Function at 0x475250
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x640
lea eax, [esp]
push ebp
push eax
xor ebp, ebp
push str.SOFTWAREMicrosoftInternet_ExplorerToolbar
mov dword [esp + 0x10], ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x10], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov edx, dword [esp + 4]
cmp edx, ebp
je 0x4755cb
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x32]
mov word [esp + 0x30], bp
push ebp
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x14]
push ebp
stosw word es:[edi], ax
push ecx
lea eax, [esp + 0x20]
lea ecx, [esp + 0x3c]
push eax
push ecx
push ebp
push edx
mov dword [esp + 0x38], ebp
mov dword [esp + 0x30], 0x104
mov dword [esp + 0x2c], ebp
call dword [sym.imp.SHLWAPI.dll_SHEnumValueW]
test eax, eax
jne 0x4755bf
push ebx
push esi
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x14]
inc edx
mov ebx, 0x208
push 0x10
mov dword [esp + 0x28], edx
mov dword [esp + 0x20], ebx
call fcn.00475ab0
mov esi, eax
cmp esi, ebp
mov dword [esp + 0x20], esi
je 0x475594
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x242]
mov word [esp + 0x240], bp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 0x34]
lea eax, [esp + 0x240]
push edx
lea ecx, [esp + 0x1c]
push eax
lea edx, [esp + 0x40]
push ecx
push edx
mov dword [esp + 0x44], ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push str.SOFTWAREMicrosoftInternet_ExplorerToolbar
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
cmp word [esp + 0x240], bp
jne 0x4753b2
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x44a]
mov word [esp + 0x448], bp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x38]
lea ecx, [esp + 0x448]
push eax
push str.CLSID_s
push 0x103
push ecx
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
lea edx, [esp + 0x30]
lea eax, [esp + 0x240]
lea ecx, [esp + 0x2c]
push edx
push eax
push ecx
lea edx, [esp + 0x454]
push 0x4ffec0
push edx
push connect
mov dword [esp + 0x48], 0x104
mov dword [esp + 0x44], ebp
call ebx
mov eax, dword [esp + 0x14]
mov dword [esi + 0x34], 2
mov ecx, dword [eax + 0x8c8]
cmp ecx, ebp
jne 0x4753cb
xor eax, eax
jmp 0x4753d6
mov eax, dword [eax + 0x8cc]
sub eax, ecx
sar eax, 2
inc eax
lea ebx, [esi + 0x48]
mov dword [esi + 0x3c], eax
lea eax, [esp + 0x38]
test eax, eax
je 0x4753f2
lea ecx, [esp + 0x38]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebp, eax
mov eax, dword [ebx]
cmp dword [eax - 0xc], 1
jg 0x4753ff
cmp ebp, dword [eax - 4]
jle 0x475412
mov ecx, ebx
call fcn.00407610
push ebp
mov ecx, ebx
call fcn.00407580
test eax, eax
je 0x47543d
mov edi, dword [ebx]
lea eax, [ebp + ebp]
mov ecx, eax
lea esi, [esp + 0x38]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx]
mov esi, dword [esp + 0x20]
mov dword [ecx - 8], ebp
mov edx, dword [ebx]
mov word [edx + eax], 0
lea eax, [esp + 0x240]
mov dword [esi + 0x30], 0x10
test eax, eax
lea ebx, [esi + 0x44]
jne 0x475456
xor ebp, ebp
jmp 0x475466
lea ecx, [esp + 0x240]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebp, eax
mov eax, dword [ebx]
cmp dword [eax - 0xc], 1
jg 0x475473
cmp ebp, dword [eax - 4]
jle 0x475486
mov ecx, ebx
call fcn.00407610
push ebp
mov ecx, ebx
call fcn.00407580
test eax, eax
je 0x4754b0
mov edi, dword [ebx]
lea eax, [ebp + ebp]
mov ecx, eax
lea esi, [esp + 0x240]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx]
mov dword [ecx - 8], ebp
mov edx, dword [ebx]
mov word [eax + edx], 0
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x38]
test ecx, ecx
lea ebx, [eax + 0x14]
jne 0x4754c3
xor ebp, ebp
jmp 0x4754d0
lea edx, [esp + 0x38]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebp, eax
mov eax, dword [ebx]
mov edi, 1
cmp dword [eax - 0xc], edi
jg 0x4754e1
cmp ebp, dword [eax - 4]
jle 0x4754f4
mov ecx, ebx
call fcn.00407610
push ebp
mov ecx, ebx
call fcn.00407580
test eax, eax
je 0x475520
mov edi, dword [ebx]
lea eax, [ebp + ebp]
mov ecx, eax
lea esi, [esp + 0x38]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebx]
mov edi, 1
mov dword [ecx - 8], ebp
mov edx, dword [ebx]
mov word [eax + edx], 0
mov esi, dword [esp + 0x20]
lea eax, [esp + 0x28]
push reloc.DSOUND.dll_DirectSoundCreate
lea ecx, [esp + 0x3c]
push eax
push ecx
push str.PlugIn
mov dword [esp + 0x38], edi
mov dword [esi + 0x10], 0
call fcn.004ae0e0
add esp, 0x10
test eax, eax
je 0x475558
cmp dword [esp + 0x28], edi
jne 0x475558
mov dword [esi + 0x10], edi
mov eax, dword [esi + 0x10]
test eax, eax
jne 0x475566
mov dword [esi + 0x3c], 0xffffffff
mov eax, dword [esi + 0x48]
push eax
call fcn.00435c20
add esp, 4
test eax, eax
je 0x47558a
push esi
mov esi, dword [esp + 0x18]
mov ecx, esi
call fcn.00477760
mov dword [esi + 0x8b8], edi
jmp 0x475592
mov edx, dword [esi]
push edi
mov ecx, esi
call dword [edx + 0x10]
xor ebp, ebp
push ebp
lea eax, [esp + 0x1c]
push ebp
lea ecx, [esp + 0x24]
push eax
mov eax, dword [esp + 0x30]
lea edx, [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x20]
push edx
push eax
push ecx
call dword [sym.imp.SHLWAPI.dll_SHEnumValueW]
test eax, eax
je 0x4752ca
pop esi
pop ebx
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebp
add esp, 0x640
ret