Function at 0x45aa32
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x54
push 0x48bdf8
call fcn.0047d2cc
mov dword [ebp - 0x50], ecx
xor ebx, ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x20], ebx
mov edi, ebx
mov dword [ebp - 0x24], edi
mov esi, ebx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x30]
push eax
push 0x20019
push ebx
push 0x412690
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x20], eax
test eax, eax
je 0x45aabe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call dword [sym.imp.WDSCORE.dll_CurrentIP]
mov esi, eax
push dword [ebp - 0x20]
push 0x412690
push 0x412304
push 0x4123d0
push 0x3000000
call fcn.00459d8f
add esp, 0x14
push ebx
push ebx
push edi
push esi
push 0x41232c
push 0x412368
push 0xab
jmp 0x45ac8b
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x44], ebx
mov eax, ebx
mov dword [ebp - 0x28], eax
jmp 0x45aad1
mov edi, dword [ebp - 0x24]
test eax, eax
jne 0x45aba7
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x40], ebx
push ebx
push ebx
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x3c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov dword [ebp - 0x20], eax
test eax, eax
jne 0x45ac9b
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x34]
jbe 0x45ab5c
mov dword [ebp - 0x34], eax
test edi, edi
je 0x45ab30
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
neg eax
sbb eax, eax
not eax
and eax, edi
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x34]
lea eax, [eax*2 + 2]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0x24], edi
test edi, edi
jne 0x45ab5c
mov dword [ebp - 0x20], 0xe
jmp 0x45acef
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x38]
jbe 0x45aba7
mov dword [ebp - 0x38], eax
test esi, esi
je 0x45ab88
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
neg eax
sbb eax, eax
not eax
and eax, esi
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x38]
add eax, 5
mov dword [ebp - 0x44], eax
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x2c], esi
test esi, esi
je 0x45ab50
push dword [ebp - 0x44]
push ebx
push esi
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x48], ebx
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x4c]
push eax
push esi
lea eax, [ebp - 0x48]
push eax
push ebx
lea eax, [ebp - 0x54]
push eax
push edi
push dword [ebp - 0x28]
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov edi, eax
mov dword [ebp - 0x20], edi
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
test edi, edi
jne 0x45ac3d
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], esi
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
mov esi, dword [eax + 4]
lea eax, [ebp - 0x64]
push eax
mov ecx, esi
call dword [0x4918b8]
mov ecx, dword [ebp - 0x50]
call esi
test eax, eax
je 0x45acdf
sub eax, 2
neg eax
sbb eax, eax
and eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
mov esi, dword [ebp - 0x2c]
test edi, edi
je 0x45aace
cmp edi, 0x103
je 0x45acec
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call dword [sym.imp.WDSCORE.dll_CurrentIP]
mov esi, eax
push dword [ebp - 0x20]
push 0x412690
push 0x412304
push 0x412468
push 0x3000000
call fcn.00459d8f
add esp, 0x14
push ebx
push ebx
push edi
push esi
push 0x41232c
push 0x412368
push 0x120
push ebx
push 0x41203c
push ebx
push eax
call dword [sym.imp.WDSCORE.dll_WdsSetupLogMessageW]
jmp 0x45acef
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call dword [sym.imp.WDSCORE.dll_CurrentIP]
mov esi, eax
push dword [ebp - 0x20]
push 0x412690
push 0x412304
push 0x412418
push 0x2000000
call fcn.00459d8f
add esp, 0x14
push ebx
push ebx
push edi
push esi
push 0x41232c
push 0x412368
push 0xcf
jmp 0x45ac8b
mov edi, 0x103
mov dword [ebp - 0x20], edi
jmp 0x45ac3d
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], 0xfffffffe
call fcn.0045ad1e
mov ebx, dword [ebp - 0x20]
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
sete al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4