Function at 0x456be0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6b9f90
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x76a02c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x74], 0
mov dword [ebp - 4], 0
call fcn.004224e0
mov ecx, eax
test ecx, ecx
je 0x458152
mov eax, dword [ecx]
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x60], edi
mov byte [ebp - 4], 1
call fcn.004224e0
mov ecx, eax
test ecx, ecx
je 0x45815c
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x48], esi
mov ecx, dword [ebp - 0x44]
mov byte [ebp - 4], 2
mov dword [ebp - 0x68], 1
call fcn.00429210
mov eax, dword [ebp - 0x44]
add eax, 4
mov ecx, eax
mov dword [ebp - 0x40], eax
call fcn.00429210
mov eax, dword [ebp - 0x44]
add eax, 8
mov ecx, eax
mov dword [ebp - 0x70], eax
call fcn.00429210
mov eax, dword [ebp - 0x44]
add eax, 0xc
mov ecx, eax
mov dword [ebp - 0x50], eax
call fcn.00429210
mov eax, dword [ebp - 0x44]
add eax, 0x10
mov ecx, eax
mov dword [ebp - 0x4c], eax
call fcn.00429210
mov eax, dword [ebp - 0x44]
add eax, 0x14
mov ecx, eax
mov dword [ebp - 0x64], eax
call fcn.00429210
mov ecx, dword [ebp - 0x44]
lea ecx, [ecx + 0x18]
call fcn.00429210
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x34]
mov dword [ecx + 0x20], 0
mov dword [ecx + 0x1c], eax
test ebx, ebx
jne 0x456cf0
xor ecx, ecx
jmp 0x456d04
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x456cf5
sub ecx, edx
sar ecx, 1
push ecx
mov ecx, dword [ebp - 0x44]
push ebx
lea ecx, [ecx + 0x18]
call fcn.00429270
push 0x20119
push ebx
push dword [ebp - 0x34]
lea ecx, [ebp - 0x7c]
call fcn.0044f790
test eax, eax
jne 0x456e0a
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x80]
mov dword [ebp - 0x34], 4
push eax
lea eax, [ebp - 0x3c]
push eax
push 0
push 0x74a26c
push dword [ebp - 0x7c]
call ebx
test eax, eax
jne 0x456d63
cmp dword [ebp - 0x3c], 4
jne 0x456d63
cmp dword [ebp - 0x80], 1
je 0x456e0a
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x38], 0x1000
call fcn.00429210
mov edx, dword [ebp - 0x38]
test edx, edx
js 0x458166
mov edi, dword [ebp - 0x60]
mov ecx, 1
mov eax, dword [edi - 8]
sub ecx, dword [edi - 4]
sub eax, edx
or eax, ecx
jge 0x456da0
push edx
lea ecx, [ebp - 0x60]
call fcn.0041f730
mov edx, dword [ebp - 0x38]
mov edi, dword [ebp - 0x60]
lea eax, [edx + edx]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x34]
push eax
push edi
lea eax, [ebp - 0x3c]
push eax
push 0
push str.ParentKeyName
push dword [ebp - 0x7c]
call ebx
test eax, eax
jne 0x456de8
mov eax, dword [ebp - 0x3c]
cmp eax, 1
je 0x456dcc
cmp eax, 2
jne 0x456de8
mov ecx, dword [ebp - 0x34]
test edi, edi
je 0x456e02
test ecx, ecx
je 0x456dfd
test cl, 1
jne 0x456de8
mov eax, ecx
shr eax, 1
cmp word [edi + eax*2 - 2], 0
je 0x456e02
lea ecx, [ebp - 0x60]
call fcn.00429210
mov edx, dword [ebp - 0x38]
test edx, edx
js 0x458170
jmp 0x456e75
xor eax, eax
mov word [edi], ax
shr ecx, 1
mov dword [ebp - 0x38], ecx
mov edi, dword [ebp - 0x60]
mov dword [ebp - 0x68], 0
or ebx, 0xffffffff
mov byte [ebp - 4], 1
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x456e2f
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x456e48
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x7c]
test eax, eax
je 0x456e56
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00468d3e
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x60]
mov ecx, 1
mov eax, dword [edi - 8]
sub ecx, dword [edi - 4]
sub eax, edx
or eax, ecx
jge 0x456e98
push edx
lea ecx, [ebp - 0x60]
call fcn.0041f730
mov edx, dword [ebp - 0x38]
mov edi, dword [ebp - 0x60]
lea eax, [edx + edx]
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x34]
push eax
push edi
lea eax, [ebp - 0x3c]
push eax
push 0
push str.ReleaseType
push dword [ebp - 0x7c]
call ebx
test eax, eax
jne 0x456ef3
mov eax, dword [ebp - 0x3c]
cmp eax, 1
je 0x456ecb
cmp eax, 2
jne 0x456ef3
mov ecx, dword [ebp - 0x34]
test edi, edi
je 0x456eee
test ecx, ecx
je 0x456ee9
test cl, 1
jne 0x456ef3
mov eax, ecx
shr eax, 1
cmp word [edi + eax*2 - 2], 0
je 0x456eee
jmp 0x456ef3
xor eax, eax
mov word [edi], ax
shr ecx, 1
mov dword [ebp - 0x38], ecx
push dword [edi - 8]
push edi
call fcn.005418c8
add esp, 8
test eax, eax
js 0x458166
cmp eax, dword [edi - 8]
jg 0x458166
xor ecx, ecx
mov dword [edi - 0xc], eax
push str.Service_Pack
push edi
mov word [edi + eax*2], cx
call fcn.00533ea4
add esp, 8
test eax, eax
je 0x456e07
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 4
push eax
lea eax, [ebp - 0x80]
xor edi, edi
push eax
lea eax, [ebp - 0x54]
mov dword [ebp - 0x3c], edi
push eax
push edi
push str.WindowsInstaller
push dword [ebp - 0x7c]
call ebx
test eax, eax
jne 0x456f6b
cmp dword [ebp - 0x54], 4
jne 0x456f6b
cmp dword [ebp - 0x80], 1
mov eax, 1
cmove edi, eax
mov dword [ebp - 0x3c], edi
mov eax, dword [ebp - 0x44]
mov edx, 0x1000
mov dword [ebp - 0x38], edx
mov ecx, 1
mov edi, dword [eax]
mov eax, dword [edi - 8]
sub ecx, dword [edi - 4]
sub eax, edx
or eax, ecx
jge 0x456f99
mov edi, dword [ebp - 0x44]
mov ecx, edi
push edx
call fcn.0041f730
mov edi, dword [edi]
mov edx, dword [ebp - 0x38]
lea eax, [edx + edx]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x34]
push eax
push edi
lea eax, [ebp - 0x54]
push eax
push 0
push str.DisplayName
push dword [ebp - 0x7c]
call ebx
test eax, eax
jne 0x456fed
mov eax, dword [ebp - 0x54]
cmp eax, 1
je 0x456fc5
cmp eax, 2
jne 0x456fed
mov ecx, dword [ebp - 0x34]
test edi, edi
je 0x45707c
test ecx, ecx
je 0x457077
test cl, 1
jne 0x456fed
mov eax, ecx
shr eax, 1
cmp word [edi + eax*2 - 2], 0
je 0x45707c
mov edx, dword [ebp - 0x44]
mov ecx, 1
mov edi, dword [edx]
mov eax, dword [edi - 8]
sub ecx, dword [edi - 4]
sub eax, 0x1000
or eax, ecx
jge 0x457017
push 0x1000
mov ecx, edx
call fcn.0041f730
mov eax, dword [ebp - 0x44]
mov edi, dword [eax]
mov eax, dword [ebp - 0x38]
add eax, eax
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x34]
push eax
push edi
lea eax, [ebp - 0x54]
push eax
push 0
push str.DisplayName1
push dword [ebp - 0x7c]
call ebx
test eax, eax
jne 0x457068
mov eax, dword [ebp - 0x54]
cmp eax, 1
je 0x45704c
cmp eax, 2
jne 0x457068
mov ecx, dword [ebp - 0x34]
test edi, edi
je 0x45707c
test ecx, ecx
je 0x457077
test cl, 1
jne 0x457068
mov eax, ecx
shr eax, 1
cmp word [edi + eax*2 - 2], 0
je 0x45707c
mov dword [ebp - 0x68], 0
mov edi, dword [ebp - 0x60]
jmp 0x456e11
xor eax, eax
mov word [edi], ax
mov edi, dword [ebp - 0x44]
shr ecx, 1
mov dword [ebp - 0x38], ecx
mov eax, dword [edi]
test eax, eax
jne 0x45708e
xor ecx, ecx
jmp 0x4570a4
push dword [eax - 8]
push eax
call fcn.005418c8
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x458166
mov eax, dword [edi]
cmp ecx, dword [eax - 8]
jg 0x458166
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [edi]
mov word [eax + ecx*2], dx
mov eax, dword [edi]
cmp dword [eax - 0xc], edx
jne 0x4570cc
mov edi, dword [ebp - 0x60]
mov dword [ebp - 0x68], edx
jmp 0x456e11
mov edi, dword [edi + 0x14]
mov edx, 0x1000
mov dword [ebp - 0x38], edx
mov ecx, 1
mov eax, dword [edi - 8]
sub ecx, dword [edi - 4]
sub eax, edx
or eax, ecx
jge 0x4570f8
mov edi, dword [ebp - 0x64]
mov ecx, edi
push edx
call fcn.0041f730
mov edi, dword [edi]
mov edx, dword [ebp - 0x38]
lea eax, [edx + edx]
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x34]
push eax
push edi
lea eax, [ebp - 0x54]
push eax
push 0
push str.UninstallString
push dword [ebp - 0x7c]
call ebx
test eax, eax
jne 0x457068
mov eax, dword [ebp - 0x54]
cmp eax, 1
je 0x457133
cmp eax, 2
jne 0x457068
mov ecx, dword [ebp - 0x34]
test edi, edi
je 0x457167
test ecx, ecx
je 0x457162
test cl, 1
jne 0x457068
mov eax, ecx
shr eax, 1
cmp word [edi + eax*2 - 2], 0
je 0x457167
mov edi, dword [ebp - 0x60]
mov dword [ebp - 0x68], 0
jmp 0x456e11
xor eax, eax
mov word [edi], ax
mov ebx, dword [ebp - 0x64]
shr ecx, 1
mov dword [ebp - 0x38], ecx
mov eax, dword [ebx]
test eax, eax
jne 0x457179
xor ecx, ecx
jmp 0x45718f
push dword [eax - 8]
push eax
call fcn.005418c8
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x458166
mov eax, dword [ebx]
cmp ecx, dword [eax - 8]
jg 0x458166
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [ebx]
mov word [eax + ecx*2], dx
mov edx, dword [ebx]
cmp dword [edx - 0xc], 0
je 0x457068
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x1000
or eax, ecx
jge 0x4571db
push 0x1000
lea ecx, [ebp - 0x48]
call fcn.0041f730
mov eax, dword [ebp - 0x44]
mov esi, dword [ebp - 0x48]
mov edx, dword [eax + 0x14]
push 0x1000
push esi
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x457268
push dword [esi - 8]
push esi
call fcn.005418c8
add esp, 8
test eax, eax
js 0x458166
cmp eax, dword [esi - 8]
jg 0x458166
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
lea ecx, [esi - 0x10]
mov edi, dword [ebx]
sub edi, 0x10
cmp ecx, edi
je 0x457268
cmp dword [edi + 0xc], 0
lea ebx, [edi + 0xc]
jl 0x45725a
mov eax, dword [ecx]
cmp eax, dword [edi]
jne 0x45725a
push ecx
call fcn.00428ba0
add esp, 4
mov dword [ebp - 0x54], eax
or ecx, 0xffffffff
lock xadd dword [ebx], ecx
dec ecx
test ecx, ecx
jg 0x457250
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x54]
mov ebx, dword [ebp - 0x64]
add eax, 0x10
mov dword [ebx], eax
jmp 0x457268
push dword [esi - 0xc]
mov ebx, dword [ebp - 0x64]
mov ecx, ebx
push esi
call fcn.00429270
cmp dword [ebp - 0x3c], 0
je 0x4577b9
call fcn.004224e0
mov ecx, eax
test ecx, ecx
je 0x45817a
mov eax, dword [ecx]
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x34], edi
mov byte [ebp - 4], 3
call fcn.004224e0
mov ecx, eax
test ecx, ecx
je 0x458184
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x3c], eax
mov byte [ebp - 4], 4
mov ecx, dword [ebx]
lea ebx, [eax - 0x10]
lea edx, [ecx - 0x10]
cmp edx, ebx
je 0x457300
cmp dword [ebx + 0xc], 0
jl 0x4572f4
mov eax, dword [edx]
cmp eax, dword [ebx]
jne 0x4572f4
push edx
call fcn.00428ba0
add esp, 4
mov dword [ebp - 0x54], eax
or ecx, 0xffffffff
lea edx, [ebx + 0xc]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4572ec
mov ecx, dword [ebx]
push ebx
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x54]
add eax, 0x10
mov dword [ebp - 0x3c], eax
jmp 0x457300
push dword [ecx - 0xc]
push ecx
lea ecx, [ebp - 0x3c]
call fcn.00429270
lea ecx, [ebp - 0x3c]
call fcn.00432460
mov eax, dword [ebp - 0x3c]
cmp dword [eax - 0xc], 0
jl 0x457774
push str.msiexec.exe
push eax
call fcn.0052fa1d
mov ecx, eax
add esp, 8
mov eax, dword [ebp - 0x3c]
test ecx, ecx
je 0x457774
sub ecx, eax
sar ecx, 1
js 0x457774
mov ebx, dword [ebp - 0x64]
mov ecx, dword [ebx]
cmp dword [ecx - 0xc], 0
jle 0x45776d
push 0x7b
push ecx
call fcn.0053018b
mov ecx, eax
add esp, 8
test ecx, ecx
je 0x45776a
mov eax, dword [ebx]
sub ecx, eax
sar ecx, 1
js 0x45776a
mov eax, dword [eax - 0xc]
sub eax, ecx
push eax
push ecx
lea eax, [ebp - 0x54]
mov ecx, ebx
push eax
call fcn.00452850
mov byte [ebp - 4], 5
lea edx, [edi - 0x10]
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x84], edx
lea ebx, [eax - 0x10]
cmp ebx, edx
je 0x4573e2
cmp dword [edx + 0xc], 0
lea edi, [edx + 0xc]
jl 0x4573d3
mov ecx, dword [ebx]
cmp ecx, dword [edx]
jne 0x4573d3
push ebx
call fcn.00428ba0
add esp, 4
mov dword [ebp - 0x58], eax
or ecx, 0xffffffff
lock xadd dword [edi], ecx
dec ecx
test ecx, ecx
jg 0x4573cb
mov edi, dword [ebp - 0x84]
push edi
mov ecx, dword [edi]
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x58]
lea edi, [eax + 0x10]
mov dword [ebp - 0x34], edi
jmp 0x4573e2
push dword [eax - 0xc]
lea ecx, [ebp - 0x34]
push eax
call fcn.00429270
mov edi, dword [ebp - 0x34]
mov byte [ebp - 4], 4
or eax, 0xffffffff
lock xadd dword [ebx + 0xc], eax
dec eax
test eax, eax
jg 0x4573fb
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x7d
push edi
call fcn.0052fcca
add esp, 8
test eax, eax
je 0x457757
sub eax, edi
sar eax, 1
js 0x457757
lea ebx, [eax + 1]
test ebx, ebx
js 0x45818e
mov eax, dword [edi - 8]
mov ecx, 1
sub ecx, dword [edi - 4]
sub eax, ebx
or eax, ecx
jge 0x457440
push ebx
lea ecx, [ebp - 0x34]
call fcn.0041f730
mov edi, dword [ebp - 0x34]
cmp ebx, dword [edi - 8]
jg 0x458166
mov dword [edi - 0xc], ebx
xor eax, eax
mov word [edi + ebx*2], ax
mov ecx, 1
mov ebx, dword [ebp - 0x40]
mov dword [ebp - 0x38], 0x1000
mov edx, dword [ebx]
mov eax, dword [edx - 8]
sub ecx, dword [edx - 4]
sub eax, 0x1000
or eax, ecx
jge 0x457480
push 0x1000
mov ecx, ebx
call fcn.0041f730
mov edx, dword [ebx]
mov ebx, dword [sym.imp.msi.dll_MsiGetPropertyW]
lea eax, [ebp - 0x38]
push eax
push edx
push str.ProductIcon
push edi
call ebx
mov edx, dword [ebp - 0x40]
mov eax, dword [edx]
test eax, eax
jne 0x4574a0
xor ecx, ecx
jmp 0x4574b9
push dword [eax - 8]
push eax
call fcn.005418c8
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x458166
mov edx, dword [ebp - 0x40]
mov eax, dword [edx]
cmp ecx, dword [eax - 8]
jg 0x458166
mov dword [eax - 0xc], ecx
mov eax, dword [edx]
xor edx, edx
mov word [eax + ecx*2], dx
mov ecx, 1
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x38], 0x1000
mov edx, dword [eax + 8]
mov eax, dword [edx - 8]
sub ecx, dword [edx - 4]
sub eax, 0x1000
or eax, ecx
jge 0x457502
mov ecx, dword [ebp - 0x70]
push 0x1000
call fcn.0041f730
mov eax, dword [ebp - 0x70]
mov edx, dword [eax]
lea eax, [ebp - 0x38]
push eax
push edx
push str.Publisher
push edi
call ebx
mov edx, dword [ebp - 0x70]
mov eax, dword [edx]
test eax, eax
jne 0x45751c
xor ecx, ecx
jmp 0x457535
push dword [eax - 8]
push eax
call fcn.005418c8
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x458166
mov edx, dword [ebp - 0x70]
mov eax, dword [edx]
cmp ecx, dword [eax - 8]
jg 0x458166
mov dword [eax - 0xc], ecx
mov eax, dword [edx]
xor edx, edx
mov word [eax + ecx*2], dx
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x38], 0x1000
mov edx, dword [ecx]
mov ecx, 1
mov eax, dword [edx - 8]
sub ecx, dword [edx - 4]
sub eax, 0x1000
or eax, ecx
jge 0x45757d
mov ecx, dword [ebp - 0x4c]
push 0x1000
call fcn.0041f730
mov eax, dword [ebp - 0x4c]
mov edx, dword [eax]
lea eax, [ebp - 0x38]
push eax
push edx
push str.InstallLocation
push edi
call ebx
mov edx, dword [ebp - 0x4c]
mov eax, dword [edx]
test eax, eax
jne 0x457597
xor ecx, ecx
jmp 0x4575b0
push dword [eax - 8]
push eax
call fcn.005418c8
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x458166
mov edx, dword [ebp - 0x4c]
mov eax, dword [edx]
cmp ecx, dword [eax - 8]
jg 0x458166
mov dword [eax - 0xc], ecx
mov eax, dword [edx]
xor edx, edx
mov word [eax + ecx*2], dx
mov ecx, 1
mov edx, dword [ebp - 0x50]
mov dword [ebp - 0x38], 0x1000
mov edx, dword [edx]
mov eax, dword [edx - 8]
sub ecx, dword [edx - 4]
sub eax, 0x1000
or eax, ecx
jge 0x4575f8
mov ecx, dword [ebp - 0x50]
push 0x1000
call fcn.0041f730
mov eax, dword [ebp - 0x50]
mov edx, dword [eax]
lea eax, [ebp - 0x38]
push eax
push edx
push str.InstallDate
push edi
call ebx
mov ebx, dword [ebp - 0x50]
mov eax, dword [ebx]
test eax, eax
jne 0x457612
xor ecx, ecx
jmp 0x457628
push dword [eax - 8]
push eax
call fcn.005418c8
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x458166
mov eax, dword [ebx]
cmp ecx, dword [eax - 8]
jg 0x458166
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [ebx]
push edi
push str.msiexec.exe__X_s
mov word [eax + ecx*2], dx
mov eax, dword [ebp - 0x64]
push eax
call fcn.0041f510
mov byte [ebp - 4], 3
or ebx, 0xffffffff
mov edx, dword [ebp - 0x3c]
add esp, 0xc
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x457671
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 2
add edi, 0xfffffff0
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x45768c
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, dword [ebp - 0x40]
mov edx, dword [ebx]
cmp dword [edx - 0xc], 0
je 0x457c92
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x1000
or eax, ecx
jge 0x4576c5
push 0x1000
lea ecx, [ebp - 0x48]
call fcn.0041f730
mov eax, dword [ebp - 0x44]
mov esi, dword [ebp - 0x48]
mov edx, dword [eax + 4]
push 0x1000
push esi
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x457ade
push dword [esi - 8]
push esi
call fcn.005418c8
add esp, 8
test eax, eax
js 0x458166
cmp eax, dword [esi - 8]
jg 0x458166
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
lea ecx, [esi - 0x10]
mov edi, dword [ebx]
sub edi, 0x10
cmp ecx, edi
je 0x457ade
cmp dword [edi + 0xc], 0
lea ebx, [edi + 0xc]
jl 0x457ad0
mov eax, dword [ecx]
cmp eax, dword [edi]
jne 0x457ad0
push ecx
call fcn.00428ba0
add esp, 4
mov dword [ebp - 0x58], eax
or ecx, 0xffffffff
lock xadd dword [ebx], ecx
dec ecx
test ecx, ecx
jg 0x45774a
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x58]
mov ebx, dword [ebp - 0x40]
add eax, 0x10
mov dword [ebx], eax
jmp 0x457ade
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x3c]
mov dword [ebp - 0x68], 0
add edx, 0xfffffff0
jmp 0x45777b
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x68], 0
lea edx, [eax - 0x10]
mov byte [ebp - 4], 3
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x457792
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 2
add edi, 0xfffffff0
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x45706f
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x60]
jmp 0x456e11
mov ebx, dword [ebp - 0x40]
mov edx, 0x1000
mov dword [ebp - 0x38], edx
mov ecx, 1
mov edi, dword [ebx]
mov eax, dword [edi - 8]
sub ecx, dword [edi - 4]
sub eax, edx
or eax, ecx
jge 0x4577e4
push edx
mov ecx, ebx
call fcn.0041f730
mov edi, dword [ebx]
mov edx, dword [ebp - 0x38]
lea eax, [edx + edx]
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x34]
push eax
push edi
lea eax, [ebp - 0x58]
push eax
push 0
push str.DisplayIcon
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x457843
mov eax, dword [ebp - 0x58]
cmp eax, 1
je 0x45781b
cmp eax, 2
jne 0x457843
mov ecx, dword [ebp - 0x34]
test edi, edi
je 0x45783e
test ecx, ecx
je 0x457839
test cl, 1
jne 0x457843
mov eax, ecx
shr eax, 1
cmp word [edi + eax*2 - 2], 0
je 0x45783e
jmp 0x457843
xor eax, eax
mov word [edi], ax
shr ecx, 1
mov dword [ebp - 0x38], ecx
mov eax, dword [ebx]
test eax, eax
jne 0x45784d
xor ecx, ecx
jmp 0x457863
push dword [eax - 8]
push eax
call fcn.005418c8
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x458166
mov eax, dword [ebx]
cmp ecx, dword [eax - 8]
jg 0x458166
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [ebx]
mov word [eax + ecx*2], dx
mov edx, 0x1000
mov eax, dword [ebp - 0x70]
mov ecx, 1
mov dword [ebp - 0x38], edx
mov edi, dword [eax]
mov eax, dword [edi - 8]
sub ecx, dword [edi - 4]
sub eax, edx
or eax, ecx
jge 0x4578a7
mov edi, dword [ebp - 0x70]
mov ecx, edi
push edx
call fcn.0041f730
mov edi, dword [edi]
mov edx, dword [ebp - 0x38]
lea eax, [edx + edx]
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x34]
push eax
push edi
lea eax, [ebp - 0x58]
push eax
push 0
push str.Publisher
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x457906
mov eax, dword [ebp - 0x58]
cmp eax, 1
je 0x4578de
cmp eax, 2
jne 0x457906
mov ecx, dword [ebp - 0x34]
test edi, edi
je 0x457901
test ecx, ecx
je 0x4578fc
test cl, 1
jne 0x457906
mov eax, ecx
shr eax, 1
cmp word [edi + eax*2 - 2], 0
je 0x457901
jmp 0x457906
xor eax, eax
mov word [edi], ax
shr ecx, 1
mov dword [ebp - 0x38], ecx
mov edi, dword [ebp - 0x70]
mov eax, dword [edi]
test eax, eax
jne 0x457913
xor ecx, ecx
jmp 0x457929
push dword [eax - 8]
push eax
call fcn.005418c8
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x458166
mov eax, dword [edi]
cmp ecx, dword [eax - 8]
jg 0x458166
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [edi]
mov word [eax + ecx*2], dx
mov edx, 0x1000
mov eax, dword [ebp - 0x4c]
mov ecx, 1
mov dword [ebp - 0x38], edx
mov edi, dword [eax]
mov eax, dword [edi - 8]
sub ecx, dword [edi - 4]
sub eax, edx
or eax, ecx
jge 0x45796d
mov edi, dword [ebp - 0x4c]
mov ecx, edi
push edx
call fcn.0041f730
mov edi, dword [edi]
mov edx, dword [ebp - 0x38]
lea eax, [edx + edx]
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x34]
push eax
push edi
lea eax, [ebp - 0x58]
push eax
push 0
push str.InstallLocation
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4579cc
mov eax, dword [ebp - 0x58]
cmp eax, 1
je 0x4579a4
cmp eax, 2
jne 0x4579cc
mov ecx, dword [ebp - 0x34]
test edi, edi
je 0x4579c7
test ecx, ecx
je 0x4579c2
test cl, 1
jne 0x4579cc
mov eax, ecx
shr eax, 1
cmp word [edi + eax*2 - 2], 0
je 0x4579c7
jmp 0x4579cc
xor eax, eax
mov word [edi], ax
shr ecx, 1
mov dword [ebp - 0x38], ecx
mov edi, dword [ebp - 0x4c]
mov eax, dword [edi]
test eax, eax
jne 0x4579d9
xor ecx, ecx
jmp 0x4579ef
push dword [eax - 8]
push eax
call fcn.005418c8
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x458166
mov eax, dword [edi]
cmp ecx, dword [eax - 8]
jg 0x458166
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [edi]
mov word [eax + ecx*2], dx
mov edx, 0x1000
mov eax, dword [ebp - 0x50]
mov ecx, 1
mov dword [ebp - 0x38], edx
mov edi, dword [eax]
mov eax, dword [edi - 8]
sub ecx, dword [edi - 4]
sub eax, edx
or eax, ecx
jge 0x457a33
mov edi, dword [ebp - 0x50]
mov ecx, edi
push edx
call fcn.0041f730
mov edi, dword [edi]
mov edx, dword [ebp - 0x38]
lea eax, [edx + edx]
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x34]
push eax
push edi
lea eax, [ebp - 0x58]
push eax
push 0
push str.InstallDate
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x457a92
mov eax, dword [ebp - 0x58]
cmp eax, 1
je 0x457a6a
cmp eax, 2
jne 0x457a92
mov ecx, dword [ebp - 0x34]
test edi, edi
je 0x457a8d
test ecx, ecx
je 0x457a88
test cl, 1
jne 0x457a92
mov eax, ecx
shr eax, 1
cmp word [edi + eax*2 - 2], 0
je 0x457a8d
jmp 0x457a92
xor eax, eax
mov word [edi], ax
shr ecx, 1
mov dword [ebp - 0x38], ecx
mov edi, dword [ebp - 0x50]
mov eax, dword [edi]
test eax, eax
jne 0x457a9f
xor ecx, ecx
jmp 0x457ab5
push dword [eax - 8]
push eax
call fcn.005418c8
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x458166
mov eax, dword [edi]
cmp ecx, dword [eax - 8]
jg 0x458166
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [edi]
mov word [eax + ecx*2], dx
jmp 0x45768f
push dword [esi - 0xc]
mov ebx, dword [ebp - 0x40]
mov ecx, ebx
push esi
call fcn.00429270
mov edx, dword [ebx]
xor cl, cl
xor eax, eax
mov edi, dword [edx - 0xc]
test edi, edi
jle 0x457b6d
nop
lea ebx, [eax + eax]
cmp word [ebx + edx], 0x22
jne 0x457b3a
test cl, cl
jne 0x457b31
mov byte [ebp - 0x69], 1
test edi, edi
js 0x458166
mov eax, dword [ebp - 0x40]
mov ecx, 1
mov edx, dword [eax]
mov eax, dword [edx - 8]
sub ecx, dword [edx - 4]
sub eax, edi
or eax, ecx
jge 0x457b2e
mov ecx, dword [ebp - 0x40]
push edi
call fcn.0041f730
mov eax, dword [ebp - 0x40]
mov edx, dword [eax]
mov cl, byte [ebp - 0x69]
mov eax, 0x20
mov word [ebx + edx], ax
lea eax, [ebx + 2]
sar eax, 1
cmp eax, edi
jl 0x457af0
test cl, cl
je 0x457b6a
test edi, edi
js 0x458166
mov ebx, dword [ebp - 0x40]
mov eax, dword [ebx]
cmp edi, dword [eax - 8]
jg 0x458166
mov dword [eax - 0xc], edi
xor ecx, ecx
mov eax, dword [ebx]
mov word [eax + edi*2], cx
jmp 0x457b6d
mov ebx, dword [ebp - 0x40]
mov ebx, dword [ebx]
xor edi, edi
movzx eax, word [ebx]
test ax, ax
je 0x457bec
mov ecx, eax
nop dword [eax + eax]
push ecx
call fcn.00541bad
add esp, 4
test eax, eax
je 0x457b98
test edi, edi
mov eax, ebx
cmovne eax, edi
mov edi, eax
jmp 0x457b9a
xor edi, edi
movzx eax, word [ebx + 2]
add ebx, 2
mov ecx, eax
test ax, ax
jne 0x457b80
mov ebx, dword [ebp - 0x40]
test edi, edi
je 0x457bef
mov edx, dword [ebx]
sub edi, edx
sar edi, 1
js 0x458198
mov eax, dword [edx - 8]
mov ecx, 1
sub ecx, dword [edx - 4]
sub eax, edi
or eax, ecx
jge 0x457bd6
push edi
mov ecx, ebx
call fcn.0041f730
mov edx, dword [ebx]
cmp edi, dword [edx - 8]
jg 0x458166
mov dword [edx - 0xc], edi
xor ecx, ecx
mov eax, dword [ebx]
mov word [eax + edi*2], cx
jmp 0x457bef
mov ebx, dword [ebp - 0x40]
mov edi, dword [ebx]
movzx eax, word [edi]
push eax
call fcn.00541bad
add esp, 4
test eax, eax
je 0x457c15
movzx eax, word [edi + 2]
add edi, 2
push eax
call fcn.00541bad
add esp, 4
test eax, eax
jne 0x457c01
mov ebx, dword [ebx]
cmp edi, ebx
je 0x457c92
mov edx, dword [ebx - 0xc]
sub edi, ebx
sar edi, 1
test edx, edx
js 0x4581a2
mov eax, dword [ebx - 8]
mov ecx, 1
sub ecx, dword [ebx - 4]
sub eax, edx
or eax, ecx
jge 0x457c48
mov ebx, dword [ebp - 0x40]
mov ecx, ebx
push edx
call fcn.0041f730
mov ebx, dword [ebx]
mov ecx, dword [ebx - 0xc]
lea edx, [ebx + edi*2]
mov eax, ecx
sub eax, edi
mov dword [ebp - 0x58], eax
lea edi, [eax + eax]
lea eax, [edi + 2]
push eax
push edx
lea eax, [ecx*2 + 2]
push eax
push ebx
call fcn.0042a160
mov eax, dword [ebp - 0x58]
add esp, 0x10
test eax, eax
js 0x458166
mov edx, dword [ebp - 0x40]
mov ecx, dword [edx]
cmp eax, dword [ecx - 8]
jg 0x458166
mov dword [ecx - 0xc], eax
xor ecx, ecx
mov eax, dword [edx]
mov word [edi + eax], cx
mov eax, dword [ebp - 0x4c]
mov edx, dword [eax]
cmp dword [edx - 0xc], 0
je 0x457d60
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x1000
or eax, ecx
jge 0x457ccb
push 0x1000
lea ecx, [ebp - 0x48]
call fcn.0041f730
mov eax, dword [ebp - 0x44]
mov esi, dword [ebp - 0x48]
mov edx, dword [eax + 0x10]
push 0x1000
push esi
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x457fb4
push dword [esi - 8]
push esi
call fcn.005418c8
add esp, 8
test eax, eax
js 0x458166
cmp eax, dword [esi - 8]
jg 0x458166
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
mov edx, dword [ebp - 0x4c]
lea ecx, [esi - 0x10]
mov edi, dword [edx]
sub edi, 0x10
cmp ecx, edi
je 0x457fb4
cmp dword [edi + 0xc], 0
lea ebx, [edi + 0xc]
jl 0x457fa9
mov eax, dword [ecx]
cmp eax, dword [edi]
jne 0x457fa9
push ecx
call fcn.00428ba0
add esp, 4
mov dword [ebp - 0x58], eax
or ecx, 0xffffffff
lock xadd dword [ebx], ecx
dec ecx
test ecx, ecx
jg 0x457d53
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x4c]
add eax, 0x10
mov dword [ecx], eax
jmp 0x457fb4
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 0
push eax
push ecx
mov ecx, dword [ebp - 0x64]
lea eax, [ebp - 0x58]
push eax
call fcn.0045b000
mov byte [ebp - 4], 6
lea edi, [esi - 0x10]
mov ecx, dword [eax]
lea edx, [ecx - 0x10]
cmp edx, edi
je 0x457dcd
cmp dword [edi + 0xc], 0
lea esi, [edi + 0xc]
jl 0x457dbe
mov eax, dword [edx]
cmp eax, dword [edi]
jne 0x457dbe
push edx
call fcn.00428ba0
add esp, 4
mov ebx, eax
or ecx, 0xffffffff
lock xadd dword [esi], ecx
dec ecx
test ecx, ecx
jg 0x457db6
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
lea esi, [ebx + 0x10]
mov dword [ebp - 0x48], esi
jmp 0x457dcd
push dword [ecx - 0xc]
push ecx
lea ecx, [ebp - 0x48]
call fcn.00429270
mov esi, dword [ebp - 0x48]
mov byte [ebp - 4], 2
or eax, 0xffffffff
mov edx, dword [ebp - 0x58]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x457dec
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0x34], 0
jl 0x457fb4
nop word [eax + eax]
mov edi, dword [esi - 0xc]
test edi, edi
js 0x458166
mov eax, dword [esi - 8]
mov ebx, 1
mov ecx, ebx
sub eax, edi
sub ecx, dword [esi - 4]
or eax, ecx
jge 0x457e2a
push edi
lea ecx, [ebp - 0x48]
call fcn.0041f730
mov esi, dword [ebp - 0x48]
lea eax, [edi + 1]
push eax
push esi
call fcn.005343c5
add esp, 8
cmp edi, dword [esi - 8]
jg 0x458166
xor eax, eax
mov dword [esi - 0xc], edi
mov word [esi + edi*2], ax
cmp dword [esi - 0xc], eax
jl 0x457ee1
push str..exe
push esi
call fcn.0052fa1d
add esp, 8
test eax, eax
je 0x457ee1
sub eax, esi
sar eax, 1
test eax, eax
jle 0x457ee1
push 0x5c
push esi
call fcn.0052fcca
mov edi, eax
add esp, 8
test edi, edi
je 0x457f18
sub edi, esi
sar edi, 1
test edi, edi
jle 0x457f18
mov eax, dword [esi - 8]
mov ecx, ebx
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x457ea7
push edi
lea ecx, [ebp - 0x48]
call fcn.0041f730
mov esi, dword [ebp - 0x48]
cmp edi, dword [esi - 8]
jg 0x458166
xor eax, eax
mov dword [esi - 0xc], edi
mov ecx, esi
mov word [esi + edi*2], ax
call fcn.00456850
test eax, eax
jne 0x457f18
mov ecx, esi
call fcn.00456960
test eax, eax
je 0x457f18
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x457ed4
jmp 0x457f0b
mov ecx, esi
call fcn.00456850
test eax, eax
jne 0x457f18
mov ecx, esi
call fcn.00456960
test eax, eax
je 0x457f18
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x457f00
sub ecx, edx
sar ecx, 1
cmp ecx, 3
ja 0x457d06
lea eax, [ebp - 0x34]
push eax
push ecx
mov ecx, dword [ebp - 0x64]
lea eax, [ebp - 0x58]
push eax
call fcn.0045b000
mov byte [ebp - 4], 7
lea edi, [esi - 0x10]
mov ecx, dword [eax]
lea edx, [ecx - 0x10]
cmp edx, edi
je 0x457f7e
cmp dword [edi + 0xc], 0
lea esi, [edi + 0xc]
jl 0x457f6f
mov eax, dword [edx]
cmp eax, dword [edi]
jne 0x457f6f
push edx
call fcn.00428ba0
add esp, 4
mov ebx, eax
or ecx, 0xffffffff
lock xadd dword [esi], ecx
dec ecx
test ecx, ecx
jg 0x457f67
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
lea esi, [ebx + 0x10]
mov dword [ebp - 0x48], esi
jmp 0x457f7e
push dword [ecx - 0xc]
push ecx
lea ecx, [ebp - 0x48]
call fcn.00429270
mov esi, dword [ebp - 0x48]
mov byte [ebp - 4], 2
or eax, 0xffffffff
mov edx, dword [ebp - 0x58]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x457f9d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0x34], 0
jge 0x457e00
jmp 0x457fb4
push dword [esi - 0xc]
mov ecx, edx
push esi
call fcn.00429270
mov ebx, dword [ebp - 0x50]
mov edx, dword [ebx]
mov ecx, edx
lea edi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x457fc0
sub ecx, edi
sar ecx, 1
cmp ecx, 8
jne 0x4580e6
xor ecx, ecx
nop word [eax + eax]
mov ax, word [edx + ecx*2]
sub ax, 0x30
cmp ax, 9
ja 0x4580e6
inc ecx
cmp ecx, 8
jl 0x457fe0
mov eax, dword [edx - 0xc]
mov ecx, 6
cmp eax, ecx
mov edi, eax
cmovge edi, ecx
lea ebx, [eax + 1]
test ebx, ebx
js 0x4581ac
mov eax, dword [edx - 8]
mov ecx, 1
sub ecx, dword [edx - 4]
sub eax, ebx
or eax, ecx
jge 0x458031
mov ecx, dword [ebp - 0x50]
push ebx
call fcn.0041f730
mov eax, dword [ebp - 0x50]
mov edx, dword [eax]
mov eax, ebx
sub eax, edi
lea edi, [edx + edi*2]
add eax, eax
push eax
push edi
push eax
lea eax, [edi + 2]
push eax
call fcn.0042a160
mov ecx, dword [ebp - 0x50]
mov eax, 0x2d
mov word [edi], ax
add esp, 0x10
mov eax, dword [ecx]
cmp ebx, dword [eax - 8]
jg 0x458166
mov dword [eax - 0xc], ebx
xor edx, edx
mov eax, dword [ecx]
mov word [eax + ebx*2], dx
mov edx, 4
mov ecx, dword [ecx]
mov eax, dword [ecx - 0xc]
cmp eax, edx
mov edi, eax
cmovge edi, edx
lea ebx, [eax + 1]
test ebx, ebx
js 0x4581b6
mov eax, dword [ecx - 8]
mov edx, 1
sub edx, dword [ecx - 4]
sub eax, ebx
or eax, edx
jge 0x4580a5
mov ecx, dword [ebp - 0x50]
push ebx
call fcn.0041f730
mov eax, dword [ebp - 0x50]
mov ecx, dword [eax]
mov eax, ebx
sub eax, edi
lea edi, [ecx + edi*2]
add eax, eax
push eax
push edi
push eax
lea eax, [edi + 2]
push eax
call fcn.0042a160
mov ecx, dword [ebp - 0x50]
mov eax, 0x2d
mov word [edi], ax
add esp, 0x10
mov eax, dword [ecx]
cmp ebx, dword [eax - 8]
jg 0x458166
mov edi, dword [ebp - 0x60]
mov dword [eax - 0xc], ebx
mov eax, dword [ecx]
xor ecx, ecx
mov word [eax + ebx*2], cx
jmp 0x456e11
lea eax, [ebp - 0x5c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x45706f
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x30]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
movzx eax, word [ebp - 0x1a]
push eax
movzx eax, word [ebp - 0x1e]
push eax
movzx eax, word [ebp - 0x20]
push eax
push str._d__02d__02d
push ebx
call fcn.0041f510
mov edi, dword [ebp - 0x60]
add esp, 0x14
jmp 0x456e11
push 0x80004005
call fcn.004222a0
push 0x80004005
call fcn.004222a0
push 0x80070057
call fcn.004222a0
push 0x80070057
call fcn.004222a0
push 0x80004005
call fcn.004222a0
push 0x80004005
call fcn.004222a0
push 0x80070057
call fcn.004222a0
push 0x80070057
call fcn.004222a0
push 0x80070057
call fcn.004222a0
push 0x80070057
call fcn.004222a0
push 0x80070057
call fcn.004222a0
int3