Function at 0x45a850
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x482730
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x4ade78]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x4b0c00]
mov dword [ebp - 0x30], 0
test al, 1
jne 0x45a8b7
or eax, 1
mov dword [0x4b0c00], eax
mov eax, dword [0x4adbb8]
mov ecx, 0x4adbb8
call dword [eax + 0xc]
add eax, 0x10
push 0x48e8b0
mov dword [0x4b0bfc], eax
call fcn.00460bd7
mov eax, dword [0x4b0c00]
add esp, 4
test al, 2
jne 0x45a8ea
or eax, 2
mov dword [0x4b0c00], eax
mov eax, dword [0x4adbb8]
mov ecx, 0x4adbb8
call dword [eax + 0xc]
add eax, 0x10
push 0x48e8e0
mov dword [0x4b0c04], eax
call fcn.00460bd7
mov eax, dword [0x4b0c00]
add esp, 4
test al, 4
jne 0x45a91d
or eax, 4
mov dword [0x4b0c00], eax
mov eax, dword [0x4adbb8]
mov ecx, 0x4adbb8
call dword [eax + 0xc]
add eax, 0x10
push 0x48e910
mov dword [0x4b0c08], eax
call fcn.00460bd7
mov eax, dword [0x4b0c00]
add esp, 4
test al, 8
jne 0x45a94b
or eax, 8
mov dword [0x4b0c00], eax
mov eax, dword [0x4adbb8]
mov ecx, 0x4adbb8
call dword [eax + 0xc]
add eax, 0x10
push 0x48e880
mov dword [0x4b0c0c], eax
call fcn.00460bd7
add esp, 4
mov eax, dword [0x4b0c04]
cmp dword [eax - 0xc], 0
je 0x45a98c
mov eax, dword [0x4b0bf4]
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x45a970
push 0x80004005
call fcn.00403930
push eax
push dword [0x4b0c0c]
call fcn.0046236e
add esp, 8
test eax, eax
setne al
test al, al
je 0x45b074
push 0x4b0bf4
mov ecx, 0x4b0c0c
call fcn.00402970
mov ecx, 0x4b0bfc
call fcn.00404340
mov ecx, 0x4b0c04
call fcn.00404340
mov ecx, 0x4b0c08
call fcn.00404340
xor eax, eax
mov dword [ebp - 0x24], eax
mov eax, dword [0x4adbb8]
mov ecx, 0x4adbb8
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x1c], esi
mov eax, dword [0x4adbb8]
mov ecx, 0x4adbb8
mov dword [ebp - 4], 0
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x20], edi
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
push str.Volatile_Environment
push SysReAllocStringLen
mov byte [ebp - 4], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, 1
test eax, eax
jne 0x45abe6
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x45abd6
mov dword [ebp - 0x18], 0x104
mov eax, dword [esi - 8]
mov ecx, ebx
sub ecx, dword [esi - 4]
sub eax, 0x104
or eax, ecx
jge 0x45aa6b
push 0x104
lea ecx, [ebp - 0x1c]
call fcn.00407d40
mov esi, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0x28]
push eax
push 0
push str.AppData
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x45aab0
push dword [esi - 8]
push esi
call fcn.00462113
add esp, 8
test eax, eax
js 0x45aaa6
cmp eax, dword [esi - 8]
jg 0x45aaa6
mov dword [esi - 0xc], eax
mov byte [eax + esi], 0
jmp 0x45aabb
push 0x80070057
call fcn.00403930
lea ecx, [ebp - 0x1c]
call fcn.00404340
mov esi, dword [ebp - 0x1c]
mov eax, dword [0x4b0bfc]
mov dword [ebp - 0x18], 0x104
mov ecx, dword [eax - 8]
mov edx, ebx
sub edx, dword [eax - 4]
sub ecx, 0x104
or ecx, edx
jge 0x45aaed
push 0x104
mov ecx, 0x4b0bfc
call fcn.00407d40
mov eax, dword [0x4b0bfc]
lea ecx, [ebp - 0x18]
push ecx
push eax
lea eax, [ebp - 0x28]
push eax
push 0
push str.Local_AppData
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x45ab3d
mov eax, dword [0x4b0bfc]
push dword [eax - 8]
push eax
call fcn.00462113
add esp, 8
test eax, eax
js 0x45aaa6
mov ecx, dword [0x4b0bfc]
cmp eax, dword [ecx - 8]
jg 0x45aaa6
mov dword [ecx - 0xc], eax
mov ecx, dword [0x4b0bfc]
mov byte [eax + ecx], 0
jmp 0x45ab47
mov ecx, 0x4b0bfc
call fcn.00404340
mov dword [ebp - 0x18], 0x104
mov eax, dword [edi - 8]
mov ecx, ebx
sub ecx, dword [edi - 4]
sub eax, 0x104
or eax, ecx
jge 0x45ab6f
push 0x104
lea ecx, [ebp - 0x20]
call fcn.00407d40
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x18]
push eax
push edi
lea eax, [ebp - 0x28]
push eax
push 0
push str.A520A1A4_1780_4FF6_BD18_167343C5AF16
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x45abbb
push dword [edi - 8]
push edi
call fcn.00462113
add esp, 8
test eax, eax
js 0x45aaa6
cmp eax, dword [edi - 8]
jg 0x45aaa6
mov dword [edi - 0xc], eax
mov byte [eax + edi], 0
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x45abe6
push 0x4b0bfc
lea ecx, [ebp - 0x20]
call fcn.00402970
push dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x45abe6
push 0x4b0bfc
lea ecx, [ebp - 0x20]
call fcn.00402970
mov edi, dword [ebp - 0x20]
call fcn.0045b1b0
test al, al
je 0x45adf1
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftInternet_ExplorerMain
push SysReAllocStringLen
mov byte [ebp - 0xd], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x45ad16
mov ecx, dword [0x4af2c0]
mov eax, ecx
imul eax, ecx
imul eax, ecx
mov dword [ebp - 0x18], 0x104
and eax, 0x8000000f
jns 0x45ac3a
dec eax
or eax, 0xfffffff0
inc eax
cmp eax, 4
jne 0x45ac46
dec ecx
mov dword [0x4af2c0], ecx
mov eax, dword [esi - 8]
sub ebx, dword [esi - 4]
sub eax, 0x104
or eax, ebx
jge 0x45ac65
push 0x104
lea ecx, [ebp - 0x1c]
call fcn.00407d40
mov esi, dword [ebp - 0x1c]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0x28]
push eax
push 0
push str.Isolation
push dword [ebp - 0x14]
call ebx
test eax, eax
jne 0x45accf
push dword [esi - 8]
push esi
call fcn.00462113
add esp, 8
test eax, eax
js 0x45aaa6
cmp eax, dword [esi - 8]
jg 0x45aaa6
mov dword [esi - 0xc], eax
mov byte [eax + esi], 0
cmp dword [esi - 0xc], 0
mov byte [ebp - 0xd], 0
jl 0x45accf
push str.PMIL
push esi
call fcn.004627c2
add esp, 8
test eax, eax
je 0x45accf
sub eax, esi
jne 0x45accf
mov dword [ebp - 0x24], 1
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0xd], 0
jne 0x45ad1c
mov eax, dword [ebp - 0x24]
or ebx, 0xffffffff
cmp dword [0x4adbb0], 0x80000002
jne 0x45adf8
push 0x4b0bf4
mov ecx, 0x4b0c04
call fcn.00402970
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x4b0bfc
call fcn.00402970
jmp 0x45aedc
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftInternet_ExplorerAdvancedOptionsCRYPTOPROTECTEDMODESECURITY
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x45ade7
lea eax, [ebp - 0x18]
push eax
push 0x104
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x104
call fcn.004045a0
push eax
lea eax, [ebp - 0x28]
push eax
push 0
push str.DefaultValue
push dword [ebp - 0x14]
call ebx
mov esi, dword [ebp - 0x1c]
push dword [esi - 8]
push esi
call fcn.00462113
add esp, 8
test eax, eax
js 0x45aaa6
cmp eax, dword [esi - 8]
jg 0x45aaa6
mov dword [esi - 0xc], eax
mov byte [eax + esi], 0
call fcn.0045c9e0
test al, al
jne 0x45adb6
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esi - 0xc], 0
jl 0x45acde
push str.PMIL
push esi
call fcn.004627c2
add esp, 8
test eax, eax
je 0x45acde
sub eax, esi
jne 0x45acde
mov eax, 1
jmp 0x45ace1
mov eax, ebx
jmp 0x45ace1
test eax, eax
je 0x45ae51
call fcn.0045b250
test al, al
je 0x45acf4
cmp byte [0x4b0aa8], 0
jne 0x45acf4
push str.Software_
lea ecx, [ebp - 0x24]
call fcn.00401b30
push eax
mov ecx, 0x4b0c04
mov byte [ebp - 4], 2
call fcn.00402970
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 1
call fcn.00402850
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x4b0bfc
call fcn.00402970
jmp 0x45aedc
push 0x4b0bfc
call fcn.0045a250
add esp, 4
test al, al
jne 0x45ae71
push str.Packageswindows_ie_ac_001AC
mov ecx, 0x4b0bfc
call fcn.00402ec0
push str.SoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsCurrentVersionAppContainerStoragewindows_ie_ac_001Software_
lea ecx, [ebp - 0x24]
call fcn.00401b30
push eax
mov ecx, 0x4b0c04
mov byte [ebp - 4], 3
call fcn.00402970
mov edx, dword [ebp - 0x24]
add edx, 0xfffffff0
mov byte [ebp - 4], 1
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x45aead
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [0x4af2c0]
lea ecx, [edx + 1]
lea eax, [edx + 2]
imul eax, ecx
imul eax, edx
cdq
mov ecx, 0xb
idiv ecx
cmp edx, 8
jne 0x45aedc
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetMailslotInfo]
mov eax, dword [0x4b0c04]
cmp dword [eax - 0xc], 0
jl 0x45af14
push str.windows_ie_ac_001
push eax
call fcn.004627c2
add esp, 8
test eax, eax
je 0x45af14
sub eax, dword [0x4b0c04]
test eax, eax
jle 0x45af14
push 0x4b0bf4
mov ecx, 0x4b0c08
call fcn.00402970
jmp 0x45af75
call fcn.0045b250
test al, al
je 0x45af39
cmp byte [0x4b0aa8], 0
jne 0x45af39
push str.Software_
lea ecx, [ebp - 0x24]
call fcn.00401b30
mov byte [ebp - 4], 5
jmp 0x45af4a
push str.SoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsCurrentVersionAppContainerStoragewindows_ie_ac_001Software_
lea ecx, [ebp - 0x24]
call fcn.00401b30
mov byte [ebp - 4], 4
push eax
mov ecx, 0x4b0c08
call fcn.00402970
mov edx, dword [ebp - 0x24]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
mov byte [ebp - 4], 1
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x45af75
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [0x4adbb0], reloc.OLEAUT32.dll_SysReAllocString
je 0x45b012
cmp byte [0x4adbb4], 0
je 0x45b012
lea eax, [ebp - 0x24]
push eax
call fcn.0045bd20
add esp, 4
mov eax, dword [eax]
mov ecx, 0x4b0c04
push dword [eax - 0xc]
mov byte [ebp - 4], 6
push eax
call fcn.004035a0
mov edx, dword [ebp - 0x24]
add edx, 0xfffffff0
mov byte [ebp - 4], 1
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x45afd2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x2c]
push eax
call fcn.0045bd20
add esp, 4
mov eax, dword [eax]
mov ecx, 0x4b0c08
push dword [eax - 0xc]
mov byte [ebp - 4], 7
push eax
call fcn.004035a0
mov edx, dword [ebp - 0x2c]
add edx, 0xfffffff0
mov byte [ebp - 4], 1
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x45b012
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 1
push dword [0x4adbb0]
push 0x4b0c04
call fcn.0045a160
push 1
push dword [0x4adbb0]
push 0x4b0c08
call fcn.0045a160
add edi, 0xfffffff0
add esp, 0x18
mov byte [ebp - 4], 0
lea eax, [edi + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x45b056
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x45b074
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp + 0x10], 0
je 0x45b08e
cmp byte [ebp + 0xc], 0
je 0x45b087
mov eax, dword [0x4b0c08]
jmp 0x45b093
mov eax, dword [0x4b0c04]
jmp 0x45b093
mov eax, dword [0x4b0bfc]
add eax, 0xfffffff0
push eax
call fcn.00403ee0
lea ecx, [eax + 0x10]
mov eax, dword [ebp + 8]
add esp, 4
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret