Function at 0x421410
Capabilities:
Get common file path
Persist via run registry key

Disassembly:
mov eax, 0x3034
call fcn.0044ced0
mov eax, dword [0x4895f0]
xor eax, esp
mov dword [esp + 0x3030], eax
push ebx
push ebp
xor ebx, ebx
push 0x3ff
lea eax, [esp + 0x83d]
push ebx
push eax
mov ebp, ecx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x14], ebx
mov byte [esp + 0x844], bl
call fcn.0044cf00
push 0x3ff
lea ecx, [esp + 0x1049]
push ebx
push ecx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x34], ebx
mov byte [esp + 0x1050], bl
call fcn.0044cf00
push 0x3ff
lea edx, [esp + 0x455]
push ebx
push edx
mov dword [esp + 0x30], ebx
mov byte [esp + 0x45c], bl
call fcn.0044cf00
push 0x3ff
lea eax, [esp + 0x61]
push ebx
push eax
mov byte [esp + 0x68], bl
call fcn.0044cf00
push 0x3ff
lea ecx, [esp + 0x146d]
push ebx
push ecx
mov dword [esp + 0x60], ebx
mov byte [esp + 0x1474], bl
call fcn.0044cf00
push 0x3ff
lea edx, [esp + 0xc79]
push ebx
push edx
mov byte [esp + 0xc80], bl
call fcn.0044cf00
add esp, 0x48
push 0x3ff
lea eax, [esp + 0x2c3d]
push ebx
push eax
mov byte [esp + 0x2c44], bl
call fcn.0044cf00
push 0x3ff
lea ecx, [esp + 0x2849]
push ebx
push ecx
mov byte [esp + 0x2850], bl
call fcn.0044cf00
push 0x3ff
lea edx, [esp + 0x2055]
push ebx
push edx
mov byte [esp + 0x205c], bl
call fcn.0044cf00
push 0x3ff
lea eax, [esp + 0x1861]
push ebx
push eax
mov dword [esp + 0x64], ebx
mov byte [esp + 0x1868], bl
call fcn.0044cf00
push 0x3ff
lea ecx, [esp + 0x1c6d]
push ebx
push ecx
mov dword [esp + 0x6c], ebx
mov byte [esp + 0x1c74], bl
call fcn.0044cf00
mov dword [esp + 0x68], ebx
mov byte [esp + 0x2474], bl
push 0x3ff
lea edx, [esp + 0x2479]
push ebx
push edx
call fcn.0044cf00
add esp, 0x48
push 0x400
lea eax, [esp + 0x143c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x4220ad
lea eax, [esp + 0x1438]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x4215b0
sub eax, edx
cmp eax, 1
mov dword [esp + 0x24], eax
jle 0x4220ad
cmp byte [esp + eax + 0x1437], 0x5c
lea eax, [esp + eax + 0x1437]
jne 0x4215db
mov byte [eax], bl
xor eax, eax
lea ecx, [ecx]
mov cl, byte [esp + eax + 0x1438]
mov byte [esp + eax + 0x2838], cl
add eax, 1
cmp cl, bl
jne 0x4215e0
lea eax, [esp + 0x2838]
add eax, 0xffffffff
nop
mov cl, byte [eax + 1]
add eax, 1
cmp cl, bl
jne 0x421600
mov ecx, dword [str.Advapi32.dll]
mov edx, dword [0x46f884]
mov dword [eax], ecx
mov ecx, dword [0x46f888]
mov dword [eax + 4], edx
mov dx, word [0x46f88c]
mov dword [eax + 8], ecx
mov word [eax + 0xc], dx
xor eax, eax
mov cl, byte [esp + eax + 0x1438]
mov byte [esp + eax + 0x2438], cl
add eax, 1
cmp cl, bl
jne 0x421631
lea eax, [esp + 0x2438]
add eax, 0xffffffff
mov cl, byte [eax + 1]
add eax, 1
cmp cl, bl
jne 0x421650
mov ecx, dword [str.Kernel32.dll]
mov edx, dword [0x46f874]
mov dword [eax], ecx
mov ecx, dword [0x46f878]
mov dword [eax + 4], edx
mov dx, word [0x46f87c]
mov dword [eax + 8], ecx
mov word [eax + 0xc], dx
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x203c]
push ecx
push 0x400
lea edx, [esp + 0x2844]
push 0x46f860
push edx
call fcn.004231a0
add esp, 0x14
test eax, eax
je 0x4220ad
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x183c]
push ecx
push 0x400
lea edx, [esp + 0x2444]
push 0x46f854
push edx
call fcn.004231a0
add esp, 0x14
test eax, eax
je 0x4220ad
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x1c3c]
push ecx
push 0x400
lea edx, [esp + 0x2444]
push str.CreateFileW
push edx
call fcn.004231a0
add esp, 0x14
test eax, eax
je 0x4220ad
push esi
push 0x46f838
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
cmp esi, ebx
je 0x4220ac
push 0x46f828
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
add esi, ecx
lea ecx, [edx + eax]
mov edx, dword [esp + 0x30]
add eax, edx
cmp byte [esi], 0xe9
mov dword [esp + 0x18], esi
jne 0x421768
mov dl, byte [esi + 5]
cmp dl, byte [esp + 0x2041]
jne 0x421768
mov edx, dword [esp + 0x203c]
mov dword [esi], edx
mov dl, byte [esp + 0x2040]
mov byte [esi + 4], dl
cmp byte [ecx], 0xe9
jne 0x42178c
mov dl, byte [ecx + 5]
cmp dl, byte [esp + 0x1841]
jne 0x42178c
mov edx, dword [esp + 0x183c]
mov dword [ecx], edx
mov dl, byte [esp + 0x1840]
mov byte [ecx + 4], dl
cmp byte [eax], 0xe9
jne 0x4217b0
mov cl, byte [eax + 5]
cmp cl, byte [esp + 0x1c41]
jne 0x4217b0
mov edx, dword [esp + 0x1c3c]
mov dword [eax], edx
mov cl, byte [esp + 0x1c40]
mov byte [eax + 4], cl
lea edx, [esp + 0xc]
push edx
push 0xf003f
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4220ac
push edi
mov eax, 0x400
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1044]
push ecx
lea edx, [esp + 0x2c]
push edx
mov edx, dword [esp + 0x1c]
push ebx
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x854]
push ecx
push ebx
push edx
mov dword [esp + 0x40], ebx
call dword [esp + 0x3c]
test eax, eax
jne 0x421b0f
jmp 0x421820
push 0x400
lea eax, [esp + 0x444]
push ebx
push eax
call fcn.0044cf00
push 0x400
lea ecx, [esp + 0x50]
push ebx
push ecx
call fcn.0044cf00
push 0x400
lea edx, [esp + 0x45c]
push edx
lea eax, [esp + 0x1060]
push eax
call fcn.0041be20
lea ecx, [esp + 0x464]
push str.rundll32.exe
push ecx
call fcn.0044d0b0
add esp, 0x2c
test eax, eax
je 0x421897
lea edx, [esp + 0x440]
push 0x46f824
push edx
call fcn.0044d0b0
add esp, 8
test eax, eax
mov dword [esp + 0x28], 1
jne 0x42189b
mov dword [esp + 0x28], ebx
push 0x20
lea eax, [esp + 0xc44]
push eax
lea ecx, [esp + 0x448]
push ecx
call fcn.0041b970
add esp, 0xc
test eax, eax
je 0x4220ab
push 0x400
lea edx, [esp + 0xc44]
push ebx
push edx
call fcn.0044cf00
push 0x20
lea eax, [esp + 0xc50]
push eax
lea ecx, [esp + 0x454]
push ecx
call fcn.0041b970
add esp, 0x18
test eax, eax
je 0x4220ab
push 0x400
lea edx, [esp + 0x44]
push ebx
push edx
call fcn.0044cf00
lea eax, [esp + 0xc4c]
push 0x469140
push eax
call fcn.0044d0b0
add esp, 0x14
test eax, eax
jne 0x421984
push 0x400
lea ecx, [esp + 0x44]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x4220ab
lea eax, [esp + 0x40]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x421940
sub eax, edx
cmp eax, 2
mov dword [esp + 0x2c], eax
jl 0x4220ab
cmp byte [esp + eax + 0x3f], 0x5c
lea eax, [esp + eax + 0x3f]
jne 0x421965
mov byte [eax], bl
lea edi, [esp + 0x40]
add edi, 0xffffffff
lea esp, [esp]
mov al, byte [edi + 1]
add edi, 1
cmp al, bl
jne 0x421970
mov dx, word [0x469140]
mov word [edi], dx
lea eax, [esp + 0xc40]
mov edx, eax
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x421990
lea edi, [esp + 0x40]
sub eax, edx
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
cmp cl, bl
jne 0x4219a2
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
cmp dword [esp + 0x28], ebx
rep movsb byte es:[edi], byte [esi]
je 0x421a29
lea eax, [esp + 0x40]
push eax
call fcn.0041c110
add esp, 4
test eax, eax
jne 0x421a29
mov ecx, dword [ebp + 0x14]
imul ecx, ecx, 0x1414
mov byte [ecx + ebp + 0x430], bl
mov edx, dword [ebp + 0x14]
imul edx, edx, 0x1414
lea edi, [edx + ebp + 0x830]
mov ecx, 0x10
mov esi, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [ebp + 0x14]
imul eax, eax, 0x1414
lea ecx, [esp + 0x840]
lea edx, [eax + ebp + 0xc30]
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
cmp al, bl
jne 0x421a17
add dword [ebp + 0x14], 1
lea ecx, [esp + 0x40]
push ecx
mov ecx, ebp
call fcn.004213b0
test eax, eax
je 0x421aa4
mov edx, dword [ebp + 0x14]
imul edx, edx, 0x1414
lea ecx, [esp + 0x40]
lea edx, [edx + ebp + 0x430]
lea ecx, [ecx]
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
cmp al, bl
jne 0x421a50
mov eax, dword [ebp + 0x14]
imul eax, eax, 0x1414
lea edi, [eax + ebp + 0x830]
mov ecx, 0x10
mov esi, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov edx, dword [ebp + 0x14]
imul edx, edx, 0x1414
lea ecx, [esp + 0x840]
lea edx, [edx + ebp + 0xc30]
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
cmp al, bl
jne 0x421a92
add dword [ebp + 0x14], 1
mov esi, dword [esp + 0x20]
mov edi, 0x400
push edi
lea eax, [esp + 0x1044]
push ebx
add esi, 1
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], edi
call fcn.0044cf00
push edi
lea ecx, [esp + 0x850]
push ebx
push ecx
call fcn.0044cf00
add esp, 0x18
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x1044]
push eax
lea ecx, [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x1c]
push ebx
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x854]
push eax
push esi
push ecx
call dword [esp + 0x3c]
test eax, eax
je 0x421820
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x421b22
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], ebx
lea edx, [esp + 0x10]
push edx
push 0xf003f
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4220ab
mov eax, 0x400
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1044]
push ecx
lea edx, [esp + 0x2c]
push edx
mov edx, dword [esp + 0x1c]
push ebx
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x854]
push ecx
push ebx
push edx
mov dword [esp + 0x40], ebx
call dword [esp + 0x3c]
test eax, eax
jne 0x421e7e
jmp 0x421b90
push 0x400
lea eax, [esp + 0x444]
push ebx
push eax
call fcn.0044cf00
push 0x400
lea ecx, [esp + 0x50]
push ebx
push ecx
call fcn.0044cf00
push 0x400
lea edx, [esp + 0x45c]
push edx
lea eax, [esp + 0x1060]
push eax
call fcn.0041be20
lea ecx, [esp + 0x464]
push str.rundll32.exe
push ecx
call fcn.0044d0b0
add esp, 0x2c
test eax, eax
je 0x421c07
lea edx, [esp + 0x440]
push 0x46f824
push edx
call fcn.0044d0b0
add esp, 8
test eax, eax
mov dword [esp + 0x28], 1
jne 0x421c0b
mov dword [esp + 0x28], ebx
push 0x20
lea eax, [esp + 0xc44]
push eax
lea ecx, [esp + 0x448]
push ecx
call fcn.0041b970
add esp, 0xc
test eax, eax
je 0x4220ab
push 0x400
lea edx, [esp + 0xc44]
push ebx
push edx
call fcn.0044cf00
push 0x20
lea eax, [esp + 0xc50]
push eax
lea ecx, [esp + 0x454]
push ecx
call fcn.0041b970
add esp, 0x18
test eax, eax
je 0x4220ab
push 0x400
lea edx, [esp + 0x44]
push ebx
push edx
call fcn.0044cf00
lea eax, [esp + 0xc4c]
push 0x469140
push eax
call fcn.0044d0b0
add esp, 0x14
test eax, eax
jne 0x421cf4
push 0x400
lea ecx, [esp + 0x44]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x4220ab
lea eax, [esp + 0x40]
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x421cb0
sub eax, edx
cmp eax, 2
mov dword [esp + 0x2c], eax
jl 0x4220ab
cmp byte [esp + eax + 0x3f], 0x5c
lea eax, [esp + eax + 0x3f]
jne 0x421cd5
mov byte [eax], bl
lea edi, [esp + 0x40]
add edi, 0xffffffff
lea esp, [esp]
mov al, byte [edi + 1]
add edi, 1
cmp al, bl
jne 0x421ce0
mov dx, word [0x469140]
mov word [edi], dx
lea eax, [esp + 0xc40]
mov edx, eax
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x421d00
lea edi, [esp + 0x40]
sub eax, edx
add edi, 0xffffffff
mov cl, byte [edi + 1]
add edi, 1
cmp cl, bl
jne 0x421d12
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
cmp dword [esp + 0x28], ebx
rep movsb byte es:[edi], byte [esi]
je 0x421d99
lea eax, [esp + 0x40]
push eax
call fcn.0041c110
add esp, 4
test eax, eax
jne 0x421d99
mov ecx, dword [ebp + 0x14]
imul ecx, ecx, 0x1414
mov byte [ecx + ebp + 0x430], bl
mov edx, dword [ebp + 0x14]
imul edx, edx, 0x1414
lea edi, [edx + ebp + 0x830]
mov ecx, 0x10
mov esi, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [ebp + 0x14]
imul eax, eax, 0x1414
lea ecx, [esp + 0x840]
lea edx, [eax + ebp + 0xc30]
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
cmp al, bl
jne 0x421d87
add dword [ebp + 0x14], 1
lea ecx, [esp + 0x40]
push ecx
mov ecx, ebp
call fcn.004213b0
test eax, eax
je 0x421e13
mov edx, dword [ebp + 0x14]
imul edx, edx, 0x1414
lea ecx, [esp + 0x40]
lea edx, [edx + ebp + 0x430]
lea ecx, [ecx]
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
cmp al, bl
jne 0x421dc0
mov eax, dword [ebp + 0x14]
imul eax, eax, 0x1414
lea edi, [eax + ebp + 0x830]
mov ecx, 0x10
mov esi, str.HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 0x14]
imul edx, edx, 0x1414
lea ecx, [esp + 0x840]
lea edx, [edx + ebp + 0xc30]
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
cmp al, bl
jne 0x421e01
add dword [ebp + 0x14], 1
mov esi, dword [esp + 0x20]
mov edi, 0x400
push edi
lea eax, [esp + 0x1044]
push ebx
add esi, 1
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], edi
call fcn.0044cf00
push edi
lea ecx, [esp + 0x850]
push ebx
push ecx
call fcn.0044cf00
add esp, 0x18
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x1044]
push eax
lea ecx, [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x1c]
push ebx
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x854]
push eax
push esi
push ecx
call dword [esp + 0x3c]
test eax, eax
je 0x421b90
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x421e91
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], ebx
lea edx, [esp + 0x10]
push edx
push 0xf003f
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4220ab
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1044]
push ecx
lea edx, [esp + 0x2c]
push edx
mov edx, dword [esp + 0x1c]
push ebx
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x854]
push ecx
push ebx
mov edi, 0x400
push edx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], edi
call dword [esp + 0x3c]
test eax, eax
jne 0x4220a3
push edi
lea eax, [esp + 0x444]
push ebx
push eax
call fcn.0044cf00
push edi
lea ecx, [esp + 0x50]
push ebx
push ecx
call fcn.0044cf00
push edi
lea edx, [esp + 0x45c]
push edx
lea eax, [esp + 0x860]
push eax
call fcn.0041be20
lea ecx, [esp + 0x50]
push ecx
lea edx, [esp + 0x68]
push edx
lea eax, [esp + 0x46c]
push eax
mov dword [esp + 0x5c], edi
call fcn.0041b7f0
add esp, 0x30
test eax, eax
je 0x422038
push edi
lea ecx, [esp + 0xc44]
push ecx
lea edx, [esp + 0x48]
push edx
call fcn.0041be20
push edi
lea eax, [esp + 0x2c50]
push eax
lea ecx, [esp + 0x1454]
push ecx
call fcn.0041be20
lea edx, [esp + 0x2c58]
push edx
lea eax, [esp + 0xc5c]
push eax
call fcn.0044d0b0
add esp, 0x20
test eax, eax
je 0x422038
lea ecx, [esp + 0x40]
push ecx
call fcn.0041b9d0
add esp, 4
test eax, eax
je 0x422038
mov edx, dword [ebp + 0x14]
imul edx, edx, 0x1414
lea ecx, [esp + 0x40]
lea edx, [edx + ebp + 0x430]
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
cmp al, bl
jne 0x421fc0
mov eax, dword [ebp + 0x14]
imul eax, eax, 0x1414
lea edi, [eax + ebp + 0x830]
mov ecx, 0x16
mov esi, str.HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks
rep movsd dword es:[edi], dword [esi]
mov edx, dword [ebp + 0x14]
imul edx, edx, 0x1414
lea ecx, [esp + 0x840]
lea edx, [edx + ebp + 0xc30]
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
cmp al, bl
jne 0x422001
mov eax, dword [ebp + 0x14]
imul eax, eax, 0x1414
lea ecx, [esp + 0x440]
lea edx, [eax + ebp + 0x1030]
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
cmp al, bl
jne 0x422026
add dword [ebp + 0x14], 1
mov esi, dword [esp + 0x20]
mov edi, 0x400
push edi
lea ecx, [esp + 0x1044]
push ebx
add esi, 1
push ecx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], edi
call fcn.0044cf00
push edi
lea edx, [esp + 0x850]
push ebx
push edx
call fcn.0044cf00
add esp, 0x18
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1044]
push ecx
lea edx, [esp + 0x2c]
push edx
mov edx, dword [esp + 0x1c]
push ebx
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x854]
push ecx
push esi
push edx
call dword [esp + 0x3c]
test eax, eax
je 0x421ef7
mov dword [esp + 0x30], 1
pop edi
pop esi
mov eax, dword [esp + 8]
pop ebp
cmp eax, ebx
pop ebx
je 0x4220be
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x3030]
mov eax, dword [esp + 0x20]
xor ecx, esp
call fcn.0044ce74
add esp, 0x3034
ret