Function at 0x4507e0
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x2c8
mov eax, dword [0x4dc6e0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x4dfca4], 1
push esi
push edi
jl 0x450a2b
lea eax, [ebp - 0x228]
push eax
call fcn.0044de40
add esp, 4
mov dword [ebp - 0x22c], 0
lea eax, [ebp - 0x22c]
push eax
push 0x4c51ac
push 1
push 0
push 0x4c53bc
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x4509ff
mov esi, dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0x270]
push eax
call esi
movdqa xmm0, xmmword [ebp - 0x270]
lea eax, [ebp - 0x280]
push eax
movdqa xmmword [ebp - 0x2b0], xmm0
call esi
movdqa xmm0, xmmword [ebp - 0x280]
lea eax, [ebp - 0x290]
push eax
movdqa xmmword [ebp - 0x2a0], xmm0
call esi
movdqa xmm0, xmmword [ebp - 0x290]
lea eax, [ebp - 0x260]
push eax
movdqa xmmword [ebp - 0x2c0], xmm0
call esi
movdqa xmm0, xmmword [ebp - 0x2b0]
sub esp, 0x10
mov ecx, dword [ebp - 0x22c]
mov eax, esp
sub esp, 0x10
mov edx, dword [ecx]
movdqu xmmword [eax], xmm0
mov eax, esp
sub esp, 0x10
movdqa xmm0, xmmword [ebp - 0x2a0]
movdqu xmmword [eax], xmm0
mov eax, esp
sub esp, 0x10
movdqa xmm0, xmmword [ebp - 0x2c0]
movdqu xmmword [eax], xmm0
mov eax, esp
movdqu xmm0, xmmword [ebp - 0x260]
push ecx
movdqu xmmword [eax], xmm0
call dword [edx + 0x28]
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov edi, eax
lea eax, [ebp - 0x260]
push eax
call esi
lea eax, [ebp - 0x290]
push eax
call esi
lea eax, [ebp - 0x280]
push eax
call esi
lea eax, [ebp - 0x270]
push eax
call esi
test edi, edi
js 0x4509f3
push 0x4afa48
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x238], 0
call fcn.00403690
mov eax, dword [eax]
test eax, eax
je 0x450953
mov edx, dword [eax]
jmp 0x450955
xor edx, edx
mov eax, dword [ebp - 0x22c]
lea esi, [ebp - 0x238]
push esi
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
lea ecx, [ebp - 0x230]
mov esi, eax
call fcn.0048c930
test esi, esi
js 0x4509f3
cmp dword [ebp - 0x214], 8
lea eax, [ebp - 0x228]
lea ecx, [ebp - 0x230]
cmovae eax, dword [ebp - 0x228]
push eax
call fcn.00403690
mov edx, dword [eax]
test edx, edx
je 0x4509a4
mov edx, dword [edx]
jmp 0x4509a6
xor edx, edx
mov eax, dword [ebp - 0x238]
lea esi, [ebp - 0x23c]
push esi
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x34]
lea ecx, [ebp - 0x230]
mov esi, eax
call fcn.0048c930
test esi, esi
jne 0x4509d7
mov eax, dword [ebp - 0x23c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x22c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
lea ecx, [ebp - 0x228]
call fcn.00403730
jmp 0x450a8b
mov eax, dword [ebp - 0x22c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0x214], 8
jb 0x450a16
push dword [ebp - 0x228]
call fcn.0048f453
add esp, 4
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048fc6c
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
lea eax, [ebp - 0x234]
push eax
push 1
push 0
push 0x4bcbe0
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x450a8b
lea eax, [ebp - 0x240]
mov dword [ebp - 0x240], 0x208
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x244]
push eax
push esi
push 0x4b0220
push dword [ebp - 0x234]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x234]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor eax, eax
test esi, esi
pop edi
sete al
xor ecx, ebp
pop esi
call fcn.0048fc6c
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret