Function at 0x453d8d
Capabilities:
Query or enumerate registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x6e8
mov eax, dword [0x46700c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x1f
pop ecx
mov esi, 0x421b88
lea edi, reloc.ADVAPI32.dll_TraceMessage
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x19
mov esi, 0x421c08
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop ecx
push 0x19
mov esi, 0x421c18
lea edi, reloc.ADVAPI32.dll_TraceMessage
rep movsd dword es:[edi], dword [esi]
pop ecx
movsw word es:[edi], word [esi]
push 0x18
mov esi, 0x421c80
lea edi, [ebp - 0x78]
rep movsd dword es:[edi], dword [esi]
pop ecx
push 0x1c
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, 0x421ce8
lea edi, [ebp - 0xd8]
rep movsd dword es:[edi], dword [esi]
pop ecx
push 0x21
mov esi, 0x421d48
lea edi, reloc.ADVAPI32.dll_TraceMessage
rep movsd dword es:[edi], dword [esi]
pop ecx
mov esi, 0x421db8
lea edi, reloc.ADVAPI32.dll_TraceMessage
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
push ecx
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push ecx
push 0xf003f
push ecx
push ecx
push ecx
lea eax, [ebp - 0xd8]
push eax
push 0x80000002
movsw word es:[edi], word [esi]
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], ecx
call ebx
mov esi, eax
test esi, esi
jne 0x453e62
mov ecx, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
push 3
push 0x10000000
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
call fcn.00453954
mov esi, eax
cmp dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x453e79
push dword [ebp - 0x6cc]
call edi
xor ecx, ecx
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], ecx
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], ecx
test esi, esi
jne 0x45412b
push ecx
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push ecx
push 0xf003f
push ecx
push ecx
push ecx
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x80000002
call ebx
mov esi, eax
test esi, esi
jne 0x4540f2
mov ecx, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
push 3
push 0x20019
lea eax, [ebp - 0x14]
push eax
call fcn.00453954
mov esi, eax
test esi, esi
jne 0x4540f2
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x109
push esi
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x80000002
call ebx
mov esi, eax
test esi, esi
jne 0x4540f2
push dword [ebp - 0x6d4]
push dword [ebp - 0x6d0]
call fcn.00453b74
mov esi, eax
test esi, esi
jne 0x4540f2
xor ecx, ecx
push ecx
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push ecx
push 0xf003f
push ecx
push ecx
push ecx
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x80000002
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], ecx
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
jne 0x4540c9
mov ecx, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
push eax
push 0x20019
lea eax, [ebp - 0x14]
push eax
call fcn.00453954
mov esi, eax
test esi, esi
jne 0x4540c9
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 0x109
push esi
lea eax, [ebp - 0x78]
push eax
push 0x80000002
call ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push 0x104
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], esi
push esi
jmp 0x4540ad
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
lea eax, reloc.ADVAPI32.dll_TraceMessage
xor esi, esi
push eax
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], esi
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], esi
call dword [sym.imp.ADVAPI32.dll_ConvertStringSidToSidW]
test eax, eax
je 0x454093
push dword [ebp - 0x6e0]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push esi
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push esi
push 0xf003f
push esi
push esi
push esi
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push dword [ebp - 0x6d8]
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x454082
mov ecx, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
push 3
push 0x2001f
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
call fcn.00453954
test eax, eax
jne 0x454082
push 0x104
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push esi
jmp 0x454076
push 4
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push 4
push 0
lea eax, reloc.ADVAPI32.dll_TraceMessage
push eax
push dword [ebp - 0x6dc]
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 2
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x104
lea eax, reloc.ADVAPI32.dll_TraceMessage
inc esi
push eax
push esi
push dword [ebp - 0x6d0]
call ebx
test eax, eax
je 0x45403e
cmp dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0
je 0x454093
push dword [ebp - 0x6dc]
call edi
mov eax, dword [ebp - reloc.ADVAPI32.dll_TraceMessage]
push 0x104
lea ecx, reloc.ADVAPI32.dll_TraceMessage
inc eax
push ecx
mov dword [ebp - reloc.ADVAPI32.dll_TraceMessage], eax
push eax
push dword [ebp - 0x6cc]
call ebx
mov esi, eax
test esi, esi
je 0x453fae
cmp esi, 0x103
jne 0x4540c9
xor esi, esi
cmp dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0
je 0x4540e1
push dword [ebp - 0x6d8]
call edi
and dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0
cmp dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0
je 0x4540f2
push dword [ebp - 0x6cc]
call edi
cmp dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0
je 0x45410a
push dword [ebp - 0x6d0]
call edi
and dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0
cmp dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0
je 0x454122
push dword [ebp - 0x6d4]
call edi
and dword [ebp - reloc.ADVAPI32.dll_TraceMessage], 0
test esi, esi
jne 0x45412b
xor eax, eax
inc eax
jmp 0x454134
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004655f1
leave
ret