Function at 0x447f90
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47e2f1
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x498
mov eax, dword [0x4b41e0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x44c], esi
mov eax, dword [ebx + 8]
push 0x260
mov dword [ebp - 0x494], eax
lea eax, [ebp - 0x318]
push 0
push eax
call fcn.0046b980
add esi, 0xc0
mov word [ebp - 0x2e0], 0
add esp, 0xc
mov dword [ebp - 0x444], esi
mov dword [ebp - 0x204], 0
mov dword [ebp - 0x208], 0
mov byte [ebp - 0x200], 1
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x318]
push 1
mov dword [ebp - 0x1fc], 0
mov dword [ebp - 0xd8], 0
call fcn.0041ac40
push ecx
push 0
push 0xffffffffffffffff
push 0xcf0000
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x226
push 0x2ee
test esi, esi
lea eax, [ebp - 0x318]
push str.Clear_Disk_Info_Monitoring_Results
cmovne eax, esi
lea ecx, [ebp - 0x318]
push str.ClearDiskInfoResultsDlg
mov dword [ebp - 0x158], eax
call fcn.0040ea60
lea eax, [ebp - 0xac]
mov dword [ebp - 4], 1
push eax
push dword [ebp - 0xe8]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0xa0]
mov ecx, dword [ebp - 0xa4]
sub eax, dword [ebp - 0xa8]
sub ecx, dword [ebp - 0xac]
movsd xmm0, qword [0x4a9c30]
mov dword [ebp - 0x1d4], eax
xor eax, eax
mov dword [ebp - 0x1d8], ecx
mov dword [ebp - 0x1d0], 0
mov dword [ebp - 0x1cc], 0
movsd qword [ebp - 0x1a8], xmm0
mov dword [ebp - 0x1a0], 0x190
mov byte [ebp - 0x19c], 1
mov byte [ebp - 0x15a], 0
nop word [eax + eax]
inc eax
cmp word [eax*2 + str.Arial], 0
jne 0x448110
inc eax
push eax
push str.Arial
lea eax, [ebp - 0x19a]
push 0x20
push eax
call fcn.0046d113
add esp, 0x10
mov dword [ebp - 0x128], 0x404
lea ecx, [ebp - 0x318]
call fcn.0041a8f0
mov edi, dword [sym.imp.USER32.dll_CreateWindowExW]
test al, al
jne 0x448162
mov dword [ebp - 0x480], 0
jmp 0x4481eb
cmp byte [ebp - 0xd0], 0
mov eax, 0x50020101
push 0
push dword [ebp - 0x1fc]
mov ecx, 0x50000101
cmovne ecx, eax
mov eax, dword [ebp - 0x2d8]
inc eax
test byte [ebp - 0x494], 2
push eax
push dword [ebp - 0xe4]
mov eax, str.The_list_below_shows_the_history_of_changes_in_the_monitored_disks_attributes
push 0x12
push 0x2da
push 0xa
push 0xa
push ecx
mov ecx, str.Clear_Disk_Info_detected_some_changes_in_the_selected_attributes._Check_them_out_in_the_list_below.
cmove eax, ecx
push eax
push 0x49f194
push 0
call edi
test eax, eax
jne 0x4481c2
mov dword [ebp - 0x480], eax
jmp 0x4481eb
push eax
push 0xd
lea ecx, [ebp - 0x318]
call fcn.0041a6e0
mov ecx, dword [ebp - 0x2dc]
movaps xmm0, xmmword [0x4a9e60]
mov dword [ebp - 0x480], eax
lea edx, [eax + eax*8]
movups xmmword [ecx + edx*8 + 0x24], xmm0
push 0x10021
push 0x1080000d
push 0x1d1
push 0x2ee
push 0x2d
push 0
push 0x49eb00
push str.Attribute_nameCurrent_valuePrevious_valueAttribute_description
lea ecx, [ebp - 0x318]
mov dword [ebp - 0x128], 0x433
call fcn.00415460
mov esi, dword [ebp - 0x2d8]
cmp eax, 0xffffffff
mov edx, dword [ebp - 0x2dc]
mov ecx, eax
cmove ecx, esi
mov dword [ebp - 0x468], eax
test edx, edx
je 0x44826d
cmp ecx, 1
jl 0x44826d
cmp ecx, esi
jg 0x44826d
lea eax, [ecx + ecx*8]
cmp dword [edx + eax*8 + 0xc], 0
je 0x44826d
cmp dword [edx + eax*8], 0xf
jne 0x44826d
push 0
push 1
push 0x109d
push dword [edx + eax*8 + 4]
mov eax, dword [sym.imp.USER32.dll_SendMessageW]
call eax
mov eax, dword [ebp - 0x44c]
push 0
push 0x10
push 0x10
push ecx
push 0x6a
push dword [eax + 0x398]
call fcn.0041afe0
mov esi, eax
mov dword [ebp - 0x32c], esi
mov dword [ebp - 0x344], 0
test esi, esi
je 0x4482b6
push 0
lea eax, [ebp - 0x344]
push eax
push dword [esi + 4]
call dword [sym.imp.gdiplus.dll_GdipCreateHBITMAPFromBitmap]
test eax, eax
je 0x4482b6
mov dword [esi + 8], eax
push 0x10
push 0x10
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x318]
push dword [ebp - 0x344]
push 1
push dword [ebp - 0x468]
call fcn.004173c0
mov eax, dword [ebp - 0x344]
test eax, eax
je 0x4482e8
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov byte [ebp - 4], 1
test esi, esi
je 0x4482fa
mov eax, dword [esi]
mov ecx, esi
push 1
mov eax, dword [eax]
call eax
mov ecx, dword [ebp - 0x468]
test ecx, ecx
jne 0x44830c
mov eax, dword [ebp - 0xe8]
jmp 0x44833f
mov edx, dword [ebp - 0x2d8]
cmp ecx, 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0x2dc]
cmove eax, edx
test ecx, ecx
je 0x44833d
cmp eax, 1
jl 0x44833d
cmp eax, edx
jg 0x44833d
lea eax, [eax + eax*8]
cmp dword [ecx + eax*8 + 0xc], 0
je 0x44833d
mov eax, dword [ecx + eax*8 + 4]
jmp 0x44833f
xor eax, eax
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0xc8
push 0
push 0x101e
push eax
mov dword [ebp - 0x46c], eax
call esi
push 0x64
push 1
push 0x101e
push dword [ebp - 0x46c]
call esi
push 0x64
push 2
push 0x101e
push dword [ebp - 0x46c]
call esi
push 0x1f4
push 3
push 0x101e
push dword [ebp - 0x46c]
call esi
cmp dword [ebp - 0xe8], 0
mov esi, 0x50030000
mov dword [ebp - 0x128], 0x424
je 0x44842c
lea ecx, [ebp - 0x318]
call fcn.0041a8f0
test al, al
je 0x44842c
cmp byte [ebp - 0xd0], 0
mov ecx, 0x50010000
mov eax, dword [ebp - 0x2d8]
push 0
push dword [ebp - 0x1fc]
cmovne ecx, esi
inc eax
push eax
push dword [ebp - 0xe4]
push 0x1e
push 0x96
push 0x203
push 0x7d
push ecx
push str.OK__close_this
push str.Button
push 0
call edi
test eax, eax
je 0x44842c
push eax
push 3
lea ecx, [ebp - 0x318]
call fcn.0041a6e0
mov ecx, dword [ebp - 0x2dc]
movaps xmm0, xmmword [0x4a9f60]
mov dword [ebp - 0x488], eax
lea edx, [eax + eax*8]
movups xmmword [ecx + edx*8 + 0x24], xmm0
jmp 0x448436
mov dword [ebp - 0x488], 0
cmp dword [ebp - 0xe8], 0
je 0x4484c6
lea ecx, [ebp - 0x318]
call fcn.0041a8f0
test al, al
je 0x4484c6
cmp byte [ebp - 0xd0], 0
mov ecx, 0x50010000
mov eax, dword [ebp - 0x2d8]
push 0
push dword [ebp - 0x1fc]
cmovne ecx, esi
inc eax
push eax
push dword [ebp - 0xe4]
push 0x1e
push 0x96
push 0x203
push 0x12c
push ecx
push str.Open_Clear_Disk_Info
push str.Button
push 0
call edi
test eax, eax
je 0x4484c6
push eax
push 3
lea ecx, [ebp - 0x318]
call fcn.0041a6e0
mov ecx, dword [ebp - 0x2dc]
movaps xmm0, xmmword [0x4a9f70]
mov dword [ebp - 0x498], eax
lea edx, [eax + eax*8]
movups xmmword [ecx + edx*8 + 0x24], xmm0
jmp 0x4484d0
mov dword [ebp - 0x498], 0
cmp dword [ebp - 0xe8], 0
je 0x448565
lea ecx, [ebp - 0x318]
call fcn.0041a8f0
test al, al
je 0x448565
cmp byte [ebp - 0xd0], 0
mov eax, 0x40030000
push 0
push dword [ebp - 0x1fc]
mov ecx, 0x40010000
cmovne ecx, eax
mov eax, dword [ebp - 0x2d8]
inc eax
push eax
push dword [ebp - 0xe4]
push 0x1e
push 0x96
push 0x203
push 0x12c
push ecx
push str.Clear_history
push str.Button
push 0
call edi
test eax, eax
je 0x448565
push eax
push 3
lea ecx, [ebp - 0x318]
call fcn.0041a6e0
mov ecx, dword [ebp - 0x2dc]
movaps xmm0, xmmword [0x4a9f70]
mov dword [ebp - 0x490], eax
lea edx, [eax + eax*8]
movups xmmword [ecx + edx*8 + 0x24], xmm0
jmp 0x44856f
mov dword [ebp - 0x490], 0
cmp dword [ebp - 0xe8], 0
je 0x4485ff
lea ecx, [ebp - 0x318]
call fcn.0041a8f0
test al, al
je 0x4485ff
cmp byte [ebp - 0xd0], 0
mov ecx, 0x50010000
mov eax, dword [ebp - 0x2d8]
push 0
push dword [ebp - 0x1fc]
cmovne ecx, esi
inc eax
push eax
push dword [ebp - 0xe4]
push 0x1e
push 0x96
push 0x203
push 0x1db
push ecx
push str.View_full_history
push str.Button
push 0
call edi
test eax, eax
je 0x4485ff
push eax
push 3
lea ecx, [ebp - 0x318]
call fcn.0041a6e0
mov ecx, dword [ebp - 0x2dc]
movaps xmm0, xmmword [0x4a9f80]
mov dword [ebp - 0x49c], eax
lea edx, [eax + eax*8]
movups xmmword [ecx + edx*8 + 0x24], xmm0
jmp 0x448609
mov dword [ebp - 0x49c], 0
cmp dword [ebp - 0xe8], 0
je 0x4486a0
lea ecx, [ebp - 0x318]
call fcn.0041a8f0
test al, al
je 0x4486a0
cmp byte [ebp - 0xd0], 0
mov eax, 0x40030000
push 0
push dword [ebp - 0x1fc]
mov ecx, 0x40010000
cmovne ecx, eax
mov eax, dword [ebp - 0x2d8]
inc eax
push eax
push dword [ebp - 0xe4]
push 0x1e
push 0x96
push 0x203
push 0x1db
push ecx
push str.View_last_changes
push str.Button
push 0
call edi
test eax, eax
je 0x4486a0
push eax
push 3
lea ecx, [ebp - 0x318]
call fcn.0041a6e0
mov ecx, dword [ebp - 0x2dc]
mov esi, eax
movaps xmm0, xmmword [0x4a9f80]
mov dword [ebp - 0x47c], esi
lea edx, [esi + esi*8]
movups xmmword [ecx + edx*8 + 0x24], xmm0
jmp 0x4486aa
mov dword [ebp - 0x47c], 0
mov esi, dword [ebp - 0x44c]
mov ecx, esi
push 0
call fcn.0042c270
mov eax, dword [esi + 0x84]
lea ecx, [esi + 0x138]
mov dword [ebp - 0x4a0], ecx
test eax, eax
jne 0x4486d7
mov eax, dword [esi + 0x368]
jmp 0x44870b
cmp eax, 0xffffffff
jne 0x4486e2
mov eax, dword [esi + 0x178]
mov ecx, dword [esi + 0x174]
test ecx, ecx
je 0x448709
cmp eax, 1
jl 0x448709
cmp eax, dword [esi + 0x178]
jg 0x448709
lea eax, [eax + eax*8]
cmp dword [ecx + eax*8 + 0xc], 0
je 0x448709
mov eax, dword [ecx + eax*8 + 4]
jmp 0x44870b
xor eax, eax
xor edx, edx
xorps xmm0, xmm0
movq qword [ebp - 0x20], xmm0
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x4a4], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edx
mov byte [ebp - 0x18], 1
movq qword [ebp - 0x58], xmm0
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x58], edx
mov byte [ebp - 0x50], 1
movq qword [ebp - 0x38], xmm0
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x38], edx
mov byte [ebp - 0x30], 1
movq qword [ebp - 0x44], xmm0
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x44], edx
mov byte [ebp - 0x3c], 1
movq qword [ebp - 0x2c], xmm0
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], edx
mov byte [ebp - 0x24], 1
xor edi, edi
movq qword [ebp - 0x478], xmm0
mov dword [ebp - 0x470], edx
mov dword [ebp - 0x474], edx
mov dword [ebp - 0x450], edi
mov dword [ebp - 0x478], edi
mov byte [ebp - 0x470], 1
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x4c], edi
mov ecx, dword [ebp - 0x494]
lea edi, [edx + 2]
and ecx, 2
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x460], ecx
jne 0x44981e
xor esi, esi
push esi
push esi
push 0x1004
push eax
mov eax, dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x330], esi
call eax
mov dword [ebp - 0x32c], eax
test eax, eax
jle 0x449816
mov eax, dword [ebp - 0x44c]
mov ecx, dword [ebp - 0x4a0]
push 3
push esi
push dword [eax + 0x84]
call fcn.00419c90
mov esi, eax
test esi, esi
jne 0x448817
push eax
lea ecx, [ebp - 0x20]
call fcn.00401a20
mov esi, dword [ebp - 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x44883b
mov eax, dword [ebp - 0x1c]
jmp 0x448835
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x448827
push eax
call fcn.00469e73
add esp, 4
xor eax, eax
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], eax
mov ecx, esi
mov byte [ebp - 0x18], 1
cmp word [ecx], 0
jne 0x4488a9
test esi, esi
je 0x448848
push esi
call fcn.00469e73
add esp, 4
mov byte [ebp - 0x18], 0
xor eax, eax
nop
inc eax
cmp word [eax*2 + 0x49f8e0], 0
jne 0x448850
mov dword [ebp - 0x1c], eax
xor ecx, ecx
inc eax
mul edi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0046a22b
mov edx, eax
add esp, 4
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov dword [ebp - 0x20], edx
test eax, eax
jle 0x448899
mov ax, word [ecx*2 + 0x49f8e0]
mov word [edx + ecx*2], ax
inc ecx
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
cmp ecx, eax
jl 0x448882
xor ecx, ecx
mov word [edx + eax*2], cx
mov eax, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
mov byte [ebp - 0x18], 1
test esi, esi
je 0x4488e9
test eax, eax
jne 0x4488c3
cmp word [esi], ax
je 0x4488be
inc eax
cmp word [esi + eax*2], 0
jne 0x4488b6
mov dword [ebp - 0x1c], eax
test eax, eax
jle 0x4488e9
push esi
mov byte [ebp - 0x18], 1
call fcn.0046dfd0
mov esi, eax
mov dword [ebp - 0x464], eax
add esp, 4
test esi, esi
jns 0x4488f5
mov eax, dword [ebp - 0x44c]
jmp 0x4497f5
xor esi, esi
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x464], esi
mov eax, dword [ebp - 0x44c]
mov ecx, dword [eax + 0x99c]
cmp esi, ecx
jge 0x4497f5
lea edx, [esi + 1]
jb 0x448916
mov ecx, edx
mov dword [eax + 0x99c], edx
mov eax, dword [eax + 0x9a4]
lea edi, [esi + esi*2]
shl edi, 5
cmp byte [edi + eax], 0
mov eax, dword [ebp - 0x44c]
je 0x4497f0
cmp ecx, esi
ja 0x44893c
mov dword [eax + 0x99c], edx
mov esi, dword [eax + 0x9a4]
mov eax, dword [esi + edi + 0x54]
test eax, eax
je 0x4497ea
cmp word [eax], 0
je 0x4497ea
mov byte [esi + edi + 0x5c], 1
xor ecx, ecx
mov esi, eax
mov dword [ebp - 0x484], eax
mov dword [ebp - 0x478], 0
mov edi, str.Monitoring_
mov byte [ebp - 0x470], 0
mov dword [ebp - 0x474], 0
nop word [eax + eax]
lea ecx, [ecx + 1]
cmp word [ecx*2 + str.HKCUSoftwareClearDiskInfo], 0
jne 0x448990
xor eax, eax
lea eax, [eax + 1]
cmp word [eax*2 + str.Monitoring_], 0
jne 0x4489a0
mov dword [ebp - 0x454], esi
lea edx, [eax + ecx]
test esi, esi
jne 0x4489cf
mov eax, dword [ebp - 0x450]
mov dword [ebp - 0x48c], eax
mov dword [ebp - 0x484], esi
jmp 0x448a00
mov ecx, dword [ebp - 0x450]
xor eax, eax
mov dword [ebp - 0x48c], ecx
cmp word [esi], ax
je 0x4489fe
mov dword [ebp - 0x48c], ecx
mov ecx, esi
mov dword [ebp - 0x454], esi
mov dword [ebp - 0x484], esi
inc eax
cmp word [ecx + eax*2], 0
jne 0x4489f6
add edx, eax
mov dword [ebp - 0x448], edx
lea eax, [edx + 1]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0046a22b
mov esi, str.HKCUSoftwareClearDiskInfo
mov dword [ebp - 0x450], eax
add esp, 4
mov ecx, eax
mov edx, 0x48
sub esi, eax
mov word [ecx], dx
add ecx, 2
movzx eax, word [esi + ecx]
mov edx, eax
test ax, ax
jne 0x448a36
mov esi, dword [ebp - 0x484]
mov eax, 0x5c
mov word [ecx], ax
lea edi, [edi + 2]
movzx eax, word [edi]
add ecx, 2
test ax, ax
jne 0x448a52
mov eax, dword [ebp - 0x454]
test eax, eax
je 0x448a90
movzx eax, word [eax]
mov edx, eax
test ax, ax
je 0x448a90
mov word [ecx], ax
lea esi, [esi + 2]
movzx eax, word [esi]
add ecx, 2
test ax, ax
jne 0x448a77
nop dword [eax + eax]
mov edi, dword [ebp - 0x450]
xor eax, eax
mov word [ecx], ax
mov eax, dword [ebp - 0x448]
mov dword [ebp - 0x474], eax
mov eax, dword [ebp - 0x48c]
mov dword [ebp - 0x478], edi
test eax, eax
je 0x448ac0
push eax
call fcn.00469e73
add esp, 4
mov eax, dword [ebp - 0x48]
mov byte [ebp - 0x470], 1
test eax, eax
je 0x448adc
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x48], 0
push ecx
mov edx, 0xf003f
mov ecx, edi
call fcn.00405480
mov dword [ebp - 0x48], eax
test eax, eax
je 0x4497ea
lea ecx, [ebp - 0x84]
mov dword [ebp - 0x70], 0
push ecx
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x78], 0
push ecx
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x84], 4
push ecx
push 0
push str.Status
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4497ea
cmp dword [ebp - 0x78], 4
jne 0x4497ea
cmp dword [ebp - 0x70], eax
je 0x4497ea
push dword [ebp - 0x330]
mov edi, dword [ebp - 0x44c]
mov ecx, edi
call fcn.0042ec60
push 1
push dword [ebp - 0x464]
mov esi, eax
mov ecx, edi
push esi
mov dword [ebp - 0x484], esi
call fcn.0042eb60
mov ecx, esi
test esi, esi
jne 0x448b89
mov edi, dword [edi + 0x368]
mov dword [ebp - 0x48c], edi
mov edi, dword [ebp - 0x44c]
jmp 0x448bd1
cmp esi, 0xffffffff
jne 0x448b94
mov ecx, dword [edi + 0x178]
mov eax, dword [edi + 0x174]
test eax, eax
je 0x448bc7
cmp ecx, 1
jl 0x448bc7
cmp ecx, dword [edi + 0x178]
jg 0x448bc7
lea ecx, [ecx + ecx*8]
cmp dword [eax + ecx*8 + 0xc], 0
je 0x448bc7
mov edi, dword [eax + ecx*8 + 4]
mov dword [ebp - 0x48c], edi
mov edi, dword [ebp - 0x44c]
jmp 0x448bd1
mov dword [ebp - 0x48c], 0
push 0
push dword [ebp - 0x330]
lea ecx, [edi + 0x138]
push dword [edi + 0x84]
call fcn.00419c90
mov esi, eax
mov eax, dword [ebp - 0x58]
test esi, esi
jne 0x448c44
test eax, eax
je 0x448c00
push eax
call fcn.00469e73
add esp, 4
push 2
mov byte [ebp - 0x50], 0
mov dword [ebp - 0x54], 0
call fcn.0046a22b
mov edx, eax
add esp, 4
mov eax, dword [ebp - 0x54]
xor ecx, ecx
mov dword [ebp - 0x58], edx
test eax, eax
jle 0x448c36
mov ax, word [ecx + ecx]
mov word [edx + ecx*2], ax
inc ecx
mov eax, dword [ebp - 0x54]
mov edx, dword [ebp - 0x58]
cmp ecx, eax
jl 0x448c23
xor ecx, ecx
mov word [edx + eax*2], cx
mov eax, dword [ebp - 0x54]
mov esi, dword [ebp - 0x58]
jmp 0x448c59
test eax, eax
je 0x448c51
push eax
call fcn.00469e73
add esp, 4
xor eax, eax
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x54], eax
mov edi, dword [ebp - 0x20]
mov byte [ebp - 0x50], 1
mov dword [ebp - 0x448], 0x49eafc
test edi, edi
jne 0x448c8c
push 2
call fcn.0046a22b
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov edi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x54]
mov esi, dword [ebp - 0x58]
mov dword [ebp - 0x1c], ecx
mov byte [ebp - 0x18], 1
mov byte [ebp - 0x50], 0
test eax, eax
jne 0x448cac
test esi, esi
je 0x448ca9
cmp word [esi], ax
je 0x448ca9
inc eax
cmp word [esi + eax*2], 0
jne 0x448ca1
mov dword [ebp - 0x54], eax
xor ecx, ecx
nop
inc ecx
cmp word [ecx*2 + str.__Disk], 0
jne 0x448cb0
add ecx, eax
test edi, edi
je 0x448cda
xor eax, eax
cmp word [edi], ax
je 0x448cd8
nop dword [eax]
inc eax
cmp word [edi + eax*2], 0
jne 0x448cd0
add ecx, eax
xor eax, eax
nop dword [eax]
inc eax
cmp word [eax*2 + 0x49eafc], 0
jne 0x448ce0
add ecx, eax
mov edx, 2
mov dword [ebp - 0x454], ecx
lea eax, [ecx + 1]
xor ecx, ecx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0046a22b
mov edx, dword [ebp - 0x58]
add esp, 4
mov dword [ebp - 0x45c], eax
mov ecx, eax
test edx, edx
je 0x448d41
movzx esi, word [edx]
test si, si
je 0x448d41
mov eax, esi
nop dword [eax]
mov word [ecx], ax
lea edx, [edx + 2]
movzx eax, word [edx]
add ecx, 2
test ax, ax
jne 0x448d30
mov esi, str.__Disk
mov edx, 0x20
sub esi, ecx
nop dword [eax]
mov word [ecx], dx
add ecx, 2
movzx eax, word [esi + ecx]
mov edx, eax
test ax, ax
jne 0x448d50
test edi, edi
je 0x448d81
movzx eax, word [edi]
mov edx, eax
test ax, ax
je 0x448d81
nop
mov word [ecx], ax
lea edi, [edi + 2]
movzx eax, word [edi]
add ecx, 2
test ax, ax
jne 0x448d70
mov eax, 0x29
nop word [eax + eax]
mov word [ecx], ax
lea ecx, [ecx + 2]
mov eax, dword [ebp - 0x448]
add eax, 2
mov dword [ebp - 0x448], eax
movzx eax, word [eax]
test ax, ax
jne 0x448d90
xor eax, eax
mov word [ecx], ax
mov eax, dword [ebp - 0x58]
test eax, eax
je 0x448dc2
push eax
call fcn.00469e73
add esp, 4
mov eax, dword [ebp - 0x45c]
sub esp, 0x10
mov ecx, dword [ebp - 0x454]
mov dword [ebp - 0x54], ecx
lea ecx, [ebp - 0x318]
mov dword [ebp - 0x58], eax
push eax
push dword [ebp - 0x464]
mov byte [ebp - 0x50], 1
push dword [ebp - 0x468]
call fcn.00419870
xor esi, esi
push esi
push esi
push 0x1004
push dword [ebp - 0x48c]
mov dword [ebp - 0x454], esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x45c], eax
test eax, eax
jle 0x4497ea
nop dword [eax]
mov ecx, dword [ebp - 0x4a0]
push 1
push esi
push dword [ebp - 0x484]
call fcn.00419c90
mov esi, eax
mov eax, dword [ebp - 0x38]
test esi, esi
jne 0x448e8e
test eax, eax
je 0x448e4a
push eax
call fcn.00469e73
add esp, 4
push 2
mov byte [ebp - 0x30], 0
mov dword [ebp - 0x34], 0
call fcn.0046a22b
mov edx, eax
add esp, 4
mov eax, dword [ebp - 0x34]
xor ecx, ecx
mov dword [ebp - 0x38], edx
test eax, eax
jle 0x448e83
nop dword [eax]
mov ax, word [ecx + ecx]
mov word [edx + ecx*2], ax
inc ecx
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x38]
cmp ecx, eax
jl 0x448e70
xor ecx, ecx
mov word [edx + eax*2], cx
mov esi, dword [ebp - 0x38]
jmp 0x448ea5
test eax, eax
je 0x448e9b
push eax
call fcn.00469e73
add esp, 4
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], 0
mov byte [ebp - 0x30], 1
cmp esi, str.Temperature
jne 0x448ebd
mov byte [ebp - 0x455], 1
jmp 0x448f3e
test esi, esi
je 0x448f37
mov edi, str.Temperature
movzx eax, word [esi]
mov ecx, eax
test ax, ax
jne 0x448ee1
cmp word [edi], ax
jne 0x448ee6
mov esi, dword [ebp - 0x38]
mov byte [ebp - 0x455], 1
jmp 0x448f3e
cmp ax, word [edi]
je 0x448f2c
xor edx, edx
cmp dx, ax
jne 0x448ef5
mov dword [ebp - 0x448], edx
jmp 0x448f07
push ecx
call fcn.0046e0a0
movzx eax, ax
add esp, 4
mov dword [ebp - 0x448], eax
movzx eax, word [edi]
xor edx, edx
mov ecx, eax
cmp dx, ax
jne 0x448f17
xor eax, eax
jmp 0x448f23
push ecx
call fcn.0046e0a0
add esp, 4
movzx eax, ax
cmp word [ebp - 0x448], ax
jne 0x448f34
add esi, 2
add edi, 2
jmp 0x448ec6
mov esi, dword [ebp - 0x38]
mov byte [ebp - 0x455], 0
test esi, esi
jne 0x448f5a
push 2
call fcn.0046a22b
add esp, 4
mov dword [ebp - 0x38], eax
xor ecx, ecx
mov word [eax], cx
mov esi, dword [ebp - 0x38]
mov dword [ebp - 0x34], ecx
mov eax, esi
mov byte [ebp - 0x30], 1
test eax, eax
mov ecx, 0x49eab8
mov eax, dword [ebp - 0x2c]
cmovne ecx, esi
mov dword [ebp - 0x448], ecx
test eax, eax
je 0x448f86
push eax
call fcn.00469e73
mov ecx, dword [ebp - 0x448]
add esp, 4
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov byte [ebp - 0x24], 1
test eax, eax
je 0x449113
lea edx, [ebp - 0x5c]
mov dword [ebp - 0x6c], 0
push edx
push 0
lea edx, [ebp - 0x6c]
mov dword [ebp - 0x5c], 0
push edx
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x449113
mov eax, dword [ebp - 0x6c]
cmp eax, 1
je 0x448fe3
cmp eax, 2
je 0x448fe3
cmp eax, 7
jne 0x449113
mov esi, dword [ebp - 0x5c]
xor ecx, ecx
mov edi, dword [ebp - 0x2c]
add esi, 4
mov dword [ebp - 0x5c], esi
mov edx, 2
shr esi, 1
mov dword [ebp - 0x28], 0
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0046a22b
xor ecx, ecx
mov dword [ebp - 0x2c], eax
add esp, 4
mov word [eax + esi*2], cx
mov eax, dword [ebp - 0x2c]
mov word [eax], cx
test edi, edi
je 0x449030
push edi
call fcn.00469e73
add esp, 4
mov eax, dword [ebp - 0x2c]
lea ecx, [esi - 1]
test eax, eax
jne 0x449052
push 2
call fcn.0046a22b
add esp, 4
mov dword [ebp - 0x2c], eax
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], ecx
xor edx, edx
mov word [eax + ecx*2], dx
lea ecx, [esi - 2]
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x44907a
push 2
call fcn.0046a22b
add esp, 4
mov dword [ebp - 0x2c], eax
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], ecx
xor edx, edx
mov word [eax + ecx*2], dx
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x44909f
push 2
call fcn.0046a22b
add esp, 4
mov dword [ebp - 0x2c], eax
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x5c]
mov byte [ebp - 0x24], 1
push ecx
push eax
push 0
push 0
push dword [ebp - 0x448]
push dword [ebp - 0x48]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x449113
cmp dword [ebp - 0x6c], 7
jne 0x449120
cmp esi, 3
jbe 0x449120
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
jne 0x4490e9
push 2
call fcn.0046a22b
add esp, 4
mov dword [ebp - 0x2c], eax
xor ecx, ecx
mov word [eax], cx
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x2c]
xor eax, eax
mov byte [ebp - 0x24], 1
add esi, 0xffffffff
je 0x449120
xor edx, edx
cmp dx, word [ecx + eax*2]
jne 0x44910c
cmp word [ecx + eax*2 + 2], dx
je 0x44910c
mov edx, 0xa
mov word [ecx + eax*2], dx
inc eax
cmp eax, esi
jb 0x4490f4
jmp 0x449120
cmp byte [ebp - 0x455], 0
je 0x4497d1
mov ecx, dword [ebp - 0x4a0]
push 2
push dword [ebp - 0x454]
push dword [ebp - 0x484]
call fcn.00419c90
mov esi, eax
mov eax, dword [ebp - 0x44]
test esi, esi
jne 0x449190
test eax, eax
je 0x44914f
push eax
call fcn.00469e73
add esp, 4
push 2
mov byte [ebp - 0x3c], 0
mov dword [ebp - 0x40], 0
call fcn.0046a22b
mov edx, eax
add esp, 4
mov eax, dword [ebp - 0x40]
xor ecx, ecx
mov dword [ebp - 0x44], edx
test eax, eax
jle 0x449185
mov ax, word [ecx + ecx]
mov word [edx + ecx*2], ax
inc ecx
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 0x44]
cmp ecx, eax
jl 0x449172
xor ecx, ecx
mov word [edx + eax*2], cx
mov esi, dword [ebp - 0x44]
jmp 0x4491a7
test eax, eax
je 0x44919d
push eax
call fcn.00469e73
add esp, 4
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x40], 0
cmp byte [ebp - 0x455], 0
mov byte [ebp - 0x3c], 1
jne 0x449274
mov edi, dword [ebp - 0x2c]
test edi, edi
jne 0x4491da
push 2
call fcn.0046a22b
add esp, 4
mov dword [ebp - 0x2c], eax
xor ecx, ecx
mov word [eax], cx
mov esi, dword [ebp - 0x44]
mov edi, dword [ebp - 0x2c]
mov dword [ebp - 0x28], ecx
mov byte [ebp - 0x24], 1
cmp esi, edi
je 0x4497d1
test esi, esi
je 0x449260
test edi, edi
je 0x4497d1
movzx eax, word [esi]
mov ecx, eax
test ax, ax
jne 0x449207
cmp word [edi], ax
je 0x4497d1
jmp 0x44920c
cmp ax, word [edi]
je 0x449252
xor edx, edx
cmp dx, ax
jne 0x44921b
mov dword [ebp - 0x448], edx
jmp 0x44922d
push ecx
call fcn.0046e0a0
movzx eax, ax
add esp, 4
mov dword [ebp - 0x448], eax
movzx eax, word [edi]
xor edx, edx
mov ecx, eax
cmp dx, ax
jne 0x44923d
xor eax, eax
jmp 0x449249
push ecx
call fcn.0046e0a0
add esp, 4
movzx eax, ax
cmp word [ebp - 0x448], ax
jne 0x44925a
add esi, 2
add edi, 2
jmp 0x4491f2
mov esi, dword [ebp - 0x44]
mov edi, dword [ebp - 0x2c]
test edi, edi
je 0x4497d1
cmp word [edi], 0
je 0x4497d1
jmp 0x4492bf
test esi, esi
je 0x4497cd
cmp dword [ebp - 0x40], 0
jne 0x44929d
xor eax, eax
cmp word [esi], ax
je 0x449298
nop dword [eax]
inc eax
cmp word [esi + eax*2], 0
jne 0x449290
mov dword [ebp - 0x40], eax
test eax, eax
jle 0x4497cd
push esi
mov byte [ebp - 0x3c], 1
call fcn.0046dfd0
add esp, 4
cmp eax, 0x37
jl 0x4497d1
mov esi, dword [ebp - 0x44]
mov edi, dword [ebp - 0x2c]
cmp dword [ebp - 0x70], 1
jbe 0x449569
cmp esi, str.True
je 0x449569
test esi, esi
je 0x44934e
mov edi, str.True
nop
movzx eax, word [esi]
mov ecx, eax
test ax, ax
jne 0x4492f5
cmp word [edi], ax
je 0x449569
jmp 0x4492fa
cmp ax, word [edi]
je 0x449340
xor edx, edx
cmp dx, ax
jne 0x449309
mov dword [ebp - 0x448], edx
jmp 0x44931b
push ecx
call fcn.0046e0a0
movzx eax, ax
add esp, 4
mov dword [ebp - 0x448], eax
movzx eax, word [edi]
xor edx, edx
mov ecx, eax
cmp dx, ax
jne 0x44932b
xor eax, eax
jmp 0x449337
push ecx
call fcn.0046e0a0
add esp, 4
movzx eax, ax
cmp word [ebp - 0x448], ax
jne 0x449348
add esi, 2
add edi, 2
jmp 0x4492e0
mov esi, dword [ebp - 0x44]
mov edi, dword [ebp - 0x2c]
cmp esi, str.False
je 0x449569
test esi, esi
je 0x4493d1
mov edi, str.False
movzx eax, word [esi]
mov ecx, eax
test ax, ax
jne 0x449378
cmp word [edi], ax
je 0x449569
jmp 0x44937d
cmp ax, word [edi]
je 0x4493c3
xor edx, edx
cmp dx, ax
jne 0x44938c
mov dword [ebp - 0x448], edx
jmp 0x44939e
push ecx
call fcn.0046e0a0
movzx eax, ax
add esp, 4
mov dword [ebp - 0x448], eax
movzx eax, word [edi]
xor edx, edx
mov ecx, eax
cmp dx, ax
jne 0x4493ae
xor eax, eax
jmp 0x4493ba
push ecx
call fcn.0046e0a0
add esp, 4
movzx eax, ax
cmp word [ebp - 0x448], ax
jne 0x4493cb
add esi, 2
add edi, 2
jmp 0x449363
mov esi, dword [ebp - 0x44]
mov edi, dword [ebp - 0x2c]
cmp esi, 0x49f380
je 0x449569
test esi, esi
je 0x449454
mov edi, 0x49f380
movzx eax, word [esi]
mov ecx, eax
test ax, ax
jne 0x4493fb
cmp word [edi], ax
je 0x449569
jmp 0x449400
cmp ax, word [edi]
je 0x449446
xor edx, edx
cmp dx, ax
jne 0x44940f
mov dword [ebp - 0x448], edx
jmp 0x449421
push ecx
call fcn.0046e0a0
movzx eax, ax
add esp, 4
mov dword [ebp - 0x448], eax
movzx eax, word [edi]
xor edx, edx
mov ecx, eax
cmp dx, ax
jne 0x449431
xor eax, eax
jmp 0x44943d
push ecx
call fcn.0046e0a0
add esp, 4
movzx eax, ax
cmp word [ebp - 0x448], ax
jne 0x44944e
add esi, 2
add edi, 2
jmp 0x4493e6
mov esi, dword [ebp - 0x44]
mov edi, dword [ebp - 0x2c]
cmp esi, 0x49f388
je 0x449569
test esi, esi
je 0x449513
mov edi, 0x49f388
nop dword [eax]
movzx eax, word [esi]
mov ecx, eax
test ax, ax
jne 0x449485
cmp word [edi], ax
je 0x449569
jmp 0x44948a
cmp ax, word [edi]
je 0x4494d0
xor edx, edx
cmp dx, ax
jne 0x449499
mov dword [ebp - 0x448], edx
jmp 0x4494ab
push ecx
call fcn.0046e0a0
movzx eax, ax
add esp, 4
mov dword [ebp - 0x448], eax
movzx eax, word [edi]
xor edx, edx
mov ecx, eax
cmp dx, ax
jne 0x4494bb
xor eax, eax
jmp 0x4494c7
push ecx
call fcn.0046e0a0
add esp, 4
movzx eax, ax
cmp word [ebp - 0x448], ax
jne 0x4494d8
add esi, 2
add edi, 2
jmp 0x449470
mov esi, dword [ebp - 0x44]
mov edi, dword [ebp - 0x2c]
test esi, esi
je 0x449513
cmp dword [ebp - 0x40], 0
jne 0x4494fd
xor eax, eax
cmp word [esi], ax
je 0x4494f8
nop
inc eax
cmp word [esi + eax*2], 0
jne 0x4494f0
mov dword [ebp - 0x40], eax
test eax, eax
jle 0x449513
push esi
mov byte [ebp - 0x3c], 1
call fcn.0046dfd0
mov edi, dword [ebp - 0x2c]
add esp, 4
mov esi, eax
jmp 0x449519
mov byte [ebp - 0x3c], 0
xor esi, esi
test edi, edi
je 0x449550
cmp dword [ebp - 0x28], 0
jne 0x44953d
xor eax, eax
cmp word [edi], ax
je 0x449538
nop word [eax + eax]
inc eax
cmp word [edi + eax*2], 0
jne 0x449530
mov dword [ebp - 0x28], eax
test eax, eax
jle 0x449550
push edi
mov byte [ebp - 0x24], 1
call fcn.0046dfd0
add esp, 4
mov ecx, eax
jmp 0x449556
mov byte [ebp - 0x24], 0
xor ecx, ecx
mov eax, esi
sub eax, ecx
jns 0x449560
mov eax, ecx
sub eax, esi
cmp eax, 5
jl 0x4497d1
mov eax, dword [ebp - 0x38]
test eax, eax
jne 0x449588
push 2
call fcn.0046a22b
add esp, 4
mov dword [ebp - 0x38], eax
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x34], ecx
push dword [ebp - 0x468]
lea ecx, [ebp - 0x318]
mov byte [ebp - 0x30], 1
push 0
push dword [ebp - 0x464]
push 0xffffffffffffffff
push 0
push eax
call fcn.00419930
mov esi, dword [ebp - 0x44]
mov edi, eax
test esi, esi
jne 0x4495cb
push 2
call fcn.0046a22b
add esp, 4
mov dword [ebp - 0x44], eax
xor ecx, ecx
mov word [eax], cx
mov esi, dword [ebp - 0x44]
mov dword [ebp - 0x40], ecx
mov ecx, dword [ebp - 0x468]
cmp ecx, 0xffffffff
mov edx, dword [ebp - 0x2d8]
mov eax, dword [ebp - 0x2dc]
cmove ecx, edx
mov byte [ebp - 0x3c], 1
test eax, eax
je 0x449637
cmp ecx, 1
jl 0x449637
cmp ecx, edx
jg 0x449637
lea ecx, [ecx + ecx*8]
cmp dword [eax + ecx*8 + 0xc], 0
je 0x449637
cmp dword [eax + ecx*8], 0xf
jne 0x449637
lea edx, [ebp - 0x38c]
mov dword [ebp - 0x384], 1
push edx
push edi
push 0x1074
mov dword [ebp - 0x378], esi
push dword [eax + ecx*8 + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [ebp - 0x2d8]
mov eax, dword [ebp - 0x2dc]
mov esi, dword [ebp - 0x2c]
test esi, esi
jne 0x449662
push 2
call fcn.0046a22b
add esp, 4
mov dword [ebp - 0x2c], eax
xor ecx, ecx
mov word [eax], cx
mov edx, dword [ebp - 0x2d8]
mov eax, dword [ebp - 0x2dc]
mov esi, dword [ebp - 0x2c]
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x468]
cmp ecx, 0xffffffff
mov byte [ebp - 0x24], 1
cmove ecx, edx
test eax, eax
je 0x4496b6
cmp ecx, 1
jl 0x4496b6
cmp ecx, edx
jg 0x4496b6
lea ecx, [ecx + ecx*8]
cmp dword [eax + ecx*8 + 0xc], 0
je 0x4496b6
cmp dword [eax + ecx*8], 0xf
jne 0x4496b6
lea edx, [ebp - 0x3c8]
mov dword [ebp - 0x3c0], 2
push edx
push edi
push 0x1074
mov dword [ebp - 0x3b4], esi
push dword [eax + ecx*8 + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0x4a0]
push 4
push dword [ebp - 0x454]
push dword [ebp - 0x484]
call fcn.00419c90
mov esi, eax
mov eax, dword [ebp - 0x20]
test esi, esi
jne 0x44972e
test eax, eax
je 0x4496e5
push eax
call fcn.00469e73
add esp, 4
push 2
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
call fcn.0046a22b
mov edx, eax
add esp, 4
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov dword [ebp - 0x20], edx
test eax, eax
jle 0x449723
nop dword [eax + eax]
mov ax, word [ecx + ecx]
mov word [edx + ecx*2], ax
inc ecx
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
cmp ecx, eax
jl 0x449710
xor ecx, ecx
mov word [edx + eax*2], cx
mov esi, dword [ebp - 0x20]
jmp 0x449745
test eax, eax
je 0x44973b
push eax
call fcn.00469e73
add esp, 4
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x18], 1
test esi, esi
jne 0x449765
push 2
call fcn.0046a22b
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov esi, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x468]
cmp eax, 0xffffffff
mov edx, dword [ebp - 0x2d8]
mov ecx, dword [ebp - 0x2dc]
cmove eax, edx
mov byte [ebp - 0x18], 1
test ecx, ecx
je 0x4497c5
cmp eax, 1
jl 0x4497c5
cmp eax, edx
jg 0x4497c5
lea eax, [eax + eax*8]
cmp dword [ecx + eax*8 + 0xc], 0
je 0x4497c5
cmp dword [ecx + eax*8], 0xf
jne 0x4497c5
lea edx, [ebp - 0x404]
mov dword [ebp - 0x3fc], 3
push edx
push edi
push 0x1074
mov dword [ebp - 0x3f0], esi
push dword [ecx + eax*8 + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
inc dword [ebp - 0x4a4]
jmp 0x4497d1
mov byte [ebp - 0x3c], 0
mov esi, dword [ebp - 0x454]
inc esi
mov dword [ebp - 0x454], esi
cmp esi, dword [ebp - 0x45c]
jl 0x448e20
mov eax, dword [ebp - 0x44c]
mov edi, 2
mov esi, dword [ebp - 0x330]
inc esi
mov dword [ebp - 0x330], esi
cmp esi, dword [ebp - 0x32c]
jl 0x4487e6
mov edx, dword [ebp - 0x4a4]
jmp 0x449818
xor edx, edx
mov esi, dword [ebp - 0x44c]
cmp dword [ebp - 0x460], 0
jne 0x44987f
test edx, edx
jne 0x44987f
push edx
push 0x20
push 0x20
push 1
push 1
push dword [esi + 0x398]
call dword [sym.imp.USER32.dll_LoadImageW]
mov esi, eax
mov dword [ebp - 0x32c], esi
test byte [ebp - 0x494], 1
mov byte [ebp - 4], 0xc
je 0x44986d
mov eax, dword [ebp - 0x44c]
mov ecx, dword [ebp - 0x4a0]
push esi
sub esp, 0xc
push dword [eax + 8]
call fcn.0041ae20
test esi, esi
je 0x449878
push esi
call dword [sym.imp.USER32.dll_DestroyIcon]
xor esi, esi
jmp 0x44b8f4
push 0x10021
push 0x80000d
push 0x1d1
push 0x2ee
push 0x2d
push 0
push 0x49eb00
push str.Date_and_timeAttribute_nameNew_valuePrevious_valueAttribute_description
lea ecx, [ebp - 0x318]
mov dword [ebp - 0x128], 0x433
call fcn.00415460
mov esi, dword [ebp - 0x2d8]
mov edi, eax
mov edx, dword [ebp - 0x2dc]
cmp edi, 0xffffffff
mov ecx, edi
mov dword [ebp - 0x454], edi
cmove ecx, esi
test edx, edx
je 0x449902
cmp ecx, 1
jl 0x449902
cmp ecx, esi
jg 0x449902
lea eax, [ecx + ecx*8]
cmp dword [edx + eax*8 + 0xc], 0
je 0x449902
cmp dword [edx + eax*8], 0xf
jne 0x449902
push 0
push 1
push 0x109d
push dword [edx + eax*8 + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x44c]
push 0
push 0x10
push 0x10
push ecx
push 0x6a
push dword [eax + 0x398]
call fcn.0041afe0
mov esi, eax
mov dword [ebp - 0x32c], esi
mov dword [ebp - 0x340], 0
test esi, esi
je 0x44994b
push 0
lea eax, [ebp - 0x340]
push eax
push dword [esi + 4]
call dword [sym.imp.gdiplus.dll_GdipCreateHBITMAPFromBitmap]
test eax, eax
je 0x44994b
mov dword [esi + 8], eax
push 0x10
push 0x10
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x318]
push dword [ebp - 0x340]
push 1
push edi
call fcn.004173c0
mov eax, dword [ebp - 0x340]
test eax, eax
je 0x449978
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov byte [ebp - 4], 0xb
test esi, esi
je 0x44998a
mov eax, dword [esi]
mov ecx, esi
push 1
mov eax, dword [eax]
call eax
test edi, edi
jne 0x449996
mov esi, dword [ebp - 0xe8]
jmp 0x4499c9
mov edx, dword [ebp - 0x2d8]
cmp edi, 0xffffffff
mov ecx, dword [ebp - 0x2dc]
mov eax, edi
cmove eax, edx
test ecx, ecx
je 0x4499c7
cmp eax, 1
jl 0x4499c7
cmp eax, edx
jg 0x4499c7
lea eax, [eax + eax*8]
cmp dword [ecx + eax*8 + 0xc], 0
je 0x4499c7
mov esi, dword [ecx + eax*8 + 4]
jmp 0x4499c9
xor esi, esi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0xc8
push 0
push 0x101e
push esi
mov dword [ebp - 0x48c], esi
call edi
push 0xc8
push 1
push 0x101e
push esi
call edi
push 0x64
push 2
push 0x101e
push esi
call edi
push 0x64
push 3
push 0x101e
push esi
call edi
push 0x1f4
push 4
push 0x101e
push esi
call edi
mov eax, dword [ebp - 0x450]
mov esi, str.MonitoringHistory
mov dword [ebp - 0x45c], eax
xor ecx, ecx
mov dword [ebp - 0x478], 0
mov byte [ebp - 0x470], 0
mov dword [ebp - 0x474], 0
nop dword [eax + eax]
inc ecx
cmp word [ecx*2 + str.HKCUSoftwareClearDiskInfo], 0
jne 0x449a50
xor eax, eax
nop
inc eax
cmp word [eax*2 + str.MonitoringHistory], 0
jne 0x449a60
add eax, ecx
mov edx, 2
mov dword [ebp - 0x32c], eax
xor ecx, ecx
inc eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0046a22b
mov edi, str.HKCUSoftwareClearDiskInfo
mov dword [ebp - 0x450], eax
add esp, 4
mov ecx, eax
mov edx, 0x48
sub edi, eax
mov word [ecx], dx
add ecx, 2
movzx eax, word [edi + ecx]
mov edx, eax
test ax, ax
jne 0x449aa2
mov eax, 0x5c
nop dword [eax + eax]
mov word [ecx], ax
lea esi, [esi + 2]
movzx eax, word [esi]
lea ecx, [ecx + 2]
test ax, ax
jne 0x449ac0
xor eax, eax
mov byte [ebp - 0x470], 1
mov word [ecx], ax
mov eax, dword [ebp - 0x450]
mov dword [ebp - 0x478], eax
mov eax, dword [ebp - 0x32c]
mov dword [ebp - 0x474], eax
mov eax, dword [ebp - 0x45c]
test eax, eax
je 0x449b08
push eax
call fcn.00469e73
add esp, 4
xorps xmm0, xmm0
mov dword [ebp - 0x348], 0
push 0x8020
movq qword [ebp - 0x350], xmm0
call fcn.0046a22b
add esp, 4
mov esi, eax
mov dword [ebp - 0x484], esi
push 0x8020
push 0
push esi
call fcn.0046b980
add esp, 0xc
mov dword [ebp - 0x350], esi
mov dword [ebp - 0x34c], 0xffffffff
mov dword [ebp - 0x348], 0
mov byte [ebp - 4], 0x10
xorps xmm0, xmm0
push 0x8020
movq qword [ebp - 0x33c], xmm0
mov dword [ebp - 0x334], 0
call fcn.0046a22b
add esp, 4
mov esi, eax
push 0x8020
push 0
push esi
call fcn.0046b980
add esp, 0xc
mov dword [ebp - 0x33c], esi
mov dword [ebp - 0x338], 0xffffffff
mov dword [ebp - 0x334], 0
xorps xmm0, xmm0
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x9c]
movq qword [ebp - 0x8c], xmm0
movups xmmword [ebp - 0x9c], xmm0
call fcn.00403550
push 0
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0xb4]
push eax
push 8
push 0xffffffffffffffff
push str.:d3
call fcn.00464810
mov edi, eax
add esp, 0x18
mov dword [ebp - 0x330], edi
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x48]
mov byte [ebp - 0x470], 1
test ecx, ecx
je 0x449c18
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x48], 0
mov esi, dword [ebp - 0x450]
mov edx, 0x20019
push ecx
mov ecx, esi
call fcn.00405480
mov dword [ebp - 0x48], eax
test eax, eax
je 0x44a469
xor ecx, ecx
mov dword [ebp - 0x464], ecx
test eax, eax
je 0x44a469
mov eax, dword [ebp - 0x484]
xor edx, edx
push edx
push edx
push edx
push edx
mov dword [ebp - 0x80], 0x4010
mov word [eax], dx
mov dword [ebp - 0x348], edx
lea edx, [ebp - 0x80]
push edx
push eax
push ecx
push dword [ebp - 0x48]
mov dword [ebp - 0x34c], 0xffffffff
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x44a469
mov edx, dword [ebp - 0x484]
cmp word [edx], ax
je 0x44a469
mov dword [ebp - 0x448], esi
xor ecx, ecx
mov dword [ebp - 0x34c], 0xfffffffe
mov esi, str.MonitoringHistory_
mov dword [ebp - 0x478], eax
mov dword [ebp - 0x32c], edx
mov byte [ebp - 0x470], al
mov dword [ebp - 0x474], eax
inc ecx
cmp word [ecx*2 + str.HKCUSoftwareClearDiskInfo], 0
jne 0x449cc1
xor eax, eax
nop
inc eax
cmp word [eax*2 + str.MonitoringHistory_], 0
jne 0x449cd0
add ecx, eax
xor eax, eax
inc eax
cmp word [edx + eax*2], 0
jne 0x449ce0
add eax, ecx
mov edx, 2
mov dword [ebp - 0x45c], eax
xor ecx, ecx
inc eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0046a22b
mov edi, str.HKCUSoftwareClearDiskInfo
mov dword [ebp - 0x450], eax
add esp, 4
mov ecx, eax
mov edx, 0x48
sub edi, eax
nop
mov word [ecx], dx
add ecx, 2
movzx eax, word [edi + ecx]
mov edx, eax
test ax, ax
jne 0x449d20
mov edi, dword [ebp - 0x330]
mov eax, 0x5c
nop dword [eax]
mov word [ecx], ax
lea esi, [esi + 2]
movzx eax, word [esi]
add ecx, 2
test ax, ax
jne 0x449d40
mov eax, dword [ebp - 0x484]
movzx eax, word [eax]
mov edx, eax
test ax, ax
je 0x449d80
mov edi, dword [ebp - 0x32c]
mov word [ecx], ax
lea edi, [edi + 2]
movzx eax, word [edi]
add ecx, 2
test ax, ax
jne 0x449d67
mov edi, dword [ebp - 0x330]
nop
mov esi, dword [ebp - 0x450]
xor eax, eax
mov word [ecx], ax
mov eax, dword [ebp - 0x45c]
mov dword [ebp - 0x474], eax
mov eax, dword [ebp - 0x448]
mov dword [ebp - 0x478], esi
test eax, eax
je 0x449db0
push eax
call fcn.00469e73
add esp, 4
mov eax, dword [ebp - 0x4c]
mov byte [ebp - 0x470], 1
test eax, eax
je 0x449dcc
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x4c], 0
push ecx
mov edx, 0x20019
mov ecx, esi
call fcn.00405480
mov dword [ebp - 0x4c], eax
test eax, eax
je 0x44a45a
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x449df7
push ecx
call fcn.00469e73
mov eax, dword [ebp - 0x4c]
add esp, 4
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x18], 1
test eax, eax
je 0x44a45a
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x68], 0
push ecx
push 0
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x60], 0
push ecx
push 0
push str.Model
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44a45a
mov eax, dword [ebp - 0x68]
cmp eax, 1
je 0x449e55
cmp eax, 2
je 0x449e55
cmp eax, 7
jne 0x44a45a
mov esi, dword [ebp - 0x60]
xor ecx, ecx
mov eax, dword [ebp - 0x20]
add esi, 4
mov dword [ebp - 0x60], esi
mov edx, 2
shr esi, 1
mov dword [ebp - 0x32c], eax
mov dword [ebp - 0x1c], 0
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0046a22b
mov dword [ebp - 0x20], eax
xor ecx, ecx
add esp, 4
mov word [eax + esi*2], cx
mov eax, dword [ebp - 0x20]
mov word [eax], cx
mov eax, dword [ebp - 0x32c]
test eax, eax
je 0x449eae
push eax
call fcn.00469e73
add esp, 4
mov eax, dword [ebp - 0x20]
lea ecx, [esi - 1]
test eax, eax
jne 0x449ed0
push 2
call fcn.0046a22b
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
xor edx, edx
mov word [eax + ecx*2], dx
lea ecx, [esi - 2]
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x449ef8
push 2
call fcn.0046a22b
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
xor edx, edx
mov word [eax + ecx*2], dx
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x449f1d
push 2
call fcn.0046a22b
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x60]
mov byte [ebp - 0x18], 1
push ecx
push eax
push 0
push 0
push str.Model
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44a454
cmp dword [ebp - 0x68], 7
jne 0x449f94
cmp esi, 3
jbe 0x449f94
cmp dword [ebp - 0x20], eax
jne 0x449f65
push 2
call fcn.0046a22b
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x20]
xor eax, eax
mov byte [ebp - 0x18], 1
add esi, 0xffffffff
je 0x449f94
lea edi, [eax + 0xa]
xor edx, edx
cmp dx, word [ecx + eax*2]
jne 0x449f89
cmp word [ecx + eax*2 + 2], dx
je 0x449f89
mov word [ecx + eax*2], di
inc eax
cmp eax, esi
jb 0x449f76
mov edi, dword [ebp - 0x330]
cmp dword [ebp - 0x20], 0
jne 0x449faf
push 2
call fcn.0046a22b
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov dword [ebp - 0x1c], ecx
sub esp, 0x10
mov byte [ebp - 0x18], 1
lea ecx, [ebp - 0x318]
push dword [ebp - 0x20]
push dword [ebp - 0x464]
push dword [ebp - 0x454]
call fcn.00419870
xor ecx, ecx
cmp dword [ebp - 0x4c], 0
mov dword [ebp - 0x45c], ecx
je 0x44a454
mov eax, dword [ebp - 0x33c]
xor edx, edx
mov dword [ebp - 0x7c], 0x4010
mov word [eax], dx
lea eax, [ebp - 0x334]
push eax
push edx
lea eax, [ebp - 0x338]
mov dword [ebp - 0x338], 0xffffffff
push eax
push edx
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x334], edx
push eax
push dword [ebp - 0x33c]
push ecx
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x44a44a
mov eax, dword [ebp - 0x33c]
cmp eax, str.Model
je 0x44a43e
test eax, eax
je 0x44a093
mov ecx, str.Model
sub eax, ecx
mov dword [ebp - 0x448], eax
movzx esi, word [eax + ecx]
mov eax, esi
mov dword [ebp - 0x32c], eax
test si, si
jne 0x44a071
cmp word [ecx], si
je 0x44a43e
movzx edx, word [ecx]
jmp 0x44a081
movzx eax, word [ecx]
mov edx, eax
cmp si, ax
je 0x44a088
mov eax, dword [ebp - 0x32c]
cmp ax, dx
jb 0x44a093
ja 0x44a093
mov eax, dword [ebp - 0x448]
add ecx, 2
jmp 0x44a052
mov eax, dword [ebp - 0x33c]
mov ecx, 0x49eab8
test eax, eax
cmovne ecx, eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x448], ecx
test eax, eax
je 0x44a0bf
push eax
call fcn.00469e73
mov ecx, dword [ebp - 0x448]
add esp, 4
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x18], 1
test eax, eax
je 0x44a43e
lea edx, [ebp - 0x64]
mov dword [ebp - 0x74], 0
push edx
push 0
lea edx, [ebp - 0x74]
mov dword [ebp - 0x64], 0
push edx
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44a43e
mov eax, dword [ebp - 0x74]
cmp eax, 1
je 0x44a11c
cmp eax, 2
je 0x44a11c
cmp eax, 7
jne 0x44a43e
mov esi, dword [ebp - 0x64]
xor ecx, ecx
mov eax, dword [ebp - 0x20]
add esi, 4
mov dword [ebp - 0x64], esi
mov edx, 2
shr esi, 1
mov dword [ebp - 0x32c], eax
mov dword [ebp - 0x1c], 0
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0046a22b
mov dword [ebp - 0x20], eax
xor ecx, ecx
add esp, 4
mov word [eax + esi*2], cx
mov eax, dword [ebp - 0x20]
mov word [eax], cx
mov eax, dword [ebp - 0x32c]
test eax, eax
je 0x44a175
push eax
call fcn.00469e73
add esp, 4
mov eax, dword [ebp - 0x20]
lea ecx, [esi - 1]
test eax, eax
jne 0x44a197
push 2
call fcn.0046a22b
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
xor edx, edx
mov word [eax + ecx*2], dx
lea ecx, [esi - 2]
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x44a1bf
push 2
call fcn.0046a22b
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
xor edx, edx
mov word [eax + ecx*2], dx
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x44a1e4
push 2
call fcn.0046a22b
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x64]
mov byte [ebp - 0x18], 1
push ecx
push eax
push 0
push 0
push dword [ebp - 0x448]
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44a43e
cmp dword [ebp - 0x74], 7
jne 0x44a25e
cmp esi, 3
jbe 0x44a25e
cmp dword [ebp - 0x20], eax
jne 0x44a22d
push 2
call fcn.0046a22b
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x20]
xor eax, eax
mov byte [ebp - 0x18], 1
add esi, 0xffffffff
je 0x44a25e
lea edi, [eax + 0xa]
nop
xor edx, edx
cmp dx, word [ecx + eax*2]
jne 0x44a253
cmp word [ecx + eax*2 + 2], dx
je 0x44a253
mov word [ecx + eax*2], di
inc eax
cmp eax, esi
jb 0x44a240
mov edi, dword [ebp - 0x330]
cmp dword [ebp - 0x20], 0
jne 0x44a279
push 2
call fcn.0046a22b
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov dword [ebp - 0x1c], ecx
push 1
push 0x49f190
push dword [ebp - 0x20]
lea ecx, [ebp - 0x9c]
mov byte [ebp - 0x18], 1
call fcn.00403640
cmp dword [ebp - 0x9c], 3
jb 0x44a43e
mov eax, dword [ebp - 0x38]
mov esi, dword [ebp - 0x33c]
test eax, eax
je 0x44a2b5
push eax
call fcn.00469e73
add esp, 4
xor eax, eax
mov byte [ebp - 0x30], 0
test esi, esi
je 0x44a2cc
cmp word [esi], ax
je 0x44a2cc
inc eax
cmp word [esi + eax*2], 0
jne 0x44a2c4
mov dword [ebp - 0x34], eax
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0046a22b
mov edx, eax
add esp, 4
mov eax, dword [ebp - 0x34]
xor ecx, ecx
mov dword [ebp - 0x38], edx
test eax, eax
jle 0x44a30a
mov ax, word [esi + ecx*2]
mov word [edx + ecx*2], ax
inc ecx
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x38]
cmp ecx, eax
jl 0x44a2f7
xor ecx, ecx
push ecx
mov word [edx + eax*2], cx
lea ecx, [ebp - 0x38]
push 0x49eb00
push edi
mov byte [ebp - 0x30], 1
call fcn.00403330
mov eax, dword [ebp - 0x38]
test eax, eax
jne 0x44a342
push 2
call fcn.0046a22b
add esp, 4
mov dword [ebp - 0x38], eax
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x34], ecx
push dword [ebp - 0x454]
lea ecx, [ebp - 0x318]
mov byte [ebp - 0x30], 1
push 0
push dword [ebp - 0x464]
push 0xffffffffffffffff
push 0x49eb00
push eax
call fcn.00419930
mov ecx, dword [ebp - 0x9c]
xor esi, esi
mov edi, dword [ebp - 0x94]
mov dword [ebp - 0x32c], eax
nop dword [eax + eax]
test ecx, ecx
jne 0x44a38c
mov dword [ebp - 0x494], ecx
jmp 0x44a3ae
cmp esi, ecx
jb 0x44a3a5
lea eax, [ecx - 1]
cmp ecx, eax
ja 0x44a3a0
lea ecx, [eax + 1]
mov dword [ebp - 0x9c], ecx
mov eax, dword [edi + eax*4]
jmp 0x44a3a8
mov eax, dword [edi + esi*4]
mov dword [ebp - 0x494], eax
mov eax, dword [ebp - 0x454]
cmp eax, 0xffffffff
mov edx, dword [ebp - 0x2dc]
cmove eax, dword [ebp - 0x2d8]
test edx, edx
je 0x44a42e
cmp eax, 1
jl 0x44a42e
cmp eax, dword [ebp - 0x2d8]
jg 0x44a42e
lea eax, [eax + eax*8]
cmp dword [edx + eax*8 + 0xc], 0
mov dword [ebp - 0x448], eax
je 0x44a42e
cmp dword [edx + eax*8], 0xf
jne 0x44a42e
lea eax, [esi + 2]
mov dword [ebp - 0x438], eax
mov eax, dword [ebp - 0x494]
mov dword [ebp - 0x42c], eax
lea eax, [ebp - 0x440]
push eax
push dword [ebp - 0x32c]
mov eax, dword [ebp - 0x448]
push 0x1074
push dword [edx + eax*8 + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0x9c]
mov edi, dword [ebp - 0x94]
inc esi
cmp esi, 3
jl 0x44a380
mov edi, dword [ebp - 0x330]
mov ecx, dword [ebp - 0x45c]
inc ecx
jmp 0x449fd2
mov dword [ebp - 0x338], 0xffffffff
mov esi, dword [ebp - 0x450]
mov ecx, dword [ebp - 0x464]
mov eax, dword [ebp - 0x48]
inc ecx
jmp 0x449c38
mov esi, dword [ebp - 0x454]
mov ecx, esi
mov eax, dword [ebp - 0x2d8]
cmp esi, 0xffffffff
mov edx, dword [ebp - 0x2dc]
cmove ecx, eax
test edx, edx
je 0x44a4b3
cmp ecx, 1
jl 0x44a4b3
cmp ecx, eax
jg 0x44a4b3
lea eax, [ecx + ecx*8]
cmp dword [edx + eax*8 + 0xc], 0
je 0x44a4b3
cmp dword [edx + eax*8], 0xf
jne 0x44a4b3
push 0
push 1
push 0x109d
push dword [edx + eax*8 + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [ebp - 0x460], 0
je 0x44a529
push 2
push esi
lea ecx, [ebp - 0x318]
call fcn.00417b80
push 2
push dword [ebp - 0x490]
lea ecx, [ebp - 0x318]
call fcn.00417b80
push 0x42
push dword [ebp - 0x47c]
lea ecx, [ebp - 0x318]
call fcn.00417b80
push 1
push dword [ebp - 0x468]
lea ecx, [ebp - 0x318]
call fcn.00417b80
push 1
push dword [ebp - 0x498]
lea ecx, [ebp - 0x318]
call fcn.00417b80
push 1
push dword [ebp - 0x49c]
lea ecx, [ebp - 0x318]
call fcn.00417b80
push 1
push 5
lea ecx, [ebp - 0x318]
call fcn.00410690
nop dword [eax + eax]
mov eax, dword [ebp - 0x444]
test eax, eax
je 0x44ac5e
cmp byte [eax + 0x38], 0
jne 0x44a9c1
mov dword [eax], 0
lea esi, [eax + 0x14]
mov dword [eax + 4], 0
xorps xmm0, xmm0
mov dword [eax + 8], 0
push 0
mov dword [eax + 0xc], 0
push 0
mov dword [eax + 0x10], 0
movups xmmword [esi], xmm0
push 0
movq qword [esi + 0x10], xmm0
push esi
mov dword [esi + 0x18], 0
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x44ac52
mov edx, dword [ebp - 0x444]
mov edx, dword [edx + 0x18]
cmp edx, 0xcae
jne 0x44a5ca
mov ecx, dword [ebp - 0x444]
mov dword [ecx], 0xfffffffa
mov byte [ecx + 0x39], 1
jmp 0x44a877
test edx, edx
je 0x44a6d1
mov ecx, dword [ebp - 0x444]
mov ecx, dword [ecx + 0x30]
test ecx, ecx
je 0x44a871
cmp edx, 0xcb1
jne 0x44a871
mov eax, dword [ebp - 0x444]
mov edx, dword [ecx + 0x3c]
mov eax, dword [eax + 0x1c]
mov dword [ebp - 0x464], eax
test edx, edx
je 0x44a6d1
cmp eax, 1
jl 0x44a6d1
cmp eax, dword [ecx + 0x40]
jg 0x44a6d1
lea eax, [eax + eax*8]
cmp dword [edx + eax*8 + 0xc], 0
mov eax, dword [ebp - 0x444]
je 0x44a6d7
mov edx, dword [eax + 0x20]
cmp edx, 0x205
jne 0x44a674
mov eax, dword [ecx + 0x1c0]
mov edx, dword [esi]
test eax, eax
je 0x44a6d1
mov dword [eax + 0x30], ecx
mov eax, dword [ecx + 0x1c0]
mov dword [eax], 0xffffffea
mov eax, dword [ecx + 0x1c0]
mov dword [eax + 8], 0x205
mov eax, dword [ecx + 0x1c0]
mov dword [eax + 4], edx
jmp 0x44a846
cmp edx, 0x203
jne 0x44a6b2
mov eax, dword [ecx + 0x1c0]
mov edx, dword [esi]
test eax, eax
je 0x44a6d1
mov dword [eax + 0x30], ecx
mov eax, dword [ecx + 0x1c0]
mov dword [eax], 0xfffffff2
mov eax, dword [ecx + 0x1c0]
mov dword [eax + 8], 0x203
mov eax, dword [ecx + 0x1c0]
mov dword [eax + 4], edx
jmp 0x44a846
cmp edx, 0x202
jne 0x44a775
push 0
push 0
push dword [esi]
push edx
mov edx, dword [ebp - 0x464]
push edx
call fcn.0041ad90
mov eax, dword [ebp - 0x444]
mov eax, dword [eax]
cmp eax, 0xfffffffa
je 0x44ac5e
mov esi, dword [ebp - 0x44c]
lea ecx, [ebp - 0x318]
cmp dword [esi + 0xf0], ecx
jne 0x44a540
cmp eax, dword [ebp - 0x488]
je 0x44ac5e
cmp eax, dword [ebp - 0x498]
jne 0x44a9ca
cmp dword [esi + 0x96c], 0
jne 0x44a736
push 2
call fcn.0046a22b
add esp, 4
mov dword [esi + 0x96c], eax
xor ecx, ecx
mov word [eax], cx
mov dword [esi + 0x970], ecx
push ecx
push 5
mov byte [esi + 0x974], 1
xor edx, edx
mov ecx, dword [esi + 0x96c]
push 0
call fcn.0040b910
mov esi, eax
test esi, esi
je 0x44a540
cmp esi, 0xffffffff
je 0x44a540
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessId]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x44a540
cmp edx, 0x402
jne 0x44a7b7
mov eax, dword [ecx + 0x1c0]
mov edx, dword [esi]
test eax, eax
je 0x44a6d1
mov dword [eax + 0x30], ecx
mov eax, dword [ecx + 0x1c0]
mov dword [eax], 0xffffff35
mov eax, dword [ecx + 0x1c0]
mov dword [eax + 8], 0x402
mov eax, dword [ecx + 0x1c0]
mov dword [eax + 4], edx
jmp 0x44a846
cmp edx, 0x403
je 0x44a815
cmp edx, 0x404
je 0x44a815
mov ecx, dword [eax + 0x30]
mov esi, dword [esi]
mov eax, dword [ecx + 0x1c0]
cmp edx, 0x405
jne 0x44a7fc
test eax, eax
je 0x44a6d1
mov dword [eax + 0x30], ecx
mov eax, dword [ecx + 0x1c0]
mov dword [eax], 0xffffff34
mov eax, dword [ecx + 0x1c0]
mov dword [eax + 8], edx
jmp 0x44a83d
test eax, eax
je 0x44a6d1
mov dword [eax + 0x30], ecx
mov eax, dword [ecx + 0x1c0]
mov dword [eax], 0xffffff36
jmp 0x44a834
mov eax, dword [ecx + 0x1c0]
mov esi, dword [esi]
test eax, eax
je 0x44a6d1
mov dword [eax + 0x30], ecx
mov eax, dword [ecx + 0x1c0]
mov dword [eax], 0xffffff33
mov eax, dword [ecx + 0x1c0]
mov dword [eax + 8], edx
mov eax, dword [ecx + 0x1c0]
mov dword [eax + 4], esi
mov eax, dword [ecx + 0x1c0]
mov edx, dword [ebp - 0x464]
mov dword [eax + 0xc], edx
mov eax, dword [ecx + 0x1c0]
mov dword [eax + 0x10], 0
mov eax, dword [ecx + 0x1c0]
mov byte [eax + 0x38], 1
jmp 0x44a6d1
mov ecx, dword [ebp - 0x444]
test eax, eax
jle 0x44ac52
cmp dword [ecx + 0x18], 0x100
jne 0x44a95e
mov eax, dword [ecx + 0x30]
mov dword [ebp - 0x32c], eax
test eax, eax
je 0x44a95e
mov eax, 0xd
cmp ax, word [ecx + 0x1c]
jne 0x44a95e
mov eax, dword [esi]
xor ecx, ecx
mov dword [ebp - 0x45c], eax
test eax, eax
je 0x44a92f
push 0xfffffffffffffff4
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, dword [ebp - 0x32c]
mov edx, dword [ecx + 0x3c]
test edx, edx
je 0x44a92b
cmp eax, 1
jl 0x44a92b
cmp eax, dword [ecx + 0x40]
jg 0x44a92b
lea ecx, [eax + eax*8]
cmp dword [edx + ecx*8 + 0xc], 0
je 0x44a92b
mov ecx, dword [ebp - 0x45c]
lea edi, [eax + eax*8]
cmp dword [edx + edi*8 + 4], ecx
mov edi, dword [ebp - 0x330]
jne 0x44a92b
mov ecx, dword [ebp - 0x444]
mov edx, dword [ecx + 0x30]
mov ecx, dword [edx + 0x3c]
test ecx, ecx
je 0x44a927
cmp eax, dword [edx + 0x40]
jg 0x44a927
lea edx, [eax + eax*8]
cmp dword [ecx + edx*8 + 0xc], 0
je 0x44a927
mov ecx, dword [ecx + edx*8]
cmp ecx, 0x23
je 0x44a939
cmp ecx, 0x24
jne 0x44a92f
jmp 0x44a939
xor ecx, ecx
jmp 0x44a92f
xor eax, eax
mov ecx, eax
cmp ecx, 0x22
je 0x44a939
cmp ecx, 0x25
jne 0x44a958
mov ecx, dword [esi]
push ecx
movzx eax, ax
push eax
push 0x111
push ecx
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x44a6d1
mov ecx, dword [ebp - 0x444]
mov eax, dword [ecx + 0x34]
test eax, eax
je 0x44a9ad
test esi, esi
jne 0x44a96d
xor cl, cl
jmp 0x44a9a9
mov ecx, dword [eax + 0x244]
add eax, 0x230
mov dword [ebp - 0x32c], eax
test ecx, ecx
je 0x44a99b
push esi
push ecx
push dword [eax]
call dword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
setne cl
test eax, eax
jne 0x44a9a9
mov eax, dword [ebp - 0x32c]
push esi
push dword [eax]
call dword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
setne cl
test cl, cl
jne 0x44a9bb
push esi
call dword [sym.imp.USER32.dll_TranslateMessage]
push esi
call dword [sym.imp.USER32.dll_DispatchMessageW]
mov eax, dword [ebp - 0x444]
mov byte [eax + 0x38], 0
jmp 0x44a6d7
mov esi, dword [ebp - 0x490]
cmp eax, esi
jne 0x44ab23
mov ecx, dword [ebp - 0x44c]
lea eax, [ebp - 0x318]
sub esp, 8
push 0x8c
push 0x190
push 0
push eax
push 1
push str.Are_you_sure_you_want_to_delete_the_history_of_atttribute_changes_
call fcn.00440f90
test eax, eax
je 0x44a540
mov eax, dword [ebp - 0x450]
mov esi, str.MonitoringHistory
mov dword [ebp - 0x460], eax
xor ecx, ecx
mov dword [ebp - 0x478], 0
mov byte [ebp - 0x470], 0
mov dword [ebp - 0x474], 0
nop word [eax + eax]
inc ecx
cmp word [ecx*2 + str.HKCUSoftwareClearDiskInfo], 0
jne 0x44aa40
xor eax, eax
nop
inc eax
cmp word [eax*2 + str.MonitoringHistory], 0
jne 0x44aa50
add eax, ecx
mov edx, 2
mov dword [ebp - 0x32c], eax
xor ecx, ecx
inc eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0046a22b
mov edi, str.HKCUSoftwareClearDiskInfo
mov dword [ebp - 0x450], eax
add esp, 4
mov ecx, eax
mov edx, 0x48
sub edi, eax
mov word [ecx], dx
add ecx, 2
movzx eax, word [edi + ecx]
mov edx, eax
test ax, ax
jne 0x44aa92
mov edi, dword [ebp - 0x330]
mov eax, 0x5c
nop
mov word [ecx], ax
lea esi, [esi + 2]
movzx eax, word [esi]
lea ecx, [ecx + 2]
test ax, ax
jne 0x44aab0
mov esi, dword [ebp - 0x450]
xor eax, eax
mov word [ecx], ax
mov eax, dword [ebp - 0x32c]
mov dword [ebp - 0x474], eax
mov eax, dword [ebp - 0x460]
mov dword [ebp - 0x478], esi
test eax, eax
je 0x44aaf1
push eax
call fcn.00469e73
add esp, 4
push esi
lea ecx, [ebp - 0x4c]
mov byte [ebp - 0x470], 1
call fcn.004045c0
test al, al
je 0x44a540
push 0
push 0
push 0x1009
push dword [ebp - 0x48c]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x44a540
cmp eax, dword [ebp - 0x49c]
jne 0x44abba
push 2
push dword [ebp - 0x454]
lea ecx, [ebp - 0x318]
call fcn.00417b80
push 2
push esi
lea ecx, [ebp - 0x318]
call fcn.00417b80
mov esi, dword [ebp - 0x47c]
lea ecx, [ebp - 0x318]
push 2
push esi
call fcn.00417b80
push 1
push dword [ebp - 0x468]
lea ecx, [ebp - 0x318]
call fcn.00417b80
push 1
push dword [ebp - 0x498]
lea ecx, [ebp - 0x318]
call fcn.00417b80
push 1
push dword [ebp - 0x49c]
lea ecx, [ebp - 0x318]
call fcn.00417b80
push 0
push str.The_list_below_shows_the_history_of_changes_in_the_monitored_disks_attributes
push dword [ebp - 0x480]
lea ecx, [ebp - 0x318]
call fcn.00418290
jmp 0x44a540
mov esi, dword [ebp - 0x47c]
cmp eax, esi
jne 0x44a540
push 2
push dword [ebp - 0x468]
lea ecx, [ebp - 0x318]
call fcn.00417b80
push 2
push dword [ebp - 0x498]
lea ecx, [ebp - 0x318]
call fcn.00417b80
push 2
push dword [ebp - 0x49c]
lea ecx, [ebp - 0x318]
call fcn.00417b80
push 1
push dword [ebp - 0x454]
lea ecx, [ebp - 0x318]
call fcn.00417b80
push 1
push dword [ebp - 0x490]
lea ecx, [ebp - 0x318]
call fcn.00417b80
push 1
push esi
lea ecx, [ebp - 0x318]
call fcn.00417b80
push 0
push str.Clear_Disk_Info_detected_some_changes_in_the_selected_attributes._Check_them_out_in_the_list_below.
push dword [ebp - 0x480]
lea ecx, [ebp - 0x318]
call fcn.00418290
jmp 0x44a540
mov eax, dword [ebp - 0x444]
mov dword [eax], 0xfffffed4
push 0
push 0
push 0x1004
push dword [ebp - 0x46c]
mov dword [ebp - 0x490], 0
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x494], eax
test eax, eax
jle 0x44b884
xor eax, eax
nop dword [eax]
push eax
push dword [ebp - 0x468]
lea ecx, [ebp - 0x318]
call fcn.00419b70
mov ecx, eax
test ecx, ecx
js 0x44b865
mov eax, dword [ebp - 0x44c]
mov edx, dword [eax + 0x99c]
cmp ecx, edx
jge 0x44b865
jb 0x44accf
lea edx, [ecx + 1]
mov dword [eax + 0x99c], edx
mov esi, edx
jmp 0x44acd2
lea esi, [ecx + 1]
mov eax, dword [eax + 0x9a4]
lea edi, [ecx + ecx*2]
shl edi, 5
cmp byte [edi + eax], 0
je 0x44b865
mov eax, dword [ebp - 0x44c]
cmp edx, ecx
ja 0x44acf8
mov dword [eax + 0x99c], esi
mov esi, dword [eax + 0x9a4]
mov eax, dword [esi + edi + 0x54]
add esi, edi
mov dword [ebp - 0x454], esi
test eax, eax
je 0x44b865
cmp word [eax], 0
je 0x44b865
push 0
push dword [ebp - 0x490]
lea ecx, [ebp - 0x318]
push dword [ebp - 0x468]
call fcn.00419c90
mov edi, eax
test edi, edi
jne 0x44ad46
push eax
lea ecx, [ebp - 0x38]
call fcn.00401a20
jmp 0x44ad64
mov eax, dword [ebp - 0x38]
test eax, eax
je 0x44ad56
push eax
call fcn.00469e73
add esp, 4
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], 0
mov byte [ebp - 0x30], 1
push 1
push dword [ebp - 0x490]
lea ecx, [ebp - 0x318]
push dword [ebp - 0x468]
call fcn.00419c90
mov edi, eax
test edi, edi
jne 0x44ad8e
push eax
lea ecx, [ebp - 0x44]
call fcn.00401a20
jmp 0x44adac
mov eax, dword [ebp - 0x44]
test eax, eax
je 0x44ad9e
push eax
call fcn.00469e73
add esp, 4
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], 0
mov byte [ebp - 0x3c], 1
cmp dword [esi + 0x54], 0
lea edi, [esi + 0x5c]
mov dword [ebp - 0x444], edi
jne 0x44ade6
push 2
call fcn.0046a22b
mov dword [esi + 0x54], eax
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x444], edi
mov word [eax], cx
mov dword [esi + 0x58], ecx
mov byte [edi], 1
mov ecx, dword [esi + 0x54]
mov edi, ecx
mov dword [ebp - 0x480], edi
jmp 0x44ae00
mov eax, dword [ebp - 0x450]
mov byte [edi], 1
mov ecx, dword [esi + 0x54]
mov edi, ecx
mov dword [ebp - 0x450], eax
mov dword [ebp - 0x480], ecx
mov dword [ebp - 0x474], 0
mov esi, str.Monitoring_
mov byte [ebp - 0x470], 0
xor eax, eax
mov dword [ebp - 0x478], 0
mov dword [ebp - 0x47c], ecx
nop dword [eax + eax]
inc eax
cmp word [eax*2 + str.HKCUSoftwareClearDiskInfo], 0
jne 0x44ae30
xor edx, edx
nop
inc edx
cmp word [edx*2 + str.Monitoring_], 0
jne 0x44ae40
add edx, eax
mov dword [ebp - 0x46c], edx
test ecx, ecx
jne 0x44ae7e
mov eax, dword [ebp - 0x444]
mov dword [ebp - 0x444], eax
mov eax, dword [ebp - 0x450]
mov dword [ebp - 0x47c], ecx
mov dword [ebp - 0x450], eax
mov dword [ebp - 0x480], edi
jmp 0x44aec0
xor eax, eax
cmp word [ecx], ax
je 0x44aebe
mov edx, dword [ebp - 0x444]
mov dword [ebp - 0x444], edx
mov edx, dword [ebp - 0x450]
mov dword [ebp - 0x47c], ecx
mov dword [ebp - 0x450], edx
mov dword [ebp - 0x480], edi
nop dword [eax]
inc eax
cmp word [ecx + eax*2], 0
jne 0x44aeb0
mov edx, dword [ebp - 0x46c]
add edx, eax
mov dword [ebp - 0x46c], edx
lea eax, [edx + 1]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0046a22b
mov edi, str.HKCUSoftwareClearDiskInfo
mov dword [ebp - 0x460], eax
add esp, 4
mov ecx, eax
mov edx, 0x48
sub edi, eax
mov word [ecx], dx
add ecx, 2
movzx eax, word [edi + ecx]
mov edx, eax
test ax, ax
jne 0x44aef6
mov edi, dword [ebp - 0x480]
mov eax, 0x5c
mov word [ecx], ax
lea esi, [esi + 2]
movzx eax, word [esi]
add ecx, 2
test ax, ax
jne 0x44af12
mov eax, dword [ebp - 0x47c]
test eax, eax
je 0x44af50
movzx eax, word [eax]
mov edx, eax
test ax, ax
je 0x44af50
mov word [ecx], ax
lea edi, [edi + 2]
movzx eax, word [edi]
add ecx, 2
test ax, ax
jne 0x44af37
nop dword [eax + eax]
mov edi, dword [ebp - 0x460]
xor eax, eax
mov word [ecx], ax
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0x474], eax
mov eax, dword [ebp - 0x450]
mov dword [ebp - 0x478], edi
test eax, eax
je 0x44af80
push eax
call fcn.00469e73
add esp, 4
mov esi, dword [ebp - 0x44]
mov byte [ebp - 0x470], 1
test esi, esi
jne 0x44afa6
push 2
call fcn.0046a22b
add esp, 4
mov dword [ebp - 0x44], eax
xor ecx, ecx
mov word [eax], cx
mov esi, dword [ebp - 0x44]
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x38]
mov byte [ebp - 0x3c], 1
test eax, eax
jne 0x44afc9
push 2
call fcn.0046a22b
add esp, 4
mov dword [ebp - 0x38], eax
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x34], ecx
push ecx
push esi
push ecx
push eax
push edi
lea ecx, [ebp - 0x48]
mov byte [ebp - 0x30], 1
call fcn.00404420
mov esi, dword [ebp - 0x454]
cmp dword [esi + 0x54], 0
jne 0x44b011
push 2
call fcn.0046a22b
mov dword [esi + 0x54], eax
add esp, 4
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x444]
mov dword [esi + 0x58], ecx
mov byte [eax], 1
mov ecx, dword [esi + 0x54]
mov edi, ecx
mov dword [ebp - 0x480], edi
jmp 0x44b025
mov eax, dword [ebp - 0x444]
mov byte [eax], 1
mov ecx, dword [esi + 0x54]
mov edi, ecx
mov dword [ebp - 0x480], ecx
mov dword [ebp - 0x474], 0
mov esi, str.MonitoringHistory_
mov byte [ebp - 0x470], 0
xor eax, eax
mov dword [ebp - 0x478], 0
mov dword [ebp - 0x47c], ecx
nop dword [eax]
inc eax
cmp word [eax*2 + str.HKCUSoftwareClearDiskInfo], 0
jne 0x44b050
xor edx, edx
nop
inc edx
cmp word [edx*2 + str.MonitoringHistory_], 0
jne 0x44b060
add edx, eax
mov dword [ebp - 0x46c], edx
test ecx, ecx
jne 0x44b092
mov eax, dword [ebp - 0x444]
mov dword [ebp - 0x47c], ecx
mov dword [ebp - 0x480], edi
mov dword [ebp - 0x444], eax
jmp 0x44b0c1
xor eax, eax
cmp word [ecx], ax
je 0x44b0bf
mov edx, dword [ebp - 0x444]
mov dword [ebp - 0x47c], ecx
mov dword [ebp - 0x480], edi
mov dword [ebp - 0x444], edx
inc eax
cmp word [ecx + eax*2], 0
jne 0x44b0b1
mov edx, dword [ebp - 0x46c]
add edx, eax
mov dword [ebp - 0x46c], edx
lea eax, [edx + 1]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0046a22b
mov edi, str.HKCUSoftwareClearDiskInfo
mov dword [ebp - 0x450], eax
add esp, 4
mov ecx, eax
mov edx, 0x48
sub edi, eax
nop word [eax + eax]
mov word [ecx], dx
add ecx, 2
movzx eax, word [edi + ecx]
mov edx, eax
test ax, ax
jne 0x44b100
mov edi, dword [ebp - 0x480]
mov eax, 0x5c
nop dword [eax]
mov word [ecx], ax
lea esi, [esi + 2]
movzx eax, word [esi]
add ecx, 2
test ax, ax
jne 0x44b120
mov eax, dword [ebp - 0x47c]
test eax, eax
je 0x44b160
movzx eax, word [eax]
mov edx, eax
test ax, ax
je 0x44b160
mov word [ecx], ax
lea edi, [edi + 2]
movzx eax, word [edi]
add ecx, 2
test ax, ax
jne 0x44b145
nop word [eax + eax]
push dword [ebp - 0x460]
xor eax, eax
mov byte [ebp - 0x470], 1
mov word [ecx], ax
mov eax, dword [ebp - 0x450]
mov dword [ebp - 0x478], eax
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0x474], eax
call fcn.00469e73
mov edi, dword [ebp - 0x454]
add esp, 4
cmp dword [edi + 0x54], 0
jne 0x44b1b3
push 2
call fcn.0046a22b
add esp, 4
mov dword [edi + 0x54], eax
xor ecx, ecx
mov word [eax], cx
mov dword [edi + 0x58], ecx
mov eax, dword [ebp - 0x444]
mov byte [eax], 1
cmp dword [edi + 0x3c], 0
mov esi, dword [edi + 0x54]
jne 0x44b1da
push 2
call fcn.0046a22b
add esp, 4
mov dword [edi + 0x3c], eax
xor ecx, ecx
mov word [eax], cx
mov dword [edi + 0x40], ecx
mov byte [edi + 0x44], 1
mov ecx, dword [edi + 0x3c]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x448], eax
xor eax, eax
mov dword [ebp - 0x32c], ecx
mov dword [ebp - 0x20], 0
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
test ecx, ecx
je 0x44b218
cmp word [ecx], ax
je 0x44b218
nop dword [eax]
inc eax
cmp word [ecx + eax*2], 0
jne 0x44b210
xor ecx, ecx
nop word [eax + eax]
inc ecx
cmp word [ecx*2 + str._with_serial_number], 0
jne 0x44b220
add ecx, eax
test esi, esi
je 0x44b24a
xor eax, eax
cmp word [esi], ax
je 0x44b248
nop dword [eax]
inc eax
cmp word [esi + eax*2], 0
jne 0x44b240
add ecx, eax
lea eax, [ecx + 1]
mov dword [ebp - 0x460], ecx
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0046a22b
mov edx, dword [ebp - 0x20]
add esp, 4
mov dword [ebp - 0x45c], eax
mov ecx, eax
test edx, edx
je 0x44b294
movzx eax, word [edx]
test ax, ax
je 0x44b294
mov word [ecx], ax
lea edx, [edx + 2]
movzx eax, word [edx]
add ecx, 2
test ax, ax
jne 0x44b283
mov edx, dword [ebp - 0x32c]
test edx, edx
je 0x44b2c4
movzx eax, word [edx]
mov edi, eax
mov dword [ebp - 0x32c], edi
test ax, ax
je 0x44b2c4
movzx edi, ax
sub edx, ecx
mov word [ecx], di
add ecx, 2
movzx eax, word [ecx + edx]
mov edi, eax
test ax, ax
jne 0x44b2b3
mov edi, str._with_serial_number
mov edx, 0x20
sub edi, ecx
mov word [ecx], dx
add ecx, 2
movzx eax, word [edi + ecx]
mov edx, eax
test ax, ax
jne 0x44b2d0
mov edi, dword [ebp - 0x454]
test esi, esi
je 0x44b306
movzx eax, word [esi]
mov edx, eax
test ax, ax
je 0x44b306
mov word [ecx], ax
lea esi, [esi + 2]
movzx eax, word [esi]
add ecx, 2
test ax, ax
jne 0x44b2f5
xor eax, eax
mov word [ecx], ax
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x44b31b
push eax
call fcn.00469e73
add esp, 4
mov eax, dword [ebp - 0x45c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x460]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x448]
mov byte [ebp - 0x18], 1
test eax, eax
je 0x44b344
push eax
call fcn.00469e73
add esp, 4
cmp dword [edi + 0x3c], 0
mov byte [ebp - 0x470], 1
jne 0x44b366
push 2
call fcn.0046a22b
add esp, 4
mov dword [edi + 0x3c], eax
xor ecx, ecx
mov word [eax], cx
mov dword [edi + 0x40], ecx
push ecx
mov byte [edi + 0x44], 1
push dword [edi + 0x3c]
push ecx
push str.Model
push dword [ebp - 0x450]
lea ecx, [ebp - 0x48]
call fcn.00404420
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push ecx
lea edx, [ebp - 0x20]
lea ecx, [ebp - 0x328]
call fcn.00407370
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x488], eax
test eax, eax
jne 0x44b3c9
push 2
call fcn.0046a22b
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x488], eax
mov byte [ebp - 0x18], 1
test eax, eax
jne 0x44b3ef
push 2
call fcn.0046a22b
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x488], eax
mov esi, dword [ebp - 0x34]
mov byte [ebp - 0x18], 1
mov byte [ebp - 0x30], 0
test esi, esi
jne 0x44b41b
mov ecx, dword [ebp - 0x38]
test ecx, ecx
je 0x44b418
cmp word [ecx], si
je 0x44b418
nop word [eax + eax]
inc esi
cmp word [ecx + esi*2], 0
jne 0x44b410
mov dword [ebp - 0x34], esi
test eax, eax
je 0x44b430
xor ecx, ecx
cmp word [eax], cx
je 0x44b42e
inc ecx
cmp word [eax + ecx*2], 0
jne 0x44b426
add esi, ecx
xor eax, eax
inc eax
cmp word [eax*2 + 0x49eb00], 0
jne 0x44b432
add esi, eax
xor ecx, ecx
mov edx, 2
mov dword [ebp - 0x45c], esi
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0046a22b
mov edi, dword [ebp - 0x488]
add esp, 4
mov ecx, dword [ebp - 0x38]
mov edx, eax
mov dword [ebp - 0x448], eax
mov dword [ebp - 0x460], ecx
test edi, edi
je 0x44b4ab
movzx ecx, word [edi]
mov esi, ecx
mov dword [ebp - 0x32c], esi
test cx, cx
je 0x44b4a5
sub edi, eax
mov eax, ecx
movzx ecx, ax
mov word [edx], cx
add edx, 2
movzx eax, word [edx + edi]
mov ecx, eax
test ax, ax
jne 0x44b494
mov ecx, dword [ebp - 0x460]
mov esi, 0x49eb00
mov edi, 0x7c
sub esi, edx
nop word [eax + eax]
mov word [edx], di
add edx, 2
movzx eax, word [edx + esi]
mov edi, eax
test ax, ax
jne 0x44b4c0
cmp dword [ebp - 0x38], 0
mov esi, dword [ebp - 0x45c]
je 0x44b4f8
movzx eax, word [ecx]
mov edi, eax
test ax, ax
je 0x44b4f8
mov word [edx], ax
lea ecx, [ecx + 2]
movzx eax, word [ecx]
add edx, 2
test ax, ax
jne 0x44b4e7
xor eax, eax
mov word [edx], ax
mov eax, dword [ebp - 0x38]
test eax, eax
je 0x44b50d
push eax
call fcn.00469e73
add esp, 4
mov edi, dword [ebp - 0x490]
lea ecx, [ebp - 0x318]
mov eax, dword [ebp - 0x448]
push 2
push edi
push dword [ebp - 0x468]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], esi
mov byte [ebp - 0x30], 1
call fcn.00419c90
mov esi, eax
mov eax, dword [ebp - 0x2c]
test esi, esi
jne 0x44b58b
test eax, eax
je 0x44b54d
push eax
call fcn.00469e73
add esp, 4
push 2
mov byte [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
call fcn.0046a22b
mov edx, eax
add esp, 4
mov eax, dword [ebp - 0x28]
xor ecx, ecx
mov dword [ebp - 0x2c], edx
test eax, eax
jle 0x44b583
mov ax, word [ecx + ecx]
mov word [edx + ecx*2], ax
inc ecx
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x2c]
cmp ecx, eax
jl 0x44b570
xor ecx, ecx
mov word [edx + eax*2], cx
jmp 0x44b5a2
test eax, eax
je 0x44b598
push eax
call fcn.00469e73
add esp, 4
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], 0
push 3
push edi
push dword [ebp - 0x468]
lea ecx, [ebp - 0x318]
mov byte [ebp - 0x24], 1
call fcn.00419c90
mov esi, eax
mov eax, dword [ebp - 0x20]
test esi, esi
jne 0x44b611
test eax, eax
je 0x44b5d0
push eax
call fcn.00469e73
add esp, 4
push 2
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
call fcn.0046a22b
mov edx, eax
add esp, 4
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov dword [ebp - 0x20], edx
test eax, eax
jle 0x44b606
mov ax, word [ecx + ecx]
mov word [edx + ecx*2], ax
inc ecx
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
cmp ecx, eax
jl 0x44b5f3
xor ecx, ecx
mov word [edx + eax*2], cx
mov esi, dword [ebp - 0x20]
jmp 0x44b628
test eax, eax
je 0x44b61e
push eax
call fcn.00469e73
add esp, 4
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 0x18], 1
mov dword [ebp - 0x488], eax
test eax, eax
jne 0x44b65a
push 2
call fcn.0046a22b
add esp, 4
mov dword [ebp - 0x2c], eax
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x20]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x488], eax
mov byte [ebp - 0x24], 1
test esi, esi
jne 0x44b67a
push 2
call fcn.0046a22b
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov esi, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x40]
mov edi, 0x49f190
mov byte [ebp - 0x18], 1
mov dword [ebp - 0x460], edi
mov byte [ebp - 0x3c], 0
test eax, eax
jne 0x44b6ab
mov ecx, dword [ebp - 0x44]
test ecx, ecx
je 0x44b6a8
cmp word [ecx], ax
je 0x44b6a8
inc eax
cmp word [ecx + eax*2], 0
jne 0x44b6a0
mov dword [ebp - 0x40], eax
xor ecx, ecx
nop dword [eax]
lea ecx, [ecx + 1]
cmp word [ecx*2 + 0x49f190], 0
jne 0x44b6b0
lea edx, [eax + ecx]
mov eax, dword [ebp - 0x488]
test eax, eax
je 0x44b6dc
xor ecx, ecx
cmp word [eax], cx
je 0x44b6da
inc ecx
cmp word [eax + ecx*2], 0
jne 0x44b6d2
add edx, ecx
xor eax, eax
nop
lea eax, [eax + 1]
cmp word [eax*2 + 0x49f190], 0
jne 0x44b6e0
lea ecx, [edx + eax]
test esi, esi
je 0x44b70a
xor eax, eax
cmp word [esi], ax
je 0x44b708
nop dword [eax]
inc eax
cmp word [esi + eax*2], 0
jne 0x44b700
add ecx, eax
lea eax, [ecx + 1]
mov dword [ebp - 0x45c], ecx
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0046a22b
mov edx, dword [ebp - 0x44]
add esp, 4
mov dword [ebp - 0x448], eax
mov ecx, eax
test edx, edx
je 0x44b754
movzx eax, word [edx]
test ax, ax
je 0x44b754
mov word [ecx], ax
lea edx, [edx + 2]
movzx eax, word [edx]
add ecx, 2
test ax, ax
jne 0x44b743
mov edi, 0x49f190
mov edx, 0xa
sub edi, ecx
mov word [ecx], dx
add ecx, 2
movzx eax, word [ecx + edi]
mov edx, eax
test ax, ax
jne 0x44b760
mov edx, dword [ebp - 0x488]
mov edi, dword [ebp - 0x460]
test edx, edx
je 0x44b7b1
movzx eax, word [edx]
mov edi, eax
mov dword [ebp - 0x32c], edi
mov edi, dword [ebp - 0x460]
test ax, ax
je 0x44b7b1
movzx eax, ax
nop word [eax + eax]
mov word [ecx], ax
lea edx, [edx + 2]
movzx eax, word [edx]
add ecx, 2
test ax, ax
jne 0x44b7a0
mov eax, 0xa
mov word [ecx], ax
lea edi, [edi + 2]
movzx eax, word [edi]
add ecx, 2
test ax, ax
jne 0x44b7b6
test esi, esi
je 0x44b7e6
movzx eax, word [esi]
mov edx, eax
test ax, ax
je 0x44b7e6
mov word [ecx], ax
lea esi, [esi + 2]
movzx eax, word [esi]
add ecx, 2
test ax, ax
jne 0x44b7d5
xor eax, eax
mov word [ecx], ax
mov eax, dword [ebp - 0x44]
test eax, eax
je 0x44b7fb
push eax
call fcn.00469e73
add esp, 4
mov esi, dword [ebp - 0x38]
mov edx, dword [ebp - 0x448]
mov eax, dword [ebp - 0x45c]
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x3c], 1
test esi, esi
jne 0x44b836
push 2
call fcn.0046a22b
mov edx, dword [ebp - 0x448]
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x38], eax
mov word [eax], cx
mov esi, dword [ebp - 0x38]
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x48]
mov byte [ebp - 0x30], 1
test eax, eax
je 0x44b865
xor ecx, ecx
cmp word [edx], cx
je 0x44b850
inc ecx
cmp word [edx + ecx*2], 0
jne 0x44b848
lea ecx, [ecx*2 + 2]
push ecx
push edx
push 1
push 0
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x490]
inc eax
mov dword [ebp - 0x490], eax
cmp eax, dword [ebp - 0x494]
jl 0x44ac90
mov edi, dword [ebp - 0x330]
mov eax, dword [ebp - 0x44c]
mov ecx, dword [ebp - 0x4a0]
push 0x20
push dword [eax + 0x10]
call fcn.00417b80
test edi, edi
je 0x44b8a7
push edi
call fcn.004647b0
add esp, 4
mov eax, dword [ebp - 0x90]
test eax, eax
je 0x44b8ba
push eax
call fcn.00469e73
add esp, 4
mov eax, dword [ebp - 0x94]
test eax, eax
je 0x44b8cd
push eax
call fcn.00469e73
add esp, 4
mov eax, dword [ebp - 0x33c]
test eax, eax
je 0x44b8e0
push eax
call fcn.00469e73
add esp, 4
push dword [ebp - 0x484]
call fcn.00469e73
mov esi, dword [ebp - 0x4a4]
add esp, 4
mov eax, dword [ebp - 0x4c]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x44b909
cmp eax, 0xffffffff
je 0x44b909
push eax
call edi
mov eax, dword [ebp - 0x48]
test eax, eax
je 0x44b918
cmp eax, 0xffffffff
je 0x44b918
push eax
call edi
mov eax, dword [ebp - 0x450]
test eax, eax
je 0x44b92b
push eax
call fcn.00469e73
add esp, 4
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x44b93b
push eax
call fcn.00469e73
add esp, 4
mov eax, dword [ebp - 0x44]
test eax, eax
je 0x44b94b
push eax
call fcn.00469e73
add esp, 4
mov eax, dword [ebp - 0x38]
test eax, eax
je 0x44b95b
push eax
call fcn.00469e73
add esp, 4
mov eax, dword [ebp - 0x58]
test eax, eax
je 0x44b96b
push eax
call fcn.00469e73
add esp, 4
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x44b97b
push eax
call fcn.00469e73
add esp, 4
lea ecx, [ebp - 0x318]
mov dword [ebp - 4], 0x14
call fcn.0040f000
mov eax, dword [ebp - 0x2dc]
test eax, eax
je 0x44b9a0
push eax
call fcn.00469e73
add esp, 4
mov ecx, dword [ebp - 0x208]
test ecx, ecx
je 0x44b9b3
push ecx
call fcn.00469e73
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00469e65
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4