Function at 0x449b34
Capabilities:
Delete registry value
Get disk information
Query or enumerate registry key
Resolve function by parsing pe exports
Resume thread
Start service

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x208
xor eax, eax
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], eax
push esi
mov dword [esp + 8], 3
mov esi, edx
push edi
mov dword [esp + 0x30], esi
cmp dword [esp + 0xc], eax
je 0x449b73
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], al
je 0x449b99
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
jmp 0x449b99
mov dword [esp + 0xc], eax
jmp 0x449b92
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], 0
je 0x449b8e
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
xor eax, eax
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0x2a
jg 0x449b79
mov eax, dword [0x15bdfa0]
xor edi, edi
inc edi
test al, 1
jne 0x449c29
or eax, edi
mov dword [0x15bdfa0], eax
xor eax, eax
push eax
push eax
mov dword [0x15bdfb0], eax
mov dword [0x15bdfb4], eax
call fcn.00423b2a
mov ecx, eax
mov dword [0x15bdfcc], 0x3f800000
mov dword [0x15bdfb0], ecx
xor eax, eax
mov dword [esp + 0x94], ecx
lea ecx, [esp + 0x94]
push ecx
push 0x10
push eax
mov dword [0x15bdfb8], eax
mov ecx, 0x15bdfb8
mov dword [0x15bdfc0], eax
mov dword [0x15bdfbc], eax
lea eax, [esp + 0xac]
push eax
call fcn.004238cf
push 0x4b24e1
mov dword [0x15bdfc4], 7
mov dword [0x15bdfc8], 8
call fcn.00496f8f
pop ecx
push 2
lea ecx, [esp + 0xbc]
call fcn.00422862
mov dword [esp + 0x18], 4
lea ecx, [esp + 0x170]
mov dword [esp + 0x28], 5
push edi
call fcn.00422862
xor eax, eax
mov dword [esp + 0x14], eax
jmp 0x449c6e
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0xb8]
mov dword [ecx + edx*4], edi
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x449c5c
mov dword [esp + 0x14], eax
jmp 0x449c91
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x170]
mov dword [ecx + edx*4], 0xfffffffd
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x449c7b
mov dword [esp + 0x18], eax
jmp 0x449d89
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x14], edi
mov dword [esp + 0x20], 0x62d17f49
mov dword [esp + 0x28], 5
mov dword [esp + 0x1c], eax
jmp 0x449cd5
mov ecx, dword [esp + 0x1c]
mov dword [esp + ecx*4 + 0x1d4], 0x392f
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 4
jl 0x449cc2
mov dword [esp + 0x14], edi
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0xb8]
sub edx, dword [ecx]
cmp edx, 0xfffffffc
jle 0x449d2b
mov dword [esp + 0xc], eax
jmp 0x449d1f
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], 0
je 0x449d1b
push eax
push 0x228a
push 0x9b1
push 0x3b2
call dword [sym.imp.GDI32.dll_SetViewportExtEx]
xor eax, eax
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jle 0x449cf8
mov dword [esp + 0x28], eax
jmp 0x449d66
mov dword [esp + 0x14], eax
jmp 0x449d44
cmp byte [esp + 0x13], 0
je 0x449d40
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
xor eax, eax
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
mov byte [esp + 0x13], al
jle 0x449d31
cmp byte [esp + 0x13], 0
je 0x449d66
push eax
push 0x11dd
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
xor eax, eax
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0x1d4]
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x28], ecx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jle 0x449ca0
lea ecx, [esp + 0x170]
call fcn.00422eed
lea ecx, [esp + 0xb8]
call fcn.00422eed
imul eax, dword [esp + 0x34], 0x2710
add eax, esi
mov dword [esp + 0x48], eax
lea eax, [esp + 0x48]
push eax
call fcn.0044b2ef
mov esi, dword [eax]
test esi, esi
je 0x449f2e
mov dword [esp + 0x1c], 0xffffffff
lea ecx, [esp + 0x10c]
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x1c], 4
push 2
call fcn.00422862
xor eax, eax
mov dword [esp + 0x18], eax
jmp 0x449e0e
mov ecx, dword [esp + 0x18]
mov dword [esp + ecx*4 + 0x1cc], 0xf0ea
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x449dfb
mov dword [esp + 0x18], eax
jmp 0x449e31
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x10c]
mov dword [ecx + edx*4], 0x999d94b4
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x449e1b
push 4
mov dword [esp + 0x1c], eax
pop edx
jmp 0x449e54
mov ecx, dword [esp + 0x18]
mov dword [esp + ecx*4 + 0x18c], 0xffffffff
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jl 0x449e41
mov dword [esp + 0x1c], eax
jmp 0x449eae
mov dword [esp + 0x30], 0x5121
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x30], eax
mov dword [esp + 0x30], 0xfffffff6
mov dword [esp + 0x30], 0x5b054dbb
mov dword [esp + 0xc], eax
jmp 0x449e9d
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0x1f0], 9
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x449e8a
dec dword [esp + 0x190]
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jle 0x449e60
mov dword [esp + 0x1c], eax
jmp 0x449f12
push 2
lea ecx, [esp + 0xe0]
call fcn.00422862
mov dword [esp + 0xc], 0
jmp 0x449ee8
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xdc]
mov dword [eax + ecx*4], 0xc58f5537
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x449ed2
mov eax, dword [esp + 0xdc]
mov ecx, dword [eax + 4]
mov eax, dword [esp + 0x10c]
mov dword [eax], ecx
lea ecx, [esp + 0xdc]
call fcn.00422eed
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xffffffff
jge 0x449eba
lea ecx, [esp + 0x10c]
call fcn.00422eed
mov dword [esp + 0x74], esi
jmp 0x44b215
push dword [esp + 0xa0]
movdqa xmm0, xmmword [0xaa8f70]
lea ecx, [esp + 0x190]
push ecx
xor eax, eax
mov dword [esp + 0x1c], 0xa3df
lea ecx, [esp + 0x184]
mov dword [esp + 0x20], edi
push ecx
push eax
lea ecx, [esp + 0x4c]
mov dword [esp + 0x4c], eax
movdqu xmmword [esp + 0x18c], xmm0
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
call fcn.0042415b
xor eax, eax
mov dword [esp + 0xc], eax
jmp 0x449f95
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0x1e4], 0x2978d8ef
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x449f82
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
mov edi, dword [esp + 0x3c]
mov dword [esp + 0x18], ecx
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
cmp edx, ecx
push 0
pop ecx
setge cl
mov dword [esp + 0x1c], edi
mov dword [esp + 0x28], ecx
xor edx, edx
mov ecx, dword [esp + 0x18]
cmp ecx, dword [esp + 0x28]
setg dl
mov dword [edi + 0xc], edx
mov dword [esp + 0x14], eax
jmp 0x44a0d2
mov dword [esp + 0x24], 0x56a0b349
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], 1
mov dword [esp + 0x24], 0x6a08376f
mov dword [esp + 0x24], 0xf3392002
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], 1
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x3c]
mov ecx, dword [ecx + edx*4]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x18], eax
jmp 0x44a0c3
mov dword [esp + 0x28], 0xeba4
mov dword [esp + 0xc], eax
jmp 0x44a046
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0x1a8], 0x3e8ce6fc
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x44a033
mov ecx, dword [edi + 0xc]
mov dword [esp + 0x28], ecx
cmp dword [esp + 0x28], eax
je 0x44a072
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x3c]
cmp dword [ecx + edx*4], eax
je 0x44a072
inc dword [esp + 0x20]
je 0x44a072
xor edi, edi
inc edi
jmp 0x44a074
mov edi, eax
mov esi, dword [esp + 0x14]
xor edx, edx
mov ecx, dword [esp + 0x1b0]
cmp ecx, 0x4b26
mov ecx, dword [esp + 0x18]
setg dl
imul edx, edi
mov edi, dword [esp + 0x1c]
add ecx, edx
xor edx, edx
cmp dword [edi + 0xc], ecx
mov ecx, dword [esp + 0x3c]
setne dl
imul edx, dword [ecx + esi*4]
mov dword [esp + 0x28], edx
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], 0
je 0x44a0bf
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x13
jl 0x44a025
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jle 0x449fdd
lea ecx, [esp + 0x3c]
call fcn.00422eed
mov eax, dword [0x15bdfa0]
test al, 2
jne 0x44a174
or eax, 2
mov dword [0x15bdfa0], eax
xor eax, eax
push eax
push eax
mov dword [0x15bdfd0], eax
mov dword [0x15bdfd4], eax
call fcn.00423b2a
mov ecx, eax
mov dword [0x15bdfec], 0x3f800000
mov dword [0x15bdfd0], ecx
xor eax, eax
mov dword [esp + 0x9c], ecx
lea ecx, [esp + 0x9c]
push ecx
push 0x10
push eax
mov dword [0x15bdfd8], eax
mov ecx, 0x15bdfd8
mov dword [0x15bdfe0], eax
mov dword [0x15bdfdc], eax
lea eax, [esp + 0x178]
push eax
call fcn.004238cf
push 0x4b24dc
mov dword [0x15bdfe4], 7
mov dword [0x15bdfe8], 8
call fcn.00496f8f
pop ecx
mov dword [esp + 0x14], 0x4bcd76ce
xor eax, eax
mov dword [esp + 0x1c], 2
mov dword [esp + 0x24], 0xc629c4dd
mov dword [esp + 0x24], 0xc869
mov dword [esp + 0x24], 4
mov dword [esp + 0x24], 0xfffffffc
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x24], 9
mov dword [esp + 0x24], 0xfffffff6
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x24], 0x8ff7673e
mov dword [esp + 0x24], 0xe12fd89d
push 0xfffffffffffffff8
mov dword [esp + 0x28], 0xbeb927ee
mov dword [esp + 0x10], eax
pop esi
jmp 0x44a1f6
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0xb0], esi
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x44a1e7
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x1c], eax
jmp 0x44a285
mov dword [esp + 0x24], eax
mov dword [esp + 0x24], 0x9229a275
mov dword [esp + 0x24], 0x5211521f
mov dword [esp + 0x24], 5
mov dword [esp + 0x24], 3
mov dword [esp + 0x24], 0xafe44fa3
mov dword [esp + 0x24], 0x9716e289
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x24], 0x99e68fc7
mov dword [esp + 0x28], 0x6d4f509e
inc dword [esp + 0x28]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + ecx*4 + 0xb0]
mov ecx, dword [esp + 0x1c]
mov dword [esp + ecx*4 + 0xb0], edx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 1
jle 0x44a21b
lea eax, [esp + 0x34]
xorps xmm0, xmm0
push eax
movdqu xmmword [esp + 0x68], xmm0
call fcn.0044b351
push 6
mov edi, dword [eax]
mov dword [esp + 0x1c], 1
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x24], 0x57440e70
pop eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x28], edi
mov dword [esp + 0x18], esi
jmp 0x44a2da
mov dword [esp + 0x20], 0x2cb51dba
dec dword [esp + 0x20]
inc dword [esp + 0x18]
cmp dword [esp + 0x18], eax
je 0x44a2ca
mov dword [esp + 0x18], 0xffffffe9
xor eax, eax
cmp dword [esp + 0x18], 0xffffffe4
je 0x44a440
mov dword [esp + 0x20], eax
mov dword [esp + 0xc], eax
jmp 0x44a30f
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0x2c], 0xf90edcad
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 1
jl 0x44a2ff
mov dword [esp + 0x2c], eax
jmp 0x44a412
mov dword [esp + 0x14], eax
mov dword [esp + 0x24], 0xc7527853
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
sub edx, ecx
mov dword [esp + 0x1c], edx
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x2c]
cmp dword [esp + 0x18], eax
jne 0x44a369
cmp dword [esp + 0x2c], eax
jne 0x44a369
mov esi, eax
jmp 0x44a36c
xor esi, esi
inc esi
mov dword [esp + 0x20], 0x1a35ca42
xor edx, edx
mov ecx, dword [esp + 0x14]
cmp esi, ecx
mov ecx, dword [esp + 0x20]
setne dl
cmp ecx, edx
push 0
pop ecx
setl cl
sub ecx, dword [esp + 0x14]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x20], ecx
cmp dword [esp + 0x1c], eax
je 0x44a3a9
cmp dword [esp + 0x20], eax
je 0x44a3a9
xor ecx, ecx
inc ecx
jmp 0x44a3ab
mov ecx, eax
mov dword [esp + 0x1c], ecx
xor edx, edx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x14]
cmp ecx, 1
mov ecx, dword [esp + 0x18]
setge dl
cmp edx, ecx
push 0
pop ecx
setl cl
xor edx, edx
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x20]
cmp ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
setl dl
add ecx, 0xffff7c65
add ecx, edx
jne 0x44a3fa
mov ecx, dword [esp + 0x24]
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x20], ecx
dec dword [esp + 0x2c]
cmp dword [esp + 0x2c], 0xffffffff
jg 0x44a31f
mov ecx, dword [esp + 0x2c]
cmp dword [esp + 0x2c], eax
je 0x44a42b
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0xc], ecx
dec dword [esp + 0x18]
jmp 0x44a2ea
cmp byte [ebp + 0xc], 0
jne 0x44a44e
test edi, edi
jne 0x44ad2f
mov ecx, 0x48d327cb
mov dword [esp + 0x74], ecx
mov dword [esp + 0x78], ecx
mov dword [esp + 0x7c], ecx
mov dword [esp + 0x80], ecx
mov dword [esp + 0x24], 0x8fc558ba
mov dword [esp + 0x20], 2
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], 0
je 0x44a497
push eax
push 0x1aa6
push 0x8aa
push 0x1f72
call dword [sym.imp.GDI32.dll_SetDIBColorTable]
dec dword [esp + 0x20]
lea eax, [esp + 0x200]
mov dl, byte [ebp + 0xc]
mov ecx, dword [esp + 0x34]
push eax
call fcn.0043c93d
mov esi, eax
lea edi, [esp + 0x68]
pop ecx
push 2
lea ecx, [esp + 0xd4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
mov dword [esp + 0x14], 7
push edi
call fcn.00422862
push 3
lea ecx, [esp + 0xc8]
call fcn.00422862
xor esi, esi
mov dword [esp + 0x20], 0x38425739
inc esi
lea ecx, [esp + 0xf4]
push esi
call fcn.00422862
xor eax, eax
mov dword [esp + 0x24], 7
mov dword [esp + 0x18], eax
jmp 0x44a51e
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0xd0]
mov dword [ecx + edx*4], 0xcb61d225
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x44a508
mov dword [esp + 0x18], eax
jmp 0x44a540
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0xc4]
mov dword [ecx + edx*4], 0x50faeb38
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x44a52a
mov dword [esp + 0x18], eax
jmp 0x44a563
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0xf4]
mov dword [ecx + edx*4], 0xe2e4ed
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x44a54d
mov dword [esp + 0x18], eax
jmp 0x44a582
mov ecx, dword [esp + 0x18]
mov dword [esp + ecx*4 + 0x19c], 0xfffffffd
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x44a56f
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0xd0]
push 0
mov dword [ecx + 4], 0x66c93ee3
mov ecx, dword [esp + 0x18]
cmp edx, ecx
pop ecx
setne cl
xor edx, edx
cmp ecx, esi
push 0
setle dl
sub edx, 0x16
sub edx, dword [esp + 0x18]
neg edx
sbb edx, edx
inc edx
imul edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x28], edx
xor edx, edx
cmp dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x18]
setle dl
cmp ecx, edx
mov ecx, dword [esp + 0xc8]
pop edx
setge dl
cmp edx, 0xfffffffc
mov dword [ecx], edx
mov ecx, dword [esp + 0x14]
sbb esi, esi
xor edx, edx
neg esi
cmp esi, ecx
push 0
setne dl
mov dword [esp + 0x24], edx
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0xf8]
cmp dword [ecx], edx
pop ecx
setne cl
mov dword [esp + 0x14], ecx
cmp dword [esp + 0x14], eax
jne 0x44a62d
cmp dword [esp + 0x20], eax
jne 0x44a62d
xor esi, esi
mov ecx, eax
inc esi
jmp 0x44a632
xor esi, esi
inc esi
mov ecx, esi
mov dword [esp + 0x1a0], ecx
mov dword [esp + 0x14], eax
jmp 0x44a65e
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], 0
je 0x44a65a
push 0x224c
push eax
push eax
push eax
call dword [sym.imp.GDI32.dll_CombineRgn]
xor eax, eax
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jle 0x44a63f
lea ecx, [esp + 0xf4]
call fcn.00422eed
lea ecx, [esp + 0xc4]
call fcn.00422eed
lea ecx, [esp + 0xd0]
call fcn.00422eed
cmp byte [ebp + 0xc], 0
je 0x44a880
cmp dword [esp + 0x6c], 0
je 0x44a880
mov dword [esp + 0xc], 0xffffffff
lea ecx, [esp + 0xe8]
push esi
call fcn.00422862
mov dword [esp + 0x20], 0xfffffff8
xor eax, eax
mov dword [esp + 0x24], esi
mov dword [esp + 0x1c], eax
jmp 0x44a6dc
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0xe8]
mov dword [ecx + edx*4], 0xc405b401
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jl 0x44a6c6
cmp dword [esp + 0xc], eax
je 0x44a6ff
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0xe8]
mov dword [ecx], edx
test edx, edx
je 0x44a6ff
cmp dword [esp + 0xc], eax
jne 0x44a701
mov esi, eax
mov ecx, dword [esp + 0xc]
xor edx, edx
mov ecx, dword [esp + 0xc]
test ecx, ecx
mov ecx, dword [esp + 0xc]
setg dl
mov dword [esp + 0x24], edx
xor edx, edx
cmp dword [esp + 0x24], ecx
setl dl
xor ecx, ecx
cmp esi, edx
setle cl
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x24], ecx
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], al
je 0x44a746
push eax
push eax
call dword [sym.imp.USER32.dll_CopyRect]
lea ecx, [esp + 0xe8]
call fcn.00422eed
mov eax, dword [esp + 0x70]
lea ecx, [esp + 0x160]
xor esi, esi
mov dword [esp + 0x78], eax
inc esi
mov dword [esp + 0x1c], esi
push edi
call fcn.00422862
xor eax, eax
mov dword [esp + 0x14], eax
jmp 0x44a78c
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x160]
mov dword [ecx + edx*4], 0x20fe6e32
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x44a776
mov dword [esp + 0x14], eax
jmp 0x44a7a7
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x1c4], eax
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x44a798
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], 0xfffffff7
jg 0x44a86c
mov edi, 0xce1e2c0d
mov dword [esp + 0x84], edi
mov dword [esp + 0x88], edi
mov dword [esp + 0x8c], edi
mov dword [esp + 0x90], edi
mov dword [esp + 0x24], 6
mov dword [esp + 0xc], 0x96c7979b
mov dword [esp + 0x24], 0xfffffffc
mov dword [esp + 0x88], esi
cmp dword [esp + 0x88], eax
jl 0x44a846
mov dword [esp + 0x20], esi
mov dword [esp + 0x20], eax
mov dword [esp + 0x20], esi
cmp dword [esp + 0x20], eax
jl 0x44a829
mov dword [esp + 0xc], 0x7e71f09a
dec dword [esp + 0xc]
dec dword [esp + 0x20]
jns 0x44a817
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], 0
je 0x44a83d
push eax
call dword [sym.imp.USER32.dll_DestroyAcceleratorTable]
xor eax, eax
dec dword [esp + 0x88]
jns 0x44a805
mov dword [esp + 0xc], eax
jmp 0x44a856
cmp dword [esp + 0x24], eax
jne 0x44a85d
dec dword [esp + 0xc]
cmp dword [esp + 0xc], 0xfffffff3
jg 0x44a84c
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xfffffff7
jle 0x44a7c1
lea ecx, [esp + 0x160]
call fcn.00422eed
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x7c], eax
mov edi, dword [esp + 0x28]
test edi, edi
jne 0x44ad2f
cmp dword [esp + 0x64], edi
jle 0x44ad2f
mov dword [esp + 0xc], 0x9dada439
mov dword [esp + 0xc], edi
jmp 0x44a8b3
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x13c], esi
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x44a8a4
mov byte [esp + 0x13], 0
cmp byte [esp + 0x13], 0
je 0x44a8d8
push 0x2633
push 0x1080
push 0
call dword [sym.imp.GDI32.dll_CreatePolygonRgn]
mov dword [esp + 0xc], 0
jmp 0x44a8f7
cmp dword [esp + 0x13c], 0
jne 0x44a8fe
mov eax, dword [esp + 0x13c]
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jle 0x44a8e2
mov dword [esp + 0xc], 0
jmp 0x44a91b
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x98], 0
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x44a908
cmp dword [esp + 0x98], 0
je 0x44a948
mov dword [esp + 0x24], 0x98a59c17
mov dword [esp + 0x20], 0xffffffff
mov eax, dword [esp + 0x24]
mov dword [esp + 0x20], eax
jmp 0x44a9e2
mov dword [esp + 0x14], 7
mov dword [esp + 0x14], 0xffffffe4
jmp 0x44a9a3
push esi
lea ecx, [esp + 0x104]
call fcn.00422862
mov dword [esp + 0xc], 0
jmp 0x44a984
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x100]
and dword [eax + ecx*4], 0
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x44a971
mov eax, dword [esp + 0x100]
lea ecx, [esp + 0x100]
dec dword [eax]
call fcn.00422eed
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0xffffffee
jne 0x44a95a
mov dword [esp + 0x14], 0
jmp 0x44a9db
mov byte [esp + 0x13], 0
cmp byte [esp + 0x13], 0
je 0x44a9d7
push 0
push 0x119e
push 0xe86
push 0x1dd7
call dword [sym.imp.KERNEL32.dll_RaiseException]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 8
jg 0x44a9b4
mov dword [esp + 0xc], 0x9b55bb2c
mov dword [esp + 0xc], 0
jmp 0x44aa1c
mov dword [esp + 0x1c], 0
mov dword [esp + 0x1c], 0xb
jmp 0x44aa11
cmp dword [esp + 0xc], 0
jne 0x44aa18
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xffffffed
jne 0x44aa06
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0xf
jne 0x44a9f4
cmp dword [esp + 0x68], 0
je 0x44ad2f
mov dword [esp + 0x14], 0x928c176b
mov dword [esp + 0x14], 0
cmp dword [esp + 0x14], 0x11
jl 0x44ab12
mov dword [esp + 0x1c], 8
lea ecx, [esp + 0x130]
push 4
call fcn.00422862
mov dword [esp + 0xc], 0
jmp 0x44aa7f
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x130]
mov dword [eax + ecx*4], 0xfffffffc
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 4
jl 0x44aa69
mov dword [esp + 0x1c], 0x18
cmp dword [esp + 0x1c], 0xfffffffa
jg 0x44aaf4
mov esi, dword [esp + 0x130]
push 1
lea ecx, [esp + 0x11c]
call fcn.00422862
mov dword [esp + 0xc], 0
jmp 0x44aaca
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x118]
mov dword [eax + ecx*4], 0x5d811f07
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 1
jl 0x44aab4
mov eax, dword [esp + 0x118]
lea ecx, [esp + 0x118]
mov eax, dword [eax]
mov dword [esi + 8], eax
call fcn.00422eed
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xfffffffa
jle 0x44aa9c
lea ecx, [esp + 0x130]
call fcn.00422eed
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0x11
jge 0x44aa49
xor esi, esi
inc esi
push esi
push 0x7e79
push 0x6c0c
push esi
push 0x52d6
push esi
push 0x21d
push 0x54bf
push dword [esp + 0x88]
call fcn.00448a0a
add esp, 0x24
push dword [esp + 0x68]
call fcn.0046298a
pop ecx
mov dword [esp + 0x1c], 7
lea ecx, [esp + 0x148]
mov dword [esp + 0x24], 0xfffffffb
mov edi, eax
push 4
mov dword [esp + 0x2c], eax
call fcn.00422862
mov dword [esp + 0xc], 0
jmp 0x44ab8f
push dword [esp + 0xc]
lea ecx, [esp + 0x14c]
call fcn.00422927
mov dword [eax], 0xfcfbce00
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 4
jl 0x44ab75
mov dword [esp + 0x1c], 0xffffffe2
jmp 0x44ad05
push 2
lea ecx, [esp + 0xa8]
call fcn.00422862
mov dword [esp + 0x14], 0
jmp 0x44abce
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x1b4], 0x9c3f
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x44abbb
mov dword [esp + 0x14], 0
jmp 0x44abf2
push dword [esp + 0x14]
call fcn.00422927
mov dword [eax], 0x23371247
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
lea ecx, [esp + 0xa4]
jl 0x44abdf
mov eax, dword [esp + 0x1c0]
mov esi, dword [esp + 0x1c]
push 0
dec esi
call fcn.00422927
mov dword [eax], esi
mov eax, 0xfff6
cmp eax, esi
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 1
setge cl
cmp dword [esp + 0x1c], ecx
je 0x44ac54
xor eax, eax
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], al
je 0x44acef
push eax
push eax
push eax
push eax
push eax
push eax
push 0x9ee
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x44aced
mov dword [esp + 0x24], 0xe012d2c8
lea ecx, [esp + 0x154]
mov dword [esp + 0x24], 7
mov dword [esp + 0x24], 0xd40a1650
mov dword [esp + 0x24], 0x1a7a81a8
push 3
call fcn.00422862
mov dword [esp + 0x20], 0x25189d9e
mov dword [esp + 0xc], 0
jmp 0x44acae
push dword [esp + 0xc]
lea ecx, [esp + 0x158]
call fcn.00422927
mov dword [eax], 0xf84255eb
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x44ac94
mov byte [esp + 0x13], 0
cmp byte [esp + 0x13], 0
je 0x44acdd
push 0xfe0
push 0x835
push 0xa40
push 0xee5
push 0
call dword [sym.imp.USER32.dll_SetRect]
dec dword [esp + 0x20]
lea ecx, [esp + 0x154]
call fcn.00422922
xor eax, eax
lea ecx, [esp + 0xa4]
cmp dword [esp + 0x1c], eax
jne 0x44ad12
call fcn.00422922
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0x16
jne 0x44aba3
jmp 0x44ad17
call fcn.00422922
lea ecx, [esp + 0x148]
call fcn.00422922
lea eax, [esp + 0x34]
push eax
call fcn.0044b351
mov dword [eax], edi
mov dword [esp + 0xc], 5
lea ecx, [esp + 0x124]
xor esi, esi
mov dword [esp + 0x1c], 0
inc esi
mov dword [esp + 0x20], 0x94b2ab76
mov dword [esp + 0x20], esi
push 2
call fcn.00422862
mov dword [esp + 0x1c], 0
jmp 0x44ad80
push dword [esp + 0x1c]
lea ecx, [esp + 0x128]
call fcn.00422927
mov dword [eax], 0xfffffff8
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jl 0x44ad66
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
neg ecx
mov dword [esp + 0x1c], eax
sbb ecx, ecx
xor edx, edx
neg ecx
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
cmp ecx, eax
setne dl
add edx, 2
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
imul edx, dword [esp + 0x20]
mov eax, dword [esp + 0xc]
cmp edx, eax
mov eax, dword [esp + 0xc]
setg cl
xor edx, edx
cmp ecx, eax
setl dl
cmp dword [esp + 0x1c], 0xfffffffa
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, edx
setge cl
mov dword [esp + 0x20], ecx
cmp dword [esp + 0x20], 0
je 0x44adfd
mov byte [esp + 0x13], 0
cmp byte [esp + 0x13], 0
je 0x44ae4b
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
jmp 0x44ae4b
mov dword [esp + 0x1c], 0
jmp 0x44ae21
push dword [esp + 0x1c]
lea ecx, [esp + 0x128]
call fcn.00422927
mov dword [eax], 0x700d62e6
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jl 0x44ae07
mov byte [esp + 0x13], 0
cmp byte [esp + 0x13], 0
je 0x44ae4b
push 0
push 0x119e
push 0xe86
push 0x1dd7
call dword [sym.imp.KERNEL32.dll_RaiseException]
lea ecx, [esp + 0x124]
call fcn.00422922
lea ecx, [esp + 0x64]
call fcn.004451e4
test edi, edi
je 0x44b215
push 4
lea ecx, [esp + 0x5c]
call fcn.00422862
mov dword [esp + 0x18], 0xfffffffb
mov dword [esp + 0x1c], 0xfffffffc
mov dword [esp + 0x14], 0
mov dword [esp + 0x20], esi
mov dword [esp + 0xc], 0
cmp dword [esp + 0xc], 4
jge 0x44aeba
push dword [esp + 0xc]
lea ecx, [esp + 0x5c]
call fcn.00422927
push 4
pop ecx
mov dword [eax], ecx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ecx
jl 0x44ae9e
mov dword [esp + 0x18], 3
cmp dword [esp + 0x18], 0
jl 0x44b097
mov dword [esp + 0xc], 0xd013d0bb
lea ecx, [esp + 0x4c]
push 2
call fcn.00422862
mov dword [esp + 0xc], 0
jmp 0x44af01
push dword [esp + 0xc]
lea ecx, [esp + 0x50]
call fcn.00422927
mov dword [eax], 0xfffffffd
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x44aeea
push dword [esp + 0x18]
lea ecx, [esp + 0x5c]
call fcn.00422927
cmp dword [eax], 0
je 0x44b066
push dword [esp + 0x18]
lea ecx, [esp + 0x5c]
call fcn.00422927
push dword [esp + 0x18]
lea ecx, [esp + 0x5c]
mov esi, dword [eax]
call fcn.00422927
mov dword [eax], esi
test esi, esi
je 0x44af70
push dword [esp + 0x18]
lea ecx, [esp + 0x5c]
call fcn.00422927
cmp dword [eax], 0
jne 0x44af5d
cmp dword [esp + 0x18], 0
jne 0x44af5d
xor eax, eax
jmp 0x44af60
xor eax, eax
inc eax
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], 0
je 0x44af70
xor eax, eax
inc eax
jmp 0x44af72
xor eax, eax
mov dword [esp + 0xc], eax
lea ecx, [esp + 0x4c]
push 1
call fcn.00422927
push 0
lea ecx, [esp + 0x50]
mov edi, eax
call fcn.00422927
mov edx, dword [esp + 0xc]
mov esi, eax
imul edx, dword [edi]
xor eax, eax
mov ecx, dword [esp + 0x18]
add edx, dword [esi]
cmp edx, ecx
setle al
add eax, dword [esi]
neg eax
sbb eax, eax
inc eax
mov dword [edi], eax
je 0x44afb3
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x18]
sub edx, 0x4128
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
add edx, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp eax, edx
setg cl
xor esi, esi
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x20]
cmp dword [esp + 0x14], eax
je 0x44b065
inc esi
mov dword [esp + 0x24], 0xd37f4a1d
mov dword [esp + 0xc], esi
js 0x44b05b
mov dword [esp + 0x14], esi
cmp dword [esp + 0x14], 0
jl 0x44b055
push dword [esp + 0xc]
lea ecx, [esp + 0x50]
call fcn.00422927
cmp dword [eax], 0
jne 0x44b055
mov dword [esp + 0x1c], 3
cmp dword [esp + 0x1c], 0
jl 0x44b04f
push dword [esp + 0x14]
lea ecx, [esp + 0x50]
call fcn.00422927
and dword [eax], 0
mov byte [esp + 0x13], 0
cmp byte [esp + 0x13], 0
je 0x44b049
push 0x1309
push 0
call dword [sym.imp.USER32.dll_CharUpperBuffW]
dec dword [esp + 0x1c]
jns 0x44b020
dec dword [esp + 0x14]
jns 0x44afff
dec dword [esp + 0xc]
jns 0x44aff4
mov dword [esp + 0x24], 0xfffffffe
jmp 0x44b075
inc esi
mov dword [esp + 0x24], 0xffffffff
cmp dword [esp + 0x24], 0
jne 0x44b08a
lea ecx, [esp + 0x4c]
call fcn.00422922
dec dword [esp + 0x18]
jns 0x44aecd
jmp 0x44b093
lea ecx, [esp + 0x4c]
call fcn.00422922
mov edi, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
xor edx, edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], esi
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
cmp ecx, eax
mov eax, dword [esp + 0x20]
setg dl
xor ecx, ecx
cmp edx, eax
setg cl
sub ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
neg ecx
sbb ecx, ecx
inc ecx
sub eax, ecx
jne 0x44b0d4
cmp dword [esp + 0x1c], eax
je 0x44b0d6
mov eax, esi
cmp dword [esp + 0x18], eax
jge 0x44b0f0
push 0
lea ecx, [esp + 0x5c]
call fcn.00422927
cmp dword [eax], 0
jne 0x44b0f0
xor ecx, ecx
jmp 0x44b0f2
mov ecx, esi
mov eax, dword [esp + 0x20]
sub ecx, eax
sub ecx, dword [esp + 0x20]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x58]
call fcn.00422922
mov edx, dword [esp + 0x30]
mov ecx, edi
call fcn.00449b2a
mov esi, eax
mov dword [esp + 0x14], 1
xor eax, eax
mov dword [esp + 0x20], 6
mov dword [esp + 0x74], esi
mov dword [esp + 0x20], eax
jmp 0x44b147
mov ecx, dword [esp + 0x20]
mov dword [esp + ecx*4 + 0x38], 1
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 1
jl 0x44b137
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], al
je 0x44b162
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
xor eax, eax
mov dword [esp + 0x14], eax
jmp 0x44b1fe
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x20], 0x9beab1d6
mov ecx, dword [esp + 0x28]
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x20], 0xffffffff
cmp dword [esp + 0x20], eax
je 0x44b1b2
cmp dword [esp + 0x28], eax
je 0x44b1b2
cmp dword [esp + 0x20], eax
je 0x44b1b2
xor ecx, ecx
inc ecx
jmp 0x44b1b4
mov ecx, eax
mov dword [esp + 0x28], ecx
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x14]
cmp edx, ecx
push 0
pop ecx
setle cl
mov dword [esp + 0x20], ecx
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x14]
cmp edx, ecx
push 0
pop ecx
setl cl
mov dword [esp + 0x38], ecx
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], 0
je 0x44b1fa
push eax
push 0x34d
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
xor eax, eax
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xfffffff5
jne 0x44b16b
lea eax, [esp + 0x48]
push eax
call fcn.0044b2ef
mov dword [eax], esi
mov eax, dword [ebp + 8]
lea esi, [esp + 0x74]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov esp, ebp
pop ebp
ret