Function at 0x403eb5
Capabilities:
Accept command line arguments
Authenticate hmac
Get number of processors
Parse pe header
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
jmp 0x403efa
sub edx, ebx
push ebp
mov ebp, esp
sub edi, eax
sub esp, 0x28
mov edx, pe_nt_image_headers32
test edx, edx
ja 0x403f24
mov eax, 0x200
xor eax, eax
xor dword [ebp - 0x1c], 0xffff
or dword [ebp - 0x18], 0xffffff
xor eax, eax
push 8
push dword fs:[0x30]
sub dword [ebp - 0x30], 0x15d45
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x4057e0
push 0x21
push 0x38
lea ecx, [ebp - 0x18]
push ecx
push 0x57
push edi
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x7d
push 0x61
push eax
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x61
push 0xd
lea eax, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x15
lea edx, [ebp - 0x1c]
push edx
push 0x42
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x31
lea edx, [ebp - 0x20]
push edx
push 0x31
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x75
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
lea ecx, [ebp - 0x20]
push ecx
lea eax, [ebp - 0x20]
push eax
push edx
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x43
push 0x3b
push 0x7e
push 0x18
push edi
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x52
push 0x1a
lea edi, [ebp - 0x1c]
push edi
push 0x34
push 0x7e
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x39
push 0x76
lea edi, [ebp - 0x18]
push edi
push 0x18
push edi
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x52
lea edi, [ebp - 0x20]
push edi
push 0x10
push 0x79
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x12
lea ecx, [ebp - 0x18]
push ecx
push 0x2b
push edx
call dword [sym.imp.shlwapi.dll_SHSetValueA]
lea eax, [ebp - 0x18]
push eax
push 0x47
lea esi, [ebp - 0x1c]
push esi
push 0x7c
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x22
lea edx, [ebp - 0x18]
push edx
push 0x3f
push ecx
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x75
push eax
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x12
push esi
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x13
push 0x4f
push 0x1c
push edx
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x74
lea esi, [ebp - 0x1c]
push esi
push 0x47
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x33
lea ecx, [ebp - 0x1c]
push ecx
lea edi, [ebp - 0x18]
push edi
push 0x48
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
lea esi, [ebp - 0x20]
push esi
push 3
push esi
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
lea edi, [ebp - 0x1c]
push edi
lea edx, [ebp - 0x18]
push edx
push 0x4f
push ecx
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x2b
lea ecx, [ebp - 0x1c]
push ecx
lea esi, [ebp - 0x1c]
push esi
push 0x1b
push esi
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x69
lea edi, [ebp - 0x18]
push edi
push 0x5b
push ecx
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x7c
lea edi, [ebp - 0x20]
push edi
push 0x16
push esi
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x14
push 0x51
push 0x2e
push 0xb
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 6
lea edi, [ebp - 0x18]
push edi
push 0x43
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
lea edi, [ebp - 0x20]
push edi
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x39
lea edi, [ebp - 0x1c]
push edi
push ecx
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x39
push 0x7a
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x20]
push ecx
push 0x3a
push ecx
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x4f
push 0x4c
lea edi, [ebp - 0x18]
push edi
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x76
push 0x43
lea edx, [ebp - 0x18]
push edx
push 0x25
push edx
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x20
lea eax, [ebp - 0x20]
push eax
lea edi, [ebp - 0x18]
push edi
push 0x40
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x67
lea edi, [ebp - 0x1c]
push edi
lea ecx, [ebp - 0x1c]
push ecx
push eax
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x64
push 0x29
lea edi, [ebp - 0x1c]
push edi
push 0x2a
push 0x36
push edx
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x60
push 0x1b
push 0x4c
push edi
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x55
lea ecx, [ebp - 0x20]
push ecx
push ecx
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x32
push 0x6c
lea edx, [ebp - 0x20]
push edx
push 0x37
lea edx, [ebp - 0x1c]
push edx
push 0x64
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x19
lea ecx, [ebp - 0x20]
push ecx
push 0x7a
push edi
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x56
push 0x37
push eax
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x65
lea edi, [ebp - 0x18]
push edi
push eax
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x1b
lea edi, [ebp - 0x1c]
push edi
push 0x62
push edi
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 8
push 0x65
lea edi, [ebp - 0x18]
push edi
lea edx, [ebp - 0x18]
push edx
push 0xd
push esi
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x57
lea eax, [ebp - 0x20]
push eax
push 0x2c
push edi
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x37
lea edi, [ebp - 0x20]
push edi
push 0x37
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x70
lea eax, [ebp - 0x20]
push eax
push 0x44
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x57
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x26
push 0x32
push 0x62
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x62
push 0x28
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x4f
push 0x48
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.shlwapi.dll_SHSetValueA]
lea edx, [ebp - 0x1c]
push edx
lea edi, [ebp - 0x18]
push edi
push ecx
call dword [sym.imp.shlwapi.dll_SHSetValueA]
lea ecx, [ebp - 0x1c]
push ecx
push eax
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x57
push 0x22
lea edx, [ebp - 0x1c]
push edx
push 0x2b
push eax
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x34
lea edx, [ebp - 0x20]
push edx
push edi
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x4d
lea edi, [ebp - 0x1c]
push edi
push edi
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x12
push 0x44
push 0x14
push 0x74
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x70
push 0x3e
lea edx, [ebp - 0x18]
push edx
push 0x5f
lea eax, [ebp - 0x20]
push eax
push 0x39
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x3c
lea esi, [ebp - 0x20]
push esi
push 0x37
lea esi, [ebp - 0x20]
push esi
push 0x20
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x34
push 0x30
lea edx, [ebp - 0x20]
push edx
push 0x50
lea edi, [ebp - 0x1c]
push edi
push 0x2f
push ecx
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x74
push 0x5a
lea eax, [ebp - 0x18]
push eax
push 0x57
push 0x76
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x71
lea eax, [ebp - 0x18]
push eax
lea edi, [ebp - 0x1c]
push edi
push 0x7c
push esi
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x21
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x75
lea edx, [ebp - 0x1c]
push edx
push 0x7f
lea edx, [ebp - 0x1c]
push edx
push 0x75
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x3d
lea ecx, [ebp - 0x20]
push ecx
push 0x10
push 0x63
push edi
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
lea esi, [ebp - 0x1c]
push esi
push ecx
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 2
push 3
lea edi, [ebp - 0x20]
push edi
push 0x65
push 0x7c
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x14
push 0x3f
push 0x5e
push eax
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x43
push 2
push ecx
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
lea ecx, [ebp - 0x1c]
push ecx
push 0x6c
push 0x1d
push esi
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x15
lea eax, [ebp - 0x20]
push eax
push 0x30
push ecx
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x4d
lea esi, [ebp - 0x20]
push esi
lea eax, [ebp - 0x1c]
push eax
push 0x2f
push esi
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
lea edi, [ebp - 0x20]
push edi
push 0x14
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
lea eax, [ebp - 0x1c]
push eax
push 0x44
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0xd
lea eax, [ebp - 0x1c]
push eax
push 0x61
push ecx
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x48
lea ecx, [ebp - 0x18]
push ecx
push 2
push 0xf
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x38
push 0x6a
push 0x62
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x6d
push 1
push edi
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x1d
push 0x6f
lea esi, [ebp - 0x18]
push esi
push 0x23
push 0x57
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x7f
lea edi, [ebp - 0x20]
push edi
push 0x79
lea esi, [ebp - 0x18]
push esi
push 0x76
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
lea ecx, [ebp - 0x18]
push ecx
push 0x3f
push edi
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x5d
lea edx, [ebp - 0x20]
push edx
push 0x54
push edi
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x19
push 0x4b
push edx
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x69
push 8
lea eax, [ebp - 0x20]
push eax
lea edi, [ebp - 0x1c]
push edi
push 0x21
push eax
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x74
lea edx, [ebp - 0x20]
push edx
lea ecx, [ebp - 0x20]
push ecx
push edi
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x3f
lea eax, [ebp - 0x1c]
push eax
push 0x74
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x10
lea edi, [ebp - 0x18]
push edi
push 0x12
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x5e
lea edi, [ebp - 0x20]
push edi
push 0x46
call dword [sym.imp.shlwapi.dll_SHSetValueA]
lea eax, [ebp - 0x20]
push eax
push 0x3b
lea edi, [ebp - 0x20]
push edi
push ecx
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x41
lea edx, [ebp - 0x1c]
push edx
push edi
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x59
push 0x2a
push edi
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x11
push 2
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x18]
push eax
push 0xb
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x18
lea edi, [ebp - 0x20]
push edi
push 0x2d
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x4d
push 0x52
push esi
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x3b
lea ecx, [ebp - 0x20]
push ecx
push 0
push eax
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x52
push 0x71
push 0x7f
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x11
lea edx, [ebp - 0x20]
push edx
push 0x4c
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x54
call dword [sym.imp.shlwapi.dll_SHSetValueA]
lea edx, [ebp - 0x18]
push edx
push 7
push edi
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
lea esi, [ebp - 0x1c]
push esi
lea ecx, [ebp - 0x1c]
push ecx
push ecx
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x17
lea esi, [ebp - 0x1c]
push esi
push 0x4c
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x7f
push 0x3a
lea ecx, [ebp - 0x20]
push ecx
push edi
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x7c
lea ecx, [ebp - 0x1c]
push ecx
push 0x40
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 2
push 0x2c
lea edx, [ebp - 0x18]
push edx
push 0x1e
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x52
lea esi, [ebp - 0x1c]
push esi
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x55
push 0x75
push 0x77
lea esi, [ebp - 0x20]
push esi
push 0x35
push edi
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 9
push 0x41
lea esi, [ebp - 0x1c]
push esi
push 0
lea edx, [ebp - 0x20]
push edx
push eax
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
lea edi, [ebp - 0x18]
push edi
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x59
push 3
lea edx, [ebp - 0x1c]
push edx
push ecx
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x15
push 0x55
push 0x14
lea ecx, [ebp - 0x18]
push ecx
push esi
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x6e
lea edx, [ebp - 0x1c]
push edx
push 0x47
lea edi, [ebp - 0x18]
push edi
push 0x6a
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x51
push 7
push edi
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x1e
push 0x1a
lea edi, [ebp - 0x18]
push edi
push ecx
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x34
lea edx, [ebp - 0x18]
push edx
push 0x13
push 0x56
push edi
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x14
lea edi, [ebp - 0x18]
push edi
lea edx, [ebp - 0x1c]
push edx
push eax
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x40
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x22
lea edi, [ebp - 0x18]
push edi
push 0x42
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x7c
push 0x29
lea edi, [ebp - 0x20]
push edi
push ecx
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x78
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x7d
push 0x19
lea esi, [ebp - 0x1c]
push esi
lea edi, [ebp - 0x18]
push edi
push 6
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x6b
push 0x13
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
lea edx, [ebp - 0x1c]
push edx
push 0x2e
push ecx
call dword [sym.imp.shlwapi.dll_SHSetValueA]
lea edi, [ebp - 0x1c]
push edi
push 0x4c
push edi
call dword [sym.imp.shlwapi.dll_SHSetValueA]
lea edi, [ebp - 0x1c]
push edi
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x77
push 0x3b
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x16
lea edi, [ebp - 0x1c]
push edi
lea esi, [ebp - 0x20]
push esi
push ecx
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x64
push 0x1c
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x68
push 0x74
push 0x5d
lea esi, [ebp - 0x18]
push esi
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
lea esi, [ebp - 0x18]
push esi
push 0x6c
push esi
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x69
push 0x7f
push 0x75
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x21
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x3c
push 0x5c
push ecx
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x7a
push 0x21
lea edi, [ebp - 0x20]
push edi
push 0x7d
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x20
push 0x42
lea edi, [ebp - 0x20]
push edi
push 0x4b
push edi
call dword [sym.imp.shlwapi.dll_SHSetValueA]
lea edi, [ebp - 0x20]
push edi
push 0x71
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x5d
push 0x63
push 4
push edi
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x6b
push 0x60
lea eax, [ebp - 0x1c]
push eax
push ecx
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x36
push 0x30
push 0x7b
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x5d
push 0x26
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x13
push 0x58
lea eax, [ebp - 0x18]
push eax
push 0xd
push edi
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x56
push 0x3b
lea edx, [ebp - 0x20]
push edx
push 0x26
push edi
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x56
lea esi, [ebp - 0x18]
push esi
lea ecx, [ebp - 0x20]
push ecx
push 0x15
push esi
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 7
lea esi, [ebp - 0x18]
push esi
lea esi, [ebp - 0x1c]
push esi
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x5e
lea edi, [ebp - 0x20]
push edi
push 0x48
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x3d
push 0x3f
lea eax, [ebp - 0x1c]
push eax
push 0x26
lea ecx, [ebp - 0x1c]
push ecx
push 0x40
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x30
push 0xf
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0xb
push 0x7f
lea esi, [ebp - 0x20]
push esi
push edi
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x77
push 4
push 0x2d
push esi
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x18
lea edi, [ebp - 0x18]
push edi
push 0x6e
lea esi, [ebp - 0x1c]
push esi
push 0x7f
push eax
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 9
push 0x39
lea edi, [ebp - 0x1c]
push edi
push 0x1a
push eax
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0xa
lea eax, [ebp - 0x20]
push eax
lea esi, [ebp - 0x20]
push esi
push 0x50
push ecx
call dword [sym.imp.shlwapi.dll_SHSetValueA]
lea edi, [ebp - 0x1c]
push edi
push eax
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x4c
lea edx, [ebp - 0x1c]
push edx
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0xe
push 0x55
lea edi, [ebp - 0x20]
push edi
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x57
push 0x65
push edi
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x38
push 0x26
push 0x66
lea esi, [ebp - 0x18]
push esi
push 0x3c
push eax
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x38
lea eax, [ebp - 0x1c]
push eax
push 6
push edi
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0xe
lea edi, [ebp - 0x1c]
push edi
push eax
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
call dword [sym.imp.shlwapi.dll_SHSetValueA]
lea edi, [ebp - 0x18]
push edi
push 0x16
lea ecx, [ebp - 0x1c]
push ecx
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x5b
push 0x11
push 0x41
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x31
push 0x4f
lea ecx, [ebp - 0x18]
push ecx
push 0x4f
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x7c
lea edi, [ebp - 0x1c]
push edi
push 0x4c
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x1b
lea esi, [ebp - 0x20]
push esi
push 0x46
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x77
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0xf
push 0x66
push 0x1d
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
lea edi, [ebp - 0x1c]
push edi
push ecx
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x31
push 0x1e
lea ecx, [ebp - 0x18]
push ecx
lea edi, [ebp - 0x1c]
push edi
push 9
push esi
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x69
lea edi, [ebp - 0x18]
push edi
push 0x76
push edx
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x13
lea edi, [ebp - 0x18]
push edi
push 0x69
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x6a
push 0x1b
lea esi, [ebp - 0x1c]
push esi
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x18
push 0x17
lea eax, [ebp - 0x18]
push eax
lea edi, [ebp - 0x18]
push edi
push 4
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x3b
lea eax, [ebp - 0x1c]
push eax
push edx
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x72
push edx
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x7e
lea edi, [ebp - 0x18]
push edi
push 0x29
lea esi, [ebp - 0x18]
push esi
push 8
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x36
push 0x6f
push 0x65
push 0x72
push edi
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x3d
push 0x1d
push edx
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x6f
push 0x78
lea esi, [ebp - 0x1c]
push esi
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x24
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x57
push 0x41
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x2d
push 4
call dword [sym.imp.shlwapi.dll_SHSetValueA]
lea edi, [ebp - 0x20]
push edi
push 0x52
push ecx
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x16
lea esi, [ebp - 0x18]
push esi
lea edx, [ebp - 0x18]
push edx
push 6
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
lea eax, [ebp - 0x18]
push eax
lea edi, [ebp - 0x18]
push edi
push edx
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0xa
lea edi, [ebp - 0x18]
push edi
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x70
push 0x79
lea edi, [ebp - 0x18]
push edi
push 0x59
push edx
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x60
push 0xb
push edi
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 1
lea esi, [ebp - 0x18]
push esi
lea edi, [ebp - 0x1c]
push edi
push 0x53
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x44
push esi
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x12
push 0x48
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x69
push 0xa
push 0x62
push edi
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x6e
lea edi, [ebp - 0x20]
push edi
lea edi, [ebp - 0x18]
push edi
push 0x6e
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x42
push 0x29
push 0x10
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x39
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
lea eax, [ebp - 0x18]
push eax
push 0x3f
push ecx
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push eax
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x3a
push 3
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x4d
push 0x27
push 0x5c
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x7e
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0xf
lea edi, [ebp - 0x20]
push edi
push 0x5a
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x4e
push 0x5a
lea edi, [ebp - 0x18]
push edi
push 3
push edi
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
lea edi, [ebp - 0x1c]
push edi
push 0x44
push edi
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x12
push 0x66
lea ecx, [ebp - 0x20]
push ecx
push 0x6e
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x7f
push edi
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
lea eax, [ebp - 0x20]
push eax
push 0x18
lea eax, [ebp - 0x20]
push eax
push 0x29
push edi
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x48
lea edi, [ebp - 0x18]
push edi
push 0x43
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x32
push 0xb
lea esi, [ebp - 0x1c]
push esi
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x7d
lea edi, [ebp - 0x1c]
push edi
lea esi, [ebp - 0x18]
push esi
push 0x43
push edx
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x7d
push 0x25
push 2
push 0x73
push eax
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x26
lea edx, [ebp - 0x1c]
push edx
lea edi, [ebp - 0x1c]
push edi
push 0x20
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x41
push 0xf
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
lea esi, [ebp - 0x20]
push esi
push 0x6c
lea edi, [ebp - 0x18]
push edi
push 0x7a
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x15
push 0xd
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x35
push 0x6b
lea esi, [ebp - 0x20]
push esi
push 0x1a
push 0x27
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x28
push 0x68
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.shlwapi.dll_SHSetValueA]
lea edi, [ebp - 0x1c]
push edi
push 0x37
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x75
push 0xf
push 0x74
push 0x29
push esi
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x4e
push 0x10
lea eax, [ebp - 0x20]
push eax
push 0x75
push eax
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x72
lea edi, [ebp - 0x20]
push edi
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x35
lea ecx, [ebp - 0x1c]
push ecx
push 5
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x7f
push 0x43
push edx
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x68
lea edi, [ebp - 0x20]
push edi
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x4b
lea edi, [ebp - 0x1c]
push edi
push 0x73
push eax
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
lea edx, [ebp - 0x18]
push edx
push 0x6a
push 0x19
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x76
lea edi, [ebp - 0x1c]
push edi
push 0xc
lea edi, [ebp - 0x20]
push edi
push 0x14
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 5
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x18]
push edx
push ecx
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0xc
push 2
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x57
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0xe
push 0xb
lea edx, [ebp - 0x20]
push edx
push 0x17
push edi
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x62
push 0x79
lea edi, [ebp - 0x18]
push edi
push 0x3f
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 4
lea ecx, [ebp - 0x20]
push ecx
lea edi, [ebp - 0x18]
push edi
push 0x49
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 1
lea edi, [ebp - 0x18]
push edi
push 9
push 0x65
push esi
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x1e
push edi
call dword [sym.imp.shlwapi.dll_SHSetValueA]
lea esi, [ebp - 0x1c]
push esi
lea esi, [ebp - 0x20]
push esi
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 3
lea esi, [ebp - 0x18]
push esi
push 0x2e
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x60
push 0x41
push 0x42
lea ecx, [ebp - 0x20]
push ecx
push 0x10
push ecx
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x6b
lea edx, [ebp - 0x20]
push edx
push 0x29
push 0x65
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x4b
push 0x6b
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x20]
push edx
push 0x62
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x34
push esi
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x3c
push 0x1f
push 0x68
push edx
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x48
lea ecx, [ebp - 0x20]
push ecx
push 6
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x65
push 0x4e
lea edi, [ebp - 0x1c]
push edi
push 0x5f
lea eax, [ebp - 0x1c]
push eax
push 0x1a
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x16
push eax
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x33
push 3
lea esi, [ebp - 0x1c]
push esi
push 0x27
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 2
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x69
push 0x44
lea esi, [ebp - 0x1c]
push esi
lea edi, [ebp - 0x18]
push edi
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
lea esi, [ebp - 0x1c]
push esi
push edx
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x24
lea edi, [ebp - 0x20]
push edi
push ecx
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x7f
lea edx, [ebp - 0x18]
push edx
push 0x3b
push edi
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x27
push 0x43
lea eax, [ebp - 0x1c]
push eax
push 0x7e
push edx
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x45
push 6
lea eax, [ebp - 0x1c]
push eax
push 0x41
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x28
push 0x18
lea esi, [ebp - 0x20]
push esi
push 0x41
lea edi, [ebp - 0x20]
push edi
push 0x5d
push edi
call dword [sym.imp.shlwapi.dll_SHSetValueA]
lea eax, [ebp - 0x1c]
push eax
push 0x2c
push esi
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x13
push 0x48
push 0x51
push edx
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
lea esi, [ebp - 0x20]
push esi
push 4
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x2e
lea esi, [ebp - 0x18]
push esi
push 0x4e
lea edi, [ebp - 0x18]
push edi
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0xb
push 0x4c
lea edi, [ebp - 0x20]
push edi
push 0x77
push edi
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0xc
lea edi, [ebp - 0x20]
push edi
push 0x7c
push esi
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x5b
lea eax, [ebp - 0x18]
push eax
push 0x4d
push 0x39
push edi
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x1e
push 0x2c
lea esi, [ebp - 0x18]
push esi
push ecx
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x67
push 0x18
lea esi, [ebp - 0x1c]
push esi
push 0x7c
push 0x3e
push edi
call dword [sym.imp.shlwapi.dll_SHSetValueA]
lea ecx, [ebp - 0x20]
push ecx
push 0x7d
lea edi, [ebp - 0x20]
push edi
push esi
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x50
push 0x48
push edx
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
lea ecx, [ebp - 0x1c]
push ecx
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
lea edi, [ebp - 0x18]
push edi
lea edx, [ebp - 0x18]
push edx
push 0x52
push ecx
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x1d
push 0x48
lea eax, [ebp - 0x1c]
push eax
push 2
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x64
push 0x16
lea edi, [ebp - 0x18]
push edi
push 0x6e
lea eax, [ebp - 0x18]
push eax
push edx
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
lea edi, [ebp - 0x20]
push edi
push 0x7e
push 0x30
push edi
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x21
push 0x6d
lea edx, [ebp - 0x18]
push edx
push 0x22
lea ecx, [ebp - 0x20]
push ecx
push 0x4b
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push esi
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 3
lea edi, [ebp - 0x18]
push edi
lea edi, [ebp - 0x18]
push edi
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
lea ecx, [ebp - 0x1c]
push ecx
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x70
lea edx, [ebp - 0x20]
push edx
push 0x27
lea edi, [ebp - 0x18]
push edi
push esi
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x1f
push edi
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x52
lea eax, [ebp - 0x20]
push eax
lea edi, [ebp - 0x1c]
push edi
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x29
lea edi, [ebp - 0x18]
push edi
push 0x77
push edx
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x31
push 0xf
push 0x65
push eax
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x5c
lea eax, [ebp - 0x20]
push eax
push 0xa
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x2b
lea edi, [ebp - 0x18]
push edi
push 0x24
push 0x6b
push edi
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
lea ecx, [ebp - 0x1c]
push ecx
push 0x19
push 0x1d
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x34
lea ecx, [ebp - 0x20]
push ecx
push 0x34
lea ecx, [ebp - 0x1c]
push ecx
push 0x78
push edi
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x4c
lea eax, [ebp - 0x18]
push eax
push 0x43
lea esi, [ebp - 0x20]
push esi
push 0x39
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x4f
push esi
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0xe
push 0x36
push esi
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x53
lea esi, [ebp - 0x20]
push esi
lea esi, [ebp - 0x18]
push esi
push 0xd
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x1c
push 0x34
lea edi, [ebp - 0x1c]
push edi
push ecx
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x4f
lea edi, [ebp - 0x18]
push edi
lea edi, [ebp - 0x18]
push edi
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
lea esi, [ebp - 0x20]
push esi
push edi
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x3e
push ecx
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x32
lea edi, [ebp - 0x1c]
push edi
push 1
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x4e
push 0x26
lea edi, [ebp - 0x1c]
push edi
push 0x29
lea ecx, [ebp - 0x1c]
push ecx
push 0x71
push esi
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x36
lea esi, [ebp - 0x18]
push esi
push 0x4f
lea edi, [ebp - 0x18]
push edi
push edi
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x78
push 0x7c
lea ecx, [ebp - 0x20]
push ecx
push 0x29
lea ecx, [ebp - 0x20]
push ecx
push edi
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 7
lea edx, [ebp - 0x1c]
push edx
push eax
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x21
lea edi, [ebp - 0x1c]
push edi
push ecx
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x7a
lea eax, [ebp - 0x18]
push eax
lea edi, [ebp - 0x18]
push edi
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x25
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x18]
push ecx
push 0x5f
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x24
lea esi, [ebp - 0x18]
push esi
push 0x14
push edx
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x53
push 0x30
lea edi, [ebp - 0x20]
push edi
push edi
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x5e
push 0x6a
lea edi, [ebp - 0x20]
push edi
push 0xa
push eax
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x53
lea edi, [ebp - 0x1c]
push edi
push esi
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x75
lea esi, [ebp - 0x20]
push esi
lea edx, [ebp - 0x1c]
push edx
push esi
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x5d
push 0x2b
lea eax, [ebp - 0x18]
push eax
push 0xa
push 0x3d
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x31
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x20]
push eax
push 0x45
push edi
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x3e
push 0x2a
lea esi, [ebp - 0x1c]
push esi
push edi
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x7f
push 0x41
lea eax, [ebp - 0x1c]
push eax
push 2
push 0x50
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x67
push 0x37
lea esi, [ebp - 0x18]
push esi
lea edi, [ebp - 0x20]
push edi
push 0x23
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x18
push 0x24
push 0x3b
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x6e
push 0x59
lea ecx, [ebp - 0x1c]
push ecx
lea edi, [ebp - 0x20]
push edi
push ecx
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x3f
push 0x72
push 0x1a
lea eax, [ebp - 0x1c]
push eax
push esi
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x5d
push 0x50
lea edi, [ebp - 0x1c]
push edi
lea esi, [ebp - 0x18]
push esi
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x44
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
lea edx, [ebp - 0x1c]
push edx
push 0x50
push 0x1d
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x2d
push 0x20
lea edi, [ebp - 0x18]
push edi
call dword [sym.imp.shlwapi.dll_SHSetValueA]
lea edi, [ebp - 0x20]
push edi
push 0x49
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x48
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x65
push 0x44
lea eax, [ebp - 0x18]
push eax
push 0x5c
push eax
call dword [sym.imp.shlwapi.dll_SHSetValueA]
lea ecx, [ebp - 0x1c]
push ecx
push 0xe
push eax
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
lea esi, [ebp - 0x18]
push esi
push 0x33
push 1
push ecx
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
lea ecx, [ebp - 0x20]
push ecx
push edi
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x77
lea esi, [ebp - 0x20]
push esi
push edi
call dword [sym.imp.shlwapi.dll_SHSetValueA]
lea edi, [ebp - 0x1c]
push edi
push ecx
call dword [sym.imp.shlwapi.dll_SHSetValueA]
lea edi, [ebp - 0x1c]
push edi
push 0x3e
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x49
lea esi, [ebp - 0x1c]
push esi
push 0x4c
push 0x47
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x7d
lea edx, [ebp - 0x20]
push edx
push 0x24
lea edi, [ebp - 0x20]
push edi
push 0x31
push edi
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0xb
push 0x57
push 0x7b
push eax
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x32
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 9
push 0x2f
lea ecx, [ebp - 0x1c]
push ecx
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x2d
push 0x42
lea edi, [ebp - 0x18]
push edi
push eax
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x6b
lea edi, [ebp - 0x18]
push edi
lea edi, [ebp - 0x1c]
push edi
push 0x41
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x7f
push 0x7e
lea eax, [ebp - 0x18]
push eax
push 0x2d
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x7f
push 0x52
lea edi, [ebp - 0x1c]
push edi
push 7
push edx
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
lea eax, [ebp - 0x1c]
push eax
push 0x69
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 8
push 0x22
lea edi, [ebp - 0x18]
push edi
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
lea edi, [ebp - 0x20]
push edi
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x56
push 0x66
push 0x14
push 0x1a
push esi
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 1
lea edx, [ebp - 0x18]
push edx
push 0x28
push eax
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x75
push 4
lea edi, [ebp - 0x1c]
push edi
push 6
lea ecx, [ebp - 0x18]
push ecx
push 0x4f
push edi
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0xd
push 0x67
push 0x26
lea esi, [ebp - 0x1c]
push esi
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x7a
push 4
lea edi, [ebp - 0x20]
push edi
push 0x3e
push esi
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x68
push 0x6f
push 0x22
lea edi, [ebp - 0x1c]
push edi
push 0x41
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0xd
lea esi, [ebp - 0x1c]
push esi
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x68
push 0x25
push 0x57
lea esi, [ebp - 0x18]
push esi
push 0x4e
push eax
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x1b
lea edi, [ebp - 0x20]
push edi
push 0x70
lea ecx, [ebp - 0x18]
push ecx
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x7b
push 0x26
push 0x6b
push eax
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
lea edx, [ebp - 0x1c]
push edx
push 8
push eax
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0xe
lea eax, [ebp - 0x18]
push eax
push 0xa
lea ecx, [ebp - 0x1c]
push ecx
push 0x76
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x24
push 0x74
push 0x36
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x34
push 0x78
lea ecx, [ebp - 0x18]
push ecx
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
lea edx, [ebp - 0x20]
push edx
push 0x48
lea eax, [ebp - 0x20]
push eax
push 0x67
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x4e
push 0x5a
push 0x6f
push 0x79
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x12
push 0x68
push 0x12
push eax
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 8
push edi
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x39
push 0x74
lea edi, [ebp - 0x1c]
push edi
push 0x67
push edx
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x4f
push 0x32
push 0x5c
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
lea esi, [ebp - 0x18]
push esi
push 0x65
push edx
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x56
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x3e
lea edx, [ebp - 0x1c]
push edx
push 0x7d
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x69
lea edx, [ebp - 0x20]
push edx
push 0x71
push 6
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x56
push 0x5e
push 0x3f
push esi
call dword [sym.imp.shlwapi.dll_SHSetValueA]
lea eax, [ebp - 0x18]
push eax
push 0x6d
lea ecx, [ebp - 0x20]
push ecx
push 0x11
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x66
lea esi, [ebp - 0x18]
push esi
lea esi, [ebp - 0x18]
push esi
push edi
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x71
push 0x63
lea esi, [ebp - 0x1c]
push esi
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x5a
lea esi, [ebp - 0x1c]
push esi
push 0x74
push edi
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x29
push 0x74
lea edx, [ebp - 0x20]
push edx
push esi
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x4f
push 0x4a
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
lea eax, [ebp - 0x20]
push eax
push 0x6a
push 0x6b
push edi
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x49
push edi
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0xe
lea esi, [ebp - 0x18]
push esi
push 0x63
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x6a
push 0xd
lea edx, [ebp - 0x1c]
push edx
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0xb
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x3a
push 0x43
push 0x7e
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x56
lea esi, [ebp - 0x1c]
push esi
push 0x12
push 0x2b
push eax
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x5d
lea edi, [ebp - 0x20]
push edi
lea edi, [ebp - 0x1c]
push edi
push edi
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x12
lea edi, [ebp - 0x18]
push edi
push edx
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x3c
push 0x7a
push edi
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0xb
push 0x4c
lea edx, [ebp - 0x18]
push edx
push 0x36
push 0x42
push ecx
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0xc
lea eax, [ebp - 0x1c]
push eax
push 0x17
lea edi, [ebp - 0x18]
push edi
push 0x3a
push eax
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x69
lea edi, [ebp - 0x18]
push edi
push 3
push edi
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x44
push 0x56
lea edi, [ebp - 0x20]
push edi
push 0x72
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x50
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x37
push 0x13
push edi
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x58
lea edx, [ebp - 0x18]
push edx
push eax
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x42
push edx
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x72
lea edx, [ebp - 0x1c]
push edx
push 0x7b
push edi
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x1d
lea ecx, [ebp - 0x20]
push ecx
push 0x4e
push ecx
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x6a
push 6
lea esi, [ebp - 0x1c]
push esi
push 0xa
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
lea edx, [ebp - 0x18]
push edx
lea edi, [ebp - 0x20]
push edi
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x44
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x32
push 0x39
push edi
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x1f
lea ecx, [ebp - 0x20]
push ecx
lea esi, [ebp - 0x20]
push esi
push 0x4a
push ecx
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0xc
push 7
push 0x1a
push esi
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x5e
push 0x11
push 0x56
push esi
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x54
push 0x58
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x23
push 9
lea edi, [ebp - 0x18]
push edi
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0xd
lea edi, [ebp - 0x1c]
push edi
lea edi, [ebp - 0x18]
push edi
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x4a
push 0x1e
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x2a
push 0x40
lea eax, [ebp - 0x20]
push eax
push 0x70
lea edx, [ebp - 0x20]
push edx
push 0x61
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x22
push 0x26
lea edi, [ebp - 0x1c]
push edi
push 0x77
push ecx
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x75
lea ecx, [ebp - 0x1c]
push ecx
push 0x48
lea edi, [ebp - 0x18]
push edi
push 0x7c
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x4f
lea edi, [ebp - 0x1c]
push edi
push ecx
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0xc
lea esi, [ebp - 0x20]
push esi
push 0x20
push esi
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
lea ecx, [ebp - 0x18]
push ecx
push 0x37
lea esi, [ebp - 0x20]
push esi
push 0x2b
push edx
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x3f
lea edx, [ebp - 0x1c]
push edx
push 0x7f
lea edx, [ebp - 0x20]
push edx
push edi
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x23
push 0x6b
lea edi, [ebp - 0x1c]
push edi
lea edi, [ebp - 0x1c]
push edi
push edi
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x51
push 0x78
lea edi, [ebp - 0x18]
push edi
push 0x4f
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x61
push 0x13
push 0x4c
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
lea edx, [ebp - 0x18]
push edx
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 6
push eax
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0
lea eax, [ebp - 0x1c]
push eax
push 0x63
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x76
push 0
push 5
push esi
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x29
push 0x47
push edi
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x15
push 0x45
lea esi, [ebp - 0x20]
push esi
lea ecx, [ebp - 0x1c]
push ecx
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x6f
lea ecx, [ebp - 0x1c]
push ecx
lea esi, [ebp - 0x1c]
push esi
push 0x7f
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x47
push eax
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x72
push 0x4c
lea esi, [ebp - 0x20]
push esi
push 0x77
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x1c
push 0x26
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x69
lea edi, [ebp - 0x20]
push edi
push 0x21
lea edi, [ebp - 0x1c]
push edi
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 4
push eax
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x37
push 0x1b
push 0x51
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x2c
lea edx, [ebp - 0x1c]
push edx
push 0x23
push edx
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x7f
push 0x47
push 0x68
push edi
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 0x62
push 0x62
push 0x63
push edi
call dword [sym.imp.shlwapi.dll_SHQueryValueExA]
push 3
push 0x40
push 0x64
push edi
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x6e
push esi
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x6a
push 0xf
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x2c
push 0x37
push 0x59
lea edi, [ebp - 0x1c]
push edi
push 0x5d
call dword [sym.imp.shlwapi.dll_SHQueryInfoKeyA]
push 0x49
push 0x55
lea eax, [ebp - 0x1c]
push eax
push eax
call dword [sym.imp.shlwapi.dll_SHSetValueA]
push 0x5c
pop esp
push 0x73
lea edi, [ebp - 0x18]
push edi
push ecx
call dword [sym.imp.shlwapi.dll_SHSetValueA]
lea edi, [ebp - 0x1c]
push edi
push 0x11
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.shlwapi.dll_SHSetValueA]
not edx
inc edx
add byte [ebp + 0x6a57e47d], cl
adc dword [ebp - 0xaf17bb], ecx
adc eax, sym.imp.shlwapi.dll_SHSetValueA
invalid
call fcn.00406a73
lea edx, [edi]
stosd dword es:[edi], eax
jle 0x405834
jbe 0x4057be
sub ah, bh
cwde
test al, 0x42
mov al, byte [ecx - 0x3acbf9a8]
outsd dx, dword [esi]
sub eax, eax
inc esi
in al, 0x14
and bh, cl
jns 0x405822
jnp 0x405829
pop esp
iretd
mov esi, 0xb3a44e1
mov eax, dword [0xa0a3a1c9]
ja 0x4057b4
mov eax, dword [0x8677a0a3]
xchg ebx, eax
mov ebx, 0xc3461381
xor byte [edx + 0x5cead9ed], cl
xchg esi, eax
push 0x3b
xor dword [0x4c9c8f46], ebx
mov ah, 0xaf
pop edx
invalid