Function at 0x45e360
Capabilities:
Encode data using xor
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5647fb
mov eax, dword fs:[0]
push eax
sub esp, 0x488
mov eax, dword [0x5be26c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov eax, 0xe350
mov dword [ebp - 0x48c], ebx
mov ecx, 0xe375
mov word [ebp - 0x428], ax
mov esi, 0xe364
mov word [ebp - 0x426], cx
mov eax, 0xe363
mov word [ebp - 0x424], si
mov edx, 0xe374
mov word [ebp - 0x422], ax
mov eax, 0xe366
mov word [ebp - 0x420], dx
mov word [ebp - 0x41e], ax
mov eax, 0xe349
mov word [ebp - 0x41c], cx
mov word [ebp - 0x41a], ax
mov eax, 0xe36a
mov word [ebp - 0x418], ax
mov eax, 0xe31d
mov word [ebp - 0x416], si
xor esi, esi
mov word [ebp - 0x414], dx
mov dword [ebp - 0x490], ebx
mov ebx, 0xf
mov word [ebp - 0x412], ax
mov ax, word [ebp - 0x428]
nop dword [eax]
mov ax, word [ebp + esi*2 - 0x428]
mov ecx, esi
and ecx, ebx
movzx edi, ax
cmp ecx, ebx
mov eax, 0xadebe306
mov edx, 0xa149c165
cmovae ecx, ebx
shl ecx, 2
call fcn.0046c590
mov cx, ax
lea eax, [esi - 0x1cfa]
and cx, bx
xor cx, ax
xor cx, di
mov word [ebp + esi*2 - 0x428], cx
inc esi
cmp esi, 0xc
jb 0x45e430
mov ecx, 0x82b3
mov eax, 0x82ac
mov word [ebp - 0x484], cx
mov edx, 0x82aa
mov word [ebp - 0x482], ax
mov eax, 0x82a3
mov word [ebp - 0x480], dx
mov word [ebp - 0x47e], cx
mov ecx, 0x829d
mov word [ebp - 0x47c], ax
mov eax, 0x82b7
mov word [ebp - 0x47a], ax
mov eax, 0x82b8
mov word [ebp - 0x478], dx
mov edx, 0x837d
mov word [ebp - 0x476], ax
mov eax, 0x82a6
mov word [ebp - 0x474], ax
mov eax, 0x82be
mov word [ebp - 0x472], ax
mov eax, 0x8294
mov word [ebp - 0x470], cx
mov word [ebp - 0x46e], ax
mov eax, 0x8281
mov word [ebp - 0x46c], ax
mov eax, 0x8299
mov word [ebp - 0x46a], ax
mov eax, 0x8283
mov word [ebp - 0x468], ax
mov eax, 0x8296
mov word [ebp - 0x466], cx
mov ecx, 0x8369
mov word [ebp - 0x464], ax
mov eax, 0x8287
mov word [ebp - 0x462], ax
mov eax, 0x82a0
mov word [ebp - 0x460], ax
mov word [ebp - 0x45e], ax
mov eax, 0x836d
mov word [ebp - 0x45c], ax
mov eax, 0x8368
mov word [ebp - 0x45a], ax
mov eax, 0x836c
mov word [ebp - 0x458], ax
mov eax, 0x8362
mov word [ebp - 0x456], ax
mov eax, 0x8370
mov word [ebp - 0x454], dx
mov word [ebp - 0x452], ax
mov eax, 0x8324
mov word [ebp - 0x450], ax
mov eax, 0x8349
mov word [ebp - 0x44e], ax
mov eax, 0x8357
mov word [ebp - 0x44c], ax
mov eax, 0x835a
mov word [ebp - 0x44a], ax
mov eax, 0x8343
mov word [ebp - 0x448], ax
mov eax, 0x8377
mov word [ebp - 0x446], ax
mov eax, 0x8372
mov word [ebp - 0x444], ax
mov eax, 0x8371
mov word [ebp - 0x442], ax
mov eax, 0x8360
mov word [ebp - 0x440], cx
mov word [ebp - 0x43e], cx
mov word [ebp - 0x43c], ax
mov eax, 0x8340
mov word [ebp - 0x43a], ax
mov eax, 0x836f
mov word [ebp - 0x438], dx
mov word [ebp - 0x436], ax
mov eax, 0x837a
mov word [ebp - 0x434], cx
mov word [ebp - 0x432], ax
mov eax, 0x837b
mov word [ebp - 0x430], ax
mov eax, 0x8379
mov word [ebp - 0x42e], ax
mov ebx, dword [ebp - 0x490]
mov eax, 0x8313
mov word [ebp - 0x42c], ax
xor edi, edi
mov ax, word [ebp - 0x484]
nop
mov ax, word [ebp + edi*2 - 0x484]
mov ecx, edi
and ecx, 0xf
movzx esi, ax
cmp ecx, 0xf
mov eax, 0xf
mov edx, 0x9afb026e
cmovae ecx, eax
mov eax, 0xea7482ec
shl ecx, 2
call fcn.0046c590
mov cx, ax
lea eax, [edi - 0x7d14]
and cx, 0xf
xor cx, ax
xor cx, si
mov word [ebp + edi*2 - 0x484], cx
inc edi
cmp edi, 0x2d
jb 0x45e680
push 0x400
lea eax, [ebp - 0x410]
push 0
push eax
call fcn.00516260
add esp, 0xc
mov dword [ebp - 0x48c], 1
lea eax, [ebp - 0x494]
mov dword [ebp - 0x494], 0x400
push eax
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x48c]
push eax
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x484]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea ecx, [ebp - 0x488]
test eax, eax
jne 0x45e739
lea eax, [ebp - 0x410]
push eax
jmp 0x45e73e
push 0x577b70
call fcn.0040ad40
xor eax, eax
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 7
mov word [ebx], ax
mov eax, dword [ebp - 0x488]
mov edx, eax
mov dword [ebp - 4], 0
lea esi, [edx + 2]
nop dword [eax + eax]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x45e770
sub edx, esi
mov ecx, ebx
sar edx, 1
push edx
push eax
call fcn.00421290
mov eax, dword [ebp - 0x488]
or ecx, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x45e7ad
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046c16d
mov esp, ebp
pop ebp
ret