Function at 0x45a380c9
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x45a3f2e4]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, dword [edi + 0x234]
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x22c], edi
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x214], eax
mov esi, dword [ebp - 0x214]
lea esi, [esi*8 + 0x45a3f2d0]
push dword [esi]
call dword [sym.imp.msvcrt.dll_wcslen]
push eax
push ebx
push dword [esi]
mov dword [ebp - 0x224], eax
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0x10
test eax, eax
jne 0x45a3814b
mov eax, dword [ebp - 0x224]
test eax, eax
je 0x45a3815c
cmp word [ebx + eax*2], 0x3a
je 0x45a3815c
inc dword [ebp - 0x214]
cmp dword [ebp - 0x214], 2
jb 0x45a3810e
jmp 0x45a38171
mov eax, dword [ebp - 0x214]
mov eax, dword [eax*8 + 0x45a3f2d4]
test eax, eax
jne 0x45a382d5
push 0x3a
push ebx
call dword [sym.imp.msvcrt.dll_wcschr]
test eax, eax
pop ecx
pop ecx
jne 0x45a3818a
mov esi, 0x4b4
jmp 0x45a38332
sub eax, ebx
sar eax, 1
mov ebx, eax
lea eax, [ebx + ebx + 0x70]
cmp eax, dword [0x45a3f970]
ja 0x45a381da
mov ecx, dword [0x45a3f974]
lea esi, [ebx + ebx + 0x78]
add ecx, esi
cmp ecx, eax
jb 0x45a381da
push ecx
call fcn.45a3adaf
test eax, eax
je 0x45a381da
mov eax, esi
add eax, 3
and eax, 0xfffffffc
call fcn.45a3abe0
mov eax, esp
test eax, eax
je 0x45a381da
mov dword [eax], 0x6b637453
add eax, 8
mov dword [ebp - 0x21c], eax
jne 0x45a3820e
lea eax, [ebx + ebx + 0x78]
push eax
call dword [0x45a3f978]
test eax, eax
mov dword [ebp - 0x21c], eax
je 0x45a38200
mov dword [eax], 0x70616548
add eax, 8
mov dword [ebp - 0x21c], eax
jne 0x45a38208
push 8
pop esi
jmp 0x45a38316
mov eax, dword [ebp - 0x21c]
push 0x1b
pop ecx
mov edi, eax
mov esi, 0x45a14070
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x230]
mov word [eax + 0x6c], 0x5c
lea edi, [eax + 0x6e]
mov ecx, ebx
rep movsw word es:[edi], word [esi]
lea ecx, [ebp - 0x220]
push ecx
push 0x20019
xor edi, edi
push edi
push eax
push 0x80000002
mov word [eax + ebx*2 + 0x6e], di
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, edi
je 0x45a38267
cmp esi, 2
jne 0x45a38316
mov esi, 0x4b4
jmp 0x45a38316
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x214]
push eax
push edi
push 0x45a14054
push dword [ebp - 0x220]
mov dword [ebp - 0x224], 0x20a
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
cmp esi, edi
jne 0x45a38254
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, edi
mov dword [ebp - 0x218], eax
jne 0x45a382bf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x45a38316
push 0x45a14038
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x45a382b5
mov edi, dword [ebp - 0x22c]
lea ecx, [ebp - 0x228]
push ecx
push 0x45a3f268
call eax
mov esi, eax
test esi, esi
jne 0x45a38316
mov eax, dword [ebp - 0x228]
cmp dword [eax], 1
jae 0x45a382fb
mov esi, 0x519
jmp 0x45a38316
mov dword [edi + 0x228], eax
mov eax, dword [ebp - 0x218]
and dword [ebp - 0x218], 0
mov dword [edi + 0x230], eax
xor esi, esi
mov eax, dword [ebp - 0x21c]
test eax, eax
je 0x45a38332
add eax, 0xfffffff8
cmp dword [eax], 0x70616548
jne 0x45a38332
push eax
call dword [0x45a3f97c]
cmp dword [ebp - 0x220], 0
je 0x45a38347
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x218], 0
je 0x45a3835c
push dword [ebp - 0x218]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
lea esp, [ebp - 0x23c]
mov ecx, dword [ebp - 4]
call fcn.45a3a970
pop edi
pop esi
pop ebx
leave
ret 4