Function at 0x4454a2
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x46700c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, edx
xor edx, edx
push edi
mov edi, ecx
xor ecx, ecx
inc edx
mov ebx, ecx
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], ecx
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], edx
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], ecx
test esi, esi
jne 0x4454e5
mov eax, 0x80004003
jmp 0x445864
test edi, edi
je 0x445573
mov ecx, edi
lea edx, [ecx + 2]
xor ebx, ebx
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x4454f4
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 1]
push eax
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new___unsigned_int_]
pop ecx
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
test eax, eax
jne 0x44552c
mov eax, 0x8007000e
jmp 0x445864
xor ecx, ecx
push ecx
push ecx
push dword [ebp - 0x420]
mov ebx, 0x80004005
push eax
push 0xffffffffffffffff
push edi
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, 0x200
test eax, eax
je 0x445561
mov eax, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
mov edx, edi
mov ecx, esi
xor ebx, ebx
call fcn.0043dbf8
push dword [ebp - 0x41c]
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
jmp 0x445623
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push edx
push ecx
push 0x4016a0
mov edi, 0x200
push 0x80000002
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4455ed
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push esi
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
xor eax, eax
push eax
push 0x41e8a4
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4455d9
inc eax
cmp dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
jne 0x4455d9
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
xor eax, eax
mov byte [esi + 0x1ff], al
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - reloc.ADVAPI32.dll_TraceMessage], ebx
jne 0x44563b
push edi
push esi
push 0x277e
push dword [0x4683ec]
call dword [sym.imp.USER32.dll_LoadStringA]
test eax, eax
jne 0x44563b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jne 0x445615
push 0x57
pop ebx
test ebx, ebx
jle 0x445623
and ebx, 0xffff
or ebx, 0x80070000
test ebx, ebx
jns 0x44563b
push ebx
push 0x41e8f0
push 2
pop esi
call fcn.00440126
pop ecx
jmp 0x445861
push 0x41e8b0
push esi
call dword [sym.imp.msvcrt.dll_strstr]
pop ecx
pop ecx
test eax, eax
jne 0x44569f
push 0x41e8b4
push esi
call dword [sym.imp.msvcrt.dll_strstr]
pop ecx
pop ecx
test eax, eax
jne 0x44569f
push 0x41e8bc
push esi
call dword [sym.imp.msvcrt.dll_strstr]
pop ecx
pop ecx
test eax, eax
jne 0x44569f
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x445676
sub ecx, edx
je 0x445692
cmp ecx, edi
jae 0x445692
cmp byte [ecx + esi - 1], 0x2f
je 0x445692
mov word [ecx + esi], 0x2f
push 0x4044dc
push esi
mov eax, edi
call fcn.0043f50c
push 0x41e8b0
push esi
call dword [sym.imp.msvcrt.dll_strstr]
pop ecx
pop ecx
test eax, eax
jne 0x4456be
push 0x41e8b0
push esi
mov eax, edi
call fcn.0043f50c
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4456c3
sub ecx, edx
mov eax, edi
sub eax, ecx
push eax
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new___unsigned_int_]
pop ecx
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
test eax, eax
je 0x445862
xor eax, eax
push 0x41e8c4
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
push esi
mov eax, edi
call fcn.0043f50c
mov eax, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
add eax, 0xfffffff6
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
cmp eax, reloc.ADVAPI32.dll_TraceMessage
jae 0x4457e8
xor eax, eax
push eax
push 0xc
push 0x4044e8
mov eax, 0x208
lea ecx, reloc.ADVAPI32.dll_TraceMessage
call fcn.0042c99c
add esp, 0xc
test eax, eax
js 0x4457e8
mov eax, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 1
xor eax, eax
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4457e8
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push dword [ebp - 0x41c]
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
xor eax, eax
push eax
push 0x41e8d4
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4457d3
cmp dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 1
jne 0x4457d3
push 0x41e8e0
push esi
mov eax, edi
call fcn.0043f50c
push dword [ebp - 0x41c]
mov eax, edi
push esi
call fcn.0043f50c
push 0x41e8d0
push esi
mov eax, edi
call fcn.0043f50c
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 1
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0
jne 0x445855
lea eax, reloc.ADVAPI32.dll_TraceMessage
test eax, eax
je 0x445855
push 0x104
lea edi, reloc.ADVAPI32.dll_TraceMessage
call fcn.00444a99
test eax, eax
je 0x445855
xor ecx, ecx
push ecx
push ecx
mov edx, 0x104
push edx
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push edx
mov eax, edi
push eax
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x445855
push 0x41e8e0
mov edi, 0x200
push esi
mov eax, edi
call fcn.0043f50c
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push esi
mov eax, edi
call fcn.0043f50c
push 0x41e8d0
push esi
mov eax, edi
call fcn.0043f50c
push dword [ebp - 0x41c]
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004655f1
leave
ret