Function at 0x100452e0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Link many functions at runtime
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
push esi
push edi
call fcn.1001c320
cmp byte [0x1005e209], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
jne 0x100453de
push 0x10053160
push dword [0x1005dbf8]
mov byte [0x1005e209], 1
call esi
lea ecx, [ebp - 0x10]
push ecx
push 0x1004ea40
push 0x1004f9fc
call eax
test eax, eax
jne 0x100453de
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x10]
push 0x1005610c
push 0
mov eax, dword [eax + 0xc]
call eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x100453de
mov esi, dword [eax]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 0x70
push esi
call edi
lea eax, [ebp - 0xc]
mov dword [esi + 0x3c], 0x10030dc0
push eax
push dword [ebp - 0xc]
push 0x70
push esi
call edi
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
push edx
mov dword [ebp - 4], 0
push 0x10053638
mov ecx, dword [eax]
push eax
call dword [ecx]
mov eax, dword [ebp - 4]
test eax, eax
je 0x100453cb
mov esi, dword [eax]
lea eax, [ebp - 0xc]
push eax
push 0x40
push 0x10
push esi
call edi
mov eax, dword [esi + 0xc]
mov dword [0x1005e0e0], eax
lea eax, [ebp - 0xc]
push eax
mov dword [esi + 0xc], 0x10030cf0
push dword [ebp - 0xc]
push 0x10
push esi
call edi
mov eax, dword [ebp - 4]
test eax, eax
je 0x100453cb
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 8]
test eax, eax
je 0x100453d8
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp byte [0x1005dbe8], 0
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
jne 0x10045480
push 0x3ae
push 0x10051d90
call ebx
push eax
call esi
push 0x10016500
push eax
push str.appresolver.dll
mov dword [0x1005dbf4], eax
call ebx
mov edx, str.windows.storage.dll
mov ecx, eax
call fcn.1001c730
test eax, eax
setne byte [0x1005dbe8]
test eax, eax
jne 0x10045480
push 0x10053160
push dword [0x1005dbf8]
call esi
lea ecx, [ebp - 4]
push ecx
push 0x1004ea40
push 0x10053174
call eax
test eax, eax
jne 0x10045480
lea eax, [ebp - 8]
mov byte [0x1005dbe8], 1
push eax
push 0x40
push 0x10
push dword [ebp - 4]
call edi
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0xc]
mov dword [0x1005dbf0], eax
lea eax, [ebp - 8]
push eax
mov dword [ecx + 0xc], 0x10016560
push dword [ebp - 8]
push 0x10
push dword [ebp - 4]
call edi
mov esi, dword [ebp + 8]
mov edx, 0x1004f9ec
mov ecx, esi
mov edi, 0xc
nop
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x100454a3
add ecx, 4
add edx, 4
sub edi, 4
jae 0x10045490
jmp 0x100454c1
mov ecx, esi
mov edx, 0x1004f9fc
mov edi, 0xc
nop
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x100454eb
add ecx, 4
add edx, 4
sub edi, 4
jae 0x100454b0
push 0x10053160
push 0x1004f3bc
call ebx
push eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0x1004f9fc
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, esi
mov edx, 0x10057bb8
mov edi, 0xc
nop word [eax + eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10045622
add ecx, 4
add edx, 4
sub edi, 4
jae 0x10045500
xor cl, cl
call fcn.10044ff0
mov eax, dword [0x100580bc]
movups xmm0, xmmword [str.twinui.dll]
mov dword [ebp - 0x208], eax
mov ax, word [0x100580c0]
push 0x1f2
mov word [ebp - 0x204], ax
lea eax, [ebp - 0x202]
push 0
push eax
movups xmmword [ebp - 0x218], xmm0
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x10], 0x208
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push 0xffff
push 0
push str.CLSIDc71c41f1_ddad_42dc_a8fc_f5bfc61df957InProcServer32
push SHChangeNotifyRegister
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
push 0x10053160
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
mov edi, eax
test edi, edi
je 0x10045614
mov esi, dword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
mov dword [ebp + 8], 0
push eax
push 0
push 0x10
push str.NoMetro
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvanced
push SHChangeNotifyRegister
mov dword [ebp - 4], 4
call esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp + 8]
push eax
push 0
push 0x10
push str.NoMetro
push str.SoftwareStartIsBack
push SHChangeNotifyRegister
call esi
cmp dword [ebp + 8], 0
jne 0x10045614
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0x10057bc8
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
pop edi
pop esi
mov eax, 0x80004001
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, esi
mov edx, str.gVba_
mov edi, 0xc
nop
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10045643
add ecx, 4
add edx, 4
sub edi, 4
jae 0x10045630
jmp 0x10045661
mov ecx, esi
mov edx, 0x10057b78
mov edi, 0xc
nop
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x1004568f
add ecx, 4
add edx, 4
sub edi, 4
jae 0x10045650
push 0x10053160
push str.twinui.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push str.gVba_
call eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edx, esi
mov edi, 0x1004f870
mov ebx, 0xc
nop dword [eax + eax]
mov eax, dword [edx]
mov ecx, dword [ebp + 0xc]
cmp eax, dword [edi]
jne 0x10045720
add edx, 4
add edi, 4
sub ebx, 4
jae 0x100456a0
mov edx, ecx
mov edi, 0x1004ea40
mov ebx, 0xc
mov eax, dword [edx]
cmp eax, dword [edi]
jne 0x10045720
add edx, 4
add edi, 4
sub ebx, 4
jae 0x100456c0
mov ecx, dword [0x1005e42c]
test ecx, ecx
jne 0x10045710
push 4
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x10045708
mov eax, dword [ebp + 0x10]
pop edi
mov dword [ecx], 0x100581e4
pop esi
mov dword [eax], ecx
xor eax, eax
mov dword [0x1005e42c], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
xor ecx, ecx
mov dword [0x1005e42c], ecx
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
mov dword [eax], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
mov edx, esi
mov edi, 0x10057ee4
mov ebx, 0xc
nop dword [eax]
mov eax, dword [edx]
cmp eax, dword [edi]
jne 0x100457b0
add edx, 4
add edi, 4
sub ebx, 4
jae 0x10045730
mov edx, ecx
mov edi, 0x1004ea40
mov ebx, 0xc
nop dword [eax]
mov eax, dword [edx]
cmp eax, dword [edi]
jne 0x100457b0
add edx, 4
add edi, 4
sub ebx, 4
jae 0x10045750
mov ecx, dword [0x1005e430]
test ecx, ecx
jne 0x100457a0
push 4
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x10045798
mov eax, dword [ebp + 0x10]
pop edi
mov dword [ecx], 0x100581d0
pop esi
mov dword [eax], ecx
xor eax, eax
mov dword [0x1005e430], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
xor ecx, ecx
mov dword [0x1005e430], ecx
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
mov dword [eax], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
mov edx, esi
mov edi, 0x1004fb84
mov ebx, 0xc
nop dword [eax]
mov eax, dword [edx]
cmp eax, dword [edi]
jne 0x10045840
add edx, 4
add edi, 4
sub ebx, 4
jae 0x100457c0
mov edx, ecx
mov edi, 0x1004ea40
mov ebx, 0xc
nop dword [eax]
mov eax, dword [edx]
cmp eax, dword [edi]
jne 0x10045840
add edx, 4
add edi, 4
sub ebx, 4
jae 0x100457e0
mov ecx, dword [0x1005e13c]
test ecx, ecx
jne 0x10045830
push 4
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x10045828
mov eax, dword [ebp + 0x10]
pop edi
mov dword [ecx], 0x1004fb20
pop esi
mov dword [eax], ecx
xor eax, eax
mov dword [0x1005e13c], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
xor ecx, ecx
mov dword [0x1005e13c], ecx
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
mov dword [eax], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
mov edx, esi
mov edi, 0x100519b0
mov ebx, 0xc
nop dword [eax]
mov eax, dword [edx]
cmp eax, dword [edi]
jne 0x100458d0
add edx, 4
add edi, 4
sub ebx, 4
jae 0x10045850
mov edx, ecx
mov edi, 0x1004ea40
mov ebx, 0xc
nop dword [eax]
mov eax, dword [edx]
cmp eax, dword [edi]
jne 0x100458d0
add edx, 4
add edi, 4
sub ebx, 4
jae 0x10045870
mov ecx, dword [0x1005e434]
test ecx, ecx
jne 0x100458c0
push 4
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x100458b8
mov eax, dword [ebp + 0x10]
pop edi
mov dword [ecx], 0x100581bc
pop esi
mov dword [eax], ecx
xor eax, eax
mov dword [0x1005e434], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
xor ecx, ecx
mov dword [0x1005e434], ecx
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
mov dword [eax], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
mov edx, 0x100519a0
mov edi, 0xc
nop word [eax + eax]
mov eax, dword [esi]
cmp eax, dword [edx]
jne 0x10045960
add esi, 4
add edx, 4
sub edi, 4
jae 0x100458e0
mov edx, 0x1004ea40
mov esi, 0xc
nop dword [eax + eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10045960
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10045900
mov ecx, dword [0x1005e438]
test ecx, ecx
jne 0x10045950
push 4
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x10045948
mov eax, dword [ebp + 0x10]
pop edi
mov dword [ecx], 0x100581a8
pop esi
mov dword [eax], ecx
xor eax, eax
mov dword [0x1005e438], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
xor ecx, ecx
mov dword [0x1005e438], ecx
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
mov dword [eax], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
pop edi
pop esi
mov eax, 0x80004002
pop ebx
mov esp, ebp
pop ebp
ret 0xc