Function at 0x462b90
Capabilities:
Link many functions at runtime

Disassembly:
push 0xffffffffffffffff
push 0x507ace
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x54b708]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
push 0x51fc90
lea ecx, [esp + 0x10]
call fcn.0043e3f0
mov dword [esp + 0x1c], 0
call fcn.0042a540
test al, al
je 0x46312b
test byte [0x557e18], 1
jne 0x462c0e
or dword [0x557e18], 1
push 0x557e0c
mov edi, str.ntdll.dll
mov byte [esp + 0x20], 1
call fcn.00430060
push 0x50ca00
call fcn.004b8f73
add esp, 4
mov byte [esp + 0x1c], 0
mov eax, dword [0x557e14]
test eax, eax
je 0x4630e2
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtOpenThread
push eax
call esi
test eax, eax
mov dword [0x554fc4], eax
jne 0x462c5d
push str.Could_not_find_NtOpenThread_entry_point_in_NTDLL.DLL
lea ecx, [esp + 0x10]
call fcn.0040d800
lea ecx, [esp + 0xc]
call fcn.0040dab0
xor al, al
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret
mov eax, dword [0x557e14]
push str.NtCreateKey
push eax
call esi
test eax, eax
mov dword [0x554fc0], eax
jne 0x462c7a
push str.Could_not_find_NtCreateKey_entry_point_in_NTDLL.DLL
jmp 0x462c37
mov ecx, dword [0x557e14]
push str.NtOpenKey
push ecx
call esi
test eax, eax
mov dword [0x554fbc], eax
jne 0x462c98
push str.Could_not_find_NtOpenKey_entry_point_in_NTDLL.DLL
jmp 0x462c37
mov edx, dword [0x557e14]
push str.NtFlushKey
push edx
call esi
test eax, eax
mov dword [0x554fb8], eax
jne 0x462cb6
push str.Could_not_find_NtFlushKey_entry_point_in_NTDLL.DLL
jmp 0x462c37
mov eax, dword [0x557e14]
push str.NtDeleteKey
push eax
call esi
test eax, eax
mov dword [0x554fb4], eax
jne 0x462cd6
push str.Could_not_find_NtDeleteKey_entry_point_in_NTDLL.DLL
jmp 0x462c37
mov ecx, dword [0x557e14]
push str.NtQueryKey
push ecx
call esi
test eax, eax
mov dword [0x554fb0], eax
jne 0x462cf7
push str.Could_not_find_NtQueryKey_entry_point_in_NTDLL.DLL
jmp 0x462c37
mov edx, dword [0x557e14]
push str.NtEnumerateKey
push edx
call esi
test eax, eax
mov dword [0x554fac], eax
jne 0x462d18
push str.Could_not_find_NtEnumerateKey_entry_point_in_NTDLL.DLL
jmp 0x462c37
mov eax, dword [0x557e14]
push str.NtClose
push eax
call esi
test eax, eax
mov dword [0x554fa8], eax
jne 0x462d38
push str.Could_not_find_NtClose_entry_point_in_NTDLL.DLL
jmp 0x462c37
mov ecx, dword [0x557e14]
push str.NtSetValueKey
push ecx
call esi
test eax, eax
mov dword [0x554fa4], eax
jne 0x462d59
push str.Could_not_find_NTSetValueKey_entry_point_in_NTDLL.DLL
jmp 0x462c37
mov edx, dword [0x557e14]
push str.NtSetInformationKey
push edx
call esi
test eax, eax
mov dword [0x554fa0], eax
jne 0x462d7a
push str.Could_not_find_NtSetInformationKey_entry_point_in_NTDLL.DLL
jmp 0x462c37
mov eax, dword [0x557e14]
push str.NtQueryValueKey
push eax
call esi
test eax, eax
mov dword [0x554f9c], eax
jne 0x462d9a
push str.Could_not_find_NtQueryValueKey_entry_point_in_NTDLL.DLL
jmp 0x462c37
mov ecx, dword [0x557e14]
push str.NtEnumerateValueKey
push ecx
call esi
test eax, eax
mov dword [0x554f98], eax
jne 0x462dbb
push str.Could_not_find_NtEnumerateValueKey_entry_point_in_NTDLL.DLL
jmp 0x462c37
mov edx, dword [0x557e14]
push str.NtDeleteValueKey
push edx
call esi
test eax, eax
mov dword [0x554f94], eax
jne 0x462ddc
push str.Could_not_find_NtDeleteValueKey_entry_point_in_NTDLL.DLL
jmp 0x462c37
mov eax, dword [0x557e14]
push str.NtRenameKey
push eax
call esi
cmp dword [0x554f94], 0
mov dword [0x554f90], eax
jne 0x462e01
push str.Could_not_find_NtRenameKey_entry_point_in_NTDLL.DLL
jmp 0x462c37
mov ecx, dword [0x557e14]
push str.NtQueryMultipleValueKey
push ecx
call esi
test eax, eax
mov dword [0x554f8c], eax
jne 0x462e22
push str.Could_not_find_NtQueryMultipleValueKey_entry_point_in_NTDLL.DLL
jmp 0x462c37
mov edx, dword [0x557e14]
push str.NtNotifyChangeKey
push edx
call esi
test eax, eax
mov dword [0x554f88], eax
jne 0x462e43
push str.Could_not_find_NtNotifyChangeKey_entry_point_in_NTDLL.DLL
jmp 0x462c37
mov eax, dword [0x557e14]
push str.NtCreateFile
push eax
call esi
test eax, eax
mov dword [0x554f84], eax
jne 0x462e63
push str.Could_not_find_NtCreateFile_entry_point_in_NTDLL.DLL
jmp 0x462c37
mov ecx, dword [0x557e14]
push str.NtOpenProcessToken
push ecx
call esi
test eax, eax
mov dword [0x554f80], eax
jne 0x462e84
push str.Could_not_find_NtOpenProcessToken_entry_point_in_NTDLL.DLL
jmp 0x462c37
mov edx, dword [0x557e14]
push str.NtAdjustPrivilegesToken
push edx
call esi
test eax, eax
mov dword [0x554f7c], eax
jne 0x462ea5
push str.Could_not_find_NtAdjustPrivilegesToken_entry_point_in_NTDLL.DLL
jmp 0x462c37
mov eax, dword [0x557e14]
push str.NtQueryInformationToken
push eax
call esi
test eax, eax
mov dword [0x554f78], eax
jne 0x462ec5
push str.Could_not_find_NtQueryInformationToken_entry_point_in_NTDLL.DLL
jmp 0x462c37
mov ecx, dword [0x557e14]
push str.RtlAllocateHeap
push ecx
call esi
test eax, eax
mov dword [0x554f74], eax
jne 0x462ee6
push str.Could_not_find_RtlAllocateHeap_entry_point_in_NTDLL.DLL
jmp 0x462c37
mov edx, dword [0x557e14]
push str.RtlFreeHeap
push edx
call esi
test eax, eax
mov dword [0x554f70], eax
jne 0x462f07
push str.Could_not_find_RtlFreeHeap_entry_point_in_NTDLL.DLL
jmp 0x462c37
mov eax, dword [0x557e14]
push str.NtRestoreKey
push eax
call esi
test eax, eax
mov dword [0x554f6c], eax
jne 0x462f27
push str.Could_not_find_NtRestoreKey_entry_point_in_NTDLL.DLL
jmp 0x462c37
mov ecx, dword [0x557e14]
push str.NtSaveKey
push ecx
call esi
test eax, eax
mov dword [0x554f68], eax
jne 0x462f48
push str.Could_not_find_NtSaveKey_entry_point_in_NTDLL.DLL
jmp 0x462c37
mov edx, dword [0x557e14]
push str.NtLoadKey
push edx
call esi
test eax, eax
mov dword [0x554f64], eax
jne 0x462f69
push str.Could_not_find_NtLoadKey_entry_point_in_NTDLL.DLL
jmp 0x462c37
mov eax, dword [0x557e14]
push str.NtLoadKey2
push eax
call esi
test eax, eax
mov dword [0x554f60], eax
jne 0x462f89
push str.Could_not_find_NtLoadKey2_entry_point_in_NTDLL.DLL
jmp 0x462c37
mov ecx, dword [0x557e14]
push str.NtReplaceKey
push ecx
call esi
test eax, eax
mov dword [0x554f5c], eax
jne 0x462faa
push str.Could_not_find_NtReplaceKey_entry_point_in_NTDLL.DLL
jmp 0x462c37
mov edx, dword [0x557e14]
push str.NtUnloadKey
push edx
call esi
test eax, eax
mov dword [0x554f58], eax
jne 0x462fcb
push str.Could_not_find_NtUnloadKey_entry_point_in_NTDLL.DLL
jmp 0x462c37
mov eax, dword [0x557e14]
push str.RtlInitString
push eax
call esi
mov ecx, dword [0x557e14]
push str.RtlInitAnsiString
push ecx
mov dword [0x554f54], eax
call esi
mov edx, dword [0x557e14]
push str.RtlInitUnicodeString
push edx
mov dword [0x554f50], eax
call esi
mov dword [0x554f4c], eax
mov eax, dword [0x557e14]
push str.RtlAnsiStringToUnicodeString
push eax
call esi
mov ecx, dword [0x557e14]
push str.RtlUnicodeStringToAnsiString
push ecx
mov dword [0x554f48], eax
call esi
mov edx, dword [0x557e14]
push str.RtlFreeString
push edx
mov dword [0x554f44], eax
call esi
mov dword [0x554f40], eax
mov eax, dword [0x557e14]
push str.RtlFreeAnsiString
push eax
call esi
mov ecx, dword [0x557e14]
push str.RtlFreeUnicodeString
push ecx
mov dword [0x554f3c], eax
call esi
cmp dword [0x554f54], 0
mov dword [0x554f38], eax
je 0x4630a7
cmp dword [0x554f50], 0
je 0x4630a7
cmp dword [0x554f4c], 0
je 0x4630a7
cmp dword [0x554f48], 0
je 0x4630a7
cmp dword [0x554f44], 0
je 0x4630a7
cmp dword [0x554f40], 0
je 0x4630a7
cmp dword [0x554f3c], 0
je 0x4630a7
test eax, eax
jne 0x462c40
call fcn.00463420
mov edx, dword [0x5556a4]
push edx
push str.RegistryUser_s
push 0x5556b0
call fcn.0041d490
add esp, 0xc
lea ecx, [esp + 0xc]
call fcn.0040dab0
mov al, 1
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [esp + 0x10]
push ecx
mov esi, eax
call fcn.00463170
add esp, 4
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 2
call fcn.0043f1c0
mov byte [esp + 0x1c], 0
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x46312b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x1c], 0xffffffff
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x463153
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor al, al
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret