Function at 0x45ac50
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x524aac
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x57c8b4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x1c], edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x45ac9d
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
cmp dword [ebp + 8], ebx
je 0x45b003
push eax
lea ecx, [ebp - 0x10]
call fcn.004081b0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], 0
mov ecx, dword [eax - 0xc]
cmp ecx, 1
jl 0x45acde
test ecx, ecx
js 0x45b0d4
cmp word [eax], 0x22
jne 0x45acde
push 1
push 0
lea ecx, [ebp - 0x10]
call fcn.0045aa10
mov eax, dword [ebp - 0x10]
mov edx, dword [eax - 0xc]
cmp edx, 1
jl 0x45ad0b
lea ecx, [edx - 1]
test ecx, ecx
js 0x45b0d4
cmp ecx, edx
jg 0x45b0d4
cmp word [eax + ecx*2], 0x22
jne 0x45ad0b
push 1
push ecx
lea ecx, [ebp - 0x10]
call fcn.0045aa10
call fcn.0040b790
mov ecx, eax
test ecx, ecx
je 0x45b0de
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x34], esi
call fcn.0040b790
mov ecx, eax
test ecx, ecx
je 0x45b0e8
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x30], eax
call fcn.0040b790
mov ecx, eax
test ecx, ecx
je 0x45b0f2
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x2c], eax
call fcn.0040b790
mov ecx, eax
test ecx, ecx
je 0x45b0fc
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 1
call fcn.0040b790
mov ecx, eax
test ecx, ecx
je 0x45b106
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
push dword [ebp - 0x10]
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 2
push str.__s_
push eax
call fcn.00408d00
mov eax, dword [ebp - 0x18]
add esi, 0xfffffff0
add esp, 0xc
or edi, 0xffffffff
lea edx, [eax - 0x10]
mov dword [ebp - 0x20], edx
cmp edx, esi
je 0x45ae01
cmp dword [esi + 0xc], 0
jl 0x45adf5
mov ecx, dword [edx]
cmp ecx, dword [esi]
jne 0x45adf5
push edx
call fcn.0040ad50
add esp, 4
mov dword [ebp + 8], eax
mov ecx, edi
lea edx, [esi + 0xc]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x45aded
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp + 8]
add eax, 0x10
mov dword [ebp - 0x34], eax
jmp 0x45ae01
push dword [eax - 0xc]
lea ecx, [ebp - 0x34]
push eax
call fcn.0040a4c0
push 0x14
push 0x53ec94
lea ecx, [ebp - 0x2c]
call fcn.0040a4c0
mov edx, dword [ebp + 0x14]
test edx, edx
jne 0x45ae39
lea eax, [ebp + 8]
push eax
lea ecx, [ebp + 0xb]
call fcn.00459430
mov edx, dword [eax]
mov ebx, 1
mov byte [ebp - 4], 3
mov dword [ebp - 0x14], ebx
test edx, edx
jne 0x45ae39
xor ecx, ecx
jmp 0x45ae4f
mov ecx, edx
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45ae40
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.0040a4c0
mov dword [ebp - 4], 2
test bl, 1
je 0x45ae85
mov edx, dword [ebp + 8]
and ebx, 0xfffffffe
mov dword [ebp - 0x14], ebx
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x45ae85
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
test esi, esi
je 0x45ae96
mov eax, esi
jmp 0x45aeae
lea eax, [ebp + 8]
push eax
lea ecx, [ebp + 0x13]
call fcn.004590f0
mov eax, dword [eax]
or ebx, 2
mov byte [ebp - 4], 4
mov dword [ebp - 0x14], ebx
lea ecx, [ebp - 0x34]
push ecx
mov ecx, dword [ebp - 0x1c]
push eax
call fcn.00459740
mov dword [ebp - 4], 2
mov edx, eax
mov dword [ebp + 0x10], edx
test bl, 2
je 0x45aef4
mov ecx, dword [ebp + 8]
and ebx, 0xfffffffd
add ecx, 0xfffffff0
mov dword [ebp - 0x14], ebx
mov dword [ebp + 0x14], ecx
mov eax, edi
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x45aef4
mov ecx, dword [ecx]
push dword [ebp + 0x14]
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x45af0b
mov eax, dword [ebp + 0xc]
push eax
push str.Add_auto_run_task_schedule_success___s
call fcn.00446bb0
mov esi, dword [ebp + 0x10]
jmp 0x45af6a
test esi, esi
jne 0x45af27
lea eax, [ebp + 0x10]
push eax
lea ecx, [ebp + 0x13]
call fcn.004591c0
mov esi, dword [eax]
or ebx, 4
mov byte [ebp - 4], 5
mov dword [ebp - 0x14], ebx
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x34]
push eax
push esi
call fcn.00459560
mov dword [ebp - 4], 2
mov esi, eax
test bl, 4
je 0x45af5c
mov edx, dword [ebp + 0x10]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x45af5c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp + 0xc]
push eax
push str.Add_auto_run_register___s
call fcn.00446bb0
mov edx, dword [ebp - 0x20]
add esp, 8
mov byte [ebp - 4], 1
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x45af88
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x28]
mov eax, edi
mov byte [ebp - 4], 0
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x45afa6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x2c]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x45afc0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x30]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x45afda
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x34]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x45aff4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
jmp 0x45b0a9
mov esi, dword [ebp + 0x10]
mov dword [ebp + 0x10], esi
test esi, esi
je 0x45b011
mov eax, esi
jmp 0x45b02e
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp + 0xf]
call fcn.00459360
mov eax, dword [eax]
mov ebx, 8
mov dword [ebp - 4], 6
mov dword [ebp - 0x14], ebx
push eax
mov ecx, edi
call fcn.0045a7c0
or edi, 0xffffffff
mov dword [ebp - 4], 0xffffffff
test bl, 8
je 0x45b062
mov edx, dword [ebp + 0xc]
and ebx, 0xfffffff7
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x45b062
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test esi, esi
jne 0x45b07a
lea eax, [ebp + 8]
push eax
lea ecx, [ebp + 0xf]
call fcn.00459290
or ebx, 0x10
mov esi, dword [eax]
mov dword [ebp + 0x10], esi
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push SysReAllocString
call esi
push dword [ebp + 0x10]
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov esi, 1
test bl, 0x10
je 0x45b0be
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x45b0be
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
push 0x80070057
call fcn.00408b70
push 0x80004005
call fcn.00408b70
push 0x80004005
call fcn.00408b70
push 0x80004005
call fcn.00408b70
push 0x80004005
call fcn.00408b70
push 0x80004005
call fcn.00408b70
int3