Function at 0x13f00
Capabilities:
Delete registry value
Encode data using xor
Query or enumerate registry value
Resolve function by parsing pe exports
Set registry value

Disassembly:
sub esp, 0x88
push ebx
mov ebx, dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
push ebp
xor ebp, ebp
push esi
push edi
push ebp
push 4
push 1
mov dword [esp + 0x88], 0xc0000001
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x50], ebp
mov dword [esp + 0x84], ebp
mov dword [esp + 0x7c], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ebp
mov dword [esp + 0x80], ebp
mov dword [esp + 0x54], ebp
call ebx
cmp eax, ebp
je 0x13f58
mov dword [eax], 0x30
mov dword [esp + 0x48], eax
push ebp
push 0x18
push 1
mov dword [esp + 0x78], ebp
call ebx
cmp eax, ebp
je 0x13f97
mov edi, 0x15150
or esi, 0xffffffff
mov ecx, eax
sub edi, eax
mov ebx, 6
mov edx, dword [edi + ecx]
mov ebp, edx
xor ebp, esi
mov dword [ecx], ebp
add ecx, 4
sub ebx, 1
mov esi, edx
jne 0x13f78
mov ebx, dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [esp + 0x6c], eax
xor ebp, ebp
push ebp
push 0x18
push 1
mov dword [esp + 0x4c], ebp
call ebx
cmp eax, ebp
je 0x13fd6
mov edi, 0x15134
or esi, 0xffffffff
mov ecx, eax
sub edi, eax
mov ebx, 6
mov edx, dword [edi + ecx]
mov ebp, edx
xor ebp, esi
mov dword [ecx], ebp
add ecx, 4
sub ebx, 1
mov esi, edx
jne 0x13fb7
mov ebx, dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [esp + 0x40], eax
xor ebp, ebp
push ebp
push 0x20
push 1
mov dword [esp + 0x6c], ebp
call ebx
cmp eax, ebp
je 0x14015
mov edi, 0x1516c
or esi, 0xffffffff
mov ecx, eax
sub edi, eax
mov ebx, 8
mov edx, dword [edi + ecx]
mov ebp, edx
xor ebp, esi
mov dword [ecx], ebp
add ecx, 4
sub ebx, 1
mov esi, edx
jne 0x13ff6
mov ebx, dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [esp + 0x60], eax
xor ebp, ebp
push ebp
push 0x68
push 1
mov dword [esp + 0x5c], ebp
call ebx
cmp eax, ebp
je 0x14054
mov edi, 0x15384
or esi, 0xffffffff
mov ecx, eax
sub edi, eax
mov ebx, 0x1a
mov edx, dword [edi + ecx]
mov ebp, edx
xor ebp, esi
mov dword [ecx], ebp
add ecx, 4
sub ebx, 1
mov esi, edx
jne 0x14035
mov ebx, dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [esp + 0x50], eax
xor ebp, ebp
push ebp
push 0xc
push 1
mov dword [esp + 0x68], ebp
call ebx
cmp eax, ebp
je 0x14093
mov edi, 0x15510
or esi, 0xffffffff
mov ecx, eax
sub edi, eax
mov ebx, 3
mov edx, dword [edi + ecx]
mov ebp, edx
xor ebp, esi
mov dword [ecx], ebp
add ecx, 4
sub ebx, 1
mov esi, edx
jne 0x14074
mov ebx, dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [esp + 0x5c], eax
xor ebp, ebp
push ebp
push 0x14
push 1
mov dword [esp + 0x70], ebp
call ebx
cmp eax, ebp
je 0x140d2
mov edi, 0x15204
or esi, 0xffffffff
mov ecx, eax
sub edi, eax
mov ebx, 5
mov edx, dword [edi + ecx]
mov ebp, edx
xor ebp, esi
mov dword [ecx], ebp
add ecx, 4
sub ebx, 1
mov esi, edx
jne 0x140b3
mov ebx, dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [esp + 0x64], eax
xor ebp, ebp
push ebp
push 0x14
push 1
mov dword [esp + 0x58], ebp
call ebx
cmp eax, ebp
je 0x14111
mov edi, 0x1521c
or esi, 0xffffffff
mov ecx, eax
sub edi, eax
mov ebx, 5
mov edx, dword [ecx + edi]
mov ebp, edx
xor ebp, esi
mov dword [ecx], ebp
add ecx, 4
sub ebx, 1
mov esi, edx
jne 0x140f2
mov ebx, dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [esp + 0x4c], eax
xor ebp, ebp
push ebp
push 0x30
push 1
mov dword [esp + 0x60], ebp
call ebx
cmp eax, ebp
je 0x14150
mov edi, 0x15198
or esi, 0xffffffff
mov ecx, eax
sub edi, eax
mov ebx, 0xc
mov edx, dword [edi + ecx]
mov ebp, edx
xor ebp, esi
mov dword [ecx], ebp
add ecx, 4
sub ebx, 1
mov esi, edx
jne 0x14131
mov ebx, dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [esp + 0x54], eax
xor ebp, ebp
push ebp
push 0x18
push 1
mov dword [esp + 0x74], ebp
call ebx
cmp eax, ebp
je 0x1418f
mov edi, 0x151cc
or esi, 0xffffffff
mov ecx, eax
sub edi, eax
mov ebx, 6
mov edx, dword [edi + ecx]
mov ebp, edx
xor ebp, esi
mov dword [ecx], ebp
add ecx, 4
sub ebx, 1
mov esi, edx
jne 0x14170
mov ebx, dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [esp + 0x68], eax
xor ebp, ebp
cmp dword [esp + 0xa4], ebp
je 0x141b4
mov eax, dword [esp + 0x9c]
push eax
push str.RestoreService
push str.__s__S
call fcn.00012710
add esp, 0xc
jmp 0x141c6
push str.RestoreService
push str.__s_Auto
call fcn.00012710
add esp, 8
mov esi, dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov edi, dword [sym.imp.ntoskrnl.exe_ZwClose]
cmp dword [esp + 0x48], ebp
je 0x149cd
cmp dword [esp + 0x6c], ebp
je 0x149b2
cmp dword [esp + 0x40], 0
je 0x149b2
cmp dword [esp + 0x60], 0
je 0x149b2
cmp dword [esp + 0x50], 0
je 0x149b2
cmp dword [esp + 0x5c], 0
je 0x149b2
cmp dword [esp + 0x64], 0
je 0x149b2
cmp dword [esp + 0x4c], 0
je 0x149b2
cmp dword [esp + 0x54], 0
je 0x149b2
cmp dword [esp + 0x68], 0
je 0x149b2
mov eax, 0x15d80
mov dword [esp + 0x58], 1
call fcn.00010a20
mov edi, eax
test edi, edi
je 0x149b2
movzx esi, word [0x15d80]
sub esi, 8
mov eax, 0
mov ebp, eax
je 0x1429f
mov edx, 1
mov cl, byte [eax + edi]
inc eax
inc edx
test cl, cl
jns 0x1429a
cmp cl, 0xff
je 0x1428c
cmp eax, esi
jae 0x14443
inc eax
inc edx
jmp 0x1429a
cmp edx, esi
jae 0x14443
add eax, 2
add edx, 2
inc ebp
cmp eax, esi
jb 0x14272
mov eax, ebp
push 0
lea ecx, [eax + eax]
push ecx
push 1
call ebx
mov esi, eax
mov dword [esp + 0x74], esi
test esi, esi
je 0x142f2
movzx edx, word [0x15d80]
sub edx, 8
push edx
call fcn.000105d0
mov eax, esi
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x142d0
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
mov dword [esp + 0x80], eax
mov dword [esp + 0x58], 0
push 0
push edi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp dword [esp + 0x58], 0
jne 0x149b2
mov ecx, dword [0x16f20]
mov edi, dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
lea edx, [esp + 0x28]
push edx
xor ebx, ebx
push 0xf003f
lea eax, [esp + 0x18]
mov esi, 0x18
push eax
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], ebx
mov dword [esp + 0x40], 0x40
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
call edi
mov ebp, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
test eax, eax
jl 0x14452
mov ecx, dword [esp + 0x40]
push ecx
lea edx, [esp + 0x18]
push edx
call ebp
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x28]
push edx
mov dword [esp + 0x30], eax
push 0xf003f
lea eax, [esp + 0x18]
lea ecx, [esp + 0x1c]
push eax
mov dword [esp + 0x34], esi
mov dword [esp + 0x40], 0x40
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
call edi
test eax, eax
jl 0x14452
mov eax, dword [esp + 0x2c]
cmp eax, ebx
je 0x143ac
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov ecx, dword [esp + 0x48]
push ecx
lea edx, [esp + 0x18]
push edx
call ebp
mov edx, dword [esp + 0x10]
mov esi, dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
lea eax, [esp + 0x1c]
push eax
push ebx
push ebx
push 2
lea ecx, [esp + 0x24]
push ecx
push edx
call esi
cmp eax, 0xc0000023
jne 0x14452
mov eax, dword [esp + 0x1c]
push ebx
push eax
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov edi, eax
mov dword [esp + 0x20], eax
cmp edi, ebx
je 0x14452
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x14]
push edx
push edi
push 2
lea eax, [esp + 0x24]
push eax
push ecx
call esi
test eax, eax
jl 0x1444a
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
sub eax, 0xc
push eax
lea esi, [edi + 0xc]
mov dword [esp + 0x7c], edx
mov dword [esp + 0x20], eax
call fcn.000104e0
test eax, eax
je 0x1444a
push str.RestoreService
push str.__s_RecoverA
call fcn.00012710
add esp, 8
jmp 0x14458
xor eax, eax
jmp 0x142a1
push ebx
push edi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor edi, edi
mov dword [esp + 0x20], edi
cmp dword [esp + 0xa4], ebx
je 0x14731
mov eax, dword [esp + 0x50]
push eax
lea ecx, [esp + 0x18]
push ecx
call ebp
mov esi, dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
lea eax, [esp + 0x28]
push eax
push 0xf003f
lea ecx, [esp + 0x18]
lea edx, [esp + 0x1c]
push ecx
mov dword [esp + 0x34], 0x18
mov dword [esp + 0x38], ebx
mov dword [esp + 0x40], 0x40
mov dword [esp + 0x3c], edx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
call esi
test eax, eax
jl 0x14728
mov edx, dword [esp + 0x9c]
push edx
lea eax, [esp + 0x18]
push eax
call ebp
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x28]
push edx
push 0xf003f
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x38], ecx
call esi
test eax, eax
jl 0x14728
mov eax, dword [esp + 0x2c]
cmp eax, ebx
je 0x144f3
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov ecx, dword [esp + 0x64]
push ecx
lea edx, [esp + 0x18]
push edx
call ebp
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x28]
push ecx
push 0xf003f
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x38], eax
call esi
test eax, eax
jl 0x14728
mov eax, dword [esp + 0x2c]
cmp eax, ebx
je 0x1452f
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, dword [esp + 0x4c]
push eax
lea ecx, [esp + 0x18]
push ecx
call ebp
mov ecx, dword [esp + 0x10]
mov esi, dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
lea edx, [esp + 0x1c]
push edx
push ebx
push ebx
push 2
lea eax, [esp + 0x24]
push eax
push ecx
call esi
cmp eax, 0xc0000023
jne 0x14728
mov edx, dword [esp + 0x1c]
push ebx
push edx
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov edi, eax
mov dword [esp + 0x24], edi
cmp edi, ebx
je 0x14728
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x14]
push ecx
push edi
push 2
lea edx, [esp + 0x24]
push edx
push eax
call esi
test eax, eax
jl 0x14720
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
sub eax, 0xc
push eax
lea esi, [edi + 0xc]
mov dword [esp + 0x74], ecx
mov dword [esp + 0x20], eax
call fcn.000104e0
test eax, eax
je 0x14720
push str.RestoreService
push str.__s_RecoverB
call fcn.00012710
add esp, 8
mov esi, edi
movzx edx, byte [esi + 0xc]
push edx
push str.RestoreService
push str.__s_Ver:__.8X
call fcn.00012710
add esp, 0xc
cmp byte [esi + 0xc], 0x21
jne 0x149b2
mov eax, dword [esi + 0x21]
mov ecx, dword [esi + 0x19]
mov edx, dword [esi + 0x1d]
mov dword [esp + 0x90], eax
mov eax, dword [esi + 0x15]
mov dword [esp + 0x58], ecx
add eax, 0x19
add ecx, eax
mov dword [esp + 0x94], edx
add edx, ecx
lea edx, [edx + esi + 0xc]
push edx
lea ecx, [ecx + esi + 0xc]
push ecx
lea eax, [eax + esi + 0xc]
push eax
mov dword [esp + 0x94], ecx
mov ecx, dword [esi + 0x11]
lea ebx, [esi + 0x25]
push ebx
push ecx
mov dword [esp + 0x98], edx
mov edx, dword [esi + 0xd]
push edx
push str.RestoreService
push str.__s_Start:__d__Unload:__d__Root:__S__Dll:__S__Depend:__S__Main:__S
mov dword [esp + 0xac], eax
call fcn.00012710
add esp, 0x20
cmp dword [esp + 0xa0], 0
je 0x14761
cmp dword [esp + 0x20], 0
je 0x14761
cmp dword [esp + 0x24], 0
je 0x14761
mov eax, dword [esp + 0x80]
mov ecx, dword [esp + 0xa0]
cmp dword [ecx], eax
jb 0x14742
mov edx, dword [esp + 0x20]
mov eax, dword [edx + 8]
mov ecx, dword [esp + 0x24]
cmp eax, dword [ecx + 8]
jne 0x14742
mov edi, edx
add ecx, 0xc
add edi, 0xc
cmp eax, 4
jb 0x146d4
lea esp, [esp]
mov edx, dword [edi]
cmp edx, dword [ecx]
jne 0x14742
sub eax, 4
add ecx, 4
add edi, 4
cmp eax, 4
jae 0x146c0
test eax, eax
je 0x146f8
mov dl, byte [ecx]
cmp dl, byte [edi]
jne 0x14742
cmp eax, 1
jbe 0x146f8
mov dl, byte [ecx + 1]
cmp dl, byte [edi + 1]
jne 0x14742
cmp eax, 2
jbe 0x146f8
mov al, byte [ecx + 2]
cmp al, byte [edi + 2]
jne 0x14742
mov edi, dword [esp + 0x80]
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x9c]
push edi
push ecx
push edx
call fcn.00014c80
mov eax, dword [esp + 0xac]
add esp, 0xc
mov dword [eax], edi
jmp 0x14761
push ebx
push edi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov dword [esp + 0x24], ebx
jmp 0x149b2
cmp edi, ebx
je 0x149b2
mov esi, dword [esp + 0x20]
jmp 0x145d6
push str.RestoreService
push str.__s_Sig_Not_Match_
call fcn.00012710
mov ecx, dword [esp + 0xa8]
add esp, 8
mov dword [ecx], 0
mov edx, dword [esp + 0x50]
push edx
lea eax, [esp + 0x18]
push eax
call ebp
xor eax, eax
lea edx, [esp + 0x28]
push edx
mov dword [esp + 0x30], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
push 0xf003f
lea eax, [esp + 0x18]
lea ecx, [esp + 0x1c]
push eax
mov dword [esp + 0x34], 0x18
mov dword [esp + 0x40], 0x40
mov dword [esp + 0x3c], ecx
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
jl 0x149b2
push ebx
lea ecx, [esp + 0x18]
push ecx
call ebp
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x28]
push eax
push 0xf003f
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x38], edx
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
jl 0x149b2
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x147ec
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov edx, dword [esp + 0x40]
push edx
lea eax, [esp + 0x18]
push eax
call ebp
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x28]
push edx
push 0xf003f
lea eax, [esp + 0x4c]
push eax
mov dword [esp + 0x38], ecx
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
jl 0x149b2
mov ecx, dword [esp + 0x5c]
push ecx
lea edx, [esp + 0x18]
push edx
call ebp
mov ecx, dword [esp + 0x10]
mov edi, dword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
push 4
lea eax, [esi + 0xd]
push eax
push 4
push 0
lea eax, [esp + 0x24]
push eax
push ecx
call edi
test eax, eax
jl 0x149b2
mov edx, dword [esp + 0x6c]
push edx
lea eax, [esp + 0x18]
push eax
call ebp
mov ecx, dword [esp + 0x58]
mov edx, dword [esp + 0x8c]
push ecx
mov ecx, dword [esp + 0x48]
push edx
push 2
push 0
lea eax, [esp + 0x24]
push eax
push ecx
call edi
test eax, eax
jl 0x149b2
cmp dword [esi + 0x11], 0
mov ebx, dword [sym.imp.ntoskrnl.exe_ZwDeleteValueKey]
jne 0x148a2
mov edx, dword [esp + 0x54]
push edx
lea eax, [esp + 0x18]
push eax
call ebp
mov edx, dword [esp + 0x44]
lea ecx, [esp + 0x14]
push ecx
push edx
call ebx
mov esi, dword [esp + 0x94]
test esi, esi
je 0x148d2
mov eax, dword [esp + 0x60]
push eax
lea ecx, [esp + 0x18]
push ecx
call ebp
mov edx, dword [esp + 0x88]
mov ecx, dword [esp + 0x10]
push esi
push edx
push 7
push 0
lea eax, [esp + 0x24]
push eax
push ecx
call edi
mov esi, dword [esp + 0x90]
test esi, esi
je 0x14902
mov edx, dword [esp + 0x68]
push edx
lea eax, [esp + 0x18]
push eax
call ebp
mov ecx, dword [esp + 0x84]
mov eax, dword [esp + 0x44]
push esi
push ecx
push 7
push 0
lea edx, [esp + 0x24]
push edx
push eax
call edi
cmp dword [esp + 0xa4], 0
je 0x14968
mov esi, dword [esp + 0x20]
test esi, esi
je 0x14992
mov ecx, dword [esp + 0x24]
test ecx, ecx
je 0x14992
mov eax, dword [esi + 8]
cmp eax, dword [ecx + 8]
jne 0x14992
add ecx, 0xc
add esi, 0xc
cmp eax, 4
jb 0x14944
nop
mov edx, dword [esi]
cmp edx, dword [ecx]
jne 0x14992
sub eax, 4
add ecx, 4
add esi, 4
cmp eax, 4
jae 0x14930
test eax, eax
je 0x14968
mov dl, byte [ecx]
cmp dl, byte [esi]
jne 0x14992
cmp eax, 1
jbe 0x14968
mov dl, byte [ecx + 1]
cmp dl, byte [esi + 1]
jne 0x14992
cmp eax, 2
jbe 0x14968
mov al, byte [ecx + 2]
cmp al, byte [esi + 2]
jne 0x14992
push str.RestoreService
push str.__s_Remove_Recovery
call fcn.00012710
mov ecx, dword [esp + 0x50]
add esp, 8
push ecx
lea edx, [esp + 0x18]
push edx
call ebp
mov ecx, dword [esp + 0x78]
lea eax, [esp + 0x14]
push eax
push ecx
call ebx
mov edx, dword [esp + 0x4c]
push edx
lea eax, [esp + 0x18]
push eax
call ebp
mov edx, dword [esp + 0x70]
lea ecx, [esp + 0x14]
push ecx
push edx
call ebx
mov dword [esp + 0x7c], 0
mov eax, dword [esp + 0x48]
push 0
push eax
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov edi, dword [sym.imp.ntoskrnl.exe_ZwClose]
mov esi, dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor ebp, ebp
mov eax, dword [esp + 0x6c]
cmp eax, ebp
je 0x149d9
push ebp
push eax
call esi
mov eax, dword [esp + 0x40]
cmp eax, ebp
je 0x149e5
push ebp
push eax
call esi
mov eax, dword [esp + 0x60]
cmp eax, ebp
je 0x149f1
push ebp
push eax
call esi
mov eax, dword [esp + 0x50]
cmp eax, ebp
je 0x149fd
push ebp
push eax
call esi
mov eax, dword [esp + 0x5c]
cmp eax, ebp
je 0x14a09
push ebp
push eax
call esi
mov eax, dword [esp + 0x64]
cmp eax, ebp
je 0x14a15
push ebp
push eax
call esi
mov eax, dword [esp + 0x4c]
cmp eax, ebp
je 0x14a21
push ebp
push eax
call esi
mov eax, dword [esp + 0x54]
cmp eax, ebp
je 0x14a2d
push ebp
push eax
call esi
mov eax, dword [esp + 0x68]
cmp eax, ebp
je 0x14a39
push ebp
push eax
call esi
mov eax, dword [esp + 0x74]
cmp eax, ebp
je 0x14a45
push ebp
push eax
call esi
mov eax, dword [esp + 0x20]
cmp eax, ebp
je 0x14a51
push ebp
push eax
call esi
mov eax, dword [esp + 0x24]
cmp eax, ebp
je 0x14a5d
push ebp
push eax
call esi
mov eax, dword [esp + 0x78]
cmp eax, ebp
je 0x14a68
push eax
call edi
mov eax, dword [esp + 0x70]
cmp eax, ebp
je 0x14a73
push eax
call edi
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x14a7e
push eax
call edi
mov eax, dword [esp + 0x44]
cmp eax, ebp
je 0x14a89
push eax
call edi
mov eax, dword [esp + 0x7c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x88
ret 0xc