Function at 0x10046290
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x90c4
call fcn.100507a0
mov eax, dword [0x10072f40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x90c0], eax
mov dword [ebp - 0x90c4], edx
test eax, eax
je 0x10046539
cmp byte [edx], 0
je 0x10046539
push ebx
xorps xmm0, xmm0
movups xmmword [eax], xmm0
mov dword [eax + 0x10], 0
push esi
mov word [eax + 0x14], 0
xor eax, eax
push edi
mov word [ebp - 0xb0], ax
mov word [ebp - 0x230], ax
lea eax, [ecx + 0x10]
push 0x23
push eax
call sub.VCRUNTIME140.dll_wcschr
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x10046524
lea eax, [ebx + 2]
push 0x23
push eax
call sub.VCRUNTIME140.dll_wcschr
mov edi, eax
add esp, 8
test edi, edi
je 0x10046524
mov esi, edi
sub esi, ebx
sar esi, 1
dec esi
cmp esi, 0x3f
jae 0x10046524
push esi
lea eax, [ebx + 2]
push eax
lea eax, [ebp - 0xb0]
push 0x40
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
add esi, esi
add esp, 0x10
cmp esi, 0x80
jae 0x1004654e
xor eax, eax
lea ebx, [edi + 2]
push 0x23
push ebx
mov word [ebp + esi - 0xb0], ax
call sub.VCRUNTIME140.dll_wcschr
mov esi, eax
add esp, 8
test esi, esi
je 0x10046524
sub esi, edi
sar esi, 1
dec esi
cmp esi, 0xbf
jae 0x10046524
push esi
push ebx
lea eax, [ebp - 0x230]
push 0xc0
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
add esi, esi
add esp, 0x10
cmp esi, 0x180
jae 0x1004654e
xor eax, eax
mov word [ebp + esi - 0x230], ax
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0xb0]
push eax
push 0x10061ee8
push 0x7ff
lea eax, [ebp - 0x90b0]
push 0x800
push eax
call fcn.10046580
add esp, 0x18
lea eax, [ebp - 0x90b8]
push eax
push 0x20001
push 0
lea eax, [ebp - 0x90b0]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10046524
lea eax, [ebp - 0x90bc]
mov dword [ebp - 0x90bc], 0x8000
push eax
lea eax, [ebp - 0x80b0]
push eax
push 0
push 0
push str.EDID
push dword [ebp - 0x90b8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10046518
push 0x2c
push eax
lea eax, [ebp - 0x30]
push eax
call sub.VCRUNTIME140.dll_memset
mov edi, str.6HZlS
lea eax, [ebp - 0x30]
add esp, 0xc
mov dword [ebp - 0x90b4], edi
xor bh, bh
nop
movsx ecx, byte [edi]
cmp byte [ebp + ecx - 0x80b0], 0
jne 0x100464d5
cmp byte [ebp + ecx - 0x80af], 0
jne 0x100464d5
cmp byte [ebp + ecx - 0x80ae], 0
jne 0x100464d5
cmp byte [ebp + ecx - 0x80ad], 0xff
jne 0x100464d5
cmp byte [ebp + ecx - 0x80ac], 0
jne 0x100464d5
xor edx, edx
lea esi, [ebp - 0x80ab]
add esi, ecx
lea edi, [edx + 0x20]
mov bl, byte [esi + edx]
cmp bl, 0x20
ja 0x100464b5
test bh, bh
jne 0x100464c9
mov bh, 1
mov word [eax], di
jmp 0x100464c6
xor bh, bh
movzx ecx, bl
cmp bl, 0x5f
cmove ecx, edi
movzx ecx, cl
mov word [eax], cx
add eax, 2
inc edx
cmp edx, 0xd
jne 0x100464a2
mov edi, dword [ebp - 0x90b4]
inc edi
mov dword [ebp - 0x90b4], edi
cmp edi, 0x10061ee8
jne 0x10046460
xor ecx, ecx
cmp word [eax - 2], 0x20
jne 0x100464f7
mov word [eax - 2], cx
jmp 0x100464fa
mov word [eax], cx
mov edx, dword [ebp - 0x90c0]
xor ecx, ecx
mov al, byte [ebp + ecx*2 - 0x30]
mov byte [edx + ecx], al
inc ecx
cmp ecx, 0xb
jl 0x10046502
mov eax, dword [ebp - 0x90c4]
mov byte [eax], 0x16
push dword [ebp - 0x90b8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005078e
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov eax, 0x80004005
xor ecx, ebp
call fcn.1005078e
mov esp, ebp
pop ebp
ret 8
call fcn.10050d63
int3