Function at 0x450c7b
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x34c4
call fcn.005482e0
mov eax, dword [0x5afee0]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x34a8], 0
push ebx
push esi
push edi
lea eax, [ebp - 0x34a8]
push eax
mov esi, str.SoftwareMicrosoftInternet_ExplorerIntelliForms
push esi
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x450d78
mov ebx, 0x1046
push ebx
push eax
mov word [ebp - 0x245c], ax
lea eax, [ebp - 0x245a]
push eax
call fcn.00537010
mov edi, 0x823
mov dword [ebp - 0x34ac], edi
jmp 0x450d45
xor eax, eax
push ebx
push eax
mov word [ebp - 0x34a4], ax
lea eax, [ebp - 0x34a2]
push eax
call fcn.00537010
lea eax, [ebp - 0x245c]
push eax
push esi
push 0x57c6a4
lea eax, [ebp - 0x34a4]
push edi
push eax
call fcn.00532a01
add esp, 0x20
lea eax, [ebp - 0x34a4]
push eax
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
test eax, eax
jne 0x450d6c
push 0x1048
push eax
lea eax, [ebp - 0x245c]
push eax
mov dword [ebp - 0x34ac], edi
call fcn.00537010
add esp, 0xc
lea eax, [ebp - 0x34ac]
push eax
lea eax, [ebp - 0x245c]
push eax
push 0
push dword [ebp - 0x34a8]
call dword [sym.imp.SHLWAPI.dll_SHEnumKeyExW]
test eax, eax
je 0x450ce3
push dword [ebp - 0x34a8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
xor esi, esi
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push esi
push eax
mov dword [ebp - 0x34ac], esi
mov dword [ebp - 0x34a8], esi
call fcn.00537010
lea eax, [ebp - 0x34a8]
push eax
call fcn.004a4e77
add esp, 0x10
test eax, eax
je 0x450f43
mov ecx, dword [ebp - 0x34a8]
lea ebx, [ebp - 0x20c]
call fcn.004a4a50
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x1414]
push str.SoftwareMicrosoftProtected_Storage_System_Provider_
push eax
call fcn.00533226
lea eax, [ebp - 0x20c]
add esp, 0xc
mov edx, eax
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x450deb
sub eax, edx
lea edi, [ebp - 0x1414]
dec edi
dec edi
mov cx, word [edi + 2]
inc edi
inc edi
test cx, cx
jne 0x450dff
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
lea eax, [ebp - 0x1414]
push eax
lea eax, [ebp - 0x414]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.00533226
lea eax, [ebp - 0x414]
push eax
lea esi, [ebp - 0x34b0]
call fcn.004a4b1a
mov ecx, dword [ebp - 0x34a8]
lea eax, [ebp - 0x34ac]
push eax
lea eax, [ebp - 0x34c4]
push eax
call fcn.004a4baa
add esp, 0x18
mov ebx, 0x80000001
test eax, eax
je 0x450efa
push 0
lea eax, [ebp - 0x34c4]
push eax
lea eax, [ebp - 0x1414]
push eax
push ebx
call fcn.004a4d71
add esp, 0x10
lea edi, [ebp - 0x1414]
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
test ax, ax
jne 0x450e8a
mov esi, str.Data
movsd dword es:[edi], dword [esi]
push 0
lea eax, [ebp - 0x34c4]
push eax
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x1414]
push eax
push ebx
movsd dword es:[edi], dword [esi]
call fcn.004a4d71
add esp, 0x10
lea edi, [ebp - 0x1414]
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
test ax, ax
jne 0x450ebe
push 0x13
pop ecx
push 1
lea eax, [ebp - 0x34c4]
push eax
lea eax, [ebp - 0x1414]
push eax
mov esi, str.e161255a_37c3_11d2_bcaa_00c04fd929db
push ebx
rep movsd dword es:[edi], dword [esi]
call fcn.004a4d71
add esp, 0x10
lea eax, [ebp - 0x1414]
push eax
push ebx
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
xor esi, esi
cmp dword [ebp - 0x34ac], esi
je 0x450f18
push dword [ebp - 0x34ac]
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 0x34b0], esi
je 0x450f43
push 0
push dword [ebp - 0x34b0]
lea eax, [ebp - 0x414]
push eax
push ebx
call fcn.004a4d71
push dword [ebp - 0x34b0]
call fcn.0052f7c5
add esp, 0x14
cmp dword [ebp - 0x34a8], 0
pop edi
pop esi
pop ebx
je 0x450f64
push dword [ebp - 0x34a8]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0052f7d0
leave
ret