Function at 0x45b7e2
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x54
push 0x48ce28
call fcn.0047e06c
mov dword [ebp - 0x50], ecx
xor ebx, ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x20], ebx
mov edi, ebx
mov dword [ebp - 0x24], edi
mov esi, ebx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x30]
push eax
push 0x20019
push ebx
push 0x4127c0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x20], eax
test eax, eax
je 0x45b86e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call dword [sym.imp.WDSCORE.dll_CurrentIP]
mov esi, eax
push dword [ebp - 0x20]
push 0x4127c0
push 0x412434
push 0x412500
push 0x3000000
call fcn.0045ab3f
add esp, 0x14
push ebx
push ebx
push edi
push esi
push 0x41245c
push 0x412498
push 0xab
jmp 0x45ba3b
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x44], ebx
mov eax, ebx
mov dword [ebp - 0x28], eax
jmp 0x45b881
mov edi, dword [ebp - 0x24]
test eax, eax
jne 0x45b957
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x40], ebx
push ebx
push ebx
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x3c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov dword [ebp - 0x20], eax
test eax, eax
jne 0x45ba4b
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x34]
jbe 0x45b90c
mov dword [ebp - 0x34], eax
test edi, edi
je 0x45b8e0
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
neg eax
sbb eax, eax
not eax
and eax, edi
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x34]
lea eax, [eax*2 + 2]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0x24], edi
test edi, edi
jne 0x45b90c
mov dword [ebp - 0x20], 0xe
jmp 0x45ba9f
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x38]
jbe 0x45b957
mov dword [ebp - 0x38], eax
test esi, esi
je 0x45b938
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
neg eax
sbb eax, eax
not eax
and eax, esi
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x38]
add eax, 5
mov dword [ebp - 0x44], eax
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x2c], esi
test esi, esi
je 0x45b900
push dword [ebp - 0x44]
push ebx
push esi
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x48], ebx
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x4c]
push eax
push esi
lea eax, [ebp - 0x48]
push eax
push ebx
lea eax, [ebp - 0x54]
push eax
push edi
push dword [ebp - 0x28]
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov edi, eax
mov dword [ebp - 0x20], edi
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
test edi, edi
jne 0x45b9ed
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], esi
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
mov esi, dword [eax + 4]
lea eax, [ebp - 0x64]
push eax
mov ecx, esi
call dword [0x4928c8]
mov ecx, dword [ebp - 0x50]
call esi
test eax, eax
je 0x45ba8f
sub eax, 2
neg eax
sbb eax, eax
and eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
mov esi, dword [ebp - 0x2c]
test edi, edi
je 0x45b87e
cmp edi, 0x103
je 0x45ba9c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call dword [sym.imp.WDSCORE.dll_CurrentIP]
mov esi, eax
push dword [ebp - 0x20]
push 0x4127c0
push 0x412434
push 0x412598
push 0x3000000
call fcn.0045ab3f
add esp, 0x14
push ebx
push ebx
push edi
push esi
push 0x41245c
push 0x412498
push 0x120
push ebx
push 0x41216c
push ebx
push eax
call dword [sym.imp.WDSCORE.dll_WdsSetupLogMessageW]
jmp 0x45ba9f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call dword [sym.imp.WDSCORE.dll_CurrentIP]
mov esi, eax
push dword [ebp - 0x20]
push 0x4127c0
push 0x412434
push 0x412548
push 0x2000000
call fcn.0045ab3f
add esp, 0x14
push ebx
push ebx
push edi
push esi
push 0x41245c
push 0x412498
push 0xcf
jmp 0x45ba3b
mov edi, 0x103
mov dword [ebp - 0x20], edi
jmp 0x45b9ed
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], 0xfffffffe
call fcn.0045bace
mov ebx, dword [ebp - 0x20]
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
sete al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4