Function at 0x6cde79d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6ce19491
mov eax, dword fs:[0]
push eax
sub esp, 0x224
mov eax, dword [0x6ce5c008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x21c]
push 0x6ce4378c
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x21c], 0
call fcn.6cdbef90
mov dword [ebp - 4], 0
call fcn.6cde5990
test eax, eax
je 0x6cde7ac3
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
lea eax, [ebp - 0x220]
push eax
call sym.QQLiveBase.dll_class_ATL::CStringT_wchar_t__class_ATL::StrTraitATL_wchar_t__class_ATL::ChTraitsCRT_wchar_t______cdecl_base::GetModuleFolder_struct_HINSTANCE____
add esp, 8
push eax
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 1
call fcn.6cddbbc0
mov byte [ebp - 4], 0
or esi, 0xffffffff
mov edx, dword [ebp - 0x220]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x6cde7a85
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x21c]
lea ecx, [ecx - 0x10]
call fcn.6cddbc30
add eax, 0x10
mov dword [ebp - 4], 0xffffffff
mov dword [edi], eax
mov eax, dword [ebp - 0x21c]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], esi
dec esi
test esi, esi
jg 0x6cde7c69
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
jmp 0x6cde7c69
lea eax, [ebp - 0x220]
mov dword [ebp - 0x228], 0
push eax
call sym.QQLiveBase.dll_class_ATL::CStringT_wchar_t__class_ATL::StrTraitATL_wchar_t__class_ATL::ChTraitsCRT_wchar_t______cdecl_base::GetRegQQLiveRootPath_void_
add esp, 4
lea ecx, [ebp - 0x228]
push ecx
push dword [eax]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov edx, dword [ebp - 0x220]
or esi, 0xffffffff
mov ebx, eax
add edx, 0xfffffff0
mov ecx, esi
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x6cde7b12
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test ebx, ebx
jne 0x6cde7c34
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x220], 0x104
lea eax, [ebp - 0x220]
mov dword [ebp - 0x224], 1
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x224]
push eax
push ebx
push str.Install
push dword [ebp - 0x228]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x6cde7c28
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x6cde7b80
sub ecx, edx
sar ecx, 1
jne 0x6cde7bdc
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
lea eax, [ebp - 0x22c]
push eax
call sym.QQLiveBase.dll_class_ATL::CStringT_wchar_t__class_ATL::StrTraitATL_wchar_t__class_ATL::ChTraitsCRT_wchar_t______cdecl_base::GetModuleFolder_struct_HINSTANCE____
add esp, 8
push eax
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 2
call fcn.6cddbbc0
mov byte [ebp - 4], 0
mov eax, esi
mov edx, dword [ebp - 0x22c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x6cde7c28
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x6cde7c28
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.6cdbf1d0
push 0x5c
push dword [ebp - 0x21c]
call dword [sym.imp.VCRUNTIME140.dll_wcsrchr]
mov ecx, dword [ebp - 0x21c]
mov edx, eax
add esp, 8
test edx, edx
jne 0x6cde7c10
or edx, 0xffffffff
jmp 0x6cde7c14
sub edx, ecx
sar edx, 1
mov eax, dword [ecx - 0xc]
dec eax
cmp edx, eax
je 0x6cde7c28
push ecx
lea ecx, [ebp - 0x21c]
call fcn.6cde9150
push dword [ebp - 0x228]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x21c]
lea ecx, [ecx - 0x10]
call fcn.6cddbc30
mov dword [ebp - 4], 0xffffffff
add eax, 0x10
mov edx, dword [ebp - 0x21c]
mov dword [edi], eax
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x6cde7c69
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.6ce11901
mov esp, ebp
pop ebp
ret