Function at 0x454d54
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x569aa2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x324
mov dword [ebp - 0x2d0], ecx
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x240]
call fcn.0054d095
mov byte [ebp - 4], 1
mov ecx, dword [0x5be480]
mov dword [ebp - 0x2c], ecx
mov byte [ebp - 4], 2
mov edx, dword [0x5be480]
mov dword [ebp - 0x18], edx
mov byte [ebp - 4], 3
mov eax, dword [0x5be480]
mov dword [ebp - 0x244], eax
mov byte [ebp - 4], 4
push 0x208
push 0
lea ecx, [ebp - 0x234]
push ecx
call fcn.005370b0
add esp, 0xc
push 0x208
lea edx, [ebp - 0x234]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x234]
push eax
push str._s_regedit.exe
lea ecx, [ebp - 0x244]
push ecx
call fcn.0054ab7c
add esp, 0xc
mov edx, dword [0x5be480]
mov dword [ebp - 0x28], edx
mov byte [ebp - 4], 5
mov eax, dword [0x5be480]
mov dword [ebp - 0x254], eax
mov byte [ebp - 4], 6
push 0x5c
lea ecx, [ebp - 0x240]
call fcn.0054d807
mov dword [ebp - 0x248], eax
mov ecx, dword [ebp - 0x248]
push ecx
lea edx, [ebp - 0x26c]
push edx
lea ecx, [ebp - 0x240]
call fcn.0054a76e
mov dword [ebp - 0x2d4], eax
mov eax, dword [ebp - 0x2d4]
mov dword [ebp - 0x2d8], eax
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x2d8]
push ecx
lea ecx, [ebp - 0x28]
call fcn.0054d46f
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x26c]
call fcn.0054d328
mov edx, dword [ebp - 0x240]
mov eax, dword [edx - 8]
mov dword [ebp - 0x2a0], eax
mov ecx, dword [ebp - 0x2a0]
sub ecx, dword [ebp - 0x248]
sub ecx, 1
push ecx
lea edx, [ebp - 0x270]
push edx
lea ecx, [ebp - 0x240]
call fcn.0054a6f2
mov dword [ebp - 0x2dc], eax
mov eax, dword [ebp - 0x2dc]
mov dword [ebp - 0x2e0], eax
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x2e0]
push ecx
lea ecx, [ebp - 0x254]
call fcn.0054d46f
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x270]
call fcn.0054d328
mov dword [ebp - 0x258], 0
jmp 0x454efd
mov edx, dword [ebp - 0x258]
add edx, 1
mov dword [ebp - 0x258], edx
mov eax, dword [ebp - 0x254]
mov ecx, dword [eax - 8]
mov dword [ebp - 0x2a4], ecx
mov edx, dword [ebp - 0x258]
cmp edx, dword [ebp - 0x2a4]
jge 0x45503d
mov eax, dword [ebp - 0x258]
mov ecx, dword [ebp - 0x254]
mov dx, word [ecx + eax*2]
mov word [ebp - 0x2a8], dx
mov eax, dword [ebp - 0x2a8]
and eax, 0xffff
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 0xa
jne 0x455038
mov ecx, dword [ebp - 0x254]
mov edx, dword [ecx - 8]
mov dword [ebp - 0x2ac], edx
mov eax, dword [ebp - 0x2ac]
sub eax, dword [ebp - 0x258]
sub eax, 1
push eax
lea ecx, [ebp - 0x274]
push ecx
lea ecx, [ebp - 0x254]
call fcn.0054a6f2
mov dword [ebp - 0x2e4], eax
mov edx, dword [ebp - 0x2e4]
mov dword [ebp - 0x2e8], edx
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x2e8]
push eax
mov ecx, dword [ebp - 0x258]
push ecx
lea edx, [ebp - 0x278]
push edx
lea ecx, [ebp - 0x254]
call fcn.0054a76e
mov dword [ebp - 0x2ec], eax
mov eax, dword [ebp - 0x2ec]
mov dword [ebp - 0x2f0], eax
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x2f0]
push ecx
lea edx, [ebp - 0x27c]
push edx
call fcn.0054d567
mov dword [ebp - 0x2f4], eax
mov eax, dword [ebp - 0x2f4]
mov dword [ebp - 0x2f8], eax
mov byte [ebp - 4], 0xb
mov ecx, dword [ebp - 0x2f8]
push ecx
lea ecx, [ebp - 0x254]
call fcn.0054d46f
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x27c]
call fcn.0054d328
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x278]
call fcn.0054d328
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x274]
call fcn.0054d328
jmp 0x454eee
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 0x28]
call fcn.0054d865
push 0x5aeb44
mov edx, dword [ebp - 0x28]
push edx
call fcn.00537cf5
add esp, 8
mov dword [ebp - 0x2b0], eax
xor eax, eax
cmp dword [ebp - 0x2b0], 0
sete al
and eax, 0xff
test eax, eax
je 0x455086
mov ecx, dword [0x5ae8ec]
mov dword [ebp - 0x20], ecx
jmp 0x4551d7
push 0x5aeb68
mov edx, dword [ebp - 0x28]
push edx
call fcn.00537cf5
add esp, 8
mov dword [ebp - 0x2b4], eax
xor eax, eax
cmp dword [ebp - 0x2b4], 0
sete al
and eax, 0xff
test eax, eax
je 0x4550c0
mov ecx, dword [0x5ae8f0]
mov dword [ebp - 0x20], ecx
jmp 0x4551d7
push 0x5aeb8c
mov edx, dword [ebp - 0x28]
push edx
call fcn.00537cf5
add esp, 8
mov dword [ebp - 0x2b8], eax
xor eax, eax
cmp dword [ebp - 0x2b8], 0
sete al
and eax, 0xff
test eax, eax
je 0x4550fa
mov ecx, dword [reloc.OLEAUT32.dll_SysReAllocString]
mov dword [ebp - 0x20], ecx
jmp 0x4551d7
push 0x5aebb4
mov edx, dword [ebp - 0x28]
push edx
call fcn.00537cf5
add esp, 8
mov dword [ebp - 0x2bc], eax
xor eax, eax
cmp dword [ebp - 0x2bc], 0
sete al
and eax, 0xff
test eax, eax
je 0x455134
mov ecx, dword [0x5ae8f8]
mov dword [ebp - 0x20], ecx
jmp 0x4551d7
push str.HKEY_PERFORMANCE_DATA
mov edx, dword [ebp - 0x28]
push edx
call fcn.00537cf5
add esp, 8
mov dword [ebp - 0x2c0], eax
xor eax, eax
cmp dword [ebp - 0x2c0], 0
sete al
and eax, 0xff
test eax, eax
je 0x45516b
mov ecx, dword [reloc.OLEAUT32.dll_SysReAllocStringLen]
mov dword [ebp - 0x20], ecx
jmp 0x4551d7
push 0x5aebf8
mov edx, dword [ebp - 0x28]
push edx
call fcn.00537cf5
add esp, 8
mov dword [ebp - 0x2c4], eax
xor eax, eax
cmp dword [ebp - 0x2c4], 0
sete al
and eax, 0xff
test eax, eax
je 0x4551a2
mov ecx, dword [0x5ae900]
mov dword [ebp - 0x20], ecx
jmp 0x4551d7
push 0x5aec20
mov edx, dword [ebp - 0x28]
push edx
call fcn.00537cf5
add esp, 8
mov dword [ebp - 0x2c8], eax
xor eax, eax
cmp dword [ebp - 0x2c8], 0
sete al
and eax, 0xff
test eax, eax
je 0x4551d7
mov ecx, dword [reloc.OLEAUT32.dll_SysStringLen]
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], 0
jne 0x455242
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x254]
call fcn.0054d328
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x28]
call fcn.0054d328
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x244]
call fcn.0054d328
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.0054d328
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.0054d328
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x240]
call fcn.0054d328
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0054d328
jmp 0x45595c
mov dword [ebp - 0x1c], 0
lea edx, [ebp - 0x1c]
push edx
push 0x20019
push 0
mov eax, dword [ebp - 0x254]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4552ce
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x254]
call fcn.0054d328
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x28]
call fcn.0054d328
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x244]
call fcn.0054d328
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.0054d328
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.0054d328
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x240]
call fcn.0054d328
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0054d328
jmp 0x45595c
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 0x5aec3c
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4553a0
push 5
push 0
push 0
mov eax, dword [ebp - 0x244]
push eax
push 0x5aec5c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push str.RegEdit_RegEdit
call dword [sym.imp.USER32.dll_FindWindowW]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x4553a0
push 0
push 0
push str.Can_not_start_regeditor.
call fcn.00555cac
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x254]
call fcn.0054d328
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x28]
call fcn.0054d328
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x244]
call fcn.0054d328
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.0054d328
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.0054d328
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x240]
call fcn.0054d328
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0054d328
jmp 0x45595c
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x4553bc
push 9
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4553c6
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_BringWindowToTop]
push 0
push 0x5aecbc
push 0
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.USER32.dll_FindWindowExW]
mov dword [ebp - 0x250], eax
cmp dword [ebp - 0x250], 0
jne 0x45545b
push 0
push 0
push str.Can_not_find_regeditor_TreeView_handle.
call fcn.00555cac
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x254]
call fcn.0054d328
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x28]
call fcn.0054d328
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x244]
call fcn.0054d328
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.0054d328
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.0054d328
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x240]
call fcn.0054d328
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0054d328
jmp 0x45595c
mov dword [ebp - 0x25c], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x24], 0
push 0
push 0
push 0x110a
mov edx, dword [ebp - 0x250]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0
jne 0x45550b
push 0
push 0
push str.Root_item_NOT_found
call fcn.00555cac
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x254]
call fcn.0054d328
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x28]
call fcn.0054d328
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x244]
call fcn.0054d328
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.0054d328
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.0054d328
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x240]
call fcn.0054d328
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0054d328
jmp 0x45595c
mov eax, dword [ebp - 0x25c]
push eax
push 2
push 0x1102
mov ecx, dword [ebp - 0x250]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [ebp - 0x25c]
push edx
push 4
push 0x110a
mov eax, dword [ebp - 0x250]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x23c], 0
jmp 0x45555f
mov ecx, dword [ebp - 0x23c]
add ecx, 1
mov dword [ebp - 0x23c], ecx
cmp dword [ebp - 0x23c], 7
jge 0x4555f1
lea edx, [ebp - 0x1c]
push edx
push 0
push 0x20019
push 0
mov eax, dword [ebp - 0x23c]
mov ecx, dword [eax*4 + 0x5ae8ec]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4555ec
mov edx, dword [ebp - 0x23c]
mov eax, dword [ebp - 0x20]
cmp eax, dword [edx*4 + 0x5ae8ec]
jne 0x4555c7
mov ecx, dword [ebp - 0x10]
push ecx
push 2
push 0x1102
mov edx, dword [ebp - 0x250]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4555f1
mov ecx, dword [ebp - 0x10]
push ecx
push 1
push 0x110a
mov edx, dword [ebp - 0x250]
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x455550
push 0x5c
push ecx
mov ecx, esp
mov dword [ebp - 0x280], esp
lea edx, [ebp - 0x254]
push edx
call fcn.0054d095
mov dword [ebp - 0x2fc], eax
mov ecx, dword [ebp - 0x2d0]
call fcn.0045596c
mov dword [ebp - 0x300], eax
mov eax, dword [ebp - 0x300]
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x24c], 0
jmp 0x455646
mov ecx, dword [ebp - 0x24c]
add ecx, 1
mov dword [ebp - 0x24c], ecx
mov edx, dword [ebp - 0x24c]
cmp edx, dword [ebp - 0x238]
jg 0x4558e4
mov eax, dword [ebp - 0x10]
push eax
push 4
push 0x110a
mov ecx, dword [ebp - 0x250]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x2c]
call fcn.0054d2b0
mov dword [ebp - 0x23c], 0
jmp 0x455696
mov edx, dword [ebp - 0x23c]
add edx, 1
mov dword [ebp - 0x23c], edx
mov eax, dword [ebp - 0x23c]
cmp eax, dword [ebp - 0x24c]
jge 0x455754
push 0x5aed50
push 0x5c
mov ecx, dword [ebp - 0x23c]
push ecx
push ecx
mov ecx, esp
mov dword [ebp - 0x284], esp
lea edx, [ebp - 0x254]
push edx
call fcn.0054d095
mov dword [ebp - 0x304], eax
lea eax, [ebp - 0x288]
push eax
mov ecx, dword [ebp - 0x2d0]
call fcn.00455a4f
mov dword [ebp - 0x308], eax
mov ecx, dword [ebp - 0x308]
mov dword [ebp - 0x30c], ecx
mov byte [ebp - 4], 0xc
mov edx, dword [ebp - 0x30c]
push edx
lea eax, [ebp - 0x28c]
push eax
call fcn.0054d5cd
mov dword [ebp - 0x310], eax
mov ecx, dword [ebp - 0x310]
mov dword [ebp - 0x314], ecx
mov byte [ebp - 4], 0xd
mov edx, dword [ebp - 0x314]
push edx
lea ecx, [ebp - 0x2c]
call fcn.0054d755
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x28c]
call fcn.0054d328
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x288]
call fcn.0054d328
jmp 0x455687
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax - 8]
mov dword [ebp - 0x2cc], ecx
mov edx, dword [ebp - 0x2cc]
sub edx, 1
push edx
lea eax, [ebp - 0x290]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0054a76e
mov dword [ebp - 0x318], eax
mov ecx, dword [ebp - 0x318]
mov dword [ebp - 0x31c], ecx
mov byte [ebp - 4], 0xe
mov edx, dword [ebp - 0x31c]
push edx
lea ecx, [ebp - 0x2c]
call fcn.0054d46f
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x290]
call fcn.0054d328
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push 0
mov ecx, dword [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4558bd
push 0x5c
mov eax, dword [ebp - 0x24c]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x294], esp
lea edx, [ebp - 0x254]
push edx
call fcn.0054d095
mov dword [ebp - 0x320], eax
lea eax, [ebp - 0x298]
push eax
mov ecx, dword [ebp - 0x2d0]
call fcn.00455a4f
mov dword [ebp - 0x324], eax
mov ecx, dword [ebp - 0x324]
mov dword [ebp - 0x328], ecx
mov byte [ebp - 4], 0xf
mov edx, dword [ebp - 0x328]
push edx
lea ecx, [ebp - 0x18]
call fcn.0054d46f
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x298]
call fcn.0054d328
push ecx
mov ecx, esp
mov dword [ebp - 0x29c], esp
lea eax, [ebp - 0x18]
push eax
call fcn.0054d095
mov dword [ebp - 0x32c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
mov ecx, dword [ebp - 0x2d0]
call fcn.0045497d
mov dword [ebp - 0x330], eax
mov edx, dword [ebp - 0x330]
mov dword [ebp - 0x264], edx
mov dword [ebp - 0x268], 0
jmp 0x45588c
mov eax, dword [ebp - 0x268]
add eax, 1
mov dword [ebp - 0x268], eax
mov ecx, dword [ebp - 0x268]
cmp ecx, dword [ebp - 0x264]
jge 0x4558b7
mov edx, dword [ebp - 0x24]
push edx
push 1
push 0x110a
mov eax, dword [ebp - 0x250]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x24], eax
jmp 0x45587d
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x24]
push eax
push 2
push 0x1102
mov ecx, dword [ebp - 0x250]
push ecx
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x455637
mov edx, dword [ebp - 0x24]
push edx
push 9
push 0x110b
mov eax, dword [ebp - 0x250]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x254]
call fcn.0054d328
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x28]
call fcn.0054d328
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x244]
call fcn.0054d328
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.0054d328
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.0054d328
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x240]
call fcn.0054d328
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0054d328
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4