Function at 0x452910
Capabilities:
Enumerate files on windows
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20484
call fcn.0042beb0
mov eax, dword [0x48d800]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x20484], ecx
push str.Identities
lea eax, [ebp - 0x20478]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea ecx, [ebp - 0x10264]
push ecx
lea edx, [ebp - 0x20478]
push edx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x452998
push 0x104
lea eax, [ebp - 0x10470]
push eax
push 0
mov ecx, dword [ebp - 0x10264]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x452998
mov edx, dword [ebp - 0x10264]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x20484]
call fcn.00451b90
jmp 0x452c91
push 0x479b04
lea eax, [ebp - 0x20478]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea ecx, [ebp - 0x10470]
push ecx
lea edx, [ebp - 0x20478]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x479b08
lea eax, [ebp - 0x20478]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov ecx, dword [ebp - 0x10264]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x10264]
push edx
lea eax, [ebp - 0x20478]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x452afa
push 0x104
lea ecx, [ebp - 0x10470]
push ecx
push 0
mov edx, dword [ebp - 0x10264]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x452a3a
mov eax, dword [ebp - 0x10264]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x20484]
call fcn.00451b90
jmp 0x452c91
mov ecx, dword [ebp - 0x10264]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x479b50
lea edx, [ebp - 0x20478]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x10470]
push eax
lea ecx, [ebp - 0x20478]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea edx, [ebp - 0x10264]
push edx
lea eax, [ebp - 0x20478]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x452a9a
mov ecx, dword [ebp - 0x20484]
call fcn.00451b90
jmp 0x452c91
mov dword [ebp - 0x20480], 0x8000
mov dword [ebp - 0x2047c], 1
lea ecx, [ebp - 0x20480]
push ecx
lea edx, [ebp - 0x10010]
push edx
lea eax, [ebp - 0x2047c]
push eax
push 0
push 0x479b54
mov ecx, dword [ebp - 0x10264]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x452af8
mov edx, dword [ebp - 0x10264]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x20484]
call fcn.00451b90
jmp 0x452c91
jmp 0x452b0a
mov ecx, dword [ebp - 0x20484]
call fcn.00451b90
jmp 0x452c91
push 0x8000
lea eax, [ebp - 0x10010]
push eax
call dword [sym.imp.SHELL32.dll_DoEnvironmentSubstW]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
and ecx, 0xffff
movzx edx, cx
test edx, edx
jne 0x452b3f
mov ecx, dword [ebp - 0x20484]
call fcn.00451b90
jmp 0x452c91
lea eax, [ebp - 0x10010]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x10268], eax
mov ecx, dword [ebp - 0x10268]
movzx edx, word [ebp + ecx*2 - 0x10012]
cmp edx, 0x5c
je 0x452b88
mov eax, 0x5c
mov ecx, dword [ebp - 0x10268]
mov word [ebp + ecx*2 - 0x10010], ax
xor edx, edx
mov eax, dword [ebp - 0x10268]
mov word [ebp + eax*2 - 0x1000e], dx
mov dword [ebp - 0x10260], 0x825
push 0xffff0002
push 0xffff0000
push 0
push 0
push 0
push 1
push 0
lea ecx, [ebp - 0x10010]
push ecx
push 0x27
mov ecx, dword [ebp - 0x20484]
add ecx, 0x78
call fcn.0040c00e
mov dword [ebp - 4], eax
push str..dbx
lea edx, [ebp - 0x10010]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x10260]
push eax
lea ecx, [ebp - 0x10010]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x10474], eax
cmp dword [ebp - 0x10474], 0xffffffff
jne 0x452bfa
jmp 0x452c91
mov edx, dword [ebp - 0x10260]
and edx, 0x410
jne 0x452c32
push 0xffff0002
mov eax, dword [ebp - 4]
push eax
push 1
push 0
push 0
push 4
push 4
lea ecx, [ebp - 0x10234]
push ecx
push 0x27
mov ecx, dword [ebp - 0x20484]
add ecx, 0x78
call fcn.0040c00e
lea edx, [ebp - 0x10260]
push edx
mov eax, dword [ebp - 0x10474]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x452c84
mov ecx, dword [ebp - 0x10260]
and ecx, 0x410
jne 0x452c82
push 0xffff0002
mov edx, dword [ebp - 4]
push edx
push 1
push 0
push 0
push 4
push 4
lea eax, [ebp - 0x10234]
push eax
push 0x27
mov ecx, dword [ebp - 0x20484]
add ecx, 0x78
call fcn.0040c00e
jmp 0x452c32
mov ecx, dword [ebp - 0x10474]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00427b2d
mov esp, ebp
pop ebp
ret