Function at 0x45ba3c
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x6b0
mov eax, dword [0x46700c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push esi
push edi
lea ecx, reloc.ADVAPI32.dll_TraceMessage
push ecx
xor esi, esi
push 0x20019
push esi
push eax
push 0x80000000
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], esi
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], esi
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], esi
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 1
call ebx
test eax, eax
jne 0x45bf3d
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push esi
push esi
push dword [ebp - 0x6a8]
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0x244
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x45bf35
cmp dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 1
jne 0x45bf35
lea eax, reloc.ADVAPI32.dll_TraceMessage
call fcn.0045b9dc
test eax, eax
je 0x45bf35
and dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x423ef0
mov eax, 0x103
lea ecx, reloc.ADVAPI32.dll_TraceMessage
call fcn.0042c95b
pop ecx
pop ecx
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x20019
push 0
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x80000000
call ebx
test eax, eax
jne 0x45bbd9
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0
push 0
push dword [ebp - 0x69c]
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0x244
call edi
test eax, eax
jne 0x45bbd1
xor edx, edx
inc edx
cmp dword [ebp - reloc.ADVAPI32.dll_TraceMessage], edx
je 0x45bb81
cmp dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 2
jne 0x45bbd1
lea eax, reloc.ADVAPI32.dll_TraceMessage
call fcn.0045b9dc
test eax, eax
je 0x45bbd1
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], edx
call dword [sym.imp.msvcrt.dll__wcslwr]
pop ecx
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
call fcn.0045b9f3
test eax, eax
jne 0x45bbd1
push dword [ebp - 0x6a8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x69c]
call esi
xor eax, eax
jmp 0x45bf43
push dword [ebp - 0x69c]
call esi
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x423f1c
mov eax, 0x103
lea ecx, reloc.ADVAPI32.dll_TraceMessage
call fcn.0042c95b
pop ecx
pop ecx
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x20019
push 0
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x80000000
call ebx
test eax, eax
jne 0x45bcb8
and dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x423f48
mov eax, 0x103
lea ecx, reloc.ADVAPI32.dll_TraceMessage
call fcn.0042c95b
pop ecx
pop ecx
xor ecx, ecx
push ecx
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push ecx
push 0x2001f
push ecx
push ecx
push ecx
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x45bc81
push dword [ebp - 0x698]
push dword [ebp - 0x69c]
call fcn.00443a60
push dword [ebp - 0x698]
call esi
push dword [ebp - 0x69c]
call esi
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x423f1c
mov eax, 0x103
lea ecx, reloc.ADVAPI32.dll_TraceMessage
call fcn.0042c95b
pop ecx
pop ecx
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x80000000
call fcn.0044435d
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x423f7c
mov eax, 0x103
lea ecx, reloc.ADVAPI32.dll_TraceMessage
call fcn.0042c95b
pop ecx
pop ecx
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x20019
push 0
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x80000000
call ebx
test eax, eax
jne 0x45bf35
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0
push 0
push dword [ebp - 0x69c]
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0x244
call edi
test eax, eax
jne 0x45bf2d
cmp dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 1
jne 0x45bf2d
lea eax, reloc.ADVAPI32.dll_TraceMessage
call fcn.0045b9dc
test eax, eax
je 0x45bf2d
and dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0
push 0x41d1ec
mov eax, 0x104
lea edi, reloc.ADVAPI32.dll_TraceMessage
call fcn.0042c8f1
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
mov eax, 0x104
call fcn.0042c8f1
mov eax, edi
push eax
push 0x423f90
mov eax, 0x121
lea ecx, reloc.ADVAPI32.dll_TraceMessage
call fcn.0042c95b
pop ecx
pop ecx
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x20019
xor edi, edi
push edi
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x80000000
call ebx
test eax, eax
jne 0x45be54
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push edi
push edi
push dword [ebp - 0x698]
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x45be4c
xor edx, edx
inc edx
cmp dword [ebp - reloc.ADVAPI32.dll_TraceMessage], edx
je 0x45bdfe
cmp dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 2
jne 0x45be4c
lea eax, reloc.ADVAPI32.dll_TraceMessage
call fcn.0045b9dc
test eax, eax
je 0x45be4c
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], edx
call dword [sym.imp.msvcrt.dll__wcslwr]
pop ecx
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
call fcn.0045b9f3
test eax, eax
jne 0x45be4c
push dword [ebp - 0x6a8]
call esi
push dword [ebp - 0x69c]
call esi
push dword [ebp - 0x698]
jmp 0x45bbc8
push dword [ebp - 0x698]
call esi
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x423fa8
mov eax, 0x121
lea ecx, reloc.ADVAPI32.dll_TraceMessage
call fcn.0042c95b
pop ecx
pop ecx
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x20019
push edi
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x80000000
call ebx
test eax, eax
jne 0x45bf2d
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x423fc0
mov eax, 0x121
lea ecx, reloc.ADVAPI32.dll_TraceMessage
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], edi
call fcn.0042c95b
pop ecx
pop ecx
push edi
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push edi
push 0x2001f
push edi
push edi
push edi
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
mov ebx, 0x80000000
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x45befa
push dword [ebp - 0x6b0]
push dword [ebp - 0x698]
call fcn.00443a60
push dword [ebp - 0x6b0]
call esi
push dword [ebp - 0x698]
call esi
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x423fa8
mov eax, 0x121
lea ecx, reloc.ADVAPI32.dll_TraceMessage
call fcn.0042c95b
pop ecx
pop ecx
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push ebx
call fcn.0044435d
push dword [ebp - 0x69c]
call esi
push dword [ebp - 0x6a8]
call esi
mov eax, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004655f1
leave
ret 4