Function at 0x45e090
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57468d
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x8f9064]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 4], 0
xor eax, eax
mov edx, dword [edi + 4]
mov ecx, edx
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45e0e6
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x2c]
call fcn.0045e3d0
push 0
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 1
cmp dword [ebp - 0x18], 8
lea eax, [ebp - 0x2c]
push ecx
cmovae eax, dword [ebp - 0x2c]
push 0
push 0x2011f
push 0
push 0
push 0
push eax
push 0x80000001
mov dword [ebp - 0x48], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x45e2cd
mov esi, dword [ebp - 0x48]
mov dword [ebp - 0x48], esi
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x45e182
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x45e178
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x45e178
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.0056d673
add esp, 8
mov edx, dword [edi + 0xc]
xor eax, eax
mov ecx, edx
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], 7
lea edi, [ecx + 2]
mov word [ebp - 0x44], ax
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x45e1b0
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x44]
call fcn.0045e3d0
mov byte [ebp - 4], 4
lea eax, [ebp - 0x44]
cmp dword [ebp - 0x30], 8
cmovae eax, dword [ebp - 0x44]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x45e2e9
mov edx, dword [ebp - 0x30]
cmp edx, 8
jb 0x45e224
mov ecx, dword [ebp - 0x44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x45e21a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x45e21a
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.0056d673
add esp, 8
test esi, esi
je 0x45e277
cmp esi, 0x80000001
je 0x45e277
cmp esi, 0x80000002
je 0x45e277
cmp esi, 0x80000000
je 0x45e277
cmp esi, 0x80000005
je 0x45e277
cmp esi, 0x80000007
je 0x45e277
cmp esi, 0x80000004
je 0x45e277
cmp esi, 0x80000060
je 0x45e277
cmp esi, 0x80000050
je 0x45e277
cmp esi, 0x80000003
je 0x45e277
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x45e2b1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0056d0b2
mov esp, ebp
pop ebp
ret
push str.RegCreateKeyExW_failed.
push eax
lea ecx, [ebp - 0x68]
call fcn.0045d9a0
push 0x8e4948
lea eax, [ebp - 0x68]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
push str.RegDeleteValueW_failed.
push eax
lea ecx, [ebp - 0x7c]
call fcn.0045d9a0
push 0x8e4948
lea eax, [ebp - 0x7c]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3