Function at 0x45b1a0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0x51b198
mov eax, 0x14a
mov ecx, dword [ebp - 8]
mov word [ecx], ax
mov edx, dword [ebp - 8]
movzx eax, word [edx]
sub eax, 0xe1
mov ecx, dword [ebp - 8]
mov word [ecx], ax
mov edx, 0x14f
mov eax, dword [ebp - 8]
mov word [eax + 2], dx
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + 2]
sub edx, 0xe1
mov eax, dword [ebp - 8]
mov word [eax + 2], dx
mov ecx, 0x155
mov edx, dword [ebp - 8]
mov word [edx + 4], cx
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 4]
sub ecx, 0xe1
mov edx, dword [ebp - 8]
mov word [edx + 4], cx
mov eax, 0x146
mov ecx, dword [ebp - 8]
mov word [ecx + 6], ax
mov edx, dword [ebp - 8]
movzx eax, word [edx + 6]
sub eax, 0xe1
mov ecx, dword [ebp - 8]
mov word [ecx + 6], ax
mov edx, 0x153
mov eax, dword [ebp - 8]
mov word [eax + 8], dx
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + 8]
sub edx, 0xe1
mov eax, dword [ebp - 8]
mov word [eax + 8], dx
mov ecx, 0x147
mov edx, dword [ebp - 8]
mov word [edx + 0xa], cx
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 0xa]
sub ecx, 0xe1
mov edx, dword [ebp - 8]
mov word [edx + 0xa], cx
mov eax, 0x142
mov ecx, dword [ebp - 8]
mov word [ecx + 0xc], ax
mov edx, dword [ebp - 8]
movzx eax, word [edx + 0xc]
sub eax, 0xe1
mov ecx, dword [ebp - 8]
mov word [ecx + 0xc], ax
mov edx, 0x144
mov eax, dword [ebp - 8]
mov word [eax + 0xe], dx
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + 0xe]
sub edx, 0xe1
mov eax, dword [ebp - 8]
mov word [eax + 0xe], dx
mov ecx, 0x146
mov edx, dword [ebp - 8]
mov word [edx + 0x10], cx
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 0x10]
sub ecx, 0xe1
mov edx, dword [ebp - 8]
mov word [edx + 0x10], cx
mov eax, 0x13d
mov ecx, dword [ebp - 8]
mov word [ecx + 0x12], ax
mov edx, dword [ebp - 8]
movzx eax, word [edx + 0x12]
sub eax, 0xe1
mov ecx, dword [ebp - 8]
mov word [ecx + 0x12], ax
mov edx, 0x15c
mov eax, dword [ebp - 8]
mov word [eax + 0x14], dx
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + 0x14]
sub edx, 0xe1
mov eax, dword [ebp - 8]
mov word [eax + 0x14], dx
mov ecx, 0x143
mov edx, dword [ebp - 8]
mov word [edx + 0x16], cx
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 0x16]
sub ecx, 0xe1
mov edx, dword [ebp - 8]
mov word [edx + 0x16], cx
mov eax, 0x112
mov ecx, dword [ebp - 8]
mov word [ecx + 0x18], ax
mov edx, dword [ebp - 8]
movzx eax, word [edx + 0x18]
sub eax, 0xe1
mov ecx, dword [ebp - 8]
mov word [ecx + 0x18], ax
mov edx, 0x11a
mov eax, dword [ebp - 8]
mov word [eax + 0x1a], dx
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + 0x1a]
sub edx, 0xe1
mov eax, dword [ebp - 8]
mov word [eax + 0x1a], dx
mov ecx, 0x117
mov edx, dword [ebp - 8]
mov word [edx + 0x1c], cx
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 0x1c]
sub ecx, 0xe1
mov edx, dword [ebp - 8]
mov word [edx + 0x1c], cx
mov eax, 0x143
mov ecx, dword [ebp - 8]
mov word [ecx + 0x1e], ax
mov edx, dword [ebp - 8]
movzx eax, word [edx + 0x1e]
sub eax, 0xe1
mov ecx, dword [ebp - 8]
mov word [ecx + 0x1e], ax
mov edx, 0x113
mov eax, dword [ebp - 8]
mov word [eax + 0x20], dx
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + 0x20]
sub edx, 0xe1
mov eax, dword [ebp - 8]
mov word [eax + 0x20], dx
mov ecx, 0x119
mov edx, dword [ebp - 8]
mov word [edx + 0x22], cx
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 0x22]
sub ecx, 0xe1
mov edx, dword [ebp - 8]
mov word [edx + 0x22], cx
mov eax, 0x118
mov ecx, dword [ebp - 8]
mov word [ecx + 0x24], ax
mov edx, dword [ebp - 8]
movzx eax, word [edx + 0x24]
sub eax, 0xe1
mov ecx, dword [ebp - 8]
mov word [ecx + 0x24], ax
mov edx, 0x10e
mov eax, dword [ebp - 8]
mov word [eax + 0x26], dx
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + 0x26]
sub edx, 0xe1
mov eax, dword [ebp - 8]
mov word [eax + 0x26], dx
mov ecx, 0x143
mov edx, dword [ebp - 8]
mov word [edx + 0x28], cx
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 0x28]
sub ecx, 0xe1
mov edx, dword [ebp - 8]
mov word [edx + 0x28], cx
mov eax, 0x142
mov ecx, dword [ebp - 8]
mov word [ecx + 0x2a], ax
mov edx, dword [ebp - 8]
movzx eax, word [edx + 0x2a]
sub eax, 0xe1
mov ecx, dword [ebp - 8]
mov word [ecx + 0x2a], ax
mov edx, 0x143
mov eax, dword [ebp - 8]
mov word [eax + 0x2c], dx
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + 0x2c]
sub edx, 0xe1
mov eax, dword [ebp - 8]
mov word [eax + 0x2c], dx
mov ecx, 0x115
mov edx, dword [ebp - 8]
mov word [edx + 0x2e], cx
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 0x2e]
sub ecx, 0xe1
mov edx, dword [ebp - 8]
mov word [edx + 0x2e], cx
mov eax, 0x10e
mov ecx, dword [ebp - 8]
mov word [ecx + 0x30], ax
mov edx, dword [ebp - 8]
movzx eax, word [edx + 0x30]
sub eax, 0xe1
mov ecx, dword [ebp - 8]
mov word [ecx + 0x30], ax
mov edx, 0x112
mov eax, dword [ebp - 8]
mov word [eax + 0x32], dx
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + 0x32]
sub edx, 0xe1
mov eax, dword [ebp - 8]
mov word [eax + 0x32], dx
mov ecx, 0x111
mov edx, dword [ebp - 8]
mov word [edx + 0x34], cx
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 0x34]
sub ecx, 0xe1
mov edx, dword [ebp - 8]
mov word [edx + 0x34], cx
mov eax, 0x112
mov ecx, dword [ebp - 8]
mov word [ecx + 0x36], ax
mov edx, dword [ebp - 8]
movzx eax, word [edx + 0x36]
sub eax, 0xe1
mov ecx, dword [ebp - 8]
mov word [ecx + 0x36], ax
mov edx, 0x142
mov eax, dword [ebp - 8]
mov word [eax + 0x38], dx
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + 0x38]
sub edx, 0xe1
mov eax, dword [ebp - 8]
mov word [eax + 0x38], dx
mov ecx, 0x10e
mov edx, dword [ebp - 8]
mov word [edx + 0x3a], cx
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 0x3a]
sub ecx, 0xe1
mov edx, dword [ebp - 8]
mov word [edx + 0x3a], cx
mov eax, 0x143
mov ecx, dword [ebp - 8]
mov word [ecx + 0x3c], ax
mov edx, dword [ebp - 8]
movzx eax, word [edx + 0x3c]
sub eax, 0xe1
mov ecx, dword [ebp - 8]
mov word [ecx + 0x3c], ax
mov edx, 0x117
mov eax, dword [ebp - 8]
mov word [eax + 0x3e], dx
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + 0x3e]
sub edx, 0xe1
mov eax, dword [ebp - 8]
mov word [eax + 0x3e], dx
mov ecx, 0x11a
mov edx, dword [ebp - 8]
mov word [edx + 0x40], cx
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 0x40]
sub ecx, 0xe1
mov edx, dword [ebp - 8]
mov word [edx + 0x40], cx
mov eax, 0x144
mov ecx, dword [ebp - 8]
mov word [ecx + 0x42], ax
mov edx, dword [ebp - 8]
movzx eax, word [edx + 0x42]
sub eax, 0xe1
mov ecx, dword [ebp - 8]
mov word [ecx + 0x42], ax
mov edx, 0x10e
mov eax, dword [ebp - 8]
mov word [eax + 0x44], dx
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + 0x44]
sub edx, 0xe1
mov eax, dword [ebp - 8]
mov word [eax + 0x44], dx
mov ecx, 0x111
mov edx, dword [ebp - 8]
mov word [edx + 0x46], cx
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 0x46]
sub ecx, 0xe1
mov edx, dword [ebp - 8]
mov word [edx + 0x46], cx
mov eax, 0x111
mov ecx, dword [ebp - 8]
mov word [ecx + 0x48], ax
mov edx, dword [ebp - 8]
movzx eax, word [edx + 0x48]
sub eax, 0xe1
mov ecx, dword [ebp - 8]
mov word [ecx + 0x48], ax
mov edx, 0x142
mov eax, dword [ebp - 8]
mov word [eax + 0x4a], dx
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + 0x4a]
sub edx, 0xe1
mov eax, dword [ebp - 8]
mov word [eax + 0x4a], dx
mov ecx, 0x142
mov edx, dword [ebp - 8]
mov word [edx + 0x4c], cx
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 0x4c]
sub ecx, 0xe1
mov edx, dword [ebp - 8]
mov word [edx + 0x4c], cx
mov eax, 0x111
mov ecx, dword [ebp - 8]
mov word [ecx + 0x4e], ax
mov edx, dword [ebp - 8]
movzx eax, word [edx + 0x4e]
sub eax, 0xe1
mov ecx, dword [ebp - 8]
mov word [ecx + 0x4e], ax
mov edx, 0x111
mov eax, dword [ebp - 8]
mov word [eax + 0x50], dx
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + 0x50]
sub edx, 0xe1
mov eax, dword [ebp - 8]
mov word [eax + 0x50], dx
mov ecx, 0x114
mov edx, dword [ebp - 8]
mov word [edx + 0x52], cx
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 0x52]
sub ecx, 0xe1
mov edx, dword [ebp - 8]
mov word [edx + 0x52], cx
mov eax, 0x115
mov ecx, dword [ebp - 8]
mov word [ecx + 0x54], ax
mov edx, dword [ebp - 8]
movzx eax, word [edx + 0x54]
sub eax, 0xe1
mov ecx, dword [ebp - 8]
mov word [ecx + 0x54], ax
mov edx, 0x112
mov eax, dword [ebp - 8]
mov word [eax + 0x56], dx
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + 0x56]
sub edx, 0xe1
mov eax, dword [ebp - 8]
mov word [eax + 0x56], dx
mov ecx, 0x145
mov edx, dword [ebp - 8]
mov word [edx + 0x58], cx
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 0x58]
sub ecx, 0xe1
mov edx, dword [ebp - 8]
mov word [edx + 0x58], cx
mov eax, 0x111
mov ecx, dword [ebp - 8]
mov word [ecx + 0x5a], ax
mov edx, dword [ebp - 8]
movzx eax, word [edx + 0x5a]
sub eax, 0xe1
mov ecx, dword [ebp - 8]
mov word [ecx + 0x5a], ax
mov edx, 0x118
mov eax, dword [ebp - 8]
mov word [eax + 0x5c], dx
mov ecx, dword [ebp - 8]
movzx edx, word [ecx + 0x5c]
sub edx, 0xe1
mov eax, dword [ebp - 8]
mov word [eax + 0x5c], dx
mov ecx, 0x15e
mov edx, dword [ebp - 8]
mov word [edx + 0x5e], cx
mov eax, dword [ebp - 8]
movzx ecx, word [eax + 0x5e]
sub ecx, 0xe1
mov edx, dword [ebp - 8]
mov word [edx + 0x5e], cx
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov dword [0x51bbdc], eax
push 0x51bbe0
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [0x51b130]
sub edx, 0xcad
push edx
call dword [0x51bbdc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x45b7d4
mov eax, 1
test eax, eax
je 0x45b7d4
jmp 0x45b7c9
call fcn.0045c870
mov dword [0x51b128], eax
mov esp, ebp
pop ebp
ret