Function at 0x455d94
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe54
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0xac], ebx
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x64], ecx
mov byte [ebp - 1], dl
mov dword [ebp - 8], eax
mov ecx, 0xa
lea eax, [ebp - 0x38]
mov edx, 0x40107c
call fcn.00403ac8
xor eax, eax
push ebp
push 0x456a19
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x456a34
call fcn.00454db4
lea eax, [ebp - 0x90]
call fcn.0042d87c
mov eax, dword [ebp - 0x90]
call fcn.00407454
mov byte [ebp - 0x65], 1
mov eax, dword [ebp - 8]
mov byte [eax + 0x18], 0
mov byte [ebp - 0x66], 0
xor eax, eax
mov dword [ebp - 0x6c], eax
xor eax, eax
mov dword [ebp - 0x70], eax
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x74], eax
mov dl, 1
mov eax, 0x450d68
call fcn.00402c78
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x4569c4
push dword fs:[edx]
mov dword fs:[edx], esp
mov dl, 1
mov eax, 0x450d68
call fcn.00402c78
mov dword [ebp - 0x6c], eax
mov dl, 1
mov eax, 0x450d68
call fcn.00402c78
mov dword [ebp - 0x70], eax
mov dl, 1
mov eax, 0x450d68
call fcn.00402c78
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x64], 0
je 0x455e7f
mov dl, 1
mov eax, 0x450d68
call fcn.00402c78
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x78], eax
mov ecx, eax
mov edx, dword [ebp - 0x78]
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp byte [ebp - 1], 0
je 0x45613d
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0
je 0x45613d
mov eax, dword [ebp - 0x7c]
cmp word [eax + 0x10], 0x80
jne 0x45612b
xor edx, edx
push ebp
push 0x4560e2
push dword fs:[edx]
mov dword fs:[edx], esp
push ebp
mov eax, dword [ebp - 0x7c]
call fcn.00455d40
pop ecx
cmp dword [ebp - 0x2c], 0
je 0x455ef1
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x6c]
call fcn.00453bc8
inc eax
jne 0x4560a3
mov ebx, 1
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax + 8]
test al, 8
je 0x455f07
mov ebx, 7
jmp 0x455f18
test al, 0x10
je 0x455f12
mov ebx, 3
jmp 0x455f18
test al, 0x40
je 0x455f18
xor ebx, ebx
test al, 4
jne 0x455fd8
mov edx, 0x456a64
lea eax, [ebp - 0x90]
call fcn.004035dc
lea eax, [ebp - 0x90]
mov edx, dword [ebp - 0x38]
call fcn.004036c4
mov eax, dword [ebp - 0x90]
call fcn.00454db4
mov eax, dword [ebp - 0x7c]
test byte [eax + 8], 0x20
je 0x455f5e
mov eax, dword [ebp - 0x38]
call fcn.0042cdb0
test al, al
je 0x455fc9
mov eax, dword [ebp - 0x7c]
mov esi, dword [eax + 8]
test esi, 1
sete al
push eax
test esi, 2
setne al
push eax
push ebx
push 0x45584c
lea eax, [ebp - 0x88]
push eax
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x38]
call fcn.0045245c
test al, al
jne 0x456090
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x98], eax
mov byte [ebp - 0x94], 0
lea edx, [ebp - 0x98]
xor ecx, ecx
mov eax, 0x456a84
call fcn.00454fa4
mov byte [ebp - 0x65], 0
jmp 0x456090
mov eax, 0x456aa8
call fcn.00454db4
jmp 0x456090
mov edx, 0x456ad0
lea eax, [ebp - 0x90]
call fcn.004035dc
lea eax, [ebp - 0x90]
mov edx, dword [ebp - 0x38]
call fcn.004036c4
mov eax, dword [ebp - 0x90]
call fcn.00454db4
mov eax, dword [ebp - 0x7c]
test byte [eax + 8], 0x20
je 0x456016
mov eax, dword [ebp - 0x38]
call fcn.0042cdd8
test al, al
je 0x456086
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x7c]
mov esi, dword [eax + 8]
and esi, 0x83
cmp esi, 0x80
sete al
push eax
cmp esi, 0x82
sete al
push eax
push ebx
push 0x45584c
lea eax, [ebp - 0x88]
push eax
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x38]
mov eax, 0x456af8
call fcn.004526ec
test al, al
jne 0x456090
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x98], eax
mov byte [ebp - 0x94], 0
lea edx, [ebp - 0x98]
xor ecx, ecx
mov eax, 0x456b08
call fcn.00454fa4
mov byte [ebp - 0x65], 0
jmp 0x456090
mov eax, 0x456b2c
call fcn.00454db4
cmp dword [ebp - 0x2c], 0
je 0x4560d8
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x6c]
call fcn.00453ad4
jmp 0x4560d8
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xa8], eax
mov byte [ebp - 0xa4], 0xb
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xa0], eax
mov byte [ebp - 0x9c], 0xb
lea edx, [ebp - 0xa8]
mov ecx, 1
mov eax, 0x456b5c
call fcn.00454fa4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x45610a
mov edx, dword [ebp - 0x7c]
mov eax, dword [ebp - 8]
call fcn.00455718
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x78]
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 8]
jmp 0x456133
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0
jne 0x455eb2
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0
je 0x4563ac
mov byte [ebp - 0x7d], 0
mov eax, dword [ebp - 0x7c]
cmp word [eax + 0x10], 0x82
jne 0x456373
mov byte [ebp - 0x7d], 1
xor eax, eax
push ebp
push 0x45634b
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
mov eax, dword [ebp - 0x7c]
call fcn.00455d40
pop ecx
cmp byte [ebp - 1], 0
jne 0x456192
mov eax, dword [ebp - 0x7c]
test byte [eax + 8], 1
jne 0x45633d
cmp byte [ebp - 1], 0
jne 0x45619e
cmp dword [ebp - 0x34], 0
jne 0x4561a2
xor eax, eax
jmp 0x4561a4
mov al, 1
mov byte [ebp - 0x7e], al
mov eax, dword [ebp - 0x7c]
test byte [eax + 8], 8
setne bl
test bl, bl
je 0x4561f4
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x98], eax
mov byte [ebp - 0x94], 0xb
lea edx, [ebp - 0x98]
xor ecx, ecx
mov eax, 0x456b8c
call fcn.00454fa4
mov eax, dword [ebp - 0x38]
call fcn.00451e44
mov byte [ebp - 0x7f], al
cmp byte [ebp - 0x7f], 0
je 0x4561f8
mov eax, 0x456bb4
call fcn.00454db4
jmp 0x4561f8
mov byte [ebp - 0x7f], 0
test bl, bl
je 0x456234
cmp byte [ebp - 0x7f], 0
je 0x456341
cmp byte [ebp - 0x7e], 0
jne 0x456234
mov eax, dword [ebp - 0x38]
call fcn.0042cdb0
test al, al
je 0x456234
mov eax, dword [ebp - 0x7c]
test byte [eax + 9], 2
jne 0x456234
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 4]
test al, al
je 0x456341
mov byte [ebp - 0x7d], 0
cmp byte [ebp - 0x7e], 0
jne 0x456305
mov eax, dword [ebp - 0x7c]
test byte [eax + 8], 0x10
je 0x4562c4
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x70]
call fcn.00453bc8
inc eax
jne 0x4562a2
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x98], eax
mov byte [ebp - 0x94], 0xb
lea edx, [ebp - 0x98]
xor ecx, ecx
mov eax, 0x456bd8
call fcn.00454fa4
mov dl, 1
mov eax, dword [ebp - 0x38]
call fcn.00453380
test al, al
je 0x456296
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x70]
call fcn.00453ad4
jmp 0x4562c4
mov eax, 0x456bfc
call fcn.00454db4
jmp 0x4562c4
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x98], eax
mov byte [ebp - 0x94], 0xb
lea edx, [ebp - 0x98]
xor ecx, ecx
mov eax, 0x456c1c
call fcn.00454fa4
mov eax, dword [ebp - 0x7c]
test byte [eax + 8], 0x40
je 0x456305
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x98], eax
mov byte [ebp - 0x94], 0xb
lea edx, [ebp - 0x98]
xor ecx, ecx
mov eax, 0x456c48
call fcn.00454fa4
mov eax, dword [ebp - 0x38]
call fcn.004541d8
test al, al
jne 0x456305
mov eax, 0x456bfc
call fcn.00454db4
mov eax, dword [ebp - 0x7c]
test byte [eax + 8], 4
je 0x456341
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x98], eax
mov byte [ebp - 0x94], 0xb
lea edx, [ebp - 0x98]
xor ecx, ecx
mov eax, 0x456c70
call fcn.00454fa4
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
call fcn.004534e8
jmp 0x456341
mov byte [ebp - 0x7d], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x456373
cmp byte [ebp - 0x7d], 0
je 0x45639a
mov edx, dword [ebp - 0x7c]
mov eax, dword [ebp - 8]
call fcn.00455718
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x78]
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 8]
jmp 0x4563a2
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0
jne 0x456150
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0
je 0x4568d1
push ebp
mov eax, dword [ebp - 0x7c]
call fcn.00455d40
pop ecx
xor edx, edx
push ebp
push 0x456880
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x7c]
mov bx, word [eax + 0x10]
movzx eax, bx
cmp eax, 0x85
jg 0x45643f
je 0x45667d
cmp eax, 0x81
jg 0x456421
je 0x4564bd
dec eax
je 0x456470
add eax, 0xfffffff1
sub eax, 2
jb case.0x45644d.140
sub eax, 0xe
je case.0x45644d.140
sub eax, 0x60
je case.0x45644d.140
jmp case.default.0x45644d
sub eax, 0x82
je 0x45654d
dec eax
je case.0x45644d.140
dec eax
je 0x45662d
jmp case.default.0x45644d
add eax, 0xffffff7a
cmp eax, 6
ja case.default.0x45644d
jmp dword [eax*4 + 0x456454]
mov edx, 0x456c90
lea eax, [ebp - 0xac]
call fcn.004035dc
lea eax, [ebp - 0xac]
mov edx, dword [ebp - 0x38]
call fcn.004036c4
mov edx, dword [ebp - 0xac]
lea ecx, [ebp - 0x90]
mov al, 0xb3
call fcn.0045096c
mov ecx, dword [ebp - 0x90]
mov dl, 1
mov eax, 0x406430
call fcn.00408dbc
call fcn.00403264
jmp case.0x45644d.140
cmp byte [ebp - 1], 0
jne 0x4564d0
mov eax, dword [ebp - 0x7c]
test byte [eax + 8], 1
jne case.0x45644d.140
mov eax, dword [ebp - 0x7c]
mov ebx, dword [eax + 8]
test bl, 8
setne al
push eax
push 0x455790
push 0x45579c
lea eax, [ebp - 0x74]
push eax
test bl, 4
setne cl
test bl, 2
setne dl
mov eax, dword [ebp - 0x38]
call fcn.004516f8
test al, al
je case.0x45644d.140
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax + 8]
test al, 2
je case.0x45644d.140
test al, 0x10
je case.0x45644d.140
push 0
mov eax, dword [ebp - 0x60]
push eax
push 1
push 0x10
call sub.shell32.dll_SHChangeNotify
lea edx, [ebp - 0x90]
mov eax, dword [ebp - 0x38]
call fcn.0042c92c
mov edx, dword [ebp - 0x90]
mov eax, dword [ebp - 0x10]
call fcn.00453b28
jmp case.0x45644d.140
lea eax, [ebp - 0x84]
mov edx, dword [ebp - 0x34]
call fcn.004035dc
cmp byte [ebp - 1], 0
jne 0x45656a
cmp dword [ebp - 0x84], 0
jne 0x456578
lea eax, [ebp - 0x84]
mov edx, dword [ebp - 0x38]
call fcn.004035dc
cmp byte [ebp - 1], 0
jne 0x456587
mov eax, dword [ebp - 0x7c]
test byte [eax + 8], 1
jne 0x4565d1
cmp byte [ebp - 1], 0
jne 0x45659a
mov eax, dword [ebp - 0x7c]
test byte [eax + 8], 2
jne case.0x45644d.140
push ebp
mov eax, dword [ebp - 0x7c]
mov ebx, dword [eax + 8]
test bh, 1
setne al
push eax
test bl, 0x80
setne cl
test bl, 0x20
setne dl
mov eax, dword [ebp - 0x84]
call fcn.004559b0
pop ecx
test al, al
jne case.0x45644d.140
mov byte [ebp - 0x65], 0
jmp case.0x45644d.140
mov eax, dword [ebp - 0x7c]
test byte [eax + 8], 8
je 0x4565e2
mov eax, dword [ebp - 0x38]
call fcn.00451e44
mov eax, dword [ebp - 0x84]
mov edx, dword [ebp - 0x38]
call fcn.004037cc
je case.0x45644d.140
push ebp
mov eax, dword [ebp - 0x7c]
mov ebx, dword [eax + 8]
test bh, 1
setne al
push eax
test bl, 0x80
setne cl
test bl, 0x20
setne dl
mov eax, dword [ebp - 0x84]
call fcn.004559b0
pop ecx
test al, al
jne case.0x45644d.140
mov byte [ebp - 0x65], 0
jmp case.0x45644d.140
lea eax, [ebp - 0x1ac]
mov ebx, dword [ebp - 0x60]
mov edx, ebx
call fcn.00402bb0
lea eax, [ebp - 0x1ac]
mov edx, 0x456ca0
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.004029f4
je 0x456669
push ebx
push 0
mov eax, dword [ebp - 0x58]
push eax
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_WritePrivateProfileStringA
jmp case.0x45644d.140
push 0
mov eax, dword [ebp - 0x58]
push eax
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_WriteProfileStringA
jmp case.0x45644d.140
mov eax, dword [ebp - 0x7c]
test byte [eax + 8], 1
je 0x456699
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 0x5c]
call fcn.004554b0
test al, al
je case.0x45644d.140
lea eax, [ebp - 0x1ac]
mov ebx, dword [ebp - 0x60]
mov edx, ebx
call fcn.00402bb0
lea eax, [ebp - 0x1ac]
mov edx, 0x456ca0
xor ecx, ecx
mov cl, byte [eax]
inc ecx
call fcn.004029f4
je 0x4566d3
push ebx
push 0
push 0
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_WritePrivateProfileStringA
jmp case.0x45644d.140
push 0
push 0
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_WriteProfileStringA
jmp case.0x45644d.140
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax + 8]
call fcn.0042dc68
test eax, eax
je case.0x45644d.140
sub eax, 2
je case.0x45644d.140
mov byte [ebp - 0x65], 0
jmp case.0x45644d.140
lea eax, [ebp - 0x8c]
push eax
push 2
push 0
mov eax, dword [ebp - 0x60]
push eax
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax + 8]
push eax
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne case.0x45644d.140
push 1
push 0x488a04
push 1
push 0
mov eax, dword [ebp - 0x5c]
push eax
mov eax, dword [ebp - 0x8c]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x456753
mov byte [ebp - 0x65], 0
mov eax, dword [ebp - 0x8c]
push eax
call sub.advapi32.dll_RegCloseKey
jmp case.0x45644d.140
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax + 8]
call fcn.0042dd9c
test eax, eax
je case.0x45644d.140
sub eax, 2
je case.0x45644d.140
sub eax, 0x8f
je case.0x45644d.140
mov byte [ebp - 0x65], 0
jmp case.0x45644d.140
lea eax, [ebp - 0x8c]
push eax
push 3
push 0
mov eax, dword [ebp - 0x60]
push eax
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax + 8]
push eax
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne case.0x45644d.140
mov edx, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x8c]
call fcn.0042dbe8
test al, al
je case.0x45644d.140
mov eax, dword [ebp - 0x5c]
push eax
mov eax, dword [ebp - 0x8c]
push eax
call sub.advapi32.dll_RegDeleteValueA
test eax, eax
je case.0x45644d.140
mov byte [ebp - 0x65], 0
jmp case.0x45644d.140
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x98], eax
mov byte [ebp - 0x94], 0xb
lea edx, [ebp - 0x98]
xor ecx, ecx
mov eax, 0x456b8c
call fcn.00454fa4
mov eax, dword [ebp - 0x38]
call fcn.00451e44
jmp case.0x45644d.140
mov byte [ebp - 0x66], 1
jmp case.0x45644d.140
lea eax, [ebp - 0xac]
push eax
movzx eax, bx
mov dword [ebp - 0x98], eax
mov byte [ebp - 0x94], 0
lea edx, [ebp - 0x98]
xor ecx, ecx
mov eax, 0x456cac
call fcn.00407ad4
mov edx, dword [ebp - 0xac]
lea ecx, [ebp - 0x90]
mov al, 0xb3
call fcn.0045096c
mov ecx, dword [ebp - 0x90]
mov dl, 1
mov eax, 0x406430
call fcn.00408dbc
call fcn.00403264
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4568a8
mov edx, dword [ebp - 0x7c]
mov eax, dword [ebp - 8]
call fcn.00455718
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0xc]
mov edx, dword [ebp - 0x78]
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 8]
cmp dword [ebp - 0x7c], 0
jne 0x4563bf
cmp byte [ebp - 0x66], 0
je 0x4568e7
push 0
push 0
push 0
push 0x8000000
call sub.shell32.dll_SHChangeNotify
mov eax, dword [ebp - 8]
test byte [eax + 0x19], 0x10
je 0x4568f5
call fcn.00453aa8
cmp dword [ebp - 0x64], 0
je 0x456930
call dword [ebp - 0x64]
mov eax, dword [ebp - 0x74]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x456930
inc ebx
xor esi, esi
lea ecx, [ebp - 0x90]
mov edx, esi
mov eax, dword [ebp - 0x74]
call fcn.00453bac
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0xc]
xor edx, edx
call fcn.00455194
inc esi
dec ebx
jne 0x45690c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4569ce
mov eax, dword [ebp - 0x74]
call fcn.00402ca0
mov eax, dword [ebp - 0xc]
call fcn.00402ca0
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x4569ab
inc ebx
xor esi, esi
lea ecx, [ebp - 0x90]
mov edx, esi
mov eax, dword [ebp - 0x10]
call fcn.00453bac
mov eax, dword [ebp - 0x90]
call fcn.0042cdc4
test al, al
je 0x4569a7
push 0
lea ecx, [ebp - 0x90]
mov edx, esi
mov eax, dword [ebp - 0x10]
call fcn.00453bac
mov eax, dword [ebp - 0x90]
call fcn.00403880
push eax
push 0x1001
push 0x1000
call sub.shell32.dll_SHChangeNotify
inc esi
dec ebx
jne 0x45695b
mov eax, dword [ebp - 0x70]
call fcn.00402ca0
mov eax, dword [ebp - 0x6c]
call fcn.00402ca0
mov eax, dword [ebp - 0x10]
call fcn.00402ca0
ret