Function at 0x457fe0
Capabilities:
Delete registry value
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4ea1a0
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebp
xor ebp, ebp
cmp word [0x51c734], bp
jne 0x458024
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
push eax
push ecx
call dword [0x51d3e4]
pop ebp
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret
push ebx
mov ebx, dword [esp + 0x3c]
push esi
push edi
push 0x5c
push ebp
push ebx
mov dword [esp + 0x1c], ebp
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
mov esi, eax
cmp esi, ebp
jne 0x458223
movzx eax, word [0x51c734]
mov ecx, dword [esp + 0x40]
lea edx, [esp + 0x10]
push edx
or eax, 0x2001b
push eax
push ebp
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, ebp
jne 0x4582c4
push ebp
push ebp
push ebp
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x30]
push eax
mov eax, dword [esp + 0x24]
push ebp
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x40]
push edx
push ebp
push ebp
push ebp
push eax
mov dword [esp + 0x54], ebp
mov dword [esp + 0x48], ebp
mov dword [esp + 0x50], ebp
mov dword [esp + 0x4c], ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov ecx, dword [esp + 0x1c]
mov edi, eax
mov eax, dword [esp + 0x18]
cmp eax, ecx
mov dword [esp + 0x14], edi
jae 0x4580ba
mov eax, ecx
mov dword [esp + 0x18], eax
lea ecx, [eax*4 + 8]
push ecx
lea ecx, [esp + 0x2c]
call fcn.004494b0
cmp edi, ebp
mov edi, dword [esp + 0x28]
mov dword [esp + 0x38], ebp
jne 0x45819c
mov ebx, dword [esp + 0x20]
dec ebx
cmp ebx, ebp
jl 0x45813f
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
lea ebx, [ebx]
mov edx, dword [esp + 0x18]
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x3c]
push ecx
lea eax, [edx*4 + 1]
push edi
mov dword [esp + 0x44], eax
mov word [edi], 0
mov edx, dword [esp + 0x28]
push ebx
push edx
call ebp
mov esi, eax
test esi, esi
jne 0x45813a
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
test esi, esi
je 0x45813a
mov dword [esp + 0x14], esi
dec ebx
jns 0x4580f0
xor ebp, ebp
mov ebx, dword [esp + 0x24]
dec ebx
cmp ebx, ebp
jl 0x458198
mov ecx, dword [esp + 0x18]
push ebp
push ebp
push ebp
push ebp
lea eax, [esp + 0x3c]
push eax
lea edx, [ecx*4 + 1]
push edi
mov dword [esp + 0x44], edx
mov word [edi], bp
mov ecx, dword [esp + 0x28]
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
cmp esi, ebp
je 0x45817c
mov dword [esp + 0x14], esi
jmp 0x458195
cmp word [edi], bp
je 0x458195
mov edx, dword [esp + 0x10]
push edi
push edx
call dword [0x51d3e4]
cmp eax, ebp
je 0x458195
mov dword [esp + 0x14], eax
dec ebx
jns 0x458148
mov ebx, dword [esp + 0x44]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x51d3e8]
cmp eax, ebp
jne 0x4581d4
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebp
je 0x45821b
push 0x4f9890
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebp
mov dword [0x51d3e8], eax
je 0x4581e7
movzx ecx, word [0x51c734]
mov edx, dword [esp + 0x40]
push ebp
push ecx
push ebx
push edx
call eax
mov esi, eax
cmp esi, ebp
je 0x4581ef
mov dword [esp + 0x14], esi
cmp edi, ebp
je 0x458204
mov eax, dword [0x51d3c8]
add edi, 0xfffffff8
push edi
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
pop ebp
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret
mov dword [0x51d3e8], ebp
jmp 0x4581e7
mov eax, esi
sub eax, ebx
sar eax, 1
push eax
push ebx
lea ecx, [esp + 0x2c]
add esi, 2
mov dword [esp + 0x2c], ebp
call fcn.00449600
movzx edx, word [0x51c734]
mov edi, dword [esp + 0x24]
mov eax, dword [esp + 0x40]
lea ecx, [esp + 0x10]
push ecx
or edx, 2
push edx
push ebp
push edi
push eax
mov dword [esp + 0x4c], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
cmp ebx, ebp
je 0x458295
cmp edi, ebp
je 0x458280
mov ecx, dword [0x51d3c8]
add edi, 0xfffffff8
push edi
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret
mov edx, dword [esp + 0x10]
push esi
push edx
call dword [0x51d3e4]
mov esi, eax
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, ebp
je 0x4582c4
mov ecx, dword [0x51d3c8]
add edi, 0xfffffff8
push edi
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [esp + 0x30]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
mov dword fs:[0], ecx
add esp, 0x2c
ret