Function at 0x120cd10
Capabilities:
Persist via contextmenuhandlers registry key
Persist via default file association registry key
Persist via filter handlers registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x125c50e
mov eax, dword fs:[0]
push eax
sub esp, 0x484
mov eax, dword [0x1286d50]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x47c], edi
mov dword [ebp - 0x428], 7
mov dword [ebp - 0x42c], ebx
mov word [ebp - 0x43c], ax
lea ecx, [ebp - 0x478]
push ecx
push 0x20019
push ebx
push 0x1268d98
push 0x80000002
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edx, dword [ebp - 0x478]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x120cdfe
push 1
push 0x1263064
mov esi, 0x1268dc4
mov ecx, 0x1268d98
call fcn.01209a40
push 0x1268dd8
push edi
call fcn.01204730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 0x10
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x120cddf
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x120cddf
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x120cdfe
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x120cdf7
or eax, 4
push ebx
push eax
call fcn.011f2d10
push 1
push 0x1263064
mov esi, 0x1268e60
mov ecx, 0x1268eb0
call fcn.01209a40
push 1
push 0x1268f34
mov esi, 0x1268f00
mov ecx, 0x1268d98
call fcn.01209a40
add esp, 0x10
mov ecx, 0x1263064
mov ebx, 0x1268d98
mov edx, 0x80000002
lea esi, [ebp - 0x458]
call fcn.01209920
push eax
lea ecx, [ebp - 0x43c]
mov byte [ebp - 4], 1
call fcn.011f1560
xor ebx, ebx
mov byte [ebp - 4], bl
cmp dword [ebp - 0x444], 8
jb 0x120ce74
mov edx, dword [ebp - 0x458]
push edx
call fcn.0123e60d
add esp, 4
push 1
push 0x1268d98
mov edi, 0x1268dc4
mov esi, 0x1263064
call fcn.012097e0
add esp, 8
test eax, eax
je 0x120cf69
push 0x1268f50
push ecx
lea eax, [ebp - 0x43c]
push eax
push ecx
mov ecx, dword [ebp - 0x47c]
push 0x1268f58
push ecx
call fcn.01204730
add esp, 0xc
push eax
call fcn.012049f0
add esp, 0xc
push eax
call fcn.01205080
mov esi, eax
mov edx, dword [esi]
mov eax, dword [edx + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x120cef0
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x120cef0
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x120cf0f
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x120cf08
or eax, 4
push ebx
push eax
call fcn.011f2d10
mov edx, dword [ebp - 0x47c]
push 0x1268fc8
push edx
call fcn.01204730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x120cf4a
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x120cf4a
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x120cf69
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x120cf62
or eax, 4
push ebx
push eax
call fcn.011f2d10
mov edx, 0x1269044
lea ecx, [ebp - 0x420]
call fcn.01209630
lea edx, [ebp - 0x420]
push edx
push 0x80000002
call fcn.01209680
add esp, 8
test eax, eax
je 0x120cfeb
mov eax, dword [ebp - 0x47c]
push 0x1269080
push eax
call fcn.01204730
mov esi, eax
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x120cfcc
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x120cfcc
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x120cfeb
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x120cfe4
or eax, 4
push ebx
push eax
call fcn.011f2d10
mov edx, 0x12690f8
lea ecx, [ebp - 0x420]
call fcn.01209630
lea edx, [ebp - 0x420]
push edx
push 0x80000002
call fcn.01209680
add esp, 8
test eax, eax
je 0x120d06d
mov eax, dword [ebp - 0x47c]
push 0x1269140
push eax
call fcn.01204730
mov esi, eax
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x120d04e
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x120d04e
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x120d06d
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x120d066
or eax, 4
push ebx
push eax
call fcn.011f2d10
lea edx, [ebp - 0x478]
push edx
push 0x20019
push ebx
push 0x12691c4
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov eax, dword [ebp - 0x478]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x120d144
push 1
push 0x1263064
mov esi, 0x12691f8
mov ecx, 0x1269208
call fcn.01209a40
push 1
push 0x1269768
mov ecx, 0x1269208
call fcn.01209a40
push 1
push 0x1263064
mov ecx, 0x1269260
call fcn.01209a40
push 1
push 0x1269768
mov ecx, 0x1269260
call fcn.01209a40
mov ecx, dword [ebp - 0x47c]
push 0x12692c0
push ecx
call fcn.01204730
mov esi, eax
mov edx, dword [esi]
mov eax, dword [edx + 4]
add esp, 0x28
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x120d125
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x120d125
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x120d144
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x120d13d
or eax, 4
push ebx
push eax
call fcn.011f2d10
push 1
push 0x1263064
mov esi, 0x1269350
mov ecx, 0x12691c4
call fcn.01209a40
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
add esp, 8
push ebx
lea edx, [ebp - 0x478]
push edx
push ebx
push 0xf013f
push ebx
push ebx
push ebx
push 0x12691c4
push 0x80000002
mov dword [ebp - 0x488], 0x738
mov dword [ebp - 0x490], ebx
call esi
cmp eax, ebx
jne 0x120d1c5
mov ecx, dword [ebp - 0x478]
push 4
lea eax, [ebp - 0x488]
push eax
push 3
push ebx
push 0x1269368
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x120d1d4
mov edx, dword [ebp - 0x478]
push edx
jmp 0x120d1d2
mov eax, dword [ebp - 0x478]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call edi
push ebx
lea ecx, [ebp - 0x478]
push ecx
push ebx
push 0xf013f
push ebx
push ebx
push ebx
push 0x1269380
push 0x80000002
call esi
cmp eax, ebx
jne 0x120d220
mov eax, dword [ebp - 0x478]
push 4
lea edx, [ebp - 0x490]
push edx
push 3
push ebx
push 0x1269368
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x120d229
mov ecx, dword [ebp - 0x478]
push ecx
jmp 0x120d227
mov edx, dword [ebp - 0x478]
push edx
call edi
push 2
push 0x126aaf4
mov esi, 0x126aaa0
mov ecx, 0x12691c4
call fcn.01209a40
push 1
push 0x1263064
mov esi, 0x12693c8
mov ecx, 0x12693d0
call fcn.01209a40
push 1
push 0x126af64
mov esi, 0x1263064
mov ecx, 0x126af80
call fcn.01209a40
push 1
push 0x126b020
mov esi, 0x126afd0
mov ecx, 0x126b040
call fcn.01209a40
push 1
push 0x1263064
mov esi, 0x126b0a4
mov ecx, 0x126b0d0
call fcn.01209a40
push 1
push 0x126b124
mov esi, 0x1263064
mov ecx, 0x126b0d0
call fcn.01209a40
push 1
push 0x126b188
mov esi, 0x126b138
mov ecx, 0x126b0d0
call fcn.01209a40
push 1
push 0x1263064
mov esi, 0x126b1b0
mov ecx, 0x126b1d0
call fcn.01209a40
add esp, 0x40
push 1
push 0x1263064
mov esi, 0x126b240
mov ecx, 0x126b290
call fcn.01209a40
push 1
push 0x1263064
mov esi, 0x1269508
mov ecx, 0x1269558
call fcn.01209a40
push 1
push 0x1263064
mov esi, 0x1269678
mov ecx, 0x12696c8
call fcn.01209a40
push 1
push 0x1269208
mov edi, 0x12691f8
mov esi, 0x1263064
call fcn.012097e0
add esp, 0x20
test eax, eax
je 0x120d395
mov eax, dword [ebp - 0x47c]
push 0x1269788
push eax
call fcn.01204730
mov esi, eax
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x120d376
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x120d376
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x120d395
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x120d38e
or eax, 4
push ebx
push eax
call fcn.011f2d10
push 1
push 0x1269208
mov edi, 0x12691f8
mov esi, 0x1269768
call fcn.012097e0
add esp, 8
test eax, eax
je 0x120d40c
mov edx, dword [ebp - 0x47c]
push 0x126ab18
push edx
call fcn.01204730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x120d3ed
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x120d3ed
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x120d40c
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x120d405
or eax, 4
push ebx
push eax
call fcn.011f2d10
push 1
push 0x1269260
mov edi, 0x12691f8
mov esi, 0x1263064
call fcn.012097e0
add esp, 8
test eax, eax
je 0x120d483
mov edx, dword [ebp - 0x47c]
push 0x1269850
push edx
call fcn.01204730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x120d464
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x120d464
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x120d483
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x120d47c
or eax, 4
push ebx
push eax
call fcn.011f2d10
push 1
push 0x1269260
mov edi, 0x12691f8
mov esi, 0x1269768
call fcn.012097e0
add esp, 8
test eax, eax
je 0x120d4fa
mov edx, dword [ebp - 0x47c]
push 0x126abf8
push edx
call fcn.01204730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x120d4db
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x120d4db
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x120d4fa
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x120d4f3
or eax, 4
push ebx
push eax
call fcn.011f2d10
lea edx, [ebp - 0x478]
push edx
push 0x20019
push ebx
push 0x1269918
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov eax, dword [ebp - 0x478]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
jne 0x120d7a1
cmp dword [ebp - 0x428], 8
mov eax, dword [ebp - 0x43c]
mov dword [ebp - 0x42c], ebx
jae 0x120d549
lea eax, [ebp - 0x43c]
xor ecx, ecx
mov word [eax], cx
mov ecx, 0x1263064
mov ebx, 0x1269918
mov edx, 0x80000001
lea esi, [ebp - 0x474]
call fcn.01209920
push eax
lea ecx, [ebp - 0x43c]
mov byte [ebp - 4], 2
call fcn.011f1560
mov byte [ebp - 4], 0
cmp dword [ebp - 0x460], 8
jb 0x120d594
mov edx, dword [ebp - 0x474]
push edx
call fcn.0123e60d
add esp, 4
mov ebx, dword [ebp - 0x47c]
push 0x1268f50
push ecx
lea eax, [ebp - 0x43c]
push eax
push ecx
push 0x1269948
push ebx
call fcn.01204730
add esp, 0xc
push eax
call fcn.012049f0
add esp, 0xc
push eax
call fcn.01205080
mov esi, eax
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x120d5ef
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x120d5ef
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0x120d610
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], 0
jne 0x120d608
or eax, 4
push 0
push eax
call fcn.011f2d10
mov edx, 0x1269918
lea ecx, [ebp - 0x420]
call fcn.01209630
lea edx, [ebp - 0x420]
push edx
push 0x80000001
call fcn.01209680
add esp, 8
test eax, eax
je 0x120d68e
push 0x12699c0
push ebx
call fcn.01204730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x120d66d
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x120d66d
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0x120d68e
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], 0
jne 0x120d686
or eax, 4
push 0
push eax
call fcn.011f2d10
push 0x11
xor edx, edx
push 0x1269a28
lea ecx, [ebp - 0x458]
mov dword [ebp - 0x444], 7
mov dword [ebp - 0x448], 0
mov word [ebp - 0x458], dx
call fcn.011f1740
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x43c]
push eax
lea ecx, [ebp - 0x458]
mov byte [ebp - 4], 3
call fcn.01201f30
cmp dword [ebp - 0x444], 8
mov edx, dword [ebp - 0x458]
jae 0x120d6ec
lea edx, [ebp - 0x458]
lea ecx, [ebp - 0x420]
call fcn.01209630
lea ecx, [ebp - 0x420]
push ecx
push 0x80000001
call fcn.01209680
add esp, 8
test eax, eax
je 0x120d783
push 0x1269a4c
push ecx
lea edx, [ebp - 0x43c]
push edx
push ecx
push 0x1269a7c
push ebx
call fcn.01204730
add esp, 0xc
push eax
call fcn.012049f0
add esp, 0xc
push eax
call fcn.01204730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x120d764
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x120d764
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0x120d783
or edi, dword [ecx + 0xc]
cmp dword [ecx + 0x38], 0
jne 0x120d77b
or edi, 4
push 0
push edi
call fcn.011f2d10
mov byte [ebp - 4], 0
cmp dword [ebp - 0x444], 8
jb 0x120d79f
mov edx, dword [ebp - 0x458]
push edx
call fcn.0123e60d
add esp, 4
xor ebx, ebx
lea eax, [ebp - 0x478]
push eax
push 0x20019
push ebx
push 0x1269ab4
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [ebp - 0x478]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x120d841
push 1
push 0x1263064
mov esi, 0x1269ae0
mov ecx, 0x1269ab4
call fcn.01209a40
mov edx, dword [ebp - 0x47c]
push 0x1269af0
push edx
call fcn.01204730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 0x10
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x120d822
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x120d822
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x120d841
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x120d83a
or eax, 4
push ebx
push eax
call fcn.011f2d10
cmp dword [ebp - 0x428], 8
mov eax, dword [ebp - 0x43c]
mov dword [ebp - 0x42c], ebx
jae 0x120d85c
lea eax, [ebp - 0x43c]
xor edx, edx
mov word [eax], dx
mov ecx, 0x1263064
mov ebx, 0x1269ab4
mov edx, 0x80000002
lea esi, [ebp - 0x474]
call fcn.01209920
push eax
lea ecx, [ebp - 0x43c]
mov byte [ebp - 4], 4
call fcn.011f1560
xor ebx, ebx
mov byte [ebp - 4], bl
cmp dword [ebp - 0x460], 8
jb 0x120d8a8
mov eax, dword [ebp - 0x474]
push eax
call fcn.0123e60d
add esp, 4
push 1
push 0x1269ab4
mov edi, 0x1269ae0
mov esi, 0x1263064
call fcn.012097e0
add esp, 8
test eax, eax
je 0x120d99d
mov edx, dword [ebp - 0x47c]
push 0x1268f50
push ecx
lea ecx, [ebp - 0x43c]
push ecx
push ecx
push 0x1269b78
push edx
call fcn.01204730
add esp, 0xc
push eax
call fcn.012049f0
add esp, 0xc
push eax
call fcn.01205080
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x120d924
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x120d924
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x120d943
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x120d93c
or eax, 4
push ebx
push eax
call fcn.011f2d10
mov edx, dword [ebp - 0x47c]
push 0x1269be0
push edx
call fcn.01204730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x120d97e
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x120d97e
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x120d99d
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x120d996
or eax, 4
push ebx
push eax
call fcn.011f2d10
push 1
push 0x1263064
mov esi, 0x1269c60
mov ecx, 0x1269cb0
call fcn.01209a40
add esp, 8
lea edx, [ebp - 0x478]
push edx
push 0x20019
push ebx
push 0x1269d04
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov eax, dword [ebp - 0x478]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x120da9c
push 2
push 0x1263064
mov esi, 0x1269d38
mov ecx, 0x1269d88
call fcn.01209a40
push 1
push 0x1263064
mov esi, 0x12691f8
mov ecx, 0x1269de0
call fcn.01209a40
push 2
push 0x1263064
mov esi, 0x1269e38
mov ecx, 0x1269e88
call fcn.01209a40
push 2
push 0x1263064
mov esi, 0x126ace0
mov ecx, 0x126ad38
call fcn.01209a40
mov ecx, dword [ebp - 0x47c]
push 0x1269af0
push ecx
call fcn.01204730
mov esi, eax
mov edx, dword [esi]
mov eax, dword [edx + 4]
add esp, 0x28
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x120da7d
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x120da7d
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x120da9c
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x120da95
or eax, 4
push ebx
push eax
call fcn.011f2d10
push 1
push 0x1263064
mov esi, 0x1269ee4
mov ecx, 0x1269d04
call fcn.01209a40
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
add esp, 8
push ebx
lea edx, [ebp - 0x478]
push edx
push ebx
push 0xf013f
push ebx
push ebx
push ebx
push 0x1269d04
push 0x80000002
mov dword [ebp - 0x48c], 0x430
mov dword [ebp - 0x484], ebx
call esi
cmp eax, ebx
jne 0x120db1d
mov ecx, dword [ebp - 0x478]
push 4
lea eax, [ebp - 0x48c]
push eax
push 3
push ebx
push 0x1269368
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x120db2c
mov edx, dword [ebp - 0x478]
push edx
jmp 0x120db2a
mov eax, dword [ebp - 0x478]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call edi
push ebx
lea ecx, [ebp - 0x478]
push ecx
push ebx
push 0xf013f
push ebx
push ebx
push ebx
push 0x1269f30
push 0x80000002
call esi
cmp eax, ebx
jne 0x120db78
mov eax, dword [ebp - 0x478]
push 4
lea edx, [ebp - 0x484]
push edx
push 3
push ebx
push 0x1269368
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x120db81
mov ecx, dword [ebp - 0x478]
push ecx
jmp 0x120db7f
mov edx, dword [ebp - 0x478]
push edx
call edi
push 2
push 0x126aaf4
mov esi, 0x126ade8
mov ecx, 0x1269d04
call fcn.01209a40
push 2
push 0x1269d88
mov edi, 0x1269d38
mov esi, 0x1263064
call fcn.012097e0
add esp, 0x10
test eax, eax
je 0x120dc0e
mov eax, dword [ebp - 0x47c]
push 0x1269f78
push eax
call fcn.01204730
mov esi, eax
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x120dbef
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x120dbef
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x120dc0e
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x120dc07
or eax, 4
push ebx
push eax
call fcn.011f2d10
push 1
push 0x1269de0
mov edi, 0x12691f8
mov esi, 0x1263064
call fcn.012097e0
add esp, 8
test eax, eax
je 0x120dc85
mov edx, dword [ebp - 0x47c]
push 0x126a028
push edx
call fcn.01204730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x120dc66
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x120dc66
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x120dc85
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x120dc7e
or eax, 4
push ebx
push eax
call fcn.011f2d10
push 2
push 0x1269e88
mov edi, 0x1269e38
mov esi, 0x1263064
call fcn.012097e0
add esp, 8
test eax, eax
je 0x120dcfc
mov edx, dword [ebp - 0x47c]
push 0x126a0d8
push edx
call fcn.01204730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x120dcdd
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x120dcdd
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x120dcfc
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x120dcf5
or eax, 4
push ebx
push eax
call fcn.011f2d10
push 2
push 0x126ad38
mov edi, 0x126ace0
mov esi, 0x1263064
call fcn.012097e0
add esp, 8
test eax, eax
je 0x120dd73
mov edx, dword [ebp - 0x47c]
push 0x126a0d8
push edx
call fcn.01204730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x120dd54
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x120dd54
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x120dd73
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x120dd6c
or eax, 4
push ebx
push eax
call fcn.011f2d10
push 2
push 0x1263064
mov esi, 0x126ae40
mov ecx, 0x126a1d8
call fcn.01209a40
push 1
push 0x126af64
mov esi, 0x1263064
mov ecx, 0x126b318
call fcn.01209a40
push 1
push 0x126b020
mov esi, 0x126afd0
mov ecx, 0x126b368
call fcn.01209a40
push 1
push 0x1263064
mov esi, 0x126b0a4
mov ecx, 0x126b3d0
call fcn.01209a40
push 1
push 0x126b124
mov esi, 0x1263064
mov ecx, 0x126b3d0
call fcn.01209a40
push 1
push 0x126b188
mov esi, 0x126b138
mov ecx, 0x126b3d0
call fcn.01209a40
push 1
push 0x1263064
mov esi, 0x126b428
mov ecx, 0x126b478
call fcn.01209a40
push 1
push 0x1263064
mov esi, 0x126b1b0
mov ecx, 0x126b508
call fcn.01209a40
add esp, 0x40
push 1
push 0x1263064
mov esi, 0x126b240
mov ecx, 0x126b578
call fcn.01209a40
push 1
push 0x1263064
mov esi, 0x1269508
mov ecx, 0x126a228
call fcn.01209a40
push 1
push 0x1263064
mov esi, 0x1269678
mov ecx, 0x126a288
call fcn.01209a40
add esp, 0x18
lea edx, [ebp - 0x478]
push edx
push 0x20019
push ebx
push 0x126a328
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov eax, dword [ebp - 0x478]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
jne 0x120e114
cmp dword [ebp - 0x428], 8
mov eax, dword [ebp - 0x43c]
mov dword [ebp - 0x42c], ebx
jae 0x120deba
lea eax, [ebp - 0x43c]
xor ecx, ecx
mov word [eax], cx
mov ecx, 0x1263064
mov ebx, 0x126a328
mov edx, 0x80000001
lea esi, [ebp - 0x474]
call fcn.01209920
push eax
lea ecx, [ebp - 0x43c]
mov byte [ebp - 4], 5
call fcn.011f1560
mov byte [ebp - 4], 0
cmp dword [ebp - 0x460], 8
jb 0x120df05
mov edx, dword [ebp - 0x474]
push edx
call fcn.0123e60d
add esp, 4
mov ebx, dword [ebp - 0x47c]
push 0x1268f50
push ecx
lea eax, [ebp - 0x43c]
push eax
push ecx
push 0x126a358
push ebx
call fcn.01204730
add esp, 0xc
push eax
call fcn.012049f0
add esp, 0xc
push eax
call fcn.01205080
mov esi, eax
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x120df60
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x120df60
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0x120df81
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], 0
jne 0x120df79
or eax, 4
push 0
push eax
call fcn.011f2d10
mov edx, 0x126a328
lea ecx, [ebp - 0x420]
call fcn.01209630
lea edx, [ebp - 0x420]
push edx
push 0x80000001
call fcn.01209680
add esp, 8
test eax, eax
je 0x120dfff
push 0x126a3d0
push ebx
call fcn.01204730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x120dfde
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x120dfde
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0x120dfff
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], 0
jne 0x120dff7
or eax, 4
push 0
push eax
call fcn.011f2d10
push 0x11
xor edx, edx
push 0x1269a28
lea ecx, [ebp - 0x458]
mov dword [ebp - 0x444], 7
mov dword [ebp - 0x448], 0
mov word [ebp - 0x458], dx
call fcn.011f1740
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x43c]
push eax
lea ecx, [ebp - 0x458]
mov byte [ebp - 4], 6
call fcn.01201f30
cmp dword [ebp - 0x444], 8
mov edx, dword [ebp - 0x458]
jae 0x120e05d
lea edx, [ebp - 0x458]
lea ecx, [ebp - 0x420]
call fcn.01209630
lea ecx, [ebp - 0x420]
push ecx
push 0x80000001
call fcn.01209680
add esp, 8
test eax, eax
je 0x120e0f6
push 0x1269a4c
push ecx
lea edx, [ebp - 0x43c]
push edx
push ecx
push 0x1269a7c
push ebx
call fcn.01204730
add esp, 0xc
push eax
call fcn.012049f0
add esp, 0xc
push eax
call fcn.01204730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x120e0d5
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x120e0d5
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0x120e0f6
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], 0
jne 0x120e0ee
or eax, 4
push 0
push eax
call fcn.011f2d10
mov byte [ebp - 4], 0
cmp dword [ebp - 0x444], 8
jb 0x120e112
mov edx, dword [ebp - 0x458]
push edx
call fcn.0123e60d
add esp, 4
xor ebx, ebx
lea eax, [ebp - 0x478]
push eax
push 0x20019
push ebx
push 0x126a438
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [ebp - 0x478]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x120e1b4
push 1
push 0x1263064
mov esi, 0x126a464
mov ecx, 0x126a438
call fcn.01209a40
mov edx, dword [ebp - 0x47c]
push 0x126a478
push edx
call fcn.01204730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 0x10
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x120e195
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x120e195
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0x120e1b4
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0x120e1ad
or eax, 4
push ebx
push eax
call fcn.011f2d10
cmp dword [ebp - 0x428], 8
mov eax, dword [ebp - 0x43c]
mov dword [ebp - 0x42c], ebx
jae 0x120e1cf
lea eax, [ebp - 0x43c]
xor edx, edx
mov word [eax], dx
mov ecx, 0x1263064
mov ebx, 0x126a438
mov edx, 0x80000002
lea esi, [ebp - 0x474]
call fcn.01209920
push eax
lea ecx, [ebp - 0x43c]
mov byte [ebp - 4], 7
call fcn.011f1560
mov byte [ebp - 4], 0
cmp dword [ebp - 0x460], 8
jb 0x120e21a
mov eax, dword [ebp - 0x474]
push eax
call fcn.0123e60d
add esp, 4
push 1
push 0x126a438
mov edi, 0x126a464
mov esi, 0x1263064
call fcn.012097e0
add esp, 8
test eax, eax
je 0x120e30d
mov ebx, dword [ebp - 0x47c]
push 0x1268f50
push ecx
lea ecx, [ebp - 0x43c]
push ecx
push ecx
push 0x126a500
push ebx
call fcn.01204730
add esp, 0xc
push eax
call fcn.012049f0
add esp, 0xc
push eax
call fcn.01205080
mov esi, eax
mov edx, dword [esi]
mov eax, dword [edx + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x120e296
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x120e296
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0x120e2b7
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], 0
jne 0x120e2af
or eax, 4
push 0
push eax
call fcn.011f2d10
push 0x126ae90
push ebx
call fcn.01204730
mov esi, eax
mov edx, dword [esi]
mov eax, dword [edx + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0x120e2ec
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0x120e2ec
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0x120e30d
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], 0
jne 0x120e305
or eax, 4
push 0
push eax
call fcn.011f2d10
push 1
push 0x1263064
mov esi, 0x1268e60
mov ecx, 0x126a5e8
call fcn.01209a40
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
add esp, 8
lea edx, [ebp - 0x478]
push edx
push 0x20019
push 0
push 0x126a63c
push 0x80000002
call ebx
mov esi, eax
mov eax, dword [ebp - 0x478]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x120e389
push 1
push 0x1263064
mov esi, 0x12691f8
mov ecx, 0x126a670
call fcn.01209a40
mov ecx, dword [ebp - 0x47c]
push 0x126a6c8
push ecx
call fcn.01204730
push eax
call fcn.011f3070
add esp, 0x14
push 1
push 0x1263064
mov esi, 0x126a758
mov ecx, 0x126a63c
call fcn.01209a40
lea edx, [ebp - 0x480]
push edx
mov ecx, 0x126a63c
mov dword [ebp - 0x480], 0x30
call fcn.01209b30
add esp, 0xc
push 0x1269368
mov ecx, 0x126a780
mov edx, 0x80000002
call fcn.01209ac0
add esp, 4
push 2
push 0x126aaf4
mov esi, 0x126af10
mov ecx, 0x126a63c
call fcn.01209a40
push 2
push 0x1263064
mov esi, 0x126a7c8
mov ecx, 0x126a810
call fcn.01209a40
push 1
push 0x1263064
mov esi, 0x1269508
mov ecx, 0x126a860
call fcn.01209a40
push 1
push 0x126a670
mov edi, 0x12691f8
mov esi, 0x1263064
call fcn.012097e0
add esp, 0x20
test eax, eax
je 0x120e44d
mov eax, dword [ebp - 0x47c]
push 0x126a8c0
push eax
call fcn.01204730
push eax
call fcn.011f3070
add esp, 0xc
lea ecx, [ebp - 0x478]
push ecx
push 0x20019
push 0
push 0x126a990
push 0x80000001
call ebx
mov edx, dword [ebp - 0x478]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x120e628
cmp dword [ebp - 0x428], 8
mov eax, dword [ebp - 0x43c]
mov dword [ebp - 0x42c], esi
jae 0x120e499
lea eax, [ebp - 0x43c]
xor ecx, ecx
mov word [eax], cx
mov ecx, 0x1263064
mov ebx, 0x126a990
mov edx, 0x80000001
lea esi, [ebp - 0x474]
call fcn.01209920
mov ebx, 8
push eax
lea ecx, [ebp - 0x43c]
mov byte [ebp - 4], bl
call fcn.011f1560
mov byte [ebp - 4], 0
cmp dword [ebp - 0x460], ebx
jb 0x120e4e7
mov edx, dword [ebp - 0x474]
push edx
call fcn.0123e60d
add esp, 4
mov esi, dword [ebp - 0x47c]
push 0x1268f50
push ecx
lea eax, [ebp - 0x43c]
push eax
push ecx
push 0x126a9c0
push esi
call fcn.01204730
add esp, 0xc
push eax
call fcn.012049f0
add esp, 0xc
push eax
call fcn.01205080
push eax
call fcn.011f3070
add esp, 0xc
mov edx, 0x126a990
lea ecx, [ebp - 0x420]
call fcn.01209630
lea ecx, [ebp - 0x420]
push ecx
push 0x80000001
call fcn.01209680
add esp, 8
test eax, eax
je 0x120e55d
push 0x126aa38
push esi
call fcn.01204730
push eax
call fcn.011f3070
add esp, 0xc
push 0x11
xor edx, edx
push 0x1269a28
lea ecx, [ebp - 0x458]
mov dword [ebp - 0x444], 7
mov dword [ebp - 0x448], 0
mov word [ebp - 0x458], dx
call fcn.011f1740
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x43c]
push eax
lea ecx, [ebp - 0x458]
mov byte [ebp - 4], 9
call fcn.01201f30
mov edx, dword [ebp - 0x458]
cmp dword [ebp - 0x444], ebx
jae 0x120e5ba
lea edx, [ebp - 0x458]
lea ecx, [ebp - 0x420]
call fcn.01209630
lea ecx, [ebp - 0x420]
push ecx
push 0x80000001
call fcn.01209680
add esp, 8
test eax, eax
je 0x120e611
push 0x1269a4c
push ecx
lea edx, [ebp - 0x43c]
push edx
push ecx
push 0x1269a7c
push esi
call fcn.01204730
add esp, 0xc
push eax
call fcn.012049f0
add esp, 0xc
push eax
call fcn.01204730
push eax
call fcn.011f3070
add esp, 0xc
cmp dword [ebp - 0x444], ebx
jb 0x120e628
mov eax, dword [ebp - 0x458]
push eax
call fcn.0123e60d
add esp, 4
cmp dword [ebp - 0x428], 8
jb 0x120e640
mov ecx, dword [ebp - 0x43c]
push ecx
call fcn.0123e60d
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0123e488
mov esp, ebp
pop ebp
ret