0x456db9
cmp ax, 0x23
jne 0x456dea
inc edi
inc edi
mov dword [ebp + 0x60], edi
cmp byte [ebp + 0x5f], 0
mov dword [ebp + 0x4c], ebx
lea esi, [ebp + 0x4c]
je 0x456fec
movsx eax, byte [ebp + 0x66]
push eax
lea eax, [ebp + 0x7c]
push eax
push edi
call fcn.00441281
mov esi, dword [ebp + 0x7c]
add esp, 0xc
jmp 0x45703d
cmp byte [ebp + 0x66], 0
je 0x456d89
xor ecx, ecx
mov cx, word [edi]
mov eax, ecx
call fcn.0043cef1
test al, al
je 0x456f35
cmp cx, 0x30
jne 0x456d7d
mov ax, word [edi + 2]
or ax, 0x20
cmp ax, 0x78
jne 0x456d7d
add edi, 4
push edi
call fcn.0043de38
pop ecx
mov dword [ebp + 0x58], eax
jmp 0x456da1
lea eax, [ebp + 0x58]
push eax
lea eax, [ebp + 0x60]
push eax
call fcn.0044880d
cmp eax, 1
pop ecx
pop ecx
jl 0x4570a2
mov al, byte [ebp + 0x58]
mov cl, byte [ebp + 0x5b]
mov byte [ebp + 0x58], cl
mov cl, byte [ebp + 0x5a]
mov byte [ebp + 0x5b], al
mov al, byte [ebp + 0x59]
mov byte [ebp + 0x59], cl
mov byte [ebp + 0x5a], al
push 4
push esi
push 5
jmp 0x456cc1
cmp cl, 0x2a
je 0x456df9
cmp cl, 0x7e
je 0x456eb0
cmp cl, 0x40
je 0x456f03
cmp cl, 0x6e
jne 0x456f0b
xor esi, esi
jmp 0x456f06
cmp ax, 0x2a
jne 0x456ea8
inc edi
inc edi
mov dword [ebp + 0x60], edi
cmp byte [ebp + 0x5f], 0
push 7
pop esi
mov dword [ebp + 0x38], ebx
jne 0x456f79
mov esi, dword [ebp + 0x60]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
lea eax, [ebx + 0x10]
push eax
lea ecx, [ebp + 0x7c]
xor edi, edi
call fcn.0043d3ea
mov edx, dword [ebp + 0x7c]
lea ecx, [esi + ebx*2]
cmp esi, ecx
mov eax, esi
mov dword [ebp + 0xc], ecx
jae 0x456e6f
and word [edx], 0
cmp byte [ebp + 0x53], 0x2a
jne 0x456f95
cmp word [eax], 0x5c
jne 0x456fc9
lea ecx, [eax + 2]
cmp word [ecx], 0x5c
jne 0x456fc9
mov eax, ecx
mov cx, word [eax]
mov word [edx], cx
inc edx
inc edx
inc eax
inc eax
xor edi, edi
cmp eax, dword [ebp + 0xc]
jb 0x456e32
cmp edi, 1
jge 0x456e76
and word [edx], 0
inc edi
inc edx
inc edx
test ebx, ebx
jle 0x456e96
cmp edi, 2
jge 0x456e96
push 2
pop esi
sub esi, edi
xor eax, eax
mov ecx, esi
shr ecx, 1
mov edi, edx
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
lea edx, [edx + esi*2]
and word [edx], 0
sub edx, dword [ebp + 0x7c]
push edx
push dword [ebp + 0x7c]
push 7
jmp 0x456cc1
cmp ax, 0x7e
jne 0x456efb
inc edi
inc edi
cmp byte [ebp + 0x5f], 0
push 2
pop esi
mov dword [ebp + 0x38], ebx
jne 0x456f79
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
push eax
lea ecx, [ebp + 0x7c]
call fcn.0043d3ea
cmp word [edi], bx
mov esi, dword [ebp + 0x7c]
mov ecx, edi
mov eax, esi
je 0x456f6b
mov dx, word [ecx]
cmp dx, 0x5c
jne 0x456f5b
cmp word [ecx + 2], 0x30
jne 0x456f5b
mov word [eax], bx
inc eax
inc eax
add ecx, 4
jmp 0x456f62
cmp ax, 0x40
jne 0x456f0b
inc edi
inc edi
push 3
pop esi
mov dword [ebp + 0x38], ebx
jmp 0x456f79
cmp dword [ebp + 0x38], ebx
jg 0x456f76
jl 0x456f19
mov esi, dword [ebp + 0x34]
cmp esi, ebx
jae 0x456f79
cmp cl, 0x5e
jne 0x456f22
push 6
jmp 0x456f29
cmp cl, 0x75
jne 0x456f2c
push 0x15
pop esi
jmp 0x456f45
test cl, cl
je 0x456f42
cmp cl, 0x24
je 0x456f42
lea ecx, [ebp + 0x7c]
call fcn.00437884
jmp 0x4564c6
xor esi, esi
inc esi
cmp byte [ebp + 0x5f], 0
mov dword [ebp + 0x38], ebx
jne 0x456f79
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
push eax
push edi
jmp 0x456f8f
mov word [eax], dx
inc eax
inc eax
inc ecx
inc ecx
cmp word [ecx], bx
jne 0x456ee1
sub eax, esi
push eax
push esi
push 2
jmp 0x456cc1
mov esi, dword [ebp + 0x34]
movsx eax, byte [ebp + 0x66]
push eax
lea eax, [ebp + 0x7c]
push eax
push edi
call fcn.00441281
add esp, 0xc
push eax
push dword [ebp + 0x7c]
push esi
jmp 0x456cc1
cmp byte [ebp + 0x53], 0x24
jne 0x456fc9
mov cx, word [eax]
cmp cx, 0xd
jne 0x456fb1
lea esi, [eax + 2]
cmp word [esi], 0xa
jne 0x456fb1
mov eax, esi
jmp 0x456fbb
cmp cx, 0xa
jne 0x456e5c
and word [edx], 0
inc eax
inc eax
inc edx
inc edx
inc edi
jmp 0x456e65
mov cx, word [eax]
cmp cx, 0x5c
jne 0x456e5c
cmp word [eax + 2], 0x30
jne 0x456e5c
and word [edx], 0
inc edx
inc edx
add eax, 4
jmp 0x456fc3
cmp byte [ebp + 0x66], 0
je 0x457029
xor ecx, ecx
mov cx, word [edi]
mov eax, ecx
call fcn.0043cef1
test al, al
je 0x456f35
cmp cx, 0x30
jne 0x45701d
mov ax, word [edi + 2]
or ax, 0x20
cmp ax, 0x78
jne 0x45701d
add edi, 4
push edi
call fcn.0043de38
pop ecx
mov dword [ebp + 0x4c], eax
jmp 0x45703d
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp + 0x60]
push eax
call fcn.0044880d
cmp eax, 1
pop ecx
pop ecx
jl 0x4570a2
push 4
push esi
push 4
jmp 0x456cc1
cmp byte [ebp + 0x66], 0
je 0x45708a
xor ecx, ecx
mov cx, word [edi]
mov eax, ecx
call fcn.0043cef1
test al, al
je 0x456f35
cmp cx, 0x30
jne 0x457078
mov ax, word [edi + 2]
or ax, 0x20
cmp ax, 0x78
jne 0x457078
add edi, 4
push edi
call fcn.0043de38
pop ecx
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], edx
jmp 0x456cbc
lea eax, [ebp + 8]
push eax
lea eax, [ebp + 0x60]
push eax
call fcn.004486b7
cmp eax, 1
pop ecx
pop ecx
jge 0x456cbc
lea ecx, [ebp + 0x7c]
call fcn.00437884
xor esi, esi
inc esi
jmp 0x457151
call fcn.00438973
add esp, 0x18
mov esi, eax
lea ecx, [ebp + 0x7c]
call fcn.00437884
jmp 0x457151
cmp byte [ebp + 0x33], 0x21
jne 0x4570fb
mov eax, dword [ebp + 0x54]
cmp word [eax], bx
jne 0x4570fb
cmp dword [ebp + 0x4c], ebx
je 0x4570ec
push dword [ebp + 0x4c]
push dword [ebp + 0x68]
push dword [ebp + 0x78]
call fcn.00446ce5
jmp 0x457145
push dword [ebp + 0x68]
push dword [ebp + 0x78]
call fcn.00446ae4
pop ecx
pop ecx
jmp 0x457148
cmp dword [ebp + 0x4c], ebx
je 0x457137
push ebx
lea eax, [ebp + 0x7c]
push eax
movzx eax, word [0x4bdbc8]
push ebx
or eax, 0x2001b
push eax
push ebx
push ebx
push ebx
push dword [ebp + 0x68]
mov dword [ebp + 0x7c], ebx
push dword [ebp + 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp dword [ebp + 0x7c], ebx
mov esi, eax
je 0x45714a
push dword [ebp + 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x45714a
push dword [ebp + 0x54]
push dword [ebp + 0x68]
push dword [ebp + 0x78]
call fcn.004389bf
add esp, 0xc
mov esi, eax
cmp esi, 2
jne 0x457151
xor esi, esi
lea ecx, [ebp + 0x24]
call fcn.00437884
lea ecx, [ebp - 0xc]
call fcn.00437884
lea ecx, [ebp]
call fcn.00437884
lea ecx, [ebp + 4]
call fcn.00437884
lea ecx, [ebp + 0x14]
call fcn.00437884
lea ecx, [ebp - 0x14]
call fcn.00437884
lea ecx, [ebp + 0x10]
call fcn.00437884
lea ecx, [ebp - 8]
call fcn.00437884
lea ecx, [ebp - 0x24]
call fcn.00437884
pop edi
mov eax, esi
pop esi
pop ebx
add ebp, 0x70
leave
ret 8