Function at 0x455f40
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4bc486
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44c
push ebx
push edi
xor edi, edi
mov ebx, ecx
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x45c], edi
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
mov eax, dword [esp + 0x464]
push 0x2001f
push eax
push reloc.WS2_32.dll_accept
lea ecx, [esp + 0x24]
mov byte [esp + 0x468], 1
call fcn.004430d0
test eax, eax
je 0x455fbd
mov eax, dword [esp + 0x18]
cmp eax, edi
je 0x455fb6
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x456192
push ebp
mov ebp, dword [esp + 0x1c]
push esi
push 0x2001f
push str.Recent_Document_List
push ebp
lea ecx, [esp + 0x20]
call fcn.004430d0
test eax, eax
je 0x455ffa
mov eax, dword [esp + 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, edi
je 0x455fec
push eax
call esi
cmp ebp, edi
je 0x455ff3
push ebp
call esi
xor eax, eax
jmp 0x456190
mov ebp, dword [esp + 0x14]
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x18]
push eax
push edi
push str.DocumentCount
mov esi, 4
push ebp
mov dword [esp + 0x44], edi
mov dword [esp + 0x48], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, edi
jne 0x456031
cmp dword [esp + 0x10], esi
je 0x456050
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebp, edi
je 0x45603e
push ebp
call esi
mov eax, dword [esp + 0x20]
cmp eax, edi
je 0x456049
push eax
call esi
xor eax, eax
jmp 0x456190
mov eax, dword [esp + 0x2c]
cmp eax, 2
jge 0x456060
mov eax, 2
jmp 0x45606a
cmp eax, 0x10
jle 0x45606a
mov eax, 0x10
mov dword [ebx + 0xc], eax
mov eax, dword [ebx]
cmp eax, edi
je 0x45607e
push eax
call fcn.0049e91c
add esp, 4
mov dword [ebx], edi
push 0x206
lea edx, [esp + 0x52]
xor ecx, ecx
push edi
push edx
mov dword [ebx + 4], edi
mov dword [ebx + 8], edi
mov word [esp + 0x58], cx
call fcn.0049e6e0
mov esi, dword [ebx + 0xc]
add esp, 0xc
cmp esi, edi
jle 0x456149
mov ebp, 0x104
mov edi, edi
push esi
xor eax, eax
push str.Document_i
lea ecx, [esp + 0x3c]
push 0xb
push ecx
mov word [esp + 0x44], ax
mov dword [esp + 0x46], eax
mov dword [esp + 0x4a], eax
mov dword [esp + 0x4e], eax
mov dword [esp + 0x52], eax
mov dword [esp + 0x56], eax
call fcn.004417b0
add esp, 0x10
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x3c]
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x1c], ebp
call fcn.00452360
test eax, eax
jne 0x45613c
lea edx, [esp + 0x4c]
push edx
lea eax, [esp + 0x258]
push ebp
push eax
call fcn.0049e538
add esp, 0xc
cmp eax, 0x50
ja case.0x456126.599
movzx ecx, byte [eax + 0x4561dc]
jmp dword [ecx*4 + 0x4561cc]
lea edx, [esp + 0x254]
push edx
mov ecx, ebx
call fcn.00444320
dec esi
cmp esi, edi
jg 0x4560b0
mov ebp, dword [esp + 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebp, edi
je 0x45615c
push ebp
call esi
mov dword [esp + 0x14], edi
mov ebp, edi
mov eax, dword [esp + 0x20]
mov dword [esp + 0x18], edi
cmp eax, edi
je 0x45616f
push eax
call esi
mov dword [esp + 0x20], edi
mov ecx, ebx
mov dword [esp + 0x24], edi
call fcn.00442720
mov ebx, eax
cmp ebp, edi
je 0x456183
push ebp
call esi
mov eax, dword [esp + 0x20]
cmp eax, edi
je 0x45618e
push eax
call esi
mov eax, ebx
pop esi
pop ebp
mov ecx, dword [esp + 0x454]
pop edi
pop ebx
mov dword fs:[0], ecx
add esp, 0x458
ret 4
push 0x8007000e
call fcn.004413b0
push 0x80070057
call fcn.004413b0
push 0x80004005
call fcn.004413b0
lea ecx, [ecx]
sub eax, 0xab004561
popal
inc ebp
add byte [ebp - 0x40ffba9f], dh
popal
inc ebp
add byte [eax], al
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ecx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [eax]
int3