Function at 0x40c65c
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebx
mov ebx, esp
push ecx
push ecx
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
mov eax, 0x11f8
call fcn.00412ca0
mov eax, dword [0x413074]
xor eax, ebp
mov dword [ebp - 4], eax
fldz
xor eax, eax
push esi
mov esi, ecx
mov word [ebp - 0x348], ax
fst qword [ebp - 0x1140]
push edi
xor edi, edi
mov dword [ebp - 0x1048], esi
fst qword [ebp - 0x1130]
push ecx
fst qword [ebp - 0x1120]
push 0x401a90
lea ecx, [ebp - 0x1040]
mov dword [ebp - 0x1068], edi
fstp qword [ebp - 0x1138]
mov dword [ebp - 0x1054], edi
mov dword [ebp - 0x1058], edi
mov word [ebp - 0x5b8], ax
mov word [ebp - 0xd8], ax
mov dword [esi + 0x6a0], edi
mov dword [esi + 0x6a4], edi
mov dword [ebp - 0x10f4], edi
mov dword [ebp - 0x10c8], edi
mov dword [ebp - 0x10c0], edi
mov dword [ebp - 0x10ec], edi
mov dword [ebp - 0x1124], 1
call fcn.0041164d
mov dword [ebp - 0x1040], 0x401080
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount64]
mov dword [0x413568], eax
mov dword [0x41356c], edx
lea eax, [ebp - 0x1068]
push eax
push 0x20019
push edi
push 0x401b20
push 0x80000002
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x40e4dd
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x108c]
mov dword [ebp - 0x1054], edi
push eax
lea eax, [ebp - 0x348]
mov dword [ebp - 0x108c], 0x104
push eax
push edi
push dword [ebp - 0x1068]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
cmp eax, 0x103
je 0x40c7ca
mov esi, edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x108c]
mov dword [ebp - 0x108c], 0x104
push eax
lea eax, [ebp - 0x348]
inc esi
push eax
push esi
push dword [ebp - 0x1068]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
cmp eax, 0x103
jne 0x40c78d
mov dword [ebp - 0x1054], esi
mov esi, dword [ebp - 0x1048]
imul eax, dword [ebp - 0x1054], 0x250
push eax
push 0x40
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
mov dword [esi + 0x6a4], eax
test eax, eax
jne 0x40c81a
push dword [ebp - 0x1068]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
lea ecx, [ebp - 0x1040]
mov dword [ebp - 0x1040], 0x401080
call fcn.0041132a
lea ecx, [ebp - 0x1040]
call fcn.0040c115
xor eax, eax
jmp 0x40e52d
imul eax, dword [ebp - 0x1054], 0xa8
push eax
push 0x40
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
imul ecx, dword [ebp - 0x1054], 0xc0
mov dword [ebp - 0x10fc], eax
push ecx
push 0x40
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
imul ecx, dword [ebp - 0x1054], 0xb8
mov dword [ebp - 0x10a4], eax
push ecx
push 0x40
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
imul ecx, dword [ebp - 0x1054], 0xd8
mov dword [ebp - 0x10a8], eax
push ecx
push 0x40
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
imul ecx, dword [ebp - 0x1054], 0xc8
mov dword [ebp - 0x10f0], eax
push ecx
push 0x40
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
imul ecx, dword [ebp - 0x1054], 0xd0
mov dword [ebp - 0x10bc], eax
push ecx
push 0x40
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
push edi
push edi
push edi
push edi
mov dword [ebp - 0x10c4], eax
lea eax, [ebp - 0x108c]
push eax
lea eax, [ebp - 0x348]
mov dword [ebp - 0x1054], edi
push eax
push edi
push dword [ebp - 0x1068]
mov dword [ebp - 0x1058], edi
mov dword [ebp - 0x108c], 0x104
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
cmp eax, 0x103
je 0x40df43
fld qword [0x401d00]
fstp qword [ebp - 0x10b8]
fld qword [0x401d08]
fstp qword [ebp - 0x10e8]
mov dword [ebp - 0x108c], 0x104
lea eax, [ebp - 0x348]
mov dword [ebp - 0x1104], 1
mov ecx, 0x401ba0
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40c94d
test dx, dx
je 0x40c949
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40c94d
add eax, 4
add ecx, 4
test dx, dx
jne 0x40c927
mov eax, edi
jmp 0x40c952
sbb eax, eax
or eax, 1
imul ecx, dword [ebp - 0x1058], 0x250
mov dword [ebp - 0x1044], ecx
test eax, eax
je 0x40ddb8
mov eax, dword [esi + 0x6a4]
add ecx, 0x18
add eax, ecx
push eax
push 0x20019
push edi
lea eax, [ebp - 0x348]
push eax
push dword [ebp - 0x1068]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x40dd9f
push ecx
push 0x401aa4
lea ecx, [ebp - 0xf78]
call fcn.0041164d
mov dword [ebp - 0xf78], 0x401074
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount64]
test byte [0x413440], 1
mov dword [0x413560], eax
mov dword [0x413564], edx
je 0x40c9de
lea eax, [ebp - 0x348]
mov edx, 0x401610
push eax
push ecx
call fcn.0040a316
mov ecx, dword [ebp - 0x1044]
lea eax, [ebp - 0x348]
add ecx, 0x1c
mov edx, 0x104
add ecx, dword [esi + 0x6a4]
push eax
call fcn.004075b9
mov dword [ebp - 0x1114], 0x208
mov dword [ebp - 0x105c], 1
test eax, eax
js 0x40dd7f
mov ecx, dword [ebp - 0x1044]
lea eax, [ebp - 0x1114]
push eax
lea eax, [ebp - 0x5b8]
push eax
lea eax, [ebp - 0x105c]
push eax
mov eax, dword [esi + 0x6a4]
push edi
push edi
push dword [ecx + eax + 0x18]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x40dd7f
mov ecx, dword [ebp - 0x10fc]
test ecx, ecx
je 0x40caa7
imul esi, dword [ebp - 0x1058], 0xa8
mov eax, dword [ebp - 0x1048]
mov eax, dword [eax + 0x6a4]
add esi, ecx
mov ecx, dword [ebp - 0x1044]
add ecx, 0x1c
add eax, ecx
push eax
push 0x4f
push 0x401bc0
push 0x50
push esi
call fcn.004076aa
mov eax, dword [ebp - 0x1058]
add esp, 0x14
mov dword [esi + 0xa0], eax
mov dword [esi + 0xa4], edi
mov esi, dword [ebp - 0x1048]
push ecx
lea eax, [ebp - 0x5b8]
push eax
push ecx
push 0x27
pop edx
lea ecx, [ebp - 0x58]
call fcn.004075ee
test eax, eax
jns 0x40cac5
xor eax, eax
mov word [ebp - 0x58], ax
mov ecx, dword [ebp - 0x1044]
mov eax, dword [esi + 0x6a4]
add ecx, 4
add eax, ecx
push eax
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CLSIDFromString]
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount64]
mov ecx, dword [esi + 0x6a4]
mov dword [ebp - 0x10cc], eax
mov eax, dword [ebp - 0x1044]
mov dword [ebp - 0x10ac], edx
mov dword [eax + ecx + 0x14], edi
lea ecx, [eax + 0x14]
mov esi, dword [esi + 0x6a4]
add eax, 4
add ecx, esi
add eax, esi
push ecx
push 0x4012d4
push 1
push edi
push eax
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoCreateInstance]
mov dword [ebp - 0x106c], eax
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount64]
sub eax, dword [ebp - 0x10cc]
mov dword [ebp - 0x1158], eax
sbb edx, dword [ebp - 0x10ac]
sub esp, 0x18
mov eax, edx
mov dword [ebp - 0x1160], edi
and eax, 0x80000000
mov esi, dword [ebp - 0x1044]
and edx, 0x7fffffff
mov dword [ebp - 0x115c], eax
mov dword [ebp - 0x1154], edx
add esi, 4
fild qword [ebp - 0x1158]
mov edi, esp
fild qword [ebp - 0x1160]
fchs
faddp st(1)
fstp qword [ebp - 0x1078]
fld qword [ebp - 0x1078]
fdiv qword [ebp - 0x10b8]
mov eax, dword [ebp - 0x1048]
mov eax, dword [eax + 0x6a4]
add esi, eax
add eax, 0x1c
fst qword [ebp - 0x1078]
fstp qword [esp + 0x10]
push dword [ebp - 0x106c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x1044]
add eax, edi
push eax
call fcn.0040b45c
mov ecx, dword [ebp - 0x10a4]
test ecx, ecx
je 0x40ccab
imul eax, dword [ebp - 0x1058], 0xc0
mov esi, dword [ebp - 0x1048]
add ecx, eax
mov eax, dword [esi + 0x6a4]
add eax, 0x1c
mov dword [ebp - 0x1064], ecx
add eax, edi
push eax
push 0x4f
push 0x401bc0
push 0x50
push ecx
call fcn.004076aa
mov esi, dword [esi + 0x6a4]
add edi, 4
fld qword [ebp - 0x1078]
add esi, edi
mov edi, dword [ebp - 0x1064]
fld st(0)
fld qword [ebp - 0x10e8]
add edi, 0xa0
fcom st(1)
add esp, 0x14
fnstsw ax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor edi, edi
mov ecx, edi
mov esi, edi
mov dword [ebp - 0x104c], ecx
test ah, 0x41
jp 0x40cc60
fsub st(1), st(0)
fcomp st(1)
fnstsw ax
test ah, 0x41
jne 0x40cc62
add esi, edi
adc ecx, 0x80000000
mov dword [ebp - 0x104c], ecx
jmp 0x40cc62
fstp st(0)
call sub.msvcrt.dll__ftol2
mov ecx, dword [ebp - 0x1064]
add eax, esi
fild dword [ebp - 0x106c]
adc edx, dword [ebp - 0x104c]
mov dword [ecx + 0xb0], eax
mov eax, dword [ebp - 0x1058]
mov dword [ecx + 0xb4], edx
fstp dword [ecx + 0xb8]
fild dword [ebp - 0x1058]
test eax, eax
jns 0x40cca3
fadd dword [0x401d10]
fstp dword [ecx + 0xbc]
jmp 0x40ccb3
fld qword [ebp - 0x1078]
xor edi, edi
cmp dword [ebp - 0x106c], 0
fadd qword [ebp - 0x1140]
mov esi, dword [ebp - 0x1048]
fstp qword [ebp - 0x1140]
jl 0x40dd7f
mov eax, dword [esi + 0x6a4]
mov ecx, dword [ebp - 0x1044]
add eax, 0x1c
push ecx
add eax, ecx
lea ecx, [ebp - 0xeb0]
push 0x401ac0
mov dword [ebp - 0x104c], eax
call fcn.0041164d
mov dword [ebp - 0xeb0], 0x401068
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount64]
test byte [0x413440], 1
mov dword [0x413558], eax
mov dword [0x41355c], edx
je 0x40cd2f
push dword [ebp - 0x104c]
mov edx, 0x4015f0
push ecx
call fcn.0040a316
mov ecx, dword [ebp - 0x10a8]
test ecx, ecx
je 0x40cdac
imul edi, dword [ebp - 0x1058], 0xb8
mov eax, dword [esi + 0x6a4]
add edi, ecx
mov ecx, dword [ebp - 0x1044]
add ecx, 0x1c
mov dword [ebp - 0x104c], edi
add eax, ecx
push eax
push 0x4f
push 0x401bc0
push 0x50
push edi
call fcn.004076aa
mov esi, dword [esi + 0x6a4]
add edi, 0xa0
mov ecx, dword [ebp - 0x1044]
add esi, 4
mov eax, dword [ebp - 0x104c]
add esi, ecx
mov edx, dword [ebp - 0x1058]
add esp, 0x14
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x1048]
xor edi, edi
mov dword [eax + 0xb0], edx
mov dword [eax + 0xb4], edi
jmp 0x40cdb2
mov ecx, dword [ebp - 0x1044]
mov eax, dword [esi + 0x6a4]
mov dword [ecx + eax + 0x230], edi
test byte [esi + 0x658], 1
je 0x40cdd6
mov eax, dword [esi + 0x6a4]
or dword [ecx + eax + 0x230], 0x20
test dword [esi + 0x658], 0x202
je 0x40cdf3
mov eax, dword [esi + 0x6a4]
or dword [ecx + eax + 0x230], 0x80
test dword [esi + 0x658], 0x200
je 0x40ce10
mov eax, dword [esi + 0x6a4]
or dword [ecx + eax + 0x230], 0x100
cmp dword [esi + 0x660], edi
je 0x40ce26
mov eax, dword [esi + 0x6a4]
or dword [eax + ecx + 0x230], 0x40
lea eax, [esi + 8]
mov edx, 0x104
push eax
lea ecx, [ebp - 0x9c8]
call fcn.004075b9
mov eax, dword [esi + 0x6a4]
mov ecx, dword [ebp - 0x1044]
mov ecx, dword [ecx + eax + 0x14]
mov eax, dword [ecx]
mov esi, dword [eax]
lea eax, [ebp - 0x1128]
push eax
push 0x4012e4
push ecx
mov ecx, esi
call dword [0x414340]
call esi
mov esi, eax
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount64]
mov dword [ebp - 0x110c], eax
mov dword [ebp - 0x1074], edx
test esi, esi
js 0x40cf10
push ecx
lea eax, [ebp - 0x348]
mov edx, 0x104
push eax
push ecx
lea ecx, [ebp - 0xdd8]
call fcn.004075ee
mov edx, dword [ebp - 0x1128]
mov ecx, dword [ebp - 0x1044]
mov eax, dword [edx]
mov esi, dword [eax + 0x20]
mov eax, dword [ebp - 0x1048]
add ecx, dword [eax + 0x6a4]
lea eax, [ecx + 0x230]
push eax
lea eax, [ecx + 0x22c]
push eax
lea eax, [ecx + 0x224]
push eax
lea eax, [ecx + 0x228]
push eax
lea eax, [ebp - 0xdd8]
push eax
lea eax, [ebp - 0x9c8]
push eax
push dword [ecx + 0x18]
mov ecx, esi
push edx
call dword [0x414340]
call esi
mov ecx, dword [ebp - 0x1128]
mov dword [ebp - 0x106c], eax
push ecx
mov edx, dword [ecx]
mov esi, dword [edx + 8]
mov ecx, esi
call dword [0x414340]
call esi
jmp 0x40d77f
push 0x400
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemAlloc]
mov edx, dword [ebp - 0x1048]
mov esi, dword [ebp - 0x1044]
mov ecx, dword [edx + 0x6a4]
mov dword [esi + ecx + 0x224], eax
test eax, eax
je 0x40e540
mov edi, dword [edx + 0x6a4]
add edi, esi
mov edx, dword [edi + 0x14]
lea ecx, [edi + 0x224]
mov eax, dword [ecx]
mov dword [ebp - 0x104c], eax
mov eax, dword [edx]
mov esi, dword [eax + 0xc]
lea eax, [edi + 0x230]
push eax
push ecx
lea eax, [edi + 0x228]
mov ecx, esi
push eax
lea eax, [ebp - 0x9c8]
push eax
push dword [edi + 0x18]
push edx
call dword [0x414340]
call esi
mov esi, dword [ebp - 0x1048]
mov edi, eax
mov ecx, dword [ebp - 0x1044]
mov edx, dword [ebp - 0x104c]
mov dword [ebp - 0x106c], edi
mov eax, dword [esi + 0x6a4]
cmp edx, dword [ecx + eax + 0x224]
je 0x40cfae
push edx
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
test edi, edi
jne 0x40d77d
lea eax, [ebp - 0x10e0]
mov dword [ebp - 0x1060], edi
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov ecx, dword [ebp - 0x1044]
xor eax, eax
mov word [ebp - 0xbd0], ax
lea eax, [ebp - 0x1114]
push eax
lea eax, [ebp - 0xbd0]
mov dword [ebp - 0x1114], 0x208
push eax
lea eax, [ebp - 0x105c]
mov dword [ebp - 0x105c], 1
push eax
mov eax, dword [esi + 0x6a4]
push edi
push 0x401bd0
push dword [ecx + eax + 0x18]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x40d05c
push ecx
lea eax, [ebp - 0xbd0]
push eax
push ecx
push 0x27
pop edx
lea ecx, [ebp - 0x58]
call fcn.004075ee
lea eax, [ebp - 0xde8]
push eax
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CLSIDFromString]
lea eax, [ebp - 0x1060]
push eax
push 0x401314
push 1
push edi
lea eax, [ebp - 0xde8]
push eax
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoCreateInstance]
mov eax, dword [esi + 0x6a4]
mov ecx, dword [ebp - 0x1044]
cmp dword [ecx + eax + 0x228], edi
jne 0x40d2d7
mov edx, dword [ebp - 0x1060]
test edx, edx
je 0x40d14e
push 8
pop eax
mov word [ebp - 0x10e0], ax
mov dword [ebp - 0x10d8], edi
mov eax, dword [edx]
push edi
mov esi, dword [eax + 0xc]
lea eax, [ebp - 0x10e0]
push eax
push 0x401be8
push edx
mov ecx, esi
call dword [0x414340]
call esi
test eax, eax
js 0x40d13c
push 8
pop eax
cmp word [ebp - 0x10e0], ax
jne 0x40d127
push dword [ebp - 0x10d8]
call dword [sym.imp.OLEAUT32.dll_VariantInit]
lea eax, [eax*2 + 2]
push eax
mov dword [ebp - 0x104c], eax
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemAlloc]
mov esi, dword [ebp - 0x1048]
mov edx, dword [ebp - 0x1044]
mov ecx, dword [esi + 0x6a4]
mov dword [edx + ecx + 0x228], eax
test eax, eax
je 0x40d12d
mov ecx, dword [esi + 0x6a4]
mov eax, dword [ebp - 0x1044]
push dword [ebp - 0x10d8]
mov edx, dword [ebp - 0x104c]
mov ecx, dword [eax + ecx + 0x228]
call fcn.00411ac6
jmp 0x40d12d
mov esi, dword [ebp - 0x1048]
lea eax, [ebp - 0x10e0]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x40d142
mov esi, dword [ebp - 0x1048]
mov ecx, dword [ebp - 0x1044]
mov edx, dword [ebp - 0x1060]
mov eax, dword [esi + 0x6a4]
add eax, ecx
cmp dword [eax + 0x228], edi
jne 0x40d2dd
lea ecx, [ebp - 0x1050]
mov dword [ebp - 0x1050], edi
push ecx
push edi
lea ecx, [ebp - 0x105c]
mov dword [ebp - 0x105c], 1
push ecx
push edi
push 0x401be8
push dword [eax + 0x18]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
lea eax, [ebp - 0x348]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x1050]
lea eax, [eax*2 + 2]
cmp ecx, eax
ja 0x40d1c8
lea eax, [ebp - 0x348]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [eax*2 + 2]
mov dword [ebp - 0x1050], ecx
push ecx
push 0x40
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
mov dword [ebp - 0x104c], eax
test eax, eax
je 0x40d2d7
xor ecx, ecx
mov word [eax], cx
lea ecx, [ebp - 0x1050]
push ecx
mov ecx, dword [ebp - 0x1044]
push eax
lea eax, [ebp - 0x105c]
push eax
mov eax, dword [esi + 0x6a4]
push edi
push 0x401be8
push dword [ecx + eax + 0x18]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
je 0x40d235
mov edx, dword [ebp - 0x1050]
shr edx, 1
je 0x40d235
mov ecx, dword [ebp - 0x104c]
lea eax, [ebp - 0x348]
push 0x7ffffffe
push eax
push edi
call fcn.00411aef
push 0x202
push 0x40
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
mov dword [ebp - 0x1064], eax
test eax, eax
je 0x40d2cb
push edi
push 0x101
push eax
push dword [ebp - 0x104c]
xor ecx, ecx
mov word [eax], cx
call dword [sym.imp.SHLWAPI.dll_SHLoadIndirectString]
test eax, eax
js 0x40d2bf
push dword [ebp - 0x1064]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
mov dword [ebp - 0x1094], eax
add eax, eax
push eax
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemAlloc]
mov ecx, dword [esi + 0x6a4]
mov edx, dword [ebp - 0x1044]
mov dword [edx + ecx + 0x228], eax
test eax, eax
je 0x40d2bf
mov ecx, dword [esi + 0x6a4]
mov eax, dword [ebp - 0x1044]
push dword [ebp - 0x1064]
mov edx, dword [ebp - 0x1094]
mov ecx, dword [eax + ecx + 0x228]
call fcn.004075b9
push dword [ebp - 0x1064]
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
push dword [ebp - 0x104c]
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
mov edx, dword [ebp - 0x1060]
mov eax, dword [esi + 0x6a4]
mov ecx, dword [ebp - 0x1044]
cmp dword [ecx + eax + 0x224], edi
jne 0x40d509
test edx, edx
je 0x40d3c3
push 8
pop eax
mov word [ebp - 0x10e0], ax
mov dword [ebp - 0x10d8], edi
mov eax, dword [edx]
push edi
mov esi, dword [eax + 0xc]
lea eax, [ebp - 0x10e0]
push eax
push 0x401bf8
push edx
mov ecx, esi
call dword [0x414340]
call esi
test eax, eax
js 0x40d3b7
push 8
pop eax
cmp word [ebp - 0x10e0], ax
jne 0x40d3a2
push dword [ebp - 0x10d8]
call dword [sym.imp.OLEAUT32.dll_VariantInit]
lea eax, [eax*2 + 2]
push eax
mov dword [ebp - 0x1094], eax
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemAlloc]
mov esi, dword [ebp - 0x1048]
mov edx, dword [ebp - 0x1044]
mov ecx, dword [esi + 0x6a4]
mov dword [edx + ecx + 0x224], eax
test eax, eax
je 0x40d3a8
mov ecx, dword [esi + 0x6a4]
mov eax, dword [ebp - 0x1044]
push dword [ebp - 0x10d8]
mov edx, dword [ebp - 0x1094]
mov ecx, dword [eax + ecx + 0x224]
call fcn.00411ac6
jmp 0x40d3a8
mov esi, dword [ebp - 0x1048]
lea eax, [ebp - 0x10e0]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x40d3bd
mov esi, dword [ebp - 0x1048]
mov ecx, dword [ebp - 0x1044]
mov eax, dword [esi + 0x6a4]
add eax, ecx
cmp dword [eax + 0x224], edi
jne 0x40d509
lea ecx, [ebp - 0x1050]
mov dword [ebp - 0x1050], edi
push ecx
push edi
lea ecx, [ebp - 0x105c]
mov dword [ebp - 0x105c], 1
push ecx
push edi
push 0x401bf8
push dword [eax + 0x18]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov eax, dword [ebp - 0x1050]
lea eax, [eax*2 + 2]
push eax
push 0x40
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
mov dword [ebp - 0x1064], eax
test eax, eax
je 0x40d503
xor ecx, ecx
mov word [eax], cx
lea ecx, [ebp - 0x1050]
push ecx
mov ecx, dword [ebp - 0x1044]
push eax
lea eax, [ebp - 0x105c]
push eax
mov eax, dword [esi + 0x6a4]
push edi
push 0x401bf8
push dword [ecx + eax + 0x18]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x40d4f7
push 0x402
push 0x40
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
mov dword [ebp - 0x104c], eax
test eax, eax
je 0x40d4f7
push edi
push 0x201
push eax
push dword [ebp - 0x1064]
xor ecx, ecx
mov word [eax], cx
call dword [sym.imp.SHLWAPI.dll_SHLoadIndirectString]
test eax, eax
js 0x40d4eb
push dword [ebp - 0x104c]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
mov dword [ebp - 0x1094], eax
add eax, eax
push eax
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemAlloc]
mov ecx, dword [esi + 0x6a4]
mov edx, dword [ebp - 0x1044]
mov dword [edx + ecx + 0x224], eax
test eax, eax
je 0x40d4eb
mov ecx, dword [esi + 0x6a4]
mov eax, dword [ebp - 0x1044]
push dword [ebp - 0x104c]
mov edx, dword [ebp - 0x1094]
mov ecx, dword [eax + ecx + 0x224]
call fcn.004075b9
push dword [ebp - 0x104c]
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
push dword [ebp - 0x1064]
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
mov ecx, dword [ebp - 0x1044]
mov eax, dword [esi + 0x6a4]
mov dword [ecx + eax + 0x22c], edi
mov eax, dword [esi + 0x6a4]
test byte [ecx + eax + 0x230], 1
je 0x40d768
mov edx, dword [ebp - 0x1060]
test edx, edx
je 0x40d603
push 8
pop eax
mov word [ebp - 0x10e0], ax
mov dword [ebp - 0x10d8], edi
mov eax, dword [edx]
push edi
mov esi, dword [eax + 0xc]
lea eax, [ebp - 0x10e0]
push eax
push 0x401c10
push edx
mov ecx, esi
call dword [0x414340]
call esi
test eax, eax
js 0x40d5f1
push 8
pop eax
cmp word [ebp - 0x10e0], ax
jne 0x40d5dc
push dword [ebp - 0x10d8]
call dword [sym.imp.OLEAUT32.dll_VariantInit]
lea eax, [eax*2 + 2]
push eax
mov dword [ebp - 0x1094], eax
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemAlloc]
mov esi, dword [ebp - 0x1048]
mov edx, dword [ebp - 0x1044]
mov ecx, dword [esi + 0x6a4]
mov dword [edx + ecx + 0x22c], eax
test eax, eax
je 0x40d5e2
mov ecx, dword [esi + 0x6a4]
mov eax, dword [ebp - 0x1044]
push dword [ebp - 0x10d8]
mov edx, dword [ebp - 0x1094]
mov ecx, dword [eax + ecx + 0x22c]
call fcn.00411ac6
jmp 0x40d5e2
mov esi, dword [ebp - 0x1048]
lea eax, [ebp - 0x10e0]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
jmp 0x40d5f7
mov esi, dword [ebp - 0x1048]
mov ecx, dword [ebp - 0x1044]
mov edx, dword [ebp - 0x1060]
mov eax, dword [esi + 0x6a4]
cmp dword [ecx + eax + 0x22c], edi
jne 0x40d76e
push 0x32
lea eax, [ebp - 0x3b0]
push eax
push 0x12
push dword [0x413518]
call dword [sym.imp.USER32.dll_LoadStringW]
mov ecx, dword [ebp - 0x1044]
lea eax, [ebp - 0x1050]
push eax
push edi
lea eax, [ebp - 0x105c]
mov dword [ebp - 0x1050], edi
push eax
mov eax, dword [esi + 0x6a4]
push edi
push 0x401c10
mov dword [ebp - 0x105c], 1
push dword [ecx + eax + 0x18]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov eax, dword [ebp - 0x1050]
cmp eax, 0x64
ja 0x40d67c
push 0x64
pop eax
mov dword [ebp - 0x1050], eax
push eax
push 0x40
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
mov dword [ebp - 0x104c], eax
test eax, eax
je 0x40d768
xor ecx, ecx
mov word [eax], cx
lea ecx, [ebp - 0x1050]
push ecx
mov ecx, dword [ebp - 0x1044]
push eax
lea eax, [ebp - 0x105c]
push eax
mov eax, dword [esi + 0x6a4]
push edi
push 0x401c10
push dword [ecx + eax + 0x18]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
je 0x40d6e9
mov edx, dword [ebp - 0x1050]
shr edx, 1
je 0x40d6e9
mov ecx, dword [ebp - 0x104c]
lea eax, [ebp - 0x3b0]
push 0x7ffffffe
push eax
push edi
call fcn.00411aef
push edi
push 0x32
lea eax, [ebp - 0x140]
push eax
push dword [ebp - 0x104c]
call dword [sym.imp.SHLWAPI.dll_SHLoadIndirectString]
test eax, eax
js 0x40d75c
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
mov dword [ebp - 0x1094], eax
add eax, eax
push eax
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemAlloc]
mov ecx, dword [esi + 0x6a4]
mov edx, dword [ebp - 0x1044]
mov dword [edx + ecx + 0x22c], eax
test eax, eax
je 0x40d75c
mov ecx, dword [esi + 0x6a4]
lea eax, [ebp - 0x140]
mov edx, dword [ebp - 0x1094]
push eax
mov eax, dword [ebp - 0x1044]
mov ecx, dword [eax + ecx + 0x22c]
call fcn.004075b9
push dword [ebp - 0x104c]
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
mov edx, dword [ebp - 0x1060]
test edx, edx
je 0x40d77f
mov eax, dword [edx]
push edx
mov esi, dword [eax + 8]
jmp 0x40cf01
xor edi, edi
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount64]
mov ecx, eax
mov dword [ebp - 0x11f0], edi
sub ecx, dword [ebp - 0x110c]
mov esi, edx
mov dword [ebp - 0x1168], ecx
sbb esi, dword [ebp - 0x1074]
mov ecx, esi
mov dword [ebp - 0x11e0], edi
and esi, 0x7fffffff
mov dword [ebp - 0x1164], esi
mov esi, 0x80000000
fild qword [ebp - 0x1168]
and ecx, esi
sub eax, dword [ebp - 0x10cc]
mov dword [ebp - 0x11ec], ecx
sbb edx, dword [ebp - 0x10ac]
fild qword [ebp - 0x11f0]
mov dword [ebp - 0x11e8], eax
mov eax, edx
and edx, 0x7fffffff
and eax, esi
mov dword [ebp - 0x11e4], edx
mov dword [ebp - 0x11dc], eax
fchs
mov eax, dword [ebp - 0x106c]
faddp st(1)
fstp qword [ebp - 0x1078]
fld qword [ebp - 0x1078]
fld qword [ebp - 0x10b8]
fdiv st(1), st(0)
fxch st(1)
fst qword [ebp - 0x1098]
fild qword [ebp - 0x11e8]
fild qword [ebp - 0x11e0]
fchs
faddp st(1)
fstp qword [ebp - 0x1078]
fld qword [ebp - 0x1078]
fdivrp st(2)
fxch st(1)
mov esi, dword [ebp - 0x1048]
fst qword [ebp - 0x1110]
test eax, eax
js 0x40dae1
jne 0x40dae1
mov eax, dword [esi + 0x6a4]
fstp st(0)
mov ecx, dword [ebp - 0x1044]
fstp st(0)
push 4
mov dword [ecx + eax + 0x240], 1
add ecx, dword [esi + 0x6a4]
pop eax
mov dword [ebp - 0x1050], eax
mov dword [ebp - 0x105c], eax
lea eax, [ebp - 0x1050]
push eax
lea eax, [ecx + 0x234]
push eax
lea eax, [ebp - 0x105c]
push eax
push edi
push 0x401c38
push dword [ecx + 0x18]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
je 0x40d8c5
mov eax, dword [esi + 0x6a4]
mov ecx, dword [ebp - 0x1044]
mov dword [ecx + eax + 0x234], 0xc8
test byte [esi + 0x658], 3
jne 0x40d8e5
push ecx
push 0x401c4c
push ecx
push 0x40
pop edx
lea ecx, [ebp - 0xd8]
call fcn.004075ee
jmp 0x40d906
push dword [esi + 0x65c]
lea eax, [ebp - 0xd8]
push 0x401c4c
push 0x401c64
push 0x40
push eax
call fcn.004076aa
add esp, 0x14
push 4
pop eax
mov dword [ebp - 0x1050], eax
mov dword [ebp - 0x105c], eax
mov eax, dword [esi + 0x658]
mov dword [ebp - 0x10a0], edi
test eax, 0x200
je 0x40d99e
mov eax, dword [esi + 0x6a4]
mov ecx, dword [ebp - 0x1044]
mov dword [ecx + eax + 0x248], edi
lea eax, [ebp - 0x1050]
push eax
lea eax, [ebp - 0x10a0]
push eax
lea eax, [ebp - 0x105c]
push eax
mov eax, dword [esi + 0x6a4]
push edi
push 0x401c74
push dword [ecx + eax + 0x18]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov edx, dword [ebp - 0x1044]
test eax, eax
jne 0x40d986
mov ecx, dword [ebp - 0x10a0]
mov eax, dword [esi + 0x6a4]
and ecx, 1
mov dword [edx + eax + 0x248], ecx
mov ecx, dword [esi + 0x6a4]
mov eax, dword [ebp - 0x10a0]
mov dword [edx + ecx + 0x24c], eax
jmp 0x40da44
mov ecx, dword [esi + 0x6a4]
test al, 8
je 0x40d9c2
imul eax, dword [ebp - 0x1054], 0x250
mov dword [eax + ecx + 0x244], 1
jmp 0x40da44
lea eax, [ebp - 0x1050]
push eax
lea eax, [ebp - 0x10a0]
push eax
lea eax, [ebp - 0x105c]
push eax
push edi
lea eax, [ebp - 0xd8]
push eax
mov eax, dword [ebp - 0x1044]
push dword [ecx + eax + 0x18]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov edx, dword [esi + 0x658]
mov ecx, dword [esi + 0x6a4]
and edx, 3
test eax, eax
jne 0x40da1c
mov ecx, dword [ebp - 0x10a0]
test edx, edx
jne 0x40da11
and ecx, 1
jmp 0x40da14
and ecx, 2
mov eax, dword [ebp - 0x1044]
jmp 0x40da37
mov eax, dword [ebp - 0x1044]
mov ecx, dword [ecx + eax + 0x230]
test edx, edx
jne 0x40da31
shr ecx, 1
jmp 0x40da34
shr ecx, 3
and ecx, 1
mov edx, dword [esi + 0x6a4]
mov dword [edx + eax + 0x244], ecx
mov ecx, dword [ebp - 0x1044]
lea eax, [ebp - 0x1050]
push eax
lea eax, [ebp - 0x7c0]
mov dword [ebp - 0x1050], 0x208
push eax
lea eax, [ebp - 0x105c]
mov dword [ebp - 0x1074], edi
push eax
mov eax, dword [esi + 0x6a4]
push edi
push 0x401c84
push dword [ecx + eax + 0x18]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x40da8c
inc eax
jmp 0x40daab
push ecx
lea eax, [ebp - 0x5b8]
mov edx, 0x104
push eax
push ecx
lea ecx, [ebp - 0x7c0]
call fcn.004075ee
mov eax, dword [ebp - 0x1074]
push eax
lea eax, [ebp - 0x7c0]
push eax
call fcn.00410b90
mov ecx, dword [esi + 0x6a4]
mov edx, dword [ebp - 0x1044]
fld qword [ebp - 0x1110]
fld qword [ebp - 0x1098]
fxch st(1)
inc dword [ebp - 0x10ec]
mov dword [edx + ecx], eax
mov dword [ebp - 0x1104], edi
mov edx, dword [esi + 0x6a4]
mov ecx, dword [ebp - 0x1044]
mov eax, dword [ebp - 0x1104]
xor eax, 1
mov dword [ebp - 0x1074], eax
cmp dword [ecx + edx + 0x240], edi
mov esi, dword [ecx + edx + 0x224]
mov byte [ebp - 0x114c], al
setne al
cmp dword [ecx + edx + 0x244], edi
mov byte [ebp - 0x1148], al
setne al
mov dword [ebp - 0x10ac], esi
mov byte [ebp - 0x1144], al
test esi, esi
jne 0x40db3d
mov dword [ebp - 0x10ac], 0x401900
mov eax, dword [ecx + edx + 0x228]
test eax, eax
jne 0x40db4d
mov eax, 0x401900
sub esp, 0x20
lea esi, [ecx + 4]
mov edi, esp
add esi, edx
fstp qword [esp + 0x18]
fstp qword [esp + 0x10]
push dword [ebp - 0x106c]
movsd dword es:[edi], dword [esi]
push dword [ebp - 0x114c]
push dword [ebp - 0x1148]
movsd dword es:[edi], dword [esi]
push dword [ebp - 0x1144]
push dword [ebp - 0x10ac]
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
xor edi, edi
cmp dword [ecx + edx + 0x248], edi
setne al
movzx eax, al
push eax
lea eax, [ecx + 0x1c]
add eax, edx
push eax
call fcn.0040b64c
mov ecx, dword [ebp - 0x10f0]
mov esi, dword [ebp - 0x1048]
test ecx, ecx
je 0x40dd35
imul eax, dword [ebp - 0x1058], 0xd8
mov edi, dword [ebp - 0x1044]
add ecx, eax
mov eax, dword [esi + 0x6a4]
add eax, 0x1c
mov dword [ebp - 0x104c], ecx
add eax, edi
push eax
push 0x4f
push 0x401bc0
push 0x50
push ecx
call fcn.004076aa
mov esi, dword [esi + 0x6a4]
add edi, 4
fld qword [ebp - 0x1098]
add esi, edi
mov edi, dword [ebp - 0x104c]
fld st(0)
fld qword [ebp - 0x10e8]
add edi, 0xa0
fcom st(1)
add esp, 0x14
fnstsw ax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor edi, edi
mov ecx, edi
mov esi, edi
mov dword [ebp - 0x10ac], ecx
test ah, 0x41
jp 0x40dc3e
fsub st(1), st(0)
fcom st(1)
fnstsw ax
test ah, 0x41
jne 0x40dc3e
add esi, edi
adc ecx, 0x80000000
mov dword [ebp - 0x10ac], ecx
fxch st(1)
call sub.msvcrt.dll__ftol2
fld qword [ebp - 0x1110]
add eax, esi
mov esi, dword [ebp - 0x104c]
fld st(0)
adc edx, dword [ebp - 0x10ac]
fcom st(2)
mov ecx, edi
mov dword [ebp - 0x10ac], ecx
mov dword [esi + 0xb0], eax
fnstsw ax
mov dword [esi + 0xb4], edx
mov edx, edi
mov dword [ebp - 0x10cc], edx
test ah, 1
jne 0x40dca3
fsub st(2)
fcom st(2)
fnstsw ax
fstp st(2)
test ah, 5
jp 0x40dca5
add ecx, edi
mov dword [ebp - 0x10ac], ecx
adc edx, 0x80000000
mov dword [ebp - 0x10cc], edx
jmp 0x40dca5
fstp st(2)
fxch st(1)
call sub.msvcrt.dll__ftol2
add eax, dword [ebp - 0x10ac]
mov ecx, dword [ebp - 0x1044]
adc edx, dword [ebp - 0x10cc]
mov dword [esi + 0xb8], eax
mov eax, dword [ebp - 0x1074]
mov dword [esi + 0xbc], edx
mov edx, dword [ebp - 0x104c]
mov esi, dword [ebp - 0x1048]
mov dword [edx + 0xc8], eax
mov eax, dword [esi + 0x6a4]
mov eax, dword [ecx + eax + 0x248]
mov dword [edx + 0xcc], eax
mov eax, dword [esi + 0x6a4]
fild dword [ecx + eax + 0x244]
fstp dword [edx + 0xc0]
mov eax, dword [esi + 0x6a4]
fild dword [ecx + eax + 0x240]
mov eax, dword [ebp - 0x106c]
mov dword [edx + 0xd0], eax
mov eax, dword [ebp - 0x1058]
mov dword [edx + 0xd4], eax
fstp dword [edx + 0xc4]
jmp 0x40dd43
fld qword [ebp - 0x1110]
fld qword [ebp - 0x1098]
fxch st(1)
fld qword [ebp - 0x1130]
lea ecx, [ebp - 0xeb0]
faddp st(2)
mov dword [ebp - 0xeb0], 0x401068
fxch st(1)
fstp qword [ebp - 0x1130]
fadd qword [ebp - 0x1120]
fstp qword [ebp - 0x1120]
call fcn.0041132a
lea ecx, [ebp - 0xeb0]
call fcn.0040c115
lea ecx, [ebp - 0xf78]
mov dword [ebp - 0xf78], 0x401074
call fcn.0041132a
lea ecx, [ebp - 0xf78]
call fcn.0040c115
cmp dword [ebp - 0x1104], 0
mov eax, dword [ebp - 0x1044]
mov dword [ebp - 0x1044], eax
je 0x40df06
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount64]
push dword [ebp - 0x10c8]
mov dword [ebp - 0x11d8], eax
mov ecx, esi
mov eax, edx
mov dword [ebp - 0x11c8], edi
and edx, 0x7fffffff
and eax, 0x80000000
mov dword [ebp - 0x11d4], edx
fild qword [ebp - 0x11d8]
mov dword [ebp - 0x11c4], eax
imul edx, dword [ebp - 0x10c0], 0xd0
fild qword [ebp - 0x11c8]
imul eax, dword [ebp - 0x10c8], 0xc8
add edx, dword [ebp - 0x10c4]
fchs
push edx
faddp st(1)
mov dword [ebp - 0x110c], edx
add eax, dword [ebp - 0x10bc]
push eax
mov dword [ebp - 0x1074], eax
mov eax, dword [esi + 0x6a4]
add eax, dword [ebp - 0x1044]
push eax
fstp qword [ebp - 0x10b0]
call fcn.0040e78c
call dword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetTickCount64]
mov dword [ebp - 0x11c0], eax
mov eax, edx
and edx, 0x7fffffff
mov dword [ebp - 0x11b8], edi
and eax, 0x80000000
mov dword [ebp - 0x11bc], edx
fild qword [ebp - 0x11c0]
mov dword [ebp - 0x11b4], eax
fild qword [ebp - 0x11b8]
fchs
faddp st(1)
fstp qword [ebp - 0x1098]
fld qword [ebp - 0x1098]
cmp dword [ebp - 0x10bc], 0
fsub qword [ebp - 0x10b0]
fdiv qword [ebp - 0x10b8]
fadd qword [ebp - 0x1138]
fstp qword [ebp - 0x1138]
je 0x40dee3
cmp dword [ebp - 0x10c4], 0
je 0x40dee3
mov eax, dword [ebp - 0x1074]
cmp dword [eax + 0xb0], 1
jne 0x40dec9
cmp dword [eax + 0xb4], edi
je 0x40dee3
mov eax, dword [ebp - 0x110c]
cmp dword [eax + 0xb8], edi
jl 0x40dedd
inc dword [ebp - 0x10f4]
inc dword [ebp - 0x10c0]
mov eax, dword [esi + 0x6a4]
add eax, dword [ebp - 0x1044]
inc dword [ebp - 0x10c8]
push 0x250
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
jmp 0x40df0c
inc dword [ebp - 0x1058]
mov eax, dword [ebp - 0x1054]
lea ecx, [ebp - 0x108c]
push edi
push edi
push edi
push edi
push ecx
lea ecx, [ebp - 0x348]
inc eax
push ecx
push eax
push dword [ebp - 0x1068]
mov dword [ebp - 0x1054], eax
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
cmp eax, 0x103
jne 0x40c908
cmp dword [ebp - 0x10fc], 0
mov eax, dword [ebp - 0x1058]
mov dword [esi + 0x6a0], eax
je 0x40e072
mov word [ebp - 0x1048], ax
call fcn.00408ca7
mov ecx, eax
cmp dword [ecx], edi
jbe 0x40e066
push 0x4000
push edi
call fcn.00404253
test al, al
je 0x40e066
mov eax, dword [ebp - 0x10fc]
mov edx, 0x402f2a
mov dword [ebp - 0x11a8], eax
movzx eax, word [ebp - 0x1048]
imul eax, eax, 0xa8
mov dword [ebp - 0x119c], 2
mov dword [ebp - 0x11b0], 0x1000000
mov dword [ebp - 0x11ac], edi
mov dword [ebp - 0x11a4], eax
lea eax, [ebp - 0x1048]
mov dword [ebp - 0x11a0], eax
lea eax, [ebp - 0x1120]
mov dword [ebp - 0x1088], eax
lea eax, [ebp - 0x1140]
mov dword [ebp - 0x1084], eax
mov eax, dword [esi + 0x668]
mov dword [ebp - 0x1080], eax
mov eax, dword [ebp - 0x1058]
mov dword [ebp - 0x109c], eax
mov eax, dword [ebp - 0x1054]
mov dword [ebp - 0x107c], eax
lea eax, [esi + 8]
mov dword [ebp - 0x10e4], eax
lea eax, [ebp - 0x11b0]
mov dword [ebp - 0x10b4], eax
lea eax, [ebp - 0x11a8]
push eax
lea eax, [ebp - 0x11a0]
push eax
lea eax, [ebp - 0x1088]
push eax
lea eax, [ebp - 0x1084]
push eax
lea eax, [ebp - 0x1080]
push eax
lea eax, [ebp - 0x109c]
push eax
lea eax, [ebp - 0x107c]
push eax
lea eax, [ebp - 0x10e4]
push eax
lea eax, [ebp - 0x10b4]
push eax
push ecx
push ecx
call fcn.00404a46
push dword [ebp - 0x10fc]
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
cmp dword [ebp - 0x10a4], 0
je 0x40e19c
mov ax, word [esi + 0x6a0]
mov word [ebp - 0x1048], ax
call fcn.00408ca7
mov ecx, eax
cmp dword [ecx], edi
jbe 0x40e190
push 0x4000
push edi
call fcn.00404253
test al, al
je 0x40e190
mov eax, dword [ebp - 0x10a4]
mov edx, 0x402e1d
mov dword [ebp - 0x1170], eax
movzx eax, word [ebp - 0x1048]
imul eax, eax, 0xc0
mov dword [ebp - 0x11cc], 2
mov dword [ebp - 0x1100], 0x1000000
mov dword [ebp - 0x10fc], edi
mov dword [ebp - 0x116c], eax
lea eax, [ebp - 0x1048]
mov dword [ebp - 0x11d0], eax
lea eax, [ebp - 0x1120]
mov dword [ebp - 0x10b4], eax
lea eax, [ebp - 0x1140]
mov dword [ebp - 0x10e4], eax
mov eax, dword [esi + 0x668]
mov dword [ebp - 0x107c], eax
mov eax, dword [ebp - 0x1058]
mov dword [ebp - 0x109c], eax
mov eax, dword [ebp - 0x1054]
mov dword [ebp - 0x1080], eax
lea eax, [esi + 8]
mov dword [ebp - 0x1084], eax
lea eax, [ebp - 0x1100]
mov dword [ebp - 0x1088], eax
lea eax, [ebp - 0x1170]
push eax
lea eax, [ebp - 0x11d0]
push eax
lea eax, [ebp - 0x10b4]
push eax
lea eax, [ebp - 0x10e4]
push eax
lea eax, [ebp - 0x107c]
push eax
lea eax, [ebp - 0x109c]
push eax
lea eax, [ebp - 0x1080]
push eax
lea eax, [ebp - 0x1084]
push eax
lea eax, [ebp - 0x1088]
push eax
push ecx
push ecx
call fcn.00404a46
push dword [ebp - 0x10a4]
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
cmp dword [ebp - 0x10a8], 0
je 0x40e2d9
mov ax, word [esi + 0x6a0]
mov word [ebp - 0x1048], ax
call fcn.00408ca7
mov ecx, eax
cmp dword [ecx], edi
jbe 0x40e2cd
push 0x4000
push edi
call fcn.00404253
test al, al
je 0x40e2cd
mov eax, dword [ebp - 0x10a8]
mov edx, 0x402d0c
mov dword [ebp - 0x1178], eax
movzx eax, word [ebp - 0x1048]
imul eax, eax, 0xb8
mov dword [ebp - 0x117c], 2
mov dword [ebp - 0x11f8], 0x1000000
mov dword [ebp - 0x11f4], edi
mov dword [ebp - 0x1174], eax
lea eax, [ebp - 0x1048]
mov dword [ebp - 0x1180], eax
lea eax, [ebp - 0x1120]
mov dword [ebp - 0x10b4], eax
lea eax, [ebp - 0x1130]
mov dword [ebp - 0x10e4], eax
mov eax, dword [esi + 0x668]
mov dword [ebp - 0x107c], eax
mov eax, dword [ebp - 0x10ec]
mov dword [ebp - 0x109c], eax
mov eax, dword [ebp - 0x1058]
mov dword [ebp - 0x1080], eax
mov eax, dword [ebp - 0x1054]
mov dword [ebp - 0x1084], eax
lea eax, [esi + 8]
mov dword [ebp - 0x1088], eax
lea eax, [ebp - 0x11f8]
mov dword [ebp - 0x10a4], eax
lea eax, [ebp - 0x1178]
push eax
lea eax, [ebp - 0x1180]
push eax
lea eax, [ebp - 0x10b4]
push eax
lea eax, [ebp - 0x10e4]
push eax
lea eax, [ebp - 0x107c]
push eax
lea eax, [ebp - 0x109c]
push eax
lea eax, [ebp - 0x1080]
push eax
lea eax, [ebp - 0x1084]
push eax
lea eax, [ebp - 0x1088]
push eax
lea eax, [ebp - 0x10a4]
push eax
push ecx
push ecx
call fcn.00404b43
push dword [ebp - 0x10a8]
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
cmp dword [ebp - 0x10f0], 0
je 0x40e416
mov ax, word [esi + 0x6a0]
mov word [ebp - 0x1048], ax
call fcn.00408ca7
mov ecx, eax
cmp dword [ecx], edi
jbe 0x40e40a
push 0x4000
push edi
call fcn.00404253
test al, al
je 0x40e40a
mov eax, dword [ebp - 0x10f0]
mov edx, 0x402b96
mov dword [ebp - 0x1190], eax
movzx eax, word [ebp - 0x1048]
imul eax, eax, 0xd8
mov dword [ebp - 0x1194], 2
mov dword [ebp - 0x1188], 0x1000000
mov dword [ebp - 0x1184], edi
mov dword [ebp - 0x118c], eax
lea eax, [ebp - 0x1048]
mov dword [ebp - 0x1198], eax
lea eax, [ebp - 0x1120]
mov dword [ebp - 0x10b4], eax
lea eax, [ebp - 0x1130]
mov dword [ebp - 0x10e4], eax
mov eax, dword [esi + 0x668]
mov dword [ebp - 0x107c], eax
mov eax, dword [ebp - 0x10ec]
mov dword [ebp - 0x109c], eax
mov eax, dword [ebp - 0x1058]
mov dword [ebp - 0x1080], eax
mov eax, dword [ebp - 0x1054]
mov dword [ebp - 0x1084], eax
lea eax, [esi + 8]
mov dword [ebp - 0x1088], eax
lea eax, [ebp - 0x1188]
mov dword [ebp - 0x10a8], eax
lea eax, [ebp - 0x1190]
push eax
lea eax, [ebp - 0x1198]
push eax
lea eax, [ebp - 0x10b4]
push eax
lea eax, [ebp - 0x10e4]
push eax
lea eax, [ebp - 0x107c]
push eax
lea eax, [ebp - 0x109c]
push eax
lea eax, [ebp - 0x1080]
push eax
lea eax, [ebp - 0x1084]
push eax
lea eax, [ebp - 0x1088]
push eax
lea eax, [ebp - 0x10a8]
push eax
push ecx
push ecx
call fcn.00404b43
push dword [ebp - 0x10f0]
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
cmp dword [ebp - 0x10bc], 0
lea edi, [esi + 0x668]
mov eax, dword [ebp - 0x10c8]
movzx edx, ax
lea eax, [esi + 0x658]
mov dword [ebp - 0x10b4], edx
je 0x40e48c
lea ecx, [ebp - 0x1124]
mov word [ebp - 0x1046], dx
push ecx
lea ecx, [ebp - 0x1138]
push ecx
lea ecx, [ebp - 0x10c0]
push ecx
lea ecx, [ebp - 0x10f4]
push ecx
lea ecx, [ebp - 0x1046]
push ecx
push edi
lea edx, [esi + 8]
push eax
lea ecx, [ebp - 0x10bc]
call fcn.00411881
push dword [ebp - 0x10bc]
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
mov edx, dword [ebp - 0x10b4]
lea eax, [esi + 0x658]
cmp dword [ebp - 0x10c4], 0
lea ecx, [esi + 8]
je 0x40e4dd
mov word [ebp - 0x1046], dx
lea edx, [ebp - 0x1124]
push edx
lea edx, [ebp - 0x1138]
push edx
lea edx, [ebp - 0x10c0]
push edx
lea edx, [ebp - 0x10f4]
push edx
lea edx, [ebp - 0x1046]
push edx
push edi
mov edx, ecx
lea ecx, [ebp - 0x10c4]
push eax
call fcn.0041191a
push dword [ebp - 0x10c4]
call dword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
push dword [ebp - 0x1058]
lea eax, [esi + 8]
push dword [ebp - 0x1054]
push ecx
push eax
call fcn.0040b271
cmp dword [ebp - 0x1068], 0
je 0x40e508
push dword [ebp - 0x1068]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
xor edi, edi
inc edi
lea ecx, [ebp - 0x1040]
mov dword [ebp - 0x1040], 0x401080
call fcn.0041132a
lea ecx, [ebp - 0x1040]
call fcn.0040c115
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004124d0
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
lea ecx, [ebp - 0xeb0]
mov dword [ebp - 0xeb0], 0x401068
call fcn.0041132a
lea ecx, [ebp - 0xeb0]
call fcn.0040c115
lea ecx, [ebp - 0xf78]
mov dword [ebp - 0xf78], 0x401074
call fcn.0041132a
lea ecx, [ebp - 0xf78]
call fcn.0040c115
jmp 0x40e50b