Function at 0x45bfd0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4e4
mov eax, dword [0x536014]
xor eax, ebp
mov dword [ebp - 4], eax
movups xmm0, xmmword [0x516e88]
push ebx
push esi
movups xmmword [ebp - 0x4b0], xmm0
push edi
movups xmm0, xmmword [0x516e78]
mov dword [ebp - 0x4d8], edx
lea ebx, [ebp - 0x4b0]
mov dword [ebp - 0x4c4], ecx
mov esi, 0x80004005
movups xmmword [ebp - 0x4a0], xmm0
mov dword [ebp - 0x4d0], 0
xor edi, edi
movups xmm0, xmmword [0x516e68]
movups xmmword [ebp - 0x490], xmm0
movups xmm0, xmmword [0x516e58]
movups xmmword [ebp - 0x480], xmm0
cmp edi, 4
jae 0x45c0a0
mov eax, dword [ecx]
lea edx, [ebp - 0x4d0]
push edx
push ebx
push ecx
call dword [eax]
mov ecx, dword [ebp - 0x4c4]
mov esi, eax
inc edi
add ebx, 0x10
test esi, esi
jne 0x45c041
mov eax, dword [ebp - 0x4d0]
push dword [ebp - 0x4d8]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov esi, eax
mov eax, dword [ebp - 0x4d0]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, dword [ebp - 0x4c4]
test esi, esi
jne 0x45c041
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00466907
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x45c08d
mov eax, dword [ecx]
lea edx, [ebp - 0x4c8]
push edx
push 0x516e48
push ecx
mov dword [ebp - 0x4c8], 0
call dword [eax]
mov edi, eax
test edi, edi
jne 0x45c0ec
mov edx, dword [ebp - 0x4d8]
mov ecx, dword [ebp - 0x4c8]
call fcn.0045bd60
mov edi, eax
mov eax, dword [ebp - 0x4c8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
test edi, edi
je 0x45c317
push 0x200
lea eax, [ebp - 0x270]
mov dword [ebp - 0x4c8], 0
push 0
push eax
call fcn.0048acb0
movups xmm0, xmmword [str.Interface]
mov eax, dword [0x516e24]
add esp, 0xc
mov dword [ebp - 8], eax
lea eax, [ebp - 0x4c8]
movups xmmword [ebp - 0x18], xmm0
movups xmm0, xmmword [str.IApplicationAssociationRegistrationInternal]
push eax
push 0x20019
movups xmmword [ebp - 0x70], xmm0
push 0
movups xmm0, xmmword [0x516a80]
lea eax, [ebp - 0x18]
push eax
movups xmmword [ebp - 0x60], xmm0
push 0x80000000
movups xmm0, xmmword [0x516a90]
movups xmmword [ebp - 0x50], xmm0
movups xmm0, xmmword [0x516aa0]
movups xmmword [ebp - 0x40], xmm0
movups xmm0, xmmword [0x516ab0]
movups xmmword [ebp - 0x30], xmm0
movq xmm0, qword [0x516ac0]
movq qword [ebp - 0x20], xmm0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x45c317
mov ebx, dword [ebp - 0x4c4]
xor esi, esi
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x4e0]
mov dword [ebp - 0x4e0], 0x100
push eax
lea eax, [ebp - 0x270]
push eax
push esi
push dword [ebp - 0x4c8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
inc esi
mov dword [ebp - 0x4c4], eax
mov dword [ebp - 0x4cc], esi
test eax, eax
jne 0x45c2fc
mov dword [ebp - 0x4d4], eax
lea eax, [ebp - 0x4d4]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x270]
push eax
push dword [ebp - 0x4c8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x45c2f6
push 0x200
push eax
lea eax, [ebp - 0x470]
push eax
call fcn.0048acb0
add esp, 0xc
mov dword [ebp - 0x4e4], 0x200
lea eax, [ebp - 0x4e4]
push eax
lea eax, [ebp - 0x470]
push eax
push 0
push 0
push 0
push dword [ebp - 0x4d4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x4d4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x45c2f0
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x470]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x45c2f0
mov dword [ebp - 0x4c0], eax
xorps xmm0, xmm0
mov dword [ebp - 0x4b4], eax
lea eax, [ebp - 0x4c0]
push eax
lea eax, [ebp - 0x270]
movq qword [ebp - 0x4bc], xmm0
push eax
call dword [sym.imp.ole32.dll_IIDFromString]
mov esi, dword [ebp - 0x4cc]
mov edi, eax
test edi, edi
jne 0x45c190
mov eax, dword [ebx]
lea ecx, [ebp - 0x4dc]
push ecx
lea ecx, [ebp - 0x4c0]
mov dword [ebp - 0x4dc], 0
push ecx
push ebx
call dword [eax]
mov edi, eax
test edi, edi
jne 0x45c190
mov edx, dword [ebp - 0x4d8]
mov ecx, dword [ebp - 0x4dc]
call fcn.0045bd60
mov edi, eax
mov eax, dword [ebp - 0x4dc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov esi, dword [ebp - 0x4cc]
mov eax, dword [ebp - 0x4c4]
test edi, edi
je 0x45c30b
cmp eax, 0x103
jne 0x45c190
push dword [ebp - 0x4c8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00466907
mov esp, ebp
pop ebp
ret