Function at 0x45d110
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4bbff9
mov eax, dword fs:[0]
push eax
sub esp, 0x43c
mov eax, dword [0x4df16c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x448], ebx
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x434], 0
call fcn.0040ce00
mov ecx, eax
test ecx, ecx
je 0x45d478
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x434], 1
call fcn.0040ce00
mov ecx, eax
test ecx, ecx
je 0x45d482
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x424], eax
push 0x4be63c
lea ecx, [ebp - 0x424]
mov dword [ebp - 4], 1
call fcn.0040c500
test al, al
jne 0x45d1d2
push 0
push 0x4be63c
lea ecx, [ebp - 0x424]
call fcn.0040d800
push dword [ebp + 0xc]
mov dword [ebp - 4], 2
call fcn.0045d7b0
mov edx, dword [0x50b024]
add esp, 4
mov esi, eax
mov eax, edx
mov ecx, dword [edx + 4]
cmp byte [ecx + 0xd], 0
jne 0x45d214
cmp dword [ecx + 0x10], esi
jge 0x45d201
mov ecx, dword [ecx + 8]
jmp 0x45d205
mov eax, ecx
mov ecx, dword [ecx]
cmp byte [ecx + 0xd], 0
je 0x45d1f7
cmp eax, edx
je 0x45d214
cmp esi, dword [eax + 0x10]
jge 0x45d216
mov eax, edx
cmp edx, eax
je 0x45d229
add eax, 0x14
lea ecx, [ebp - 0x424]
push eax
call fcn.00409230
call fcn.0040ce00
mov ecx, eax
test ecx, ecx
je 0x45d48c
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x42c], eax
push 0x4c35dc
lea ecx, [ebp - 0x42c]
mov byte [ebp - 4], 3
call fcn.0040c500
test al, al
jne 0x45d270
push 3
push 0x4c35dc
lea ecx, [ebp - 0x42c]
call fcn.0040d800
add esi, 0xfffffffd
mov byte [ebp - 4], 4
cmp esi, 0x3e
ja case.0x45d287.4
movzx eax, byte [esi + 0x45d4a0]
jmp dword [eax*4 + 0x45d498]
push 0x208
lea eax, [ebp - 0x420]
mov dword [ebp - 0x428], 1
push 0
push eax
mov dword [ebp - 0x430], 0x104
call fcn.00494db0
mov edi, dword [ebp - 0x42c]
lea eax, [ebp - 0x430]
mov esi, dword [ebp - 0x424]
add esp, 0xc
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x428]
push eax
push edi
push esi
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x45d423
lea ecx, [ebp - 0x420]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45d2f7
sub ecx, edx
lea eax, [ebp - 0x420]
sar ecx, 1
push ecx
push eax
mov ecx, ebx
call fcn.0040d800
jmp 0x45d423
mov dword [ebp - 0x444], 0
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x43c], 0
mov esi, dword [ebp - 0x424]
lea ecx, [ebp - 0x444]
push 0x20219
push esi
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebp - 4], 5
call fcn.0040d2f0
mov edi, dword [ebp - 0x42c]
mov ebx, dword [ebp - 0x444]
test eax, eax
jne 0x45d412
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00494db0
add esp, 0xc
mov dword [ebp - 0x430], 0x208
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x438]
push eax
push 0
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x45d412
mov eax, dword [ebp - 0x438]
cmp eax, 1
je 0x45d3bf
cmp eax, 2
jne 0x45d412
mov eax, dword [ebp - 0x430]
test eax, eax
je 0x45d3dc
test al, 1
jne 0x45d412
shr eax, 1
cmp word [ebp + eax*2 - 0x21a], 0
je 0x45d3e5
jmp 0x45d412
xor eax, eax
mov word [ebp - 0x218], ax
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45d3f0
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
mov ecx, dword [ebp - 0x428]
push eax
call fcn.0040d800
test ebx, ebx
je 0x45d41d
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0x428]
lea edx, [edi - 0x10]
mov byte [ebp - 4], 2
or edi, 0xffffffff
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x45d441
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x45d45a
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00472a8d
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.0040c4e0
push 0x80004005
call fcn.0040c4e0
push 0x80004005
call fcn.0040c4e0
nop
mov ss, edx
inc ebp
add byte [edx], bl
rol dword [ebp], cl
add byte [ecx], al
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add dword [eax], eax
add dword [ecx], eax
add byte [eax], al
add ah, cl