Function at 0x7cf4ec72
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b4
push esi
push edi
push dword [ebp + 8]
xor edi, edi
mov dword [ebp - 8], edi
call sym.SHELL32.dll_ILFindLastID
mov esi, eax
lea eax, [ebp - 0x2b4]
push 0x50
push eax
push esi
mov dword [ebp + 8], esi
call fcn.7cf4efc3
lea eax, [ebp - 0x2b4]
push eax
call fcn.7cf4f09e
cmp eax, edi
jne 0x7cf4efbd
test byte [esi + 2], 0x80
push ebx
je 0x7cf4ece4
push edi
push esi
call fcn.7cf4ec47
push eax
lea eax, [ebp - 0x214]
push 0x104
push eax
push esi
call fcn.7cf4e858
push eax
call fcn.7cf8d33d
test eax, eax
je 0x7cf4ece4
mov ebx, 0x10000000
jmp 0x7cf4ecf6
push esi
call fcn.7cf4ec47
mov ebx, eax
neg ebx
sbb ebx, ebx
and ebx, 0x8000000
lea eax, [ebp - 8]
push eax
push esi
call fcn.7cf8d912
test eax, eax
jge 0x7cf4ed31
push esi
call fcn.7cf4ec47
neg eax
sbb eax, eax
push edi
and eax, 3
push eax
push 0x7cf33370
call sym.SHELL32.dll_Ordinal_72
test eax, 0xfffff000
jne 0x7cf4ed26
or ebx, eax
or ebx, 0xc000000
jmp 0x7cf4efa5
lea eax, [ebp - 4]
mov esi, 0x208
push eax
lea eax, [ebp - 0x214]
push eax
push 0x7cf352d0
push dword [ebp - 8]
mov dword [ebp - 4], esi
call fcn.7cf5aef1
test eax, eax
jne 0x7cf4ed5b
or ebx, 0x20000
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
lea eax, [ebp - 0x214]
push eax
push 0x7cf3562c
push dword [ebp - 8]
call fcn.7cf5aef1
mov edi, dword [sym.imp.SHLWAPI.dll_Ordinal_461]
test eax, eax
jne 0x7cf4ed88
push 2
call edi
test al, 2
je 0x7cf4edaf
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
lea eax, [ebp - 0x214]
push eax
push 0x7cf35610
push dword [ebp - 8]
call fcn.7cf5aef1
test eax, eax
jne 0x7cf4edb5
push 2
call edi
test al, 2
jne 0x7cf4edb5
or ebx, 0x100000
push 0x7cf39960
push dword [ebp - 8]
call fcn.7cf50d61
test eax, eax
je 0x7cf4edcc
or ebx, 0x400000
lea eax, [ebp - 4]
mov edi, dword [sym.imp.SHLWAPI.dll_SHQueryValueExW]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x7cf355f8
push dword [ebp - 8]
mov dword [ebp - 4], esi
call edi
test eax, eax
jne 0x7cf4edf8
or ebx, 0x1000000
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x7cf355dc
push dword [ebp - 8]
call edi
test eax, eax
jne 0x7cf4ee1e
or ebx, 0x8000000
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x7cf355c0
push dword [ebp - 8]
call edi
test eax, eax
jne 0x7cf4ee44
or ebx, 0x10000000
test ebx, 0x20000
jne 0x7cf4efa2
lea eax, [ebp - 4]
and word [ebp - 0x214], 0
push eax
lea eax, [ebp - 0x214]
mov edi, 0x7cf33548
push eax
push edi
mov dword [ebp - 4], esi
push dword [ebp - 8]
call fcn.7cf5aef1
cmp word [ebp - 0x214], 0
jne 0x7cf4eeab
push dword [ebp - 8]
call fcn.7cf8e910
test eax, eax
mov dword [ebp - 0xc], eax
je 0x7cf4eeab
lea ecx, [ebp - 4]
mov dword [ebp - 4], esi
push ecx
lea ecx, [ebp - 0x214]
push ecx
push edi
push eax
call fcn.7cf5aef1
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [ebp - 0x214], 0
mov edi, 0x2000
jne 0x7cf4eefe
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
lea eax, [ebp - 0x214]
push eax
push 0x7cf35320
push dword [ebp - 8]
call fcn.7cf5aef1
test eax, eax
jne 0x7cf4eefe
cmp word [ebp - 0x214], ax
je 0x7cf4eefe
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveBlanksW]
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveArgsW]
or ebx, edi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
lea eax, [ebp - 0x214]
push 0x7cf35348
push eax
call esi
test eax, eax
je 0x7cf4ef9f
lea eax, [ebp - 0x214]
push 0x7cf35350
push eax
call esi
test eax, eax
je 0x7cf4ef9f
cmp word [ebp - 0x214], 0
je 0x7cf4ef76
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.SHLWAPI.dll_PathParseIconLocationW]
mov esi, ebx
shr esi, 0xd
and esi, 1
push esi
push eax
lea eax, [ebp - 0x214]
push eax
call sym.SHELL32.dll_Ordinal_72
cmp eax, 0xffffffff
jne 0x7cf4ef6b
push 0
push esi
push 0x7cf33370
call sym.SHELL32.dll_Ordinal_72
test eax, 0xfffff000
jne 0x7cf4efa5
or ebx, eax
jmp 0x7cf4efa5
push dword [ebp + 8]
call fcn.7cf4ec47
neg eax
sbb eax, eax
push 0
and eax, 3
push eax
push 0x7cf33370
call sym.SHELL32.dll_Ordinal_72
test eax, 0xfffff000
jne 0x7cf4ef9b
or ebx, eax
or ebx, edi
jmp 0x7cf4efa5
and bh, 0xdf
or bh, 0x10
push dword [ebp - 8]
call fcn.7cf50668
lea eax, [ebp - 0x2b4]
push ebx
push eax
call fcn.7cf50de6
mov eax, ebx
pop ebx
pop edi
pop esi
leave
ret 4