Function at 0x445000
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
mov ecx, 0
mov eax, ecx
xor edx, edx
push edx
mov eax, 0
mov edx, eax
push edx
mov ecx, 0
push ecx
mov ebx, 0
push ebx
xor edx, edx
push edx
mov dword [0x5536ea], 0
mov ecx, dword [0x5536ea]
push ecx
call dword [sym.imp.USER32.DLL_CreateDesktopA]
mov dword [0x553458], eax
xor eax, eax
mov ecx, 0
mov ebx, ecx
push ebx
mov ecx, 0
push ecx
xor ecx, ecx
push ecx
xor ecx, ecx
push ecx
xor ebx, ebx
push ebx
mov dword [0x553529], 0
mov ecx, dword [0x553529]
push ecx
call dword [sym.imp.USER32.DLL_CreateDesktopA]
mov dword [0x5536ca], eax
mov dword [0x5535a2], 0
mov eax, dword [0x5535a2]
lea edx, [esi + 0x96]
add edx, 0xf6
add edx, 0xd30
je 0x4450a1
add edx, 0x53b
sub edx, dword [0x5538eb]
mov eax, 0x923
add edx, eax
or edx, dword [0x553150]
jne 0x4450c0
rol edx, 1
add edx, 0x245
mov eax, 0x22aa
imul edx, eax, 6
add dword [0x5535ce], edx
mov eax, 0
dec eax
test eax, 0x145a
je 0x4450df
and eax, 0xfff
mov edx, 0xd61
add eax, edx
add dword [0x55333f], eax
mov edx, 0x5e
sub edx, 0x88797ea8
jne 0x44618f
mov dword [0x5535ce], eax
mov ebx, 0
shr ebx, 2
test dword [0x5533c3], ebx
je 0x445117
shr ebx, 1
ror ebx, 3
mov edi, 0x116f
or ebx, edi
add ebx, dword [0x553712]
cmp ebx, 0xd72
jne 0x445138
sub ebx, 0x9d2
add ebx, dword [0x553587]
mov esi, 0x145a
add ebx, esi
sub dword [0x55396d], ebx
mov edx, 0xae9
mov esi, 0x21ec
xor esi, edx
push edx
pop dword [0x5538f8]
add dword [0x55346d], edx
leave
ret
or edi, 0x78
add esi, edi
mov edx, 0
sub edx, dword [0x55340c]
or edx, dword [0x553259]
je 0x44518b
mov ebx, 0x1941
or edx, ebx
mov dword [0x55359f], edx
push eax
call 0x44516c
add esi, 1
xor esi, ebp
inc edi
push 0x25
push 0x34
push 0x4b
push 3
push 0x4f
push 9
push 0x3f
push 2
push 0xe
push 0x3d
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x100
pop edx
mov edi, 0x185
imul edx, edi, 0x13
or edx, 0x1f8c
jne 0x4451e8
rol edx, 4
mov edi, 0x2649
or edx, edi
add dword [0x553876], edx
loop 0x445228
in eax, dx
stosb byte es:[edi], al
pop edx
push esi
cmp al, 0xe9
sal byte [edi + 0x45912503], 0xfe
dec esi
sbb al, 0x4f
or eax, 0x65f43bfe
sbb dh, byte [esi - 0x74cda69e]
fadd dword [ebx]
inc byte [eax - 0x75]
add esi, dword [0x55322d]
mov ebx, eax
add edi, esi
inc eax
mov esi, ebx
add esi, dword [0x55322d]
add esi, 0x94
je 0x44522b
sub esi, dword [0x553168]
sub esi, 0x2b2
add al, byte [eax]
add byte [ecx], al
xor eax, 0x5535b8
add dword [0x5535b8], esi
lea ecx, [esi + 0x8e]
mov edx, 0xcb9
or ecx, edx
or ecx, dword [0x553296]
jne 0x44524c
push es
sub ecx, 0xc83
and ecx, 0xffffff
test dword [0x5530ee], ecx
je 0x445269
dec ecx
mov esi, 0xc5b
or ecx, esi
mov edi, 0x26d4
xor edi, ecx
sub dword [0x553779], ecx
mov dword [ecx + 0x3d08ce8c], esi
dec ecx
dec esp
mov byte [0xbc9a015c], al
loop 0x4452e2
in eax, dx
push 0x2e
dec esi
pop eax
cmp byte [edx], cl
adc al, 0xf9
int 0x93
jno 0x445245
mov ecx, 0x4f
dec edi
add byte [eax], al
add byte [ecx + 0x1ef], al
add byte [eax + 0xd8], bh
sub edi, 1
mov eax, 0xd8
mov eax, ebx
inc edx
push 0x69
push 0x4e
push 0x25
push 0x54
push 0x48
push 0x50
push 0x7b
push 0x4d
push 0x3a
push 5
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov edi, 0
add edi, 0xa7c
add edi, 0xdd6
jne 0x4452e2
ror edi, 5
shr edi, 2
rol edi, 3
add edi, dword [str.ZHBP]
or edi, dword [0x5530de]
jne 0x4452f3
shr edi, 3
mov esi, 0x2548
or edi, esi
push edi
pop dword [0x5531ae]
add dword [0x55302c], edi
leave
ret
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
push esi
mov esi, 0x736
shr esi, 6
test esi, 0x2160
je 0x4461af
mov ebx, 0x1b3a
imul esi, ebx, 0x32
and esi, 0xfffff
add esi, 0xc21
jne 0x4461cb
mov edi, 0x7d5
or esi, edi
inc esi
add esi, 0xb0a
mov dword [ebp - 4], esi
push 0
push 0xf003f
push 0
push 0
push 0x80000002
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
lea eax, [ebx + 0x83]
add eax, 0xbd3
test eax, 0x30b
je 0x4461fe
mov ebx, 0x2258
add eax, ebx
mov edi, 0x4e8
xor edi, eax
cmp eax, 0xf60
je 0x446216
mov ebx, 0x420
sub eax, ebx
shl eax, 8
sub eax, 0x74e
test dword [0x553709], eax
jne 0x446238
mov ecx, 0x12a5
or eax, ecx
sub eax, 0x724
mov ecx, 0x821
add eax, ecx
sub dword [0x553843], eax
push 0
call dword [sym.imp.USER32.DLL_GetDC]
push 0x553164
lea eax, [0x5530dd]
push eax
add ecx, 1
mov ecx, 0x71
add eax, ebx
lea eax, [0x5538a6]
push eax
push 0x55360e
add ecx, esi
mov edi, esi
push dword [0x553539]
call fcn.00445320
ror eax, 8
sub eax, 0x4c8
jne 0x44628c
mov ebx, 0x21c9
imul eax, ebx, 0x59
mov esi, 0x24a1
add eax, esi
sub eax, 0xb0e
je 0x4462a9
and eax, 0xffff
mov ebx, 0xccb
xor ebx, eax
shl eax, 3
add dword [str._P_0], eax
push 0x553592
call fcn.0044557d
mov dword [ebp - 0xc], 0
mov ebx, dword [ebp - 0xc]
push ebx
mov edx, 0xcd
mov ebx, edx
push ebx
mov ecx, 9
mov ebx, ecx
push ebx
call dword [sym.imp.gdi32.dll_GetEnhMetaFileDescriptionA]
inc eax
jne 0x44520c
push 0x77c
pop edi
mov esi, 0x1d9e
sub edi, esi
or dword [ebp - 4], edi
je 0x446303
shr edi, 2
sub edi, 0x93
mov eax, 0xcd1
sub edi, eax
sub dword [0x55378a], edi
push 0xdafd598
pop edx
push edx
push 0x51629e6b
pop edi
push edi
mov edx, 0x30a97f85
push edx
xor edx, edx
push edx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.SHELL32.DLL_SHGetDataFromIDListA]
or eax, eax
je 0x44516c
lea ebx, [0xab]
dec eax
cwde
lea eax, [0x55314c]
push eax
call fcn.004456df
mov esi, 0x14
mov ecx, esi
push ecx
mov dword [ebp - 0x1c], 7
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.USER32.DLL_GetClassLongW]
shl eax, 3
or dword [ebp - 0x14], eax
je 0x446376
mov esi, 0x7e2
imul eax, esi, 0xb
sub dword [0x553256], eax
mov edx, 0x39
mov ebx, edx
push ebx
mov dword [ebp - 0x10], 0xec
mov esi, dword [ebp - 0x10]
push esi
call dword [sym.imp.gdi32.dll_SetBkMode]
or eax, eax
jne 0x44520a
ror eax, 1
or eax, dword [0x5534a5]
jne 0x4463ad
add eax, dword [0x553067]
ror eax, 8
or eax, dword [0x55337c]
jne 0x4463c5
add eax, 0x41a
mov ebx, 0x699
xor ebx, eax
rol eax, 1
or eax, 0xde5
je 0x4463d8
mov ebx, 0x1cea
xor ebx, eax
shr eax, 6
sub dword [0x553498], eax
push 0x4df9
mov dword [ebp - 0x14], esi
inc edi
add ebx, edi
mov edi, 0xdf
dec ebx
push dword [0x55393d]
push dword [0x5530cf]
push dword [0x5536b5]
push 0x5537b8
push ebx
call fcn.004454a0
test al, al
je 0x446417
mov esi, 0xe1
inc ebx
inc esi
mov dword [ebp - 0x14], eax
mov edx, 7
push edx
call dword [sym.imp.USER32.DLL_GetDC]
or eax, eax
jne 0x44529d
shl eax, 4
sub eax, 0x989
je 0x44643f
mov esi, 0x13a
add eax, esi
mov dword [0x5534dd], eax
push 0xfded
push edi
push 0
push 0x1737
push 0x6a19
push 0
call fcn.004454a0
inc eax
push eax
pop dword [0x55363b]
mov dword [0x5534c2], eax
mov esi, 0x525f46
mov ebx, 0x2d285
add esi, ebx
push esi
xor esi, esi
push esi
call dword [sym.imp.advapi32.dll_RegDeleteValueW]
or eax, eax
je 0x44520e
lea ebx, [edi + 0x9f]
ror ebx, 1
cmp ebx, 0x553
jne 0x4464a4
ror ebx, 5
mov esi, 0x30d
imul ebx, esi, 0x34
inc ebx
sub dword [0x553652], ebx
mov ebx, 0x378697
mov esi, 0x1daf05
add ebx, esi
push ebx
call dword [sym.imp.kernel32.dll_LoadLibraryA]
or eax, eax
jne 0x44528b
mov esi, 5
xor esi, eax
push eax
pop dword [0x55314d]
mov dword [0x55325e], eax
call fcn.0044562d
or al, al
jne 0x4464ea
add esi, eax
xor eax, edi
or ebx, 0x69
sub ebx, eax
push pe_nt_image_headers32
pop edi
push edi
mov dword [ebp - 8], 0xdd
mov eax, dword [ebp - 8]
push eax
mov dword [0x5534f3], 0
mov edi, dword [0x5534f3]
push edi
xor esi, esi
push esi
mov esi, 3
mov ebx, esi
push ebx
call dword [sym.imp.gdi32.dll_EnumFontFamiliesExW]
or eax, eax
jne 0x44529d
push esi
push eax
call fcn.00445410
lea edi, [eax + edi*4 + 0xdd1]
mov esi, 0xca4
imul edi, esi, 0x52
test edi, 0x13d0
jne 0x446557
sub edi, dword [0x5531eb]
sub edi, 0x437
mov esi, 0x1955
sub edi, esi
sub dword [0x553487], edi
push 0xc5a1
push ebx
push dword [str._tXY_]
push 0
push 0x553720
push edi
call fcn.004454a0
test al, al
jne 0x446581
mov edi, esi
sub eax, esi
mov dword [ebp - 0x1c], edi
mov dword [0x553756], eax
mov edx, 0xa4
push edx
mov edx, 1
push edx
mov dword [ebp - 0x18], 0xf2
mov ecx, dword [ebp - 0x18]
push ecx
xor edx, edx
push edx
call dword [sym.imp.gdi32.dll_SetPixel]
mov esi, eax
sub esi, dword [0x5535df]
push esi
pop dword [0x5533e4]
add dword [0x553740], esi
push 0
call fcn.0044557d
test al, al
je 0x4465cf
lea edi, [esi + 0xa]
inc esi
dec esi
cdq
mov edx, 0x65c31a8b
push edx
mov ebx, 0x47ca6c
mov edi, ebx
mov dword [0x5537b1], 0xd6915
add edi, dword [0x5537b1]
push edi
mov dword [ebp - 0x14], 0x503749
mov edx, dword [ebp - 0x14]
add edx, 0x4f923
push edx
mov edx, 0
mov eax, edx
push eax
push 0x39d254
pop edi
add edi, 0x1b640a
push edi
mov edx, 0x4e4742
mov dword [ebp - 0x14], 0x6eae5
add edx, dword [ebp - 0x14]
push edx
mov eax, 0x5e
push eax
mov edi, 0
push edi
call dword [sym.imp.advapi32.dll_RegEnumValueA]
or eax, eax
je 0x44528b
rol eax, 1
or eax, dword [str.AH_ba_b]
jne 0x446651
mov ebx, 0xc46
add eax, ebx
shr eax, 3
sub eax, dword [0x5537df]
test dword [ebp - 8], eax
je 0x44666c
mov edi, 0x909
xor edi, eax
shr eax, 1
mov esi, 0x11a4
xor esi, eax
mov dword [ebp - 0xc], eax
mov edx, 0xf5574ff
push edx
mov dword [ebp - 0x18], 0x1b8a4d9c
mov edi, dword [ebp - 0x18]
push edi
mov edx, 0x4ae91918
mov esi, edx
push esi
mov dword [0x553233], 0
mov eax, dword [0x553233]
push eax
mov edx, 0
mov ecx, edx
push ecx
call dword [sym.imp.SHELL32.DLL_SHGetDataFromIDListA]
or eax, eax
je 0x44516c
push 0
push dword [0x55307a]
push dword [0x553611]
mov edi, 0x1235e
add edi, 0x43390d
call edi
test eax, eax
je 0x445290
mov ebx, eax
lea eax, [0x5535a8]
push eax
lea eax, [0x553769]
push eax
call fcn.0044546d
mov dword [ebp - 0x10], 0x47870b3f
mov edx, dword [ebp - 0x10]
push edx
mov edx, 0x54a9ac
mov edi, edx
mov dword [str._v___], 0x8c2d
add edi, dword [str._v___]
push edi
mov edx, 0x354247
mov dword [0x5534a8], 0x1feef9
add edx, dword [0x5534a8]
push edx
push 0
pop edx
push edx
mov edx, 0x251133
mov edi, edx
mov edx, 0x302140
add edi, edx
push edi
push 0x4a23de
pop esi
mov eax, 0xb1066
add esi, eax
push esi
mov dword [ebp - 8], 0x3b
mov edx, dword [ebp - 8]
push edx
mov dword [0x553838], 0
mov edx, dword [0x553838]
push edx
call dword [sym.imp.advapi32.dll_RegEnumValueA]
or eax, eax
je 0x44516f
mov esi, 0x226d
sub eax, esi
or eax, dword [0x5533b3]
je 0x44678b
and eax, 0xffff
mov esi, 0x1eef
add eax, esi
shr eax, 2
mov dword [0x55312f], eax
push 0x4d763132
pop edi
push edi
mov esi, 0x646c41d9
push esi
push 0x4584404
pop esi
push esi
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 4]
push ecx
push 0
pop ecx
push ecx
call dword [sym.imp.SHELL32.DLL_SHGetDataFromIDListA]
or eax, eax
je 0x44516f
push 0x35c
pop eax
sub eax, 0x8bd
or eax, dword [0x553098]
je 0x4467de
and eax, 0xfff
inc eax
mov dword [0x553552], eax
push 0x553884
push dword [0x5530d5]
call fcn.0044546d
push 3
pop eax
push eax
call dword [sym.imp.gdi32.dll_WidenPath]
or eax, eax
jne 0x44529d
lea eax, [0x55370d]
push eax
push 0xcf09
mov edi, esi
add edi, esi
push dword [0x553307]
lea eax, [0x553002]
push eax
mov eax, 0xe1
add esi, ebx
add eax, edi
mov ecx, edi
xor edi, ebp
mov edi, 0x36
inc edi
inc esi
lea eax, [0x553106]
push eax
push dword [0x5538ac]
call fcn.004454a0
or al, al
je 0x446857
sub esi, eax
mov dword [ebp - 4], ebx
mov esi, ecx
dec eax
mov esi, 0x45
push esi
mov esi, 0xad
push esi
mov edx, 0xd7
mov ecx, edx
push ecx
mov edx, 0xe9
mov esi, edx
push esi
call dword [sym.imp.gdi32.dll_CreateRectRgn]
lea eax, [0x553531]
push eax
call fcn.004456df
mov dword [0x5530e4], eax
mov ecx, 0x5b
push ecx
mov dword [0x55387e], 0
mov edx, dword [0x55387e]
push edx
mov edx, 0xe
push edx
mov dword [0x553342], 0
mov ecx, dword [0x553342]
push ecx
xor eax, eax
push eax
mov ecx, 0xc00
mov eax, ecx
push eax
call dword [sym.imp.kernel32.dll_CompareStringA]
or eax, eax
jne 0x44529d
push dword [0x553944]
call fcn.0044557d
ror eax, 5
test dword [ebp - 0x10], eax
jne 0x4468eb
dec eax
sub eax, dword [0x5534a7]
add dword [0x55321d], eax
mov eax, 0x53e7ff
mov esi, eax
add esi, 0x14a64
push esi
call dword [sym.imp.gdi32.dll_GetEnhMetaFileW]
or eax, eax
jne 0x44520e
push dword [0x5536f8]
call fcn.00445676
mov dword [0x5531cb], eax
mov eax, 1
push eax
call dword [sym.imp.gdi32.dll_UpdateColors]
or eax, eax
jne 0x44519f
inc eax
test eax, 0x4dc
je 0x446940
mov edi, 0x726
or eax, edi
mov esi, 0x10b2
sub eax, esi
push eax
shr eax, 4
test dword [ebp - 0x18], eax
jne 0x446964
sub eax, dword [0x55328f]
mov edi, 0x1a9b
sub eax, edi
mov esi, 0x1c8c
add eax, esi
pop dword [0x553245]
mov dword [0x5532f7], eax
push 0
push 0x55385d
push 0x55324f
push dword [0x55320c]
push dword [0x553020]
mov ecx, 0x2268b5c6
sub ecx, 0x22245e21
call ecx
push esi
push edi
xor ecx, ecx
mov eax, 0x19e8
imul ecx, eax, 0x31
cmp ecx, 0x26
je 0x4469ab
shl ecx, 2
shr ecx, 4
or ecx, 0xa60
jne 0x4469c3
mov edi, 0x1d06
or ecx, edi
and ecx, 0xff
add dword [0x553063], ecx
mov dword [ebp - 0x1c], ecx
mov eax, esi
sub eax, esi
lea eax, [0x5532cd]
push eax
push 0x55392d
push dword [0x5533fc]
push edi
xor esi, dword [0x56239a]
add eax, ebx
push dword [0x553510]
call fcn.00445368
push 0
push 0x6a68
push 0
call fcn.00445547
lea eax, [0x55325a]
push eax
push 0x48a5
lea eax, [0x553257]
push eax
call fcn.004453a8
mov ebx, 0x5c9
add ebx, dword [0x55354a]
or ebx, dword [0x5534e3]
jne 0x446a35
add ebx, dword [0x553871]
sub dword [0x5532ae], ebx
call fcn.0044562d
add eax, dword [0x5536fd]
push eax
sub eax, dword [0x553211]
add eax, 0xebf
jne 0x446a5c
dec eax
mov edi, 0x880
add eax, edi
add eax, 0x7cf
test eax, 0x1fd3
jne 0x446a77
sub eax, dword [0x5536f7]
mov ebx, 0x1054
imul eax, ebx, 0x12
pop dword [0x5538b6]
add dword [0x55382d], eax
push dword [0x55312a]
sub eax, edi
dec edi
add esi, 1
push esi
call fcn.0044546d
shl eax, 8
push eax
pop dword [0x5533fa]
mov dword [ebp - 0x10], eax
ret