Function at 0x45e7b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x49f170
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x4c9614]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0x1a4], 0
sete al
test al, al
jne 0x45ec6f
cmp dword [ebx + 0x1a8], 0
sete al
test al, al
jne 0x45ec6f
mov eax, dword [ebx + 0x1a8]
test eax, eax
jne 0x45e817
push 0x80004003
call fcn.0047e430
push 0
push 0x9c4
lea esi, [esp + 0x38]
call fcn.00414520
lea ecx, [esp + 0x14]
mov dword [esp + 0x50], 0
call fcn.0041bae0
mov byte [esp + 0x50], 2
mov eax, dword [esp + 0x30]
test eax, eax
je 0x45e84d
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov esi, dword [esp + 0x14]
test esi, esi
je 0x45e91d
push str.SB_RightMenu
mov al, 1
call fcn.00455000
add esp, 4
movzx eax, al
push eax
push 0x9c6
push ecx
mov eax, esp
mov dword [eax], esi
mov ecx, dword [esi]
mov edx, dword [ecx + 4]
mov dword [esp + 0x48], esp
push esi
call edx
call fcn.00415e90
add esp, 0xc
push str.SB_Mark_Proc
mov al, 1
call fcn.00455000
add esp, 4
movzx eax, al
push eax
push 0x9c7
push ecx
mov eax, esp
mov dword [eax], esi
mov ecx, dword [esi]
mov edx, dword [ecx + 4]
mov dword [esp + 0x48], esp
push esi
call edx
call fcn.00415e90
add esp, 0xc
push str.SB_TrojanTips
mov al, 1
call fcn.00455000
add esp, 4
movzx eax, al
push eax
push 0x9c8
push ecx
mov eax, esp
mov dword [eax], esi
mov ecx, dword [esi]
mov edx, dword [ecx + 4]
mov dword [esp + 0x48], esp
push esi
call edx
call fcn.00415e90
add esp, 0xc
push str.SB_B_TRAF
xor al, al
call fcn.00455000
add esp, 4
movzx eax, al
push eax
push 0x9c9
push ecx
mov eax, esp
mov dword [eax], esi
mov ecx, dword [esi]
mov edx, dword [ecx + 4]
mov dword [esp + 0x48], esp
push esi
call edx
call fcn.00415e90
add esp, 0xc
mov eax, dword [ebx + 0x1a8]
test eax, eax
jne 0x45e931
push 0x80004003
call fcn.0047e430
push 0
push 0xa28
lea esi, [esp + 0x34]
call fcn.00414520
lea ecx, [esp + 0x14]
mov byte [esp + 0x50], 3
call fcn.00413670
mov byte [esp + 0x50], 2
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x45e964
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov edi, dword [esp + 0x14]
test edi, edi
je 0x45ebdb
mov eax, 4
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x40]
push edx
push str.SB_Clear
push 0x4b3ff4
xor esi, esi
push reloc.OLEAUT32.dll_SysReAllocString
mov ebx, 2
mov byte [esp + 0x34], 1
mov byte [esp + 0x38], 1
mov byte [esp + 0x3c], 1
mov byte [esp + 0x40], 0
mov byte [esp + 0x44], 0
mov dword [esp + 0x30], esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov eax, dword [esp + 0x18]
cmp eax, esi
je 0x45e9e0
cmp eax, 1
jne 0x45e9d6
xor ebx, ebx
jmp 0x45e9e0
cmp eax, 2
jne 0x45e9e0
lea ebx, [eax - 1]
mov edi, edi
test byte [0x4d21d4], 1
jne 0x45ea02
or dword [0x4d21d4], 1
call fcn.00454be0
push 0x4a67a0
call fcn.0047edbf
add esp, 4
mov ecx, dword [0x4d2234]
xor eax, eax
test ecx, ecx
je 0x45ea1a
call ecx
cmp eax, 7
jl 0x45ea1a
mov eax, 7
cmp esi, eax
jge 0x45ea97
test byte [0x4d21d4], 1
jne 0x45ea40
or dword [0x4d21d4], 1
call fcn.00454be0
push 0x4a67a0
call fcn.0047edbf
add esp, 4
mov eax, dword [0x4d223c]
test eax, eax
je 0x45ea51
push esi
call eax
add esp, 4
jmp 0x45ea53
xor eax, eax
cmp eax, 1
sete al
cmp esi, 5
ja case.0x45ea5e.0
jmp dword [esi*4 + 0x45ec84]
mov byte [esp + 0x1c], al
inc esi
jmp 0x45e9e0
mov byte [esp + 0x20], al
inc esi
jmp 0x45e9e0
mov byte [esp + 0x24], al
inc esi
jmp 0x45e9e0
mov byte [esp + 0x28], al
inc esi
jmp 0x45e9e0
mov byte [esp + 0x2c], al
inc esi
jmp 0x45e9e0
push 0
lea esi, [esp + 0x40]
mov eax, edi
test ebx, ebx
jne 0x45eab4
push 0xa29
call fcn.00414520
mov byte [esp + 0x50], 4
jmp 0x45ead9
cmp ebx, 1
jne 0x45eaca
push 0xa2a
call fcn.00414520
mov byte [esp + 0x50], 5
jmp 0x45ead9
push 0xa2b
call fcn.00414520
mov byte [esp + 0x50], 6
push ecx
mov ecx, esp
mov dword [esp + 0x44], esp
call fcn.004136f0
call fcn.00415fd0
mov byte [esp + 0x54], 2
mov eax, dword [esp + 0x40]
add esp, 4
test eax, eax
je 0x45eb02
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
push 0xa2b
push ecx
mov eax, esp
mov dword [eax], edi
mov eax, dword [edi]
mov ecx, dword [eax + 4]
mov dword [esp + 0x48], esp
push edi
call ecx
call fcn.00416310
mov ecx, dword [ebp + 8]
add esp, 8
push eax
call fcn.0045e2f0
mov edx, dword [esp + 0x1c]
push edx
push 0xa2d
push ecx
mov eax, esp
mov dword [eax], edi
mov eax, dword [edi]
mov ecx, dword [eax + 4]
mov dword [esp + 0x4c], esp
push edi
call ecx
call fcn.00415e90
mov edx, dword [esp + 0x2c]
add esp, 0xc
push edx
push 0xa2e
push ecx
mov eax, esp
mov dword [eax], edi
mov eax, dword [edi]
mov ecx, dword [eax + 4]
mov dword [esp + 0x4c], esp
push edi
call ecx
call fcn.00415e90
mov edx, dword [esp + 0x30]
add esp, 0xc
push edx
push 0xa2f
push ecx
mov eax, esp
mov dword [eax], edi
mov eax, dword [edi]
mov ecx, dword [eax + 4]
mov dword [esp + 0x4c], esp
push edi
call ecx
call fcn.00415e90
mov edx, dword [esp + 0x34]
add esp, 0xc
push edx
push 0xa30
push ecx
mov eax, esp
mov dword [eax], edi
mov eax, dword [edi]
mov ecx, dword [eax + 4]
mov dword [esp + 0x4c], esp
push edi
call ecx
call fcn.00415e90
mov edx, dword [esp + 0x38]
add esp, 0xc
push edx
push 0xa31
push ecx
mov eax, esp
mov dword [eax], edi
mov eax, dword [edi]
mov ecx, dword [eax + 4]
mov dword [esp + 0x4c], esp
push edi
call ecx
call fcn.00415e90
mov ebx, dword [ebp + 8]
add esp, 0xc
test byte [0x4d21d4], 1
jne 0x45ebfd
or dword [0x4d21d4], 1
call fcn.00454be0
push 0x4a67a0
call fcn.0047edbf
add esp, 4
mov eax, dword [0x4d21e4]
cmp eax, 1
jne 0x45ec09
jmp 0x45ec4b
cmp eax, 2
je 0x45ec49
mov eax, dword [0x4d2230]
test eax, eax
je 0x45ec1b
call eax
jmp 0x45ec4b
push str.SB_State
mov al, 1
call fcn.00455000
add esp, 4
test al, al
je 0x45ec49
mov eax, dword [0x4d21f4]
test eax, eax
je 0x45ec49
push 1
call eax
add esp, 4
test eax, eax
jne 0x45ec49
mov eax, 1
jmp 0x45ec4b
xor eax, eax
cmp eax, 1
sete dl
movzx eax, dl
push eax
push ebx
call fcn.0045e470
mov dword [esp + 0x50], 0xffffffff
test edi, edi
je 0x45ec6f
mov ecx, dword [edi]
mov edx, dword [ecx + 8]
push edi
call edx
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4