Function at 0x460d2a
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xe94
mov eax, 0x44c05e
call fcn.0043bc61
mov dword [ebp - 0xea0], edx
mov eax, ecx
mov dword [ebp - 0xe54], eax
mov ecx, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
and dword [ebp - 0xe60], 0
mov dword [ebp - 0xe9c], ecx
and dword [ebp - 4], 0
lea edx, [ebp - 0xe60]
push ebx
mov ecx, eax
call fcn.00432e14
mov edi, eax
cmp edi, 0x80040d61
jne 0x461317
and dword [ebp - 0xe50], 0
lea eax, [ebp - 0xe50]
mov byte [ebp - 4], 1
push eax
push 0x4075ec
push 0x15
push 0
push 0x4075dc
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoCreateInstance]
mov ecx, dword [ebp + 4]
mov edi, eax
test edi, edi
jns 0x460e4c
push edi
push 0x409960
mov edx, 0x1a4
call fcn.0045e47c
xor eax, eax
push 0x208
push eax
mov dword [ebp - 0xe68], eax
mov dword [ebp - 0xe64], eax
lea eax, [ebp - 0x420]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x420]
push 0x104
push eax
push 0
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0xe68]
call fcn.0046496f
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xe68]
push dword [ebx + 8]
push dword [ebx + 4]
push 0x7d0
call fcn.004649a0
mov edx, dword [ebx]
push 0xffffffffffffffff
push eax
push 0x40e418
mov esi, dword [edx + 0x10]
mov ecx, esi
mov dword [ebx + 0xc], eax
call dword [0x4a3670]
mov ecx, ebx
call esi
lea ecx, [ebp - 0xe68]
call fcn.0043a882
jmp 0x4612f7
and dword [ebp - 0xe4c], 0
mov byte [ebp - 4], 2
lea edx, [ebp - 0xe4c]
mov eax, dword [ebp - 0xe50]
push edx
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x1c]
mov ecx, esi
call dword [0x4a3670]
call esi
mov ecx, dword [ebp + 4]
mov edi, eax
test edi, edi
jns 0x460f1b
push edi
push 0x409960
mov edx, 0x1aa
call fcn.0045e47c
xor eax, eax
push 0x208
push eax
mov dword [ebp - 0xe70], eax
mov dword [ebp - 0xe6c], eax
lea eax, [ebp - 0x628]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x628]
push 0x104
push eax
push 0
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
lea eax, [ebp - 0x628]
push eax
lea ecx, [ebp - 0xe70]
call fcn.0046496f
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xe70]
push dword [ebx + 8]
push dword [ebx + 4]
push 0x7d0
call fcn.004649a0
mov ecx, dword [ebx]
push 0xffffffffffffffff
push eax
push 0x40e410
mov esi, dword [ecx + 0x10]
mov ecx, esi
mov dword [ebx + 0xc], eax
call dword [0x4a3670]
mov ecx, ebx
call esi
lea ecx, [ebp - 0xe70]
jmp 0x460ffe
xor eax, eax
mov dword [ebp - 0xe94], 0x206
mov word [ebp - 0x12], ax
mov edx, reloc.OLEAUT32.dll_SysReAllocString
lea eax, [ebp - 0xe5c]
mov dword [ebp - 0xe98], 2
push eax
push 1
push ecx
push 0x407210
call fcn.0043fa36
mov edi, eax
mov esi, 0x80070000
test edi, edi
jle 0x460f5e
movzx edi, di
or edi, esi
mov ecx, dword [ebp + 4]
test edi, edi
jns 0x461008
push edi
push 0x409960
mov edx, 0x1b5
call fcn.0045e47c
xor eax, eax
push 0x208
push eax
mov dword [ebp - 0xe78], eax
mov dword [ebp - 0xe74], eax
lea eax, [ebp - 0x830]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x830]
push 0x104
push eax
push 0
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
lea eax, [ebp - 0x830]
push eax
lea ecx, [ebp - 0xe78]
call fcn.0046496f
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xe78]
push dword [ebx + 8]
push dword [ebx + 4]
push 0x7d7
call fcn.004649a0
mov ecx, dword [ebx]
push 0xffffffffffffffff
push eax
push 0x40e3f0
mov esi, dword [ecx + 0x10]
mov ecx, esi
mov dword [ebx + 0xc], eax
call dword [0x4a3670]
mov ecx, ebx
call esi
lea ecx, [ebp - 0xe78]
call fcn.0043a882
jmp 0x4612d9
lea eax, [ebp - 0xe94]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0xe98]
push eax
push 0x40e37c
push 0x40e3b0
push dword [ebp - 0xe5c]
call dword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHGetValueW]
mov edi, eax
test edi, edi
jle 0x46103e
movzx edi, di
or edi, esi
mov ecx, dword [ebp + 4]
test edi, edi
jns 0x4610e3
push edi
push 0x409960
mov edx, 0x1ba
call fcn.0045e47c
xor eax, eax
push 0x208
push eax
mov dword [ebp - 0xe80], eax
mov dword [ebp - 0xe7c], eax
lea eax, [ebp - 0xa38]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0xa38]
push 0x104
push eax
push 0
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
lea eax, [ebp - 0xa38]
push eax
lea ecx, [ebp - 0xe80]
call fcn.0046496f
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xe80]
push dword [ebx + 8]
push dword [ebx + 4]
push 0x7d5
call fcn.004649a0
mov ecx, dword [ebx]
push 0xffffffffffffffff
push eax
push 0x40e37c
mov esi, dword [ecx + 0x10]
mov ecx, esi
mov dword [ebx + 0xc], eax
call dword [0x4a3670]
mov ecx, ebx
call esi
lea ecx, [ebp - 0xe80]
jmp 0x4611c4
push 0
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.api_ms_win_shell_shdirectory_l1_1_0.dll_Ordinal_290]
test eax, eax
je 0x4611ce
cmp eax, 0x50
je 0x4611ce
cmp eax, 0xb7
je 0x4611ce
mov edi, 0x80070003
test eax, eax
jle 0x46111e
movzx eax, ax
or eax, esi
lea ecx, [ebp - 0x218]
push ecx
push 0x40e3d4
push eax
push 0x409960
push 0x1d3
push dword [ebp + 4]
call fcn.00464a06
xor eax, eax
push 0x208
push eax
mov dword [ebp - 0xe88], eax
mov dword [ebp - 0xe84], eax
lea eax, [ebp - 0xc40]
push eax
call sub.msvcrt.dll_memset
add esp, 0x24
lea eax, [ebp - 0xc40]
push 0x104
push eax
push 0
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
lea eax, [ebp - 0xc40]
push eax
lea ecx, [ebp - 0xe88]
call fcn.0046496f
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xe88]
push dword [ebx + 8]
push dword [ebx + 4]
push 0x7d4
call fcn.004649a0
mov ecx, dword [ebx]
push 0xffffffffffffffff
push eax
mov dword [ebx + 0xc], eax
lea eax, [ebp - 0x218]
mov esi, dword [ecx + 0x10]
mov ecx, esi
push eax
call dword [0x4a3670]
mov ecx, ebx
call esi
lea ecx, [ebp - 0xe88]
call fcn.0043a882
jmp 0x4612cd
and dword [ebp - 0xe58], 0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xe58]
mov eax, dword [ebp - 0xe4c]
push ecx
push dword [ebp - 0xe9c]
push dword [ebp - 0xea0]
mov esi, dword [eax]
push dword [ebp - 0xe54]
push eax
mov ecx, dword [esi + 0x28]
call dword [0x4a3670]
call dword [esi + 0x28]
mov edi, eax
test edi, edi
jns 0x4612af
mov ecx, dword [ebp + 4]
mov edx, 0x1cb
push edi
push 0x409960
call fcn.004649e6
xor eax, eax
push 0x208
push eax
mov dword [ebp - 0xe90], eax
mov dword [ebp - 0xe8c], eax
lea eax, [ebp - 0xe48]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0xe48]
push 0x104
push eax
push 0
call dword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
lea eax, [ebp - 0xe48]
push eax
lea ecx, [ebp - 0xe90]
call fcn.0046496f
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xe90]
push dword [ebx + 8]
push dword [ebx + 4]
push 0x7d3
call fcn.004649a0
mov ecx, dword [ebx]
push 0xffffffffffffffff
push eax
push dword [ebp - 0xe54]
mov esi, dword [ecx + 0x10]
mov ecx, esi
mov dword [ebx + 0xc], eax
call dword [0x4a3670]
mov ecx, ebx
call esi
lea ecx, [ebp - 0xe90]
call fcn.0043a882
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0xe58]
test eax, eax
je 0x4612cd
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x4a3670]
call esi
push dword [ebp - 0xe5c]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0xe4c]
test eax, eax
je 0x4612f7
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x4a3670]
call esi
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0xe50]
test eax, eax
je 0x46132e
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x4a3670]
call esi
jmp 0x46132e
mov ecx, dword [ebp + 4]
test edi, edi
jns 0x46132e
push edi
push 0x409960
mov edx, 0x1f9
call fcn.0045e47c
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0xe60]
test eax, eax
je 0x46134c
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x4a3670]
call esi
mov eax, edi
call fcn.0043bc10
ret 8