Function at 0x44ab30
Capabilities:
Persist via run registry key
Query or enumerate registry value
Set registry value
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x9ac]
sub esp, 0x9ac
push 0xffffffffffffffff
push 0x620789
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x70a308]
xor eax, ebp
mov dword [ebp + 0x9a8], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x70], ecx
xor edi, edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 4], edi
mov eax, dword [0x704d18]
neg eax
sbb eax, eax
and eax, 0xf
add eax, 0xf
mov dword [0x704d1c], eax
mov byte [ebp - 0x29], 0
push edi
lea ecx, [ebp - 0x14]
push ecx
push edi
push 0xf003f
push edi
push edi
push edi
push str.SoftwareDownloadManager_
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x44abe8
push edi
push edi
push edi
push edi
push str.Extensions
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x44abe8
push 0xce
push str.3GP_7Z_AAC_ACE_AIF_ARJ_ASF_AVI_BIN_BZ2_EXE_GZ_GZIP_IMG_ISO_LZH_M4A_M4V_MKV_MOV_MP3_MP4_MPA_MPE_MPEG_MPG_MSI_MSU_OGG_OGV_PDF_PLJ_PPS_PPT_QT_R0_R1_RA_RAR_RM_RMVB_SEA_SIT_SITX_TAR_TIF_TIFF_WAV_WMA_WMV_Z_ZIP
push 1
push edi
push str.Extensions
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov byte [ebp - 0x29], 1
push edi
push edi
push edi
push edi
push 0x656fd0
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x44ac85
mov dword [ebp + 0x558], edi
mov dword [ebp + 0x560], edi
xor edx, edx
mov word [ebp + 0x55c], dx
mov byte [ebp - 4], 1
lea eax, [ebp + 0x558]
push eax
call fcn.0044a2c0
add esp, 4
test al, al
je 0x44ac76
mov esi, dword [ebp + 0x558]
cmp esi, edi
mov eax, esi
jne 0x44ac41
lea eax, [ebp + 0x55c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x44ac44
sub eax, edx
sar eax, 1
cmp esi, edi
mov ecx, esi
jne 0x44ac5f
lea ecx, [ebp + 0x55c]
lea edx, [eax + eax + 2]
push edx
push ecx
push edi
push edi
push 0x656fd0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x558]
call fcn.004011f0
push edi
push edi
push edi
push edi
push str.TempPath
mov ecx, dword [ebp - 0x14]
push ecx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call ebx
test eax, eax
je 0x44ace9
mov edx, dword [0x70f64c]
cmp edx, edi
mov eax, edx
jne 0x44acaf
mov eax, 0x70f650
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x44acb2
sub eax, esi
sar eax, 1
cmp edx, edi
mov ecx, edx
jne 0x44accc
mov ecx, 0x70f650
lea edx, [eax + eax + 2]
push edx
push ecx
push 1
push edi
push str.TempPath
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x44ae8b
lea ecx, [ebp - 0x1c]
push ecx
push 0x20019
push edi
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x44ae8b
mov esi, 0x208
mov dword [ebp - 0x40], esi
lea edx, [ebp - 0x40]
push edx
lea eax, [ebp + 0x57c]
push eax
push edi
push edi
push 0x6536b0
mov ecx, dword [ebp - 0x1c]
push ecx
call ebx
test eax, eax
jne 0x44ae81
mov dword [ebp + 0x564], edi
mov dword [ebp + 0x56c], edi
xor edx, edx
mov word [ebp + 0x568], dx
mov byte [ebp - 4], 2
push edi
lea eax, [ebp + 0x57c]
push eax
push 0x64edec
lea ecx, [ebp + 0x564]
call fcn.00402190
push 0x7e
lea ecx, [ebp + 0x57c]
push ecx
call fcn.005fa163
add esp, 8
test eax, eax
je 0x44adbf
xor edx, edx
mov word [ebp + 0x350], dx
push 0x206
push edi
lea eax, [ebp + 0x352]
push eax
call fcn.005f8cb0
add esp, 0xc
push edi
lea ecx, [ebp + 0x350]
push ecx
lea edx, [ebp + 0x57c]
push edx
call fcn.00446960
add esp, 8
push eax
push 0x64edec
lea ecx, [ebp + 0x564]
call fcn.00402190
mov dword [ebp - 0x40], esi
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp + 0x57c]
push ecx
push edi
push edi
push str.TempPath
mov edx, dword [ebp - 0x14]
push edx
call ebx
test eax, eax
jne 0x44ae72
mov edx, dword [ebp + 0x564]
cmp edx, edi
mov eax, edx
jne 0x44adf4
lea eax, [ebp + 0x568]
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x44adf7
sub eax, esi
sar eax, 1
cmp edx, edi
mov ecx, edx
jne 0x44ae12
lea ecx, [ebp + 0x568]
push eax
push ecx
lea eax, [ebp + 0x57c]
push eax
call fcn.0061390f
add esp, 0xc
test eax, eax
jne 0x44ae72
mov edx, dword [0x70f64c]
cmp edx, edi
mov eax, edx
jne 0x44ae38
mov eax, 0x70f650
lea esi, [eax + 2]
jmp 0x44ae40
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x44ae40
sub eax, esi
sar eax, 1
cmp edx, edi
mov ecx, edx
jne 0x44ae5a
mov ecx, 0x70f650
lea edx, [eax + eax + 2]
push edx
push ecx
push 1
push edi
push str.TempPath
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x564]
call fcn.004011f0
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, 4
mov dword [ebp - 0x30], ebx
lea edx, [ebp - 0x30]
push edx
lea eax, [ebp - 0x20]
push eax
push edi
push edi
push str.FindApps
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x44aec9
mov dword [ebp - 0x20], edi
push ebx
lea edx, [ebp - 0x20]
push edx
push ebx
push edi
push str.FindApps
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call fcn.00447040
mov eax, dword [0x70f660]
cmp eax, edi
jne 0x44aedc
mov eax, 0x70f664
push eax
call fcn.004471a0
add esp, 4
test al, al
jne 0x44aef0
xor eax, eax
jmp 0x44b7bf
mov edx, dword [0x70f660]
cmp edx, edi
mov eax, edx
jne 0x44af01
mov eax, 0x70f664
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x44af04
sub eax, esi
sar eax, 1
cmp edx, edi
mov ecx, edx
jne 0x44af1e
mov ecx, 0x70f664
lea edx, [eax + eax + 2]
push edx
push ecx
push 1
push edi
push 0x658fb8
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea ecx, [ebp - 0x34]
call fcn.004024e0
mov byte [ebp - 4], 3
cmp dword [0x704d18], edi
je 0x44af5c
mov ecx, dword [0x70f7b4]
push ecx
push str._s_Trial
lea edx, [ebp - 0x34]
push edx
jmp 0x44af6b
mov eax, dword [0x70f7b4]
push eax
push str._s_Full
lea ecx, [ebp - 0x34]
push ecx
call fcn.00402f60
add esp, 0xc
mov dword [ebp - 0x74], 0x40
lea edx, [ebp - 0x74]
push edx
lea eax, [ebp + 0x884]
push eax
push edi
push edi
push str.idmvers
mov ecx, dword [ebp - 0x14]
push ecx
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call esi
test eax, eax
jne 0x44b016
mov edx, dword [0x70f7b4]
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x44afa7
sub eax, esi
push eax
push edx
lea edx, [ebp + 0x884]
push edx
call fcn.005f9ccb
add esp, 0xc
test eax, eax
je 0x44afcf
mov dword [0x70f5f4], 1
push 8
push str.v6.35b09
lea eax, [ebp + 0x884]
push eax
call fcn.005fd020
add esp, 0xc
test eax, eax
je 0x44b007
push 8
push str.v6.35b10
lea ecx, [ebp + 0x884]
push ecx
call fcn.005fd020
add esp, 0xc
test eax, eax
jne 0x44b0bb
mov dword [0x70f5f8], 1
jmp 0x44b0bb
lea edx, [ebp - 0x44]
push edx
lea eax, [ebp - 0x18]
push eax
push edi
push 0xf003f
push edi
push 0x64f8bc
push edi
push str.SoftwareDownloadManagermenuExt
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x44b0bb
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x24]
push edx
push edi
push edi
push str.ffdownlFLV_v
mov eax, dword [ebp - 0x18]
push eax
call esi
test eax, eax
je 0x44b078
mov dword [ebp - 0x24], 2
push ebx
lea ecx, [ebp - 0x24]
push ecx
push ebx
push edi
push str.ffdownlFLV_v
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x24]
push ecx
push edi
push edi
push str.ffdownl10FLV_v
mov edx, dword [ebp - 0x18]
push edx
call esi
test eax, eax
je 0x44b0b1
mov dword [ebp - 0x24], 2
push ebx
lea eax, [ebp - 0x24]
push eax
push ebx
push edi
push str.ffdownl10FLV_v
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x34]
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x44b0c3
sub eax, esi
inc eax
push eax
push edx
push 1
push edi
push str.idmvers
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push edi
push edi
push edi
push edi
push str.LstCheck
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x44b137
lea edx, [ebp + 0x960]
push edx
call fcn.005fcf0b
add esp, 4
lea eax, [ebp + 0x960]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x44b110
sub eax, edx
push eax
lea eax, [ebp + 0x960]
push eax
push 1
push edi
push str.LstCheck
mov ecx, dword [ebp - 0x14]
push ecx
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call esi
jmp 0x44b13d
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x30], ebx
lea edx, [ebp - 0x30]
push edx
lea eax, [ebp - 0x20]
push eax
push edi
push edi
push str.LaunchOnStart
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x44b17d
mov dword [ebp - 0x20], 1
push ebx
lea edx, [ebp - 0x20]
push edx
push ebx
push edi
push str.LaunchOnStart
mov eax, dword [ebp - 0x14]
push eax
call esi
cmp dword [ebp - 0x20], edi
je 0x44b298
push edi
lea ecx, [ebp - 0x1c]
push ecx
push edi
push 0xf003f
push edi
push edi
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x44b298
mov dword [ebp + 0x570], edi
mov dword [ebp + 0x578], edi
xor edx, edx
mov word [ebp + 0x574], dx
mov byte [ebp - 4], 4
mov eax, dword [0x70f660]
cmp eax, edi
jne 0x44b1d3
mov eax, 0x70f664
push edi
push eax
push str._s__onboot
lea ecx, [ebp + 0x570]
call fcn.00402190
mov byte [ebp - 0x39], 1
mov dword [ebp - 0x44], 0x410
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp + 0x148]
push ecx
push edi
push edi
push str.IDMan
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44b239
mov eax, dword [ebp + 0x570]
cmp eax, edi
jne 0x44b220
lea eax, [ebp + 0x574]
push eax
lea eax, [ebp + 0x148]
push eax
call fcn.005fdd2a
add esp, 8
test eax, eax
jne 0x44b239
mov byte [ebp - 0x39], al
jmp 0x44b289
mov edx, dword [ebp + 0x570]
cmp edx, edi
mov eax, edx
jne 0x44b24b
lea eax, [ebp + 0x574]
lea esi, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x44b250
sub eax, esi
sar eax, 1
cmp edx, edi
mov ecx, edx
jne 0x44b26b
lea ecx, [ebp + 0x574]
lea edx, [eax + eax + 2]
push edx
push ecx
push 1
push edi
push str.IDMan
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov byte [ebp - 4], 3
lea ecx, [ebp + 0x570]
call fcn.004011f0
mov dword [ebp - 0x20], 1
push edi
push edi
push edi
push edi
push str.RememberLastSave
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x44b2c8
push ebx
lea edx, [ebp - 0x20]
push edx
push ebx
push edi
push str.RememberLastSave
mov eax, dword [ebp - 0x14]
push eax
call esi
mov dword [ebp - 0x20], edi
push edi
push edi
push edi
push edi
push str.MonitorUrlClipboard
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x44b2f4
push ebx
lea edx, [ebp - 0x20]
push edx
push ebx
push edi
push str.MonitorUrlClipboard
mov eax, dword [ebp - 0x14]
push eax
call esi
mov dword [ebp - 0x20], edi
push edi
push edi
push edi
push edi
push str.UseHttpProxy
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x44b320
push ebx
lea edx, [ebp - 0x20]
push edx
push ebx
push edi
push str.UseHttpProxy
mov eax, dword [ebp - 0x14]
push eax
call esi
mov dword [ebp - 0x20], edi
push edi
push edi
push edi
push edi
push str.UseFtpProxy
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x44b34c
push ebx
lea edx, [ebp - 0x20]
push edx
push ebx
push edi
push str.UseFtpProxy
mov eax, dword [ebp - 0x14]
push eax
call esi
mov dword [ebp - 0x20], edi
push edi
push edi
push edi
push edi
push str.FtpPasive
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x44b378
push ebx
lea edx, [ebp - 0x20]
push edx
push ebx
push edi
push str.FtpPasive
mov eax, dword [ebp - 0x14]
push eax
call esi
cmp byte [ebp - 0x29], 0
je 0x44b388
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov dword [ebp - 0x38], edi
lea ecx, [ebp - 0x5c]
call fcn.0050bd00
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x6c]
call fcn.0050bd00
mov byte [ebp - 4], 6
push edi
cmp dword [0x704d18], edi
jne 0x44b559
lea edx, [ebp - 0x14]
push edx
push edi
push 0xf003f
push edi
push edi
push edi
mov eax, dword [0x710adc]
push eax
mov ecx, dword [0x70f5d4]
neg ecx
sbb ecx, ecx
add ecx, 0x80000002
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov esi, eax
neg esi
sbb esi, esi
inc esi
mov dword [ebp - 0x38], esi
cmp esi, edi
jne 0x44b677
lea ecx, [ebp - 0x18]
call fcn.004024e0
mov bl, 7
mov byte [ebp - 4], bl
cmp dword [0x70f5d4], edi
mov eax, str.CURRENT_USER
jne 0x44b40b
mov eax, str.MACHINE
mov edx, dword [0x710adc]
push edx
push eax
push 0x651d64
lea eax, [ebp - 0x18]
push eax
call fcn.00402f60
add esp, 0x10
mov ecx, dword [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x5c]
call fcn.0050bdf0
test eax, eax
je 0x44b469
push edi
lea edx, [ebp - 0x14]
push edx
push edi
push 0xf003f
push edi
push edi
push edi
mov eax, dword [0x710adc]
push eax
mov ecx, dword [0x70f5d4]
neg ecx
sbb ecx, ecx
add ecx, 0x80000002
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov esi, eax
neg esi
sbb esi, esi
inc esi
mov dword [ebp - 0x38], esi
cmp esi, edi
jne 0x44b65e
mov edx, dword [ebp - 0x18]
push edx
lea ecx, [ebp - 0x5c]
call fcn.0050bec0
test eax, eax
je 0x44b4bf
push edi
lea eax, [ebp - 0x14]
push eax
push edi
push 0xf003f
push edi
push edi
push edi
mov ecx, dword [0x710adc]
push ecx
mov edx, dword [0x70f5d4]
neg edx
sbb edx, edx
add edx, 0x80000002
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov esi, eax
neg esi
sbb esi, esi
inc esi
mov dword [ebp - 0x38], esi
cmp esi, edi
jne 0x44b65e
push edi
lea eax, [ebp - 0x14]
push eax
push edi
push 0xf003f
push edi
push edi
push edi
push str.SoftwareClassesCLSIDE6871B76_C3C8_44DD_B947_ABFFE144860D
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov esi, eax
neg esi
sbb esi, esi
inc esi
mov dword [ebp - 0x38], esi
cmp esi, edi
jne 0x44b65e
lea ecx, [ebp - 0x1c]
call fcn.004024e0
mov byte [ebp - 4], 8
push str.SoftwareClassesCLSIDE6871B76_C3C8_44DD_B947_ABFFE144860D
push str.CURRENT_USER_s
lea ecx, [ebp - 0x1c]
push ecx
call fcn.00402f60
add esp, 0xc
mov edx, dword [ebp - 0x1c]
push edx
lea ecx, [ebp - 0x6c]
call fcn.0050bdf0
test eax, eax
je 0x44b549
push edi
lea eax, [ebp - 0x14]
push eax
push edi
push 0xf003f
push edi
push edi
push edi
push str.SoftwareClassesCLSIDE6871B76_C3C8_44DD_B947_ABFFE144860D
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov esi, eax
neg esi
sbb esi, esi
inc esi
mov dword [ebp - 0x38], esi
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x1c]
call fcn.00402550
jmp 0x44b65e
lea ecx, [ebp - 0x14]
push ecx
push edi
push 0xf003f
push edi
push edi
push edi
mov edx, dword [0x710ae0]
push edx
xor eax, eax
cmp byte [0x70f5f0], al
setne al
add eax, 0x80000001
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov esi, eax
neg esi
sbb esi, esi
inc esi
mov dword [ebp - 0x38], esi
cmp esi, edi
jne 0x44b677
lea ecx, [ebp - 0x18]
call fcn.004024e0
mov byte [ebp - 4], 9
cmp byte [0x70f5f0], 0
mov eax, str.MACHINE
jne 0x44b5b5
mov eax, str.CURRENT_USER
mov ecx, dword [0x710ae0]
push ecx
push eax
push 0x651d64
lea edx, [ebp - 0x18]
push edx
call fcn.00402f60
add esp, 0x10
mov eax, dword [ebp - 0x18]
push eax
lea ecx, [ebp - 0x5c]
call fcn.0050bdf0
test eax, eax
je 0x44b614
push edi
lea ecx, [ebp - 0x14]
push ecx
push edi
push 0xf003f
push edi
push edi
push edi
mov edx, dword [0x710ae0]
push edx
xor eax, eax
cmp byte [0x70f5f0], al
setne al
add eax, 0x80000001
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov esi, eax
neg esi
sbb esi, esi
inc esi
mov dword [ebp - 0x38], esi
cmp esi, edi
jne 0x44b65e
mov ecx, dword [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x5c]
call fcn.0050bec0
test eax, eax
je 0x44b65e
push edi
lea edx, [ebp - 0x14]
push edx
push edi
push 0xf003f
push edi
push edi
push edi
mov eax, dword [0x710ae0]
push eax
xor ecx, ecx
cmp byte [0x70f5f0], cl
setne cl
add ecx, 0x80000001
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov esi, eax
neg esi
sbb esi, esi
inc esi
mov dword [ebp - 0x38], esi
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x18]
call fcn.00402550
cmp esi, edi
je 0x44b849
mov ebx, 4
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edi
push edi
push edi
push edi
push str.MData
mov edx, dword [ebp - 0x14]
push edx
call esi
cmp eax, edi
je 0x44b796
lea eax, [ebp - 0x44]
push eax
call fcn.005fbc53
lea ecx, [ebp - 0x44]
push ecx
call fcn.005fca9c
add esp, 8
mov edx, dword [eax + 0x1c]
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x30], ebx
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x4c]
push ecx
push edi
push edi
push str.Model
mov edx, dword [ebp - 0x14]
push edx
call esi
test eax, eax
je 0x44b6e7
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
push ebx
lea ecx, [ebp - 0x48]
push ecx
push ebx
push edi
push str.Model
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x30], ebx
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x18]
push ecx
push edi
push edi
push str.Therad
mov edx, dword [ebp - 0x14]
push edx
call esi
test eax, eax
je 0x44b7e4
mov dword [ebp - 0x18], 1
cmp dword [0x704d18], edi
je 0x44b778
lea eax, [ebp - 0x1c]
push eax
push 1
push edi
push str.SoftwareClassesCLSID84797876_C678_1780_A556_0CD06786780F
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x44b778
mov dword [ebp - 0x30], ebx
lea ecx, [ebp - 0x30]
push ecx
lea edx, [ebp - 0x40]
push edx
push edi
push edi
push str.Therad
mov eax, dword [ebp - 0x1c]
push eax
call esi
test eax, eax
jne 0x44b76e
mov eax, dword [ebp - 0x40]
cmp eax, 0x1e
jbe 0x44b75a
add eax, 0xffffffe2
jmp 0x44b75f
mov eax, 1
mov dword [ebp - 0x18], eax
cmp eax, 0x1a
jbe 0x44b76e
mov dword [ebp - 0x18], 0x1a
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
lea edx, [ebp - 0x18]
push edx
push ebx
push edi
push str.Therad
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x44b83f
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x6c]
call fcn.0050bd60
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x5c]
call fcn.0050bd60
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x34]
call fcn.00402550
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x9a8]
xor ecx, ebp
call fcn.005f85e7
add ebp, 0x9ac
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [0x704d1c]
jae 0x44b879
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x4c]
cmp eax, ecx
je 0x44b83f
jbe 0x44b80d
sub eax, ecx
cmp eax, 0x14
jbe 0x44b812
mov eax, 0x14
jmp 0x44b812
mov eax, 1
add dword [ebp - 0x18], eax
push ebx
lea edx, [ebp - 0x18]
push edx
push ebx
push edi
push str.Therad
mov eax, dword [ebp - 0x14]
push eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call esi
push ebx
lea ecx, [ebp - 0x48]
push ecx
push ebx
push edi
push str.Model
mov edx, dword [ebp - 0x14]
push edx
call esi
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x6c]
call fcn.0050bd60
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x5c]
call fcn.0050bd60
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x34]
call fcn.00402550
mov dword [ebp - 4], 0xffffffff
jmp 0x44b7ba
cmp dword [0x704d18], edi
jne 0x44bb02
lea ecx, [ebp - 0x24]
push ecx
push 1
push edi
push 0x64ed98
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, 0x32
test eax, eax
jne 0x44b9c5
mov dword [ebp - 0x28], esi
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp + 0x8c4]
push eax
push edi
push edi
mov ecx, dword [0x710d94]
push ecx
mov edx, dword [ebp - 0x24]
push edx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call ebx
test eax, eax
jne 0x44b9c5
mov dword [ebp - 0x28], esi
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp + 0x8f8]
push ecx
push edi
push edi
mov edx, dword [0x710d98]
push edx
mov eax, dword [ebp - 0x24]
push eax
call ebx
test eax, eax
jne 0x44b9c5
mov dword [ebp - 0x28], esi
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp + 0x92c]
push edx
push edi
push edi
mov eax, dword [0x710d9c]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call ebx
test eax, eax
jne 0x44b9c5
mov dword [ebp - 0x28], esi
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp + 0x974]
push eax
push edi
push edi
mov ecx, dword [0x710d90]
push ecx
mov edx, dword [ebp - 0x24]
push edx
call ebx
test eax, eax
jne 0x44b9c5
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp + 0x8c4]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x44b955
sub eax, edx
je 0x44b9c5
lea eax, [ebp + 0x8f8]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x44b970
sub eax, edx
je 0x44b9c5
lea eax, [ebp + 0x92c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x44b984
sub eax, edx
je 0x44b9c5
lea eax, [ebp + 0x974]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x44b998
sub eax, edx
mov bl, 0x2d
cmp eax, 0x17
jne 0x44b9c7
cmp byte [ebp + 0x979], bl
jne 0x44b9c7
cmp byte [ebp + 0x97f], bl
jne 0x44b9c7
cmp byte [ebp + 0x985], bl
jne 0x44b9c7
jmp 0x44b796
mov bl, 0x2d
push edi
lea ecx, [ebp - 0x24]
push ecx
push edi
push 0xf003f
push edi
push edi
push edi
push str.SoftwareDownloadManager_
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x44bb02
mov dword [ebp - 0x28], esi
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp + 0x8c4]
push eax
push edi
push edi
mov ecx, dword [0x710d94]
push ecx
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x44bb02
mov dword [ebp - 0x28], esi
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp + 0x8f8]
push ecx
push edi
push edi
mov edx, dword [0x710d98]
push edx
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x44bb02
mov dword [ebp - 0x28], esi
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp + 0x92c]
push edx
push edi
push edi
mov eax, dword [0x710d9c]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x44bb02
mov dword [ebp - 0x28], esi
lea edx, [ebp - 0x28]
push edx
lea eax, [ebp + 0x974]
push eax
push edi
push edi
mov ecx, dword [0x710d90]
push ecx
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x44bb02
lea eax, [ebp + 0x8c4]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x44ba95
sub eax, edx
je 0x44bb02
lea eax, [ebp + 0x8f8]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x44bab0
sub eax, edx
je 0x44bb02
lea eax, [ebp + 0x92c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x44bac4
sub eax, edx
je 0x44bb02
lea eax, [ebp + 0x974]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x44bad8
sub eax, edx
cmp eax, 0x17
jne 0x44bb02
cmp byte [ebp + 0x979], bl
jne 0x44bb02
cmp byte [ebp + 0x97f], bl
jne 0x44bb02
cmp byte [ebp + 0x985], bl
je 0x44b796
lea ecx, [ebp]
call fcn.0050c0a0
mov byte [ebp - 4], 0xa
mov ecx, dword [0x710e98]
lea edx, [ebp + 0x784]
lea ebx, [ebx]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x44bb20
mov edx, dword [0x710264]
mov eax, edx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x44bb35
sub eax, esi
push eax
push edx
push 0x100
lea eax, [ebp + 0x784]
push eax
lea ecx, [ebp + 0x508]
call fcn.00446ad0
mov byte [ebp + 0x883], 0
push 0x100
lea ecx, [ebp + 0x784]
push ecx
push edi
push edi
push str.MData
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
lea ecx, [ebp - 0x5c]
call fcn.0050bcb0
lea ecx, [ebp - 0x6c]
call fcn.0050bcb0
push edi
call dword [sym.imp.KERNEL32.dll_ExitProcess]