Function at 0x4515ea
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x46700c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x421044
push 3
pop esi
xor edi, edi
push esi
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], edi
call fcn.004400fc
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x451624
push ebx
call fcn.0045121a
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 1
push edi
push 0x401478
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 4
pop ecx
test eax, eax
jne 0x451755
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push edi
push 0x421070
push dword [ebp - 0x214]
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], edi
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], ecx
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4516ec
cmp dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 1
jne 0x4516ec
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push edi
push 0x4210a8
push dword [ebp - 0x214]
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4516ec
cmp dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 1
jne 0x4516ec
push ebx
lea eax, reloc.ADVAPI32.dll_TraceMessage
call fcn.00451316
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x4210dc
call fcn.00440126
pop ecx
pop ecx
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push edi
push 0x401f14
push dword [ebp - 0x214]
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x451749
cmp dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 1
jne 0x451749
push ebx
lea eax, reloc.ADVAPI32.dll_TraceMessage
call fcn.00451402
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x4210fc
call fcn.00440126
pop ecx
pop ecx
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 1
push edi
push 0x401478
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x451822
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push edi
push 0x42111c
push dword [ebp - 0x214]
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 4
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x451816
cmp dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 1
jne 0x451816
mov ecx, 0x401424
lea eax, reloc.ADVAPI32.dll_TraceMessage
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4517ee
test dx, dx
je 0x4517f3
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4517ee
add eax, 4
add ecx, 4
test dx, dx
jne 0x4517ca
jmp 0x4517f3
sbb edi, edi
sbb edi, reloc.ADVAPI32.dll_TraceMessage
test edi, edi
je 0x451816
push ebx
lea eax, reloc.ADVAPI32.dll_TraceMessage
call fcn.004514fe
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x421148
call fcn.00440126
pop ecx
pop ecx
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004655f1
leave
ret