Function at 0x455240
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x502879
mov eax, dword fs:[0]
push eax
sub esp, 0x114
mov eax, dword [0x5732cc]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x34], edi
xor esi, esi
mov dword [ebp - 4], esi
push 0x468ad0
call fcn.004dbbc8
add esp, 4
cmp dword [ebp + 0xc], esi
setne bl
mov byte [ebp - 0x2d], bl
cmp dword [ebp + 0x10], esi
setne byte [ebp - 0x2e]
mov dword [ebp - 0x2c], esi
test bl, bl
je 0x4552b6
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov esi, eax
mov dword [ebp - 0x2c], esi
mov eax, dword [edi + 0x58]
test eax, eax
je 0x4552b6
mov esi, eax
mov dword [ebp - 0x2c], esi
cmp byte [0x576fd1], 0
jne 0x4556a8
cmp byte [0x576fd0], 0
jne 0x4556a8
mov byte [0x576fd1], 1
call fcn.00424890
mov ecx, eax
call fcn.00422940
test al, al
je 0x4556e2
call fcn.00424890
mov byte [eax + 0x24], 0
push 0xffffffffffffffff
push 1
push 1
call fcn.0041f480
mov ecx, eax
call fcn.00420010
push 1
lea ecx, [ebp - 0x120]
call fcn.0041f520
mov byte [ebp - 4], 1
mov byte [ebp - 4], 2
push str.IN_CMW_OUDO__set_NTRSB_to_false.
lea eax, [ebp - 0x120]
push eax
call fcn.0041e560
add esp, 8
lea ecx, [ebp - 0x120]
push ecx
call fcn.0041f480
mov ecx, eax
call fcn.0041cfb0
mov dword [ebp - 4], 1
jmp 0x45535e
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x120]
call fcn.0041dc00
mov byte [ebp - 0x25], 0
push 0x513c28
call fcn.00430450
add esp, 4
cmp eax, 0xffffffff
jne 0x4553c1
push 0x513edc
call fcn.00430450
add esp, 4
cmp eax, 0xffffffff
jne 0x4553c1
push 0x513ed0
call fcn.00430450
add esp, 4
cmp eax, 0xffffffff
jne 0x4553c1
push str.USAirways.exe
call fcn.00430490
add esp, 4
cmp eax, 1
jne 0x4553c1
mov byte [ebp - 0x25], al
jmp 0x45566f
push 0x519710
lea edx, [ebp - 0x2c]
push edx
call fcn.00432d60
add esp, 8
mov byte [ebp - 4], 4
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x3c], 1
mov dword [ebp - 0x48], 0x10
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 0x3c]
push edx
push str.DoNotPromptToUpdate
push str.SoftwareUSAirwaysToolbar
push reloc.WS2_32.dll_accept
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test bl, bl
jne 0x45542a
lea edx, [ebp - 0x24]
mov ecx, dword [ebp - 0x2c]
call fcn.0044ed20
test eax, eax
jle 0x455659
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax - 8]
push ecx
push eax
push 1
push str.DoNotPromptToUpdate
push str.SoftwareUSAirwaysToolbar
push reloc.WS2_32.dll_accept
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
push 0x514dec
lea ecx, [ebp - 0x38]
call fcn.0041ad50
mov byte [ebp - 4], 5
push 0
lea eax, [ebp - 0x44]
push eax
call fcn.0046bd70
mov byte [ebp - 4], 6
add esp, 4
mov ecx, esp
mov dword [ebp - 0x5c], esp
push str.A_new_version_of_US_Airways_Dividend_Miles_StoreFront_has_been_downloaded_and_is_ready_to_be_installed.__Would_you_like_to_update__nUS_Airways_Dividend_Miles_StoreFront_now___The_update_will_only_take_a_few_seconds_but_will_require_all_internet_browsers_to_be_closed.__Please_select
call fcn.0041ad50
mov byte [ebp - 4], 7
push 0x67
push 4
mov ecx, dword [ebp - 0x38]
push ecx
push esi
mov byte [ebp - 4], 6
call fcn.00439230
add esp, 0x14
cmp eax, 6
jne 0x455641
mov dword [ebp - 0x54], 0x513c28
mov dword [ebp - 0x50], 0x513edc
mov dword [ebp - 0x4c], 0x513ed0
push 0xffffffffffffffff
push 3
lea edx, [ebp - 0x54]
push edx
call fcn.00454780
add esp, 0xc
test al, al
jne 0x45552a
push 0xffffffffffffffff
push 1
push 2
call fcn.0041f480
mov ecx, eax
call fcn.00420010
push 1
lea ecx, [ebp - 0x120]
call fcn.0041f520
mov ebx, 8
mov byte [ebp - 4], bl
mov byte [ebp - 4], 9
push str.The_TerminateAll_function_could_not_terminate_all_the_required_processes.
lea eax, [ebp - 0x120]
push eax
call fcn.0041e560
add esp, 8
lea ecx, [ebp - 0x120]
push ecx
call fcn.0041f480
mov ecx, eax
call fcn.0041cfb0
mov dword [ebp - 4], ebx
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x120]
call fcn.0041dc00
call fcn.00424890
mov byte [eax + 0x24], 1
push 0xffffffffffffffff
push 1
push 1
call fcn.0041f480
mov ecx, eax
call fcn.00420010
push 1
lea ecx, [ebp - 0x120]
call fcn.0041f520
mov ebx, 0xb
mov byte [ebp - 4], bl
mov byte [ebp - 4], 0xc
push str.IN_CMW_OUDO__set_NTRSB_to_true.
lea edx, [ebp - 0x120]
push edx
call fcn.0041e560
add esp, 8
lea eax, [ebp - 0x120]
push eax
call fcn.0041f480
mov ecx, eax
call fcn.0041cfb0
mov dword [ebp - 4], ebx
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x120]
call fcn.0041dc00
mov byte [ebp - 0x25], 1
push 0x1770
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x513c28
call fcn.00430490
add esp, 4
test eax, eax
jne 0x4555eb
push 0x513edc
call fcn.00430490
add esp, 4
test eax, eax
jne 0x4555eb
push 0x513ed0
call fcn.00430490
add esp, 4
test eax, eax
jne 0x4555eb
push str.USAirways.exe
call fcn.00430490
add esp, 4
cmp eax, 1
jle 0x455641
mov byte [ebp - 0x25], 0
lea ecx, [ebp - 0x80]
call fcn.0041cc10
mov byte [ebp - 4], 0xe
push 0
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0x80]
call fcn.004527b0
cmp eax, 1
jne 0x455635
call fcn.00424890
mov ecx, eax
call fcn.004226e0
call fcn.00430a70
push 0
push 0
push 0x10
mov ecx, dword [ebp - 0x34]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x80]
call fcn.0041cad0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x44]
call fcn.00416630
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x38]
call fcn.00416630
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.00416630
cmp byte [ebp - 0x25], 0
je 0x455756
push 0
push 0
call fcn.00424890
mov ecx, eax
call fcn.004235d0
test al, al
je 0x455756
mov byte [0x576fd0], 1
mov byte [0x576fd1], 0
push 0
push 0
push 0x10
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004db901
mov esp, ebp
pop ebp
ret 0x10
test bl, bl
je 0x455756
push 0x514dec
lea ecx, [ebp - 0x2c]
call fcn.0041ad50
mov bl, 0xf
mov byte [ebp - 4], bl
cmp byte [ebp - 0x2e], 0
je 0x455716
push 0xe1
push 0x66
push 0
mov edx, dword [ebp - 0x2c]
push edx
push esi
call fcn.00439050
add esp, 0x14
jmp 0x45574a
push 0
lea eax, [ebp - 0x34]
push eax
call fcn.0046bd70
mov byte [ebp - 4], 0x10
mov ecx, dword [ebp - 0x34]
push ecx
push 0xbe
push 0x66
push 0
mov edx, dword [ebp - 0x2c]
push edx
push esi
call fcn.00439050
add esp, 0x20
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x34]
call fcn.00416630
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c]
call fcn.00416630
mov byte [0x576fd1], 0
jmp 0x4556a8