Function at 0x455d80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x5c7004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0
push 0x5c9e40
push 0xfffffffffffffff7
push 0x20019
lea eax, [ebp - 8]
mov byte [0x5cde50], 0
push eax
call sym.ProcessHacker.exe_PhOpenKey
test eax, eax
js 0x45608f
push 0x50
push 4
push dword [0x5cd55c]
xor ebx, ebx
mov dword [ebp - 0x18], 0x14
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
push 0x100
push 4
push dword [0x5cd55c]
mov dword [ebp - 0x14], eax
xor esi, esi
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x10], 0x100
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
push edi
push 1
push esi
push dword [ebp - 0xc]
call dword [sym.imp.ntdll.dll_NtEnumerateValueKey]
cmp eax, 0x8000001a
je 0x455f2b
jmp 0x455e20
cmp eax, 0x80000005
je 0x455e2e
cmp eax, 0xc0000023
jne 0x455e66
push edi
push 0
push dword [0x5cd55c]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword [ebp - 0x10]
push 4
push dword [0x5cd55c]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x10]
push edi
push 1
push esi
push dword [ebp - 0xc]
call dword [sym.imp.ntdll.dll_NtEnumerateValueKey]
test eax, eax
js 0x455f2b
cmp dword [edi + 4], 1
jne 0x455f02
cmp dword [edi + 0xc], 2
jbe 0x455eca
lfence
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 8]
push dword [0x5cd4f8]
mov dword [ebp - 0x24], eax
add ecx, edi
add eax, 0xa
mov dword [ebp - 0x20], ecx
push eax
call sym.ProcessHacker.exe_PhCreateObject
mov ecx, dword [ebp - 0x24]
mov esi, eax
lea eax, [esi + 8]
xor edx, edx
mov dword [esi + 4], eax
mov dword [esi], ecx
mov word [eax + ecx], dx
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x455ed1
push ecx
push eax
lfence
push dword [esi + 4]
call fcn.00537fe0
add esp, 0xc
jmp 0x455ed1
call sym.ProcessHacker.exe_PhReferenceEmptyString
mov esi, eax
mov eax, dword [ebp - 0x18]
cmp ebx, eax
jne 0x455ef8
add eax, eax
mov dword [ebp - 0x18], eax
shl eax, 2
push eax
mov eax, dword [ebp - 0x14]
push eax
push 4
push dword [0x5cd55c]
call dword [sym.imp.ntdll.dll_RtlReAllocateHeap]
mov dword [ebp - 0x14], eax
jmp 0x455efb
mov eax, dword [ebp - 0x14]
mov dword [eax + ebx*4], esi
inc ebx
mov esi, dword [ebp - 0x2c]
lea eax, [ebp - 0x10]
inc esi
push eax
lfence
push dword [ebp - 0x10]
mov dword [ebp - 0x2c], esi
push edi
push 1
push esi
push dword [ebp - 0xc]
call dword [sym.imp.ntdll.dll_NtEnumerateValueKey]
lea ecx, [ecx]
cmp eax, 0x8000001a
jne 0x455e20
push edi
push 0
push dword [0x5cd55c]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
xor esi, esi
mov dword [ebp - 0xc], esi
test ebx, ebx
je 0x456071
mov edi, 0x5cf00c
lea ecx, [ecx]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x14]
push dword [eax + esi*4]
call sym.ProcessHacker.exe_PhParseCommandLineFuzzy
test al, al
je 0x456047
xor ecx, ecx
xor eax, eax
lock cmpxchg dword [edi], ecx
mov edi, dword [ebp - 0x20]
mov esi, eax
test esi, esi
je 0x455f8a
lock inc dword [esi - 4]
jmp 0x455fb2
push 0
push dword [0x5cd528]
call sym.ProcessHacker.exe_PhGetDllFileName
mov esi, eax
mov edx, 0x5cf00c
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
jne 0x455fae
lock inc dword [esi - 4]
test esi, esi
je 0x456028
push esi
call sym.ProcessHacker.exe_PhGetBaseName
mov dword [ebp - 0x18], eax
lea ecx, [esi - 8]
or edx, 0xffffffff
lock xadd dword [ecx + 4], edx
dec edx
jne 0x455fd1
call fcn.004c1f60
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x18]
test edi, edi
je 0x456014
mov ecx, dword ds:[eax]
mov edx, dword [edi]
cmp ecx, edx
ja 0x456014
mov eax, dword [edi + 4]
sub eax, ecx
mov dword [ebp - 0x30], ecx
add eax, edx
push 1
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x30]
push esi
push eax
call sym.ProcessHacker.exe_PhEqualStringRef
movzx ecx, byte [0x5cde50]
test al, al
mov eax, 1
cmovne ecx, eax
mov byte [0x5cde50], cl
lea ecx, ds:[esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x456028
call fcn.004c1f60
test edi, edi
je 0x45603f
lea ecx, [edi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x45603f
call fcn.004c1f60
mov esi, dword [ebp - 0xc]
mov edi, 0x5cf00c
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + esi*4]
or eax, 0xffffffff
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], eax
dec eax
jne 0x456065
jmp 0x456060
call fcn.004c1f60
inc esi
mov dword [ebp - 0xc], esi
cmp esi, ebx
jb 0x455f50
push dword ds:[ebp - 0x14]
push 0
push dword [0x5cd55c]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtClose]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00534c91
mov esp, ebp
pop ebp
ret