Function at 0x45b380
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov eax, 0x3048
call fcn.004ac5b0
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x3044], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
mov ebp, ecx
push 0xf000
push ebp
push 0x102c
push 0x29c5
push dword [0x4e6030]
mov dword [esp + 0x28], ebp
call edi
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call ebx
mov esi, eax
mov dword [esp + 0x1054], 0
push 0x7fc
lea eax, [esp + 0x105c]
shr esi, 0xc
push 0
push eax
dec esi
call fcn.0048fb10
add esp, 0xc
mov dword [esp + 0x20], 4
lea eax, [esp + 0x1054]
mov dword [esp + 0x30], 0x400
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x18]
push eax
push ebp
push 0x1073
push 0x29c5
push dword [0x4e6030]
call edi
push eax
call ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_StrRStrIW]
lea eax, [esp + 0x1054]
push 0x4bdaf4
push 0
push eax
call ebx
test eax, eax
jne 0x45b459
push 0x4bdafc
push eax
lea eax, [esp + 0x105c]
push eax
call ebx
neg eax
sbb eax, eax
inc eax
jmp 0x45b45b
xor eax, eax
cmp esi, eax
jne 0x45b466
xor eax, eax
jmp 0x45ba5b
push 0x7fc
lea eax, [esp + 0x85c]
mov dword [esp + 0x858], 0
push 0
push eax
call fcn.0048fb10
push 0x7fc
lea eax, [esp + 0x68]
mov dword [esp + 0x64], 0
push 0
push eax
call fcn.0048fb10
add esp, 0x18
mov dword [esp + 0x20], 4
lea eax, [esp + 0x854]
mov dword [esp + 0x30], 0x400
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x18]
push eax
push ebp
push 0x1073
push 0x29c5
push dword [0x4e6030]
call edi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ebp, dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x854]
push eax
lea eax, [esp + 0x58]
push eax
call ebp
mov edi, dword [sym.imp.SHLWAPI.dll_StrChrW]
lea eax, [esp + 0x54]
push 0x7c
push eax
call edi
mov ebx, eax
lea eax, [esp + 0x54]
test esi, esi
jne 0x45b5f3
test ebx, ebx
jne 0x45b58d
push 0x5c
push ebx
push eax
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
mov esi, eax
test esi, esi
je 0x45ba58
lea eax, [esp + 0x54]
sub esi, eax
and esi, 0xfffffffe
cmp esi, 0x800
jae 0x45ba74
xor eax, eax
push 0x7fc
push eax
mov word [esp + esi + 0x5c], ax
mov dword [esp + 0x185c], eax
lea eax, [esp + 0x1860]
push eax
call fcn.0048fb10
add esp, 0xc
lea eax, [esp + 0x56]
add eax, esi
push eax
lea eax, [esp + 0x1858]
push eax
call ebp
mov esi, dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp + 0x54]
push 0x4bdaf4
push eax
call esi
lea eax, [esp + 0x1854]
jmp 0x45b6e3
mov esi, ebx
sub esi, eax
and esi, 0xfffffffe
cmp esi, 0x800
jae 0x45ba74
xor eax, eax
push 0x7fc
push eax
mov word [esp + esi + 0x5c], ax
mov dword [esp + 0x105c], eax
lea eax, [esp + 0x1060]
push eax
call fcn.0048fb10
add esp, 0xc
lea eax, [esp + 0x56]
add eax, esi
push eax
lea eax, [esp + 0x1058]
push eax
call ebp
mov esi, dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp + 0x54]
push 0x4bdafc
push eax
call esi
lea eax, [esp + 0x1054]
jmp 0x45b6e3
push 0x7c
push eax
call edi
test eax, eax
jne 0x45b676
push 0x4bdaf4
push eax
lea eax, [esp + 0x5c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrRStrIW]
mov esi, eax
test esi, esi
je 0x45ba58
lea eax, [esp + 0x54]
sub esi, eax
and esi, 0xfffffffe
cmp esi, 0x800
jae 0x45ba74
xor eax, eax
push 0x7fc
push eax
mov word [esp + esi + 0x5c], ax
mov dword [esp + 0x205c], eax
lea eax, [esp + 0x2060]
push eax
call fcn.0048fb10
add esp, 0xc
lea eax, [esp + 0x56]
add eax, esi
push eax
lea eax, [esp + 0x2058]
push eax
call ebp
lea eax, [esp + 0x2054]
push eax
lea eax, [esp + 0x58]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
jmp 0x45b6eb
push 0x7fc
lea eax, [esp + 0x285c]
mov dword [esp + 0x2858], 0
push 0
push eax
call fcn.0048fb10
lea eax, [esp + 0x60]
mov esi, ebx
sub esi, eax
add esp, 0xc
and esi, 0xfffffffe
lea eax, [esp + 0x56]
add eax, esi
push eax
lea eax, [esp + 0x2858]
push eax
call ebp
add esi, 0xfffffffe
cmp esi, 0x800
jae 0x45ba74
xor eax, eax
mov word [esp + esi + 0x54], ax
lea eax, [esp + 0x54]
mov esi, dword [sym.imp.SHLWAPI.dll_StrCatW]
push 0x4bdb04
push eax
call esi
lea eax, [esp + 0x2854]
push eax
lea eax, [esp + 0x58]
push eax
call esi
lea eax, [esp + 0x54]
mov dword [esp + 0x20], 4
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x18]
push 0x1074
push 0x29c5
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
test ebx, ebx
jne 0x45b846
push 0x5c
lea eax, [esp + 0x858]
push eax
call edi
test eax, eax
je 0x45ba58
lea ecx, [esp + 0x854]
sub eax, ecx
and eax, 0xfffffffe
cmp eax, 0x800
jae 0x45ba74
xor ecx, ecx
mov word [esp + eax + 0x854], cx
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x10]
push ecx
push 0xf013f
lea ecx, [esp + 0x85e]
add eax, ecx
lea ecx, [esp + 0x85c]
push ebx
push eax
call fcn.00479700
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x45ba58
push 0x5c
lea eax, [esp + 0x58]
push eax
call edi
mov edi, eax
test edi, edi
je 0x45ba58
lea eax, [esp + 0x54]
sub edi, eax
and edi, 0xfffffffe
cmp edi, 0x800
jae 0x45ba74
xor eax, eax
lea ecx, [esp + 0x54]
push eax
mov word [esp + edi + 0x58], ax
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
push ebx
push 0xf013f
push ebx
push ebx
lea eax, [esp + 0x6e]
add eax, edi
push ebx
push eax
call fcn.00479700
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x45ba58
push eax
push dword [esp + 0x18]
push eax
push dword [esp + 0x1c]
call dword [sym.imp.SHLWAPI.dll_SHCopyKeyW]
push dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [esp + 0x14]
call esi
push str.chNameOfFolder
push ebx
push ebx
lea esi, [esp + 0x862]
push ebx
lea ecx, [esp + 0x864]
add esi, edi
call fcn.00479700
mov edx, esi
mov ecx, eax
call fcn.00477b10
add esp, 0x10
lea eax, [ebx + 1]
jmp 0x45ba5b
push 0x7fc
lea eax, [esp + 0x105c]
mov dword [esp + 0x1058], 0
push 0
push eax
call fcn.0048fb10
push 0x7fc
lea eax, [esp + 0x1868]
mov dword [esp + 0x1864], 0
push 0
push eax
call fcn.0048fb10
add esp, 0x18
lea eax, [esp + 0x854]
push 0x7c
push 0
push eax
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
test eax, eax
je 0x45ba58
lea ecx, [esp + 0x854]
sub eax, ecx
and eax, 0xfffffffe
cmp eax, 0x800
jae 0x45ba74
xor ecx, ecx
mov word [esp + eax + 0x854], cx
lea ecx, [esp + 0x856]
add eax, ecx
push eax
lea eax, [esp + 0x1058]
push eax
call ebp
push 0x5c
lea eax, [esp + 0x858]
push eax
call edi
test eax, eax
je 0x45ba58
lea ecx, [esp + 0x854]
sub eax, ecx
and eax, 0xfffffffe
cmp eax, 0x800
jae 0x45ba74
xor ecx, ecx
push ecx
mov word [esp + eax + 0x858], cx
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x14]
push ecx
push 0
push 0xf013f
push 0
push 0
lea ecx, [esp + 0x86e]
add eax, ecx
lea ecx, [esp + 0x86c]
push 0
push eax
call fcn.00479700
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push eax
call ebx
test eax, eax
jne 0x45ba58
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x400
push eax
lea eax, [esp + 0x1858]
push eax
push 0
push 0
lea eax, [esp + 0x1064]
push eax
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x45ba58
lea eax, [esp + 0x1054]
push eax
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push 0x7c
lea eax, [esp + 0x58]
push eax
call edi
test eax, eax
je 0x45ba58
lea ecx, [esp + 0x54]
sub eax, ecx
and eax, 0xfffffffe
cmp eax, 0x800
jae 0x45ba74
xor ecx, ecx
mov word [esp + eax + 0x54], cx
lea eax, [esp + 0x54]
push 0x5c
push eax
call edi
test eax, eax
je 0x45ba58
lea ecx, [esp + 0x54]
sub eax, ecx
and eax, 0xfffffffe
cmp eax, 0x800
jae 0x45ba74
xor ecx, ecx
push ecx
mov word [esp + eax + 0x58], cx
lea ecx, [esp + 0x14]
push ecx
push 0
push 0xf013f
push 0
push 0
lea ecx, [esp + 0x6e]
add eax, ecx
lea ecx, [esp + 0x6c]
push 0
push eax
call fcn.00479700
push eax
call ebx
test eax, eax
jne 0x45ba58
lea eax, [esp + 0x1854]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
lea eax, [esp + 0x1858]
push eax
push 1
push 0
lea eax, [esp + 0x1064]
push eax
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x10]
call esi
mov eax, 1
jmp 0x45ba5b
or eax, 0xffffffff
mov ecx, dword [esp + 0x3054]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0048ea75
add esp, 0x3048
ret
call fcn.0048eba6
int3