Function at 0x4588ec
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff44
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xa0], ebx
mov dword [ebp - 0xbc], ebx
mov dword [ebp - 0x8c], ebx
mov dword [ebp - 0x74], ecx
mov byte [ebp - 1], dl
mov dword [ebp - 8], eax
mov ecx, 0xa
lea eax, [ebp - 0x48]
mov edx, 0x40107c
call fcn.00403980
xor eax, eax
push ebp
push 0x4595d6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x4595f0
call fcn.00455970
lea eax, [ebp - 0xa0]
call fcn.0042d7a8
mov eax, dword [ebp - 0xa0]
call fcn.00407248
mov byte [ebp - 0x75], 1
mov eax, dword [ebp - 8]
mov byte [eax + 0x1c], 0
mov byte [ebp - 0x76], 0
xor eax, eax
mov dword [ebp - 0x7c], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x20], eax
mov dl, 1
mov eax, 0x451aac
call fcn.00402b30
mov dword [ebp - 0x14], eax
xor edx, edx
push ebp
push 0x459581
push dword fs:[edx]
mov dword fs:[edx], esp
mov dl, 1
mov eax, 0x451aac
call fcn.00402b30
mov dword [ebp - 0x7c], eax
mov dl, 1
mov eax, 0x451aac
call fcn.00402b30
mov dword [ebp - 0x1c], eax
mov dl, 1
mov eax, 0x451aac
call fcn.00402b30
mov dword [ebp - 0x18], eax
mov dl, 1
mov eax, 0x451aac
call fcn.00402b30
mov dword [ebp - 0x10], eax
mov dl, 1
mov eax, 0x451aac
call fcn.00402b30
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x74], 0
je 0x4589ff
mov dl, 1
mov eax, 0x451aac
call fcn.00402b30
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x80], eax
mov ecx, eax
mov edx, dword [ebp - 0x80]
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp byte [ebp - 1], 0
je 0x458d3f
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
je 0x458d3f
mov eax, dword [ebp - 0x84]
cmp word [eax + 0x10], 0x80
jne 0x458d24
xor edx, edx
push ebp
push 0x458cd5
push dword fs:[edx]
mov dword fs:[edx], esp
push ebp
mov eax, dword [ebp - 0x84]
call fcn.00458898
pop ecx
cmp dword [ebp - 0x3c], 0
je 0x458a7d
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x7c]
call fcn.00454648
inc eax
jne 0x458c96
mov bl, 1
mov eax, dword [ebp - 0x84]
mov eax, dword [eax + 8]
test al, 1
je 0x458a90
xor ebx, ebx
jmp 0x458a96
test al, 2
je 0x458a96
mov bl, 2
mov esi, 1
test al, 8
je 0x458aa6
mov esi, 7
jmp 0x458ab7
test al, 0x10
je 0x458ab1
mov esi, 3
jmp 0x458ab7
test al, 0x40
je 0x458ab7
xor esi, esi
test al, 4
jne 0x458bac
mov edx, 0x459620
lea eax, [ebp - 0xa0]
call fcn.00403494
lea eax, [ebp - 0xa0]
mov edx, dword [ebp - 0x48]
call fcn.0040357c
mov eax, dword [ebp - 0xa0]
call fcn.00455970
cmp dword [ebp - 0x44], 0
je 0x458b17
mov edx, 0x459640
lea eax, [ebp - 0xa0]
call fcn.00403494
lea eax, [ebp - 0xa0]
mov edx, dword [ebp - 0x44]
call fcn.0040357c
mov eax, dword [ebp - 0xa0]
call fcn.00455970
mov eax, dword [ebp - 0x84]
mov edi, dword [eax + 8]
test edi, 0x20
je 0x458b3d
test edi, 0x100
setne al
mov edx, dword [ebp - 0x48]
call fcn.0045151c
test al, al
je 0x458b9d
mov eax, dword [ebp - 0x40]
push eax
push ebx
push esi
push 0x457e54
lea eax, [ebp - 0x90]
push eax
mov eax, dword [ebp - 0x84]
test byte [eax + 9], 1
setne al
mov ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0x48]
call fcn.00453578
test al, al
jne 0x458c83
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xa8], eax
mov byte [ebp - 0xa4], 0
lea edx, [ebp - 0xa8]
xor ecx, ecx
mov eax, 0x459664
call fcn.00455b70
mov byte [ebp - 0x75], 0
jmp 0x458c83
mov eax, 0x459688
call fcn.00455970
jmp 0x458c83
mov edx, 0x4596b0
lea eax, [ebp - 0xa0]
call fcn.00403494
lea eax, [ebp - 0xa0]
mov edx, dword [ebp - 0x48]
call fcn.0040357c
mov eax, dword [ebp - 0xa0]
call fcn.00455970
cmp dword [ebp - 0x44], 0
je 0x458c04
mov edx, 0x4596d8
lea eax, [ebp - 0xa0]
call fcn.00403494
lea eax, [ebp - 0xa0]
mov edx, dword [ebp - 0x44]
call fcn.0040357c
mov eax, dword [ebp - 0xa0]
call fcn.00455970
mov eax, dword [ebp - 0x84]
test byte [eax + 8], 0x20
je 0x458c1c
mov eax, dword [ebp - 0x48]
call fcn.0042cc40
test al, al
je 0x458c79
mov eax, dword [ebp - 0x84]
test byte [eax + 8], 0x80
jne 0x458c2a
xor ebx, ebx
mov eax, dword [ebp - 0x40]
push eax
push ebx
push esi
push 0x457e54
lea eax, [ebp - 0x90]
push eax
mov ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x38]
call fcn.004537f8
test al, al
jne 0x458c83
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xa8], eax
mov byte [ebp - 0xa4], 0
lea edx, [ebp - 0xa8]
xor ecx, ecx
mov eax, 0x459700
call fcn.00455b70
mov byte [ebp - 0x75], 0
jmp 0x458c83
mov eax, 0x459724
call fcn.00455970
cmp dword [ebp - 0x3c], 0
je 0x458ccb
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x7c]
call fcn.00454554
jmp 0x458ccb
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xb8], eax
mov byte [ebp - 0xb4], 0xb
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xb0], eax
mov byte [ebp - 0xac], 0xb
lea edx, [ebp - 0xb8]
mov ecx, 1
mov eax, 0x459754
call fcn.00455b70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x458cfd
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 8]
call fcn.00457d20
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x80]
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 8]
jmp 0x458d32
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
jne 0x458a38
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
je 0x458f49
mov byte [ebp - 0x85], 0
mov eax, dword [ebp - 0x84]
cmp word [eax + 0x10], 0x82
jne 0x458efe
mov byte [ebp - 0x85], 1
xor edx, edx
push ebp
push 0x458ed6
push dword fs:[edx]
mov dword fs:[edx], esp
push ebp
mov eax, dword [ebp - 0x84]
call fcn.00458898
pop ecx
cmp byte [ebp - 1], 0
jne 0x458da9
mov eax, dword [ebp - 0x84]
test byte [eax + 8], 1
jne 0x458ec5
cmp byte [ebp - 1], 0
jne 0x458db5
cmp dword [ebp - 0x44], 0
jne 0x458db9
xor eax, eax
jmp 0x458dbb
mov al, 1
mov byte [ebp - 0x86], al
mov eax, dword [ebp - 0x84]
mov eax, dword [eax + 8]
test al, 8
setne bl
test bl, bl
je 0x458de9
test ah, 4
setne dl
mov eax, dword [ebp - 0x48]
call fcn.004583cc
mov byte [ebp - 0x87], al
jmp 0x458df0
mov byte [ebp - 0x87], 0
test bl, bl
je 0x458e42
cmp byte [ebp - 0x87], 0
je 0x458ecc
cmp byte [ebp - 0x86], 0
jne 0x458e42
mov eax, dword [ebp - 0x84]
test byte [eax + 9], 8
setne al
mov edx, dword [ebp - 0x48]
call fcn.0045151c
test al, al
je 0x458e42
mov eax, dword [ebp - 0x84]
test byte [eax + 9], 2
jne 0x458e42
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x458ecc
mov byte [ebp - 0x85], 0
cmp byte [ebp - 0x86], 0
jne 0x458e8a
mov eax, dword [ebp - 0x84]
mov eax, dword [eax + 8]
test al, 0x10
je 0x458e6f
push ebp
test ah, 8
setne al
mov edx, dword [ebp - 0x48]
call fcn.00458488
pop ecx
mov eax, dword [ebp - 0x84]
mov eax, dword [eax + 8]
test al, 0x40
je 0x458e8a
test ah, 8
setne al
mov edx, dword [ebp - 0x48]
call fcn.00458674
mov eax, dword [ebp - 0x84]
test byte [eax + 8], 4
je 0x458ecc
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xa8], eax
mov byte [ebp - 0xa4], 0xb
lea edx, [ebp - 0xa8]
xor ecx, ecx
mov eax, 0x459784
call fcn.00455b70
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x40]
call fcn.004542b0
jmp 0x458ecc
mov byte [ebp - 0x85], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x458efe
cmp byte [ebp - 0x85], 0
je 0x458f2e
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 8]
call fcn.00457d20
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x80]
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 8]
jmp 0x458f3c
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
jne 0x458d58
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
je 0x4594a9
push ebp
mov eax, dword [ebp - 0x84]
call fcn.00458898
pop ecx
xor edx, edx
push ebp
push 0x45944f
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x84]
mov bx, word [eax + 0x10]
movzx eax, bx
cmp eax, 0x85
jg 0x458fe8
je 0x45921d
cmp eax, 0x81
jg 0x458fca
je 0x459066
dec eax
je 0x459019
add eax, 0xfffffff1
sub eax, 2
jb case.0x458ff6.140
sub eax, 0xe
je case.0x458ff6.140
sub eax, 0x60
je case.0x458ff6.140
jmp case.default.0x458ff6
sub eax, 0x82
je 0x459106
dec eax
je case.0x458ff6.140
dec eax
je 0x45920a
jmp case.default.0x458ff6
add eax, 0xffffff7a
cmp eax, 6
ja case.default.0x458ff6
jmp dword [eax*4 + 0x458ffd]
mov edx, 0x4597a4
lea eax, [ebp - 0xbc]
call fcn.00403494
lea eax, [ebp - 0xbc]
mov edx, dword [ebp - 0x48]
call fcn.0040357c
mov edx, dword [ebp - 0xbc]
lea ecx, [ebp - 0xa0]
mov al, 0xb6
call fcn.004506dc
mov ecx, dword [ebp - 0xa0]
mov dl, 1
mov eax, 0x406368
call fcn.00408bac
call fcn.0040311c
jmp case.0x458ff6.140
cmp byte [ebp - 1], 0
jne 0x45907c
mov eax, dword [ebp - 0x84]
test byte [eax + 8], 1
jne case.0x458ff6.140
mov eax, dword [ebp - 0x84]
mov ebx, dword [eax + 8]
test bl, 4
setne al
push eax
test bl, 8
setne al
push eax
push 0x457d98
push 0x457da4
lea eax, [ebp - 0x20]
push eax
test bl, 2
setne cl
test bl, 0x20
setne al
mov edx, dword [ebp - 0x48]
call fcn.00452758
test al, al
je case.0x458ff6.140
mov eax, dword [ebp - 0x84]
mov eax, dword [eax + 8]
test al, 2
je case.0x458ff6.140
test al, 0x10
je case.0x458ff6.140
push 0
mov eax, dword [ebp - 0x70]
push eax
push 1
push 0x10
call sub.shell32.dll_SHChangeNotify
lea edx, [ebp - 0xa0]
mov eax, dword [ebp - 0x48]
call fcn.0042c79c
mov edx, dword [ebp - 0xa0]
mov eax, dword [ebp - 0x14]
call fcn.004545a8
jmp case.0x458ff6.140
lea eax, [ebp - 0x8c]
mov edx, dword [ebp - 0x44]
call fcn.00403494
cmp byte [ebp - 1], 0
jne 0x459123
cmp dword [ebp - 0x8c], 0
jne 0x459131
lea eax, [ebp - 0x8c]
mov edx, dword [ebp - 0x48]
call fcn.00403494
cmp byte [ebp - 1], 0
jne 0x459143
mov eax, dword [ebp - 0x84]
test byte [eax + 8], 1
jne 0x45919a
cmp byte [ebp - 1], 0
jne 0x459159
mov eax, dword [ebp - 0x84]
test byte [eax + 8], 2
jne case.0x458ff6.140
push ebp
mov eax, dword [ebp - 0x84]
mov ebx, dword [eax + 8]
test bl, 0x80
setne al
push eax
test bh, 1
setne al
push eax
test bl, 0x20
setne cl
test bh, 8
setne dl
mov eax, dword [ebp - 0x8c]
call fcn.00457fb8
pop ecx
test al, al
jne case.0x458ff6.140
mov byte [ebp - 0x75], 0
jmp case.0x458ff6.140
mov eax, dword [ebp - 0x84]
mov eax, dword [eax + 8]
test al, 8
je 0x4591b5
test ah, 4
setne dl
mov eax, dword [ebp - 0x48]
call fcn.004583cc
mov eax, dword [ebp - 0x8c]
mov edx, dword [ebp - 0x48]
call fcn.00403684
je case.0x458ff6.140
push ebp
mov eax, dword [ebp - 0x84]
mov ebx, dword [eax + 8]
test bl, 0x80
setne al
push eax
test bh, 1
setne al
push eax
test bl, 0x20
setne cl
test bh, 8
setne dl
mov eax, dword [ebp - 0x8c]
call fcn.00457fb8
pop ecx
test al, al
jne case.0x458ff6.140
mov byte [ebp - 0x75], 0
jmp case.0x458ff6.140
mov ecx, dword [ebp - 0x48]
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x44]
call fcn.0042d064
jmp case.0x458ff6.140
mov eax, dword [ebp - 0x84]
test byte [eax + 8], 1
je 0x45923c
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x44]
call fcn.0042cf0c
test al, al
je case.0x458ff6.140
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x44]
call fcn.0042d0b0
jmp case.0x458ff6.140
lea ecx, [ebp - 0x98]
lea edx, [ebp - 0x91]
mov eax, dword [ebp - 0x84]
mov eax, dword [eax + 8]
call fcn.00457a80
mov ecx, dword [ebp - 0x70]
mov edx, dword [ebp - 0x98]
mov al, byte [ebp - 0x91]
call fcn.0042dce8
test eax, eax
je case.0x458ff6.140
sub eax, 2
je case.0x458ff6.140
mov byte [ebp - 0x75], 0
jmp case.0x458ff6.140
lea ecx, [ebp - 0x98]
lea edx, [ebp - 0x91]
mov eax, dword [ebp - 0x84]
mov eax, dword [eax + 8]
call fcn.00457a80
push 0
push 2
lea eax, [ebp - 0x9c]
push eax
mov ecx, dword [ebp - 0x70]
mov edx, dword [ebp - 0x98]
mov al, byte [ebp - 0x91]
call fcn.0042dc44
test eax, eax
jne case.0x458ff6.140
push 1
push 0x491aa4
push 1
push 0
mov eax, dword [ebp - 0x6c]
push eax
mov eax, dword [ebp - 0x9c]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x4592f8
mov byte [ebp - 0x75], 0
mov eax, dword [ebp - 0x9c]
push eax
call sub.advapi32.dll_RegCloseKey
jmp case.0x458ff6.140
lea ecx, [ebp - 0x98]
lea edx, [ebp - 0x91]
mov eax, dword [ebp - 0x84]
mov eax, dword [eax + 8]
call fcn.00457a80
mov ecx, dword [ebp - 0x70]
mov edx, dword [ebp - 0x98]
mov al, byte [ebp - 0x91]
call fcn.0042de24
test eax, eax
je case.0x458ff6.140
sub eax, 2
je case.0x458ff6.140
sub eax, 0x8f
je case.0x458ff6.140
mov byte [ebp - 0x75], 0
jmp case.0x458ff6.140
lea ecx, [ebp - 0x98]
lea edx, [ebp - 0x91]
mov eax, dword [ebp - 0x84]
mov eax, dword [eax + 8]
call fcn.00457a80
push 0
push 3
lea eax, [ebp - 0x9c]
push eax
mov ecx, dword [ebp - 0x70]
mov edx, dword [ebp - 0x98]
mov al, byte [ebp - 0x91]
call fcn.0042dc44
test eax, eax
jne case.0x458ff6.140
mov edx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x9c]
call fcn.0042db8c
test al, al
je 0x4593c7
mov eax, dword [ebp - 0x6c]
push eax
mov eax, dword [ebp - 0x9c]
push eax
call sub.advapi32.dll_RegDeleteValueA
test eax, eax
je 0x4593c7
mov byte [ebp - 0x75], 0
mov eax, dword [ebp - 0x9c]
push eax
call sub.advapi32.dll_RegCloseKey
jmp case.0x458ff6.140
mov eax, dword [ebp - 0x84]
test byte [eax + 8], 1
setne dl
mov eax, dword [ebp - 0x48]
call fcn.004583cc
jmp case.0x458ff6.140
mov byte [ebp - 0x76], 1
jmp case.0x458ff6.140
lea eax, [ebp - 0xbc]
push eax
movzx eax, bx
mov dword [ebp - 0xa8], eax
mov byte [ebp - 0xa4], 0
lea edx, [ebp - 0xa8]
xor ecx, ecx
mov eax, 0x4597bc
call fcn.00407894
mov edx, dword [ebp - 0xbc]
lea ecx, [ebp - 0xa0]
mov al, 0xb6
call fcn.004506dc
mov ecx, dword [ebp - 0xa0]
mov dl, 1
mov eax, 0x406368
call fcn.00408bac
call fcn.0040311c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x459477
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 8]
call fcn.00457d20
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x80]
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp dword [ebp - 0x84], 0
jne 0x458f62
cmp byte [ebp - 0x76], 0
je 0x4594bf
push 0
push 0
push 0
push 0x8000000
call sub.shell32.dll_SHChangeNotify
mov eax, dword [ebp - 8]
test byte [eax + 0x1d], 0x10
je 0x4594cd
call fcn.0045448c
cmp dword [ebp - 0x74], 0
je 0x4594dd
call dword [ebp - 0x74]
push ebp
call fcn.00458804
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45958b
mov eax, dword [ebp - 0x20]
call fcn.00402b58
mov eax, dword [ebp - 0xc]
call fcn.00402b58
mov eax, dword [ebp - 0x10]
call fcn.00402b58
mov eax, dword [ebp - 0x14]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x459560
inc esi
xor ebx, ebx
lea ecx, [ebp - 0xa0]
mov edx, ebx
mov eax, dword [ebp - 0x14]
call fcn.0045462c
mov eax, dword [ebp - 0xa0]
call fcn.0042cc2c
test al, al
je 0x45955c
push 0
lea ecx, [ebp - 0xa0]
mov edx, ebx
mov eax, dword [ebp - 0x14]
call fcn.0045462c
mov eax, dword [ebp - 0xa0]
call fcn.00403738
push eax
push 0x1001
push 0x1000
call sub.shell32.dll_SHChangeNotify
inc ebx
dec esi
jne 0x459510
mov eax, dword [ebp - 0x18]
call fcn.00402b58
mov eax, dword [ebp - 0x1c]
call fcn.00402b58
mov eax, dword [ebp - 0x7c]
call fcn.00402b58
mov eax, dword [ebp - 0x14]
call fcn.00402b58
ret