Function at 0x45f620
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4a2848
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x118
push esi
push edi
mov ecx, dword [esp + 0x134]
mov edx, dword [esp + 0x130]
lea eax, [esp + 0x14]
mov dword [esp + 0x128], 1
push eax
push 0x20019
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x45fa03
mov ecx, 0x41
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x18]
lea ecx, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x13c]
lea edx, [esp + 0x140]
push ecx
mov ecx, dword [esp + 0x1c]
push edx
push 0
push eax
push ecx
mov dword [esp + 0x30], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x45f9f8
mov esi, dword [esp + 0x144]
lea edx, [esp + 0x1c]
push ebx
push edx
push 0x4c2284
push esi
call fcn.0048a7fc
mov eax, dword [esp + 0x150]
push str.IEXPLORE.EXE
push eax
call fcn.004773a0
add esp, 0x14
test eax, eax
jne 0x45f7ff
mov ecx, esi
call fcn.0048a85b
mov ecx, esi
call fcn.0048a80f
mov ecx, dword [0x4cc854]
mov dword [esp + 0x10], ecx
lea edx, [esp + 0xc]
mov bl, 2
push 0xc
push edx
mov ecx, esi
mov byte [esp + 0x134], bl
call fcn.0048a360
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x130], 3
call fcn.0048c53c
lea ecx, [esp + 0xc]
mov byte [esp + 0x12c], bl
call fcn.0048c403
lea ecx, [esp + 0x10]
call fcn.0048c958
mov eax, dword [esp + 0x10]
push str.IEXPLORE.EXE
push eax
call fcn.0047514f
add esp, 8
test eax, eax
jne 0x45f78b
mov ecx, dword [esi]
lea edx, [esp + 0xc]
mov eax, dword [ecx - 8]
mov ecx, esi
add eax, 0xfffffff3
push eax
push edx
call fcn.0048a3dc
push eax
mov ecx, esi
mov byte [esp + 0x130], 4
call fcn.0048c53c
mov byte [esp + 0x12c], bl
lea ecx, [esp + 0xc]
jmp 0x45f7e9
mov eax, dword [0x4cc854]
mov dword [esp + 0xc], eax
mov ecx, dword [esi]
lea edx, [esp + 0x14]
mov byte [esp + 0x12c], 5
mov eax, dword [ecx - 8]
mov ecx, esi
dec eax
push eax
push edx
call fcn.0048a3dc
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x130], 6
call fcn.0048c53c
lea ecx, [esp + 0x14]
mov byte [esp + 0x12c], 5
call fcn.0048c403
lea eax, [esp + 0xc]
mov ecx, esi
push eax
call fcn.0048c53c
mov byte [esp + 0x12c], bl
lea ecx, [esp + 0xc]
call fcn.0048c403
lea ecx, [esp + 0x10]
mov byte [esp + 0x12c], 1
call fcn.0048c403
mov ecx, dword [esp + 0x144]
push str.msimn.exe
push ecx
call fcn.004773a0
add esp, 8
test eax, eax
jne 0x45f8ca
mov edx, dword [0x4cc854]
push ebp
mov dword [esp + 0x14], edx
mov bl, 7
push esi
lea ecx, [esp + 0x18]
mov byte [esp + 0x134], bl
call fcn.0048c53c
push 0x100
call fcn.0048c144
add esp, 4
mov ebp, eax
mov ecx, 0x40
xor eax, eax
mov edi, ebp
push 0x100
push ebp
push str.ProgramFiles
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov eax, dword [0x4cc854]
mov dword [esp + 0x10], eax
push ebp
lea ecx, [esp + 0x14]
mov byte [esp + 0x134], 8
call fcn.0048c58c
mov ecx, dword [esp + 0x10]
push ecx
push str._ProgramFiles_
lea ecx, [esp + 0x1c]
call fcn.0048a144
lea edx, [esp + 0x14]
mov ecx, esi
push edx
call fcn.0048c53c
push ebp
call fcn.0048c16d
add esp, 4
lea ecx, [esp + 0x10]
mov byte [esp + 0x130], bl
call fcn.0048c403
lea ecx, [esp + 0x14]
mov byte [esp + 0x130], 1
call fcn.0048c403
pop ebp
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x144]
mov eax, dword [ecx - 8]
test eax, eax
je 0x45f99b
lea edx, [esp + 0x14]
push 1
push edx
mov ecx, esi
call fcn.0048a360
mov eax, dword [eax]
push 0x4c2288
push eax
call fcn.0047514f
add esp, 8
lea ecx, [esp + 0x14]
test eax, eax
setne bl
call fcn.0048c403
test bl, bl
je 0x45f923
push 0x4c2288
mov ecx, esi
call fcn.0048c7df
lea eax, [esp + 0x14]
push 1
push eax
lea ecx, [esp + 0x14c]
call fcn.0048a3dc
mov eax, dword [eax]
push 0x4c2288
push eax
call fcn.0047514f
add esp, 8
lea ecx, [esp + 0x14]
test eax, eax
sete bl
call fcn.0048c403
test bl, bl
je 0x45f99b
mov ecx, dword [esp + 0x144]
lea edx, [esp + 0x14]
mov eax, dword [ecx - 8]
lea ecx, [esp + 0x144]
dec eax
push eax
push edx
call fcn.0048a360
push eax
lea ecx, [esp + 0x148]
mov byte [esp + 0x130], 9
call fcn.0048c53c
lea ecx, [esp + 0x14]
mov byte [esp + 0x12c], 1
call fcn.0048c403
lea eax, [esp + 0x144]
mov ecx, esi
push eax
call fcn.0048c81b
mov esi, dword [esi]
push 0
push esi
call fcn.00476665
add esp, 8
or esi, 0xffffffff
cmp eax, esi
mov byte [esp + 0x12c], 0
pop ebx
lea ecx, [esp + 0x134]
jne 0x45f9dc
call fcn.0048c403
mov dword [esp + 0x128], esi
jmp 0x45fa22
call fcn.0048c403
lea ecx, [esp + 0x140]
mov dword [esp + 0x128], esi
call fcn.0048c403
mov al, 1
jmp 0x45fa30
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x134]
mov byte [esp + 0x128], 0
call fcn.0048c403
mov dword [esp + 0x128], 0xffffffff
lea ecx, [esp + 0x140]
call fcn.0048c403
xor al, al
mov ecx, dword [esp + 0x120]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x124
ret 0x18