Function at 0x444680
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x486772
mov eax, dword fs:[0]
push eax
sub esp, 0xec
mov eax, dword [0x4c600c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ecx + 4], 1
mov eax, dword [ebp + 8]
mov dword [ebp - 0xac], eax
jne 0x4446c9
mov esi, str.HKCUEnvironment
mov edi, 0x10
jmp 0x4446d3
mov esi, str.HKLMSYSTEMCurrentControlSetControlSession_ManagerEnvironment
mov edi, 0x41
mov eax, 4
mov dword [ebp - 0x88], edi
mov ebx, str.PATH
mov dword [ebp - 0x8c], esi
mov dword [ebp - 0x98], ebx
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0x9c], 0
mov dword [ebp - 4], 1
mov dword [ebp - 0xbc], 0
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0xb4], 0
mov dword [ebp - 0xb0], 0
mov byte [ebp - 4], 3
cmp byte [0x4cb09f], 0
jne 0x44477f
push 0
push 0
push 6
call fcn.0041e080
add esp, 0xc
mov byte [0x4cb09e], al
xchg dword [ebp - 0xc8], eax
mov byte [0x4cb09f], 1
cmp byte [0x4cb09e], 0
jne 0x444a3a
mov eax, 0x17
mov dword [ebp - 0xd8], str.HKLMSYSTEMCurrentControlSetControlLsa
push 1
mov ebx, str.Authentication_Packages
mov dword [ebp - 0xd4], 0x29
push eax
mov esi, str.HKLMSYSTEMCurrentControlSetControlSession_Manager
mov dword [ebp - 0xe8], str.HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlLsa
mov edi, 0x35
mov dword [ebp - 0xd0], esi
push ebx
lea ecx, [ebp - 0x98]
mov dword [ebp - 0xcc], edi
mov dword [ebp - 0xe4], 0x37
mov dword [ebp - 0xe0], str.HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSession_Manager
mov dword [ebp - 0xdc], 0x43
mov dword [ebp - 0xf8], ebx
mov dword [ebp - 0x90], eax
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0xf0], str.PendingFileRenameOperations
mov dword [ebp - 0xec], 0x1b
call fcn.00417510
test eax, eax
jne 0x444829
mov eax, dword [ebp - 0x90]
jmp 0x44489e
push 1
push 0x1b
push str.PendingFileRenameOperations
lea ecx, [ebp - 0x98]
call fcn.00417510
test eax, eax
jne 0x44484d
mov ebx, str.PendingFileRenameOperations
mov eax, 0x1b
jmp 0x444898
push dword [ebp - 0x94]
lea ecx, [ebp - 0xbc]
push dword [ebp - 0x98]
call fcn.00410191
cmp dword [ebp - 0xb4], 0
mov eax, 0x4ca5a4
cmovne eax, dword [ebp - 0xb8]
push eax
call dword [sym.imp.USER32.dll_CharLowerW]
mov eax, dword [ebp - 0xb4]
test eax, eax
je 0x444891
mov ebx, dword [ebp - 0xb8]
dec eax
jmp 0x444898
xor eax, eax
mov ebx, 0x4ca5a8
mov dword [ebp - 0x90], eax
push 1
push 0x29
push str.HKLMSYSTEMCurrentControlSetControlLsa
lea ecx, [ebp - 0x8c]
mov dword [ebp - 0x98], ebx
mov dword [ebp - 0x94], eax
call fcn.00417510
test eax, eax
je 0x444a24
push 1
push 0x37
push str.HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlLsa
lea ecx, [ebp - 0x8c]
call fcn.00417510
test eax, eax
je 0x444a24
push 1
push edi
push esi
lea ecx, [ebp - 0x8c]
call fcn.00417510
test eax, eax
je 0x444a2e
push 1
push 0x43
push str.HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSession_Manager
lea ecx, [ebp - 0x8c]
call fcn.00417510
test eax, eax
je 0x444a2e
mov esi, dword [ebp - 0x88]
mov edi, dword [ebp - 0x8c]
cmp esi, 4
je 0x444937
jbe 0x4449cb
cmp word [edi + 8], 0x5c
jne 0x4449cb
push 1
push 4
push str.HKLM
lea ecx, [ebp - 0x8c]
call fcn.00417600
test al, al
je 0x444970
lea eax, [esi + 0xe]
push eax
lea ecx, [ebp - 0xa8]
call fcn.004101f8
push str.HKEY_LOCAL_MACHINE
lea ecx, [ebp - 0xa8]
call fcn.0043b900
jmp 0x4449a7
push 1
push 4
push str.HKCU
lea ecx, [ebp - 0x8c]
call fcn.00417600
test al, al
je 0x4449cb
lea eax, [esi + 0xd]
push eax
lea ecx, [ebp - 0xa8]
call fcn.004101f8
push str.HKEY_CURRENT_USER
lea ecx, [ebp - 0xa8]
call fcn.0043fcf0
mov ecx, 4
mov dword [ebp - 0xc4], edi
cmp esi, ecx
mov edx, esi
cmovb ecx, esi
sub edx, ecx
push edx
lea eax, [edi + ecx*2]
push eax
lea ecx, [ebp - 0xa8]
call fcn.00416670
mov ecx, dword [ebp - 0xa0]
test ecx, ecx
je 0x4449dc
lea eax, [ecx - 1]
test eax, eax
jne 0x4449ef
push esi
push edi
lea ecx, [ebp - 0xa8]
call fcn.00410191
mov ecx, dword [ebp - 0xa0]
test ecx, ecx
mov eax, 0x4ca5a4
cmovne eax, dword [ebp - 0xa4]
push eax
call dword [sym.imp.USER32.dll_CharLowerW]
lea eax, [ebp - 0xc4]
push eax
lea ecx, [ebp - 0xa8]
call fcn.0041011a
mov esi, dword [ebp - 0xc4]
mov edi, dword [ebp - 0xc0]
jmp 0x444a2e
mov esi, str.HKLMSYSTEMCurrentControlSetControlLsa
mov edi, 0x29
mov dword [ebp - 0x8c], esi
mov dword [ebp - 0x88], edi
mov ecx, dword [ebp - 0xac]
push 0x4e
call fcn.00410f2e
push ecx
mov ecx, dword [ebp - 0xac]
call fcn.00445110
lea eax, [edi + edi]
mov dword [ebp - 0x84], 0x67452301
push eax
mov edx, esi
mov dword [ebp - 0x80], 0xefcdab89
lea ecx, [ebp - 0x84]
mov dword [ebp - 0x7c], 0x98badcfe
mov dword [ebp - 0x78], 0x10325476
invalid
inc ebp
invalid
invalid
loope 0x444a56