Function at 0x52a0e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd4
push ebx
push esi
push edi
mov eax, dword [ebp - 0x34]
push eax
movzx ecx, byte [ebp - 0x30]
push ecx
call fcn.0052b4c0
test eax, eax
jne 0x52a123
mov esi, dword [ebp - 0x30]
add esi, 0x92
movzx edx, word [ebp - 0x58]
push edx
movzx eax, byte [ebp - 0x84]
push eax
call fcn.0052b4c0
and eax, dword [ebp - 0x34]
or esi, eax
mov dword [ebp - 0x38], esi
jmp 0x52a13a
mov ecx, dword [ebp - 0x34]
add ecx, dword [ebp - 4]
movzx edx, word [ebp - 0x3c]
add ecx, dword [ebp - 0x74]
lea eax, [edx + ecx + 0x71]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x50]
push ecx
movzx edx, byte [ebp - 0xbc]
push edx
call fcn.0052b4c0
mov esi, eax
add esi, dword [ebp - 0x24]
mov eax, dword [ebp - 0xa8]
add eax, dword [ebp - 0xbc]
and esi, eax
mov ecx, dword [ebp - 0x20]
push ecx
movzx edx, byte [ebp - 0xbc]
push edx
call fcn.0052b4c0
movzx ecx, word [ebp - 0x5c]
add eax, ecx
and esi, eax
and esi, dword [ebp - 0x34]
mov dword [ebp - 0xb8], esi
movzx edx, byte [ebp - 0x4a]
cmp edx, 0x9c
jne 0x52a1ae
movzx esi, word [ebp - 0x18]
add esi, 0xcf
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
sub esi, eax
mov dword [ebp - 0x9c], esi
jmp 0x52a1c7
movzx eax, byte [ebp - 0x4a]
sub eax, 0x3d
movzx ecx, byte [ebp - 0x19]
sub ecx, dword [ebp - 0x44]
add ecx, dword [ebp - 0x54]
sar eax, cl
mov byte [ebp - 0x8d], al
cmp dword [ebp - 0x68], 0
jne 0x52a1d7
mov cx, word [ebp - 0x68]
mov word [ebp - 0x28], cx
jmp 0x52a1f5
movzx edx, word [ebp - 0x5c]
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x84]
sub eax, 0x20
movzx ecx, word [ebp - 0xc4]
sub eax, ecx
or edx, eax
mov dword [ebp - 0x10], edx
xor edx, edx
mov word [ebp - 0x88], dx
mov dword [ebp - 0x54], 0xb5
movzx eax, word [ebp - 0x8c]
test eax, eax
je 0x52a22a
mov ecx, dword [ebp - 0x38]
push ecx
call fcn.0051a8d0
movzx edx, ax
add edx, 0xf0
mov dword [ebp - 0x84], edx
jmp 0x52a255
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x20]
movzx ecx, word [ebp - 0xac]
mov edx, dword [ebp - 0xb8]
lea ecx, [ecx + edx + 0x72]
sub ecx, dword [ebp - 0xbc]
add ecx, 0x58
and eax, ecx
mov dword [ebp - 0xcc], eax
mov edx, dword [ebp - 0x68]
push edx
movzx eax, byte [ebp - 0xcd]
push eax
movzx ecx, word [ebp - 0x7c]
push ecx
mov edx, dword [ebp - 0x74]
push edx
call fcn.00529720
movzx eax, al
sub eax, 0x56
and eax, 0x48
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0xb8]
lea ecx, [edx + ecx - 0x8f]
and eax, ecx
mov dword [ebp - 0x34], eax
mov edx, dword [ebp - 0x24]
push edx
movzx eax, byte [ebp - 0x54]
push eax
call fcn.0052b4c0
cmp eax, 0x7c
je 0x52a2c6
movzx esi, byte [ebp - 0x6d]
add esi, dword [ebp - 0x68]
add esi, dword [ebp - 0xb8]
mov ecx, dword [ebp - 0x38]
push ecx
movzx edx, byte [ebp - 0x44]
push edx
call fcn.0052b4c0
sub esi, eax
and esi, dword [ebp - 0x10]
mov word [ebp - 0x78], si
jmp 0x52a2f2
mov eax, dword [ebp - 0x74]
mov ecx, dword [ebp - 4]
lea esi, [ecx + eax - 0xcc]
mov edx, dword [ebp - 0xb8]
push edx
movzx eax, byte [ebp - 0x34]
push eax
call fcn.0052b4c0
add eax, dword [ebp - 0x34]
and esi, eax
or esi, dword [ebp - 0x24]
mov dword [ebp - 0xbc], esi
mov dword [ebp - 0xa8], 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetAltTabInfoA]
movzx eax, byte [esp - 0x20]
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 1
je 0x52a32c
mov ecx, 1
mov word [ebp - 0x88], cx
cmp dword [ebp - 0x24], 0x7e
jne 0x52a33d
mov edx, dword [ebp - 0x98]
mov dword [ebp - 0x10], edx
jmp 0x52a35f
movzx esi, word [ebp - 0x14]
movzx eax, byte [ebp - 0xad]
push eax
call fcn.0051a8d0
movzx ecx, ax
add esi, dword [ebp - 0x24]
add ecx, esi
add ecx, dword [ebp - 0x20]
mov dword [ebp - 0x84], ecx
movzx esi, word [ebp - 0xa0]
add esi, 0xa4
movzx edi, word [ebp - 0x60]
sub edi, dword [ebp - 0x24]
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AddAccessAllowedAce]
sub edi, eax
sub edi, dword [ebp - 4]
and esi, edi
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp - 0x44]
push eax
movzx ecx, byte [ebp - 0x6d]
push ecx
movzx edx, byte [ebp - 0x7d]
push edx
call fcn.00529720
movzx eax, al
and esi, eax
mov dword [ebp - 0xb8], esi
mov ecx, dword [ebp - 0x50]
add ecx, dword [ebp - 0x54]
add ecx, dword [ebp - 0xa8]
sub ecx, dword [ebp - 0xbc]
mov dword [ebp - 0x10], ecx
mov edx, 0x5a
sub edx, dword [ebp - 0x44]
sub edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
lea ecx, [edx + eax + 0x6f]
mov dword [ebp - 0x68], ecx
cmp dword [ebp - 0xa8], 0xcf
je 0x52a3f1
movzx edx, word [ebp - 0x28]
push edx
call fcn.0051a8d0
movzx eax, ax
test eax, eax
je 0x52a415
mov ecx, 0x6e
sub ecx, dword [ebp - 0x84]
add ecx, dword [ebp - 0xa8]
sub ecx, dword [ebp - 0xb8]
mov edx, dword [ebp - 0x38]
and edx, 0x13
or ecx, edx
mov dword [ebp - 0x30], ecx
jmp 0x52a439
movzx eax, byte [ebp - 0x80]
mov ecx, dword [ebp - 0x98]
lea edx, [eax + ecx + 0xda]
sub edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x24]
add eax, 0x154
or edx, eax
mov dword [ebp - 0x74], edx
cmp dword [ebp - 0xcc], 0x2f
jne 0x52a448
cmp dword [ebp - 0x74], 0
je 0x52a462
mov ecx, dword [ebp - 0x30]
sub ecx, dword [ebp - 0xbc]
sub ecx, dword [ebp - 0x74]
movzx edx, word [ebp - 0x18]
add ecx, edx
mov dword [ebp - 0xcc], ecx
jmp 0x52a491
movzx eax, word [ebp - 0x58]
push eax
movzx ecx, byte [ebp - 0x38]
push ecx
call fcn.0052b4c0
mov edx, dword [ebp - 0x74]
sub edx, dword [ebp - 0xcc]
movzx ecx, byte [ebp - 0x7d]
sub edx, ecx
and eax, edx
or eax, dword [ebp - 0xb8]
or eax, dword [ebp - 0xa8]
mov byte [ebp - 9], al
movzx edx, word [ebp - 0x14]
push edx
call fcn.0051a8d0
movzx esi, ax
mov eax, dword [ebp - 0x74]
push eax
movzx ecx, byte [ebp - 0x80]
push ecx
mov edx, dword [ebp - 0xbc]
push edx
movzx eax, word [ebp - 0xc0]
push eax
call fcn.00529720
movzx ecx, al
add esi, ecx
mov edx, 0xe8
sub edx, dword [ebp - 0x9c]
or esi, edx
mov dword [ebp - 0x30], esi
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
je 0x52a501
movzx ecx, word [ebp - 0x48]
add ecx, dword [ebp - 4]
movzx edx, word [ebp - 0x3c]
add ecx, edx
or ecx, dword [ebp - 0x10]
or ecx, 0xd7
mov word [ebp - 0xa0], cx
jmp 0x52a52c
movzx eax, word [ebp - 0x7c]
mov ecx, dword [ebp - 0xb8]
lea ebx, [ecx + eax - 0x94]
and ebx, dword [ebp - 0x24]
movzx edx, byte [ebp - 9]
push edx
movzx eax, byte [ebp - 0xcc]
push eax
call fcn.0052b4c0
and ebx, eax
mov byte [ebp - 0xb], bl
movzx esi, byte [ebp - 0xad]
movzx edi, byte [ebp - 0x29]
mov ecx, dword [ebp - 0x9c]
push ecx
movzx edx, byte [ebp - 0x74]
push edx
call fcn.0052b4c0
add edi, eax
sub edi, dword [ebp - 0x30]
movzx eax, byte [ebp - 0x29]
sub edi, eax
movzx ecx, byte [ebp - 0xad]
sub edi, ecx
add edi, dword [ebp - 0xbc]
and esi, edi
mov dword [ebp - 0x10], esi
cmp dword [ebp - 4], 0
jne 0x52a59f
mov edx, dword [ebp - 0x98]
sub edx, dword [ebp - 0x20]
add edx, dword [ebp - 0xb8]
movzx eax, word [ebp - 0xc8]
lea esi, [edx + eax + 0x2c]
mov ecx, dword [ebp - 0x10]
push ecx
movzx edx, byte [ebp - 0xc8]
push edx
call fcn.0052b4c0
add esi, eax
mov dword [ebp - 0x68], esi
jmp 0x52a5c2
mov ebx, dword [ebp - 0x74]
and ebx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
push eax
call fcn.0051a8d0
movzx ecx, ax
add ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0x9c]
and ebx, ecx
mov byte [ebp - 0xcd], bl
mov edx, dword [ebp - 0x50]
add edx, dword [ebp - 0x54]
add edx, dword [ebp - 0x10]
mov dword [ebp - 0x74], edx
mov eax, dword [ebp - 0x68]
push eax
movzx ecx, byte [ebp - 0x24]
push ecx
call fcn.0052b4c0
mov edx, dword [ebp - 0x20]
sub edx, eax
movzx eax, byte [ebp - 0x49]
sub edx, eax
movzx ecx, word [ebp - 0xc8]
mov eax, dword [ebp - 0x38]
sub eax, ecx
movzx ecx, word [ebp - 0xac]
add eax, ecx
and edx, eax
movzx eax, word [ebp - 0x8c]
and edx, eax
xor edx, dword [ebp - 0x84]
mov dword [ebp - 0x24], edx
cmp dword [ebp - 4], 0
jne 0x52a65e
movzx esi, word [ebp - 0x58]
sar esi, 0xce
movzx edi, word [ebp - 0xc4]
mov ecx, dword [ebp - 0x10]
push ecx
movzx edx, byte [ebp - 0x98]
push edx
call fcn.0052b4c0
sub edi, eax
movzx eax, word [ebp - 0xa0]
push eax
movzx ecx, byte [ebp - 0x54]
push ecx
call fcn.0052b4c0
add eax, dword [ebp - 0x84]
and edi, eax
or esi, edi
or esi, 0xb0
mov dword [ebp - 0x30], esi
jmp 0x52a665
mov dword [ebp - 0x50], 0xca
movzx esi, word [ebp - 0x8c]
add esi, dword [ebp - 0xa8]
movzx edx, word [ebp - 0x7c]
push edx
movzx eax, byte [ebp - 0xac]
push eax
call fcn.0052b4c0
sub esi, eax
add esi, dword [ebp - 0x50]
mov dword [ebp - 0xcc], esi
mov ecx, dword [ebp - 0x44]
sub ecx, dword [ebp - 0x30]
add ecx, dword [ebp - 0xbc]
sub ecx, dword [ebp - 0xa8]
add ecx, dword [ebp - 0x98]
add ecx, dword [ebp - 0x10]
movzx edx, byte [ebp - 0x7f]
sub ecx, edx
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x84]
push eax
movzx ecx, byte [ebp - 0x24]
push ecx
call fcn.0052b4c0
test eax, eax
jne 0x52a6ef
mov edx, dword [ebp - 0x20]
push edx
movzx eax, byte [ebp - 0x74]
push eax
call fcn.0052b4c0
cmp eax, 0x11
je 0x52a6ef
mov ecx, dword [ebp - 0xbc]
sub ecx, 0xee
and ecx, 0x3e
mov dword [ebp - 0x34], ecx
jmp 0x52a722
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
movzx edx, word [ebp - 0x5c]
push edx
call fcn.00529720
movzx eax, al
mov ecx, dword [ebp - 0x84]
sub ecx, eax
sub ecx, 0x58
mov edx, dword [ebp - 0x50]
sub edx, dword [ebp - 0x68]
and ecx, edx
xor ecx, 0xc
mov word [ebp - 0x6c], cx
mov eax, dword [ebp - 0x84]
add eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x38]
add eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x74]
and eax, dword [ebp - 0x44]
mov word [ebp - 0x8c], ax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0xd4], ecx
cmp dword [ebp - 0xd4], 9
je 0x52a795
cmp dword [ebp - 0xd4], 0x10
je 0x52a767
cmp dword [ebp - 0xd4], 0x3e
je 0x52a7a8
jmp 0x52a7ce
mov edx, dword [ebp - 0x74]
or edx, dword [ebp - 8]
movzx eax, byte [ebp - 0xa1]
add eax, dword [ebp - 0x30]
movzx ecx, word [ebp - 0x5c]
sub eax, ecx
and eax, dword [ebp - 0x98]
or edx, eax
mov eax, dword [ebp - 0xcc]
and eax, 0x47
or edx, eax
mov dword [ebp - 0x24], edx
jmp 0x52a7d8
movzx ecx, byte [ebp - 0x6d]
mov edx, dword [ebp - 0x50]
lea eax, [ecx + edx - 0x140]
mov dword [ebp - 0x20], eax
jmp 0x52a7d8
mov ecx, dword [ebp - 0x84]
sub ecx, 0x4f
sub ecx, dword [ebp - 0x44]
sub ecx, dword [ebp - 0xbc]
sub ecx, dword [ebp - 0x30]
add ecx, 0xce
and ecx, 4
mov dword [ebp - 0x98], ecx
jmp 0x52a7d8
mov dword [ebp - 0xb8], 0x5a
mov edx, 0x19
sub edx, dword [ebp - 0x9c]
mov dword [ebp - 0x34], edx
movzx eax, word [ebp - 0xa0]
movzx ecx, byte [ebp - 0xcd]
sub eax, ecx
mov word [ebp - 0x14], ax
mov edx, dword [ebp - 0x10]
add edx, dword [ebp - 0x98]
movzx eax, word [ebp - 0x28]
sub edx, eax
add edx, 0xed
sub edx, dword [ebp - 0x54]
movzx ecx, word [ebp - 0x5c]
sub edx, ecx
and edx, dword [ebp - 0x30]
mov word [ebp - 0x40], dx
cmp dword [ebp - 0x9c], 6
jne 0x52a85f
movzx edx, word [ebp - 0x5c]
xor edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0xbc]
and eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xbc]
sub ecx, dword [ebp - 0x98]
movzx esi, word [ebp - 0x94]
sub ecx, esi
movzx esi, byte [ebp - 0xa]
add ecx, esi
and eax, ecx
xor edx, eax
mov byte [ebp - 0x8e], dl
jmp 0x52a86b
mov edx, dword [ebp - 8]
and edx, dword [ebp - 0x9c]
mov dword [ebp - 0x34], edx
cmp dword [ebp - 0x38], 0x75
jne 0x52a877
cmp dword [ebp - 0x44], 0
jne 0x52a8e5
mov eax, dword [ebp - 0x84]
push eax
movzx ecx, byte [ebp - 9]
push ecx
mov edx, dword [ebp - 0x50]
push edx
movzx eax, word [ebp - 0x5c]
push eax
call fcn.00529720
movzx esi, al
add esi, dword [ebp - 0x9c]
movzx ecx, byte [ebp - 0xad]
push ecx
movzx edx, byte [ebp - 0x50]
push edx
call fcn.0052b4c0
add esi, eax
mov eax, dword [ebp - 0x9c]
push eax
movzx ecx, word [ebp - 0x3c]
push ecx
movzx edx, byte [ebp - 0x4a]
push edx
mov eax, dword [ebp - 0x30]
push eax
call fcn.00529720
movzx ecx, al
add esi, dword [ebp - 4]
add ecx, esi
movzx edx, word [ebp - 0xac]
mov eax, dword [ebp - 0x68]
lea edx, [eax + edx + 0x1c]
or ecx, edx
mov dword [ebp - 0x54], ecx
jmp 0x52a909
movzx eax, word [ebp - 0x8c]
mov ecx, dword [ebp - 8]
add ecx, 0xe6
sub ecx, dword [ebp - 0x98]
add ecx, dword [ebp - 4]
sub ecx, dword [ebp - 0x84]
and eax, ecx
mov dword [ebp - 0x30], eax
mov edx, dword [ebp - 0x20]
add edx, dword [ebp - 0x20]
add edx, dword [ebp - 0x74]
mov word [ebp - 0x58], dx
mov eax, dword [ebp - 4]
push eax
movzx ecx, byte [ebp - 4]
push ecx
call fcn.0052b4c0
mov esi, eax
movzx edx, byte [ebp - 0x7d]
sub esi, edx
sub esi, dword [ebp - 0x44]
add esi, dword [ebp - 0x54]
movzx edi, word [ebp - 0x28]
mov eax, dword [ebp - 0x24]
push eax
call fcn.0051a8d0
movzx ecx, ax
lea edx, [edi + ecx + 0x1c]
or esi, edx
mov dword [ebp - 0x20], esi
movzx esi, word [ebp - 0x7c]
mov edi, 0x10a
sub edi, dword [ebp - 0xb8]
mov eax, dword [ebp - 0x20]
push eax
movzx ecx, word [ebp - 0x7c]
push ecx
mov edx, dword [ebp - 0x20]
push edx
movzx eax, word [ebp - 0x48]
push eax
call fcn.00529720
movzx ebx, al
movzx ecx, word [ebp - 0x14]
push ecx
movzx edx, byte [ebp - 0xcc]
push edx
call fcn.0052b4c0
add ebx, eax
mov ecx, ebx
shl edi, cl
and esi, edi
mov eax, dword [ebp - 8]
shr eax, 0x45
xor esi, eax
mov dword [ebp - 4], esi
mov byte [ebp - 0x49], 0x80
movzx edx, word [ebp - 0xb4]
add edx, 0x54
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0xcc]
shl edx, cl
mov eax, dword [ebp - 0x50]
add eax, 0xba
and edx, eax
mov word [ebp - 0x48], dx
mov ecx, dword [ebp - 0x50]
push ecx
mov edx, dword [ebp - 0xcc]
push edx
movzx eax, word [ebp - 0xc8]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call fcn.00529720
movzx ebx, al
add ebx, dword [ebp - 0x10]
and ebx, dword [ebp - 0x34]
mov esi, 0xd3
sub esi, dword [ebp - 0x30]
push 0
call dword [sym.imp.ADVAPI32.dll_GetSidLengthRequired]
add esi, dword [ebp - 0x9c]
add eax, esi
sub eax, dword [ebp - 0xb8]
and ebx, eax
mov byte [ebp - 0x80], bl
movzx edx, word [ebp - 0xc4]
movzx eax, word [ebp - 0xa0]
sub edx, eax
mov dword [ebp - 4], edx
mov ecx, dword [ebp - 0x68]
push ecx
movzx edx, word [ebp - 0x14]
push edx
movzx eax, byte [ebp - 0x7d]
push eax
movzx ecx, word [ebp - 0x7c]
push ecx
call fcn.00529720
movzx edx, al
test edx, edx
jne 0x52aa70
movzx eax, byte [ebp - 0x8e]
push eax
movzx ecx, byte [ebp - 0x4a]
push ecx
call fcn.0052b4c0
cmp eax, 0x9d
jne 0x52aa70
mov edx, dword [ebp - 0x50]
sub edx, 0x7d
and edx, dword [ebp - 0x34]
movzx eax, word [ebp - 0x60]
add eax, dword [ebp - 0x20]
and eax, dword [ebp - 0x98]
or edx, eax
mov dword [ebp - 0x54], edx
jmp 0x52aa7a
movzx ecx, word [ebp - 0x48]
mov dword [ebp - 0x84], ecx
mov edx, dword [ebp - 4]
sub edx, 0x15
mov word [ebp - 0x14], dx
cmp dword [ebp - 0xa8], 0x14
je 0x52aab9
movzx eax, byte [ebp - 0xcd]
push eax
call fcn.0051a8d0
movzx esi, ax
mov ecx, dword [ebp - 0x74]
push ecx
movzx edx, byte [ebp - 0x98]
push edx
call fcn.0052b4c0
sub esi, eax
mov word [ebp - 0x94], si
jmp 0x52aac5
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x9c], eax
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x98]
mov edx, dword [ebp - 0x10]
lea eax, [ecx + edx + 0x90]
mov dword [ebp - 0x68], eax
mov ecx, dword [ebp + 8]
mov dword [0x157f3a8], ecx
movzx edx, byte [ebp - 0x61]
sub edx, dword [ebp - 0x50]
sub edx, 0x63
sub edx, dword [ebp - 0xcc]
mov ecx, dword [ebp - 0x84]
shr edx, cl
mov eax, dword [ebp - 0xa8]
sub eax, 0x49
and edx, eax
mov dword [ebp - 0x84], edx
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x34], ecx
movzx edx, word [ebp - 0x48]
mov eax, dword [ebp - 0x84]
sub eax, edx
mov ecx, dword [ebp - 0x50]
sub ecx, dword [ebp - 0xa8]
and eax, ecx
and eax, dword [ebp - 0x34]
mov word [ebp - 0x18], ax
movzx edx, byte [ebp - 0x19]
cmp edx, 0x91
jne 0x52ab46
cmp dword [ebp - 0x84], 0
jne 0x52ab53
mov eax, dword [ebp - 0x68]
sub eax, 0xee
mov dword [ebp - 0x34], eax
jmp 0x52ab61
movzx ecx, word [ebp - 0x28]
mov edx, 0xc6
sub edx, ecx
mov dword [ebp - 0x44], edx
mov ecx, dword [ebp - 0x34]
add ecx, dword [ebp - 0xbc]
mov eax, 0xb5
sar eax, cl
and eax, 0xef
movzx ecx, byte [ebp - 0x1a]
mov edx, dword [ebp - 0x20]
sub edx, ecx
movzx ecx, word [ebp - 0x7c]
mov esi, dword [ebp - 0xa8]
sub esi, ecx
and edx, esi
or eax, edx
mov dword [ebp - 0x54], eax
movzx edx, byte [ebp - 0x61]
movzx eax, word [ebp - 0x78]
add edx, dword [ebp - 0x38]
add eax, edx
mov ecx, dword [ebp - 0xa8]
lea edx, [eax + ecx - 0xda]
sub edx, dword [ebp - 0x44]
or edx, 0xc8
mov byte [ebp - 0x6d], dl
movzx eax, word [ebp - 0x48]
test eax, eax
je 0x52abd2
cmp dword [ebp - 0x68], 0x5c
je 0x52abd2
movzx ecx, word [ebp - 0x60]
mov dword [ebp - 0xcc], ecx
jmp 0x52abeb
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xcc]
lea ecx, [eax + edx + 0x9b]
and ecx, dword [ebp - 0x68]
mov dword [ebp - 0x84], ecx
push 0
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
mov esi, eax
sub esi, dword [ebp - 8]
mov edx, dword [ebp - 0x68]
push edx
mov eax, dword [ebp - 0x38]
push eax
movzx ecx, word [ebp - 0x94]
push ecx
movzx edx, byte [ebp - 0x29]
push edx
call fcn.00529720
movzx eax, al
sub esi, eax
and esi, 0xffffffc9
mov dword [ebp - 0x50], esi
mov ecx, dword [ebp + 0xc]
mov dword [0x157f3ac], ecx
mov edx, dword [ebp - 0x38]
cmp edx, dword [ebp - 8]
je 0x52ac4c
movzx esi, word [ebp - 0xa0]
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
add esi, eax
sub esi, dword [ebp - 0x9c]
mov dword [ebp - 0x38], esi
jmp 0x52ac7e
mov esi, 0xc8
sub esi, dword [ebp - 0xcc]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryMultipleValuesW]
mov ecx, 0xdd
sub ecx, eax
movzx edx, word [ebp - 0x6c]
lea eax, [ecx + edx + 0x88]
or esi, eax
mov dword [ebp - 0x54], esi
mov ecx, dword [ebp - 0x34]
sub ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 8]
add ecx, dword [ebp - 0xb8]
movzx edx, byte [ebp - 0x7e]
add ecx, edx
and ecx, 0x47
mov dword [ebp - 0xcc], ecx
movzx eax, byte [ebp - 0xad]
mov ecx, dword [ebp - 0x20]
sub ecx, eax
or ecx, dword [ebp - 8]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0xb8], 0x19
je 0x52acc3
mov dword [ebp - 0x9c], 0xb7
jmp 0x52acea
movzx edx, word [ebp - 0xc8]
add edx, dword [ebp - 0x38]
sub edx, dword [ebp - 0x68]
add edx, dword [ebp - 0x24]
and edx, 0x30
movzx eax, word [ebp - 0x58]
mov ecx, dword [ebp - 0x30]
sub ecx, eax
add ecx, dword [ebp - 0xcc]
or edx, ecx
mov dword [ebp - 0x54], edx
movzx edx, byte [ebp - 0xcd]
push edx
call fcn.0051a8d0
movzx eax, ax
test eax, eax
jne 0x52ad07
cmp dword [ebp - 0xb8], 0
je 0x52ad3f
mov ecx, dword [ebp - 0xcc]
push ecx
call fcn.0051a8d0
movzx edx, ax
mov eax, dword [ebp - 0xb8]
lea ecx, [edx + eax - 0x4a]
movzx edx, word [ebp - 0xc8]
mov eax, dword [ebp - 0x74]
lea edx, [edx + eax + 0xdd]
sub edx, dword [ebp - 0x38]
and ecx, edx
mov word [ebp - 0xb4], cx
jmp 0x52ad4a
movzx eax, word [ebp - 0x6c]
and eax, dword [ebp - 0x30]
mov word [ebp - 0x7c], ax
movzx ecx, word [ebp - 0xc0]
movzx edx, word [ebp - 0x8c]
add edx, dword [ebp - 0x24]
and ecx, edx
mov eax, dword [ebp - 0xa8]
add eax, 0x60
sub eax, dword [ebp - 8]
and ecx, eax
mov dword [ebp - 0x98], ecx
mov ecx, 0xc6
sub ecx, dword [ebp - 0xb8]
sub ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
add edx, dword [ebp - 4]
and ecx, edx
mov dword [ebp - 0x44], ecx
movzx eax, word [ebp - 0xc4]
add eax, dword [ebp - 8]
mov word [ebp - 0x28], ax
cmp dword [ebp - 0x84], 0
je 0x52add0
movzx ecx, word [ebp - 0xb4]
cmp ecx, 0x8e
je 0x52add0
mov edx, dword [ebp - 0x34]
add edx, 0x58
sub edx, dword [ebp - 0x9c]
add edx, 0xc1
sub edx, dword [ebp - 0x9c]
sub edx, 0x3b
mov byte [ebp - 0xa], dl
jmp 0x52adfa
movzx esi, word [ebp - 0x3c]
add esi, dword [ebp - 0x10]
sub esi, dword [ebp - 0x84]
mov eax, dword [ebp - 0x44]
push eax
call fcn.0051a8d0
movzx ecx, ax
add esi, ecx
movzx edx, word [ebp - 0x7c]
add esi, edx
and esi, dword [ebp - 0x68]
mov dword [ebp - 0xbc], esi
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetKernelObjectSecurity]
mov esi, eax
mov eax, dword [ebp - 0x50]
push eax
mov ecx, dword [ebp - 0x9c]
push ecx
mov edx, dword [ebp - 0x20]
push edx
movzx eax, byte [ebp - 0xcd]
push eax
call fcn.00529720
movzx ecx, al
cmp esi, ecx
jne 0x52ae65
movzx esi, byte [ebp - 0x61]
add esi, dword [ebp - 0x34]
mov edx, dword [ebp - 0x74]
push edx
call fcn.0051a8d0
movzx eax, ax
sub esi, eax
mov ecx, dword [ebp - 0x98]
push ecx
call fcn.0051a8d0
movzx edx, ax
mov eax, dword [ebp - 0x24]
lea ecx, [eax + edx + 0xe6]
and esi, ecx
mov word [ebp - 0x60], si
jmp 0x52aeab
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 0x44]
lea esi, [eax + edx - 0x4c]
movzx ecx, word [ebp - 0xc8]
push ecx
mov edx, dword [ebp - 0xb8]
push edx
mov eax, dword [ebp - 0xb8]
push eax
mov ecx, dword [ebp - 0xb8]
push ecx
call fcn.00529720
movzx edx, al
sub esi, edx
add esi, 0x1d
sub esi, dword [ebp - 0x20]
sub esi, 0xda
mov dword [ebp - 0x98], esi
mov esi, dword [ebp - 0x38]
sub esi, 0x1a
mov eax, dword [ebp - 0x38]
push eax
movzx ecx, byte [ebp - 0x8e]
push ecx
call fcn.0052b4c0
sub esi, eax
mov dword [ebp - 0x44], esi
movzx edx, word [ebp - 0x94]
cmp edx, 0xab
je 0x52aee6
mov eax, 0x148
sub eax, dword [ebp - 0x20]
and eax, 0x10
mov dword [ebp - 0x38], eax
jmp 0x52af03
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x9c]
mov edx, dword [ebp - 0x38]
add edx, dword [ebp - 0x38]
movzx eax, word [ebp - 0x8c]
add edx, eax
or ecx, edx
mov dword [ebp - 0x38], ecx
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
cmp eax, dword [ebp - 0x98]
jne 0x52af59
movzx ecx, word [ebp - 0xb4]
push ecx
mov edx, dword [ebp - 0x54]
push edx
mov eax, dword [ebp - 0x84]
push eax
movzx ecx, byte [ebp - 0xa]
push ecx
call fcn.00529720
movzx edx, al
cmp edx, 0xe7
jne 0x52af59
mov eax, dword [ebp - 0x74]
add eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0xa8]
sub eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x68]
or eax, dword [ebp - 0x68]
mov dword [ebp - 0x44], eax
jmp 0x52af5f
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x44], ecx
mov edx, dword [ebp - 0x54]
or edx, dword [ebp - 0x68]
mov dword [ebp - 0x44], edx
movzx eax, word [ebp - 0x6c]
movzx ecx, word [ebp - 0x58]
sub eax, ecx
mov edx, dword [ebp - 0x38]
lea eax, [eax + edx + 0xa5]
movzx ecx, byte [ebp - 0x6d]
add ecx, dword [ebp - 0x9c]
shr eax, cl
mov dword [ebp - 0xbc], eax
movzx ecx, byte [ebp - 0x4a]
movzx edx, word [ebp - 0x48]
sub ecx, edx
add ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x30]
sub ecx, dword [ebp - 0x38]
add ecx, 0x55
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x74]
or ecx, eax
mov byte [ebp - 0x29], cl
mov ecx, dword [ebp - 0x68]
sub ecx, dword [ebp - 0x38]
movzx edx, byte [ebp - 0x7f]
sub ecx, edx
mov byte [ebp - 0x6d], cl
movzx eax, word [ebp - 0x94]
push eax
call fcn.0051a8d0
movzx esi, ax
add esi, dword [ebp - 0x30]
and esi, dword [ebp - 8]
mov ecx, dword [ebp - 0x84]
add ecx, 0xf8
and esi, ecx
mov edx, dword [ebp - 0x38]
push edx
call fcn.0051a8d0
movzx eax, ax
mov ecx, dword [ebp - 0x30]
sub ecx, eax
and ecx, dword [ebp - 0x24]
or esi, ecx
mov dword [ebp - 0x98], esi
mov edx, dword [ebp - 0x84]
and edx, dword [ebp - 0x84]
or edx, dword [ebp - 0x24]
mov word [ebp - 0x94], dx
mov eax, dword [ebp - 0xb8]
add eax, dword [ebp - 0x9c]
movzx esi, word [ebp - 0x28]
add eax, dword [ebp - 0x30]
add esi, eax
mov ecx, dword [ebp - 0x30]
push ecx
mov edx, dword [ebp - 0xcc]
push edx
movzx eax, word [ebp - 0xa0]
push eax
mov ecx, dword [ebp - 0xb8]
push ecx
call fcn.00529720
movzx edx, al
mov eax, dword [ebp - 0x38]
lea ecx, [eax + edx - 0xdb]
and esi, ecx
mov word [ebp - 0x3c], si
movzx edx, word [ebp - 0x88]
test edx, edx
jne 0x52b433
mov eax, dword [ebp - 0x44]
push eax
movzx ecx, byte [ebp - 0x34]
push ecx
call fcn.0052b4c0
movzx edx, word [ebp - 0xc0]
and eax, edx
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x9c]
or eax, 0xc6
mov dword [ebp - 0x50], eax
mov esi, dword [ebp - 0x50]
and esi, dword [ebp - 0x54]
and esi, 0xffffff4b
mov ecx, dword [ebp - 0x44]
push ecx
movzx edx, byte [ebp - 0x14]
push edx
call fcn.0052b4c0
mov ecx, dword [ebp - 0x10]
lea edx, [ecx + eax - 0x15]
or esi, edx
or esi, dword [ebp - 0x30]
mov dword [ebp - 0xcc], esi
movzx eax, word [ebp - 0x28]
test eax, eax
je 0x52b0e7
movzx ecx, word [ebp - 0xb4]
add ecx, dword [ebp - 0x30]
sub ecx, dword [ebp - 8]
movzx edx, byte [ebp - 0x61]
add ecx, edx
sub ecx, dword [ebp - 0x9c]
sub ecx, 0x5c
mov dword [ebp - 0x38], ecx
jmp 0x52b0fc
mov eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 0x10]
and ecx, dword [ebp - 0x44]
or eax, ecx
mov word [ebp - 0x18], ax
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
movzx edx, byte [ebp - 0x29]
cmp eax, edx
je 0x52b141
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0xbc]
lea edx, [ecx + eax + 0xf4]
add edx, dword [ebp - 0x84]
movzx eax, word [ebp - 0x28]
add edx, eax
movzx ecx, word [ebp - 0x88]
sub edx, ecx
mov dword [ebp - 0x84], edx
jmp 0x52b196
mov esi, dword [ebp - 0x10]
add esi, dword [ebp - 0x9c]
mov edx, dword [ebp - 0xb8]
push edx
movzx eax, word [ebp - 0xc8]
push eax
mov ecx, dword [ebp - 0x44]
push ecx
movzx edx, word [ebp - 0x3c]
push edx
call fcn.00529720
movzx eax, al
mov edi, dword [ebp - 0x24]
sub edi, eax
mov ecx, dword [ebp - 0x50]
push ecx
mov edx, dword [ebp - 0xcc]
push edx
movzx eax, byte [ebp - 9]
push eax
mov ecx, dword [ebp - 0x34]
push ecx
call fcn.00529720
movzx edx, al
sub edi, edx
or esi, edi
mov word [ebp - 0x8c], si
call fcn.005298a0
mov dword [ebp - 0x24], eax
movzx eax, word [ebp - 0xc4]
add eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
add ecx, dword [ebp - 0xa8]
and eax, ecx
and eax, 0xbf
mov dword [ebp - 0x9c], eax
movzx edx, word [ebp - 0xb4]
add edx, dword [ebp - 0xbc]
movzx eax, word [ebp - 0x88]
sub edx, eax
add edx, 0xfa
mov ecx, dword [ebp - 0xa8]
sub ecx, 0xa8
and edx, ecx
mov dword [ebp - 0x68], edx
cmp dword [ebp - 0x54], 0
jne 0x52b1f9
movzx edx, byte [ebp - 9]
test edx, edx
jne 0x52b219
mov eax, 0xad
sub eax, dword [ebp - 0xb8]
sub eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xcc]
lea edx, [eax + ecx - 7]
sub edx, dword [ebp - 0x34]
mov dword [ebp - 4], edx
jmp 0x52b222
mov eax, 0x16
mov word [ebp - 0x48], ax
movzx ecx, word [ebp - 0x48]
mov dword [ebp - 0xb8], ecx
mov edx, dword [ebp - 0x50]
push edx
movzx eax, byte [ebp - 0x74]
push eax
call fcn.0052b4c0
test eax, eax
je 0x52b264
cmp dword [ebp - 8], 0xb6
je 0x52b264
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x54]
movzx edx, word [ebp - 0x6c]
sub ecx, edx
sub ecx, dword [ebp - 0x24]
and ecx, dword [ebp - 0xb8]
mov dword [ebp - 0xb8], ecx
jmp 0x52b26a
mov eax, dword [ebp - 4]
mov dword [ebp - 0x50], eax
movzx ebx, byte [ebp - 0x8e]
mov ecx, dword [ebp - 0x34]
push ecx
movzx edx, byte [ebp - 0xbc]
push edx
call fcn.0052b4c0
mov ecx, 0x67
sub ecx, eax
add ecx, 0xfe
movzx edx, byte [ebp - 0x80]
sub ecx, edx
sub ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x30]
and ebx, ecx
and ebx, 0x12
mov byte [ebp - 0xb], bl
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x74]
lea edx, [ecx + eax + 0x28]
mov word [ebp - 0xc8], dx
movzx eax, word [ebp - 0x8c]
cmp eax, 0xc
je 0x52b2ea
movzx ecx, word [ebp - 0x94]
cmp ecx, 0xf
jne 0x52b2ea
movzx edx, byte [ebp - 0x29]
add edx, dword [ebp - 0x34]
movzx eax, byte [ebp - 0x61]
add edx, eax
movzx ecx, word [ebp - 0x40]
sub edx, ecx
and edx, 0x4c
mov dword [ebp - 0xb8], edx
jmp 0x52b304
mov edx, 0xcd
sub edx, dword [ebp - 0xcc]
add edx, 0x100
sub edx, dword [ebp - 0x68]
add edx, 0x21
mov dword [ebp - 0x44], edx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x52b34b
cmp dword [ebp - 8], 0xd9
jne 0x52b34b
mov eax, dword [ebp - 0x54]
add eax, 0x14
sub eax, dword [ebp - 0xcc]
add eax, 0x66
movzx ecx, byte [ebp - 0x61]
sub eax, ecx
and eax, 0xef
mov dword [ebp - 0x84], eax
jmp 0x52b36d
mov edx, dword [ebp - 4]
and edx, dword [ebp - 0x38]
movzx eax, word [ebp - 0xb4]
mov ecx, dword [ebp - 8]
lea eax, [ecx + eax - 0x66]
and edx, eax
or edx, 0xef
mov dword [ebp - 0xbc], edx
movzx ecx, byte [ebp - 0x6d]
movzx edx, word [ebp - 0x60]
add ecx, edx
and ecx, 8
movzx eax, word [ebp - 0x18]
add eax, dword [ebp - 0x30]
shl eax, 0xa1
or ecx, eax
mov dword [ebp - 0x98], ecx
mov ecx, dword [ebp - 0x84]
add ecx, dword [ebp - 0x74]
mov edx, dword [ebp - 0x84]
lea eax, [ecx + edx - 0x6b]
mov byte [ebp - 0x61], al
cmp dword [ebp - 0x44], 0x7b
jne 0x52b3b3
mov ecx, dword [ebp - 0x9c]
cmp ecx, dword [ebp - 0x44]
je 0x52b3cc
movzx edx, word [ebp - 0x48]
mov eax, 0xa3
sub eax, dword [ebp - 0xb8]
or edx, eax
mov dword [ebp - 0x98], edx
jmp 0x52b3d2
mov ecx, dword [ebp - 0x50]
mov dword [ebp - 0x30], ecx
movzx edx, word [ebp - 0x94]
sub edx, 0x7e
and edx, dword [ebp - 0x50]
mov dword [ebp - 0xbc], edx
mov ecx, 0x157f358
call dword [ebp - 0x24]
movzx eax, byte [ebp - 0x7d]
push eax
mov ecx, dword [ebp - 0x30]
push ecx
mov edx, dword [ebp - 0x9c]
push edx
mov eax, dword [ebp - 0xb8]
push eax
call fcn.00529720
movzx ecx, al
test ecx, ecx
jne 0x52b416
cmp dword [ebp - 0x10], 0
je 0x52b42a
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0x50]
sub edx, dword [ebp - 0x38]
and edx, dword [ebp - 0xa8]
mov dword [ebp - 0x38], edx
jmp 0x52b433
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x38]
push ecx
movzx edx, byte [ebp - 0xcc]
push edx
call fcn.0052b4c0
test eax, eax
jne 0x52b454
cmp dword [ebp - 0x84], 0xce
jne 0x52b46e
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0xcc]
sub eax, dword [ebp - 0x24]
sub eax, 0x8c
or eax, dword [ebp - 0x24]
mov word [ebp - 0x40], ax
jmp 0x52b4a3
mov ecx, dword [ebp - 0xb8]
sub ecx, dword [ebp - 0x20]
movzx edx, word [ebp - 0x7c]
add ecx, dword [ebp - 0x10]
lea esi, [edx + ecx + 0xcc]
mov eax, dword [ebp - 0x98]
push eax
movzx ecx, byte [ebp - 0xbc]
push ecx
call fcn.0052b4c0
mov edx, dword [ebp - 4]
sub edx, eax
xor esi, edx
mov dword [ebp - 4], esi
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x68], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret