Function at 0x451a70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x62b207
mov eax, dword fs:[0]
push eax
sub esp, 0x650
mov eax, dword [0x6b278c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x644], ecx
cmp dword [ebp + 8], 0
jne 0x451aae
xor eax, eax
jmp 0x452634
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x5dc]
call fcn.0040e4b0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x5dc]
push ecx
lea edx, [ebp - 0x2c]
push edx
call fcn.0043a030
add esp, 8
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x5dc]
call fcn.0040e530
lea ecx, [ebp - 0xd0]
call fcn.0045fd10
lea eax, [ebp - 0xd0]
push eax
lea ecx, [ebp - 0xcc]
call fcn.0045fe00
mov byte [ebp - 4], 3
push 0
lea ecx, [ebp - 0x3c]
call fcn.00465640
mov byte [ebp - 4], 4
push 1
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x2c]
push edx
lea ecx, [ebp - 0xcc]
call fcn.0045fe90
movzx eax, al
test eax, eax
jne 0x451b70
mov dword [ebp - 0x5e0], 0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x3c]
call fcn.00465c70
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xcc]
call fcn.0041dc10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.0040e3e0
mov eax, dword [ebp - 0x5e0]
jmp 0x452634
lea ecx, [ebp - 0x3c]
call fcn.00468100
movzx ecx, al
test ecx, ecx
jne 0x451b8e
lea ecx, [ebp - 0x3c]
call fcn.00468270
movzx edx, al
test edx, edx
jne 0x451bcd
mov dword [ebp - 0x5e4], 0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x3c]
call fcn.00465c70
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xcc]
call fcn.0041dc10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.0040e3e0
mov eax, dword [ebp - 0x5e4]
jmp 0x452634
mov dword [ebp - 0xd4], 0
jmp 0x451be8
mov eax, dword [ebp - 0xd4]
add eax, 1
mov dword [ebp - 0xd4], eax
lea ecx, [ebp - 0x3c]
call fcn.004674a0
cmp dword [ebp - 0xd4], eax
jae 0x4525fa
push 0x6466d4
mov ecx, dword [ebp - 0xd4]
push ecx
lea ecx, [ebp - 0x3c]
call fcn.00467870
mov ecx, eax
call fcn.00467990
mov dword [ebp - 0x104], eax
push 0x6466dc
mov edx, dword [ebp - 0xd4]
push edx
lea ecx, [ebp - 0x3c]
call fcn.00467870
mov ecx, eax
call fcn.00467990
mov dword [ebp - 0xf8], eax
mov ecx, dword [ebp - 0x104]
call fcn.00468100
movzx eax, al
test eax, eax
jne 0x451c86
mov ecx, dword [ebp - 0x104]
call fcn.00468250
movzx ecx, al
test ecx, ecx
je 0x451c86
mov ecx, dword [ebp - 0xf8]
call fcn.00468100
movzx edx, al
test edx, edx
jne 0x451c86
mov ecx, dword [ebp - 0xf8]
call fcn.00468270
movzx eax, al
test eax, eax
jne 0x451c8b
jmp 0x451bd9
lea ecx, [ebp - 0xf4]
push ecx
mov ecx, dword [ebp - 0x104]
call fcn.00466340
mov byte [ebp - 4], 5
push 0
push 0x6466e4
lea ecx, [ebp - 0xf4]
call fcn.00431a70
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0xffffffff
jne 0x451cd6
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xf4]
call fcn.0040e3e0
jmp 0x451bd9
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0x144], 0
mov edx, dword [ebp - 0x140]
push edx
push 0
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 0xf4]
call fcn.004140b0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xf4]
call fcn.0040ee50
sub eax, dword [ebp - 0x140]
sub eax, 1
push eax
mov ecx, dword [ebp - 0x140]
add ecx, 1
push ecx
lea edx, [ebp - 0x13c]
push edx
lea ecx, [ebp - 0xf4]
call fcn.004140b0
mov byte [ebp - 4], 7
push str.HKEY_CLASSES_ROOT
lea eax, [ebp - 0x120]
push eax
call fcn.00432220
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x451d68
mov dword [ebp - 0xd8], connect
jmp 0x451e02
push str.HKEY_CURRENT_USER
lea edx, [ebp - 0x120]
push edx
call fcn.00432220
add esp, 8
movzx eax, al
test eax, eax
je 0x451d8f
mov dword [ebp - 0xd8], reloc.WS2_32.dll_accept
jmp 0x451e02
push str.HKEY_LOCAL_MACHINE
lea ecx, [ebp - 0x120]
push ecx
call fcn.00432220
add esp, 8
movzx edx, al
test edx, edx
je 0x451db6
mov dword [ebp - 0xd8], reloc.OLEAUT32.dll_SysReAllocString
jmp 0x451e02
push str.HKEY_USERS
lea eax, [ebp - 0x120]
push eax
call fcn.00432220
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x451ddd
mov dword [ebp - 0xd8], reloc.WS2_32.dll_closesocket
jmp 0x451e02
push str.HKEY_CURRENT_CONFIG
lea edx, [ebp - 0x120]
push edx
call fcn.00432220
add esp, 8
movzx eax, al
test eax, eax
je 0x451e02
mov dword [ebp - 0xd8], reloc.WS2_32.dll_getpeername
lea ecx, [ebp - 0x144]
push ecx
push 0x109
push 0
lea edx, [ebp - 0x13c]
push edx
lea eax, [ebp - 0x600]
push eax
call fcn.00439f10
add esp, 8
mov dword [ebp - 0x648], eax
mov ecx, dword [ebp - 0x648]
mov dword [ebp - 0x64c], ecx
mov byte [ebp - 4], 8
mov ecx, dword [ebp - 0x64c]
call fcn.0040e5d0
push eax
mov edx, dword [ebp - 0xd8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0xfc], eax
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x600]
call fcn.0040e530
cmp dword [ebp - 0xfc], 0
je 0x451ea5
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x13c]
call fcn.0040e3e0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x120]
call fcn.0040e3e0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xf4]
call fcn.0040e3e0
jmp 0x451bd9
mov dword [ebp - 0x100], 0
mov dword [ebp - 0x148], 0
jmp 0x451eca
mov eax, dword [ebp - 0x148]
add eax, 1
mov dword [ebp - 0x148], eax
mov ecx, dword [ebp - 0xf8]
call fcn.004674a0
cmp dword [ebp - 0x148], eax
jae 0x45253f
mov ecx, dword [ebp - 0x148]
push ecx
mov ecx, dword [ebp - 0xf8]
call fcn.00467970
mov dword [ebp - 0x190], eax
mov ecx, dword [ebp - 0x190]
call fcn.00468100
movzx edx, al
test edx, edx
jne 0x451f1d
mov ecx, dword [ebp - 0x190]
call fcn.004682c0
movzx eax, al
test eax, eax
jne 0x451f22
jmp 0x45253f
push 0x646744
mov ecx, dword [ebp - 0x190]
call fcn.00467bc0
mov dword [ebp - 0x14c], eax
push 0x646748
mov ecx, dword [ebp - 0x190]
call fcn.00467bc0
mov dword [ebp - 0x18c], eax
push 0x646750
mov ecx, dword [ebp - 0x190]
call fcn.00467bc0
mov dword [ebp - 0x1b0], eax
mov ecx, dword [ebp - 0x14c]
call fcn.00468100
movzx ecx, al
test ecx, ecx
jne 0x451f88
mov ecx, dword [ebp - 0x14c]
call fcn.00468250
movzx edx, al
test edx, edx
jne 0x451f8d
jmp 0x45253f
mov ecx, dword [ebp - 0x18c]
call fcn.00468100
movzx eax, al
test eax, eax
jne 0x451fb1
mov ecx, dword [ebp - 0x18c]
call fcn.00468250
movzx ecx, al
test ecx, ecx
jne 0x451fda
mov ecx, dword [ebp - 0x1b0]
call fcn.00468100
movzx edx, al
test edx, edx
jne 0x451fda
mov ecx, dword [ebp - 0x1b0]
call fcn.00468250
movzx eax, al
test eax, eax
je 0x451fda
jmp 0x45253f
lea ecx, [ebp - 0x61c]
push ecx
mov ecx, dword [ebp - 0x14c]
call fcn.00466340
mov dword [ebp - 0x650], eax
mov edx, dword [ebp - 0x650]
mov dword [ebp - 0x654], edx
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x654]
push eax
lea ecx, [ebp - 0x184]
push ecx
call fcn.00439f10
add esp, 8
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x61c]
call fcn.0040e3e0
mov ecx, dword [ebp - 0x18c]
call fcn.00468100
movzx edx, al
test edx, edx
jne 0x45206f
mov ecx, dword [ebp - 0x18c]
call fcn.00468250
movzx eax, al
test eax, eax
je 0x45206f
mov ecx, dword [ebp - 0x1b0]
call fcn.00468100
movzx ecx, al
test ecx, ecx
jne 0x45206f
mov ecx, dword [ebp - 0x1b0]
call fcn.00468250
movzx edx, al
test edx, edx
jne 0x4520b9
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x184]
call fcn.0040e5d0
push eax
mov eax, dword [ebp - 0x144]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4520a5
mov ecx, dword [ebp - 0x100]
add ecx, 1
mov dword [ebp - 0x100], ecx
jmp 0x4520b9
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x184]
call fcn.0040e530
jmp 0x45253f
mov dword [ebp - 0x188], 0
lea edx, [ebp - 0x1ac]
push edx
mov ecx, dword [ebp - 0x18c]
call fcn.00466340
mov byte [ebp - 4], 0xc
push str.REG_SZ
lea eax, [ebp - 0x1ac]
push eax
call fcn.00432220
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x452103
mov dword [ebp - 0x188], 1
jmp 0x4522ed
push str.REG_EXPAND_SZ
lea edx, [ebp - 0x1ac]
push edx
call fcn.00432220
add esp, 8
movzx eax, al
test eax, eax
je 0x45212d
mov dword [ebp - 0x188], 2
jmp 0x4522ed
push str.REG_BINARY
lea ecx, [ebp - 0x1ac]
push ecx
call fcn.00432220
add esp, 8
movzx edx, al
test edx, edx
je 0x452157
mov dword [ebp - 0x188], 3
jmp 0x4522ed
push str.REG_DWORD
lea eax, [ebp - 0x1ac]
push eax
call fcn.00432220
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x452181
mov dword [ebp - 0x188], 4
jmp 0x4522ed
push str.REG_DWORD_LITTLE_ENDIAN
lea edx, [ebp - 0x1ac]
push edx
call fcn.00432220
add esp, 8
movzx eax, al
test eax, eax
je 0x4521ab
mov dword [ebp - 0x188], 4
jmp 0x4522ed
push str.REG_DWORD_BIG_ENDIAN
lea ecx, [ebp - 0x1ac]
push ecx
call fcn.00432220
add esp, 8
movzx edx, al
test edx, edx
je 0x4521d5
mov dword [ebp - 0x188], 5
jmp 0x4522ed
push str.REG_LINK
lea eax, [ebp - 0x1ac]
push eax
call fcn.00432220
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x4521ff
mov dword [ebp - 0x188], 6
jmp 0x4522ed
push str.REG_MULTI_SZ
lea edx, [ebp - 0x1ac]
push edx
call fcn.00432220
add esp, 8
movzx eax, al
test eax, eax
je 0x452229
mov dword [ebp - 0x188], 7
jmp 0x4522ed
push str.REG_RESOURCE_LIST
lea ecx, [ebp - 0x1ac]
push ecx
call fcn.00432220
add esp, 8
movzx edx, al
test edx, edx
je 0x452253
mov dword [ebp - 0x188], 8
jmp 0x4522ed
push str.REG_FULL_RESOURCE_DESCRIPTOR
lea eax, [ebp - 0x1ac]
push eax
call fcn.00432220
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x45227a
mov dword [ebp - 0x188], 9
jmp 0x4522ed
push str.REG_RESOURCE_REQUIREMENTS_LIST
lea edx, [ebp - 0x1ac]
push edx
call fcn.00432220
add esp, 8
movzx eax, al
test eax, eax
je 0x4522a1
mov dword [ebp - 0x188], 0xa
jmp 0x4522ed
push str.REG_QWORD
lea ecx, [ebp - 0x1ac]
push ecx
call fcn.00432220
add esp, 8
movzx edx, al
test edx, edx
je 0x4522c8
mov dword [ebp - 0x188], 0xb
jmp 0x4522ed
push str.REG_QWORD_LITTLE_ENDIAN
lea eax, [ebp - 0x1ac]
push eax
call fcn.00432220
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x4522ed
mov dword [ebp - 0x188], 0xb
xor edx, edx
mov word [ebp - 0x5b4], dx
push 0x3fe
push 0
lea eax, [ebp - 0x5b2]
push eax
call fcn.005b4de0
add esp, 0xc
mov dword [ebp - 0x5b8], 0x200
lea ecx, [ebp - 0x638]
push ecx
mov ecx, dword [ebp - 0x1b0]
call fcn.00466340
mov dword [ebp - 0x658], eax
mov edx, dword [ebp - 0x658]
mov dword [ebp - 0x65c], edx
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0x65c]
push eax
lea ecx, [ebp - 0x168]
push ecx
call fcn.00439f10
add esp, 8
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x638]
call fcn.0040e3e0
cmp dword [ebp - 0x188], 2
je 0x452382
cmp dword [ebp - 0x188], 1
je 0x452382
cmp dword [ebp - 0x188], 7
jne 0x45241d
lea edx, [ebp - 0x5b8]
push edx
lea eax, [ebp - 0x5b4]
push eax
lea ecx, [ebp - 0x188]
push ecx
push 0
lea ecx, [ebp - 0x184]
call fcn.0040e5d0
push eax
mov edx, dword [ebp - 0x144]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x452418
lea ecx, [ebp - 0x168]
call fcn.0040e5d0
push eax
lea eax, [ebp - 0x5b4]
push eax
call fcn.0041c6e0
add esp, 8
test eax, eax
je 0x4523e6
mov ecx, dword [ebp - 0x100]
add ecx, 1
mov dword [ebp - 0x100], ecx
jmp 0x452418
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x168]
call fcn.0040e530
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x1ac]
call fcn.0040e3e0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x184]
call fcn.0040e530
jmp 0x45253f
jmp 0x45250d
cmp dword [ebp - 0x188], 4
je 0x452433
cmp dword [ebp - 0x188], 3
jne 0x4524de
lea edx, [ebp - 0x5b8]
push edx
lea eax, [ebp - 0x5b4]
push eax
lea ecx, [ebp - 0x188]
push ecx
push 0
lea ecx, [ebp - 0x184]
call fcn.0040e5d0
push eax
mov edx, dword [ebp - 0x144]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4524dc
movsx eax, word [ebp - 0x5b4]
mov dword [ebp - 0x5bc], eax
lea ecx, [ebp - 0x168]
call fcn.0040e5d0
push eax
call fcn.005b50e1
add esp, 4
mov dword [ebp - 0x5c0], eax
mov ecx, dword [ebp - 0x5c0]
cmp ecx, dword [ebp - 0x5bc]
jne 0x4524ad
mov edx, dword [ebp - 0x100]
add edx, 1
mov dword [ebp - 0x100], edx
jmp 0x4524dc
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x168]
call fcn.0040e530
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x1ac]
call fcn.0040e3e0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x184]
call fcn.0040e530
jmp 0x45253f
jmp 0x45250d
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x168]
call fcn.0040e530
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x1ac]
call fcn.0040e3e0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x184]
call fcn.0040e530
jmp 0x45253f
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x168]
call fcn.0040e530
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x1ac]
call fcn.0040e3e0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x184]
call fcn.0040e530
jmp 0x451ebb
mov eax, dword [ebp - 0x144]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xf8]
call fcn.004674a0
cmp eax, dword [ebp - 0x100]
jne 0x4525c8
mov dword [ebp - 0x63c], 1
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x13c]
call fcn.0040e3e0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x120]
call fcn.0040e3e0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xf4]
call fcn.0040e3e0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x3c]
call fcn.00465c70
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xcc]
call fcn.0041dc10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.0040e3e0
mov eax, dword [ebp - 0x63c]
jmp 0x452634
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x13c]
call fcn.0040e3e0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x120]
call fcn.0040e3e0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xf4]
call fcn.0040e3e0
jmp 0x451bd9
mov dword [ebp - 0x640], 0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x3c]
call fcn.00465c70
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xcc]
call fcn.0041dc10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.0040e3e0
mov eax, dword [ebp - 0x640]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005b4b30
mov esp, ebp
pop ebp
ret 4