Function at 0x436c10
Capabilities:
Enumerate files on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47e349
mov eax, dword fs:[0]
push eax
mov eax, 0x2d50
call fcn.0047a9b0
mov eax, dword [0x49f008]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2d4c], edx
mov esi, ecx
mov dword [ebp - 0x2d3c], esi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2d48], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2d44], eax
mov dword [ebp - 4], 0
xor eax, eax
mov dword [ebp - 0x281c], 0
mov dword [ebp - 0x2818], 7
mov word [ebp - 0x282c], ax
mov ebx, 7
mov dword [ebp - 0x284c], eax
mov dword [ebp - 0x2848], ebx
mov word [ebp - 0x285c], ax
mov dword [ebp - 0x2d28], eax
xor al, al
mov byte [ebp - 0x2d29], al
xor eax, eax
mov dword [ebp - 0x2834], 0
mov dword [ebp - 0x2830], ebx
mov word [ebp - 0x2844], ax
mov byte [ebp - 4], 3
mov eax, dword [0x4a08d4]
test eax, eax
je 0x436cdb
lea ecx, [ebp - 0x2d28]
push ecx
call eax
push 0x500
lea eax, [ebp - 0x1e14]
push eax
push str._SystemRoot_Inf_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push esi
lea eax, [ebp - 0x1e14]
push 0x500
push eax
call fcn.0046b97c
add esp, 0xc
lea eax, [ebp - 0x2880]
push eax
push 0
lea eax, [ebp - 0x1e14]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x43762a
mov eax, dword [ebp - 0x2860]
mov dword [ebp - 0x2d40], eax
test eax, eax
je 0x43762a
mov edi, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
xor esi, esi
mov ebx, dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0x2d30], esi
nop dword [eax]
push 0x500
lea eax, [ebp - 0x1414]
push eax
push str._SystemRoot_System32DriverStoreFileRepository
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp esi, 3
ja case.default.0x436d70
jmp dword [esi*4 + 0x4376f8]
push dword [ebp - 0x2d3c]
lea eax, [ebp - 0x1414]
push eax
lea eax, [ebp - 0xa14]
push str._s_s_
push eax
call fcn.0040a5b0
add esp, 0x10
jmp 0x436e49
lea eax, [ebp - 0x1414]
push eax
lea eax, [ebp - 0xa14]
push str._s
push eax
call fcn.0040a5b0
add esp, 0xc
jmp 0x436e0e
cmp dword [ebp - 0x2818], 8
lea eax, [ebp - 0x282c]
cmovae eax, dword [ebp - 0x282c]
push eax
lea eax, [ebp - 0x1414]
push eax
lea eax, [ebp - 0xa14]
push str._s_s_
push eax
call fcn.0040a5b0
add esp, 0x10
jmp 0x436e22
lea eax, [ebp - 0x1414]
push eax
lea eax, [ebp - 0xa14]
push str._s
push eax
call fcn.0040a5b0
add esp, 0xc
jmp 0x436e3f
cmp esi, 1
jne 0x436e1d
cmp dword [ebp - 0x281c], 0
jne 0x43700b
jmp 0x436e49
cmp esi, 2
jne 0x436e3a
cmp byte [ebp + 0x41], 0
je 0x43700b
cmp dword [ebp - 0x281c], 0
jne 0x436e49
jmp 0x43700b
cmp esi, 3
jne 0x436e49
cmp byte [ebp + 0x42], 0
je 0x43700b
lea eax, [ebp - 0x2ad4]
push eax
lea eax, [ebp - 0xa14]
push eax
call edi
mov dword [ebp - 0x2d34], eax
cmp eax, 0xffffffff
je 0x43700b
mov esi, eax
nop word [eax + eax]
test byte [ebp - 0x2ad4], 0x10
je 0x436fe1
cmp word [ebp - 0x2aa8], 0x2e
jne 0x436eab
mov ax, word [ebp - 0x2aa6]
test ax, ax
je 0x436fe1
cmp ax, 0x2e
jne 0x436eab
cmp word [ebp - 0x2aa4], 0
je 0x436fe1
lea eax, [ebp - 0x2aa8]
push 0x104
push eax
call fcn.0046c265
mov edi, dword [ebp + 0x60]
add esp, 8
cmp edi, dword [ebp + 0x64]
je 0x43707b
lea ebx, [ebp - 0x2aa8]
lea ecx, [ebx + 2]
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x436ed4
sub ebx, ecx
sar ebx, 1
cmp dword [edi + 0x14], 8
mov esi, edi
jb 0x436eed
mov esi, dword [edi]
mov edx, dword [edi + 0x10]
cmp edx, ebx
jne 0x43706f
lea ecx, [ebp - 0x2aa8]
test edx, edx
je 0x436f25
mov eax, ecx
sub esi, eax
nop word [eax + eax]
mov ax, word [esi + ecx]
cmp ax, word [ecx]
jne 0x43706f
add ecx, 2
sub edx, 1
jne 0x436f10
push 8
push str._______
lea ecx, [ebp - 0x2844]
call fcn.00402380
lea eax, [ebp - 0x2d5c]
push 0x258
push eax
call fcn.004643b0
add esp, 8
cmp dword [edi + 0x14], 8
jb 0x436f53
mov edi, dword [edi]
mov eax, dword [eax]
mov ecx, 0x487d18
test eax, eax
push edi
cmovne ecx, eax
push ecx
push 0x4a0918
call fcn.0040a5b0
add esp, 0xc
push dword [ebp - 0x2d54]
call fcn.004634ea
add esp, 4
push dword [ebp - 0x2d5c]
call fcn.004634ea
mov ecx, 0x4a0918
add esp, 4
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x436f92
sub ecx, edx
sar ecx, 1
push ecx
push 0x4a0918
lea ecx, [ebp - 0x2844]
call fcn.0040a360
cmp dword [ebp - 0x2830], 8
lea ecx, [ebp - 0x2844]
push 1
cmovae ecx, dword [ebp - 0x2844]
mov edx, 4
call fcn.00410e40
add esp, 4
mov ebx, dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [ebp - 0x2d34]
lea eax, [ebp - 0x2ad4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x436e70
mov esi, dword [ebp - 0x2d30]
push dword [ebp - 0x2d34]
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
inc esi
mov dword [ebp - 0x2d30], esi
cmp esi, 4
jl 0x436d50
mov eax, dword [0x4a08d0]
test eax, eax
je 0x43702c
push dword [ebp - 0x2d28]
call eax
mov edx, dword [ebp - 0x2830]
cmp edx, 8
jb 0x43758d
mov ecx, dword [ebp - 0x2844]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x437583
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4376e4
jmp 0x437583
add edi, 0x18
cmp edi, dword [ebp + 0x64]
jne 0x436ee3
lea eax, [ebp - 0x2aa8]
push eax
lea eax, [ebp - 0x1414]
push eax
lea eax, [ebp - 0xa14]
push str._s_s.inf
push eax
call fcn.0040a5b0
mov edi, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
lea eax, [ebp - 0x2d24]
add esp, 0x10
push eax
lea eax, [ebp - 0xa14]
push eax
call edi
mov ebx, eax
mov dword [ebp - 0x2d50], ebx
cmp ebx, 0xffffffff
je 0x436fd5
lea eax, [ebp - 0x2cf8]
push 0x104
push eax
call fcn.0046c265
lea eax, [ebp - 0x2cf8]
push eax
lea eax, [ebp - 0x2aa8]
push eax
lea eax, [ebp - 0x1414]
push eax
lea eax, [ebp - 0x2814]
push 0x490eb4
push eax
call fcn.0040a5b0
xor eax, eax
add esp, 0x1c
mov dword [ebp - 0x2d38], eax
cmp byte [ebp + 0x44], al
je 0x43716e
mov edi, dword [ebp + 0x48]
cmp edi, dword [ebp + 0x4c]
je 0x43716e
lea ebx, [ebp - 0x2cf8]
lea ecx, [ebx + 2]
nop dword [eax]
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x437120
sub ebx, ecx
sar ebx, 1
nop
cmp dword [edi + 0x14], 8
mov esi, edi
jb 0x43713a
mov esi, dword [edi]
mov edx, dword [edi + 0x10]
cmp edx, ebx
jne 0x4371c8
lea ecx, [ebp - 0x2cf8]
test edx, edx
je 0x437164
mov eax, ecx
sub esi, eax
mov ax, word [esi + ecx]
cmp ax, word [ecx]
jne 0x4371c8
add ecx, 2
sub edx, 1
jne 0x437153
mov dword [ebp - 0x2d38], 1
mov edi, dword [ebp + 0x60]
cmp edi, dword [ebp + 0x64]
je 0x4371de
lea ebx, [ebp - 0x2cf8]
lea ecx, [ebx + 2]
nop
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x437180
sub ebx, ecx
sar ebx, 1
nop
cmp dword [edi + 0x14], 8
mov esi, edi
jb 0x43719a
mov esi, dword [edi]
mov edx, dword [edi + 0x10]
cmp edx, ebx
jne 0x4371d6
lea eax, [ebp - 0x2cf8]
test edx, edx
je 0x4371c1
mov ecx, eax
sub esi, ecx
nop
mov cx, word [esi + eax]
cmp cx, word [eax]
jne 0x4371d6
add eax, 2
sub edx, 1
jne 0x4371b0
mov edi, 2
jmp 0x4371e4
add edi, 0x18
cmp edi, dword [ebp + 0x4c]
jne 0x437130
jmp 0x43716e
add edi, 0x18
cmp edi, dword [ebp + 0x64]
jne 0x437190
mov edi, dword [ebp - 0x2d38]
mov esi, dword [ebp - 0x2d30]
cmp esi, 2
jge 0x43739f
lea eax, [ebp - 0x2880]
push eax
push 0
lea eax, [ebp - 0x2814]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x437543
mov eax, dword [ebp - 0x2d40]
cmp eax, dword [ebp - 0x2860]
jne 0x437543
push 0
push 0
lea edx, [ebp - 0x2814]
lea ecx, [ebp - 0x1e14]
call fcn.00411b70
add esp, 8
test al, al
je 0x437543
lea ecx, [ebp - 0x2cf8]
mov byte [ebp - 0x2d29], 1
xor bl, bl
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x437255
sub ecx, edx
lea eax, [ebp - 0x2cf8]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x282c]
call fcn.00402380
lea eax, [ebp - 0x2aa8]
push eax
lea eax, [ebp - 0x1414]
push eax
lea eax, [ebp - 0xa14]
push 0x48859c
push eax
call fcn.0040a5b0
lea ecx, [ebp - 0xa14]
add esp, 0x10
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4372a2
sub ecx, edx
lea eax, [ebp - 0xa14]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x285c]
call fcn.00402380
cmp byte [ebp + 0x43], 0
jne 0x43731e
test edi, edi
jne 0x43731e
sub esp, 0x18
lea ecx, [ebp - 0xa14]
mov edx, esp
lea esi, [ecx + 2]
xor eax, eax
mov dword [edx + 0x10], edi
mov dword [edx + 0x14], 7
mov word [edx], ax
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4372f0
sub ecx, esi
lea eax, [ebp - 0xa14]
sar ecx, 1
push ecx
push eax
mov ecx, edx
call fcn.00402380
call fcn.00436800
mov esi, dword [ebp - 0x2d30]
add esp, 0x18
mov bl, al
lea eax, [ebp - 0xa14]
test bl, bl
push eax
mov eax, 0x490ed0
mov ecx, 0x490ec8
cmove ecx, eax
push ecx
push str._____s__s
push 0x4a0918
call fcn.0040a5b0
lea eax, [ebp - 0x2aa8]
push eax
lea eax, [ebp - 0x1414]
push eax
lea eax, [ebp - 0xa14]
push str._s_s.sys
push eax
call fcn.0040a5b0
add esp, 0x20
lea ecx, [ebp - 0xa14]
call fcn.00411360
test al, al
jne 0x43738c
push str.___drv_
push 0x500
push 0x4a0918
call fcn.0046b97c
add esp, 0xc
cmp edi, 1
jne 0x437513
push str.___f_
jmp 0x43751d
push dword [ebp - 0x2d44]
mov edx, dword [ebp - 0x2d4c]
lea ecx, [ebp - 0x2814]
push dword [ebp - 0x2d48]
call fcn.00436940
add esp, 8
test al, al
je 0x437543
lea eax, [ebp - 0x2aa8]
xor bl, bl
push eax
lea eax, [ebp - 0x1414]
push eax
lea eax, [ebp - 0xa14]
push 0x48859c
push eax
call fcn.0040a5b0
add esp, 0x10
test edi, edi
jne 0x4374de
lea ecx, [ebp - 0xa14]
cmp byte [ebp + 0x43], bl
je 0x43748d
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x437405
mov eax, dword [ebp - 0x284c]
lea esi, [ebp - 0x285c]
sub ecx, edx
sar ecx, 1
cmp dword [ebp - 0x2848], 8
cmovae esi, dword [ebp - 0x285c]
cmp eax, ecx
jne 0x437459
mov edx, eax
lea ecx, [ebp - 0xa14]
test edx, edx
je 0x4374d8
mov eax, ecx
sub esi, eax
mov ax, word [esi + ecx]
cmp ax, word [ecx]
jne 0x437459
add ecx, 2
sub edx, 1
jne 0x437446
jmp 0x4374d8
sub esp, 0x18
lea ecx, [ebp - 0xa14]
mov edx, esp
lea esi, [ecx + 2]
xor eax, eax
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 7
mov word [edx], ax
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x437480
jmp 0x4374bb
sub esp, 0x18
lea esi, [ecx + 2]
mov edx, esp
xor eax, eax
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 7
mov word [edx], ax
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4374b0
sub ecx, esi
lea eax, [ebp - 0xa14]
sar ecx, 1
push ecx
push eax
mov ecx, edx
call fcn.00402380
call fcn.00436800
mov bl, al
add esp, 0x18
mov esi, dword [ebp - 0x2d30]
lea eax, [ebp - 0xa14]
test bl, bl
push eax
mov ecx, 0x490f34
mov eax, 0x490f2c
cmove eax, ecx
push eax
push str._____s__s
push 0x4a0918
call fcn.0040a5b0
add esp, 0x10
cmp edi, 1
jne 0x437513
push str.___f_
jmp 0x43751d
cmp edi, 2
jne 0x43752f
push str.___e_
push 0x500
push 0x4a0918
call fcn.0046b97c
add esp, 0xc
push 1
mov edx, 4
mov ecx, 0x4a0918
call fcn.00410e40
add esp, 4
mov ebx, dword [ebp - 0x2d50]
lea eax, [ebp - 0x2d24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4370c4
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindClose]
call ebx
cmp byte [ebp - 0x2d29], 0
je 0x436fdb
cmp esi, 2
jl 0x436ffd
jmp 0x436fdb
push edx
push ecx
call fcn.004632e1
add esp, 8
mov ebx, dword [ebp - 0x2848]
xor eax, eax
mov dword [ebp - 0x2834], 0
mov dword [ebp - 0x2830], 7
mov word [ebp - 0x2844], ax
cmp ebx, 8
jb 0x4375ea
lea ecx, [ebx*2 + 2]
mov ebx, dword [ebp - 0x285c]
mov eax, ebx
cmp ecx, 0x1000
jb 0x4375e0
mov ebx, dword [ebx - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4376e9
push ecx
push ebx
call fcn.004632e1
add esp, 8
mov edx, dword [ebp - 0x2818]
cmp edx, 8
jb 0x4376a7
mov ecx, dword [ebp - 0x282c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x43769d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4376ee
jmp 0x43769d
mov eax, dword [0x4a08d0]
test eax, eax
je 0x43763b
push dword [ebp - 0x2d28]
call eax
mov edx, dword [ebp - 0x2830]
cmp edx, 8
jb 0x43767b
mov ecx, dword [ebp - 0x2844]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x437671
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4376f3
push edx
push ecx
call fcn.004632e1
add esp, 8
xor eax, eax
mov dword [ebp - 0x2834], 0
mov dword [ebp - 0x2830], 7
mov word [ebp - 0x2844], ax
jmp 0x4375ea
push edx
push ecx
call fcn.004632e1
add esp, 8
xor eax, eax
mov dword [ebp - 0x2818], 7
lea ecx, [ebp + 0x10]
mov word [ebp - 0x282c], ax
mov dword [ebp - 0x281c], eax
call fcn.0040fa90
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004632a0
mov esp, ebp
pop ebp
ret
call fcn.0046851b
call fcn.0046851b
call fcn.0046851b
call fcn.0046851b
ja 0x437767
inc ebx
add byte [ebp - 0x45ffbc93], bl
insd dword es:[edi], dx
inc ebx
add ah, ch
insd dword es:[edi], dx
inc ebx
add ah, cl
int3
inc edi
test dword [eax], eax
in eax, 0xff
inc dword [edi]
add byte [eax], al
add byte [esi - 0x77], ah
test esp, ebp
in al, 0xff
inc esi
inc ebp
cld
add dword [ebx + 0x4a1f9415], ecx
add byte [ecx - 0x75], dl
or eax, 0x4a1f90
call fcn.0040aba0
mov eax, dword [0x4a1f90]
xor edi, edi
mov ecx, dword [0x4a1f88]
add esp, 4
mov esi, dword [0x4a1f84]
sub ecx, esi
mov dword [0x4a1f94], eax
mov eax, 0xb21642c9
imul ecx
mov dword [ebp - 0x1b28], edi
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
test eax, eax
jle 0x437cda
xor ebx, ebx
mov dword [ebp - 0x1b20], ebx
cmp byte [ebx + esi + 0x30], 0
je 0x437ca7
push 0x27
push str.SYSTEMCurrentControlSetControlClass_
lea ecx, [ebp - 0x1af0]
call fcn.00402380
mov eax, dword [0x4a1f84]
add eax, 0x18
add eax, ebx
cmp dword [eax + 0x14], 8
jb 0x437804
mov eax, dword [eax]
push eax
lea eax, [ebp - 0xd8]
push 0x64
push eax
call fcn.0046b918
lea ecx, [ebp - 0xd8]
add esp, 0xc
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x437820
sub ecx, edx
lea eax, [ebp - 0xd8]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x1af0]
call fcn.0040a360
lea eax, [ebp - 0xd8]
push 0x64
push eax
call fcn.0046c265
xor edi, edi
lea eax, [ebp - 0x1af0]
cmp dword [ebp - 0x1adc], 8
push edi
cmovae eax, dword [ebp - 0x1af0]
push eax
lea eax, [ebp - 0x1ad8]
mov dword [ebp - 0x1b24], edi
push str._s_04d
push eax
call fcn.0040a5b0
add esp, 0x18
lea eax, [ebp - 0x1b18]
push eax
push 0x20119
push edi
lea eax, [ebp - 0x1ad8]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x437c9b
nop dword [eax]
mov dword [ebp - 0x1af4], 0x400
lea eax, [ebp - 0x8d8]
mov ecx, 0x400
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x4378c5
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x1af4]
push eax
lea eax, [ebp - 0x8d8]
push eax
push ecx
push ecx
push str.InfPath
push dword [ebp - 0x1b18]
call esi
test eax, eax
jne 0x437c36
lea eax, [ebp - 0x8d8]
mov byte [ebp - 0x1b19], 1
push 0x200
push eax
call fcn.0046c265
add esp, 8
mov dword [ebp - 0x1af8], 0x400
mov ecx, 0x400
lea eax, [ebp - 0x4d8]
nop dword [eax + eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x437930
lea eax, [ebp - 0x1af8]
push eax
lea eax, [ebp - 0x4d8]
push eax
push ecx
push ecx
push str.MatchingDeviceId
push dword [ebp - 0x1b18]
call esi
test eax, eax
je 0x437965
xor eax, eax
mov word [ebp - 0x4d8], ax
lea eax, [ebp - 0x4d8]
push 0x200
push eax
call fcn.0046c265
add esp, 8
mov dword [ebp - 0x1afc], 0x800
mov ecx, 0x800
lea eax, [ebp - 0x10d8]
nop
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x437990
lea eax, [ebp - 0x1afc]
push eax
lea eax, [ebp - 0x10d8]
push eax
push ecx
push ecx
push str.DriverDesc
push dword [ebp - 0x1b18]
call esi
test eax, eax
je 0x4379c5
xor eax, eax
mov word [ebp - 0x10d8], ax
lea eax, [ebp - 0x10d8]
push 0x400
push eax
call fcn.0046c265
mov edx, dword [0x4a1f84]
add esp, 8
cmp byte [ebx + edx + 0x34], 0
je 0x437b0a
mov edi, dword [ebx + edx + 0x38]
cmp edi, dword [ebx + edx + 0x3c]
je 0x437a69
lea ebx, [ebp - 0x8d8]
lea ecx, [ebx + 2]
nop dword [eax]
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x437a00
mov eax, dword [ebp - 0x1b20]
sub ebx, ecx
sar ebx, 1
cmp dword [edi + 0x14], 8
mov esi, edi
jb 0x437a1f
mov esi, dword [edi]
mov edx, dword [edi + 0x10]
cmp edx, ebx
jne 0x437ad5
lea ecx, [ebp - 0x8d8]
test edx, edx
je 0x437a55
mov eax, ecx
sub esi, eax
nop dword [eax + eax]
mov ax, word [esi + ecx]
cmp ax, word [ecx]
jne 0x437acf
add ecx, 2
sub edx, 1
jne 0x437a40
mov edx, dword [0x4a1f84]
xor al, al
mov byte [ebp - 0x1b19], al
mov ebx, dword [ebp - 0x1b20]
mov edi, dword [ebx + edx + 0x44]
cmp edi, dword [ebx + edx + 0x48]
je 0x437b18
lea ebx, [ebp - 0x4d8]
lea ecx, [ebx + 2]
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x437a80
mov eax, dword [ebp - 0x1b20]
sub ebx, ecx
sar ebx, 1
cmp dword [edi + 0x14], 8
mov esi, edi
jb 0x437a9f
mov esi, dword [edi]
mov edx, dword [edi + 0x10]
cmp edx, ebx
jne 0x437af3
lea eax, [ebp - 0x4d8]
test edx, edx
je 0x437ac5
mov ecx, eax
sub esi, ecx
mov cx, word [esi + eax]
cmp cx, word [eax]
jne 0x437aed
add eax, 2
sub edx, 1
jne 0x437ab4
mov edx, dword [0x4a1f84]
xor bl, bl
jmp 0x437b1e
mov eax, dword [ebp - 0x1b20]
mov edx, dword [0x4a1f84]
add edi, 0x18
cmp edi, dword [eax + edx + 0x3c]
jne 0x437a15
jmp 0x437a63
mov eax, dword [ebp - 0x1b20]
mov edx, dword [0x4a1f84]
add edi, 0x18
cmp edi, dword [eax + edx + 0x48]
jne 0x437a95
mov bl, byte [ebp - 0x1b19]
jmp 0x437b24
mov bl, byte [ebp - 0x1b19]
mov eax, dword [ebp - 0x1b20]
jmp 0x437b2a
mov bl, byte [ebp - 0x1b19]
mov eax, dword [ebp - 0x1b20]
mov edi, dword [ebp - 0x1b24]
add eax, edx
cmp dword [eax + 0x14], 8
jb 0x437b34
mov eax, dword [eax]
lea ecx, [ebp - 0x10d8]
test bl, bl
push ecx
lea ecx, [ebp - 0x4d8]
push ecx
lea ecx, [ebp - 0x8d8]
push ecx
push edi
push eax
mov ecx, 0x490ed0
mov eax, 0x490ec8
cmove eax, ecx
push eax
push str._s__s__04d:__s___s___s
push 0x4a0918
call fcn.0040a5b0
push 1
mov edx, 4
mov ecx, 0x4a0918
call fcn.00410e40
add esp, 0x24
test bl, bl
mov ebx, dword [ebp - 0x1b20]
je 0x437c36
mov edi, dword [0x4a1f84]
sub esp, 0x5c
mov esi, esp
add edi, ebx
mov ecx, esi
mov dword [ebp - 0x1b2c], esi
push edi
call fcn.00402240
lea eax, [edi + 0x18]
mov byte [ebp - 4], 2
push eax
lea ecx, [esi + 0x18]
call fcn.00402240
mov byte [ebp - 4], 3
lea ecx, [esi + 0x38]
movzx eax, byte [edi + 0x30]
mov byte [esi + 0x30], al
movzx eax, byte [edi + 0x31]
mov byte [esi + 0x31], al
movzx eax, byte [edi + 0x32]
mov byte [esi + 0x32], al
movzx eax, byte [edi + 0x33]
mov byte [esi + 0x33], al
movzx eax, byte [edi + 0x34]
mov byte [esi + 0x34], al
lea eax, [edi + 0x38]
push eax
call fcn.0045feb0
lea eax, [edi + 0x44]
mov byte [ebp - 4], 4
push eax
lea ecx, [esi + 0x44]
call fcn.0045feb0
lea eax, [edi + 0x50]
mov byte [ebp - 4], 5
push eax
lea ecx, [esi + 0x50]
call fcn.0045feb0
lea eax, [ebp - 0x4d8]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x10d8]
push eax
lea edx, [ebp - 0xd8]
lea ecx, [ebp - 0x8d8]
call fcn.00436c10
mov edi, dword [ebp - 0x1b24]
add esp, 0x64
push dword [ebp - 0x1b18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc edi
lea eax, [ebp - 0x1af0]
cmp dword [ebp - 0x1adc], 8
push edi
cmovae eax, dword [ebp - 0x1af0]
push eax
lea eax, [ebp - 0x1ad8]
mov dword [ebp - 0x1b24], edi
push str._s_04d
push eax
call fcn.0040a5b0
add esp, 0x10
lea eax, [ebp - 0x1b18]
push eax
push 0x20119
push 0
lea eax, [ebp - 0x1ad8]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4378b0
mov edi, dword [ebp - 0x1b28]
mov esi, dword [0x4a1f84]
mov ecx, dword [0x4a1f88]
mov eax, 0xb21642c9
sub ecx, esi
inc edi
imul ecx
add ebx, 0x5c
mov dword [ebp - 0x1b28], edi
add edx, ecx
mov dword [ebp - 0x1b20], ebx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jl 0x4377d5
mov edx, dword [ebp - 0x1adc]
cmp edx, 8
jb 0x437d16
mov ecx, dword [ebp - 0x1af0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x437d0c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x437d32
push edx
push ecx
call fcn.004632e1
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004632a0
mov esp, ebp
pop ebp
ret
call fcn.0046851b
int3