Function at 0x4545c5
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x270
mov eax, dword [0x46700c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push eax
push 0x423e48
xor ebx, ebx
and dword [ebp - reloc.ADVAPI32.dll_TraceMessage], ebx
xor esi, esi
push 0x422204
mov eax, 0x95
lea ecx, reloc.ADVAPI32.dll_TraceMessage
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], esi
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 1
call fcn.0042c95b
add esp, 0xc
test eax, eax
jns 0x454622
xor eax, eax
jmp 0x454858
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x20019
push 0
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x454855
push edi
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0
push 0x422220
push dword [ebp - 0x268]
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0x12c
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4546ec
cmp dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 1
jne 0x4546ec
lea edi, reloc.ADVAPI32.dll_TraceMessage
mov edx, edi
mov eax, 0x95
lea esi, reloc.ADVAPI32.dll_TraceMessage
call fcn.0042c88c
mov eax, esi
push 0x20
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
je 0x4546b8
xor ecx, ecx
mov word [eax], cx
mov esi, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
lea eax, reloc.ADVAPI32.dll_TraceMessage
inc esi
push eax
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], esi
call fcn.0045ba3c
test eax, eax
je 0x4546d6
inc ebx
push 0x20
push edi
call dword [sym.imp.msvcrt.dll_wcschr]
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x4546ec
add edi, 2
jmp 0x454690
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0
push 0x422238
push dword [ebp - 0x268]
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0x12c
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x454795
cmp dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 1
jne 0x454795
lea eax, reloc.ADVAPI32.dll_TraceMessage
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
mov edx, eax
mov eax, 0x95
lea esi, reloc.ADVAPI32.dll_TraceMessage
call fcn.0042c88c
mov eax, esi
push 0x20
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
je 0x45475f
xor ecx, ecx
mov word [eax], cx
mov esi, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
inc esi
lea edi, reloc.ADVAPI32.dll_TraceMessage
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], esi
call fcn.0045c07f
test eax, eax
je 0x45477c
inc ebx
push 0x20
push dword [ebp - 0x270]
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
je 0x454795
add eax, 2
jmp 0x454731
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0
push 0x422248
push dword [ebp - 0x268]
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0x12c
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x45483a
cmp dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 1
jne 0x45483a
lea edi, reloc.ADVAPI32.dll_TraceMessage
mov edx, edi
mov eax, 0x95
lea esi, reloc.ADVAPI32.dll_TraceMessage
call fcn.0042c88c
mov eax, esi
push 0x20
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
je 0x454802
xor ecx, ecx
mov word [eax], cx
mov esi, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
inc esi
push 0x424008
lea ecx, reloc.ADVAPI32.dll_TraceMessage
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], esi
call fcn.0045bf59
test eax, eax
je 0x454824
inc ebx
push 0x20
push edi
call dword [sym.imp.msvcrt.dll_wcschr]
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x45483a
add edi, 2
jmp 0x4547da
push dword [ebp - 0x268]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
cmp ebx, esi
je 0x454855
xor eax, eax
cmp eax, ebx
sbb eax, eax
neg eax
jmp 0x454858
push 2
pop eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004655f1
leave
ret 4