Function at 0xa53c80
Capabilities:
Persist via winlogon helper dll registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xabc20f
mov eax, dword fs:[0]
push eax
sub esp, 0x270
mov eax, dword [0xae6d50]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor esi, esi
mov edi, ecx
mov ebx, 7
xor ecx, ecx
mov dword [ebp - 0x268], eax
mov dword [ebp - 0x270], edi
mov dword [ebp - 0x258], esi
mov dword [ebp - 0x260], esi
mov dword [ebp - 0x27c], esi
mov dword [ebp - 0x254], esi
mov dword [ebp - 0x1ac], ebx
mov dword [ebp - 0x1b0], esi
mov word [ebp - 0x1c0], cx
mov dword [ebp - 4], esi
push esi
xor edx, edx
push 0xac3064
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x200], ebx
mov dword [ebp - 0x204], esi
mov word [ebp - 0x214], dx
call fcn.00a51740
mov byte [ebp - 4], 1
push esi
xor eax, eax
push 0xac3064
lea ecx, [ebp - 0x1dc]
mov dword [ebp - 0x1c8], ebx
mov dword [ebp - 0x1cc], esi
mov word [ebp - 0x1dc], ax
call fcn.00a51740
mov byte [ebp - 4], 2
xor ecx, ecx
push esi
mov word [ebp - 0x230], cx
push 0xac3064
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x220], esi
call fcn.00a51740
mov byte [ebp - 4], 3
push 1
xor edx, edx
push 0xac31cc
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 0x1e4], ebx
mov dword [ebp - 0x1e8], esi
mov word [ebp - 0x1f8], dx
call fcn.00a51740
mov ecx, 0xac31d0
mov ebx, 0xac31e0
mov edx, 0x80000002
lea esi, [ebp - 0x24c]
mov byte [ebp - 4], 4
call fcn.00a69920
push eax
lea ecx, [ebp - 0x214]
mov byte [ebp - 4], 5
call fcn.00a51560
mov byte [ebp - 4], 4
cmp dword [ebp - 0x238], 8
jb 0xa53de5
mov eax, dword [ebp - 0x24c]
push eax
call fcn.00a9e60d
add esp, 4
cmp dword [ebp - 0x204], 0
je 0xa5415d
push 0xffffffffffffffff
push 0
lea ecx, [ebp - 0x214]
push ecx
lea ecx, [ebp - 0x1dc]
call fcn.00a515e0
jmp 0xa53e10
cmp dword [ebp - 0x1e4], 8
mov eax, dword [ebp - 0x1f8]
jae 0xa53e25
lea eax, [ebp - 0x1f8]
mov edx, dword [ebp - 0x1e8]
push edx
push eax
lea eax, [ebp - 0x1dc]
push eax
call fcn.00a60740
mov edi, eax
cmp edi, 0xffffffff
je 0xa53fff
lea ecx, [ebp - 0x1dc]
push ecx
mov ecx, edi
xor edx, edx
lea esi, [ebp - 0x24c]
call fcn.00a5eb80
mov esi, eax
lea edx, [ebp - 0x1c0]
cmp edx, esi
je 0xa53eef
cmp dword [ebp - 0x1ac], 8
jb 0xa53e82
mov eax, dword [ebp - 0x1c0]
push eax
call fcn.00a9e60d
add esp, 4
xor ecx, ecx
mov ebx, 7
mov dword [ebp - 0x1ac], ebx
mov dword [ebp - 0x1b0], 0
mov word [ebp - 0x1c0], cx
cmp dword [esi + 0x14], 8
jae 0xa53ec0
mov eax, dword [esi + 0x10]
lea edx, [eax + eax + 2]
push edx
lea eax, [ebp - 0x1c0]
push esi
push eax
call fcn.00a9e620
add esp, 0xc
jmp 0xa53ece
mov ecx, dword [esi]
mov dword [ebp - 0x1c0], ecx
mov dword [esi], 0
mov edx, dword [esi + 0x10]
mov dword [ebp - 0x1b0], edx
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x1ac], eax
xor ecx, ecx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x10], 0
mov word [esi], cx
mov byte [ebp - 4], 4
cmp dword [ebp - 0x238], 8
jb 0xa53f0b
mov edx, dword [ebp - 0x24c]
push edx
call fcn.00a9e60d
add esp, 4
call fcn.00a8a1b1
mov esi, eax
mov dword [ebp - 0x278], esi
call fcn.00a8a06b
push 0
lea ecx, [ebp - 0x274]
mov ebx, eax
call fcn.00a89fa0
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0xa53f38
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x274]
call fcn.00a89fc8
push ecx
mov byte [ebp - 4], 7
mov eax, esp
mov dword [ebp - 0x264], esp
push 0
lea ecx, [ebp - 0x26c]
mov dword [eax], esi
call fcn.00a89fa0
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
jae 0xa53f6b
inc eax
mov dword [esi + 4], eax
lea ecx, [ebp - 0x26c]
call fcn.00a89fc8
lea eax, [ebp - 0x1c0]
push eax
call fcn.00a66860
add esp, 8
test al, al
push 0
lea ecx, [ebp - 0x25c]
sete byte [ebp - 0x24d]
mov byte [ebp - 4], 4
call fcn.00a89fa0
mov eax, dword [esi + 4]
test eax, eax
je 0xa53faf
cmp eax, 0xffffffff
jae 0xa53faf
dec eax
mov dword [esi + 4], eax
mov ebx, dword [esi + 4]
neg ebx
sbb ebx, ebx
lea ecx, [ebp - 0x25c]
not ebx
call fcn.00a89fc8
and ebx, esi
je 0xa53fd1
mov edx, dword [ebx]
mov eax, dword [edx]
push 1
mov ecx, ebx
call eax
cmp byte [ebp - 0x24d], 0
je 0xa53fe4
mov dword [ebp - 0x27c], 1
mov ecx, dword [ebp - 0x1e8]
add ecx, edi
push ecx
push 0
lea ecx, [ebp - 0x1dc]
call fcn.00a51830
jmp 0xa53e10
call fcn.00a8a1b1
mov esi, eax
mov dword [ebp - 0x264], esi
call fcn.00a8a06b
push 0
lea ecx, [ebp - 0x25c]
mov ebx, eax
call fcn.00a89fa0
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0xa5402c
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x25c]
call fcn.00a89fc8
push ecx
mov byte [ebp - 4], 8
mov eax, esp
mov dword [ebp - 0x278], esp
push 0
lea ecx, [ebp - 0x26c]
mov dword [eax], esi
call fcn.00a89fa0
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
jae 0xa5405f
inc eax
mov dword [esi + 4], eax
lea ecx, [ebp - 0x26c]
call fcn.00a89fc8
lea edx, [ebp - 0x1dc]
push edx
call fcn.00a66860
add esp, 8
test al, al
push 0
lea ecx, [ebp - 0x25c]
sete byte [ebp - 0x24d]
mov byte [ebp - 4], 4
call fcn.00a89fa0
mov eax, dword [esi + 4]
test eax, eax
je 0xa540a3
cmp eax, 0xffffffff
jae 0xa540a3
dec eax
mov dword [esi + 4], eax
mov ebx, dword [esi + 4]
neg ebx
sbb ebx, ebx
lea ecx, [ebp - 0x25c]
not ebx
call fcn.00a89fc8
and ebx, esi
je 0xa540c5
mov eax, dword [ebx]
mov edx, dword [eax]
push 1
mov ecx, ebx
call edx
cmp byte [ebp - 0x24d], 0
jne 0xa540db
cmp dword [ebp - 0x27c], 1
jne 0xa541ce
push 0xac325c
push ecx
lea eax, [ebp - 0x214]
push eax
push ecx
mov ecx, dword [ebp - 0x270]
push 0xac3268
push ecx
call fcn.00a64730
add esp, 0xc
push eax
call fcn.00a649f0
add esp, 0xc
push eax
call fcn.00a64730
mov esi, eax
mov edx, dword [esi]
mov eax, dword [edx + 4]
add esp, 8
xor ebx, ebx
test byte [eax + esi + 0xc], 6
jne 0xa54136
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0xa54136
mov ebx, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test ebx, ebx
je 0xa541ce
mov eax, dword [ecx + 0xc]
or eax, ebx
cmp dword [ecx + 0x38], 0
jne 0xa54153
or eax, 4
push 0
push eax
call fcn.00a52d10
jmp 0xa541ce
push 0xac32c8
push edi
call fcn.00a64730
mov esi, eax
mov edx, dword [esi]
mov eax, dword [edx + 4]
mov ecx, dword [eax + esi + 0xc]
add esp, 8
xor ebx, ebx
test cl, 6
jne 0xa54194
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0xa54194
mov ebx, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test ebx, ebx
je 0xa541b5
mov eax, dword [ecx + 0xc]
or eax, ebx
cmp dword [ecx + 0x38], 0
jne 0xa541ad
or eax, 4
push 0
push eax
call fcn.00a52d10
push 1
push 0xac31d0
mov esi, 0xac3354
mov ecx, 0xac31e0
call fcn.00a69a40
add esp, 8
push 0
push 0xac3064
lea ecx, [ebp - 0x1dc]
call fcn.00a51740
push 0
push 0xac3064
lea ecx, [ebp - 0x1c0]
call fcn.00a51740
mov ecx, 0xac31d0
mov ebx, 0xac31e0
mov edx, 0x80000001
lea esi, [ebp - 0x24c]
call fcn.00a69920
push eax
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 9
call fcn.00a51560
mov byte [ebp - 4], 4
cmp dword [ebp - 0x238], 8
jb 0xa54238
mov edx, dword [ebp - 0x24c]
push edx
call fcn.00a9e60d
add esp, 4
cmp dword [ebp - 0x220], 0
je 0xa545a7
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x1dc]
call fcn.00a515e0
jmp 0xa54260
cmp dword [ebp - 0x1e4], 8
mov eax, dword [ebp - 0x1f8]
jae 0xa54275
lea eax, [ebp - 0x1f8]
mov ecx, dword [ebp - 0x1e8]
push ecx
push eax
lea edx, [ebp - 0x1dc]
push edx
call fcn.00a60740
mov edi, eax
cmp edi, 0xffffffff
je 0xa5444f
lea eax, [ebp - 0x1dc]
push eax
mov ecx, edi
xor edx, edx
lea esi, [ebp - 0x24c]
call fcn.00a5eb80
mov esi, eax
lea ecx, [ebp - 0x1c0]
cmp ecx, esi
je 0xa5433f
cmp dword [ebp - 0x1ac], 8
jb 0xa542d2
mov edx, dword [ebp - 0x1c0]
push edx
call fcn.00a9e60d
add esp, 4
xor eax, eax
mov ebx, 7
mov dword [ebp - 0x1ac], ebx
mov dword [ebp - 0x1b0], 0
mov word [ebp - 0x1c0], ax
cmp dword [esi + 0x14], 8
jae 0xa54310
mov eax, dword [esi + 0x10]
lea ecx, [eax + eax + 2]
push ecx
lea edx, [ebp - 0x1c0]
push esi
push edx
call fcn.00a9e620
add esp, 0xc
jmp 0xa5431e
mov eax, dword [esi]
mov dword [ebp - 0x1c0], eax
mov dword [esi], 0
mov ecx, dword [esi + 0x10]
mov dword [ebp - 0x1b0], ecx
mov edx, dword [esi + 0x14]
mov dword [ebp - 0x1ac], edx
xor eax, eax
mov dword [esi + 0x14], ebx
mov dword [esi + 0x10], 0
mov word [esi], ax
mov byte [ebp - 4], 4
cmp dword [ebp - 0x238], 8
jb 0xa5435b
mov ecx, dword [ebp - 0x24c]
push ecx
call fcn.00a9e60d
add esp, 4
call fcn.00a8a1b1
mov esi, eax
mov dword [ebp - 0x264], esi
call fcn.00a8a06b
push 0
lea ecx, [ebp - 0x25c]
mov ebx, eax
call fcn.00a89fa0
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0xa54388
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x25c]
call fcn.00a89fc8
push ecx
mov byte [ebp - 4], 0xb
mov eax, esp
mov dword [ebp - 0x278], esp
push 0
lea ecx, [ebp - 0x26c]
mov dword [eax], esi
call fcn.00a89fa0
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
jae 0xa543bb
inc eax
mov dword [esi + 4], eax
lea ecx, [ebp - 0x26c]
call fcn.00a89fc8
lea edx, [ebp - 0x1c0]
push edx
call fcn.00a66860
add esp, 8
test al, al
push 0
lea ecx, [ebp - 0x274]
sete byte [ebp - 0x24d]
mov byte [ebp - 4], 4
call fcn.00a89fa0
mov eax, dword [esi + 4]
test eax, eax
je 0xa543ff
cmp eax, 0xffffffff
jae 0xa543ff
dec eax
mov dword [esi + 4], eax
mov ebx, dword [esi + 4]
neg ebx
sbb ebx, ebx
lea ecx, [ebp - 0x274]
not ebx
call fcn.00a89fc8
and ebx, esi
je 0xa54421
mov eax, dword [ebx]
mov edx, dword [eax]
push 1
mov ecx, ebx
call edx
cmp byte [ebp - 0x24d], 0
je 0xa54434
mov dword [ebp - 0x254], 1
mov eax, dword [ebp - 0x1e8]
add eax, edi
push eax
push 0
lea ecx, [ebp - 0x1dc]
call fcn.00a51830
jmp 0xa54260
call fcn.00a8a1b1
mov esi, eax
mov dword [ebp - 0x264], esi
call fcn.00a8a06b
push 0
lea ecx, [ebp - 0x25c]
mov ebx, eax
call fcn.00a89fa0
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0xa5447c
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x25c]
call fcn.00a89fc8
push ecx
mov byte [ebp - 4], 0xc
mov eax, esp
mov dword [ebp - 0x278], esp
push 0
lea ecx, [ebp - 0x26c]
mov dword [eax], esi
call fcn.00a89fa0
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
jae 0xa544af
inc eax
mov dword [esi + 4], eax
lea ecx, [ebp - 0x26c]
call fcn.00a89fc8
lea ecx, [ebp - 0x1dc]
push ecx
call fcn.00a66860
add esp, 8
test al, al
push 0
lea ecx, [ebp - 0x25c]
sete byte [ebp - 0x24d]
mov byte [ebp - 4], 4
call fcn.00a89fa0
mov eax, dword [esi + 4]
test eax, eax
je 0xa544f3
cmp eax, 0xffffffff
jae 0xa544f3
dec eax
mov dword [esi + 4], eax
mov ebx, dword [esi + 4]
neg ebx
sbb ebx, ebx
lea ecx, [ebp - 0x25c]
not ebx
call fcn.00a89fc8
and ebx, esi
je 0xa54515
mov edx, dword [ebx]
mov eax, dword [edx]
push 1
mov ecx, ebx
call eax
cmp byte [ebp - 0x24d], 0
jne 0xa5452b
cmp dword [ebp - 0x254], 1
jne 0xa545a7
mov edx, dword [ebp - 0x270]
push 0xac325c
push ecx
lea ecx, [ebp - 0x230]
push ecx
push ecx
push 0xac3370
push edx
call fcn.00a64730
add esp, 0xc
push eax
call fcn.00a649f0
add esp, 0xc
push eax
call fcn.00a64730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor ebx, ebx
test byte [eax + esi + 0xc], 6
jne 0xa54586
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0xa54586
mov ebx, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test ebx, ebx
je 0xa545a7
mov eax, dword [ecx + 0xc]
or eax, ebx
cmp dword [ecx + 0x38], 0
jne 0xa5459f
or eax, 4
push 0
push eax
call fcn.00a52d10
lea edx, [ebp - 0x254]
push edx
push 0x20019
push 0
push 0xac33e8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xa546c2
lea eax, [ebp - 0x25c]
push eax
mov eax, dword [ebp - 0x254]
lea ecx, [ebp - 0x260]
push ecx
lea edx, [ebp - 0x264]
push edx
push 0
push 0xac33cc
push eax
mov dword [ebp - 0x25c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x254]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0xa546c2
mov eax, dword [ebp - 0x260]
test eax, eax
je 0xa546c2
push eax
push 0xac3454
mov eax, 0x190
lea ebx, [ebp - 0x1a4]
call fcn.00a53130
mov edi, dword [ebp - 0x270]
add esp, 8
push 0xac325c
push ecx
mov edx, ebx
push edx
push ecx
push 0xac3470
push edi
call fcn.00a64730
add esp, 0xc
push eax
call fcn.00a64730
add esp, 0xc
push eax
call fcn.00a64730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor ebx, ebx
test byte [eax + esi + 0xc], 6
jne 0xa54695
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0xa54695
mov ebx, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test ebx, ebx
je 0xa546b6
mov eax, dword [ecx + 0xc]
or eax, ebx
cmp dword [ecx + 0x38], 0
jne 0xa546ae
or eax, 4
push 0
push eax
call fcn.00a52d10
mov dword [ebp - 0x258], 1
jmp 0xa546c8
mov edi, dword [ebp - 0x270]
lea edx, [ebp - 0x254]
push edx
push 0x20019
push 0
push 0xac3590
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xa547d7
lea eax, [ebp - 0x25c]
push eax
mov eax, dword [ebp - 0x254]
lea ecx, [ebp - 0x260]
push ecx
lea edx, [ebp - 0x264]
push edx
push 0
push 0xac3570
push eax
mov dword [ebp - 0x25c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x254]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0xa547d7
mov eax, dword [ebp - 0x260]
test eax, eax
je 0xa547d7
push eax
push 0xac3454
mov eax, 0x190
lea ebx, [ebp - 0x1a4]
call fcn.00a53130
add esp, 8
push 0xac325c
push ecx
mov edx, ebx
push edx
push ecx
push 0xac3600
push edi
call fcn.00a64730
add esp, 0xc
push eax
call fcn.00a64730
add esp, 0xc
push eax
call fcn.00a64730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor ebx, ebx
test byte [eax + esi + 0xc], 6
jne 0xa547b0
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0xa547b0
mov ebx, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test ebx, ebx
je 0xa547d1
mov eax, dword [ecx + 0xc]
or eax, ebx
cmp dword [ecx + 0x38], 0
jne 0xa547c9
or eax, 4
push 0
push eax
call fcn.00a52d10
inc dword [ebp - 0x258]
lea edx, [ebp - 0x254]
push edx
push 0x20019
push 0
push 0xac3590
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xa548e6
lea eax, [ebp - 0x25c]
push eax
mov eax, dword [ebp - 0x254]
lea ecx, [ebp - 0x260]
push ecx
lea edx, [ebp - 0x264]
push edx
push 0
push 0xac36ec
push eax
mov dword [ebp - 0x25c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x254]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0xa548e6
mov eax, dword [ebp - 0x260]
test eax, eax
je 0xa548e6
push eax
push 0xac3454
mov eax, 0x190
lea ebx, [ebp - 0x1a4]
call fcn.00a53130
add esp, 8
push 0xac325c
push ecx
mov edx, ebx
push edx
push ecx
push 0xac3700
push edi
call fcn.00a64730
add esp, 0xc
push eax
call fcn.00a64730
add esp, 0xc
push eax
call fcn.00a64730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor ebx, ebx
test byte [eax + esi + 0xc], 6
jne 0xa548bf
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0xa548bf
mov ebx, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test ebx, ebx
je 0xa548e0
mov eax, dword [ecx + 0xc]
or eax, ebx
cmp dword [ecx + 0x38], 0
jne 0xa548d8
or eax, 4
push 0
push eax
call fcn.00a52d10
inc dword [ebp - 0x258]
lea edx, [ebp - 0x254]
push edx
push 0x20019
push 0
push 0xac37e8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xa549f5
lea eax, [ebp - 0x25c]
push eax
mov eax, dword [ebp - 0x254]
lea ecx, [ebp - 0x260]
push ecx
lea edx, [ebp - 0x264]
push edx
push 0
push 0xac36ec
push eax
mov dword [ebp - 0x25c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x254]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0xa549f5
mov eax, dword [ebp - 0x260]
test eax, eax
je 0xa549f5
push eax
push 0xac3454
mov eax, 0x190
lea ebx, [ebp - 0x1a4]
call fcn.00a53130
add esp, 8
push 0xac325c
push ecx
mov edx, ebx
push edx
push ecx
push 0xac3860
push edi
call fcn.00a64730
add esp, 0xc
push eax
call fcn.00a64730
add esp, 0xc
push eax
call fcn.00a64730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor ebx, ebx
test byte [eax + esi + 0xc], 6
jne 0xa549ce
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0xa549ce
mov ebx, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test ebx, ebx
je 0xa549ef
mov eax, dword [ecx + 0xc]
or eax, ebx
cmp dword [ecx + 0x38], 0
jne 0xa549e7
or eax, 4
push 0
push eax
call fcn.00a52d10
inc dword [ebp - 0x258]
mov edx, dword [ebp - 0x268]
push edx
call fcn.00a5ce90
add esp, 4
test eax, eax
jne 0xa54b1b
lea eax, [ebp - 0x254]
push eax
push 0x20019
push 0
push 0xac3978
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xa54b1b
lea ecx, [ebp - 0x268]
push ecx
mov ecx, dword [ebp - 0x254]
lea edx, [ebp - 0x260]
push edx
lea eax, [ebp - 0x264]
push eax
push 0
push 0xac3950
push ecx
mov dword [ebp - 0x268], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 0x254]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0xa54b1b
mov eax, dword [ebp - 0x260]
test eax, eax
je 0xa54b1b
push eax
push 0xac3454
mov eax, 0x190
lea ebx, [ebp - 0x1a4]
call fcn.00a53130
add esp, 8
push 0xac325c
push ecx
mov eax, ebx
push eax
push ecx
push 0xac39c0
push edi
call fcn.00a64730
add esp, 0xc
push eax
call fcn.00a64730
add esp, 0xc
push eax
call fcn.00a64730
mov esi, eax
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
add esp, 8
xor ebx, ebx
test byte [eax + esi + 0xc], 6
jne 0xa54af4
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0xa54af4
mov ebx, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test ebx, ebx
je 0xa54b15
mov eax, dword [ecx + 0xc]
or eax, ebx
cmp dword [ecx + 0x38], 0
jne 0xa54b0d
or eax, 4
push 0
push eax
call fcn.00a52d10
inc dword [ebp - 0x258]
lea edx, [ebp - 0x254]
push edx
push 0x20019
push 0
push 0xac3a98
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xa54c2a
lea eax, [ebp - 0x268]
push eax
mov eax, dword [ebp - 0x254]
lea ecx, [ebp - 0x260]
push ecx
lea edx, [ebp - 0x264]
push edx
push 0
push 0xac3950
push eax
mov dword [ebp - 0x268], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x254]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0xa54c2a
mov eax, dword [ebp - 0x260]
test eax, eax
je 0xa54c2a
push eax
push 0xac3454
mov eax, 0x190
lea ebx, [ebp - 0x1a4]
call fcn.00a53130
add esp, 8
push 0xac325c
push ecx
mov edx, ebx
push edx
push ecx
push 0xac3af8
push edi
call fcn.00a64730
add esp, 0xc
push eax
call fcn.00a64730
add esp, 0xc
push eax
call fcn.00a64730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor ebx, ebx
test byte [eax + esi + 0xc], 6
jne 0xa54c03
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0xa54c03
mov ebx, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test ebx, ebx
je 0xa54c24
mov eax, dword [ecx + 0xc]
or eax, ebx
cmp dword [ecx + 0x38], 0
jne 0xa54c1c
or eax, 4
push 0
push eax
call fcn.00a52d10
inc dword [ebp - 0x258]
lea edx, [ebp - 0x254]
push edx
push 0x20019
push 0
push 0xac3c18
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xa54d39
lea eax, [ebp - 0x268]
push eax
mov eax, dword [ebp - 0x254]
lea ecx, [ebp - 0x260]
push ecx
lea edx, [ebp - 0x264]
push edx
push 0
push 0xac3be4
push eax
mov dword [ebp - 0x268], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x254]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0xa54d39
mov eax, dword [ebp - 0x260]
test eax, eax
je 0xa54d39
push eax
push 0xac3454
mov eax, 0x190
lea ebx, [ebp - 0x1a4]
call fcn.00a53130
add esp, 8
push 0xac325c
push ecx
mov edx, ebx
push edx
push ecx
push 0xac3ca0
push edi
call fcn.00a64730
add esp, 0xc
push eax
call fcn.00a64730
add esp, 0xc
push eax
call fcn.00a64730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor ebx, ebx
test byte [eax + esi + 0xc], 6
jne 0xa54d12
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0xa54d12
mov ebx, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test ebx, ebx
je 0xa54d33
mov eax, dword [ecx + 0xc]
or eax, ebx
cmp dword [ecx + 0x38], 0
jne 0xa54d2b
or eax, 4
push 0
push eax
call fcn.00a52d10
inc dword [ebp - 0x258]
lea edx, [ebp - 0x254]
push edx
push 0x20019
push 0
push 0xac3e10
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xa54e46
lea eax, [ebp - 0x268]
push eax
mov eax, dword [ebp - 0x254]
lea ecx, [ebp - 0x260]
push ecx
lea edx, [ebp - 0x264]
push edx
push 0
push 0xac3dec
push eax
mov dword [ebp - 0x268], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x254]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0xa54e46
cmp dword [ebp - 0x260], esi
jne 0xa54e46
push esi
push 0xac3454
mov eax, 0x190
lea ebx, [ebp - 0x1a4]
call fcn.00a53130
add esp, 8
push 0xac325c
push ecx
mov edx, ebx
push edx
push ecx
push 0xac3e88
push edi
call fcn.00a64730
add esp, 0xc
push eax
call fcn.00a64730
add esp, 0xc
push eax
call fcn.00a64730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor ebx, ebx
test byte [eax + esi + 0xc], 6
jne 0xa54e1f
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0xa54e1f
mov ebx, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test ebx, ebx
je 0xa54e40
mov eax, dword [ecx + 0xc]
or eax, ebx
cmp dword [ecx + 0x38], 0
jne 0xa54e38
or eax, 4
push 0
push eax
call fcn.00a52d10
inc dword [ebp - 0x258]
lea edx, [ebp - 0x254]
push edx
push 0x20019
push 0
push 0xac3f88
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xa54f53
lea eax, [ebp - 0x268]
push eax
mov eax, dword [ebp - 0x254]
lea ecx, [ebp - 0x260]
push ecx
lea edx, [ebp - 0x264]
push edx
push 0
push 0xac3dec
push eax
mov dword [ebp - 0x268], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x254]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0xa54f53
cmp dword [ebp - 0x260], esi
jne 0xa54f53
push esi
push 0xac3454
mov eax, 0x190
lea ebx, [ebp - 0x1a4]
call fcn.00a53130
add esp, 8
push 0xac325c
push ecx
mov edx, ebx
push edx
push ecx
push 0xac4040
push edi
call fcn.00a64730
add esp, 0xc
push eax
call fcn.00a64730
add esp, 0xc
push eax
call fcn.00a64730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor ebx, ebx
test byte [eax + esi + 0xc], 6
jne 0xa54f2c
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0xa54f2c
mov ebx, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test ebx, ebx
je 0xa54f4d
mov eax, dword [ecx + 0xc]
or eax, ebx
cmp dword [ecx + 0x38], 0
jne 0xa54f45
or eax, 4
push 0
push eax
call fcn.00a52d10
inc dword [ebp - 0x258]
mov edi, 8
cmp dword [ebp - 0x1e4], edi
jb 0xa54f6f
mov edx, dword [ebp - 0x1f8]
push edx
call fcn.00a9e60d
add esp, 4
xor ebx, ebx
xor eax, eax
mov esi, 7
mov dword [ebp - 0x1e4], esi
mov dword [ebp - 0x1e8], ebx
mov word [ebp - 0x1f8], ax
cmp dword [ebp - 0x21c], edi
jb 0xa54fa2
mov ecx, dword [ebp - 0x230]
push ecx
call fcn.00a9e60d
add esp, 4
xor edx, edx
mov dword [ebp - 0x21c], esi
mov dword [ebp - 0x220], ebx
mov word [ebp - 0x230], dx
cmp dword [ebp - 0x1c8], edi
jb 0xa54fce
mov eax, dword [ebp - 0x1dc]
push eax
call fcn.00a9e60d
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x1c8], esi
mov dword [ebp - 0x1cc], ebx
mov word [ebp - 0x1dc], cx
cmp dword [ebp - 0x200], edi
jb 0xa54ffa
mov edx, dword [ebp - 0x214]
push edx
call fcn.00a9e60d
add esp, 4
xor eax, eax
mov dword [ebp - 0x200], esi
mov dword [ebp - 0x204], ebx
mov word [ebp - 0x214], ax
cmp dword [ebp - 0x1ac], edi
jb 0xa55026
mov ecx, dword [ebp - 0x1c0]
push ecx
call fcn.00a9e60d
add esp, 4
mov eax, dword [ebp - 0x258]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00a9e488
mov esp, ebp
pop ebp
ret