Function at 0x416f64
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x270
mov eax, dword [0x6f4e3c]
xor eax, ebp
mov dword [esp + 0x268], eax
call fcn.004175be
lea edi, [esp + 0x3c]
mov ecx, eax
push edi
call fcn.0041760e
movzx eax, byte [edi + 0xb]
test al, al
jns 0x416fa2
mov edi, dword [esp + 0x3c]
mov eax, dword [esp + 0x40]
lea esi, [esp + 0x60]
mov ecx, esi
push eax
push edi
call fcn.0046ed80
push esi
call fcn.004827a0
add esp, 4
mov ebx, eax
mov ecx, esi
call fcn.0046ee40
test bl, bl
je 0x41720c
xor eax, eax
lea edi, [esp + 0x30]
mov dword [edi + 4], eax
mov dword [edi], eax
mov dword [edi + 8], eax
push edi
call fcn.00439049
add esp, 4
test al, al
je 0x4171f9
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
test eax, eax
js 0x4171f9
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
movzx eax, byte [esp + 0x47]
test al, al
jns 0x417013
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x40]
jmp 0x417017
lea edx, [esp + 0x3c]
lea ebx, [esp + 0x24]
mov ecx, ebx
push eax
push edx
call fcn.0046ed80
movzx eax, byte [esp + 0x3b]
test al, al
jns 0x417035
mov edi, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
mov ecx, ebx
push eax
push edi
push esi
call fcn.0046fbd0
mov ecx, ebx
push esi
call fcn.0046ee80
mov ecx, esi
call fcn.0046ee40
lea ebx, [esp + 0x18]
mov ecx, ebx
push str.plugins
call fcn.00401a6c
movzx eax, byte [ebx + 0xb]
test al, al
jns 0x41706e
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
lea edi, [esp + 0x48]
mov ecx, edi
push eax
push ebx
call fcn.0046ed80
lea ebx, [esp + 0x24]
mov ecx, ebx
push edi
push esi
call fcn.00470540
mov ecx, ebx
push esi
call fcn.0046ee80
mov ecx, esi
call fcn.0046ee40
mov ecx, edi
call fcn.0046ee40
cmp byte [esp + 0x23], 0
jns 0x4170b1
push dword [esp + 0x18]
call fcn.00517bd6
add esp, 4
mov ebx, 0x208
xor edi, edi
push ebx
push edi
push esi
call fcn.006030b0
add esp, 0xc
lea eax, [esp + 0x14]
mov dword [eax], 1
lea ecx, [esp + 0x10]
mov dword [ecx], ebx
push ecx
push esi
push eax
push edi
push str.CLSID7978461C_CC22_48F2_BC69_02220D3E101DInprocServer32
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push esi
call fcn.006208d5
add esp, 4
test eax, eax
je 0x417103
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4171ea
lea ecx, [esp + 0x48]
push str.pta.dll
call fcn.00401a6c
lea ecx, [esp + 0x54]
push str.itrusenroll.dll
call fcn.00401a6c
mov bl, 1
lea ecx, [edi + edi*2]
movzx eax, byte [esp + ecx*4 + 0x53]
test al, al
jns 0x417137
mov edx, dword [esp + ecx*4 + 0x48]
mov eax, dword [esp + ecx*4 + 0x4c]
jmp 0x41713d
lea edx, [esp + ecx*4]
add edx, 0x48
lea ecx, [esp + 0x24]
push eax
push edx
lea esi, [esp + 0xc]
push esi
call fcn.0046fbd0
lea edi, [esp + 0x18]
mov ecx, edi
push esi
call fcn.00468aa8
mov ecx, esi
call fcn.0046ee40
cmp byte [esp + 0x23], 0
mov esi, edi
jns 0x41716d
mov esi, dword [esp + 0x18]
push 8
push 0
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
cmp eax, 0x21
jb 0x4171a9
mov edi, eax
mov dword [esp], ebx
push str.DllRegisterServer
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41719f
mov ebx, eax
push esi
call fcn.00401e20
add esp, 4
call ebx
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ebx, dword [esp]
cmp byte [esp + 0x23], 0
jns 0x4171bc
push dword [esp + 0x18]
call fcn.00517bd6
add esp, 4
xor edi, edi
inc edi
test bl, 1
mov ebx, 0
jne 0x417121
mov esi, 0x18
cmp byte [esp + esi + 0x47], 0
jns 0x4171e5
push dword [esp + esi + 0x3c]
call fcn.00517bd6
add esp, 4
add esi, 0xfffffff4
jne 0x4171d2
call dword [sym.imp.ole32.dll_OleUninitialize]
lea ecx, [esp + 0x24]
call fcn.0046ee40
cmp byte [esp + 0x3b], 0
jns 0x41720c
push dword [esp + 0x30]
call fcn.00517bd6
add esp, 4
cmp byte [esp + 0x47], 0
jns 0x41721f
push dword [esp + 0x3c]
call fcn.00517bd6
add esp, 4
mov ecx, dword [esp + 0x268]
xor ecx, ebp
call fcn.00517c1a
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret