Function at 0x4066b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
mov eax, dword [0x4c6018]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0xe8]
push eax
call fcn.00427f90
mov eax, dword [ebp - 0x44]
cmp eax, 5
je 0x406901
cmp eax, 6
je 0x406901
lea ecx, [ebp - 0xec]
push ecx
push 3
push 0
cmp eax, 0xb
jne 0x4067df
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerAutoplayHandlers
push SysReAllocString
call edi
mov edx, dword [ebp - 0xec]
test eax, eax
jne 0x4067d9
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0xf8], eax
lea eax, [ebp - 0xfc]
push eax
lea ecx, [ebp - 0xf8]
push ecx
push 0
push 0
push str.DisableAutoplay
push edx
mov dword [ebp - 0xfc], 4
call esi
test eax, eax
je 0x40675a
mov eax, dword [ebp - 0xec]
push eax
jmp 0x406963
cmp dword [ebp - 0xf8], 1
jne 0x40676f
mov ecx, dword [ebp - 0xec]
push ecx
jmp 0x4068de
lea edx, [ebp - 0xec]
push edx
push 3
push 0
push str.SYSTEMCurrentControlSetServicesCdrom
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
mov eax, dword [ebp - 0xec]
jne 0x4068dd
lea ecx, [ebp - 0xf4]
push ecx
lea edx, [ebp - 0xf0]
push edx
push 0
push 0
push str.AutoRun
push eax
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0xf4], 4
call esi
test eax, eax
jne 0x406763
cmp dword [ebp - 0xf0], 1
je 0x40674e
mov edx, dword [ebp - 0xec]
push edx
jmp 0x4068de
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [ebp - 0xec]
test eax, eax
je 0x406804
push edx
jmp 0x406862
lea eax, [ebp - 0xf4]
push eax
lea ecx, [ebp - 0xf0]
push ecx
push 0
push 0
push str.NoDriveTypeAutoRun
push edx
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0xf4], 4
call edi
test eax, eax
je 0x40683f
mov eax, dword [ebp - 0xec]
push eax
jmp 0x406862
mov eax, dword [ebp - 0xf0]
cmp eax, 0xb5
je 0x406763
cmp eax, 0xff
je 0x406763
mov ecx, dword [ebp - 0xec]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0xec]
push edx
push 3
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push SysReAllocString
call esi
test eax, eax
mov eax, dword [ebp - 0xec]
jne 0x4068dd
lea ecx, [ebp - 0xfc]
push ecx
lea edx, [ebp - 0xf8]
push edx
push 0
push 0
push str.NoDriveTypeAutoRun
push eax
mov dword [ebp - 0xf8], 0
mov dword [ebp - 0xfc], 4
call edi
test eax, eax
jne 0x40695c
mov eax, dword [ebp - 0xf8]
cmp eax, 0xb5
je 0x4068d7
cmp eax, 0xff
jne 0x4069a5
mov eax, dword [ebp - 0xec]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0xe8]
call fcn.004280b0
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00449013
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0xec]
push edx
push 3
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
mov eax, dword [ebp - 0xec]
jne 0x4068dd
lea ecx, [ebp - 0xf4]
push ecx
lea edx, [ebp - 0xf0]
push edx
push 0
push 0
push str.NoDriveTypeAutoRun
push eax
mov dword [ebp - 0xf0], 0
mov dword [ebp - 0xf4], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x406989
mov ecx, dword [ebp - 0xec]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0xe8]
call fcn.004280b0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 1
pop esi
call fcn.00449013
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xf0]
cmp eax, 0xb5
je 0x4068d7
cmp eax, 0xff
je 0x4068d7
mov edx, dword [ebp - 0xec]
push edx
jmp 0x406963