Function at 0x456701
Capabilities:
Encode data using base64
Parse credit card information
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x90
push ebx
push esi
push edi
mov dword [ebp + 0x18], ecx
push ecx
lea ecx, [ebp - 0x20]
call fcn.0043ff76
mov eax, dword [ebp + 0x78]
mov dword [ebp + 0x24], eax
xor ebx, ebx
lea eax, [ebp + 0x78]
push eax
mov byte [ebp + 0x3b], 0xff
mov byte [ebp + 0x66], bl
mov byte [ebp + 0x53], bl
mov dword [ebp - 8], ebx
call fcn.00437e65
push 0xa
lea eax, [ebp + 0x78]
push eax
push str.___initram
call fcn.0043fbfd
add esp, 0x10
test al, al
jne 0x456be9
mov dword [ebp + 0x68], ebx
mov esi, dword [ebp + 0x78]
mov ax, word [esi]
cmp ax, 0x2d
mov dword [ebp + 0x54], ebx
mov dword [ebp + 0x58], 0xfffffff0
mov byte [ebp + 0x6f], 0
mov byte [ebp + 0x5f], 0
mov byte [ebp + 0x65], 0
mov byte [ebp + 0x67], 0
mov byte [ebp + 0x2b], 0
mov byte [ebp + 0x64], 0
mov byte [ebp + 0x2a], 0
mov byte [ebp + 0x29], 0
mov dword [ebp + 0x4c], ebx
mov cl, 0x2a
jne 0x456794
mov cl, al
movsx ecx, cl
movzx eax, ax
cmp ecx, eax
mov dword [ebp + 0x14], ecx
jne 0x4569e7
movzx eax, word [esi + 2]
cmp dword [ebp + 0x14], eax
jne 0x4569e7
xor eax, eax
lea ecx, [esi + 4]
mov ax, word [ecx]
mov edx, eax
and dx, 0xffdf
cmp dx, 0x48
je 0x4569e7
call fcn.00437e2d
test al, al
jne 0x4569e7
xor edi, edi
mov esi, ecx
inc edi
push edi
push esi
push 0x4af564
mov dword [ebp + 0x78], esi
call fcn.0043917b
add esp, 0xc
test al, al
je 0x45683c
lea eax, [ebp + 0x78]
add esi, 2
push eax
mov dword [ebp + 0x30], esi
call fcn.00405196
cmp word [esi], 0x3a
pop ecx
je 0x456812
or dword [ebp + 0x4c], 7
jmp 0x4569d8
lea eax, [ebp + 0x60]
push eax
inc esi
lea eax, [ebp + 0x30]
inc esi
push eax
mov dword [ebp + 0x60], ebx
mov dword [ebp + 0x30], esi
call fcn.0043a784
test eax, eax
pop ecx
pop ecx
jle 0x4569d8
mov eax, dword [ebp + 0x60]
or dword [ebp + 0x4c], eax
jmp 0x4569d8
push 2
push esi
push 0x4af560
call fcn.0043917b
add esp, 0xc
test al, al
lea eax, [ebp + 0x78]
je 0x456888
add esi, 4
push eax
mov dword [ebp + 0xc], esi
call fcn.00405196
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0xc]
push eax
mov dword [ebp + 0x60], ebx
call fcn.0044957c
add esp, 0xc
test eax, eax
jle 0x4569d8
mov eax, dword [ebp + 0x60]
mov dword [ebp + 0x54], eax
mov dword [ebp + 0x58], ebx
jmp 0x4569d8
push 2
pop esi
push esi
push eax
push 0x4aaeec
call fcn.0043fbfd
add esp, 0xc
test al, al
je 0x4568a7
mov byte [ebp + 0x65], 1
jmp 0x4569d8
push 4
lea eax, [ebp + 0x78]
push eax
push str.byte
call fcn.0043fbfd
add esp, 0xc
test al, al
je 0x4568c7
mov byte [ebp + 0x64], 1
jmp 0x4569d8
push edi
lea eax, [ebp + 0x78]
push eax
push 0x4aa480
call fcn.0043fbfd
add esp, 0xc
test al, al
je 0x4568e6
mov byte [ebp + 0x67], 3
jmp 0x4569d8
push esi
lea eax, [ebp + 0x78]
push eax
push 0x4af554
call fcn.0043fbfd
add esp, 0xc
test al, al
je 0x456905
or byte [ebp + 0x67], 1
jmp 0x4569d8
push esi
lea eax, [ebp + 0x78]
push eax
push 0x4af550
call fcn.0043fbfd
add esp, 0xc
test al, al
je 0x456924
or byte [ebp + 0x67], 2
jmp 0x4569d8
push 4
lea eax, [ebp + 0x78]
push eax
push str.name
call fcn.0043fbfd
add esp, 0xc
test al, al
je 0x456944
mov byte [ebp + 0x2b], 1
jmp 0x4569d8
push edi
lea eax, [ebp + 0x78]
push eax
push 0x4af544
call fcn.0043fbfd
add esp, 0xc
test al, al
je 0x45695f
inc byte [ebp + 0x66]
jmp 0x4569d8
push esi
lea eax, [ebp + 0x78]
push eax
push 0x4af540
call fcn.0043fbfd
add esp, 0xc
test al, al
je 0x45697a
dec byte [ebp + 0x66]
jmp 0x4569d8
push edi
lea eax, [ebp + 0x78]
push eax
push 0x4af53c
call fcn.0043fbfd
add esp, 0xc
test al, al
je 0x456995
inc byte [ebp + 0x53]
jmp 0x4569d8
push esi
lea eax, [ebp + 0x78]
push eax
push 0x4af538
call fcn.0043fbfd
add esp, 0xc
test al, al
je 0x4569b1
mov byte [ebp + 0x2a], 1
jmp 0x4569d8
push 4
lea eax, [ebp + 0x78]
push eax
push str.init
call fcn.0043fbfd
add esp, 0xc
test al, al
je 0x4569ce
mov byte [ebp + 0x29], 1
jmp 0x4569d8
lea eax, [ebp + 0x78]
push eax
call fcn.00405196
pop ecx
mov esi, dword [ebp + 0x78]
movzx eax, word [esi]
cmp dword [ebp + 0x14], eax
je 0x4567a5
lea ecx, [ebp + 8]
call fcn.0043dd7e
lea ecx, [ebp - 0x10]
call fcn.0043dd7e
lea ecx, [ebp + 0x10]
call fcn.0043dd7e
lea ecx, [ebp + 4]
call fcn.0043dd7e
lea ecx, [ebp]
call fcn.0043dd7e
xor eax, eax
mov ax, word [esi]
mov ecx, eax
or ecx, 0x20
cmp cx, 0x6e
je 0x456a61
cmp cx, 0x75
je 0x456a61
cmp cx, 0x62
je 0x456a61
cmp ax, 0x5e
je 0x456a61
cmp ax, 0x2b
je 0x456a61
cmp ax, 0x23
je 0x456a61
cmp ax, 0x40
je 0x456a61
cmp ax, 0x24
je 0x456a61
cmp ax, 0x2a
je 0x456a61
cmp ax, 0x7e
je 0x456a61
cmp ax, 0x2e
je 0x456a61
cmp ax, 0x3f
jne 0x456a7a
mov al, byte [esi]
inc esi
inc esi
test al, al
mov byte [ebp + 0x6f], al
mov dword [ebp + 0x78], esi
je 0x456a7a
movzx eax, word [esi]
movsx ecx, byte [ebp + 0x6f]
cmp ecx, eax
je 0x456a80
cmp word [esi], 0x24
jne 0x456a8a
mov al, byte [esi]
inc esi
inc esi
mov byte [ebp + 0x5f], al
mov dword [ebp + 0x78], esi
cmp byte [ebp + 0x6f], 0x41
jl 0x456a9a
cmp byte [ebp + 0x6f], 0x5a
jg 0x456a9a
or byte [ebp + 0x6f], 0x20
lea eax, [ebp + 0x78]
push eax
call fcn.00437e65
mov edi, dword [ebp + 0x78]
mov dword [esp], 0x4af528
push edi
mov dword [ebp + 0x1c], edi
call dword [sym.imp.SHLWAPI.dll_StrStrW]
mov esi, eax
cmp esi, ebx
je 0x456ac0
lea edi, [esi + 4]
mov edx, edi
mov dword [ebp + 0x44], edx
cmp word [edi], bx
je 0x456b53
mov ax, word [edx]
cmp ax, 0x2c
je 0x456b0a
cmp ax, 0x3d
je 0x456b53
cmp ax, 0x21
jne 0x456afe
lea eax, [edx + 2]
mov dword [ebp + 0x30], eax
lea eax, [ebp + 0x30]
push eax
call fcn.00437e65
mov eax, dword [ebp + 0x30]
cmp word [eax], bx
pop ecx
je 0x456b53
lea edx, [eax - 2]
inc edx
inc edx
mov dword [ebp + 0x44], edx
cmp word [edx], bx
jne 0x456ace
jmp 0x456b53
add edx, 2
push 0x3d
push edx
call dword [sym.imp.SHLWAPI.dll_StrChrW]
cmp eax, ebx
je 0x456b1e
mov edx, eax
jmp 0x456b4b
mov eax, dword [ebp + 0x44]
add eax, 2
push 0x21
push eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov edx, eax
cmp edx, ebx
je 0x456b50
lea eax, [edx + 2]
mov dword [ebp + 0x30], eax
lea eax, [ebp + 0x30]
push eax
call fcn.00437e65
mov eax, dword [ebp + 0x30]
cmp word [eax], bx
pop ecx
jne 0x456b50
mov dword [ebp + 0x44], edx
jmp 0x456b53
mov edx, dword [ebp + 0x44]
mov ax, word [edx]
cmp ax, 0x2c
je 0x456b68
cmp ax, 0x3d
je 0x456b68
cmp ax, 0x21
jne 0x456b7c
mov al, byte [edx]
mov word [edx], bx
add dword [ebp + 0x44], 2
test al, al
mov byte [ebp + 0x3a], al
jne 0x456c02
inc byte [ebp + 0x3b]
cmp byte [ebp + 0x3b], 0
jg 0x456bf8
mov ecx, dword [ebp + 0x18]
push 1
push ebx
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x24]
call fcn.0044c8eb
mov eax, dword [ebp - 8]
lea ecx, [ebp]
mov dword [ebp + 0x78], eax
call fcn.00437e1a
lea ecx, [ebp + 4]
call fcn.00437e1a
lea ecx, [ebp + 0x10]
call fcn.00437e1a
lea ecx, [ebp - 0x10]
call fcn.00437e1a
lea ecx, [ebp + 8]
call fcn.00437e1a
lea eax, [ebp + 0x78]
push eax
call fcn.00437e65
push 0xa
lea eax, [ebp + 0x78]
push eax
push str.___initram
call fcn.0043fbfd
add esp, 0x10
test al, al
je 0x456757
push 3
call fcn.0041120d
pop ecx
xor esi, esi
jmp 0x457c28
mov esi, 0x80070057
jmp 0x457c00
cmp esi, ebx
mov dword [ebp - 4], ebx
jne 0x456c1b
push 0x5c
push ebx
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_StrRChrW]
call edi
mov esi, eax
cmp esi, ebx
je 0x456c73
mov ecx, dword [ebp + 0x18]
push 1
push ebx
lea eax, [ebp + 8]
push eax
push dword [ebp + 0x78]
mov word [esi], bx
call fcn.0044c8eb
mov eax, dword [ebp + 8]
push 0x5c
push eax
mov dword [ebp + 0x1c], eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
cmp eax, ebx
jne 0x456c4d
mov esi, 0x80070057
jmp 0x457bf8
mov ecx, dword [ebp + 0x18]
mov word [eax], bx
inc eax
inc eax
push 1
mov dword [ebp + 0x60], eax
push ebx
lea eax, [ebp - 4]
push eax
add esi, 2
push esi
call fcn.0044c8eb
mov eax, dword [ebp - 4]
mov dword [ebp + 0x40], eax
jmp 0x456cf6
push 1
push 0x2c
lea eax, [ebp + 0x1c]
push eax
lea ecx, [ebp - 0x20]
call fcn.0044edb8
push ebx
lea ecx, [ebp + 8]
push ecx
push eax
call fcn.004408ab
mov eax, dword [ebp + 8]
add esp, 0xc
push 0x5c
push eax
mov dword [ebp + 0x1c], eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov esi, eax
cmp esi, ebx
je 0x456c43
mov word [esi], bx
inc esi
inc esi
push 0x4af528
push esi
mov dword [ebp + 0x60], esi
call dword [sym.imp.SHLWAPI.dll_StrStrW]
cmp byte [ebp + 0x67], 0
mov dword [ebp + 0x40], eax
je 0x456cd4
cmp eax, ebx
jne 0x456ce9
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esi + eax*2]
mov dword [ebp + 0x40], eax
cmp eax, ebx
jne 0x456ce9
push 0x5c
push ebx
push esi
call edi
cmp eax, ebx
mov dword [ebp + 0x40], eax
je 0x456c43
cmp word [eax], bx
je 0x456cf6
mov word [eax], bx
inc eax
inc eax
mov dword [ebp + 0x40], eax
cmp word [eax], 0x5c
jne 0x456d01
inc eax
inc eax
mov dword [ebp + 0x40], eax
cmp byte [ebp + 0x2b], 0
mov dword [ebp + 0x30], ebx
je 0x456d25
lea eax, [ebp + 0x30]
push eax
lea eax, [ebp + 0x44]
push eax
push dword [ebp + 0x18]
call fcn.0044b862
mov eax, dword [ebp + 0x30]
add esp, 0xc
mov dword [ebp + 0x44], eax
jmp 0x456d28
mov eax, dword [ebp + 0x44]
cmp byte [ebp + 0x3a], 0x2c
jne 0x456db9
push 1
push 0x2c
lea eax, [ebp + 0x44]
push eax
lea ecx, [ebp - 0x20]
call fcn.0044edb8
push ebx
lea ecx, [ebp + 0x10]
push ecx
push eax
call fcn.004408ab
mov ecx, dword [ebp + 0x18]
add esp, 0xc
push ebx
lea eax, [ebp + 0x10]
push eax
call fcn.00402d33
cmp byte [ebp + 0x6f], 0x2e
jne 0x456d9b
mov eax, dword [ebp + 0x44]
cmp word [eax], 0x2c
jne 0x456d9b
add dword [ebp + 0x44], 2
push 1
push 0x2c
lea eax, [ebp + 0x44]
push eax
lea ecx, [ebp - 0x20]
call fcn.0044edb8
push ebx
lea ecx, [ebp]
push ecx
push eax
call fcn.004408ab
mov ecx, dword [ebp + 0x18]
add esp, 0xc
push ebx
lea eax, [ebp]
push eax
call fcn.00402d33
mov eax, dword [ebp + 0x10]
cmp word [eax], bx
jne 0x456eb2
push str.RegDat
lea ecx, [ebp + 0x10]
call fcn.004464ff
jmp 0x456eb2
cmp byte [ebp + 0x3a], 0x21
je 0x456eb2
cmp word [eax], bx
jne 0x456dec
cmp byte [ebp + 0x6f], 0x24
je 0x456e0b
cmp byte [ebp + 0x6f], 0x2a
je 0x456dec
cmp byte [ebp + 0x6f], 0x7e
je 0x456dec
cmp byte [ebp + 0x53], 0
je 0x456eb2
mov dword [ebp + 0x68], eax
jmp 0x456eb2
cmp byte [ebp + 0x6f], 0x24
je 0x456e0b
cmp byte [ebp + 0x6f], 0x2a
je 0x456e0b
cmp byte [ebp + 0x6f], 0x7e
je 0x456e0b
lea eax, [ebp + 0x44]
push eax
call fcn.00437e65
mov eax, dword [ebp + 0x44]
pop ecx
push eax
lea ecx, [ebp + 0x14]
call fcn.00446497
mov edx, dword [ebp + 0x14]
lea eax, [ebp + 0x78]
push eax
mov dword [ebp + 0x78], edx
call fcn.00437e65
cmp byte [ebp + 0x7c], 0
pop ecx
je 0x456e35
push edx
lea ecx, [ebp + 4]
call fcn.004464ff
jmp 0x456e45
mov ecx, dword [ebp + 0x18]
push 1
push ebx
lea eax, [ebp + 4]
push eax
push edx
call fcn.0044bafc
mov eax, dword [ebp + 4]
mov dword [ebp + 0x68], eax
mov dword [ebp + 0x7c], eax
lea eax, [ebp + 0x7c]
push eax
call fcn.00437e65
cmp byte [ebp + 0x6f], 0
pop ecx
jne 0x456e90
push dword [ebp + 0x78]
push 0x4af510
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x456e79
mov dword [ebp + 0x68], 0x4a69d4
jmp 0x456eaa
mov ecx, dword [ebp + 0x7c]
mov ax, word [ecx]
cmp ax, 0x23
je 0x456e8b
cmp ax, 0x40
jne 0x456eaa
mov dword [ebp + 0x68], ecx
jmp 0x456eaa
cmp byte [ebp + 0x6f], 0x23
je 0x456e9c
cmp byte [ebp + 0x6f], 0x40
jne 0x456eaa
mov eax, dword [ebp + 0x7c]
cmp word [eax], bx
mov dword [ebp + 0x68], eax
jne 0x456eaa
mov dword [ebp + 0x68], ebx
lea ecx, [ebp + 0x14]
call fcn.00437e1a
mov edi, dword [ebp + 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str.HKLM
push edi
call esi
test eax, eax
je 0x456f69
push str.HKEY_LOCAL_MACHINE
push edi
call esi
test eax, eax
je 0x456f69
push str.HKCU
push edi
call esi
test eax, eax
je 0x456f60
push str.HKEY_CURRENT_USER
push edi
call esi
test eax, eax
je 0x456f60
push str.HKCR
push edi
call esi
test eax, eax
je 0x456f57
push str.HKEY_CLASSES_ROOT
push edi
call esi
test eax, eax
je 0x456f57
push 0x4af474
push edi
call esi
test eax, eax
je 0x456f4e
push str.HKEY_USERS
push edi
call esi
test eax, eax
je 0x456f4e
push str.HKCC
push edi
call esi
test eax, eax
je 0x456f45
push str.HKEY_CURRENT_CONFIG
push edi
call esi
test eax, eax
je 0x456f45
mov esi, 0x80070057
jmp 0x457bf0
mov dword [ebp + 0x78], 0x80000005
jmp 0x456f70
mov dword [ebp + 0x78], 0x80000003
jmp 0x456f70
mov dword [ebp + 0x78], 0x80000000
jmp 0x456f70
mov dword [ebp + 0x78], 0x80000001
jmp 0x456f70
mov dword [ebp + 0x78], 0x80000002
mov eax, dword [ebp + 0x10]
cmp word [eax], bx
je 0x457690
cmp byte [ebp + 0x6f], 0x2e
je 0x456f8b
cmp byte [ebp + 0x6f], 0x3f
mov dword [ebp + 0x3c], ebx
jne 0x456f98
cmp byte [ebp + 0x6f], 0x3f
mov dword [ebp + 0x3c], 1
je 0x456fa7
cmp dword [ebp + 0x3c], ebx
je 0x456fa2
cmp word [eax], bx
je 0x456fa7
mov dword [ebp + 0x4c], ebx
jmp 0x456fae
mov dword [ebp + 0x4c], 1
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x64
lea ecx, [ebp + 0x68]
mov dword [ebp + 0xc], ebx
call fcn.0043dd9c
lea ecx, [ebp + 0x2c]
call fcn.0043dd7e
cmp byte [ebp + 0x6f], 0x2e
lea eax, [ebp + 0x2c]
je 0x456fd6
lea eax, [ebp + 0x68]
push 0x1000
lea ecx, [ebp + 0x48]
mov dword [ebp + 0x34], eax
call fcn.0043dc74
cmp byte [ebp + 0x67], 0
lea eax, [ebp + 0x7c]
mov dword [ebp + 0x1c], 0xfff
mov dword [ebp + 0x7c], ebx
mov dword [ebp + 0x24], ebx
push eax
je 0x45717f
movzx eax, word [0x4c0bc8]
or eax, 9
push eax
push ebx
push dword [ebp + 0x60]
mov dword [ebp + 0x40], ebx
push dword [ebp + 0x78]
mov dword [ebp + 0x3c], ebx
mov dword [ebp + 0x4c], ebx
mov dword [ebp + 0x14], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp + 0x7c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push ebx
push ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp + 0x3c]
push eax
push ebx
push ebx
push ebx
push dword [ebp + 0x7c]
call esi
push ebx
push ebx
push ebx
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 0x14]
push eax
push ebx
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp + 0x3c]
push eax
push ebx
push ebx
push ebx
push dword [ebp + 0x7c]
call esi
mov dword [ebp + 0x78], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp + 0x4c], eax
jae 0x457071
mov dword [ebp + 0x4c], eax
mov eax, dword [ebp + 0x4c]
lea eax, [eax*4 + 0x20]
mov dword [ebp - 0xc], eax
shr eax, 1
add eax, 8
push eax
lea ecx, [ebp + 0x58]
call fcn.0043dd9c
mov esi, dword [ebp + 0x58]
mov word [esi], 0xd
mov word [esi + 2], 0xa
lea ebx, [esi + 4]
mov word [ebx], 0x76
lea edi, [esi + 8]
mov word [esi + 6], 0x20
and word [edi], 0
cmp byte [ebp + 0x67], 3
mov dword [ebp + 0x60], ebx
je 0x4570ba
mov edi, ebx
cmp dword [ebp + 0x78], 0
jne 0x457163
test byte [ebp + 0x67], 1
je 0x457111
and dword [ebp + 0x78], 0
cmp dword [ebp + 0x14], 0
jle 0x457111
mov eax, dword [ebp - 0xc]
mov dword [ebp + 0x40], eax
xor eax, eax
push eax
push eax
push eax
push eax
mov word [edi], ax
lea eax, [ebp + 0x40]
push eax
push edi
push dword [ebp + 0x78]
push dword [ebp + 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x457106
push dword [ebp + 0x60]
lea ecx, [ebp + 0x68]
call fcn.0043ddea
mov dword [ebp + 0x60], esi
inc dword [ebp + 0x78]
mov eax, dword [ebp + 0x78]
cmp eax, dword [ebp + 0x14]
jl 0x4570d4
test byte [ebp + 0x67], 2
mov word [ebx], 0x6b
je 0x457163
and dword [ebp + 0x78], 0
cmp dword [ebp + 0x3c], 0
jle 0x457163
xor ebx, ebx
mov eax, dword [ebp - 0xc]
push ebx
push ebx
push ebx
push ebx
mov dword [ebp + 0x40], eax
lea eax, [ebp + 0x40]
push eax
push edi
push dword [ebp + 0x78]
mov word [edi], bx
push dword [ebp + 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x457158
push dword [ebp + 0x60]
lea ecx, [ebp + 0x68]
call fcn.0043ddea
mov dword [ebp + 0x60], esi
inc dword [ebp + 0x78]
mov eax, dword [ebp + 0x78]
cmp eax, dword [ebp + 0x3c]
jl 0x457128
cmp dword [ebp + 0x7c], 0
je 0x457172
push dword [ebp + 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 0x58]
call fcn.00437e1a
jmp 0x45763d
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp + 0x48]
push eax
push dword [ebp + 0x40]
push dword [ebp + 0x60]
push dword [ebp + 0x78]
call fcn.00441d07
mov esi, dword [ebp + 0x7c]
add esp, 0x18
cmp esi, ebx
mov edi, eax
je 0x45720c
mov eax, dword [ebp + 0x40]
cmp word [eax], bx
jne 0x4571c7
cmp esi, 2
jne 0x4571c7
cmp edi, 0xfffffffe
jne 0x4571c7
cmp dword [ebp + 0x3c], ebx
je 0x45763f
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x4af424
jmp 0x4571d8
cmp dword [ebp + 0x3c], ebx
mov dword [ebp + 0xc], esi
je 0x4571e5
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.ERROR
mov ecx, dword [ebp + 0x34]
call fcn.0043de39
jmp 0x45763f
cmp byte [ebp + 0x29], 0
jne 0x45763f
lea ecx, [ebp + 0x48]
call fcn.00437e1a
lea ecx, [ebp + 0x2c]
call fcn.00437e1a
lea ecx, [ebp + 0x68]
call fcn.00437e1a
jmp 0x457bf0
cmp dword [ebp + 0x58], ebx
jl 0x45722d
jg 0x457218
cmp dword [ebp + 0x54], ebx
jb 0x45722d
xor eax, eax
cmp dword [ebp + 0x54], edi
jne 0x457224
cmp dword [ebp + 0x58], eax
je 0x45722d
mov dword [ebp + 0x60], 1
jmp 0x457230
mov dword [ebp + 0x60], ebx
cmp edi, 1
mov byte [ebp + 0x7b], 0
mov byte [ebp + 0x7f], 0xff
mov eax, str.REG_SZ
jne 0x45724a
mov bl, 0x24
mov byte [ebp + 0x7f], 0
jmp 0x457264
cmp edi, 6
jne 0x457258
mov eax, str.REG_LINK
mov bl, 0x5e
jmp 0x457264
cmp edi, 0x15
jne 0x4572bb
mov eax, str.REG_MUI_SZ
mov bl, 0x75
xor esi, esi
cmp dword [ebp + 0x3c], esi
je 0x457281
mov ecx, dword [ebp + 0x34]
push 0xffffffffffffffff
push 0xffffffffffffffff
push eax
call fcn.0043de39
cmp dword [ebp + 0x4c], esi
jne 0x45763d
cmp dword [ebp + 0x60], esi
jne 0x4575d8
cmp dword [ebp + 0x58], esi
jg 0x4572aa
jl 0x457296
cmp dword [ebp + 0x54], esi
jae 0x4572aa
mov al, byte [ebp + 0x6f]
cmp bl, al
je 0x4572aa
cmp al, 0x2e
je 0x4572aa
cmp byte [ebp + 0x7f], al
jne 0x4575d8
mov eax, dword [ebp + 0x68]
mov ecx, dword [ebp + 0x48]
mov dword [ebp + 0x68], ecx
mov dword [ebp + 0x48], eax
jmp 0x45763d
cmp edi, 0xb
jne 0x457321
cmp dword [ebp + 0x3c], ebx
je 0x4572df
mov ecx, dword [ebp + 0x34]
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_QWORD
call fcn.0043de39
cmp dword [ebp + 0x4c], ebx
jne 0x45763d
cmp dword [ebp + 0x60], ebx
jne 0x4575d8
cmp dword [ebp + 0x58], ebx
jg 0x457304
jl 0x4572f4
cmp dword [ebp + 0x54], ebx
jae 0x457304
cmp byte [ebp + 0x6f], 0x2b
je 0x457304
cmp byte [ebp + 0x6f], 0x2e
jne 0x4575d8
mov eax, dword [ebp + 0x48]
push str.0x_I64x
push dword [eax + 4]
push dword [eax]
push dword [ebp + 0x68]
call fcn.004878ba
add esp, 0x10
jmp 0x45763d
cmp edi, 4
mov esi, dword [ebp + 0x48]
jne 0x45736e
cmp dword [ebp + 0x3c], ebx
je 0x457348
mov ecx, dword [ebp + 0x34]
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_DWORD
call fcn.0043de39
cmp dword [ebp + 0x4c], ebx
jne 0x45763d
cmp dword [ebp + 0x60], ebx
jne 0x4575d8
cmp dword [ebp + 0x58], ebx
jg 0x4573cd
jl 0x45735d
cmp dword [ebp + 0x54], ebx
jae 0x4573cd
cmp byte [ebp + 0x6f], 0x23
je 0x4573cd
cmp byte [ebp + 0x6f], 0x2e
je 0x4573cd
jmp 0x4575d8
cmp edi, 5
jne 0x4573e5
cmp dword [ebp + 0x3c], ebx
je 0x457392
mov ecx, dword [ebp + 0x34]
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_DWORD_BIG_ENDIAN
call fcn.0043de39
cmp dword [ebp + 0x4c], ebx
jne 0x45763d
cmp dword [ebp + 0x60], ebx
jne 0x4575d8
cmp dword [ebp + 0x58], ebx
jg 0x4573b7
jl 0x4573a7
cmp dword [ebp + 0x54], ebx
jae 0x4573b7
cmp byte [ebp + 0x6f], 0x62
je 0x4573b7
cmp byte [ebp + 0x6f], 0x2e
jne 0x4575d8
mov cl, byte [esi + 3]
mov al, byte [esi]
mov byte [esi], cl
mov byte [esi + 3], al
mov cl, byte [esi + 2]
mov al, byte [esi + 1]
mov byte [esi + 1], cl
mov byte [esi + 2], al
push dword [esi]
push str.0x_x
push dword [ebp + 0x68]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x45763d
cmp edi, 2
jne 0x457453
cmp dword [ebp + 0x3c], ebx
je 0x457409
mov ecx, dword [ebp + 0x34]
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_EXPAND_SZ
call fcn.0043de39
cmp dword [ebp + 0x4c], ebx
jne 0x45763d
cmp dword [ebp + 0x60], ebx
jne 0x4575d8
cmp dword [ebp + 0x58], ebx
jg 0x45742e
jl 0x45741e
cmp dword [ebp + 0x54], ebx
jae 0x45742e
cmp byte [ebp + 0x6f], 0x7e
je 0x45742e
cmp byte [ebp + 0x6f], 0x2e
jne 0x4575d8
cmp byte [ebp + 0x5f], 0
je 0x4572aa
mov eax, dword [ebp + 0x48]
push 1
push ebx
lea ecx, [ebp + 0x68]
push ecx
mov ecx, dword [ebp + 0x18]
push eax
mov dword [ebp + 0x44], eax
call fcn.0044c8eb
jmp 0x45763d
cmp edi, 7
jne 0x457536
cmp dword [ebp + 0x3c], ebx
je 0x45747b
mov ecx, dword [ebp + 0x34]
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_MULTI_SZ
call fcn.0043de39
cmp dword [ebp + 0x4c], ebx
jne 0x45763d
cmp dword [ebp + 0x60], ebx
jne 0x4575d8
cmp dword [ebp + 0x58], ebx
jg 0x4574a0
jl 0x457490
cmp dword [ebp + 0x54], ebx
jae 0x4574a0
cmp byte [ebp + 0x6f], 0x2a
je 0x4574a0
cmp byte [ebp + 0x6f], 0x2e
jne 0x4575d8
mov esi, dword [ebp + 0x1c]
shr esi, 1
lea eax, [esi*4 + 6]
push eax
lea ecx, [ebp + 0x68]
call fcn.0043ddc3
mov ecx, dword [ebp + 0x48]
mov eax, dword [ebp + 0x68]
lea esi, [ecx + esi*2]
jmp 0x45752a
cmp byte [ebp + 0x5f], 0x2a
jne 0x4574f1
cmp word [ecx], 0x5c
jne 0x4574f1
lea edx, [ecx + 2]
mov di, word [edx]
cmp di, 0x30
je 0x4574e3
cmp di, 0x5c
je 0x4574e3
cmp di, bx
jne 0x4574f1
mov word [eax], 0x5c
mov ecx, edx
mov dx, word [ecx]
inc eax
inc eax
jmp 0x4574f9
mov dx, word [ecx]
cmp dx, bx
je 0x457502
mov word [eax], dx
inc eax
inc eax
inc ecx
inc ecx
jmp 0x45752a
inc ecx
inc ecx
cmp byte [ebp + 0x5f], 0x24
jne 0x45751c
cmp ecx, esi
jae 0x45752e
mov word [eax], 0xd
inc eax
inc eax
mov word [eax], 0xa
jmp 0x457528
mov word [eax], 0x5c
inc eax
inc eax
mov word [eax], 0x30
inc eax
inc eax
cmp ecx, esi
jb 0x4574c0
mov word [eax], bx
jmp 0x45763d
cmp edi, 3
jne 0x457542
mov eax, str.REG_BINARY
jmp 0x45756f
cmp edi, ebx
jne 0x45754d
mov eax, str.REG_NONE
jmp 0x45756f
cmp edi, 8
jne 0x457559
mov eax, str.REG_RESOURCE_LIST
jmp 0x45756f
cmp edi, 9
jne 0x457565
mov eax, str.REG_FULL_RESOURCE_DESCRIPTOR
jmp 0x45756f
cmp edi, 0xa
jne 0x457590
mov eax, str.REG_RESOURCE_REQUIREMENTS_LIST
cmp dword [ebp + 0x3c], ebx
je 0x45758a
mov ecx, dword [ebp + 0x34]
push 0xffffffffffffffff
push 0xffffffffffffffff
push eax
call fcn.0043de39
cmp dword [ebp + 0x4c], ebx
jne 0x45763d
mov byte [ebp + 0x7b], 0x40
jmp 0x4575bb
cmp dword [ebp + 0x3c], ebx
je 0x4575bb
mov esi, dword [ebp + 0x34]
push 0x32
mov ecx, esi
call fcn.0043ddc3
push edi
push str.0x_lx
push dword [esi]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
cmp dword [ebp + 0x4c], ebx
jne 0x45763d
cmp dword [ebp + 0x58], ebx
jg 0x4575d3
jl 0x4575c7
cmp dword [ebp + 0x54], ebx
jae 0x4575d3
mov al, byte [ebp + 0x6f]
cmp byte [ebp + 0x7b], al
je 0x4575d3
cmp al, 0x2e
jne 0x4575d8
cmp dword [ebp + 0x60], ebx
je 0x4575f5
lea ecx, [ebp + 0x48]
call fcn.00437e1a
lea ecx, [ebp + 0x2c]
call fcn.00437e1a
lea ecx, [ebp + 0x68]
call fcn.00437e1a
jmp 0x456f3b
mov eax, dword [ebp + 0x1c]
lea eax, [eax + eax*4 + 7]
push eax
lea ecx, [ebp + 0x68]
call fcn.0043ddc3
mov edi, dword [ebp + 0x68]
mov esi, dword [ebp + 0x48]
xor ebx, ebx
mov word [edi], bx
mov word [edi + 2], bx
cmp dword [ebp + 0x1c], ebx
mov dword [ebp + 0x24], 1
jle 0x45763d
movzx eax, byte [esi]
push eax
push str._0x_02X
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
inc esi
inc ebx
add edi, 0xa
cmp ebx, dword [ebp + 0x1c]
jl 0x457620
xor ebx, ebx
mov eax, dword [ebp + 0x10]
cmp word [eax], bx
je 0x45765a
mov edx, dword [ebp + 0x68]
mov ecx, dword [ebp + 0x24]
lea ecx, [edx + ecx*2]
push ecx
mov ecx, dword [ebp + 0x18]
push eax
call fcn.0043d658
mov eax, dword [ebp]
cmp word [eax], bx
je 0x457670
mov ecx, dword [ebp + 0x34]
push dword [ecx]
mov ecx, dword [ebp + 0x18]
push eax
call fcn.0043d658
lea ecx, [ebp + 0x48]
call fcn.00437e1a
lea ecx, [ebp + 0x2c]
call fcn.00437e1a
lea ecx, [ebp + 0x68]
call fcn.00437e1a
mov esi, dword [ebp + 0xc]
jmp 0x457bf0
cmp dword [ebp + 0x68], ebx
je 0x457b68
xor edx, edx
cmp byte [ebp + 0x66], dl
push 8
mov dword [ebp + 0x7c], edx
pop edi
mov dword [ebp + 0x20], edx
mov dword [ebp + 0x24], edx
lea ebx, [ebp + 0x20]
jg 0x4576b4
cmp byte [ebp + 0x53], dl
je 0x4576df
movsx eax, byte [ebp + 0x66]
push eax
push dword [ebp + 0x60]
push dword [ebp + 0x78]
call fcn.0043b4e2
add esp, 0xc
cmp byte [ebp + 0x66], 2
mov esi, eax
jge 0x457b5b
cmp byte [ebp + 0x53], 0
jne 0x457b5b
xor edx, edx
mov cl, byte [ebp + 0x6f]
cmp cl, 0x2b
je 0x457aae
test cl, cl
jne 0x457705
mov esi, dword [ebp + 0x68]
mov ax, word [esi]
cmp ax, 0x2b
jne 0x457743
inc esi
inc esi
mov dword [ebp + 0x68], esi
jmp 0x457ab1
cmp cl, 0x23
je 0x457a34
cmp cl, 0x62
jne 0x4577f1
cmp byte [ebp + 0x64], 0
mov dword [ebp + 0x54], 5
mov dword [ebp + 0x58], edx
je 0x457757
movsx eax, byte [ebp + 0x65]
push eax
lea eax, [ebp + 0x7c]
push eax
push dword [ebp + 0x68]
call fcn.00441df6
mov ebx, dword [ebp + 0x7c]
add esp, 0xc
jmp 0x4577c7
cmp ax, 0x23
jne 0x45781c
inc esi
inc esi
mov dword [ebp + 0x68], esi
jmp 0x457a37
cmp byte [ebp + 0x65], 0
je 0x457797
mov edx, dword [ebp + 0x68]
xor ecx, ecx
mov cx, word [edx]
mov eax, ecx
call fcn.0043d8c9
test al, al
je 0x45787f
cmp cx, 0x30
jne 0x45778b
mov ax, word [edx + 2]
or ax, 0x20
cmp ax, 0x78
jne 0x45778b
add edx, 4
push edx
call fcn.0043e8bb
pop ecx
mov dword [ebp + 0x20], eax
jmp 0x4577af
lea eax, [ebp + 0x20]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.0044957c
cmp eax, 1
pop ecx
pop ecx
jl 0x457b1c
mov al, byte [ebp + 0x20]
mov cl, byte [ebp + 0x23]
mov byte [ebp + 0x20], cl
mov cl, byte [ebp + 0x22]
mov byte [ebp + 0x23], al
mov al, byte [ebp + 0x21]
mov byte [ebp + 0x21], cl
mov byte [ebp + 0x22], al
push 4
pop edi
push edi
push ebx
push dword [ebp + 0x54]
xor esi, esi
cmp byte [ebp + 0x2a], 0
push dword [ebp + 0x40]
push dword [ebp + 0x60]
push dword [ebp + 0x78]
je 0x457b2c
call dword [0x4c1118]
mov esi, eax
jmp 0x457b34
cmp cl, 0x2a
je 0x45792a
cmp cl, 0x7e
je 0x4578c1
cmp cl, 0x40
je 0x4578b2
cmp cl, 0x6e
mov esi, dword [ebp + 0x68]
jne 0x457846
mov dword [ebp + 0x54], edx
jmp 0x4578bc
cmp ax, 0x2a
jne 0x45782c
inc esi
inc esi
mov dword [ebp + 0x68], esi
jmp 0x45792d
cmp ax, 0x7e
jne 0x45783c
push 2
pop edi
add esi, edi
jmp 0x4578c7
cmp ax, 0x40
jne 0x457846
inc esi
inc esi
jmp 0x4578b5
cmp dword [ebp + 0x58], edx
jg 0x45793d
jl 0x45785a
cmp dword [ebp + 0x54], edx
jae 0x45793d
cmp cl, 0x5e
jne 0x457868
mov dword [ebp + 0x54], 6
jmp 0x457893
cmp cl, 0x75
jne 0x457876
mov dword [ebp + 0x54], 0x15
jmp 0x457893
test cl, cl
je 0x45788c
cmp cl, 0x24
je 0x45788c
lea ecx, [ebp + 0x7c]
call fcn.00437e1a
jmp 0x456f3b
mov dword [ebp + 0x54], 1
cmp byte [ebp + 0x64], 0
mov dword [ebp + 0x58], edx
jne 0x45793d
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
shl edi, 1
mov ebx, esi
jmp 0x4577ca
mov esi, dword [ebp + 0x68]
mov dword [ebp + 0x54], 3
mov dword [ebp + 0x58], edx
jmp 0x45793d
mov esi, dword [ebp + 0x68]
push 2
pop edi
cmp byte [ebp + 0x64], 0
mov dword [ebp + 0x54], edi
mov dword [ebp + 0x58], edx
jne 0x45793d
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 2
push eax
lea ecx, [ebp + 0x7c]
call fcn.0043ddc3
cmp word [esi], 0
mov ebx, dword [ebp + 0x7c]
mov ecx, esi
mov eax, ebx
je 0x45791b
mov dx, word [ecx]
cmp dx, 0x5c
jne 0x45790e
cmp word [ecx + 2], 0x30
jne 0x45790e
and word [eax], 0
add eax, edi
add ecx, 4
jmp 0x457915
mov word [eax], dx
add eax, edi
add ecx, edi
cmp word [ecx], 0
jne 0x4578f3
and word [eax], 0
sub eax, ebx
add eax, edi
mov edi, eax
jmp 0x4577ca
mov esi, dword [ebp + 0x68]
cmp byte [ebp + 0x64], 0
mov dword [ebp + 0x54], 7
mov dword [ebp + 0x58], edx
je 0x457953
movsx eax, byte [ebp + 0x65]
push eax
lea eax, [ebp + 0x7c]
push eax
push esi
call fcn.00441df6
mov edi, eax
jmp 0x457a55
mov esi, dword [ebp + 0x68]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, eax
lea eax, [ebx + 0x10]
push eax
lea ecx, [ebp + 0x7c]
xor edi, edi
call fcn.0043ddc3
mov edx, dword [ebp + 0x7c]
lea ecx, [esi + ebx*2]
cmp esi, ecx
mov eax, esi
mov dword [ebp + 0xc], ecx
jae 0x4579b1
and word [edx], 0
cmp byte [ebp + 0x5f], 0x2a
jne 0x4579e8
cmp word [eax], 0x5c
jne 0x457a15
lea ecx, [eax + 2]
cmp word [ecx], 0x5c
jne 0x457a15
mov eax, ecx
mov cx, word [eax]
mov word [edx], cx
inc edx
inc edx
inc eax
inc eax
xor edi, edi
cmp eax, dword [ebp + 0xc]
jb 0x45797c
cmp edi, 1
jge 0x4579b8
and word [edx], 0
inc edi
inc edx
inc edx
test ebx, ebx
jle 0x4579d8
cmp edi, 2
jge 0x4579d8
push 2
pop esi
sub esi, edi
xor eax, eax
mov ecx, esi
shr ecx, 1
mov edi, edx
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
lea edx, [edx + esi*2]
mov ebx, dword [ebp + 0x7c]
and word [edx], 0
sub edx, ebx
mov edi, edx
jmp 0x4577ca
cmp byte [ebp + 0x5f], 0x24
jne 0x457a15
mov cx, word [eax]
cmp cx, 0xd
jne 0x457a04
lea esi, [eax + 2]
cmp word [esi], 0xa
jne 0x457a04
mov eax, esi
jmp 0x457a0a
cmp cx, 0xa
jne 0x45799e
and word [edx], 0
inc eax
inc eax
inc edx
inc edx
inc edi
jmp 0x4579a7
mov cx, word [eax]
cmp cx, 0x5c
jne 0x45799e
cmp word [eax + 2], 0x30
jne 0x45799e
and word [edx], 0
inc edx
inc edx
add eax, 4
jmp 0x457a12
mov esi, dword [ebp + 0x68]
cmp byte [ebp + 0x64], 0
push 4
pop edi
mov dword [ebp + 0x54], edi
mov dword [ebp + 0x58], edx
je 0x457a60
movsx eax, byte [ebp + 0x65]
push eax
lea eax, [ebp + 0x7c]
push eax
push esi
call fcn.00441df6
mov ebx, dword [ebp + 0x7c]
add esp, 0xc
jmp 0x4577ca
cmp byte [ebp + 0x65], 0
je 0x457a9f
xor ecx, ecx
mov cx, word [esi]
mov eax, ecx
call fcn.0043d8c9
test al, al
je 0x45787f
cmp cx, 0x30
jne 0x457a90
mov ax, word [esi + 2]
or ax, 0x20
cmp ax, 0x78
jne 0x457a90
add esi, edi
push esi
call fcn.0043e8bb
pop ecx
mov dword [ebp + 0x20], eax
jmp 0x4577ca
lea eax, [ebp + 0x20]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.0044957c
jmp 0x457b11
mov esi, dword [ebp + 0x68]
cmp byte [ebp + 0x64], 0
mov dword [ebp + 0x54], 0xb
mov dword [ebp + 0x58], edx
jne 0x457a46
cmp byte [ebp + 0x65], 0
je 0x457b04
xor ecx, ecx
mov cx, word [esi]
mov eax, ecx
call fcn.0043d8c9
test al, al
je 0x45787f
cmp cx, 0x30
jne 0x457af2
mov ax, word [esi + 2]
or ax, 0x20
cmp ax, 0x78
jne 0x457af2
add esi, 4
push esi
call fcn.0043e8bb
pop ecx
mov dword [ebp + 0x20], eax
mov dword [ebp + 0x24], edx
jmp 0x4577ca
lea eax, [ebp + 0x20]
push eax
lea eax, [ebp + 0x68]
push eax
call fcn.00449426
cmp eax, 1
pop ecx
pop ecx
jge 0x4577ca
lea ecx, [ebp + 0x7c]
call fcn.00437e1a
xor esi, esi
inc esi
jmp 0x457bf0
call fcn.00439000
add esp, 0x18
cmp esi, 0x3fd
jne 0x457b5b
cmp byte [ebp + 0x66], 0
jne 0x457b5b
push 1
push dword [ebp + 0x60]
mov byte [ebp + 0x66], 1
push dword [ebp + 0x78]
call fcn.0043b4e2
add esp, 0xc
jmp 0x4577ca
lea ecx, [ebp + 0x7c]
call fcn.00437e1a
jmp 0x457bf0
cmp byte [ebp + 0x3a], 0x21
jne 0x457b9a
mov eax, dword [ebp + 0x40]
cmp word [eax], bx
jne 0x457b9a
cmp dword [ebp + 0x4c], ebx
je 0x457b8b
push dword [ebp + 0x4c]
push dword [ebp + 0x60]
push dword [ebp + 0x78]
call fcn.00447a54
jmp 0x457be4
push dword [ebp + 0x60]
push dword [ebp + 0x78]
call fcn.00447853
pop ecx
pop ecx
jmp 0x457be7
cmp dword [ebp + 0x4c], ebx
je 0x457bd6
push ebx
lea eax, [ebp + 0x7c]
push eax
movzx eax, word [0x4c0bc8]
push ebx
or eax, 0x2001b
push eax
push ebx
push ebx
push ebx
push dword [ebp + 0x60]
mov dword [ebp + 0x7c], ebx
push dword [ebp + 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp dword [ebp + 0x7c], ebx
mov esi, eax
je 0x457be9
push dword [ebp + 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x457be9
push dword [ebp + 0x40]
push dword [ebp + 0x60]
push dword [ebp + 0x78]
call fcn.0043904c
add esp, 0xc
mov esi, eax
cmp esi, 2
jne 0x457bf0
xor esi, esi
lea ecx, [ebp + 0x30]
call fcn.00437e1a
lea ecx, [ebp - 4]
call fcn.00437e1a
lea ecx, [ebp]
call fcn.00437e1a
lea ecx, [ebp + 4]
call fcn.00437e1a
lea ecx, [ebp + 0x10]
call fcn.00437e1a
lea ecx, [ebp - 0x10]
call fcn.00437e1a
lea ecx, [ebp + 8]
call fcn.00437e1a
lea ecx, [ebp - 8]
call fcn.00437e1a
lea ecx, [ebp - 0x20]
call fcn.00437e1a
pop edi
mov eax, esi
pop esi
pop ebx
add ebp, 0x70
leave
ret 8