Function at 0x45a984
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff44
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xa0], ebx
mov dword [ebp - 0xbc], ebx
mov dword [ebp - 0x8c], ebx
mov dword [ebp - 0x74], ecx
mov byte [ebp - 1], dl
mov dword [ebp - 8], eax
mov ecx, 0xa
lea eax, [ebp - 0x48]
mov edx, 0x40107c
call fcn.00403980
xor eax, eax
push ebp
push 0x45b6e5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x45b700
call fcn.00456ff8
lea eax, [ebp - 0xa0]
call fcn.0042d890
mov eax, dword [ebp - 0xa0]
call fcn.004072b0
mov byte [ebp - 0x75], 1
mov eax, dword [ebp - 8]
mov byte [eax + 0x1c], 0
mov byte [ebp - 0x76], 0
xor eax, eax
mov dword [ebp - 0x7c], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x20], eax
mov dl, 1
mov eax, 0x452990
call fcn.00402b30
mov dword [ebp - 0x14], eax
xor edx, edx
push ebp
push 0x45b690
push dword fs:[edx]
mov dword fs:[edx], esp
mov dl, 1
mov eax, 0x452990
call fcn.00402b30
mov dword [ebp - 0x7c], eax
mov dl, 1
mov eax, 0x452990
call fcn.00402b30
mov dword [ebp - 0x1c], eax
mov dl, 1
mov eax, 0x452990
call fcn.00402b30
mov dword [ebp - 0x18], eax
mov dl, 1
mov eax, 0x452990
call fcn.00402b30
mov dword [ebp - 0x10], eax
mov dl, 1
mov eax, 0x452990
call fcn.00402b30
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x74], 0
je 0x45aa97
mov dl, 1
mov eax, 0x452990
call fcn.00402b30
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x80], eax
mov ecx, eax
mov edx, dword [ebp - 0x80]
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp byte [ebp - 1], 0
je 0x45ae3a
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
je 0x45ae3a
mov eax, dword [ebp - 0x84]
cmp word [eax + 0x10], 0x80
jne 0x45ae1f
xor edx, edx
push ebp
push 0x45add0
push dword fs:[edx]
mov dword fs:[edx], esp
push ebp
mov eax, dword [ebp - 0x84]
call fcn.0045a930
pop ecx
cmp dword [ebp - 0x3c], 0
je 0x45ab15
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x7c]
call fcn.00455810
inc eax
jne 0x45ad91
mov bl, 1
mov eax, dword [ebp - 0x84]
mov eax, dword [eax + 8]
test al, 1
je 0x45ab28
xor ebx, ebx
jmp 0x45ab2e
test al, 2
je 0x45ab2e
mov bl, 2
mov esi, 1
test al, 8
je 0x45ab3e
mov esi, 7
jmp 0x45ab4f
test al, 0x10
je 0x45ab49
mov esi, 3
jmp 0x45ab4f
test al, 0x40
je 0x45ab4f
xor esi, esi
test al, 4
jne 0x45ac77
mov edx, 0x45b730
lea eax, [ebp - 0xa0]
call fcn.00403494
lea eax, [ebp - 0xa0]
mov edx, dword [ebp - 0x48]
call fcn.0040357c
mov eax, dword [ebp - 0xa0]
call fcn.00456ff8
cmp dword [ebp - 0x44], 0
je 0x45abaf
mov edx, 0x45b750
lea eax, [ebp - 0xa0]
call fcn.00403494
lea eax, [ebp - 0xa0]
mov edx, dword [ebp - 0x44]
call fcn.0040357c
mov eax, dword [ebp - 0xa0]
call fcn.00456ff8
mov eax, dword [ebp - 0x84]
mov edi, dword [eax + 8]
test edi, 0x20
je 0x45abd9
test edi, 0x100
setne al
mov edx, dword [ebp - 0x48]
call fcn.00452400
test al, al
je 0x45ac68
mov eax, dword [ebp - 0x40]
push eax
push ebx
push esi
push 0x459d34
lea eax, [ebp - 0x90]
push eax
mov eax, dword [ebp - 0x84]
test byte [eax + 9], 1
setne al
mov ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0x48]
call fcn.0045452c
test al, al
jne 0x45ac35
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xa8], eax
mov byte [ebp - 0xa4], 0
lea edx, [ebp - 0xa8]
xor ecx, ecx
mov eax, 0x45b774
call fcn.00457204
mov byte [ebp - 0x75], 0
jmp 0x45ad7e
cmp bl, 1
jne 0x45ad7e
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xa8], eax
mov byte [ebp - 0xa4], 0
lea edx, [ebp - 0xa8]
xor ecx, ecx
mov eax, 0x45b798
call fcn.00457204
jmp 0x45ad7e
mov eax, 0x45b7b8
call fcn.00456ff8
jmp 0x45ad7e
mov edx, 0x45b7e0
lea eax, [ebp - 0xa0]
call fcn.00403494
lea eax, [ebp - 0xa0]
mov edx, dword [ebp - 0x48]
call fcn.0040357c
mov eax, dword [ebp - 0xa0]
call fcn.00456ff8
cmp dword [ebp - 0x44], 0
je 0x45accf
mov edx, 0x45b808
lea eax, [ebp - 0xa0]
call fcn.00403494
lea eax, [ebp - 0xa0]
mov edx, dword [ebp - 0x44]
call fcn.0040357c
mov eax, dword [ebp - 0xa0]
call fcn.00456ff8
mov eax, dword [ebp - 0x84]
test byte [eax + 8], 0x20
je 0x45aceb
mov eax, dword [ebp - 0x48]
call fcn.0042cd28
test al, al
je 0x45ad74
mov eax, dword [ebp - 0x84]
test byte [eax + 8], 0x80
jne 0x45acf9
xor ebx, ebx
mov eax, dword [ebp - 0x40]
push eax
push ebx
push esi
push 0x459d34
lea eax, [ebp - 0x90]
push eax
mov ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x38]
call fcn.004547ac
test al, al
jne 0x45ad48
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xa8], eax
mov byte [ebp - 0xa4], 0
lea edx, [ebp - 0xa8]
xor ecx, ecx
mov eax, 0x45b830
call fcn.00457204
mov byte [ebp - 0x75], 0
jmp 0x45ad7e
cmp bl, 1
jne 0x45ad7e
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xa8], eax
mov byte [ebp - 0xa4], 0
lea edx, [ebp - 0xa8]
xor ecx, ecx
mov eax, 0x45b798
call fcn.00457204
jmp 0x45ad7e
mov eax, 0x45b854
call fcn.00456ff8
cmp dword [ebp - 0x3c], 0
je 0x45adc6
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x7c]
call fcn.0045571c
jmp 0x45adc6
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xb8], eax
mov byte [ebp - 0xb4], 0xb
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xb0], eax
mov byte [ebp - 0xac], 0xb
lea edx, [ebp - 0xb8]
mov ecx, 1
mov eax, 0x45b884
call fcn.00457204
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45adf8
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 8]
call fcn.00459c00
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x80]
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 8]
jmp 0x45ae2d
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
jne 0x45aad0
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
je 0x45b058
mov byte [ebp - 0x85], 0
mov eax, dword [ebp - 0x84]
cmp word [eax + 0x10], 0x82
jne 0x45b00d
mov byte [ebp - 0x85], 1
xor edx, edx
push ebp
push 0x45afe5
push dword fs:[edx]
mov dword fs:[edx], esp
push ebp
mov eax, dword [ebp - 0x84]
call fcn.0045a930
pop ecx
cmp byte [ebp - 1], 0
jne 0x45aea4
mov eax, dword [ebp - 0x84]
test byte [eax + 8], 1
jne 0x45afd4
cmp byte [ebp - 1], 0
jne 0x45aeb0
cmp dword [ebp - 0x44], 0
jne 0x45aeb4
xor eax, eax
jmp 0x45aeb6
mov al, 1
mov byte [ebp - 0x86], al
mov eax, dword [ebp - 0x84]
mov eax, dword [eax + 8]
test al, 8
setne bl
test bl, bl
je 0x45aee4
test ah, 4
setne dl
mov eax, dword [ebp - 0x48]
call fcn.0045a32c
mov byte [ebp - 0x87], al
jmp 0x45aeeb
mov byte [ebp - 0x87], 0
test bl, bl
je 0x45af3d
cmp byte [ebp - 0x87], 0
je 0x45afdb
cmp byte [ebp - 0x86], 0
jne 0x45af3d
mov eax, dword [ebp - 0x84]
test byte [eax + 9], 8
setne al
mov edx, dword [ebp - 0x48]
call fcn.00452400
test al, al
je 0x45af3d
mov eax, dword [ebp - 0x84]
test byte [eax + 9], 2
jne 0x45af3d
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x45afdb
mov byte [ebp - 0x85], 0
cmp byte [ebp - 0x86], 0
jne 0x45af85
mov eax, dword [ebp - 0x84]
mov eax, dword [eax + 8]
test al, 0x10
je 0x45af6a
push ebp
test ah, 8
setne al
mov edx, dword [ebp - 0x48]
call fcn.0045a3e8
pop ecx
mov eax, dword [ebp - 0x84]
mov eax, dword [eax + 8]
test al, 0x40
je 0x45af85
test ah, 8
setne al
mov edx, dword [ebp - 0x48]
call fcn.0045a5d4
mov eax, dword [ebp - 0x84]
test byte [eax + 8], 4
je 0x45afbe
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xa8], eax
mov byte [ebp - 0xa4], 0xb
lea edx, [ebp - 0xa8]
xor ecx, ecx
mov eax, 0x45b8b4
call fcn.00457204
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x40]
call fcn.004552b8
mov eax, dword [ebp - 0x84]
test byte [eax + 9], 0x10
je 0x45afdb
mov eax, dword [ebp - 0x38]
call fcn.0045a764
jmp 0x45afdb
mov byte [ebp - 0x85], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45b00d
cmp byte [ebp - 0x85], 0
je 0x45b03d
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 8]
call fcn.00459c00
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x80]
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 8]
jmp 0x45b04b
mov eax, dword [ebp - 0x84]
mov eax, dword [eax]
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
jne 0x45ae53
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
je 0x45b5b8
push ebp
mov eax, dword [ebp - 0x84]
call fcn.0045a930
pop ecx
xor edx, edx
push ebp
push 0x45b55e
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x84]
mov bx, word [eax + 0x10]
movzx eax, bx
cmp eax, 0x85
jg 0x45b0f7
je 0x45b32c
cmp eax, 0x81
jg 0x45b0d9
je 0x45b175
dec eax
je 0x45b128
add eax, 0xfffffff1
sub eax, 2
jb case.0x45b105.140
sub eax, 0xe
je case.0x45b105.140
sub eax, 0x60
je case.0x45b105.140
jmp case.default.0x45b105
sub eax, 0x82
je 0x45b215
dec eax
je case.0x45b105.140
dec eax
je 0x45b319
jmp case.default.0x45b105
add eax, 0xffffff7a
cmp eax, 6
ja case.default.0x45b105
jmp dword [eax*4 + 0x45b10c]
mov edx, 0x45b8d4
lea eax, [ebp - 0xbc]
call fcn.00403494
lea eax, [ebp - 0xbc]
mov edx, dword [ebp - 0x48]
call fcn.0040357c
mov edx, dword [ebp - 0xbc]
lea ecx, [ebp - 0xa0]
mov al, 0xb6
call fcn.00450ab8
mov ecx, dword [ebp - 0xa0]
mov dl, 1
mov eax, 0x406408
call fcn.00408c14
call fcn.0040311c
jmp case.0x45b105.140
cmp byte [ebp - 1], 0
jne 0x45b18b
mov eax, dword [ebp - 0x84]
test byte [eax + 8], 1
jne case.0x45b105.140
mov eax, dword [ebp - 0x84]
mov ebx, dword [eax + 8]
test bl, 4
setne al
push eax
test bl, 8
setne al
push eax
push 0x459c78
push 0x459c84
lea eax, [ebp - 0x20]
push eax
test bl, 2
setne cl
test bl, 0x20
setne al
mov edx, dword [ebp - 0x48]
call fcn.0045363c
test al, al
je case.0x45b105.140
mov eax, dword [ebp - 0x84]
mov eax, dword [eax + 8]
test al, 2
je case.0x45b105.140
test al, 0x10
je case.0x45b105.140
push 0
mov eax, dword [ebp - 0x70]
push eax
push 1
push 0x10
call sub.shell32.dll_SHChangeNotify
lea edx, [ebp - 0xa0]
mov eax, dword [ebp - 0x48]
call fcn.0042c870
mov edx, dword [ebp - 0xa0]
mov eax, dword [ebp - 0x14]
call fcn.00455770
jmp case.0x45b105.140
lea eax, [ebp - 0x8c]
mov edx, dword [ebp - 0x44]
call fcn.00403494
cmp byte [ebp - 1], 0
jne 0x45b232
cmp dword [ebp - 0x8c], 0
jne 0x45b240
lea eax, [ebp - 0x8c]
mov edx, dword [ebp - 0x48]
call fcn.00403494
cmp byte [ebp - 1], 0
jne 0x45b252
mov eax, dword [ebp - 0x84]
test byte [eax + 8], 1
jne 0x45b2a9
cmp byte [ebp - 1], 0
jne 0x45b268
mov eax, dword [ebp - 0x84]
test byte [eax + 8], 2
jne case.0x45b105.140
push ebp
mov eax, dword [ebp - 0x84]
mov ebx, dword [eax + 8]
test bl, 0x80
setne al
push eax
test bh, 1
setne al
push eax
test bl, 0x20
setne cl
test bh, 8
setne dl
mov eax, dword [ebp - 0x8c]
call fcn.00459ee8
pop ecx
test al, al
jne case.0x45b105.140
mov byte [ebp - 0x75], 0
jmp case.0x45b105.140
mov eax, dword [ebp - 0x84]
mov eax, dword [eax + 8]
test al, 8
je 0x45b2c4
test ah, 4
setne dl
mov eax, dword [ebp - 0x48]
call fcn.0045a32c
mov eax, dword [ebp - 0x8c]
mov edx, dword [ebp - 0x48]
call fcn.00403684
je case.0x45b105.140
push ebp
mov eax, dword [ebp - 0x84]
mov ebx, dword [eax + 8]
test bl, 0x80
setne al
push eax
test bh, 1
setne al
push eax
test bl, 0x20
setne cl
test bh, 8
setne dl
mov eax, dword [ebp - 0x8c]
call fcn.00459ee8
pop ecx
test al, al
jne case.0x45b105.140
mov byte [ebp - 0x75], 0
jmp case.0x45b105.140
mov ecx, dword [ebp - 0x48]
mov edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x44]
call fcn.0042d14c
jmp case.0x45b105.140
mov eax, dword [ebp - 0x84]
test byte [eax + 8], 1
je 0x45b34b
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x44]
call fcn.0042cff4
test al, al
je case.0x45b105.140
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x44]
call fcn.0042d198
jmp case.0x45b105.140
lea ecx, [ebp - 0x98]
lea edx, [ebp - 0x91]
mov eax, dword [ebp - 0x84]
mov eax, dword [eax + 8]
call fcn.00459940
mov ecx, dword [ebp - 0x70]
mov edx, dword [ebp - 0x98]
mov al, byte [ebp - 0x91]
call fcn.0042dde8
test eax, eax
je case.0x45b105.140
sub eax, 2
je case.0x45b105.140
mov byte [ebp - 0x75], 0
jmp case.0x45b105.140
lea ecx, [ebp - 0x98]
lea edx, [ebp - 0x91]
mov eax, dword [ebp - 0x84]
mov eax, dword [eax + 8]
call fcn.00459940
push 0
push 2
lea eax, [ebp - 0x9c]
push eax
mov ecx, dword [ebp - 0x70]
mov edx, dword [ebp - 0x98]
mov al, byte [ebp - 0x91]
call fcn.0042dd44
test eax, eax
jne case.0x45b105.140
push 1
push 0x498b38
push 1
push 0
mov eax, dword [ebp - 0x6c]
push eax
mov eax, dword [ebp - 0x9c]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x45b407
mov byte [ebp - 0x75], 0
mov eax, dword [ebp - 0x9c]
push eax
call sub.advapi32.dll_RegCloseKey
jmp case.0x45b105.140
lea ecx, [ebp - 0x98]
lea edx, [ebp - 0x91]
mov eax, dword [ebp - 0x84]
mov eax, dword [eax + 8]
call fcn.00459940
mov ecx, dword [ebp - 0x70]
mov edx, dword [ebp - 0x98]
mov al, byte [ebp - 0x91]
call fcn.0042df3c
test eax, eax
je case.0x45b105.140
sub eax, 2
je case.0x45b105.140
sub eax, 0x8f
je case.0x45b105.140
mov byte [ebp - 0x75], 0
jmp case.0x45b105.140
lea ecx, [ebp - 0x98]
lea edx, [ebp - 0x91]
mov eax, dword [ebp - 0x84]
mov eax, dword [eax + 8]
call fcn.00459940
push 0
push 3
lea eax, [ebp - 0x9c]
push eax
mov ecx, dword [ebp - 0x70]
mov edx, dword [ebp - 0x98]
mov al, byte [ebp - 0x91]
call fcn.0042dd44
test eax, eax
jne case.0x45b105.140
mov edx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x9c]
call fcn.0042dc8c
test al, al
je 0x45b4d6
mov eax, dword [ebp - 0x6c]
push eax
mov eax, dword [ebp - 0x9c]
push eax
call sub.advapi32.dll_RegDeleteValueA
test eax, eax
je 0x45b4d6
mov byte [ebp - 0x75], 0
mov eax, dword [ebp - 0x9c]
push eax
call sub.advapi32.dll_RegCloseKey
jmp case.0x45b105.140
mov eax, dword [ebp - 0x84]
test byte [eax + 8], 1
setne dl
mov eax, dword [ebp - 0x48]
call fcn.0045a32c
jmp case.0x45b105.140
mov byte [ebp - 0x76], 1
jmp case.0x45b105.140
lea eax, [ebp - 0xbc]
push eax
movzx eax, bx
mov dword [ebp - 0xa8], eax
mov byte [ebp - 0xa4], 0
lea edx, [ebp - 0xa8]
xor ecx, ecx
mov eax, 0x45b8ec
call fcn.004078fc
mov edx, dword [ebp - 0xbc]
lea ecx, [ebp - 0xa0]
mov al, 0xb6
call fcn.00450ab8
mov ecx, dword [ebp - 0xa0]
mov dl, 1
mov eax, 0x406408
call fcn.00408c14
call fcn.0040311c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45b586
mov edx, dword [ebp - 0x84]
mov eax, dword [ebp - 8]
call fcn.00459c00
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x80]
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp dword [ebp - 0x84], 0
jne 0x45b071
cmp byte [ebp - 0x76], 0
je 0x45b5ce
push 0
push 0
push 0
push 0x8000000
call sub.shell32.dll_SHChangeNotify
mov eax, dword [ebp - 8]
test byte [eax + 0x1d], 0x10
je 0x45b5dc
call fcn.00455548
cmp dword [ebp - 0x74], 0
je 0x45b5ec
call dword [ebp - 0x74]
push ebp
call fcn.0045a89c
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45b69a
mov eax, dword [ebp - 0x20]
call fcn.00402b58
mov eax, dword [ebp - 0xc]
call fcn.00402b58
mov eax, dword [ebp - 0x10]
call fcn.00402b58
mov eax, dword [ebp - 0x14]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x45b66f
inc esi
xor ebx, ebx
lea ecx, [ebp - 0xa0]
mov edx, ebx
mov eax, dword [ebp - 0x14]
call fcn.004557f4
mov eax, dword [ebp - 0xa0]
call fcn.0042cd14
test al, al
je 0x45b66b
push 0
lea ecx, [ebp - 0xa0]
mov edx, ebx
mov eax, dword [ebp - 0x14]
call fcn.004557f4
mov eax, dword [ebp - 0xa0]
call fcn.00403738
push eax
push 0x1001
push 0x1000
call sub.shell32.dll_SHChangeNotify
inc ebx
dec esi
jne 0x45b61f
mov eax, dword [ebp - 0x18]
call fcn.00402b58
mov eax, dword [ebp - 0x1c]
call fcn.00402b58
mov eax, dword [ebp - 0x7c]
call fcn.00402b58
mov eax, dword [ebp - 0x14]
call fcn.00402b58
ret