Function at 0x45608f
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
xor esi, esi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp + 8]
lea ebx, [ebp - 0x20]
mov dword [ebp - 0x24], esi
mov edi, esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], esi
call fcn.00455fa4
mov ebx, dword [ebp - 0x20]
cmp dword [ebp - 0x14], esi
je 0x4563f2
cmp dword [ebp - 0xc], esi
je 0x4563f2
push esi
lea eax, [ebp - 8]
push eax
push esi
push 3
push esi
push esi
push esi
push dword [ebp - 0xc]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
test edi, edi
jne 0x4563f2
cmp dword [ebp + 0x10], esi
je 0x456463
test ebx, ebx
jne 0x456132
cmp dword [ebp - 0x10], esi
jne 0x456132
push 2
pop eax
push eax
push 0x401424
jmp 0x456200
mov esi, dword [ebp - 0x1c]
mov eax, esi
shr eax, 1
not eax
and eax, 1
jne 0x456158
push eax
push eax
push eax
push eax
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4563e7
mov eax, 0x10003
cmp esi, eax
ja 0x4561b8
je 0x45617f
mov eax, esi
dec eax
je 0x4561a0
push 2
pop ecx
sub eax, ecx
je 0x4561a0
sub eax, 5
je 0x456207
sub eax, 0xfff9
jne 0x4561d7
test ebx, ebx
je 0x4563e7
mov esi, ebx
call fcn.00440984
mov dword [ebp + 8], eax
push 4
lea eax, [ebp + 8]
push eax
push 4
xor esi, esi
jmp 0x456452
xor esi, esi
cmp dword [ebp - 0x10], esi
je 0x4563e9
push dword [ebp - 0x18]
push dword [ebp - 0x10]
push 3
jmp 0x456452
mov eax, esi
sub eax, 0x20000
je 0x45642c
push 2
pop ecx
sub eax, ecx
je 0x45642c
sub eax, 0x20006
je 0x456207
xor esi, esi
test ebx, ebx
je 0x4563e9
mov ecx, ebx
push 2
lea edx, [ecx + 2]
pop edi
mov ax, word [ecx]
add ecx, edi
cmp ax, si
jne 0x4561e9
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push ebx
push 1
jmp 0x456452
test ebx, ebx
je 0x4563e7
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], 7
test esi, 0x40000
je 0x456361
lea eax, [ebp - 0x18]
push eax
xor esi, esi
push esi
lea eax, [ebp - 0x1c]
push eax
push esi
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x456363
cmp dword [ebp - 0x1c], 7
jne 0x456363
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x456256
mov eax, dword [ebp - 0x18]
sub ecx, edx
sar ecx, 1
shr eax, 1
add eax, 3
add eax, ecx
xor ecx, ecx
push 2
pop edx
mov dword [ebp + 8], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new___unsigned_int_]
mov esi, eax
pop ecx
mov dword [ebp - 0x28], esi
test esi, esi
jne 0x456299
push EventRegister
pop edi
jmp 0x456361
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0x1c]
push eax
xor eax, eax
push eax
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x456351
cmp ax, word [esi]
mov edx, esi
jmp 0x4562f5
push ebx
push edx
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x45632d
mov edx, dword [ebp - 0x20]
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x20], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x24]
jne 0x4562d9
sub ecx, dword [ebp - 0x20]
xor eax, eax
sar ecx, 1
lea edx, [edx + ecx*2]
add edx, 2
cmp ax, word [edx]
mov dword [ebp - 0x20], edx
jne 0x4562c0
mov eax, dword [ebp + 8]
mov esi, dword [ebp - 0x20]
dec eax
mov edx, ebx
call fcn.0042c88c
test eax, eax
js 0x45634c
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x24]
jne 0x456311
sub ecx, edx
sar ecx, 1
xor eax, eax
mov word [esi + ecx*2 + 2], ax
mov esi, dword [ebp - 0x28]
jmp 0x45635d
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x24]
jne 0x456332
sub ecx, edx
sar ecx, 1
or eax, reloc.ADVAPI32.dll_TraceMessage
sub eax, ecx
add dword [ebp + 8], eax
jmp 0x45635d
push dword [ebp - 0x28]
jmp 0x456352
push esi
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
xor eax, eax
mov esi, eax
pop ecx
test esi, esi
jne 0x4563c1
xor esi, esi
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x456368
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 2]
xor ecx, ecx
push 2
pop edx
mov dword [ebp + 8], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new___unsigned_int_]
mov esi, eax
pop ecx
test esi, esi
je 0x4563e7
mov eax, dword [ebp + 8]
dec eax
mov edx, ebx
call fcn.0042c88c
mov ecx, esi
lea edx, [ecx + 2]
xor edi, edi
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x4563ab
sub ecx, edx
sar ecx, 1
xor eax, eax
mov word [esi + ecx*2 + 2], ax
mov eax, dword [ebp + 8]
add eax, eax
push eax
push esi
push 7
xor eax, eax
push eax
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test esi, esi
je 0x4563e7
push esi
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
xor esi, esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp + 0x10], 0
jne 0x456417
cmp dword [ebp - 4], 0
jne 0x456417
test ebx, ebx
jne 0x456417
cmp dword [ebp - 0xc], ebx
je 0x456417
cmp dword [ebp - 0x14], ebx
je 0x456417
push dword [ebp - 0xc]
push dword [ebp - 0x14]
call fcn.0044435d
test edi, edi
je 0x456494
cmp dword [ebp + 0x10], 0
jne 0x456476
push 2
pop eax
cmp edi, eax
jne 0x456476
mov edi, esi
jmp 0x45649f
test ebx, ebx
je 0x4563e7
mov ecx, ebx
push 2
lea edx, [ecx + 2]
xor esi, esi
pop edi
mov ax, word [ecx]
add ecx, edi
cmp ax, si
jne 0x45643a
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push ebx
push edi
push esi
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
jmp 0x4563e9
cmp dword [ebp - 4], esi
je 0x4563e9
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x45645f
push edi
push 0x4226e4
push 2
pop esi
call fcn.00440126
push dword [ebp + 0xc]
push 0x4226b0
call fcn.00440126
add esp, 0x10
cmp dword [ebp + 0x10], 0
mov eax, 0x404b5c
jne 0x4564a4
mov eax, 0x404bc0
push edi
push dword [ebp + 0xc]
push eax
push 0x422718
push 4
pop esi
call fcn.00440126
add esp, 0x10
cmp dword [ebp - 0x10], 0
je 0x4564c9
push dword [ebp - 0x10]
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void__]
pop ecx
cmp dword [ebp - 0xc], 0
je 0x4564d9
push dword [ebp - 0xc]
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
cmp dword [ebp - 4], 0
je 0x4564e9
push dword [ebp - 4]
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
test ebx, ebx
je 0x4564f5
push ebx
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
test edi, edi
jle 0x456505
and edi, 0xffff
or edi, 0x80070000
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0xc