Function at 0x458fd0
Capabilities:
Delete registry value
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4e5fb0
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebp
xor ebp, ebp
cmp word [0x518dc4], bp
jne 0x459014
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
push eax
push ecx
call dword [0x519298]
pop ebp
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret
push ebx
mov ebx, dword [esp + 0x3c]
push esi
push edi
push 0x5c
push ebp
push ebx
mov dword [esp + 0x1c], ebp
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
mov esi, eax
cmp esi, ebp
jne 0x459213
movzx eax, word [0x518dc4]
mov ecx, dword [esp + 0x40]
lea edx, [esp + 0x10]
push edx
or eax, 0x2001b
push eax
push ebp
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, ebp
jne 0x4592b4
push ebp
push ebp
push ebp
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x30]
push eax
mov eax, dword [esp + 0x24]
push ebp
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x40]
push edx
push ebp
push ebp
push ebp
push eax
mov dword [esp + 0x54], ebp
mov dword [esp + 0x48], ebp
mov dword [esp + 0x50], ebp
mov dword [esp + 0x4c], ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov ecx, dword [esp + 0x1c]
mov edi, eax
mov eax, dword [esp + 0x18]
cmp eax, ecx
mov dword [esp + 0x14], edi
jae 0x4590aa
mov eax, ecx
mov dword [esp + 0x18], eax
lea ecx, [eax*4 + 8]
push ecx
lea ecx, [esp + 0x2c]
call fcn.00446280
cmp edi, ebp
mov edi, dword [esp + 0x28]
mov dword [esp + 0x38], ebp
jne 0x45918c
mov ebx, dword [esp + 0x20]
dec ebx
cmp ebx, ebp
jl 0x45912f
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
lea ebx, [ebx]
mov edx, dword [esp + 0x18]
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x3c]
push ecx
lea eax, [edx*4 + 1]
push edi
mov dword [esp + 0x44], eax
mov word [edi], 0
mov edx, dword [esp + 0x28]
push ebx
push edx
call ebp
mov esi, eax
test esi, esi
jne 0x45912a
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
test esi, esi
je 0x45912a
mov dword [esp + 0x14], esi
dec ebx
jns 0x4590e0
xor ebp, ebp
mov ebx, dword [esp + 0x24]
dec ebx
cmp ebx, ebp
jl 0x459188
mov ecx, dword [esp + 0x18]
push ebp
push ebp
push ebp
push ebp
lea eax, [esp + 0x3c]
push eax
lea edx, [ecx*4 + 1]
push edi
mov dword [esp + 0x44], edx
mov word [edi], bp
mov ecx, dword [esp + 0x28]
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
cmp esi, ebp
je 0x45916c
mov dword [esp + 0x14], esi
jmp 0x459185
cmp word [edi], bp
je 0x459185
mov edx, dword [esp + 0x10]
push edi
push edx
call dword [0x519298]
cmp eax, ebp
je 0x459185
mov dword [esp + 0x14], eax
dec ebx
jns 0x459138
mov ebx, dword [esp + 0x44]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x51929c]
cmp eax, ebp
jne 0x4591c4
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebp
je 0x45920b
push 0x4f5390
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebp
mov dword [0x51929c], eax
je 0x4591d7
movzx ecx, word [0x518dc4]
mov edx, dword [esp + 0x40]
push ebp
push ecx
push ebx
push edx
call eax
mov esi, eax
cmp esi, ebp
je 0x4591df
mov dword [esp + 0x14], esi
cmp edi, ebp
je 0x4591f4
mov eax, dword [0x51927c]
add edi, 0xfffffff8
push edi
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
pop ebp
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret
mov dword [0x51929c], ebp
jmp 0x4591d7
mov eax, esi
sub eax, ebx
sar eax, 1
push eax
push ebx
lea ecx, [esp + 0x2c]
add esi, 2
mov dword [esp + 0x2c], ebp
call fcn.004463d0
movzx edx, word [0x518dc4]
mov edi, dword [esp + 0x24]
mov eax, dword [esp + 0x40]
lea ecx, [esp + 0x10]
push ecx
or edx, 2
push edx
push ebp
push edi
push eax
mov dword [esp + 0x4c], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
cmp ebx, ebp
je 0x459285
cmp edi, ebp
je 0x459270
mov ecx, dword [0x51927c]
add edi, 0xfffffff8
push edi
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret
mov edx, dword [esp + 0x10]
push esi
push edx
call dword [0x519298]
mov esi, eax
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, ebp
je 0x4592b4
mov ecx, dword [0x51927c]
add edi, 0xfffffff8
push edi
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [esp + 0x30]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
mov dword fs:[0], ecx
add esp, 0x2c
ret