Function at 0x684c6480
Capabilities:
Create thread
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x26c
mov eax, dword [ebp + 0x14]
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x23c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x240], eax
mov eax, dword [ebp + 0x18]
test eax, eax
jns 0x684c6510
mov eax, dword [ebx + 0xc]
xor ecx, ecx
lea edx, [ebp - 0x222]
test eax, eax
sete cl
mov eax, esi
mov dword [ebp - 0x248], ecx
mov dword [ebp - 0x244], edx
call fcn.684c3c70
mov edx, dword [ebp - 0x244]
mov ecx, dword [ebp - 0x248]
test eax, eax
je 0x684c67b8
mov eax, dword [ebp - 0x240]
mov dword [esp], edi
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x23c]
mov dword [esp + 4], eax
mov eax, ebx
call fcn.684c4240
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp dword [esi], 1
je 0x684c6570
mov edx, dword [esi + 8]
cmp edx, 1
je 0x684c6630
cmp edx, 2
je 0x684c6618
cmp edx, 4
je 0x684c6623
cmp edx, 3
je 0x684c6545
test byte [0x684eb0a0], 1
jne 0x684c66d8
mov ecx, dword [ebx + 0xc]
test ecx, ecx
jne 0x684c6668
mov edx, dword [ebx + 0x80]
test edx, edx
je 0x684c6668
mov ecx, 1
lea edx, [ebp - 0x222]
jmp 0x684c64be
lea eax, [ebp - 0x22c]
lea edx, [ebp - 0x222]
mov dword [esp + 8], 0
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x228]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 4], str.ThreadingModel
mov eax, dword [esi + 4]
mov dword [ebp - 0x244], edx
mov dword [ebp - 0x22c], 0x14
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
mov edx, dword [ebp - 0x244]
sub esp, 0x18
test eax, eax
jne 0x684c65d0
cmp dword [ebp - 0x228], 1
je 0x684c65d9
xor eax, eax
mov word [ebp - 0x222], ax
mov eax, dword [sym.imp.ucrtbase.dll__wcsicmp]
mov dword [esp + 4], str.Apartment
mov dword [esp], edx
mov dword [ebp - 0x248], edx
mov dword [ebp - 0x244], eax
call eax
test eax, eax
je 0x684c6630
mov edx, dword [ebp - 0x248]
mov dword [esp + 4], str.Free
mov eax, dword [ebp - 0x244]
mov dword [esp], edx
call eax
test eax, eax
jne 0x684c6690
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x684c6790
xor ecx, ecx
lea edx, [ebp - 0x222]
jmp 0x684c64be
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x684c655e
mov eax, dword [ebp - 0x240]
mov dword [ebp + 0xc], edi
xor ecx, ecx
mov dword [ebp + 8], esi
mov dword [ebp + 0x14], eax
mov eax, dword [ebp - 0x23c]
mov dword [ebp + 0x10], eax
xor edx, edx
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.684c5bf0
mov eax, dword [ebp - 0x240]
mov dword [ebp + 0xc], edi
mov ecx, 1
mov dword [ebp + 8], esi
mov dword [ebp + 0x14], eax
mov eax, dword [ebp - 0x23c]
mov dword [ebp + 0x10], eax
jmp 0x684c6655
mov edx, dword [ebp - 0x248]
mov dword [esp + 4], str.Both
mov eax, dword [ebp - 0x244]
mov dword [esp], edx
call eax
mov edx, dword [ebp - 0x248]
test eax, eax
mov ecx, eax
je 0x684c64be
cmp word [ebp - 0x222], 0
mov edx, 5
jne 0x684c6538
jmp 0x684c6545
test edi, edi
je 0x684c688f
mov eax, edi
mov dword [ebp - 0x244], edx
shr eax, 0x10
je 0x684c6871
movzx eax, byte [edi + 0xf]
mov dword [esp + 0x2c], eax
movzx eax, byte [edi + 0xe]
mov dword [esp + 0x28], eax
movzx eax, byte [edi + 0xd]
mov dword [esp + 0x24], eax
movzx eax, byte [edi + 0xc]
mov dword [esp + 0x20], eax
movzx eax, byte [edi + 0xb]
mov dword [esp + 0x1c], eax
movzx eax, byte [edi + 0xa]
mov dword [esp + 0x18], eax
movzx eax, byte [edi + 9]
mov dword [esp + 0x14], eax
movzx eax, byte [edi + 8]
mov dword [esp + 0x10], eax
movzx eax, word [edi + 6]
mov dword [esp + 0xc], eax
movzx eax, word [edi + 4]
mov dword [esp + 8], eax
mov eax, dword [edi]
mov dword [esp], 0x684ee258
mov dword [esp + 4], eax
call fcn.684c3b20
mov edx, dword [ebp - 0x244]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], str.unrecognised_threading_model__d_for_object__s__should_be_main_threaded__n
mov dword [esp + 8], str.apartment_get_inproc_class_object
mov dword [esp + 4], 0x684eb0a0
mov dword [esp], 0
call fcn.684c40b0
jmp 0x684c6545
mov eax, dword [ebp - 0x240]
mov dword [ebp + 0xc], edi
xor ecx, ecx
mov edx, 1
mov dword [ebp + 8], esi
mov dword [ebp + 0x14], eax
mov eax, dword [ebp - 0x23c]
mov dword [ebp + 0x10], eax
jmp 0x684c6657
mov eax, 0x80040154
test byte [0x684eb0a0], 4
je 0x684c6503
test edi, edi
je 0x684c68ae
mov eax, edi
shr eax, 0x10
je 0x684c6899
movzx eax, byte [edi + 0xf]
mov dword [esp + 0x2c], eax
movzx eax, byte [edi + 0xe]
mov dword [esp + 0x28], eax
movzx eax, byte [edi + 0xd]
mov dword [esp + 0x24], eax
movzx eax, byte [edi + 0xc]
mov dword [esp + 0x20], eax
movzx eax, byte [edi + 0xb]
mov dword [esp + 0x1c], eax
movzx eax, byte [edi + 0xa]
mov dword [esp + 0x18], eax
movzx eax, byte [edi + 9]
mov dword [esp + 0x14], eax
movzx eax, byte [edi + 8]
mov dword [esp + 0x10], eax
movzx eax, word [edi + 6]
mov dword [esp + 0xc], eax
movzx eax, word [edi + 4]
mov dword [esp + 8], eax
mov eax, dword [edi]
mov dword [esp], 0x684ee258
mov dword [esp + 4], eax
call fcn.684c3b20
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.class__s_not_registered_inproc_n
mov dword [esp + 8], str.apartment_get_inproc_class_object
mov dword [esp + 4], 0x684eb0a0
mov dword [esp], 2
call fcn.684c40b0
mov eax, 0x80040154
jmp 0x684c6503
movzx eax, di
mov dword [esp], 0x684ee248
mov dword [esp + 4], eax
call fcn.684c3b20
mov edx, dword [ebp - 0x244]
jmp 0x684c6759
mov eax, 0x684ee241
jmp 0x684c6759
movzx edi, di
mov dword [esp], 0x684ee248
mov dword [esp + 4], edi
call fcn.684c3b20
jmp 0x684c683f
mov eax, 0x684ee241
jmp 0x684c683f