Function at 0x447c70
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47e8d1
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x4a0
mov eax, dword [0x4b4200]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x454], esi
mov eax, dword [ebx + 8]
push 0x270
mov dword [ebp - 0x498], eax
lea eax, [ebp - 0x328]
push 0
push eax
call fcn.0046ba40
add esp, 0xc
mov word [ebp - 0x2f0], 0
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x218], 0
mov byte [ebp - 0x210], 1
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x328]
push 1
mov dword [ebp - 0x20c], 0
mov dword [ebp - 0xe8], 0
mov dword [ebp - 0xe0], 0
mov dword [ebp - 0xdc], 0
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0xd4], 0
mov dword [ebp - 0xd0], 0
call fcn.0041ada0
push ecx
push 0
push 0xffffffffffffffff
push 0xcf0000
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x226
push 0x2ee
add esi, 0xd8
lea eax, [ebp - 0x328]
push str.Clear_Disk_Info_Monitoring_Results
cmovne eax, esi
lea ecx, [ebp - 0x328]
push str.ClearDiskInfoResultsDlg
mov dword [ebp - 0x168], eax
call fcn.0040ecf0
lea eax, [ebp - 0xac]
mov dword [ebp - 4], 1
push eax
push dword [ebp - 0xf8]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0xa0]
mov ecx, dword [ebp - 0xa4]
sub eax, dword [ebp - 0xa8]
sub ecx, dword [ebp - 0xac]
movsd xmm0, qword [0x4aa3f8]
mov dword [ebp - 0x1e4], eax
xor eax, eax
mov dword [ebp - 0x1e8], ecx
mov dword [ebp - 0x1e0], 0
mov dword [ebp - 0x1dc], 0
movsd qword [ebp - 0x1b8], xmm0
mov dword [ebp - 0x1b0], 0x190
mov byte [ebp - 0x1ac], 1
mov byte [ebp - 0x16a], 0
inc eax
cmp word [eax*2 + str.Arial], 0
jne 0x447e14
inc eax
push eax
push str.Arial
lea eax, [ebp - 0x1aa]
push 0x20
push eax
call fcn.0046d1e3
add esp, 0x10
mov dword [ebp - 0x138], 0x404
lea ecx, [ebp - 0x328]
call fcn.0041aa50
mov edi, dword [sym.imp.USER32.dll_CreateWindowExW]
test al, al
jne 0x447e66
mov dword [ebp - 0x488], 0
jmp 0x447eed
mov eax, dword [ebp - 0x2e8]
mov ecx, str.Clear_Disk_Info_detected_some_changes_in_the_selected_attributes._Check_them_out_in_the_list_below.
push 0
push dword [ebp - 0x20c]
inc eax
push eax
push dword [ebp - 0xf4]
movzx eax, byte [ebp - 0xe0]
push 0x12
push 0x2da
and eax, 1
push 0xa
shl eax, 0x11
push 0xa
add eax, 0x50000101
test byte [ebp - 0x498], 2
push eax
mov eax, str.The_list_below_shows_the_history_of_changes_in_the_monitored_disks_attributes
cmove eax, ecx
push eax
push str.Static
push 0
call edi
test eax, eax
jne 0x447ec4
mov dword [ebp - 0x488], eax
jmp 0x447eed
push eax
push 0xd
lea ecx, [ebp - 0x328]
call fcn.0041a7c0
mov ecx, dword [ebp - 0x2ec]
movaps xmm0, xmmword [0x4aa670]
mov dword [ebp - 0x488], eax
lea edx, [eax + eax*8]
movups xmmword [ecx + edx*8 + 0x24], xmm0
push 0x10021
push 0x1080000d
push 0x1d1
push 0x2ee
push 0x2d
push 0
push 0x49edcc
push str.Attribute_nameCurrent_valuePrevious_valueAttribute_description
lea ecx, [ebp - 0x328]
mov dword [ebp - 0x138], 0x433
call fcn.004156d0
mov esi, dword [ebp - 0x2e8]
cmp eax, 0xffffffff
mov edx, dword [ebp - 0x2ec]
mov ecx, eax
cmove ecx, esi
mov dword [ebp - 0x474], eax
test edx, edx
je 0x447f6f
cmp ecx, 1
jl 0x447f6f
cmp ecx, esi
jg 0x447f6f
lea eax, [ecx + ecx*8]
cmp dword [edx + eax*8 + 0xc], 0
je 0x447f6f
cmp dword [edx + eax*8], 0xf
jne 0x447f6f
push 0
push 1
push 0x109d
push dword [edx + eax*8 + 4]
mov eax, dword [sym.imp.USER32.dll_SendMessageW]
call eax
mov eax, dword [ebp - 0x454]
push 0
push 0x10
push 0x10
push ecx
push 0x6a
push dword [eax + 0x3c0]
call fcn.0041b150
mov esi, eax
mov dword [ebp - 0x33c], esi
mov dword [ebp - 0x354], 0
test esi, esi
je 0x447fb8
push 0
lea eax, [ebp - 0x354]
push eax
push dword [esi + 4]
call dword [sym.imp.gdiplus.dll_GdipCreateHBITMAPFromBitmap]
test eax, eax
je 0x447fb8
mov dword [esi + 8], eax
push 0x10
push 0x10
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x328]
push dword [ebp - 0x354]
push 1
push dword [ebp - 0x474]
call fcn.004174a0
mov eax, dword [ebp - 0x354]
test eax, eax
je 0x447fea
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov byte [ebp - 4], 1
test esi, esi
je 0x447ffc
mov eax, dword [esi]
mov ecx, esi
push 1
mov eax, dword [eax]
call eax
mov ecx, dword [ebp - 0x474]
test ecx, ecx
jne 0x44800e
mov eax, dword [ebp - 0xf8]
jmp 0x448041
mov edx, dword [ebp - 0x2e8]
cmp ecx, 0xffffffff
mov eax, ecx
mov ecx, dword [ebp - 0x2ec]
cmove eax, edx
test ecx, ecx
je 0x44803f
cmp eax, 1
jl 0x44803f
cmp eax, edx
jg 0x44803f
lea eax, [eax + eax*8]
cmp dword [ecx + eax*8 + 0xc], 0
je 0x44803f
mov eax, dword [ecx + eax*8 + 4]
jmp 0x448041
xor eax, eax
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0xc8
push 0
push 0x101e
push eax
mov dword [ebp - 0x4a0], eax
call esi
push 0x64
push 1
push 0x101e
push dword [ebp - 0x4a0]
call esi
push 0x64
push 2
push 0x101e
push dword [ebp - 0x4a0]
call esi
push 0x1f4
push 3
push 0x101e
push dword [ebp - 0x4a0]
call esi
cmp dword [ebp - 0xf8], 0
mov dword [ebp - 0x138], 0x424
je 0x44812c
lea ecx, [ebp - 0x328]
call fcn.0041aa50
test al, al
je 0x44812c
mov eax, dword [ebp - 0x2e8]
push 0
push dword [ebp - 0x20c]
inc eax
push eax
push dword [ebp - 0xf4]
movzx eax, byte [ebp - 0xe0]
push 0x1e
push 0x96
push 0x203
and eax, 1
push 0x7d
shl eax, 0x11
add eax, 0x50010000
push eax
push str.OK__close_this
push str.Button
push 0
call edi
test eax, eax
je 0x44812c
push eax
push 3
lea ecx, [ebp - 0x328]
call fcn.0041a7c0
mov ecx, dword [ebp - 0x2ec]
movaps xmm0, xmmword [0x4aa780]
mov dword [ebp - 0x490], eax
lea edx, [eax + eax*8]
movups xmmword [ecx + edx*8 + 0x24], xmm0
jmp 0x448136
mov dword [ebp - 0x490], 0
cmp dword [ebp - 0xf8], 0
je 0x4481c9
lea ecx, [ebp - 0x328]
call fcn.0041aa50
test al, al
je 0x4481c9
mov eax, dword [ebp - 0x2e8]
push 0
push dword [ebp - 0x20c]
inc eax
push eax
push dword [ebp - 0xf4]
movzx eax, byte [ebp - 0xe0]
push 0x1e
push 0x96
push 0x203
and eax, 1
push 0x12c
shl eax, 0x11
add eax, 0x50010000
push eax
push str.Open_Clear_Disk_Info
push str.Button
push 0
call edi
test eax, eax
je 0x4481c9
push eax
push 3
lea ecx, [ebp - 0x328]
call fcn.0041a7c0
mov ecx, dword [ebp - 0x2ec]
movaps xmm0, xmmword [0x4aa790]
mov dword [ebp - 0x4ac], eax
lea edx, [eax + eax*8]
movups xmmword [ecx + edx*8 + 0x24], xmm0
jmp 0x4481d3
mov dword [ebp - 0x4ac], 0
cmp dword [ebp - 0xf8], 0
je 0x448266
lea ecx, [ebp - 0x328]
call fcn.0041aa50
test al, al
je 0x448266
mov eax, dword [ebp - 0x2e8]
push 0
push dword [ebp - 0x20c]
inc eax
push eax
push dword [ebp - 0xf4]
movzx eax, byte [ebp - 0xe0]
push 0x1e
push 0x96
push 0x203
and eax, 1
push 0x12c
shl eax, 0x11
add eax, 0x40010000
push eax
push str.Clear_history
push str.Button
push 0
call edi
test eax, eax
je 0x448266
push eax
push 3
lea ecx, [ebp - 0x328]
call fcn.0041a7c0
mov ecx, dword [ebp - 0x2ec]
movaps xmm0, xmmword [0x4aa790]
mov dword [ebp - 0x4a4], eax
lea edx, [eax + eax*8]
movups xmmword [ecx + edx*8 + 0x24], xmm0
jmp 0x448270
mov dword [ebp - 0x4a4], 0
cmp dword [ebp - 0xf8], 0
je 0x448303
lea ecx, [ebp - 0x328]
call fcn.0041aa50
test al, al
je 0x448303
mov eax, dword [ebp - 0x2e8]
push 0
push dword [ebp - 0x20c]
inc eax
push eax
push dword [ebp - 0xf4]
movzx eax, byte [ebp - 0xe0]
push 0x1e
push 0x96
push 0x203
and eax, 1
push 0x1db
shl eax, 0x11
add eax, 0x50010000
push eax
push str.View_full_history
push str.Button
push 0
call edi
test eax, eax
je 0x448303
push eax
push 3
lea ecx, [ebp - 0x328]
call fcn.0041a7c0
mov ecx, dword [ebp - 0x2ec]
movaps xmm0, xmmword [0x4aa7a0]
mov dword [ebp - 0x4a8], eax
lea edx, [eax + eax*8]
movups xmmword [ecx + edx*8 + 0x24], xmm0
jmp 0x44830d
mov dword [ebp - 0x4a8], 0
cmp dword [ebp - 0xf8], 0
je 0x4483a2
lea ecx, [ebp - 0x328]
call fcn.0041aa50
test al, al
je 0x4483a2
mov eax, dword [ebp - 0x2e8]
push 0
push dword [ebp - 0x20c]
inc eax
push eax
push dword [ebp - 0xf4]
movzx eax, byte [ebp - 0xe0]
push 0x1e
push 0x96
push 0x203
and eax, 1
push 0x1db
shl eax, 0x11
add eax, 0x40010000
push eax
push str.View_last_changes
push str.Button
push 0
call edi
test eax, eax
je 0x4483a2
push eax
push 3
lea ecx, [ebp - 0x328]
call fcn.0041a7c0
mov ecx, dword [ebp - 0x2ec]
mov esi, eax
movaps xmm0, xmmword [0x4aa7a0]
mov dword [ebp - 0x48c], esi
lea edx, [esi + esi*8]
movups xmmword [ecx + edx*8 + 0x24], xmm0
jmp 0x4483ac
mov dword [ebp - 0x48c], 0
mov esi, dword [ebp - 0x454]
mov ecx, esi
push 0
call fcn.0042d5e0
mov eax, dword [esi + 0x94]
test eax, eax
jne 0x4483cd
mov eax, dword [esi + 0x380]
jmp 0x448401
cmp eax, 0xffffffff
jne 0x4483d8
mov eax, dword [esi + 0x190]
mov ecx, dword [esi + 0x18c]
test ecx, ecx
je 0x4483ff
cmp eax, 1
jl 0x4483ff
cmp eax, dword [esi + 0x190]
jg 0x4483ff
lea eax, [eax + eax*8]
cmp dword [ecx + eax*8 + 0xc], 0
je 0x4483ff
mov eax, dword [ecx + eax*8 + 4]
jmp 0x448401
xor eax, eax
xor edx, edx
xorps xmm0, xmm0
movq qword [ebp - 0x20], xmm0
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x4b0], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edx
mov byte [ebp - 0x18], 1
movq qword [ebp - 0x58], xmm0
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x58], edx
mov byte [ebp - 0x50], 1
movq qword [ebp - 0x2c], xmm0
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], edx
mov byte [ebp - 0x24], 1
movq qword [ebp - 0x44], xmm0
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x44], edx
mov byte [ebp - 0x3c], 1
movq qword [ebp - 0x38], xmm0
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x38], edx
mov byte [ebp - 0x30], 1
xor edi, edi
movq qword [ebp - 0x484], xmm0
mov dword [ebp - 0x47c], edx
mov dword [ebp - 0x480], edx
mov dword [ebp - 0x45c], edi
mov dword [ebp - 0x484], edi
mov byte [ebp - 0x47c], 1
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x4c], edi
test dword [ebp - 0x498], 2
mov byte [ebp - 4], 0xb
jne 0x4495b1
xor esi, esi
push esi
push esi
push 0x1004
push eax
mov eax, dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x46c], esi
call eax
mov dword [ebp - 0x33c], eax
test eax, eax
jle 0x449545
mov edi, dword [ebp - 0x454]
lea eax, [edi + 0x150]
mov dword [ebp - 0x464], eax
push 3
push esi
push dword [edi + 0x94]
mov ecx, eax
call fcn.00419d90
mov esi, eax
test esi, esi
jne 0x44850c
push eax
lea ecx, [ebp - 0x20]
call fcn.00405a60
mov esi, dword [ebp - 0x20]
cmp dword [eax], 0
je 0x448537
mov ecx, dword [ebp - 0x1c]
jmp 0x44852b
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x44851c
push eax
call fcn.00469dd3
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], ecx
lea eax, [ebp - 0x20]
mov byte [ebp - 0x18], 1
mov eax, dword [eax]
cmp word [eax], 0
jne 0x4485b7
test esi, esi
je 0x448544
push esi
call fcn.00469dd3
add esp, 4
mov byte [ebp - 0x18], 0
xor eax, eax
nop word [eax + eax]
inc eax
cmp word [eax*2 + 0x49f820], 0
jne 0x448550
mov dword [ebp - 0x1c], eax
mov ecx, 2
inc eax
mul ecx
mov ecx, 0xffffffff
cmovb eax, ecx
push eax
call fcn.0046a3df
mov edx, eax
add esp, 4
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov dword [ebp - 0x20], edx
test eax, eax
jle 0x4485a7
nop word [eax + eax]
mov ax, word [ecx*2 + 0x49f820]
mov word [edx + ecx*2], ax
inc ecx
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
cmp ecx, eax
jl 0x448590
xor ecx, ecx
mov word [edx + eax*2], cx
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
mov byte [ebp - 0x18], 1
test esi, esi
je 0x4485f2
test ecx, ecx
jne 0x4485d1
cmp word [esi], cx
je 0x4485cc
inc ecx
cmp word [esi + ecx*2], 0
jne 0x4485c4
mov dword [ebp - 0x1c], ecx
test ecx, ecx
jle 0x4485f2
push esi
mov byte [ebp - 0x18], 1
call fcn.0046e166
mov edx, eax
mov dword [ebp - 0x340], eax
add esp, 4
test edx, edx
js 0x44951e
jmp 0x4485fe
xor edx, edx
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x340], edx
mov ecx, dword [edi + 0x9e4]
cmp edx, ecx
jge 0x44951e
jb 0x448617
lea ecx, [edx + 1]
mov dword [edi + 0x9e4], ecx
mov eax, dword [edi + 0x9ec]
lea esi, [edx + edx*2]
shl esi, 5
cmp byte [esi + eax], 0
je 0x44951e
cmp ecx, edx
ja 0x44863a
lea eax, [edx + 1]
mov dword [edi + 0x9e4], eax
mov edx, dword [edi + 0x9ec]
mov eax, dword [edx + esi + 0x54]
test eax, eax
je 0x44951e
cmp word [eax], 0
je 0x44951e
mov byte [edx + esi + 0x5c], 1
mov edi, str.Monitoring_
mov dword [ebp - 0x484], 0
mov edx, eax
mov byte [ebp - 0x47c], 0
xor ecx, ecx
mov dword [ebp - 0x480], 0
nop
inc ecx
cmp word [ecx*2 + str.HKCUSoftwareClearDiskInfo], 0
jne 0x448680
xor eax, eax
nop
inc eax
cmp word [eax*2 + str.Monitoring_], 0
jne 0x448690
mov esi, dword [ebp - 0x45c]
add ecx, eax
mov dword [ebp - 0x478], ecx
mov dword [ebp - 0x494], edx
mov dword [ebp - 0x460], esi
test edx, edx
jne 0x4486c8
mov eax, dword [ebp - 0x340]
mov dword [ebp - 0x340], eax
jmp 0x4486fd
xor eax, eax
cmp word [edx], ax
je 0x4486fb
mov ecx, dword [ebp - 0x340]
mov esi, dword [ebp - 0x45c]
mov dword [ebp - 0x340], ecx
mov ecx, dword [ebp - 0x478]
mov dword [ebp - 0x460], esi
mov dword [ebp - 0x494], edx
inc eax
cmp word [edx + eax*2], 0
jne 0x4486f3
add ecx, eax
lea eax, [ecx + 1]
mov dword [ebp - 0x478], ecx
mov ecx, 2
mul ecx
mov ecx, 0xffffffff
cmovb eax, ecx
push eax
call fcn.0046a3df
mov esi, str.HKCUSoftwareClearDiskInfo
mov dword [ebp - 0x45c], eax
add esp, 4
mov ecx, eax
mov edx, 0x48
sub esi, eax
mov word [ecx], dx
add ecx, 2
movzx eax, word [esi + ecx]
mov edx, eax
test ax, ax
jne 0x448732
mov esi, dword [ebp - 0x494]
mov eax, 0x5c
nop
movzx eax, ax
lea edi, [edi + 2]
mov word [ecx], ax
add ecx, 2
movzx eax, word [edi]
test ax, ax
jne 0x448750
test esi, esi
je 0x448786
movzx eax, word [esi]
mov edx, eax
test ax, ax
je 0x448786
movzx eax, ax
lea esi, [esi + 2]
mov word [ecx], ax
add ecx, 2
movzx eax, word [esi]
test ax, ax
jne 0x448772
mov edi, dword [ebp - 0x45c]
xor eax, eax
mov word [ecx], ax
mov eax, dword [ebp - 0x478]
mov dword [ebp - 0x480], eax
mov eax, dword [ebp - 0x460]
mov dword [ebp - 0x484], edi
test eax, eax
je 0x4487b6
push eax
call fcn.00469dd3
add esp, 4
mov eax, dword [ebp - 0x48]
mov byte [ebp - 0x47c], 1
test eax, eax
je 0x4487d2
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x48], 0
push ecx
mov edx, 0xf003f
mov ecx, edi
call fcn.00409550
mov dword [ebp - 0x48], eax
test eax, eax
je 0x449518
lea ecx, [ebp - 0x9c]
mov dword [ebp - 0x6c], 0
push ecx
lea ecx, [ebp - 0x6c]
mov dword [ebp - 0x78], 0
push ecx
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x9c], 4
push ecx
push 0
push str.Status
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x449518
cmp dword [ebp - 0x78], 4
jne 0x449518
cmp dword [ebp - 0x6c], eax
je 0x449518
push dword [ebp - 0x46c]
mov ecx, dword [ebp - 0x454]
call fcn.00430380
mov ecx, dword [ebp - 0x454]
mov esi, eax
push 1
push dword [ebp - 0x340]
mov dword [ebp - 0x494], esi
push esi
call fcn.00430170
mov edx, dword [ebp - 0x464]
mov ecx, esi
test esi, esi
jne 0x448881
mov edi, dword [edx + 0x230]
mov dword [ebp - 0x460], edi
jmp 0x4488ba
cmp esi, 0xffffffff
jne 0x448889
mov ecx, dword [edx + 0x40]
mov eax, dword [edx + 0x3c]
test eax, eax
je 0x4488b0
cmp ecx, 1
jl 0x4488b0
cmp ecx, dword [edx + 0x40]
jg 0x4488b0
lea ecx, [ecx + ecx*8]
cmp dword [eax + ecx*8 + 0xc], 0
je 0x4488b0
mov edi, dword [eax + ecx*8 + 4]
mov dword [ebp - 0x460], edi
jmp 0x4488ba
mov dword [ebp - 0x460], 0
mov eax, dword [ebp - 0x454]
mov ecx, edx
push 0
push dword [ebp - 0x46c]
push dword [eax + 0x94]
call fcn.00419d90
mov esi, eax
mov eax, dword [ebp - 0x58]
test esi, esi
jne 0x448938
test eax, eax
je 0x4488eb
push eax
call fcn.00469dd3
add esp, 4
push 2
mov byte [ebp - 0x50], 0
mov dword [ebp - 0x54], 0
call fcn.0046a3df
mov ecx, eax
add esp, 4
mov eax, dword [ebp - 0x54]
xor edi, edi
mov dword [ebp - 0x58], ecx
test eax, eax
jle 0x44892a
xor edx, edx
xor esi, esi
mov ax, word [edx]
lea edx, [edx + 2]
mov word [ecx + esi], ax
lea esi, [esi + 2]
mov eax, dword [ebp - 0x54]
inc edi
mov ecx, dword [ebp - 0x58]
cmp edi, eax
jl 0x448912
xor edx, edx
mov word [ecx + eax*2], dx
mov eax, dword [ebp - 0x54]
mov esi, dword [ebp - 0x58]
jmp 0x44894d
test eax, eax
je 0x448945
push eax
call fcn.00469dd3
add esp, 4
xor eax, eax
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x54], eax
mov edi, dword [ebp - 0x20]
mov byte [ebp - 0x50], 1
mov dword [ebp - 0x458], str.__0
test edi, edi
jne 0x448980
push 2
call fcn.0046a3df
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov edi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x54]
mov esi, dword [ebp - 0x58]
mov dword [ebp - 0x1c], ecx
mov byte [ebp - 0x18], 1
mov byte [ebp - 0x50], 0
test eax, eax
jne 0x4489a0
test esi, esi
je 0x44899d
cmp word [esi], ax
je 0x44899d
inc eax
cmp word [esi + eax*2], 0
jne 0x448995
mov dword [ebp - 0x54], eax
xor ecx, ecx
inc ecx
cmp word [ecx*2 + str.__Disk], 0
jne 0x4489a2
mov esi, dword [ebp - 0x340]
add ecx, eax
test edi, edi
jne 0x4489c2
mov dword [ebp - 0x340], esi
jmp 0x4489da
xor eax, eax
cmp word [edi], ax
je 0x4489d8
mov dword [ebp - 0x340], esi
nop
inc eax
cmp word [edi + eax*2], 0
jne 0x4489d0
add ecx, eax
xor eax, eax
nop dword [eax]
inc eax
cmp word [eax*2 + str.__0], 0
jne 0x4489e0
add ecx, eax
mov dword [ebp - 0x470], ecx
lea eax, [ecx + 1]
mov ecx, 2
mul ecx
mov ecx, 0xffffffff
cmovb eax, ecx
push eax
call fcn.0046a3df
mov edx, dword [ebp - 0x58]
add esp, 4
mov dword [ebp - 0x49c], eax
mov ecx, eax
mov dword [ebp - 0x478], esi
test edx, edx
je 0x448a5a
movzx esi, word [edx]
mov eax, dword [ebp - 0x340]
mov dword [ebp - 0x478], eax
test si, si
je 0x448a5a
mov eax, esi
mov esi, dword [ebp - 0x340]
mov dword [ebp - 0x478], esi
movzx eax, ax
lea edx, [edx + 2]
mov word [ecx], ax
add ecx, 2
movzx eax, word [edx]
test ax, ax
jne 0x448a46
mov esi, str.__Disk
mov edx, 0x20
sub esi, ecx
mov word [ecx], dx
add ecx, 2
movzx eax, word [esi + ecx]
mov edx, eax
test ax, ax
jne 0x448a66
test edi, edi
je 0x448a99
movzx eax, word [edi]
mov edx, eax
test ax, ax
je 0x448a99
movzx eax, ax
lea edi, [edi + 2]
mov word [ecx], ax
add ecx, 2
movzx eax, word [edi]
test ax, ax
jne 0x448a85
mov edx, dword [ebp - 0x458]
mov eax, 0x29
movzx eax, ax
lea edx, [edx + 2]
mov word [ecx], ax
lea ecx, [ecx + 2]
movzx eax, word [edx]
test ax, ax
jne 0x448aa4
xor eax, eax
mov word [ecx], ax
mov eax, dword [ebp - 0x58]
test eax, eax
je 0x448acd
push eax
call fcn.00469dd3
add esp, 4
mov eax, dword [ebp - 0x49c]
sub esp, 0x14
mov ecx, dword [ebp - 0x470]
mov dword [ebp - 0x54], ecx
lea ecx, [ebp - 0x328]
mov dword [ebp - 0x58], eax
push eax
push dword [ebp - 0x478]
mov byte [ebp - 0x50], 1
push dword [ebp - 0x474]
call fcn.00419960
xor esi, esi
push esi
push esi
push 0x1004
push dword [ebp - 0x460]
mov dword [ebp - 0x340], esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x49c], eax
test eax, eax
jle 0x449518
mov ecx, dword [ebp - 0x464]
push 1
push esi
push dword [ebp - 0x494]
call fcn.00419d90
mov esi, eax
mov eax, dword [ebp - 0x2c]
test esi, esi
jne 0x448ba3
test eax, eax
je 0x448b51
push eax
call fcn.00469dd3
add esp, 4
push 2
mov byte [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
call fcn.0046a3df
mov ecx, eax
add esp, 4
mov eax, dword [ebp - 0x28]
xor edi, edi
mov dword [ebp - 0x2c], ecx
test eax, eax
jle 0x448b98
xor edx, edx
xor esi, esi
nop dword [eax + eax]
mov ax, word [edx]
lea edx, [edx + 2]
mov word [ecx + esi], ax
lea esi, [esi + 2]
mov eax, dword [ebp - 0x28]
inc edi
mov ecx, dword [ebp - 0x2c]
cmp edi, eax
jl 0x448b80
xor edx, edx
mov word [ecx + eax*2], dx
mov esi, dword [ebp - 0x2c]
jmp 0x448bba
test eax, eax
je 0x448bb0
push eax
call fcn.00469dd3
add esp, 4
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], 0
mov byte [ebp - 0x24], 1
cmp esi, str.Temperature
jne 0x448bd2
mov byte [ebp - 0x465], 1
jmp 0x448c58
test esi, esi
je 0x448c51
mov edi, str.Temperature
nop dword [eax + eax]
movzx eax, word [esi]
mov ecx, eax
test ax, ax
jne 0x448bfb
cmp word [edi], ax
jne 0x448c00
mov esi, dword [ebp - 0x2c]
mov byte [ebp - 0x465], 1
jmp 0x448c58
cmp ax, word [edi]
je 0x448c46
xor edx, edx
cmp dx, ax
jne 0x448c0f
mov dword [ebp - 0x458], edx
jmp 0x448c21
push ecx
call fcn.0046e306
movzx eax, ax
add esp, 4
mov dword [ebp - 0x458], eax
movzx eax, word [edi]
xor edx, edx
mov ecx, eax
cmp dx, ax
jne 0x448c31
xor eax, eax
jmp 0x448c3d
push ecx
call fcn.0046e306
add esp, 4
movzx eax, ax
cmp word [ebp - 0x458], ax
jne 0x448c4e
add esi, 2
add edi, 2
jmp 0x448be0
mov esi, dword [ebp - 0x2c]
mov byte [ebp - 0x465], 0
test esi, esi
jne 0x448c74
push 2
call fcn.0046a3df
add esp, 4
mov dword [ebp - 0x2c], eax
xor ecx, ecx
mov word [eax], cx
mov esi, dword [ebp - 0x2c]
mov dword [ebp - 0x28], ecx
mov eax, esi
mov byte [ebp - 0x24], 1
test eax, eax
mov ecx, 0x49eb08
mov eax, dword [ebp - 0x38]
cmovne ecx, esi
mov dword [ebp - 0x458], ecx
test eax, eax
je 0x448ca0
push eax
call fcn.00469dd3
mov ecx, dword [ebp - 0x458]
add esp, 4
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov byte [ebp - 0x30], 1
test eax, eax
je 0x448e2f
lea edx, [ebp - 0x5c]
mov dword [ebp - 0x68], 0
push edx
push 0
lea edx, [ebp - 0x68]
mov dword [ebp - 0x5c], 0
push edx
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x448e2f
mov eax, dword [ebp - 0x68]
cmp eax, 1
je 0x448cfd
cmp eax, 2
je 0x448cfd
cmp eax, 7
jne 0x448e2f
mov esi, dword [ebp - 0x5c]
mov ecx, 2
mov edi, dword [ebp - 0x38]
add esi, 4
mov dword [ebp - 0x5c], esi
shr esi, 1
mov dword [ebp - 0x34], 0
lea eax, [esi + 1]
mul ecx
mov ecx, 0xffffffff
cmovb eax, ecx
push eax
call fcn.0046a3df
xor ecx, ecx
mov dword [ebp - 0x38], eax
add esp, 4
mov word [eax + esi*2], cx
mov eax, dword [ebp - 0x38]
mov word [eax], cx
test edi, edi
je 0x448d49
push edi
call fcn.00469dd3
add esp, 4
mov eax, dword [ebp - 0x38]
lea ecx, [esi - 1]
test eax, eax
jne 0x448d6b
push 2
call fcn.0046a3df
add esp, 4
mov dword [ebp - 0x38], eax
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x34], ecx
xor edx, edx
mov word [eax + ecx*2], dx
lea ecx, [esi - 2]
mov eax, dword [ebp - 0x38]
test eax, eax
jne 0x448d93
push 2
call fcn.0046a3df
add esp, 4
mov dword [ebp - 0x38], eax
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x34], ecx
xor edx, edx
mov word [eax + ecx*2], dx
mov eax, dword [ebp - 0x38]
test eax, eax
jne 0x448db8
push 2
call fcn.0046a3df
add esp, 4
mov dword [ebp - 0x38], eax
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x5c]
mov byte [ebp - 0x30], 1
push ecx
push eax
push 0
push 0
push dword [ebp - 0x458]
push dword [ebp - 0x48]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x448e2f
cmp dword [ebp - 0x68], 7
jne 0x448e3c
cmp esi, 3
jbe 0x448e3c
mov ecx, dword [ebp - 0x38]
test ecx, ecx
jne 0x448e02
push 2
call fcn.0046a3df
add esp, 4
mov dword [ebp - 0x38], eax
xor ecx, ecx
mov word [eax], cx
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x38]
xor eax, eax
mov byte [ebp - 0x30], 1
add esi, 0xffffffff
je 0x448e3c
nop dword [eax]
xor edx, edx
cmp dx, word [ecx + eax*2]
jne 0x448e28
cmp word [ecx + eax*2 + 2], dx
je 0x448e28
mov edx, 0xa
mov word [ecx + eax*2], dx
inc eax
cmp eax, esi
jb 0x448e10
jmp 0x448e3c
cmp byte [ebp - 0x465], 0
je 0x4494ff
mov ecx, dword [ebp - 0x464]
push 2
push dword [ebp - 0x340]
push dword [ebp - 0x494]
call fcn.00419d90
mov esi, eax
mov eax, dword [ebp - 0x44]
test esi, esi
jne 0x448eb5
test eax, eax
je 0x448e6b
push eax
call fcn.00469dd3
add esp, 4
push 2
mov byte [ebp - 0x3c], 0
mov dword [ebp - 0x40], 0
call fcn.0046a3df
mov ecx, eax
add esp, 4
mov eax, dword [ebp - 0x40]
xor edi, edi
mov dword [ebp - 0x44], ecx
test eax, eax
jle 0x448eaa
xor edx, edx
xor esi, esi
mov ax, word [edx]
lea edx, [edx + 2]
mov word [ecx + esi], ax
lea esi, [esi + 2]
mov eax, dword [ebp - 0x40]
inc edi
mov ecx, dword [ebp - 0x44]
cmp edi, eax
jl 0x448e92
xor edx, edx
mov word [ecx + eax*2], dx
mov esi, dword [ebp - 0x44]
jmp 0x448ecc
test eax, eax
je 0x448ec2
push eax
call fcn.00469dd3
add esp, 4
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x40], 0
cmp byte [ebp - 0x465], 0
mov byte [ebp - 0x3c], 1
jne 0x448f98
mov edi, dword [ebp - 0x38]
test edi, edi
jne 0x448eff
push 2
call fcn.0046a3df
add esp, 4
mov dword [ebp - 0x38], eax
xor ecx, ecx
mov word [eax], cx
mov esi, dword [ebp - 0x44]
mov edi, dword [ebp - 0x38]
mov dword [ebp - 0x34], ecx
mov byte [ebp - 0x30], 1
cmp esi, edi
je 0x4494ff
test esi, esi
je 0x448f85
test edi, edi
je 0x4494ff
movzx eax, word [esi]
mov ecx, eax
test ax, ax
jne 0x448f2c
cmp word [edi], ax
je 0x4494ff
jmp 0x448f31
cmp ax, word [edi]
je 0x448f77
xor edx, edx
cmp dx, ax
jne 0x448f40
mov dword [ebp - 0x458], edx
jmp 0x448f52
push ecx
call fcn.0046e306
movzx eax, ax
add esp, 4
mov dword [ebp - 0x458], eax
movzx eax, word [edi]
xor edx, edx
mov ecx, eax
cmp dx, ax
jne 0x448f62
xor eax, eax
jmp 0x448f6e
push ecx
call fcn.0046e306
add esp, 4
movzx eax, ax
cmp word [ebp - 0x458], ax
jne 0x448f7f
add esi, 2
add edi, 2
jmp 0x448f17
mov esi, dword [ebp - 0x44]
mov edi, dword [ebp - 0x38]
test edi, edi
je 0x4494ff
cmp word [edi], 0
jne 0x448fdf
jmp 0x4494ff
test esi, esi
je 0x4494fb
cmp dword [ebp - 0x40], 0
jne 0x448fbd
xor eax, eax
cmp word [esi], ax
je 0x448fb8
nop dword [eax]
inc eax
cmp word [esi + eax*2], 0
jne 0x448fb0
mov dword [ebp - 0x40], eax
test eax, eax
jle 0x4494fb
push esi
mov byte [ebp - 0x3c], 1
call fcn.0046e166
add esp, 4
cmp eax, 0x37
jl 0x4494ff
mov esi, dword [ebp - 0x44]
mov edi, dword [ebp - 0x38]
cmp dword [ebp - 0x6c], 1
jbe 0x449289
cmp esi, str.True
je 0x449289
test esi, esi
je 0x44906e
mov edi, str.True
nop
movzx eax, word [esi]
mov ecx, eax
test ax, ax
jne 0x449015
cmp word [edi], ax
je 0x449289
jmp 0x44901a
cmp ax, word [edi]
je 0x449060
xor edx, edx
cmp dx, ax
jne 0x449029
mov dword [ebp - 0x458], edx
jmp 0x44903b
push ecx
call fcn.0046e306
movzx eax, ax
add esp, 4
mov dword [ebp - 0x458], eax
movzx eax, word [edi]
xor edx, edx
mov ecx, eax
cmp dx, ax
jne 0x44904b
xor eax, eax
jmp 0x449057
push ecx
call fcn.0046e306
add esp, 4
movzx eax, ax
cmp word [ebp - 0x458], ax
jne 0x449068
add esi, 2
add edi, 2
jmp 0x449000
mov esi, dword [ebp - 0x44]
mov edi, dword [ebp - 0x38]
cmp esi, str.False
je 0x449289
test esi, esi
je 0x4490f1
mov edi, str.False
movzx eax, word [esi]
mov ecx, eax
test ax, ax
jne 0x449098
cmp word [edi], ax
je 0x449289
jmp 0x44909d
cmp ax, word [edi]
je 0x4490e3
xor edx, edx
cmp dx, ax
jne 0x4490ac
mov dword [ebp - 0x458], edx
jmp 0x4490be
push ecx
call fcn.0046e306
movzx eax, ax
add esp, 4
mov dword [ebp - 0x458], eax
movzx eax, word [edi]
xor edx, edx
mov ecx, eax
cmp dx, ax
jne 0x4490ce
xor eax, eax
jmp 0x4490da
push ecx
call fcn.0046e306
add esp, 4
movzx eax, ax
cmp word [ebp - 0x458], ax
jne 0x4490eb
add esi, 2
add edi, 2
jmp 0x449083
mov esi, dword [ebp - 0x44]
mov edi, dword [ebp - 0x38]
cmp esi, 0x49f3e0
je 0x449289
test esi, esi
je 0x449174
mov edi, 0x49f3e0
movzx eax, word [esi]
mov ecx, eax
test ax, ax
jne 0x44911b
cmp word [edi], ax
je 0x449289
jmp 0x449120
cmp ax, word [edi]
je 0x449166
xor edx, edx
cmp dx, ax
jne 0x44912f
mov dword [ebp - 0x458], edx
jmp 0x449141
push ecx
call fcn.0046e306
movzx eax, ax
add esp, 4
mov dword [ebp - 0x458], eax
movzx eax, word [edi]
xor edx, edx
mov ecx, eax
cmp dx, ax
jne 0x449151
xor eax, eax
jmp 0x44915d
push ecx
call fcn.0046e306
add esp, 4
movzx eax, ax
cmp word [ebp - 0x458], ax
jne 0x44916e
add esi, 2
add edi, 2
jmp 0x449106
mov esi, dword [ebp - 0x44]
mov edi, dword [ebp - 0x38]
cmp esi, 0x49f3e8
je 0x449289
test esi, esi
je 0x449233
mov edi, 0x49f3e8
nop dword [eax]
movzx eax, word [esi]
mov ecx, eax
test ax, ax
jne 0x4491a5
cmp word [edi], ax
je 0x449289
jmp 0x4491aa
cmp ax, word [edi]
je 0x4491f0
xor edx, edx
cmp dx, ax
jne 0x4491b9
mov dword [ebp - 0x458], edx
jmp 0x4491cb
push ecx
call fcn.0046e306
movzx eax, ax
add esp, 4
mov dword [ebp - 0x458], eax
movzx eax, word [edi]
xor edx, edx
mov ecx, eax
cmp dx, ax
jne 0x4491db
xor eax, eax
jmp 0x4491e7
push ecx
call fcn.0046e306
add esp, 4
movzx eax, ax
cmp word [ebp - 0x458], ax
jne 0x4491f8
add esi, 2
add edi, 2
jmp 0x449190
mov esi, dword [ebp - 0x44]
mov edi, dword [ebp - 0x38]
test esi, esi
je 0x449233
cmp dword [ebp - 0x40], 0
jne 0x44921d
xor eax, eax
cmp word [esi], ax
je 0x449218
nop
inc eax
cmp word [esi + eax*2], 0
jne 0x449210
mov dword [ebp - 0x40], eax
test eax, eax
jle 0x449233
push esi
mov byte [ebp - 0x3c], 1
call fcn.0046e166
mov edi, dword [ebp - 0x38]
add esp, 4
mov esi, eax
jmp 0x449239
mov byte [ebp - 0x3c], 0
xor esi, esi
test edi, edi
je 0x449270
cmp dword [ebp - 0x34], 0
jne 0x44925d
xor eax, eax
cmp word [edi], ax
je 0x449258
nop word [eax + eax]
inc eax
cmp word [edi + eax*2], 0
jne 0x449250
mov dword [ebp - 0x34], eax
test eax, eax
jle 0x449270
push edi
mov byte [ebp - 0x30], 1
call fcn.0046e166
add esp, 4
mov ecx, eax
jmp 0x449276
mov byte [ebp - 0x30], 0
xor ecx, ecx
mov eax, esi
sub eax, ecx
jns 0x449280
mov eax, ecx
sub eax, esi
cmp eax, 5
jl 0x4494ff
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x4492a8
push 2
call fcn.0046a3df
add esp, 4
mov dword [ebp - 0x2c], eax
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], ecx
push ecx
push dword [ebp - 0x474]
lea ecx, [ebp - 0x328]
mov byte [ebp - 0x24], 1
push 0
push dword [ebp - 0x478]
push 0xffffffffffffffff
push 0
push eax
call fcn.00419a20
mov esi, dword [ebp - 0x44]
mov edi, eax
mov dword [ebp - 0x470], edi
test esi, esi
jne 0x4492f2
push 2
call fcn.0046a3df
add esp, 4
mov dword [ebp - 0x44], eax
xor ecx, ecx
mov word [eax], cx
mov esi, dword [ebp - 0x44]
mov dword [ebp - 0x40], ecx
mov ecx, dword [ebp - 0x474]
cmp ecx, 0xffffffff
mov edx, dword [ebp - 0x2e8]
mov eax, dword [ebp - 0x2ec]
cmove ecx, edx
mov byte [ebp - 0x3c], 1
test eax, eax
je 0x44935e
cmp ecx, 1
jl 0x44935e
cmp ecx, edx
jg 0x44935e
lea ecx, [ecx + ecx*8]
cmp dword [eax + ecx*8 + 0xc], 0
je 0x44935e
cmp dword [eax + ecx*8], 0xf
jne 0x44935e
lea edx, [ebp - 0x39c]
mov dword [ebp - 0x394], 1
push edx
push edi
push 0x1074
mov dword [ebp - 0x388], esi
push dword [eax + ecx*8 + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [ebp - 0x2e8]
mov eax, dword [ebp - 0x2ec]
mov esi, dword [ebp - 0x38]
test esi, esi
jne 0x449389
push 2
call fcn.0046a3df
add esp, 4
mov dword [ebp - 0x38], eax
xor ecx, ecx
mov word [eax], cx
mov edx, dword [ebp - 0x2e8]
mov eax, dword [ebp - 0x2ec]
mov esi, dword [ebp - 0x38]
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x474]
cmp ecx, 0xffffffff
mov byte [ebp - 0x30], 1
cmove ecx, edx
test eax, eax
je 0x4493dd
cmp ecx, 1
jl 0x4493dd
cmp ecx, edx
jg 0x4493dd
lea ecx, [ecx + ecx*8]
cmp dword [eax + ecx*8 + 0xc], 0
je 0x4493dd
cmp dword [eax + ecx*8], 0xf
jne 0x4493dd
lea edx, [ebp - 0x3d8]
mov dword [ebp - 0x3d0], 2
push edx
push edi
push 0x1074
mov dword [ebp - 0x3c4], esi
push dword [eax + ecx*8 + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0x464]
push 4
push dword [ebp - 0x340]
push dword [ebp - 0x494]
call fcn.00419d90
mov esi, eax
mov eax, dword [ebp - 0x20]
test esi, esi
jne 0x44945c
test eax, eax
je 0x44940c
push eax
call fcn.00469dd3
add esp, 4
push 2
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
call fcn.0046a3df
mov ecx, eax
add esp, 4
mov eax, dword [ebp - 0x1c]
xor edi, edi
mov dword [ebp - 0x20], ecx
test eax, eax
jle 0x44944b
xor edx, edx
xor esi, esi
mov ax, word [edx]
lea edx, [edx + 2]
mov word [ecx + esi], ax
lea esi, [esi + 2]
mov eax, dword [ebp - 0x1c]
inc edi
mov ecx, dword [ebp - 0x20]
cmp edi, eax
jl 0x449433
mov edi, dword [ebp - 0x470]
xor edx, edx
mov word [ecx + eax*2], dx
mov esi, dword [ebp - 0x20]
jmp 0x449473
test eax, eax
je 0x449469
push eax
call fcn.00469dd3
add esp, 4
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x18], 1
test esi, esi
jne 0x449493
push 2
call fcn.0046a3df
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov esi, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x474]
cmp eax, 0xffffffff
mov edx, dword [ebp - 0x2e8]
mov ecx, dword [ebp - 0x2ec]
cmove eax, edx
mov byte [ebp - 0x18], 1
test ecx, ecx
je 0x4494f3
cmp eax, 1
jl 0x4494f3
cmp eax, edx
jg 0x4494f3
lea eax, [eax + eax*8]
cmp dword [ecx + eax*8 + 0xc], 0
je 0x4494f3
cmp dword [ecx + eax*8], 0xf
jne 0x4494f3
lea edx, [ebp - 0x414]
mov dword [ebp - 0x40c], 3
push edx
push edi
push 0x1074
mov dword [ebp - 0x400], esi
push dword [ecx + eax*8 + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
inc dword [ebp - 0x4b0]
jmp 0x4494ff
mov byte [ebp - 0x3c], 0
mov esi, dword [ebp - 0x340]
inc esi
mov dword [ebp - 0x340], esi
cmp esi, dword [ebp - 0x49c]
jl 0x448b27
mov edi, dword [ebp - 0x454]
mov esi, dword [ebp - 0x46c]
mov eax, dword [ebp - 0x464]
inc esi
mov dword [ebp - 0x46c], esi
cmp esi, dword [ebp - 0x33c]
jl 0x4484e0
mov edx, dword [ebp - 0x4b0]
jmp 0x449547
xor edx, edx
test dword [ebp - 0x498], 2
mov esi, dword [ebp - 0x454]
jne 0x4495b1
test edx, edx
jne 0x4495b1
push edx
push 0x20
push 0x20
push 1
push 1
push dword [esi + 0x3c0]
call dword [sym.imp.USER32.dll_LoadImageW]
mov esi, eax
mov dword [ebp - 0x33c], esi
test byte [ebp - 0x498], 1
mov byte [ebp - 4], 0xc
je 0x44959f
mov eax, dword [ebp - 0x454]
push esi
sub esp, 0xc
lea ecx, [eax + 0x150]
push dword [eax + 8]
call fcn.0041af90
test esi, esi
je 0x4495aa
push esi
call dword [sym.imp.USER32.dll_DestroyIcon]
xor esi, esi
jmp 0x44b5d2
push 0x10021
push 0x80000d
push 0x1d1
push 0x2ee
push 0x2d
push 0
push 0x49edcc
push str.Date_and_timeAttribute_nameNew_valuePrevious_valueAttribute_description
lea ecx, [ebp - 0x328]
mov dword [ebp - 0x138], 0x433
call fcn.004156d0
mov esi, dword [ebp - 0x2e8]
mov edi, eax
mov edx, dword [ebp - 0x2ec]
cmp edi, 0xffffffff
mov ecx, edi
mov dword [ebp - 0x478], edi
cmove ecx, esi
test edx, edx
je 0x449634
cmp ecx, 1
jl 0x449634
cmp ecx, esi
jg 0x449634
lea eax, [ecx + ecx*8]
cmp dword [edx + eax*8 + 0xc], 0
je 0x449634
cmp dword [edx + eax*8], 0xf
jne 0x449634
push 0
push 1
push 0x109d
push dword [edx + eax*8 + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x454]
push 0
push 0x10
push 0x10
push ecx
push 0x6a
push dword [eax + 0x3c0]
call fcn.0041b150
mov esi, eax
mov dword [ebp - 0x33c], esi
mov dword [ebp - 0x350], 0
test esi, esi
je 0x44967d
push 0
lea eax, [ebp - 0x350]
push eax
push dword [esi + 4]
call dword [sym.imp.gdiplus.dll_GdipCreateHBITMAPFromBitmap]
test eax, eax
je 0x44967d
mov dword [esi + 8], eax
push 0x10
push 0x10
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x328]
push dword [ebp - 0x350]
push 1
push edi
call fcn.004174a0
mov eax, dword [ebp - 0x350]
test eax, eax
je 0x4496aa
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov byte [ebp - 4], 0xb
test esi, esi
je 0x4496bc
mov eax, dword [esi]
mov ecx, esi
push 1
mov eax, dword [eax]
call eax
test edi, edi
jne 0x4496c8
mov esi, dword [ebp - 0xf8]
jmp 0x4496fb
mov edx, dword [ebp - 0x2e8]
cmp edi, 0xffffffff
mov ecx, dword [ebp - 0x2ec]
mov eax, edi
cmove eax, edx
test ecx, ecx
je 0x4496f9
cmp eax, 1
jl 0x4496f9
cmp eax, edx
jg 0x4496f9
lea eax, [eax + eax*8]
cmp dword [ecx + eax*8 + 0xc], 0
je 0x4496f9
mov esi, dword [ecx + eax*8 + 4]
jmp 0x4496fb
xor esi, esi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0xc8
push 0
push 0x101e
push esi
mov dword [ebp - 0x458], esi
call edi
push 0xc8
push 1
push 0x101e
push esi
call edi
push 0x64
push 2
push 0x101e
push esi
call edi
push 0x64
push 3
push 0x101e
push esi
call edi
push 0x1f4
push 4
push 0x101e
push esi
call edi
mov eax, dword [ebp - 0x45c]
mov esi, str.MonitoringHistory
mov dword [ebp - 0x470], eax
xor ecx, ecx
mov dword [ebp - 0x484], 0
mov byte [ebp - 0x47c], 0
mov dword [ebp - 0x480], 0
nop word [eax + eax]
inc ecx
cmp word [ecx*2 + str.HKCUSoftwareClearDiskInfo], 0
jne 0x449780
xor eax, eax
nop
inc eax
cmp word [eax*2 + str.MonitoringHistory], 0
jne 0x449790
add eax, ecx
mov ecx, 2
mov dword [ebp - 0x33c], eax
inc eax
mul ecx
mov ecx, 0xffffffff
cmovb eax, ecx
push eax
call fcn.0046a3df
mov edi, str.HKCUSoftwareClearDiskInfo
mov dword [ebp - 0x45c], eax
add esp, 4
mov ecx, eax
mov edx, 0x48
sub edi, eax
mov word [ecx], dx
add ecx, 2
movzx eax, word [edi + ecx]
mov edx, eax
test ax, ax
jne 0x4497d1
mov eax, 0x5c
movzx eax, ax
lea esi, [esi + 2]
mov word [ecx], ax
lea ecx, [ecx + 2]
movzx eax, word [esi]
test ax, ax
jne 0x4497e7
xor eax, eax
mov byte [ebp - 0x47c], 1
mov word [ecx], ax
mov eax, dword [ebp - 0x45c]
mov dword [ebp - 0x484], eax
mov eax, dword [ebp - 0x33c]
mov dword [ebp - 0x480], eax
mov eax, dword [ebp - 0x470]
test eax, eax
je 0x449832
push eax
call fcn.00469dd3
add esp, 4
xorps xmm0, xmm0
mov dword [ebp - 0x358], 0
push 0x8020
movq qword [ebp - 0x360], xmm0
call fcn.0046a3df
add esp, 4
mov esi, eax
mov dword [ebp - 0x494], esi
push 0x8020
push 0
push esi
call fcn.0046ba40
add esp, 0xc
mov dword [ebp - 0x360], esi
mov dword [ebp - 0x35c], 0xffffffff
mov dword [ebp - 0x358], 0
mov byte [ebp - 4], 0x10
xorps xmm0, xmm0
push 0x8020
movq qword [ebp - 0x34c], xmm0
mov dword [ebp - 0x344], 0
call fcn.0046a3df
add esp, 4
mov esi, eax
push 0x8020
push 0
push esi
call fcn.0046ba40
add esp, 0xc
mov dword [ebp - 0x34c], esi
mov dword [ebp - 0x348], 0xffffffff
mov dword [ebp - 0x344], 0
xorps xmm0, xmm0
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x90]
movq qword [ebp - 0x80], xmm0
movups xmmword [ebp - 0x90], xmm0
call fcn.00407610
push 0
lea eax, [ebp - 0xb4]
push eax
lea eax, [ebp - 0xb0]
push eax
push 8
push 0xffffffffffffffff
push str.:d3
call fcn.00464700
mov edi, eax
add esp, 0x18
mov dword [ebp - 0x340], edi
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x48]
mov byte [ebp - 0x47c], 1
test ecx, ecx
je 0x44993f
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x48], 0
mov esi, dword [ebp - 0x45c]
mov edx, 0x20019
push ecx
mov ecx, esi
call fcn.00409550
mov dword [ebp - 0x48], eax
test eax, eax
je 0x44a1a9
xor ecx, ecx
mov dword [ebp - 0x46c], ecx
test eax, eax
je 0x44a1a9
mov eax, dword [ebp - 0x494]
xor edx, edx
push edx
push edx
push edx
push edx
mov dword [ebp - 0x98], 0x4010
mov word [eax], dx
mov dword [ebp - 0x358], edx
lea edx, [ebp - 0x98]
push edx
push eax
push ecx
push dword [ebp - 0x48]
mov dword [ebp - 0x35c], 0xffffffff
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x44a1a9
mov edx, dword [ebp - 0x494]
cmp word [edx], ax
je 0x44a1a9
mov dword [ebp - 0x49c], esi
xor ecx, ecx
mov dword [ebp - 0x35c], 0xfffffffe
mov esi, str.MonitoringHistory_
mov dword [ebp - 0x484], eax
mov dword [ebp - 0x33c], edx
mov byte [ebp - 0x47c], al
mov dword [ebp - 0x480], eax
nop
inc ecx
cmp word [ecx*2 + str.HKCUSoftwareClearDiskInfo], 0
jne 0x4499f0
xor eax, eax
nop
inc eax
cmp word [eax*2 + str.MonitoringHistory_], 0
jne 0x449a00
add ecx, eax
xor eax, eax
cmp word [edx], ax
je 0x449a1d
inc eax
cmp word [edx + eax*2], 0
jne 0x449a15
add ecx, eax
mov dword [ebp - 0x470], ecx
lea eax, [ecx + 1]
mov ecx, 2
mul ecx
mov ecx, 0xffffffff
cmovb eax, ecx
push eax
call fcn.0046a3df
mov edi, str.HKCUSoftwareClearDiskInfo
mov dword [ebp - 0x45c], eax
add esp, 4
mov ecx, eax
mov edx, 0x48
sub edi, eax
mov word [ecx], dx
add ecx, 2
movzx eax, word [edi + ecx]
mov edx, eax
test ax, ax
jne 0x449a54
mov edi, dword [ebp - 0x340]
mov eax, 0x5c
movzx eax, ax
lea esi, [esi + 2]
mov word [ecx], ax
add ecx, 2
movzx eax, word [esi]
test ax, ax
jne 0x449a70
mov eax, dword [ebp - 0x494]
movzx eax, word [eax]
mov edx, eax
test ax, ax
je 0x449ab4
mov edx, dword [ebp - 0x33c]
nop word [eax + eax]
movzx eax, ax
lea edx, [edx + 2]
mov word [ecx], ax
add ecx, 2
movzx eax, word [edx]
test ax, ax
jne 0x449aa0
mov esi, dword [ebp - 0x45c]
xor eax, eax
mov word [ecx], ax
mov eax, dword [ebp - 0x470]
mov dword [ebp - 0x480], eax
mov eax, dword [ebp - 0x49c]
mov dword [ebp - 0x484], esi
test eax, eax
je 0x449ae4
push eax
call fcn.00469dd3
add esp, 4
mov eax, dword [ebp - 0x4c]
mov byte [ebp - 0x47c], 1
test eax, eax
je 0x449b00
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x4c], 0
push ecx
mov edx, 0x20019
mov ecx, esi
call fcn.00409550
mov dword [ebp - 0x4c], eax
test eax, eax
je 0x44a19a
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x449b2b
push ecx
call fcn.00469dd3
mov eax, dword [ebp - 0x4c]
add esp, 4
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x18], 1
test eax, eax
je 0x44a19a
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x70], 0
push ecx
push 0
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x60], 0
push ecx
push 0
push str.Model
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44a19a
mov eax, dword [ebp - 0x70]
cmp eax, 1
je 0x449b89
cmp eax, 2
je 0x449b89
cmp eax, 7
jne 0x44a19a
mov esi, dword [ebp - 0x60]
mov ecx, 2
mov eax, dword [ebp - 0x20]
add esi, 4
mov dword [ebp - 0x60], esi
shr esi, 1
mov dword [ebp - 0x33c], eax
mov dword [ebp - 0x1c], 0
lea eax, [esi + 1]
mul ecx
mov ecx, 0xffffffff
cmovb eax, ecx
push eax
call fcn.0046a3df
mov dword [ebp - 0x20], eax
xor ecx, ecx
add esp, 4
mov word [eax + esi*2], cx
mov eax, dword [ebp - 0x20]
mov word [eax], cx
mov eax, dword [ebp - 0x33c]
test eax, eax
je 0x449be1
push eax
call fcn.00469dd3
add esp, 4
mov eax, dword [ebp - 0x20]
lea ecx, [esi - 1]
test eax, eax
jne 0x449c03
push 2
call fcn.0046a3df
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
xor edx, edx
mov word [eax + ecx*2], dx
lea ecx, [esi - 2]
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x449c2b
push 2
call fcn.0046a3df
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
xor edx, edx
mov word [eax + ecx*2], dx
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x449c50
push 2
call fcn.0046a3df
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x60]
mov byte [ebp - 0x18], 1
push ecx
push eax
push 0
push 0
push str.Model
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44a194
cmp dword [ebp - 0x70], 7
jne 0x449cce
cmp esi, 3
jbe 0x449cce
cmp dword [ebp - 0x20], eax
jne 0x449c98
push 2
call fcn.0046a3df
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x20]
xor eax, eax
mov byte [ebp - 0x18], 1
add esi, 0xffffffff
je 0x449cce
lea edi, [eax + 0xa]
nop dword [eax]
xor edx, edx
cmp dx, word [ecx + eax*2]
jne 0x449cc3
cmp word [ecx + eax*2 + 2], dx
je 0x449cc3
mov word [ecx + eax*2], di
inc eax
cmp eax, esi
jb 0x449cb0
mov edi, dword [ebp - 0x340]
cmp dword [ebp - 0x20], 0
jne 0x449ce9
push 2
call fcn.0046a3df
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov dword [ebp - 0x1c], ecx
sub esp, 0x14
mov byte [ebp - 0x18], 1
lea ecx, [ebp - 0x328]
push dword [ebp - 0x20]
push dword [ebp - 0x46c]
push dword [ebp - 0x478]
call fcn.00419960
xor ecx, ecx
cmp dword [ebp - 0x4c], 0
mov dword [ebp - 0x464], ecx
je 0x44a194
mov eax, dword [ebp - 0x34c]
xor edx, edx
mov dword [ebp - 0x94], 0x4010
mov word [eax], dx
lea eax, [ebp - 0x344]
push eax
push edx
lea eax, [ebp - 0x348]
mov dword [ebp - 0x348], 0xffffffff
push eax
push edx
lea eax, [ebp - 0x94]
mov dword [ebp - 0x344], edx
push eax
push dword [ebp - 0x34c]
push ecx
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x44a18a
mov eax, dword [ebp - 0x34c]
cmp eax, str.Model
je 0x44a17e
test eax, eax
je 0x449dd3
mov ecx, str.Model
sub eax, ecx
mov dword [ebp - 0x470], eax
movzx esi, word [eax + ecx]
mov eax, esi
mov dword [ebp - 0x33c], eax
test si, si
jne 0x449db1
cmp word [ecx], si
je 0x44a17e
movzx edx, word [ecx]
jmp 0x449dc1
movzx eax, word [ecx]
mov edx, eax
cmp si, ax
je 0x449dc8
mov eax, dword [ebp - 0x33c]
cmp ax, dx
jb 0x449dd3
ja 0x449dd3
mov eax, dword [ebp - 0x470]
add ecx, 2
jmp 0x449d92
mov eax, dword [ebp - 0x34c]
mov ecx, 0x49eb08
test eax, eax
cmovne ecx, eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x460], ecx
test eax, eax
je 0x449dff
push eax
call fcn.00469dd3
mov ecx, dword [ebp - 0x460]
add esp, 4
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x18], 1
test eax, eax
je 0x44a17e
lea edx, [ebp - 0x64]
mov dword [ebp - 0x74], 0
push edx
push 0
lea edx, [ebp - 0x74]
mov dword [ebp - 0x64], 0
push edx
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44a17e
mov eax, dword [ebp - 0x74]
cmp eax, 1
je 0x449e5c
cmp eax, 2
je 0x449e5c
cmp eax, 7
jne 0x44a17e
mov esi, dword [ebp - 0x64]
mov ecx, 2
mov eax, dword [ebp - 0x20]
add esi, 4
mov dword [ebp - 0x64], esi
shr esi, 1
mov dword [ebp - 0x33c], eax
mov dword [ebp - 0x1c], 0
lea eax, [esi + 1]
mul ecx
mov ecx, 0xffffffff
cmovb eax, ecx
push eax
call fcn.0046a3df
mov dword [ebp - 0x20], eax
xor ecx, ecx
add esp, 4
mov word [eax + esi*2], cx
mov eax, dword [ebp - 0x20]
mov word [eax], cx
mov eax, dword [ebp - 0x33c]
test eax, eax
je 0x449eb4
push eax
call fcn.00469dd3
add esp, 4
mov eax, dword [ebp - 0x20]
lea ecx, [esi - 1]
test eax, eax
jne 0x449ed6
push 2
call fcn.0046a3df
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
xor edx, edx
mov word [eax + ecx*2], dx
lea ecx, [esi - 2]
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x449efe
push 2
call fcn.0046a3df
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
xor edx, edx
mov word [eax + ecx*2], dx
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x449f23
push 2
call fcn.0046a3df
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x64]
mov byte [ebp - 0x18], 1
push ecx
push eax
push 0
push 0
push dword [ebp - 0x460]
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44a17e
cmp dword [ebp - 0x74], 7
jne 0x449f9e
cmp esi, 3
jbe 0x449f9e
cmp dword [ebp - 0x20], eax
jne 0x449f6c
push 2
call fcn.0046a3df
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x20]
xor eax, eax
mov byte [ebp - 0x18], 1
add esi, 0xffffffff
je 0x449f9e
lea edi, [eax + 0xa]
nop dword [eax]
xor edx, edx
cmp dx, word [ecx + eax*2]
jne 0x449f93
cmp word [ecx + eax*2 + 2], dx
je 0x449f93
mov word [ecx + eax*2], di
inc eax
cmp eax, esi
jb 0x449f80
mov edi, dword [ebp - 0x340]
cmp dword [ebp - 0x20], 0
jne 0x449fb9
push 2
call fcn.0046a3df
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov dword [ebp - 0x1c], ecx
push 1
push 0x49ed98
push dword [ebp - 0x20]
lea ecx, [ebp - 0x90]
mov byte [ebp - 0x18], 1
call fcn.00407700
cmp dword [ebp - 0x90], 3
jb 0x44a17e
mov eax, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x34c]
test eax, eax
je 0x449ff5
push eax
call fcn.00469dd3
add esp, 4
xor eax, eax
mov byte [ebp - 0x24], 0
test esi, esi
je 0x44a00c
cmp word [esi], ax
je 0x44a00c
inc eax
cmp word [esi + eax*2], 0
jne 0x44a004
mov dword [ebp - 0x28], eax
mov ecx, 2
inc eax
mul ecx
mov ecx, 0xffffffff
cmovb eax, ecx
push eax
call fcn.0046a3df
mov edx, eax
add esp, 4
mov eax, dword [ebp - 0x28]
xor ecx, ecx
mov dword [ebp - 0x2c], edx
test eax, eax
jle 0x44a049
mov ax, word [esi + ecx*2]
mov word [edx + ecx*2], ax
inc ecx
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x2c]
cmp ecx, eax
jl 0x44a036
xor ecx, ecx
push ecx
mov word [edx + eax*2], cx
lea ecx, [ebp - 0x2c]
push 0x49edcc
push edi
mov byte [ebp - 0x24], 1
call fcn.00407400
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x44a081
push 2
call fcn.0046a3df
add esp, 4
mov dword [ebp - 0x2c], eax
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], ecx
push ecx
push dword [ebp - 0x478]
lea ecx, [ebp - 0x328]
mov byte [ebp - 0x24], 1
push 0
push dword [ebp - 0x46c]
push 0xffffffffffffffff
push 0x49edcc
push eax
call fcn.00419a20
mov ecx, dword [ebp - 0x90]
xor esi, esi
mov edi, dword [ebp - 0x88]
mov dword [ebp - 0x33c], eax
nop dword [eax + eax]
test ecx, ecx
jne 0x44a0cc
mov dword [ebp - 0x460], ecx
jmp 0x44a0ee
cmp esi, ecx
jb 0x44a0e5
lea eax, [ecx - 1]
cmp ecx, eax
ja 0x44a0e0
lea ecx, [eax + 1]
mov dword [ebp - 0x90], ecx
mov eax, dword [edi + eax*4]
jmp 0x44a0e8
mov eax, dword [edi + esi*4]
mov dword [ebp - 0x460], eax
mov eax, dword [ebp - 0x478]
cmp eax, 0xffffffff
mov edx, dword [ebp - 0x2ec]
cmove eax, dword [ebp - 0x2e8]
test edx, edx
je 0x44a16e
cmp eax, 1
jl 0x44a16e
cmp eax, dword [ebp - 0x2e8]
jg 0x44a16e
lea eax, [eax + eax*8]
cmp dword [edx + eax*8 + 0xc], 0
mov dword [ebp - 0x470], eax
je 0x44a16e
cmp dword [edx + eax*8], 0xf
jne 0x44a16e
lea eax, [esi + 2]
mov dword [ebp - 0x448], eax
mov eax, dword [ebp - 0x460]
mov dword [ebp - 0x43c], eax
lea eax, [ebp - 0x450]
push eax
push dword [ebp - 0x33c]
mov eax, dword [ebp - 0x470]
push 0x1074
push dword [edx + eax*8 + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0x90]
mov edi, dword [ebp - 0x88]
inc esi
cmp esi, 3
jl 0x44a0c0
mov edi, dword [ebp - 0x340]
mov ecx, dword [ebp - 0x464]
inc ecx
jmp 0x449d0c
mov dword [ebp - 0x348], 0xffffffff
mov esi, dword [ebp - 0x45c]
mov ecx, dword [ebp - 0x46c]
mov eax, dword [ebp - 0x48]
inc ecx
jmp 0x44995f
mov esi, dword [ebp - 0x478]
mov ecx, esi
mov eax, dword [ebp - 0x2e8]
cmp esi, 0xffffffff
mov edx, dword [ebp - 0x2ec]
cmove ecx, eax
test edx, edx
je 0x44a1f3
cmp ecx, 1
jl 0x44a1f3
cmp ecx, eax
jg 0x44a1f3
lea eax, [ecx + ecx*8]
cmp dword [edx + eax*8 + 0xc], 0
je 0x44a1f3
cmp dword [edx + eax*8], 0xf
jne 0x44a1f3
push 0
push 1
push 0x109d
push dword [edx + eax*8 + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
test byte [ebp - 0x498], 2
je 0x44a269
push 2
push esi
lea ecx, [ebp - 0x328]
call fcn.00417cb0
push 2
push dword [ebp - 0x4a4]
lea ecx, [ebp - 0x328]
call fcn.00417cb0
push 0x42
push dword [ebp - 0x48c]
lea ecx, [ebp - 0x328]
call fcn.00417cb0
push 1
push dword [ebp - 0x474]
lea ecx, [ebp - 0x328]
call fcn.00417cb0
push 1
push dword [ebp - 0x4ac]
lea ecx, [ebp - 0x328]
call fcn.00417cb0
push 1
push dword [ebp - 0x4a8]
lea ecx, [ebp - 0x328]
call fcn.00417cb0
push 1
push 5
lea ecx, [ebp - 0x328]
call fcn.00410720
mov ecx, dword [ebp - 0x454]
lea esi, [ecx + 0xd8]
mov dword [ebp - 0x46c], esi
jmp 0x44a292
mov esi, dword [ebp - 0x46c]
test esi, esi
je 0x44a9d2
cmp byte [esi + 0x38], 0
je 0x44a2a9
mov byte [esi + 0x38], 0
jmp 0x44a67d
mov dword [esi], 0
lea eax, [esi + 0x14]
mov dword [esi + 4], 0
xorps xmm0, xmm0
mov dword [esi + 8], 0
push 0
mov dword [esi + 0xc], 0
push 0
mov dword [esi + 0x10], 0
movups xmmword [eax], xmm0
push 0
movq qword [eax + 0x10], xmm0
push eax
mov dword [eax + 0x18], 0
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x44a9cc
mov edx, dword [esi + 0x18]
cmp edx, 0xcae
jne 0x44a356
mov dword [esi], 0xfffffffa
mov byte [esi + 0x39], 1
test eax, eax
jle 0x44a9cc
cmp edx, 0x100
jne 0x44a60a
mov eax, dword [esi + 0x30]
mov dword [ebp - 0x33c], eax
test eax, eax
je 0x44a60a
mov eax, 0xd
cmp ax, word [esi + 0x1c]
jne 0x44a60a
mov eax, dword [esi + 0x14]
xor ecx, ecx
mov dword [ebp - 0x470], eax
test eax, eax
jne 0x44a556
jmp 0x44a5d1
test edx, edx
je 0x44a677
mov ecx, dword [esi + 0x30]
test ecx, ecx
je 0x44a30a
cmp edx, 0xcb1
jne 0x44a30a
mov edx, dword [ecx + 0x3c]
mov eax, dword [esi + 0x1c]
mov dword [ebp - 0x464], eax
test edx, edx
je 0x44a677
cmp eax, 1
jl 0x44a677
cmp eax, dword [ecx + 0x40]
jg 0x44a677
lea eax, [eax + eax*8]
cmp dword [edx + eax*8 + 0xc], 0
je 0x44a677
mov edx, dword [esi + 0x20]
cmp edx, 0x205
jne 0x44a40d
mov eax, dword [ecx + 0x1c0]
mov edx, dword [esi + 0x14]
test eax, eax
je 0x44a677
mov dword [eax + 0x30], ecx
mov eax, dword [ecx + 0x1c0]
mov dword [eax], 0xffffffea
mov eax, dword [ecx + 0x1c0]
mov dword [eax + 8], 0x205
mov eax, dword [ecx + 0x1c0]
mov dword [eax + 4], edx
mov eax, dword [ecx + 0x1c0]
mov edx, dword [ebp - 0x464]
mov dword [eax + 0xc], edx
mov eax, dword [ecx + 0x1c0]
mov dword [eax + 0x10], 0
mov eax, dword [ecx + 0x1c0]
mov byte [eax + 0x38], 1
jmp 0x44a677
cmp edx, 0x203
jne 0x44a444
mov eax, dword [ecx + 0x1c0]
mov edx, dword [esi + 0x14]
test eax, eax
je 0x44a677
mov dword [eax + 0x30], ecx
mov eax, dword [ecx + 0x1c0]
mov dword [eax], 0xfffffff2
mov eax, dword [ecx + 0x1c0]
mov dword [eax + 8], 0x203
jmp 0x44a3d9
cmp edx, 0x202
jne 0x44a465
push 0
push 0
push dword [esi + 0x14]
push edx
mov edx, dword [ebp - 0x464]
push edx
call fcn.0041af00
jmp 0x44a677
cmp edx, 0x402
jne 0x44a49f
mov eax, dword [ecx + 0x1c0]
mov edx, dword [esi + 0x14]
test eax, eax
je 0x44a677
mov dword [eax + 0x30], ecx
mov eax, dword [ecx + 0x1c0]
mov dword [eax], 0xffffff35
mov eax, dword [ecx + 0x1c0]
mov dword [eax + 8], 0x402
jmp 0x44a3d9
cmp edx, 0x403
je 0x44a51c
cmp edx, 0x404
je 0x44a51c
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x460], eax
mov eax, dword [ecx + 0x1c0]
cmp edx, 0x405
jne 0x44a4f1
test eax, eax
je 0x44a677
mov dword [eax + 0x30], ecx
mov eax, dword [ecx + 0x1c0]
mov dword [eax], 0xffffff34
mov eax, dword [ecx + 0x1c0]
mov dword [eax + 8], edx
mov edx, dword [ebp - 0x460]
jmp 0x44a3d9
test eax, eax
je 0x44a677
mov dword [eax + 0x30], ecx
mov eax, dword [ecx + 0x1c0]
mov dword [eax], 0xffffff36
mov eax, dword [ecx + 0x1c0]
mov dword [eax + 8], edx
mov edx, dword [ebp - 0x460]
jmp 0x44a3d9
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x33c], eax
mov eax, dword [ecx + 0x1c0]
test eax, eax
je 0x44a677
mov dword [eax + 0x30], ecx
mov eax, dword [ecx + 0x1c0]
mov dword [eax], 0xffffff33
mov eax, dword [ecx + 0x1c0]
mov dword [eax + 8], edx
mov edx, dword [ebp - 0x33c]
jmp 0x44a3d9
push 0xfffffffffffffff4
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, dword [ebp - 0x33c]
mov dword [ebp - 0x464], eax
mov edx, dword [ecx + 0x3c]
test edx, edx
je 0x44a5cd
cmp eax, 1
jl 0x44a5cd
cmp eax, dword [ecx + 0x40]
jg 0x44a5cd
lea ecx, [eax + eax*8]
cmp dword [edx + ecx*8 + 0xc], 0
je 0x44a5cd
mov ecx, dword [ebp - 0x470]
lea edi, [eax + eax*8]
cmp dword [edx + edi*8 + 4], ecx
mov edi, dword [ebp - 0x340]
jne 0x44a5cd
mov edx, dword [esi + 0x30]
mov ecx, dword [edx + 0x3c]
test ecx, ecx
je 0x44a5c9
cmp eax, dword [edx + 0x40]
jg 0x44a5c9
lea edx, [eax + eax*8]
cmp dword [ecx + edx*8 + 0xc], 0
je 0x44a5c9
mov ecx, dword [ecx + edx*8]
cmp ecx, 0x23
je 0x44a5c1
cmp ecx, 0x24
jne 0x44a5d7
mov dword [ebp - 0x464], eax
jmp 0x44a5e1
xor ecx, ecx
jmp 0x44a5d1
xor eax, eax
mov ecx, eax
mov dword [ebp - 0x464], eax
cmp ecx, 0x22
je 0x44a5e1
cmp ecx, 0x25
jne 0x44a60a
mov esi, dword [esi + 0x14]
push esi
call dword [sym.imp.USER32.dll_GetParent]
mov edx, dword [ebp - 0x464]
push esi
movzx ecx, dx
push ecx
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov esi, dword [ebp - 0x46c]
jmp 0x44a677
mov eax, dword [esi + 0x34]
test eax, eax
je 0x44a65f
lea ecx, [esi + 0x14]
test ecx, ecx
jne 0x44a61c
xor cl, cl
jmp 0x44a65b
mov edx, dword [eax + 0x244]
add eax, 0x230
mov dword [ebp - 0x33c], eax
test edx, edx
je 0x44a64d
push ecx
push edx
push dword [eax]
call dword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
setne cl
test eax, eax
jne 0x44a65b
mov eax, dword [ebp - 0x33c]
lea ecx, [esi + 0x14]
push ecx
push dword [eax]
call dword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
setne cl
test cl, cl
jne 0x44a673
lea eax, [esi + 0x14]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esi + 0x14]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
mov byte [esi + 0x38], 0
mov ecx, dword [ebp - 0x454]
mov eax, dword [esi]
cmp eax, 0xfffffffa
je 0x44a9d2
lea edx, [ebp - 0x328]
cmp dword [ecx + 0x108], edx
jne 0x44a292
cmp eax, dword [ebp - 0x490]
je 0x44a9d2
cmp eax, dword [ebp - 0x4ac]
jne 0x44a723
cmp dword [ecx + 0x9b4], 0
jne 0x44a6d8
push 2
call fcn.0046a3df
mov ecx, dword [ebp - 0x454]
add esp, 4
xor edx, edx
mov dword [ecx + 0x9b4], eax
mov word [eax], dx
mov dword [ecx + 0x9b8], edx
push ecx
push 5
mov byte [ecx + 0x9bc], 1
xor edx, edx
mov ecx, dword [ecx + 0x9b4]
push 0
call fcn.00404770
mov ecx, dword [ebp - 0x454]
mov esi, eax
test esi, esi
je 0x44a28c
cmp esi, 0xffffffff
je 0x44a28c
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessId]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x454]
jmp 0x44a28c
cmp eax, dword [ebp - 0x4a4]
jne 0x44a88a
sub esp, 8
lea eax, [ebp - 0x328]
push 0x8c
push 0x190
push 0
push eax
push 1
push str.Are_you_sure_you_want_to_delete_the_history_of_atttribute_changes_
call fcn.004406e0
mov ecx, dword [ebp - 0x454]
test eax, eax
je 0x44a292
mov eax, dword [ebp - 0x45c]
xor ecx, ecx
mov dword [ebp - 0x49c], eax
mov dword [ebp - 0x484], 0
mov dword [ebp - 0x33c], str.MonitoringHistory
mov byte [ebp - 0x47c], 0
mov dword [ebp - 0x480], 0
inc ecx
cmp word [ecx*2 + str.HKCUSoftwareClearDiskInfo], 0
jne 0x44a792
xor eax, eax
inc eax
cmp word [eax*2 + str.MonitoringHistory], 0
jne 0x44a7a0
add eax, ecx
mov ecx, 2
mov dword [ebp - 0x470], eax
inc eax
mul ecx
mov ecx, 0xffffffff
cmovb eax, ecx
push eax
call fcn.0046a3df
mov edi, str.HKCUSoftwareClearDiskInfo
mov dword [ebp - 0x45c], eax
add esp, 4
mov ecx, eax
mov edx, 0x48
sub edi, eax
mov word [ecx], dx
add ecx, 2
movzx eax, word [edi + ecx]
mov edx, eax
test ax, ax
jne 0x44a7e1
mov edi, dword [ebp - 0x340]
mov eax, 0x5c
mov edx, dword [ebp - 0x33c]
movzx eax, ax
lea edx, [edx + 2]
mov word [ecx], ax
lea ecx, [ecx + 2]
movzx eax, word [edx]
test ax, ax
jne 0x44a803
xor eax, eax
mov word [ecx], ax
mov eax, dword [ebp - 0x45c]
mov dword [ebp - 0x484], eax
mov eax, dword [ebp - 0x470]
mov dword [ebp - 0x480], eax
mov eax, dword [ebp - 0x49c]
test eax, eax
je 0x44a847
push eax
call fcn.00469dd3
add esp, 4
push dword [ebp - 0x45c]
lea ecx, [ebp - 0x4c]
mov byte [ebp - 0x47c], 1
call fcn.00408680
mov ecx, dword [ebp - 0x454]
test al, al
je 0x44a292
push 0
push 0
push 0x1009
push dword [ebp - 0x458]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0x454]
jmp 0x44a292
cmp eax, dword [ebp - 0x4a8]
jne 0x44a92b
push 2
push dword [ebp - 0x478]
lea ecx, [ebp - 0x328]
call fcn.00417cb0
push 2
push dword [ebp - 0x4a4]
lea ecx, [ebp - 0x328]
call fcn.00417cb0
push 2
push dword [ebp - 0x48c]
lea ecx, [ebp - 0x328]
call fcn.00417cb0
push 1
push dword [ebp - 0x474]
lea ecx, [ebp - 0x328]
call fcn.00417cb0
push 1
push dword [ebp - 0x4ac]
lea ecx, [ebp - 0x328]
call fcn.00417cb0
push 1
push dword [ebp - 0x4a8]
lea ecx, [ebp - 0x328]
call fcn.00417cb0
push 0
push str.The_list_below_shows_the_history_of_changes_in_the_monitored_disks_attributes
push dword [ebp - 0x488]
lea ecx, [ebp - 0x328]
call fcn.004183e0
mov ecx, dword [ebp - 0x454]
jmp 0x44a292
cmp eax, dword [ebp - 0x48c]
jne 0x44a292
push 2
push dword [ebp - 0x474]
lea ecx, [ebp - 0x328]
call fcn.00417cb0
push 2
push dword [ebp - 0x4ac]
lea ecx, [ebp - 0x328]
call fcn.00417cb0
push 2
push dword [ebp - 0x4a8]
lea ecx, [ebp - 0x328]
call fcn.00417cb0
push 1
push dword [ebp - 0x478]
lea ecx, [ebp - 0x328]
call fcn.00417cb0
push 1
push dword [ebp - 0x4a4]
lea ecx, [ebp - 0x328]
call fcn.00417cb0
push 1
push dword [ebp - 0x48c]
lea ecx, [ebp - 0x328]
call fcn.00417cb0
push 0
push str.Clear_Disk_Info_detected_some_changes_in_the_selected_attributes._Check_them_out_in_the_list_below.
push dword [ebp - 0x488]
lea ecx, [ebp - 0x328]
call fcn.004183e0
mov ecx, dword [ebp - 0x454]
jmp 0x44a292
mov dword [esi], 0xfffffed4
push 0
push 0
push 0x1004
push dword [ebp - 0x4a0]
mov dword [ebp - 0x48c], 0
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x4a0], eax
test eax, eax
jle 0x44b562
xor eax, eax
push eax
push dword [ebp - 0x474]
lea ecx, [ebp - 0x328]
call fcn.00419c70
mov ecx, eax
test ecx, ecx
js 0x44b543
mov esi, dword [ebp - 0x454]
mov edx, dword [esi + 0x9e4]
cmp ecx, edx
jge 0x44b543
jb 0x44aa3c
lea edx, [ecx + 1]
mov dword [esi + 0x9e4], edx
mov eax, dword [esi + 0x9ec]
lea edi, [ecx + ecx*2]
shl edi, 5
cmp byte [edi + eax], 0
je 0x44b543
cmp edx, ecx
ja 0x44aa5f
lea eax, [ecx + 1]
mov dword [esi + 0x9e4], eax
mov esi, dword [esi + 0x9ec]
add esi, edi
mov dword [ebp - 0x498], esi
mov eax, dword [esi + 0x54]
test eax, eax
je 0x44b543
cmp word [eax], 0
je 0x44b543
push 0
push dword [ebp - 0x48c]
lea ecx, [ebp - 0x328]
push dword [ebp - 0x474]
call fcn.00419d90
mov edi, eax
test edi, edi
jne 0x44aaac
push eax
lea ecx, [ebp - 0x2c]
call fcn.00405a60
jmp 0x44aaca
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x44aabc
push eax
call fcn.00469dd3
add esp, 4
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], 0
mov byte [ebp - 0x24], 1
push 1
push dword [ebp - 0x48c]
lea ecx, [ebp - 0x328]
push dword [ebp - 0x474]
call fcn.00419d90
mov edi, eax
test edi, edi
jne 0x44aaf4
push eax
lea ecx, [ebp - 0x44]
call fcn.00405a60
jmp 0x44ab12
mov eax, dword [ebp - 0x44]
test eax, eax
je 0x44ab04
push eax
call fcn.00469dd3
add esp, 4
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], 0
mov byte [ebp - 0x3c], 1
cmp dword [esi + 0x54], 0
jne 0x44ab41
push 2
call fcn.0046a3df
add esp, 4
mov dword [esi + 0x54], eax
xor ecx, ecx
mov dword [ebp - 0x484], ecx
mov word [eax], cx
mov dword [esi + 0x58], ecx
mov byte [ebp - 0x47c], cl
mov dword [ebp - 0x480], ecx
jmp 0x44ab68
mov eax, dword [ebp - 0x45c]
mov dword [ebp - 0x45c], eax
mov dword [ebp - 0x484], 0
mov byte [ebp - 0x47c], 0
mov dword [ebp - 0x480], 0
mov byte [esi + 0x5c], 1
mov edi, str.Monitoring_
mov esi, dword [esi + 0x54]
xor eax, eax
mov edx, esi
mov dword [ebp - 0x488], esi
nop
inc eax
cmp word [eax*2 + str.HKCUSoftwareClearDiskInfo], 0
jne 0x44ab80
xor ecx, ecx
nop
inc ecx
cmp word [ecx*2 + str.Monitoring_], 0
jne 0x44ab90
add ecx, eax
mov dword [ebp - 0x46c], ecx
test esi, esi
jne 0x44abbc
mov eax, dword [ebp - 0x45c]
mov dword [ebp - 0x45c], eax
mov dword [ebp - 0x488], esi
jmp 0x44abea
xor eax, eax
cmp word [esi], ax
je 0x44abe8
mov ecx, dword [ebp - 0x45c]
mov dword [ebp - 0x45c], ecx
mov ecx, dword [ebp - 0x46c]
mov dword [ebp - 0x488], esi
nop dword [eax + eax]
inc eax
cmp word [edx + eax*2], 0
jne 0x44abe0
add ecx, eax
lea eax, [ecx + 1]
mov dword [ebp - 0x46c], ecx
mov ecx, 2
mul ecx
mov ecx, 0xffffffff
cmovb eax, ecx
push eax
call fcn.0046a3df
mov esi, str.HKCUSoftwareClearDiskInfo
mov dword [ebp - 0x490], eax
add esp, 4
mov ecx, eax
mov edx, 0x48
sub esi, eax
nop
mov word [ecx], dx
add ecx, 2
movzx eax, word [ecx + esi]
mov edx, eax
test ax, ax
jne 0x44ac20
mov esi, dword [ebp - 0x488]
mov eax, 0x5c
nop dword [eax]
movzx eax, ax
lea edi, [edi + 2]
mov word [ecx], ax
add ecx, 2
movzx eax, word [edi]
test ax, ax
jne 0x44ac40
test esi, esi
je 0x44ac76
movzx eax, word [esi]
mov edx, eax
test ax, ax
je 0x44ac76
movzx eax, ax
lea esi, [esi + 2]
mov word [ecx], ax
add ecx, 2
movzx eax, word [esi]
test ax, ax
jne 0x44ac62
mov edi, dword [ebp - 0x490]
xor eax, eax
mov word [ecx], ax
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0x480], eax
mov eax, dword [ebp - 0x45c]
mov dword [ebp - 0x484], edi
mov byte [ebp - 0x47c], 1
test eax, eax
je 0x44acad
push eax
call fcn.00469dd3
add esp, 4
mov esi, dword [ebp - 0x44]
test esi, esi
jne 0x44accc
push 2
call fcn.0046a3df
add esp, 4
mov dword [ebp - 0x44], eax
xor ecx, ecx
mov word [eax], cx
mov esi, dword [ebp - 0x44]
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x2c]
mov byte [ebp - 0x3c], 1
test eax, eax
jne 0x44acef
push 2
call fcn.0046a3df
add esp, 4
mov dword [ebp - 0x2c], eax
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], ecx
push ecx
push esi
push ecx
push eax
push edi
lea ecx, [ebp - 0x48]
mov byte [ebp - 0x24], 1
mov byte [ebp - 0x47c], 1
call fcn.004084e0
mov esi, dword [ebp - 0x498]
cmp dword [esi + 0x54], 0
jne 0x44ad3c
push 2
call fcn.0046a3df
add esp, 4
mov dword [esi + 0x54], eax
xor ecx, ecx
mov dword [ebp - 0x484], ecx
mov word [eax], cx
mov dword [esi + 0x58], ecx
mov byte [ebp - 0x47c], cl
mov dword [ebp - 0x480], ecx
jmp 0x44ad57
mov dword [ebp - 0x484], 0
mov byte [ebp - 0x47c], 0
mov dword [ebp - 0x480], 0
mov byte [esi + 0x5c], 1
mov edi, str.MonitoringHistory_
mov esi, dword [esi + 0x54]
xor eax, eax
mov edx, esi
mov dword [ebp - 0x488], esi
nop dword [eax]
inc eax
cmp word [eax*2 + str.HKCUSoftwareClearDiskInfo], 0
jne 0x44ad70
xor ecx, ecx
nop
inc ecx
cmp word [ecx*2 + str.MonitoringHistory_], 0
jne 0x44ad80
add ecx, eax
test esi, esi
jne 0x44ad9a
mov dword [ebp - 0x488], esi
jmp 0x44adb1
xor eax, eax
cmp word [esi], ax
je 0x44adaf
mov dword [ebp - 0x488], esi
inc eax
cmp word [edx + eax*2], 0
jne 0x44ada7
add ecx, eax
lea eax, [ecx + 1]
mov dword [ebp - 0x458], ecx
mov ecx, 2
mul ecx
mov ecx, 0xffffffff
cmovb eax, ecx
push eax
call fcn.0046a3df
mov esi, str.HKCUSoftwareClearDiskInfo
mov dword [ebp - 0x45c], eax
add esp, 4
mov ecx, eax
mov edx, 0x48
sub esi, eax
mov word [ecx], dx
add ecx, 2
movzx eax, word [ecx + esi]
mov edx, eax
test ax, ax
jne 0x44ade6
mov esi, dword [ebp - 0x488]
mov eax, 0x5c
movzx eax, ax
lea edi, [edi + 2]
mov word [ecx], ax
add ecx, 2
movzx eax, word [edi]
test ax, ax
jne 0x44ae02
test esi, esi
je 0x44ae38
movzx eax, word [esi]
mov edx, eax
test ax, ax
je 0x44ae38
movzx eax, ax
lea esi, [esi + 2]
mov word [ecx], ax
add ecx, 2
movzx eax, word [esi]
test ax, ax
jne 0x44ae24
push dword [ebp - 0x490]
xor eax, eax
mov byte [ebp - 0x47c], 1
mov word [ecx], ax
mov eax, dword [ebp - 0x45c]
mov dword [ebp - 0x484], eax
mov eax, dword [ebp - 0x458]
mov dword [ebp - 0x480], eax
call fcn.00469dd3
mov edi, dword [ebp - 0x498]
add esp, 4
cmp dword [edi + 0x54], 0
jne 0x44ae8b
push 2
call fcn.0046a3df
add esp, 4
mov dword [edi + 0x54], eax
xor ecx, ecx
mov word [eax], cx
mov dword [edi + 0x58], ecx
mov byte [edi + 0x5c], 1
cmp dword [edi + 0x3c], 0
mov esi, dword [edi + 0x54]
jne 0x44aead
push 2
call fcn.0046a3df
add esp, 4
mov dword [edi + 0x3c], eax
xor ecx, ecx
mov word [eax], cx
mov dword [edi + 0x40], ecx
mov byte [edi + 0x44], 1
mov ecx, dword [edi + 0x3c]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x49c], eax
xor eax, eax
mov dword [ebp - 0x33c], ecx
mov dword [ebp - 0x20], 0
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
test ecx, ecx
je 0x44aee8
cmp word [ecx], ax
je 0x44aee8
inc eax
cmp word [ecx + eax*2], 0
jne 0x44aee0
xor ecx, ecx
nop word [eax + eax]
inc ecx
cmp word [ecx*2 + str._with_serial_number], 0
jne 0x44aef0
add ecx, eax
test esi, esi
je 0x44af1a
xor eax, eax
cmp word [esi], ax
je 0x44af18
nop dword [eax]
inc eax
cmp word [esi + eax*2], 0
jne 0x44af10
add ecx, eax
lea eax, [ecx + 1]
mov dword [ebp - 0x458], ecx
mov ecx, 2
mul ecx
mov ecx, 0xffffffff
cmovb eax, ecx
push eax
call fcn.0046a3df
mov edx, dword [ebp - 0x20]
add esp, 4
mov dword [ebp - 0x470], eax
mov ecx, eax
test edx, edx
je 0x44af66
movzx eax, word [edx]
test ax, ax
je 0x44af66
movzx eax, ax
lea edx, [edx + 2]
mov word [ecx], ax
add ecx, 2
movzx eax, word [edx]
test ax, ax
jne 0x44af52
mov edx, dword [ebp - 0x33c]
test edx, edx
je 0x44af96
movzx eax, word [edx]
mov edi, eax
mov dword [ebp - 0x33c], edi
test ax, ax
je 0x44af96
movzx edi, ax
sub edx, ecx
mov word [ecx], di
add ecx, 2
movzx eax, word [edx + ecx]
mov edi, eax
test ax, ax
jne 0x44af85
mov edi, str._with_serial_number
mov edx, 0x20
sub edi, ecx
mov word [ecx], dx
add ecx, 2
movzx eax, word [ecx + edi]
mov edx, eax
test ax, ax
jne 0x44afa2
mov edi, dword [ebp - 0x498]
test esi, esi
je 0x44afdb
movzx eax, word [esi]
mov edx, eax
test ax, ax
je 0x44afdb
movzx eax, ax
lea esi, [esi + 2]
mov word [ecx], ax
add ecx, 2
movzx eax, word [esi]
test ax, ax
jne 0x44afc7
xor eax, eax
mov word [ecx], ax
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x44aff0
push eax
call fcn.00469dd3
add esp, 4
mov eax, dword [ebp - 0x470]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x458]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x49c]
mov byte [ebp - 0x18], 1
test eax, eax
je 0x44b019
push eax
call fcn.00469dd3
add esp, 4
cmp dword [edi + 0x3c], 0
jne 0x44b034
push 2
call fcn.0046a3df
add esp, 4
mov dword [edi + 0x3c], eax
xor ecx, ecx
mov word [eax], cx
mov dword [edi + 0x40], ecx
push ecx
mov byte [edi + 0x44], 1
push dword [edi + 0x3c]
mov byte [ebp - 0x47c], 1
push ecx
push str.Model
push dword [ebp - 0x45c]
lea ecx, [ebp - 0x48]
call fcn.004084e0
lea eax, [ebp - 0x338]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push ecx
lea edx, [ebp - 0x20]
lea ecx, [ebp - 0x338]
call fcn.0040b530
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x458], eax
test eax, eax
jne 0x44b09e
push 2
call fcn.0046a3df
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x458], eax
mov byte [ebp - 0x18], 1
test eax, eax
jne 0x44b0c4
push 2
call fcn.0046a3df
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x458], eax
mov esi, dword [ebp - 0x28]
mov byte [ebp - 0x18], 1
mov byte [ebp - 0x24], 0
test esi, esi
jne 0x44b0eb
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x44b0e8
cmp word [ecx], si
je 0x44b0e8
nop
inc esi
cmp word [ecx + esi*2], 0
jne 0x44b0e0
mov dword [ebp - 0x28], esi
test eax, eax
je 0x44b100
xor ecx, ecx
cmp word [eax], cx
je 0x44b0fe
inc ecx
cmp word [eax + ecx*2], 0
jne 0x44b0f6
add esi, ecx
xor eax, eax
inc eax
cmp word [eax*2 + 0x49edcc], 0
jne 0x44b102
add esi, eax
mov ecx, 2
mov dword [ebp - 0x33c], esi
lea eax, [esi + 1]
mul ecx
mov ecx, 0xffffffff
cmovb eax, ecx
push eax
call fcn.0046a3df
mov edi, dword [ebp - 0x458]
add esp, 4
mov ecx, dword [ebp - 0x2c]
mov edx, eax
mov dword [ebp - 0x460], eax
mov dword [ebp - 0x490], ecx
test edi, edi
je 0x44b16d
movzx ecx, word [edi]
test cx, cx
je 0x44b167
sub edi, eax
mov word [edx], cx
add edx, 2
movzx eax, word [edi + edx]
mov ecx, eax
test ax, ax
jne 0x44b156
mov ecx, dword [ebp - 0x490]
mov esi, 0x49edcc
mov edi, 0x7c
sub esi, edx
nop dword [eax]
mov word [edx], di
add edx, 2
movzx eax, word [edx + esi]
mov edi, eax
test ax, ax
jne 0x44b180
cmp dword [ebp - 0x2c], 0
mov esi, dword [ebp - 0x33c]
je 0x44b1bb
movzx eax, word [ecx]
mov edi, eax
test ax, ax
je 0x44b1bb
movzx eax, ax
lea ecx, [ecx + 2]
mov word [edx], ax
add edx, 2
movzx eax, word [ecx]
test ax, ax
jne 0x44b1a7
xor eax, eax
mov word [edx], ax
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x44b1d0
push eax
call fcn.00469dd3
add esp, 4
mov eax, dword [ebp - 0x460]
lea ecx, [ebp - 0x328]
push 2
push dword [ebp - 0x48c]
mov dword [ebp - 0x2c], eax
push dword [ebp - 0x474]
mov dword [ebp - 0x28], esi
mov byte [ebp - 0x24], 1
call fcn.00419d90
mov esi, eax
mov eax, dword [ebp - 0x38]
test esi, esi
jne 0x44b256
test eax, eax
je 0x44b20f
push eax
call fcn.00469dd3
add esp, 4
push 2
mov byte [ebp - 0x30], 0
mov dword [ebp - 0x34], 0
call fcn.0046a3df
mov edi, eax
add esp, 4
mov eax, dword [ebp - 0x34]
xor esi, esi
mov dword [ebp - 0x38], edi
test eax, eax
jle 0x44b24e
xor ecx, ecx
xor edx, edx
mov ax, word [ecx]
lea ecx, [ecx + 2]
mov word [edi + edx], ax
lea edx, [edx + 2]
mov eax, dword [ebp - 0x34]
inc esi
mov edi, dword [ebp - 0x38]
cmp esi, eax
jl 0x44b236
xor ecx, ecx
mov word [edi + eax*2], cx
jmp 0x44b26d
test eax, eax
je 0x44b263
push eax
call fcn.00469dd3
add esp, 4
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], 0
push 3
push dword [ebp - 0x48c]
lea ecx, [ebp - 0x328]
mov byte [ebp - 0x30], 1
push dword [ebp - 0x474]
call fcn.00419d90
mov esi, eax
mov eax, dword [ebp - 0x20]
test esi, esi
jne 0x44b2f3
test eax, eax
je 0x44b2a0
push eax
call fcn.00469dd3
add esp, 4
push 2
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
call fcn.0046a3df
mov edi, eax
add esp, 4
mov eax, dword [ebp - 0x1c]
xor esi, esi
mov dword [ebp - 0x20], edi
test eax, eax
jle 0x44b2e8
xor ecx, ecx
xor edx, edx
nop word [eax + eax]
mov ax, word [ecx]
lea ecx, [ecx + 2]
mov word [edi + edx], ax
lea edx, [edx + 2]
mov eax, dword [ebp - 0x1c]
inc esi
mov edi, dword [ebp - 0x20]
cmp esi, eax
jl 0x44b2d0
xor ecx, ecx
mov word [edi + eax*2], cx
mov esi, dword [ebp - 0x20]
jmp 0x44b30a
test eax, eax
je 0x44b300
push eax
call fcn.00469dd3
add esp, 4
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x18], 1
test esi, esi
jne 0x44b32a
push 2
call fcn.0046a3df
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov esi, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
mov edi, dword [ebp - 0x38]
mov byte [ebp - 0x18], 1
mov dword [ebp - 0x458], edi
test edi, edi
jne 0x44b359
push 2
call fcn.0046a3df
add esp, 4
mov dword [ebp - 0x38], eax
xor ecx, ecx
mov word [eax], cx
mov edi, dword [ebp - 0x38]
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x458], edi
mov eax, dword [ebp - 0x40]
mov byte [ebp - 0x30], 1
mov dword [ebp - 0x33c], 0x49ed98
mov byte [ebp - 0x3c], 0
test eax, eax
jne 0x44b38b
mov ecx, dword [ebp - 0x44]
test ecx, ecx
je 0x44b388
cmp word [ecx], ax
je 0x44b388
nop
inc eax
cmp word [ecx + eax*2], 0
jne 0x44b380
mov dword [ebp - 0x40], eax
xor ecx, ecx
nop dword [eax]
inc ecx
cmp word [ecx*2 + 0x49ed98], 0
jne 0x44b390
add ecx, eax
test edi, edi
je 0x44b3ba
xor eax, eax
cmp word [edi], ax
je 0x44b3b8
nop dword [eax]
inc eax
cmp word [edi + eax*2], 0
jne 0x44b3b0
add ecx, eax
xor eax, eax
nop dword [eax]
inc eax
cmp word [eax*2 + 0x49ed98], 0
jne 0x44b3c0
add ecx, eax
test esi, esi
je 0x44b3ea
xor eax, eax
cmp word [esi], ax
je 0x44b3e8
nop dword [eax]
inc eax
cmp word [esi + eax*2], 0
jne 0x44b3e0
add ecx, eax
lea eax, [ecx + 1]
mov dword [ebp - 0x490], ecx
mov ecx, 2
mul ecx
mov ecx, 0xffffffff
cmovb eax, ecx
push eax
call fcn.0046a3df
mov edx, dword [ebp - 0x44]
add esp, 4
mov dword [ebp - 0x460], eax
mov ecx, eax
test edx, edx
je 0x44b436
movzx eax, word [edx]
test ax, ax
je 0x44b436
movzx eax, ax
lea edx, [edx + 2]
mov word [ecx], ax
add ecx, 2
movzx eax, word [edx]
test ax, ax
jne 0x44b422
mov edi, 0x49ed98
mov edx, 0xa
sub edi, ecx
mov word [ecx], dx
add ecx, 2
movzx eax, word [ecx + edi]
mov edx, eax
test ax, ax
jne 0x44b442
mov edi, dword [ebp - 0x458]
test edi, edi
je 0x44b47b
movzx eax, word [edi]
mov edx, eax
test ax, ax
je 0x44b47b
movzx eax, ax
lea edi, [edi + 2]
mov word [ecx], ax
add ecx, 2
movzx eax, word [edi]
test ax, ax
jne 0x44b467
mov edx, dword [ebp - 0x33c]
mov eax, 0xa
movzx eax, ax
lea edx, [edx + 2]
mov word [ecx], ax
add ecx, 2
movzx eax, word [edx]
test ax, ax
jne 0x44b486
test esi, esi
je 0x44b4c4
movzx eax, word [esi]
mov edx, eax
test ax, ax
je 0x44b4c4
nop dword [eax + eax]
movzx eax, ax
lea esi, [esi + 2]
mov word [ecx], ax
add ecx, 2
movzx eax, word [esi]
test ax, ax
jne 0x44b4b0
xor eax, eax
mov word [ecx], ax
mov eax, dword [ebp - 0x44]
test eax, eax
je 0x44b4d9
push eax
call fcn.00469dd3
add esp, 4
mov esi, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x460]
mov eax, dword [ebp - 0x490]
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x3c], 1
test esi, esi
jne 0x44b514
push 2
call fcn.0046a3df
mov edx, dword [ebp - 0x460]
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x2c], eax
mov word [eax], cx
mov esi, dword [ebp - 0x2c]
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x48]
mov byte [ebp - 0x24], 1
test eax, eax
je 0x44b543
xor ecx, ecx
cmp word [edx], cx
je 0x44b52e
inc ecx
cmp word [edx + ecx*2], 0
jne 0x44b526
lea ecx, [ecx*2 + 2]
push ecx
push edx
push 1
push 0
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x48c]
inc eax
mov dword [ebp - 0x48c], eax
cmp eax, dword [ebp - 0x4a0]
jl 0x44aa01
mov edi, dword [ebp - 0x340]
mov eax, dword [ebp - 0x454]
push 0x20
push dword [eax + 0x10]
lea ecx, [eax + 0x150]
call fcn.00417cb0
test edi, edi
je 0x44b585
push edi
call fcn.004646a0
add esp, 4
mov eax, dword [ebp - 0x84]
test eax, eax
je 0x44b598
push eax
call fcn.00469dd3
add esp, 4
mov eax, dword [ebp - 0x88]
test eax, eax
je 0x44b5ab
push eax
call fcn.00469dd3
add esp, 4
mov eax, dword [ebp - 0x34c]
test eax, eax
je 0x44b5be
push eax
call fcn.00469dd3
add esp, 4
push dword [ebp - 0x494]
call fcn.00469dd3
mov esi, dword [ebp - 0x4b0]
add esp, 4
mov eax, dword [ebp - 0x4c]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x44b5e7
cmp eax, 0xffffffff
je 0x44b5e7
push eax
call edi
mov eax, dword [ebp - 0x48]
test eax, eax
je 0x44b5f6
cmp eax, 0xffffffff
je 0x44b5f6
push eax
call edi
mov eax, dword [ebp - 0x45c]
test eax, eax
je 0x44b609
push eax
call fcn.00469dd3
add esp, 4
mov eax, dword [ebp - 0x38]
test eax, eax
je 0x44b619
push eax
call fcn.00469dd3
add esp, 4
mov eax, dword [ebp - 0x44]
test eax, eax
je 0x44b629
push eax
call fcn.00469dd3
add esp, 4
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x44b639
push eax
call fcn.00469dd3
add esp, 4
mov eax, dword [ebp - 0x58]
test eax, eax
je 0x44b649
push eax
call fcn.00469dd3
add esp, 4
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x44b659
push eax
call fcn.00469dd3
add esp, 4
lea ecx, [ebp - 0x328]
mov dword [ebp - 4], 0x14
call fcn.0040f2b0
mov eax, dword [ebp - 0x2ec]
test eax, eax
je 0x44b67e
push eax
call fcn.00469dd3
add esp, 4
mov ecx, dword [ebp - 0x218]
test ecx, ecx
je 0x44b691
push ecx
call fcn.00469dd3
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00469dc5
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 4