Function at 0x44db48
Capabilities:
Encode data using base64
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
push ebx
push esi
push edi
mov dword [ebp - 0x20], ecx
push ecx
lea ecx, [ebp - 0x70]
call fcn.00435bf3
mov eax, dword [ebp + 8]
xor ebx, ebx
mov byte [ebp - 5], 0xff
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x58], eax
mov dword [ebp - 0xc], ebx
lea eax, [ebp + 8]
push eax
call fcn.0042ebab
mov esi, dword [ebp + 8]
mov ax, word [esi]
cmp ax, 0x2d
pop ecx
mov byte [ebp - 1], bl
mov byte [ebp - 3], bl
mov byte [ebp - 4], bl
mov byte [ebp - 2], bl
mov dword [ebp - 0x2c], ebx
mov cl, 0x2a
jne 0x44db98
mov cl, al
movsx edi, cl
movzx eax, ax
jmp 0x44dcb2
movzx eax, word [esi + 2]
cmp edi, eax
jne 0x44dcba
xor eax, eax
lea ecx, [esi + 4]
mov ax, word [ecx]
mov edx, eax
and dx, 0xffdf
cmp dx, 0x48
je 0x44dcba
call fcn.00402b47
test al, al
jne 0x44dcba
mov esi, ecx
push 1
push esi
push 0x496da8
mov dword [ebp + 8], esi
call fcn.0042fae7
add esp, 0xc
test al, al
lea eax, [ebp + 8]
je 0x44dc31
push eax
add esi, 2
call fcn.0040418b
cmp word [esi], 0x3a
pop ecx
je 0x44dc0a
or dword [ebp - 0x2c], 7
jmp 0x44dcac
lea eax, [ebp - 0x4c]
push eax
inc esi
lea eax, [ebp - 0x5c]
inc esi
push eax
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x5c], esi
call fcn.004369c5
test eax, eax
pop ecx
pop ecx
jle 0x44dcac
mov eax, dword [ebp - 0x4c]
or dword [ebp - 0x2c], eax
jmp 0x44dcac
push 2
push eax
push 0x496da4
call fcn.00435950
add esp, 0xc
test al, al
je 0x44dc4b
mov byte [ebp - 4], 1
jmp 0x44dcac
push 1
lea eax, [ebp + 8]
push eax
push 0x4923a0
call fcn.00435950
add esp, 0xc
test al, al
je 0x44dc68
mov byte [ebp - 2], 3
jmp 0x44dcac
push 2
lea eax, [ebp + 8]
push eax
push 0x496da0
call fcn.00435950
add esp, 0xc
test al, al
je 0x44dc85
or byte [ebp - 2], 1
jmp 0x44dcac
push 2
lea eax, [ebp + 8]
push eax
push 0x496d9c
call fcn.00435950
add esp, 0xc
test al, al
je 0x44dca2
or byte [ebp - 2], 2
jmp 0x44dcac
lea eax, [ebp + 8]
push eax
call fcn.0040418b
pop ecx
mov esi, dword [ebp + 8]
movzx eax, word [esi]
cmp edi, eax
je 0x44dba3
lea ecx, [ebp - 0x30]
call fcn.00433c24
lea ecx, [ebp - 0x64]
call fcn.00433c24
lea ecx, [ebp - 0x28]
call fcn.00433c24
lea ecx, [ebp - 0x3c]
call fcn.00433c24
lea ecx, [ebp - 0x38]
call fcn.00433c24
mov ax, word [esi]
cmp ax, 0x2b
je 0x44dd15
cmp ax, 0x23
je 0x44dd15
cmp ax, 0x40
je 0x44dd15
cmp ax, 0x24
je 0x44dd15
cmp ax, 0x2a
je 0x44dd15
cmp ax, 0x7e
je 0x44dd15
cmp ax, 0x2e
je 0x44dd15
cmp ax, 0x3f
jne 0x44dd2d
mov al, byte [esi]
inc esi
inc esi
cmp al, bl
mov byte [ebp - 1], al
mov dword [ebp + 8], esi
je 0x44dd2d
movzx ecx, word [esi]
movsx eax, al
cmp eax, ecx
je 0x44dd33
cmp word [esi], 0x24
jne 0x44dd3d
mov al, byte [esi]
inc esi
inc esi
mov byte [ebp - 3], al
mov dword [ebp + 8], esi
lea eax, [ebp + 8]
push eax
call fcn.0042ebab
mov eax, dword [ebp + 8]
pop ecx
mov dword [ebp - 0x5c], eax
xor ecx, ecx
jmp 0x44dd65
cmp cx, 0x2c
je 0x44dd6d
cmp cx, 0x3d
je 0x44dd6d
cmp cx, 0x21
je 0x44dd6d
inc eax
inc eax
mov cx, word [eax]
cmp cx, bx
jne 0x44dd51
mov cx, word [eax]
cmp cx, 0x2c
je 0x44dd82
cmp cx, 0x3d
je 0x44dd82
cmp cx, 0x21
jne 0x44dd93
mov cl, byte [eax]
mov word [eax], bx
inc eax
inc eax
cmp cl, bl
mov byte [ebp - 6], cl
mov dword [ebp - 0x24], eax
jne 0x44ddea
inc byte [ebp - 5]
cmp byte [ebp - 5], bl
jg 0x44dde0
mov ecx, dword [ebp - 0x20]
push 1
push ebx
lea eax, [ebp - 0x50]
push eax
push dword [ebp - 0x58]
call fcn.0043c245
mov eax, dword [ebp - 0x50]
lea ecx, [ebp - 0x38]
mov dword [ebp + 8], eax
call fcn.0042eb98
lea ecx, [ebp - 0x3c]
call fcn.0042eb98
lea ecx, [ebp - 0x28]
call fcn.0042eb98
lea ecx, [ebp - 0x64]
call fcn.0042eb98
lea ecx, [ebp - 0x30]
call fcn.0042eb98
jmp 0x44db6f
mov esi, 0x80070057
jmp 0x44eb20
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrW]
push 0x496d94
push dword [ebp + 8]
mov dword [ebp - 0x4c], ebx
call edi
mov esi, eax
cmp esi, ebx
jne 0x44de13
push 0x5c
push ebx
push ebx
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
mov esi, eax
cmp esi, ebx
je 0x44de61
mov ecx, dword [ebp - 0x20]
push 1
push ebx
lea eax, [ebp - 0x30]
push eax
push dword [ebp + 8]
mov word [esi], bx
call fcn.0043c245
push 0x5c
push dword [ebp - 0x30]
call dword [sym.imp.SHLWAPI.dll_StrChrW]
cmp eax, ebx
jne 0x44de41
mov esi, 0x80070057
jmp 0x44eb18
mov ecx, dword [ebp - 0x20]
mov word [eax], bx
inc eax
inc eax
push 1
mov dword [ebp - 0x18], eax
push ebx
lea eax, [ebp - 0x4c]
push eax
add esi, 2
push esi
call fcn.0043c245
mov eax, dword [ebp - 0x4c]
jmp 0x44dee0
push 1
push 0x2c
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x70]
call fcn.0043fb4e
push ebx
lea ecx, [ebp - 0x30]
push ecx
push eax
call fcn.004364f8
add esp, 0xc
push 0x5c
push dword [ebp - 0x30]
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov esi, eax
cmp esi, ebx
je 0x44de37
mov word [esi], bx
inc esi
inc esi
push 0x496d94
push esi
mov dword [ebp - 0x18], esi
call edi
cmp byte [ebp - 2], bl
mov dword [ebp - 0x10], eax
je 0x44deb9
cmp eax, ebx
jne 0x44ded3
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esi + eax*2]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jne 0x44ded3
push 0x5c
push ebx
push esi
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
cmp eax, ebx
mov dword [ebp - 0x10], eax
je 0x44de37
mov eax, dword [ebp - 0x10]
cmp word [eax], bx
je 0x44dee3
mov word [eax], bx
inc eax
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp word [eax], 0x5c
jne 0x44def0
add dword [ebp - 0x10], 2
cmp byte [ebp - 6], 0x2c
jne 0x44df81
push 1
push 0x2c
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x70]
call fcn.0043fb4e
push ebx
lea ecx, [ebp - 0x28]
push ecx
push eax
call fcn.004364f8
mov ecx, dword [ebp - 0x20]
add esp, 0xc
push ebx
lea eax, [ebp - 0x28]
push eax
call fcn.00402c07
cmp byte [ebp - 1], 0x2e
jne 0x44df63
mov eax, dword [ebp - 0x24]
cmp word [eax], 0x2c
jne 0x44df63
add dword [ebp - 0x24], 2
push 1
push 0x2c
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x70]
call fcn.0043fb4e
push ebx
lea ecx, [ebp - 0x38]
push ecx
push eax
call fcn.004364f8
mov ecx, dword [ebp - 0x20]
add esp, 0xc
push ebx
lea eax, [ebp - 0x38]
push eax
call fcn.00402c07
mov eax, dword [ebp - 0x28]
cmp word [eax], bx
jne 0x44e06c
push 0x496d84
lea ecx, [ebp - 0x28]
call fcn.0043de31
jmp 0x44e06c
cmp byte [ebp - 6], 0x21
je 0x44e06c
mov eax, dword [ebp - 0x24]
cmp word [eax], bx
jne 0x44dfa9
cmp byte [ebp - 1], 0x24
je 0x44dfc5
cmp byte [ebp - 1], 0x2a
je 0x44dfa9
cmp byte [ebp - 1], 0x7e
jne 0x44e06c
cmp byte [ebp - 1], 0x24
je 0x44dfc5
cmp byte [ebp - 1], 0x2a
je 0x44dfc5
cmp byte [ebp - 1], 0x7e
je 0x44dfc5
lea eax, [ebp - 0x24]
push eax
call fcn.0042ebab
pop ecx
push dword [ebp - 0x24]
lea ecx, [ebp - 0x48]
call fcn.0043ddc9
mov edx, dword [ebp - 0x48]
lea eax, [ebp + 8]
push eax
mov dword [ebp + 8], edx
call fcn.0042ebab
cmp byte [ebp + 0xc], bl
pop ecx
je 0x44dff0
push edx
lea ecx, [ebp - 0x3c]
call fcn.0043de31
jmp 0x44e000
mov ecx, dword [ebp - 0x20]
push 1
push ebx
lea eax, [ebp - 0x3c]
push eax
push edx
call fcn.0043b011
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xc], eax
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
call fcn.0042ebab
cmp byte [ebp - 1], bl
pop ecx
jne 0x44e04a
push dword [ebp + 8]
push 0x496d7c
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x44e033
mov dword [ebp - 0xc], 0x496134
jmp 0x44e064
mov ecx, dword [ebp + 0xc]
mov ax, word [ecx]
cmp ax, 0x23
je 0x44e045
cmp ax, 0x40
jne 0x44e064
mov dword [ebp - 0xc], ecx
jmp 0x44e064
cmp byte [ebp - 1], 0x23
je 0x44e056
cmp byte [ebp - 1], 0x40
jne 0x44e064
mov eax, dword [ebp + 0xc]
cmp word [eax], bx
mov dword [ebp - 0xc], eax
jne 0x44e064
mov dword [ebp - 0xc], ebx
lea ecx, [ebp - 0x48]
call fcn.0042eb98
mov edi, dword [ebp - 0x30]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str.HKLM
push edi
call esi
test eax, eax
je 0x44e11d
push str.HKEY_LOCAL_MACHINE
push edi
call esi
test eax, eax
je 0x44e11d
push str.HKCU
push edi
call esi
test eax, eax
je 0x44e114
push str.HKEY_CURRENT_USER
push edi
call esi
test eax, eax
je 0x44e114
push str.HKCR
push edi
call esi
test eax, eax
je 0x44e10b
push str.HKEY_CLASSES_ROOT
push edi
call esi
test eax, eax
je 0x44e10b
push 0x496ce0
push edi
call esi
test eax, eax
je 0x44e102
push str.HKEY_USERS
push edi
call esi
test eax, eax
je 0x44e102
push str.HKCC
push edi
call esi
test eax, eax
je 0x44e0f9
push str.HKEY_CURRENT_CONFIG
push edi
call esi
test eax, eax
jne 0x44de37
mov dword [ebp - 0x14], 0x80000005
jmp 0x44e124
mov dword [ebp - 0x14], 0x80000003
jmp 0x44e124
mov dword [ebp - 0x14], 0x80000000
jmp 0x44e124
mov dword [ebp - 0x14], 0x80000001
jmp 0x44e124
mov dword [ebp - 0x14], 0x80000002
mov eax, dword [ebp - 0x28]
cmp word [eax], bx
je 0x44e6f7
cmp byte [ebp - 1], 0x2e
je 0x44e13f
cmp byte [ebp - 1], 0x3f
mov dword [ebp - 0xc], ebx
jne 0x44e14c
cmp byte [ebp - 1], 0x3f
mov dword [ebp - 0xc], 1
je 0x44e15b
cmp dword [ebp - 0xc], ebx
je 0x44e156
cmp word [eax], bx
je 0x44e15b
mov dword [ebp - 0x2c], ebx
jmp 0x44e162
mov dword [ebp - 0x2c], 1
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x64
lea ecx, [ebp + 0xc]
mov dword [ebp - 0x48], ebx
call fcn.00433c42
lea ecx, [ebp - 0x24]
call fcn.00433c24
cmp byte [ebp - 1], 0x2e
lea eax, [ebp - 0x24]
je 0x44e18a
lea eax, [ebp + 0xc]
push 0x1000
lea ecx, [ebp + 8]
mov dword [ebp - 0x1c], eax
call fcn.00433b18
cmp byte [ebp - 2], bl
mov dword [ebp - 0x34], 0xfff
mov dword [ebp - 0x40], ebx
je 0x44e31d
lea eax, [ebp - 0x2c]
push eax
push 9
push ebx
push dword [ebp - 0x18]
mov dword [ebp - 0xc], ebx
push dword [ebp - 0x14]
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x2c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push ebx
push ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x40]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x2c]
call esi
push ebx
push ebx
push ebx
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x44]
push eax
push ebx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x40]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x2c]
call esi
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x10], eax
jae 0x44e218
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
lea eax, [eax*4 + 0x20]
mov dword [ebp - 0x58], eax
shr eax, 1
add eax, 8
push eax
lea ecx, [ebp - 0x5c]
call fcn.00433c42
cmp byte [ebp - 2], 3
mov esi, dword [ebp - 0x5c]
mov word [esi], 0xd
mov word [esi + 2], 0xa
lea eax, [esi + 4]
mov word [eax], 0x76
lea edi, [esi + 8]
mov word [esi + 6], 0x20
mov dword [ebp - 0x14], eax
mov word [edi], bx
je 0x44e261
lea edi, [esi + 4]
cmp dword [ebp - 0x18], ebx
jne 0x44e302
test byte [ebp - 2], 1
je 0x44e2b3
cmp dword [ebp - 0x44], ebx
mov dword [ebp - 0x18], ebx
jle 0x44e2b3
mov eax, dword [ebp - 0x58]
push ebx
push ebx
push ebx
push ebx
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebp - 0x18]
mov word [edi], bx
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x44e2a8
push dword [ebp - 0x14]
lea ecx, [ebp + 0xc]
call fcn.00433c92
mov dword [ebp - 0x14], esi
inc dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x44]
jl 0x44e278
test byte [ebp - 2], 2
mov word [esi + 4], 0x6b
je 0x44e302
cmp dword [ebp - 0x40], ebx
mov dword [ebp - 0x18], ebx
jle 0x44e302
mov eax, dword [ebp - 0x58]
push ebx
push ebx
push ebx
push ebx
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebp - 0x18]
mov word [edi], bx
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x44e2f7
push dword [ebp - 0x14]
lea ecx, [ebp + 0xc]
call fcn.00433c92
mov dword [ebp - 0x14], esi
inc dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x40]
jl 0x44e2c7
cmp dword [ebp - 0x2c], ebx
je 0x44e310
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x5c]
call fcn.0042eb98
jmp 0x44e6ad
mov edi, dword [ebp - 0x10]
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp + 8]
push eax
push edi
push dword [ebp - 0x18]
push dword [ebp - 0x14]
call fcn.00437907
mov esi, eax
add esp, 0x18
cmp esi, ebx
jge 0x44e3aa
cmp word [edi], bx
jne 0x44e365
cmp dword [ebp - 0x40], 2
jne 0x44e365
cmp esi, 0xfffffffe
jne 0x44e365
cmp dword [ebp - 0xc], ebx
je 0x44e6ad
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0x496c90
jmp 0x44e380
mov esi, dword [ebp - 0x40]
cmp esi, ebx
jne 0x44e36f
xor esi, esi
inc esi
cmp dword [ebp - 0xc], ebx
mov dword [ebp - 0x48], esi
je 0x44e38d
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.ERROR
mov ecx, dword [ebp - 0x1c]
call fcn.00433ce1
jmp 0x44e6ad
lea ecx, [ebp + 8]
call fcn.0042eb98
lea ecx, [ebp - 0x24]
call fcn.0042eb98
lea ecx, [ebp + 0xc]
call fcn.0042eb98
jmp 0x44eb18
cmp esi, 1
jne 0x44e40d
cmp dword [ebp - 0xc], ebx
je 0x44e3ce
mov ecx, dword [ebp - 0x1c]
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_SZ
call fcn.00433ce1
cmp dword [ebp - 0x2c], ebx
jne 0x44e6ad
cmp byte [ebp - 1], 0x24
je 0x44e3fc
cmp byte [ebp - 1], 0x2e
je 0x44e3fc
cmp byte [ebp - 1], bl
je 0x44e3fc
lea ecx, [ebp + 8]
call fcn.0042eb98
lea ecx, [ebp - 0x24]
call fcn.0042eb98
lea ecx, [ebp + 0xc]
call fcn.0042eb98
jmp 0x44de37
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [ebp + 0xc], ecx
mov dword [ebp + 8], eax
jmp 0x44e6ad
cmp esi, 0xb
jne 0x44e45a
cmp dword [ebp - 0xc], ebx
je 0x44e431
mov ecx, dword [ebp - 0x1c]
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_QWORD
call fcn.00433ce1
cmp dword [ebp - 0x2c], ebx
jne 0x44e6ad
cmp byte [ebp - 1], 0x2b
je 0x44e43d
cmp byte [ebp - 1], 0x2e
jne 0x44e3df
mov eax, dword [ebp + 8]
push str.0x_I64x
push dword [eax + 4]
push dword [eax]
push dword [ebp + 0xc]
call fcn.00470d8d
add esp, 0x10
jmp 0x44e6ad
cmp esi, 4
jne 0x44e4a9
cmp dword [ebp - 0xc], ebx
je 0x44e47e
mov ecx, dword [ebp - 0x1c]
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_DWORD
call fcn.00433ce1
cmp dword [ebp - 0x2c], ebx
jne 0x44e6ad
cmp byte [ebp - 1], 0x23
je 0x44e48e
cmp byte [ebp - 1], 0x2e
jne 0x44e3df
mov eax, dword [ebp + 8]
push dword [eax]
push str.0x_x
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x44e6ad
cmp esi, 3
jne 0x44e54a
cmp dword [ebp - 0xc], ebx
je 0x44e4d1
mov ecx, dword [ebp - 0x1c]
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_BINARY
call fcn.00433ce1
cmp dword [ebp - 0x2c], ebx
jne 0x44e6ad
cmp byte [ebp - 1], 0x40
je 0x44e4e1
cmp byte [ebp - 1], 0x2e
jne 0x44e3df
mov eax, dword [ebp - 0x34]
lea eax, [eax + eax*4 + 6]
push eax
lea ecx, [ebp + 0xc]
call fcn.00433c6b
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov word [edi], bx
cmp dword [ebp - 0x34], ebx
jle 0x44e513
movzx eax, byte [esi]
push eax
push str.0x_02X
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
inc esi
add edi, 8
mov dword [ebp - 0x44], edi
xor edi, edi
inc edi
cmp dword [ebp - 0x34], edi
jle 0x44e6ad
movzx eax, byte [esi]
push eax
push str._0x_02X
push dword [ebp - 0x44]
call dword [sym.imp.USER32.dll_wsprintfW]
add dword [ebp - 0x44], 0xa
add esp, 0xc
inc esi
inc edi
cmp edi, dword [ebp - 0x34]
jl 0x44e525
jmp 0x44e6ad
cmp esi, 2
jne 0x44e59e
cmp dword [ebp - 0xc], ebx
je 0x44e56e
mov ecx, dword [ebp - 0x1c]
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_EXPAND_SZ
call fcn.00433ce1
cmp dword [ebp - 0x2c], ebx
jne 0x44e6ad
cmp byte [ebp - 1], 0x7e
je 0x44e57e
cmp byte [ebp - 1], 0x2e
jne 0x44e3df
cmp byte [ebp - 3], bl
je 0x44e3fc
mov ecx, dword [ebp - 0x20]
push 1
push ebx
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
call fcn.0043c245
jmp 0x44e6ad
cmp esi, 7
jne 0x44e676
cmp dword [ebp - 0xc], ebx
je 0x44e5c6
mov ecx, dword [ebp - 0x1c]
push 0xffffffffffffffff
push 0xffffffffffffffff
push str.REG_MULTI_SZ
call fcn.00433ce1
cmp dword [ebp - 0x2c], ebx
jne 0x44e6ad
cmp byte [ebp - 1], 0x2a
je 0x44e5d6
cmp byte [ebp - 1], 0x2e
jne 0x44e3df
mov esi, dword [ebp - 0x34]
shr esi, 1
lea eax, [esi*4 + 6]
push eax
lea ecx, [ebp + 0xc]
call fcn.00433c6b
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
lea esi, [edi + esi*2]
cmp edi, esi
mov dword [ebp - 0x5c], esi
jae 0x44e671
push 2
pop esi
cmp byte [ebp - 3], 0x2a
jne 0x44e636
cmp word [edi], 0x5c
jne 0x44e636
lea ecx, [edi + 2]
mov dx, word [ecx]
cmp dx, 0x30
je 0x44e621
cmp dx, 0x5c
je 0x44e621
cmp dx, bx
jne 0x44e636
mov edi, ecx
mov word [eax], 0x5c
mov cx, word [edi]
add eax, esi
mov word [eax], cx
add eax, esi
add edi, esi
jmp 0x44e66c
mov cx, word [edi]
cmp cx, bx
jne 0x44e62d
add edi, esi
cmp byte [ebp - 3], 0x24
jne 0x44e65e
cmp edi, dword [ebp - 0x5c]
jae 0x44e671
cmp word [edi], bx
je 0x44e671
mov word [eax], 0xd
add eax, esi
mov word [eax], 0xa
jmp 0x44e66a
mov word [eax], 0x5c
add eax, esi
mov word [eax], 0x30
add eax, esi
cmp edi, dword [ebp - 0x5c]
jb 0x44e5fe
mov word [eax], bx
jmp 0x44e6ad
cmp dword [ebp - 0xc], ebx
je 0x44e69d
mov edi, dword [ebp - 0x1c]
push 0x32
mov ecx, edi
call fcn.00433c6b
push esi
push 0x495b38
push dword [edi]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
cmp dword [ebp - 0x2c], ebx
jne 0x44e6ad
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jne 0x44e6aa
xor eax, eax
inc eax
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x28]
cmp word [eax], bx
je 0x44e6c1
push dword [ebp + 0xc]
mov ecx, dword [ebp - 0x20]
push eax
call fcn.004335ed
mov eax, dword [ebp - 0x38]
cmp word [eax], bx
je 0x44e6d7
mov ecx, dword [ebp - 0x1c]
push dword [ecx]
mov ecx, dword [ebp - 0x20]
push eax
call fcn.004335ed
lea ecx, [ebp + 8]
call fcn.0042eb98
lea ecx, [ebp - 0x24]
call fcn.0042eb98
lea ecx, [ebp + 0xc]
call fcn.0042eb98
mov esi, dword [ebp - 0x48]
jmp 0x44eb18
mov esi, dword [ebp - 0xc]
cmp esi, ebx
je 0x44ea90
mov al, byte [ebp - 1]
cmp al, 0x2b
je 0x44e71b
cmp al, bl
jne 0x44e767
mov ax, word [esi]
cmp ax, 0x2b
jne 0x44e795
inc esi
inc esi
mov dword [ebp - 0xc], esi
cmp byte [ebp - 4], bl
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
je 0x44ea56
xor ecx, ecx
mov cx, word [esi]
mov eax, ecx
call fcn.0043384b
test al, al
je 0x44de37
cmp cx, 0x30
jne 0x44e755
mov ax, word [esi + 2]
or ax, 0x20
cmp ax, 0x78
jne 0x44e755
add esi, 4
push esi
call fcn.0043466b
pop ecx
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], edx
jmp 0x44ea70
cmp al, 0x23
je 0x44e7a0
cmp al, 0x40
je 0x44e7f5
cmp al, 0x2a
je 0x44e882
cmp al, 0x7e
je 0x44e93d
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
push eax
push esi
push 1
jmp 0x44ea78
cmp ax, 0x23
jne 0x44e7e6
inc esi
inc esi
mov dword [ebp - 0xc], esi
cmp byte [ebp - 4], bl
mov dword [ebp + 0xc], ebx
je 0x44ea32
xor ecx, ecx
mov cx, word [esi]
mov eax, ecx
call fcn.0043384b
test al, al
je 0x44de37
cmp cx, 0x30
jne 0x44e7d7
mov ax, word [esi + 2]
or ax, 0x20
cmp ax, 0x78
jne 0x44e7d7
add esi, 4
push esi
call fcn.0043466b
pop ecx
mov dword [ebp + 0xc], eax
jmp 0x44ea4c
cmp ax, 0x40
jne 0x44e873
inc esi
inc esi
mov dword [ebp - 0xc], esi
push esi
xor edi, edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
push esi
lea ecx, [ebp + 0xc]
call fcn.00433b18
lea eax, [ebp - 0xc]
push eax
call fcn.0042ebab
cmp esi, ebx
pop ecx
jle 0x44ea0c
mov eax, dword [ebp - 0xc]
mov cx, word [eax]
cmp cx, bx
je 0x44ea0c
cmp byte [ebp - 4], bl
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
je 0x44e9eb
cmp cx, 0x30
jne 0x44e853
mov cx, word [eax + 2]
or cx, 0x20
cmp cx, 0x78
jne 0x44e853
add eax, 4
mov dword [ebp - 0xc], eax
push 2
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.00434730
lea eax, [ebp - 0xc]
push eax
call fcn.0042ebab
add esp, 0x10
jmp 0x44e9fa
cmp ax, 0x2a
jne 0x44e931
inc esi
inc esi
mov dword [ebp - 0xc], esi
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
lea eax, [edi + 0x10]
push eax
lea ecx, [ebp + 8]
mov dword [ebp + 0xc], ebx
call fcn.00433c42
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
lea edi, [eax + edi*2]
cmp eax, edi
jae 0x44e8e6
cmp byte [ebp - 3], 0x2a
mov word [edx], bx
jne 0x44e9a6
cmp word [eax], 0x5c
jne 0x44e9c9
lea ecx, [eax + 2]
cmp word [ecx], 0x5c
jne 0x44e9c9
mov eax, ecx
mov cx, word [eax]
mov word [edx], cx
inc edx
inc edx
inc eax
inc eax
mov dword [ebp + 0xc], ebx
cmp eax, edi
jb 0x44e8a9
cmp dword [ebp + 0xc], 2
jge 0x44e901
push 2
pop esi
sub esi, dword [ebp + 0xc]
xor eax, eax
mov ecx, esi
shr ecx, 1
mov edi, edx
rep stosd dword es:[edi], eax
adc ecx, ecx
add dword [ebp + 0xc], esi
rep stosw word es:[edi], ax
lea edx, [edx + esi*2]
push 2
pop eax
sub eax, dword [ebp + 0xc]
lea eax, [edx + eax*2]
mov word [eax], bx
sub eax, dword [ebp + 8]
push eax
push dword [ebp + 8]
push 7
push dword [ebp - 0x10]
push dword [ebp - 0x18]
push dword [ebp - 0x14]
call fcn.0042f97c
add esp, 0x18
mov esi, eax
lea ecx, [ebp + 8]
jmp 0x44e3a0
cmp ax, 0x7e
jne 0x44e783
inc esi
inc esi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
push eax
lea ecx, [ebp + 0xc]
call fcn.00433c42
cmp word [esi], bx
mov eax, dword [ebp + 0xc]
mov ecx, esi
je 0x44e97e
mov dx, word [ecx]
cmp dx, 0x5c
jne 0x44e972
cmp word [ecx + 2], 0x30
jne 0x44e972
mov word [eax], bx
inc eax
inc eax
add ecx, 4
jmp 0x44e979
mov word [eax], dx
inc eax
inc eax
inc ecx
inc ecx
cmp word [ecx], bx
jne 0x44e958
mov word [eax], bx
sub eax, dword [ebp + 0xc]
sar eax, 1
shl eax, 1
push eax
push dword [ebp + 0xc]
push 2
push dword [ebp - 0x10]
push dword [ebp - 0x18]
push dword [ebp - 0x14]
call fcn.0042f97c
add esp, 0x18
mov esi, eax
jmp 0x44e39d
cmp byte [ebp - 3], 0x24
jne 0x44e9c9
cmp word [eax], 0xd
jne 0x44e9c9
cmp word [eax + 2], 0xa
jne 0x44e9c9
add eax, 4
mov word [edx], bx
inc edx
inc edx
inc dword [ebp + 0xc]
jmp 0x44e8dc
mov cx, word [eax]
cmp cx, 0x5c
jne 0x44e8d2
cmp word [eax + 2], 0x30
jne 0x44e8d2
mov word [edx], bx
inc edx
inc edx
add eax, 4
jmp 0x44e9c1
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.004369a1
pop ecx
pop ecx
mov al, byte [ebp - 0x60]
mov ecx, dword [ebp + 0xc]
mov byte [ecx + edi], al
inc edi
cmp edi, esi
jl 0x44e81b
push edi
push dword [ebp + 0xc]
push 3
push dword [ebp - 0x10]
push dword [ebp - 0x18]
push dword [ebp - 0x14]
call fcn.0042f97c
add esp, 0x18
lea ecx, [ebp + 0xc]
mov esi, eax
call fcn.0042eb98
jmp 0x44eb18
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.004369c5
xor esi, esi
inc esi
cmp eax, esi
pop ecx
pop ecx
jl 0x44eb18
push 4
lea eax, [ebp + 0xc]
push eax
push 4
jmp 0x44ea78
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.004369a1
xor esi, esi
inc esi
cmp eax, esi
pop ecx
pop ecx
jl 0x44eb18
push 8
lea eax, [ebp - 0x60]
push eax
push 0xb
push dword [ebp - 0x10]
push dword [ebp - 0x18]
push dword [ebp - 0x14]
call fcn.0042f97c
add esp, 0x18
mov esi, eax
jmp 0x44eb18
cmp byte [ebp - 6], 0x21
jne 0x44eac2
mov eax, dword [ebp - 0x10]
cmp word [eax], bx
jne 0x44eac2
cmp dword [ebp - 0x2c], ebx
je 0x44eab3
push dword [ebp - 0x2c]
push dword [ebp - 0x18]
push dword [ebp - 0x14]
call fcn.004357fa
jmp 0x44eb0c
push dword [ebp - 0x18]
push dword [ebp - 0x14]
call fcn.0043f173
pop ecx
pop ecx
jmp 0x44eb0f
cmp dword [ebp - 0x2c], ebx
je 0x44eafe
push ebx
lea eax, [ebp + 0xc]
push eax
movzx eax, word [0x4a6b68]
push ebx
or eax, 0x2001b
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x18]
mov dword [ebp + 0xc], ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp dword [ebp + 0xc], ebx
mov esi, eax
je 0x44eb11
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x44eb11
push dword [ebp - 0x10]
push dword [ebp - 0x18]
push dword [ebp - 0x14]
call fcn.0042f9f3
add esp, 0xc
mov esi, eax
cmp esi, 2
jne 0x44eb18
xor esi, esi
lea ecx, [ebp - 0x4c]
call fcn.0042eb98
lea ecx, [ebp - 0x38]
call fcn.0042eb98
lea ecx, [ebp - 0x3c]
call fcn.0042eb98
lea ecx, [ebp - 0x28]
call fcn.0042eb98
lea ecx, [ebp - 0x64]
call fcn.0042eb98
lea ecx, [ebp - 0x30]
call fcn.0042eb98
lea ecx, [ebp - 0x50]
call fcn.0042eb98
lea ecx, [ebp - 0x70]
call fcn.0042eb98
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8