Function at 0x481920
Capabilities:
Get file attributes
Query environment variable
Query or enumerate registry value

Disassembly:
cmp byte [0x505e4c], 0
jne 0x48261e
push ebx
push edi
push esi
sub esp, 0x114
mov byte [0x505e4c], 1
mov dword [0x505e50], 0
mov dword [0x505e54], 0
mov esi, dword [0x5052b0]
mov dword [0x505e58], esi
mov dword [0x505e5c], 0x104
push 0x104
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
mov byte [eax], 0
mov dword [0x505e64], eax
mov dword [0x505e60], 0
mov dword [0x505e74], 0x4fb060
mov dword [0x505e78], 0
mov dword [0x505e7c], 0
mov dword [0x505e80], esi
mov dword [0x505e68], 0
mov dword [0x505e6c], 0
mov dword [0x505e70], esi
mov dword [0x505e84], 0
mov dword [0x505e88], 0
mov dword [0x505e8c], esi
mov dword [0x505e90], 0
mov dword [0x505e94], 0
mov dword [0x505e98], esi
mov dword [0x505e9c], 0
mov dword [0x505ea0], 0
call fcn.00480de0
mov esi, dword [0x505e44]
test esi, esi
je 0x481bc7
mov dword [esp + 0x14], 0
mov ebx, esp
lea edi, [esp + 0x14]
jmp 0x481a58
mov eax, dword [0x505e80]
mov byte [eax], 0
mov dword [0x505e7c], 0
mov dword [0x505e74], 0x4fb060
mov esi, dword [esp + 0x14]
test esi, esi
je 0x481bc7
mov ecx, esi
mov edx, edi
push ebx
push 0x505e78
push 0x505e74
push 0x505e5c
push 0x505e50
call fcn.00481740
add esp, 0x14
test al, al
je 0x481bc7
cmp byte [esp], 0
jne 0x481b30
cmp dword [0x505e50], 0
je 0x481aa0
mov eax, dword [0x505e58]
mov byte [eax], 0
jmp 0x481aaa
mov eax, dword [0x5052b0]
mov dword [0x505e58], eax
mov dword [0x505e54], 0
cmp dword [0x505e68], 0
je 0x481ad0
mov eax, dword [0x505e70]
mov byte [eax], 0
jmp 0x481ada
mov eax, dword [0x5052b0]
mov dword [0x505e70], eax
mov dword [0x505e6c], 0
cmp dword [0x505e5c], 0
je 0x481b00
mov eax, dword [0x505e64]
mov byte [eax], 0
jmp 0x481b0a
mov eax, dword [0x5052b0]
mov dword [0x505e64], eax
mov dword [0x505e60], 0
cmp dword [0x505e78], 0
jne 0x481a30
mov eax, dword [0x5052b0]
mov dword [0x505e80], eax
jmp 0x481a38
push 0x505e50
push 0x505e68
call fcn.00472940
add esp, 8
mov eax, dword [0x505e6c]
cmp eax, 4
jb 0x481b80
mov ecx, dword [0x505e70]
add eax, ecx
add eax, 0xfffffffc
push str..exe
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
jne 0x481b80
mov eax, dword [0x505e6c]
add eax, 0xfffffffc
push eax
push 0x505e68
call fcn.00472d30
add esp, 8
push str.sihost
push dword [0x505e70]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
je 0x481d49
push str.explorer
push dword [0x505e70]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
je 0x481d49
mov dword [0x505e9c], esi
mov eax, dword [esp + 0x14]
mov dword [0x505ea0], eax
cmp dword [0x505e54], 0
jne 0x4823fb
push str.ConEmuPID
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
test eax, eax
je 0x481c83
push 0xa
push 0
push eax
call sub.api_ms_win_crt_convert_l1_1_0.dll_strtoul
add esp, 0xc
mov dword [0x505e9c], eax
mov ecx, eax
xor edx, edx
push 0
push 0x505e78
push 0x505e74
push 0x505e5c
push 0x505e50
call fcn.00481740
add esp, 0x14
mov esi, str.ConEmu
test al, al
je 0x481c85
push 0x505e50
push 0x505e68
call fcn.00472940
add esp, 8
mov eax, dword [0x505e6c]
cmp eax, 4
jb 0x482079
mov ecx, dword [0x505e70]
add eax, ecx
add eax, 0xfffffffc
push str..exe
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
jne 0x482079
mov eax, dword [0x505e6c]
add eax, 0xfffffffc
push eax
push 0x505e68
call fcn.00472d30
add esp, 8
jmp 0x482079
xor esi, esi
push str.SSH_CONNECTION
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
test eax, eax
je 0x481ca5
push str.SSH_TTY
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
mov esi, eax
test esi, esi
jne 0x481d36
push str.WT_SESSION
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
mov esi, str.WindowsTerminal
test eax, eax
jne 0x481d36
push str.WT_PROFILE_ID
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
test eax, eax
jne 0x481d36
push str.ALACRITTY_SOCKET
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
mov esi, str.Alacritty
test eax, eax
jne 0x481d36
push str.ALACRITTY_LOG
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
test eax, eax
jne 0x481d36
push str.ALACRITTY_WINDOW_ID
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
test eax, eax
jne 0x481d36
push str.TERM_PROGRAM
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
mov esi, eax
test eax, eax
jne 0x481d36
push str.TERM
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
mov esi, eax
test eax, eax
je 0x482079
cmp dword [0x505e50], 0
je 0x481d63
mov eax, dword [0x505e58]
mov byte [eax], 0
jmp 0x481d6d
cmp dword [0x505e50], 0
je 0x481dea
mov eax, dword [0x505e58]
mov byte [eax], 0
jmp 0x481df4
mov eax, dword [0x5052b0]
mov dword [0x505e58], eax
mov dword [0x505e54], 0
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
test esi, esi
je 0x481ecb
mov edi, eax
test eax, eax
je 0x481ecb
mov eax, dword [0x505e50]
mov ecx, eax
sub ecx, 1
jb 0x481dae
cmp ecx, edi
jb 0x481dae
xor ecx, ecx
mov eax, dword [0x505e58]
jmp 0x481ea8
cmp eax, 2
mov ecx, 0x20
cmovae ecx, eax
mov edx, edi
inc edx
nop dword [eax]
mov ebx, ecx
add ecx, ecx
cmp edx, ebx
ja 0x481dc0
test eax, eax
je 0x481e8f
push ebx
push dword [0x505e58]
call sub.api_ms_win_crt_heap_l1_1_0.dll_realloc
add esp, 8
mov ecx, dword [0x505e54]
jmp 0x481e9d
mov eax, dword [0x5052b0]
mov dword [0x505e58], eax
mov dword [0x505e54], 0
cmp dword [0x505e68], 0
je 0x481e11
mov eax, dword [0x505e70]
mov byte [eax], 0
jmp 0x481e1b
mov eax, dword [0x5052b0]
mov dword [0x505e70], eax
mov dword [0x505e6c], 0
cmp dword [0x505e5c], 0
je 0x481e38
mov eax, dword [0x505e64]
mov byte [eax], 0
jmp 0x481e42
mov eax, dword [0x5052b0]
mov dword [0x505e64], eax
mov dword [0x505e60], 0
cmp dword [0x505e78], 0
je 0x481e5f
mov eax, dword [0x505e80]
mov byte [eax], 0
jmp 0x481e69
mov eax, dword [0x5052b0]
mov dword [0x505e80], eax
mov dword [0x505e7c], 0
mov dword [0x505e74], 0x4fb060
cmp dword [0x505e54], 0
jne 0x4823fb
jmp 0x481bd4
push ebx
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
mov byte [eax], 0
xor ecx, ecx
mov dword [0x505e58], eax
mov dword [0x505e50], ebx
add ecx, eax
push edi
push esi
push ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov eax, dword [0x505e54]
add eax, edi
mov dword [0x505e54], eax
mov ecx, dword [0x505e58]
mov byte [ecx + eax], 0
cmp dword [0x505e68], 0
je 0x481ede
mov eax, dword [0x505e70]
mov byte [eax], 0
jmp 0x481ee8
mov eax, dword [0x5052b0]
mov dword [0x505e70], eax
mov dword [0x505e6c], 0
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
test esi, esi
je 0x481f9f
mov edi, eax
test eax, eax
je 0x481f9f
mov eax, dword [0x505e68]
mov ecx, eax
sub ecx, 1
jb 0x481f26
cmp ecx, edi
jb 0x481f26
xor ecx, ecx
mov eax, dword [0x505e70]
jmp 0x481f7c
cmp eax, 2
mov ecx, 0x20
cmovae ecx, eax
mov edx, edi
inc edx
nop word cs:[eax + eax]
mov ebx, ecx
add ecx, ecx
cmp edx, ebx
ja 0x481f40
test eax, eax
je 0x481f63
push ebx
push dword [0x505e70]
call sub.api_ms_win_crt_heap_l1_1_0.dll_realloc
add esp, 8
mov ecx, dword [0x505e6c]
jmp 0x481f71
push ebx
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
mov byte [eax], 0
xor ecx, ecx
mov dword [0x505e70], eax
mov dword [0x505e68], ebx
add ecx, eax
push edi
push esi
push ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov eax, dword [0x505e6c]
add eax, edi
mov dword [0x505e6c], eax
mov ecx, dword [0x505e70]
mov byte [ecx + eax], 0
cmp dword [0x505e5c], 0
je 0x481fb2
mov eax, dword [0x505e64]
mov byte [eax], 0
jmp 0x481fbc
mov eax, dword [0x5052b0]
mov dword [0x505e64], eax
mov dword [0x505e60], 0
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
test esi, esi
je 0x48206f
mov edi, eax
test eax, eax
je 0x48206f
mov eax, dword [0x505e5c]
mov ecx, eax
sub ecx, 1
jb 0x481ffa
cmp ecx, edi
jb 0x481ffa
xor ecx, ecx
mov eax, dword [0x505e64]
jmp 0x48204c
cmp eax, 2
mov ecx, 0x20
cmovae ecx, eax
mov edx, edi
inc edx
nop dword [eax + eax]
mov ebx, ecx
add ecx, ecx
cmp edx, ebx
ja 0x482010
test eax, eax
je 0x482033
push ebx
push dword [0x505e64]
call sub.api_ms_win_crt_heap_l1_1_0.dll_realloc
add esp, 8
mov ecx, dword [0x505e60]
jmp 0x482041
push ebx
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
mov byte [eax], 0
xor ecx, ecx
mov dword [0x505e64], eax
mov dword [0x505e5c], ebx
add ecx, eax
push edi
push esi
push ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov eax, dword [0x505e60]
add eax, edi
mov dword [0x505e60], eax
mov ecx, dword [0x505e64]
mov byte [ecx + eax], 0
mov dword [0x505e74], 0x4fb060
cmp dword [0x505e54], 0
jne 0x4823fb
lea esi, [esp + 0x14]
push 0x100
push str.SOFTWAREClassesPackagedComClassIndex_
push esi
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
lea edi, [esp + 0x64]
mov dword [esp + 0x10], 0x50
lea eax, [esp + 0x10]
push eax
push edi
push 0
push 2
push str.DelegationTerminal
push str.Console__Startup
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x482160
push str.SystemRoot
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
push eax
push str._sSystem32conhost.exe
push 0x505e5c
call fcn.00472810
add esp, 0xc
push dword [0x505e64]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 0x10
jne 0x482146
cmp dword [0x505e50], 0
je 0x482253
mov eax, dword [0x505e58]
mov byte [eax], 0
mov ecx, dword [0x505e50]
mov dword [0x505e54], 0
test ecx, ecx
je 0x482267
cmp ecx, 0xc
jae 0x482624
xor eax, eax
cmp ecx, 1
ja 0x482270
jmp 0x482269
cmp dword [0x505e5c], 0
je 0x482314
mov eax, dword [0x505e64]
mov byte [eax], 0
jmp 0x48231e
push str.00000000_0000_0000_0000_000000000000
push edi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscmp
add esp, 8
test eax, eax
je 0x4820d0
push str.B23D10C0_E52E_411E_9D5B_C09FDF709C7D
push edi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscmp
add esp, 8
test eax, eax
je 0x4820d0
mov dword [esp + 0xc], 0
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x48223b
mov dword [esp], 0
mov dword [esp + 4], 0
mov eax, dword [0x5052b0]
mov dword [esp + 8], eax
mov eax, esp
push 0
push eax
push 0
push dword [esp + 0x18]
call fcn.00485b10
add esp, 0x10
test al, al
je 0x48221a
cmp dword [esp + 4], 0x19
jb 0x48221a
mov eax, dword [esp + 8]
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 9]
pcmpeqb xmm1, xmmword [str..WindowsTerminalMicrosoft.Window]
pcmpeqb xmm0, xmmword [0x4fb050]
pand xmm0, xmm1
pmovmskb eax, xmm0
cmp eax, 0xffff
je 0x48263c
cmp dword [esp], 0
mov dword [esp + 4], 0
je 0x48223b
mov dword [esp], 0
push dword [esp + 8]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4820d0
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4820d0
mov eax, dword [0x5052b0]
mov dword [0x505e58], eax
mov dword [0x505e54], 0
mov al, 1
mov ecx, 0x20
nop
mov esi, ecx
add ecx, ecx
cmp esi, 0xc
jb 0x482270
test al, al
je 0x48228d
push esi
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
mov byte [eax], 0
xor ecx, ecx
jmp 0x4822a2
push esi
push dword [0x505e58]
call sub.api_ms_win_crt_heap_l1_1_0.dll_realloc
add esp, 8
mov ecx, dword [0x505e54]
mov dword [0x505e58], eax
mov dword [0x505e50], esi
mov dword [eax + ecx + 7], 0x6578652e
mov dword [eax + ecx + 4], 0x2e74736f
mov dword [eax + ecx], 0x686e6f63
mov eax, dword [0x505e54]
lea ecx, [eax + 0xb]
mov dword [0x505e54], ecx
mov ecx, dword [0x505e58]
mov byte [ecx + eax + 0xb], 0
cmp dword [0x505e68], 0
je 0x48232d
mov eax, dword [0x505e70]
mov byte [eax], 0
mov ecx, dword [0x505e68]
mov dword [0x505e6c], 0
test ecx, ecx
je 0x482341
cmp ecx, 8
jae 0x482630
xor eax, eax
cmp ecx, 1
ja 0x482350
jmp 0x482343
mov eax, dword [0x5052b0]
mov dword [0x505e64], eax
mov dword [0x505e60], 0
jmp 0x4823ee
mov eax, dword [0x5052b0]
mov dword [0x505e70], eax
mov dword [0x505e6c], 0
mov al, 1
mov ecx, 0x20
nop dword [eax + eax]
mov esi, ecx
add ecx, ecx
cmp esi, 8
jb 0x482350
test al, al
je 0x48236d
push esi
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
mov byte [eax], 0
xor ecx, ecx
jmp 0x482382
push esi
push dword [0x505e70]
call sub.api_ms_win_crt_heap_l1_1_0.dll_realloc
add esp, 8
mov ecx, dword [0x505e6c]
mov dword [0x505e70], eax
mov dword [0x505e68], esi
mov dword [eax + ecx + 3], 0x74736f68
mov dword [eax + ecx], 0x686e6f63
mov eax, dword [0x505e6c]
lea ecx, [eax + 7]
mov dword [0x505e6c], ecx
mov ecx, dword [0x505e70]
mov byte [ecx + eax + 7], 0
mov eax, dword [0x505e64]
mov edx, dword [0x505e60]
test edx, edx
je 0x4823e0
mov esi, edx
mov ecx, edx
nop dword [eax + eax]
sub ecx, 1
jb 0x4823e4
cmp byte [eax + esi - 1], 0x5c
mov esi, ecx
jne 0x4823d0
jmp 0x4823e6
xor ecx, ecx
jmp 0x4823e6
mov ecx, edx
add eax, ecx
inc eax
mov dword [0x505e74], eax
cmp dword [0x505e54], 0
je 0x482615
push str.WindowsTerminal
push dword [0x505e70]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
je 0x4824c6
push str.conhost
push dword [0x505e70]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
je 0x48252f
push str.Code
push dword [0x505e70]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
je 0x482573
push str.explorer
push dword [0x505e70]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
je 0x4825b4
mov esi, dword [0x505e70]
push str.wezterm_gui
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
add esp, 8
test eax, eax
jne 0x4825fe
cmp dword [0x505e68], 0
je 0x4824ad
mov dword [0x505e6c], 0
mov dword [0x505e68], 0
push esi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
mov dword [0x505e68], 0
mov edi, str.WezTerm
mov eax, 7
jmp 0x4825f3
push str..WindowsTerminalPreview_
push dword [0x505e64]
call sub.SHELL32.dll_StrStrIA
mov esi, eax
test eax, eax
mov eax, str.Windows_Terminal
mov edi, str.Windows_Terminal_Preview
cmove edi, eax
cmp dword [0x505e68], 0
je 0x482512
mov dword [0x505e6c], 0
mov dword [0x505e68], 0
push dword [0x505e70]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
xor eax, eax
test esi, esi
setne al
mov dword [0x505e68], 0
lea eax, [eax*8 + 0x10]
jmp 0x4825f3
cmp dword [0x505e68], 0
je 0x48255a
mov dword [0x505e6c], 0
mov dword [0x505e68], 0
push dword [0x505e70]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
mov dword [0x505e68], 0
mov edi, str.Console_Window_Host
mov eax, 0x13
jmp 0x4825f3
cmp dword [0x505e68], 0
je 0x48259e
mov dword [0x505e6c], 0
mov dword [0x505e68], 0
push dword [0x505e70]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
mov dword [0x505e68], 0
mov edi, str.Visual_Studio_Code
mov eax, 0x12
jmp 0x4825f3
cmp dword [0x505e68], 0
je 0x4825df
mov dword [0x505e6c], 0
mov dword [0x505e68], 0
push dword [0x505e70]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
mov dword [0x505e68], 0
mov edi, str.Windows_Explorer
mov eax, 0x10
mov dword [0x505e6c], eax
mov dword [0x505e70], edi
push 0x505e84
push 0x505e5c
push 0x505e50
call fcn.00420b80
add esp, 0xc
add esp, 0x114
pop esi
pop edi
pop ebx
mov eax, 0x505e50
ret
xor ecx, ecx
mov eax, dword [0x505e58]
jmp 0x4822ad
xor ecx, ecx
mov eax, dword [0x505e70]
jmp 0x48238d
cmp dword [0x505e50], 0
je 0x48264f
mov eax, dword [0x505e58]
mov byte [eax], 0
jmp 0x482659
mov eax, dword [0x5052b0]
mov dword [0x505e58], eax
mov dword [0x505e54], 0
push str.WindowsTerminal.exe
push 0x13
push 0x505e50
call fcn.00472620
add esp, 0xc
cmp dword [0x505e68], 0
je 0x48268a
mov eax, dword [0x505e70]
mov byte [eax], 0
jmp 0x482694
mov eax, dword [0x5052b0]
mov dword [0x505e70], eax
mov dword [0x505e6c], 0
push str.WindowsTerminal
push 0xf
push 0x505e68
call fcn.00472620
add esp, 0xc
push str.ProgramFiles
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
push dword [esp + 8]
push eax
push str._sWindowsApps_sWindowsTerminal.exe
push 0x505e5c
call fcn.00472810
add esp, 0x10
push dword [0x505e64]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 0x10
jne 0x482709
mov eax, dword [0x505e64]
mov edx, dword [0x505e60]
test edx, edx
je 0x48275b
mov esi, edx
mov ecx, edx
sub ecx, 1
jb 0x48275f
cmp byte [eax + esi - 1], 0x5c
mov esi, ecx
jne 0x4826f9
jmp 0x482761
cmp dword [0x505e5c], 0
mov dword [0x505e60], 0
je 0x482734
mov dword [0x505e5c], 0
push dword [0x505e64]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
mov eax, dword [esp]
mov ecx, dword [esp + 4]
mov dword [0x505e5c], eax
mov eax, dword [esp + 8]
mov dword [0x505e64], eax
mov dword [0x505e60], ecx
mov dword [0x505e74], 0x4fb060
jmp 0x48278a
xor ecx, ecx
jmp 0x482761
mov ecx, edx
add eax, ecx
inc eax
mov dword [0x505e74], eax
cmp dword [esp], 0
mov dword [esp + 4], 0
je 0x48278a
mov dword [esp], 0
push dword [esp + 8]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
mov eax, dword [esp + 0xc]
test eax, eax
je 0x4823ee
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4823ee