Function at 0x450d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x5ac004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 0x5aea10
push 0xfffffffffffffff7
push 0x20019
lea eax, [ebp - 8]
mov byte [0x5b2694], 0
push eax
call sym.ProcessHacker.exe_PhOpenKey
test eax, eax
js 0x45102f
push 0x50
push 4
push dword [0x5b1dac]
xor ebx, ebx
mov dword [ebp - 0x18], 0x14
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
push 0x100
push 4
push dword [0x5b1dac]
mov dword [ebp - 0x14], eax
xor esi, esi
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x10], 0x100
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
push edi
push 1
push esi
push dword [ebp - 0xc]
call dword [sym.imp.ntdll.dll_NtEnumerateValueKey]
cmp eax, 0x8000001a
je 0x450ecb
jmp 0x450dc0
cmp eax, 0x80000005
je 0x450dce
cmp eax, 0xc0000023
jne 0x450e06
push edi
push 0
push dword [0x5b1dac]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword [ebp - 0x10]
push 4
push dword [0x5b1dac]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
push edi
push 1
push esi
push dword [ebp - 0xc]
call dword [sym.imp.ntdll.dll_NtEnumerateValueKey]
test eax, eax
js 0x450ecb
cmp dword [edi + 4], 1
jne 0x450ea2
cmp dword [edi + 0xc], 2
jbe 0x450e6a
lfence
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push dword [0x5b1d70]
mov dword [ebp - 0x24], eax
add ecx, edi
add eax, 0xa
mov dword [ebp - 0x20], ecx
push eax
call sym.ProcessHacker.exe_PhCreateObject
mov ecx, dword [ebp - 0x24]
mov esi, eax
lea eax, [esi + 8]
xor edx, edx
mov dword [esi + 4], eax
mov dword [esi], ecx
mov word [eax + ecx], dx
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x450e71
push ecx
push eax
lfence
push dword [esi + 4]
call fcn.00521a30
add esp, 0xc
jmp 0x450e71
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov esi, eax
mov eax, dword [ebp - 0x18]
cmp ebx, eax
jne 0x450e98
add eax, eax
mov dword [ebp - 0x18], eax
shl eax, 2
push eax
mov eax, dword [ebp - 0x14]
push eax
push 4
push dword [0x5b1dac]
call dword [sym.imp.ntdll.dll_RtlReAllocateHeap]
mov dword [ebp - 0x14], eax
jmp 0x450e9b
mov eax, dword [ebp - 0x14]
mov dword [eax + ebx*4], esi
inc ebx
mov esi, dword [ebp - 0x2c]
lea eax, [ebp - 0x10]
inc esi
push eax
lfence
push dword [ebp - 0x10]
mov dword [ebp - 0x2c], esi
push edi
push 1
push esi
push dword [ebp - 0xc]
call dword [sym.imp.ntdll.dll_NtEnumerateValueKey]
lea ecx, [ecx]
cmp eax, 0x8000001a
jne 0x450dc0
push edi
push 0
push dword [0x5b1dac]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
xor esi, esi
mov dword [ebp - 0xc], esi
test ebx, ebx
je 0x451011
mov edi, 0x5b3834
lea ecx, [ecx]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x14]
push dword [eax + esi*4]
call sym.ProcessHacker.exe_PhParseCommandLineFuzzy
test al, al
je 0x450fe7
xor ecx, ecx
xor eax, eax
lock cmpxchg dword [edi], ecx
mov edi, dword [ebp - 0x20]
mov esi, eax
test esi, esi
je 0x450f2a
lock inc dword [esi - 4]
jmp 0x450f52
push 0
push dword [0x5b1d78]
call sym.ProcessHacker.exe_PhGetDllFileName
mov esi, eax
mov edx, 0x5b3834
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x450f4e
lock inc dword [esi - 4]
test esi, esi
je 0x450fc8
push esi
call sym.ProcessHacker.exe_PhGetBaseName
mov dword [ebp - 0x18], eax
lea ecx, [esi - 8]
or edx, 0xffffffff
lock xadd dword [ecx + 4], edx
dec edx
jne 0x450f71
call fcn.004b3960
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x18]
test edi, edi
je 0x450fb4
mov ecx, dword ds:[eax]
mov edx, dword [edi]
cmp ecx, edx
ja 0x450fb4
mov eax, dword [edi + 4]
sub eax, ecx
mov dword [ebp - 0x30], ecx
add eax, edx
push 1
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x30]
push esi
push eax
call sym.ProcessHacker.exe_PhEqualStringRef
movzx ecx, byte [0x5b2694]
test al, al
mov eax, 1
cmovne ecx, eax
mov byte [0x5b2694], cl
lea ecx, ds:[esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x450fc8
call fcn.004b3960
test edi, edi
je 0x450fdf
lea ecx, [edi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x450fdf
call fcn.004b3960
mov esi, dword [ebp - 0xc]
mov edi, 0x5b3834
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + esi*4]
or eax, 0xffffffff
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x451005
jmp 0x451000
call fcn.004b3960
inc esi
mov dword [ebp - 0xc], esi
cmp esi, ebx
jb 0x450ef0
push dword ds:[ebp - 0x14]
push 0
push dword [0x5b1dac]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtClose]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051e068
mov esp, ebp
pop ebp
ret