Function at 0x10046340
Capabilities:
Check if file exists
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x6d4
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x6d0], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
xor ebx, ebx
push 0x3ff
lea ecx, [esp + 0x2dd]
push ebx
mov esi, 0x177
push ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ebx
lea edi, [esi - 0x51]
mov byte [esp + 0x1f], bl
mov byte [esp + 0x2e4], bl
call fcn.100d4cc0
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0xe6]
push eax
mov word [esp + 0xe8], dx
call fcn.100d4cc0
push 0x81
lea ecx, [esp + 0x65]
push ebx
push ecx
mov byte [esp + 0x6c], bl
call fcn.100d4cc0
xor ecx, ecx
add esp, 0x24
cmp dword [esp + 0x24], ecx
je case.default.0x100463d9
mov eax, dword [ebp + 8]
dec eax
cmp eax, 3
ja case.default.0x100463d9
jmp dword [eax*4 + 0x1004672c]
lea edx, [esp + 0xd0]
push edx
push ecx
push ecx
push 0x1a
push ecx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push str.key.dat
lea eax, [esp + 0xd4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [esp + 0xd0]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100465a5
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x2dc]
lea eax, [esp + 0xd4]
call fcn.10046290
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x100465a5
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6d0]
xor ecx, esp
call fcn.100d0738
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0xd0]
push eax
push ecx
push ecx
push 0x1c
push ecx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push str.storage.bin
lea ecx, [esp + 0xd4]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [esp + 0xd0]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100465a5
lea eax, [esp + 0x14]
push eax
jmp 0x10046421
lea edx, [esp + 0x18]
push edx
push 0x20019
push ecx
push str.SoftwareMicrosoftWindowsCurrentVersionSET
push SysReAllocString
mov dword [esp + 0x34], ecx
mov dword [esp + 0x2c], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100465a5
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x14]
push eax
push 0
lea ecx, [esp + 0x28]
push ecx
push 0
push str.data
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [esp + 0x14]
add eax, 0xfffffe60
cmp eax, 0x25f
ja 0x1004651a
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x2dc]
push edx
lea eax, [esp + 0x28]
push eax
push 0
push str.data
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [esp + 0x18]
push edx
jmp 0x1004659f
lea eax, [esp + 0x18]
push eax
push 0x20019
push ecx
push str.SoftwareMicrosoftWindowsCurrentVersionSettings_storage
push SysReAllocString
mov dword [esp + 0x34], ecx
mov dword [esp + 0x2c], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100465a5
lea ecx, [esp + 0x14]
push ecx
push eax
lea edx, [esp + 0x28]
push edx
push eax
mov eax, dword [esp + 0x28]
push str.data
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffe60
cmp ecx, 0x25f
ja 0x1004659a
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x2dc]
push eax
lea ecx, [esp + 0x28]
push ecx
push 0
push str.data
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x14]
lea ecx, [eax - 0x1a0]
cmp ecx, 0x260
ja case.default.0x100463d9
cmp eax, 0x288
ja 0x100465cb
xor ebx, ebx
mov byte [esp + 0x13], 1
jmp 0x1004660b
cmp eax, 0x290
jne 0x100465de
mov ebx, 0x84
mov byte [esp + 0x13], 2
jmp 0x1004660b
cmp eax, 0x2f0
jb 0x1004660b
cmp dword [esp + 0x498], 0
mov edi, 0x18a
lea esi, [edi + 0x51]
mov ebx, 0x84
je 0x10046606
mov byte [esp + 0x13], 5
lea esi, [edi + 0x27]
jmp 0x1004660b
mov byte [esp + 0x13], 4
lea eax, [esp + edi + 0x2d8]
movzx eax, word [eax]
mov edx, 0x7de
cmp ax, dx
jb case.default.0x100463d9
mov ecx, 0x7e4
cmp ax, cx
ja case.default.0x100463d9
mov edi, dword [esp + 0x24]
lea esi, [esp + esi + 0x2d8]
mov ecx, 8
rep movsd dword es:[edi], dword [esi]
test ebx, ebx
je 0x10046682
lea edx, [esp + ebx + 0x2d8]
call fcn.10045dc0
test al, al
jne 0x10046675
push edx
call fcn.10045460
mov esi, eax
mov ecx, 0x20
lea edi, [esp + 0x4c]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.100d1800
add esp, 8
jmp 0x10046682
mov ecx, 0x20
mov esi, edx
lea edi, [esp + 0x48]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x24]
mov edx, dword [esi]
xor eax, eax
mov byte [esp + 0x28], 0
mov dword [esp + 0x29], eax
mov dword [esp + 0x2d], eax
mov dword [esp + 0x31], eax
mov dword [esp + 0x35], eax
mov dword [esp + 0x39], eax
mov dword [esp + 0x3d], eax
mov dword [esp + 0x41], eax
mov word [esp + 0x45], ax
mov byte [esp + 0x47], al
cmp edx, dword [esp + 0x28]
je case.default.0x100463d9
cmp byte [esp + 0x13], 5
jb 0x100466e7
mov edx, esi
mov ecx, esi
call fcn.10045e10
test eax, eax
jne 0x100466eb
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x6d0]
xor ecx, esp
call fcn.100d0738
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x1c]
cmp byte [esp + 0x13], 2
jb 0x1004670d
lea eax, [esp + 0x48]
push eax
mov eax, esi
call fcn.10046220
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
je case.default.0x100463d9
xor ecx, ecx
test eax, eax
setne cl
pop edi
pop esi
pop ebx
mov eax, ecx
mov ecx, dword [esp + 0x6d0]
xor ecx, esp
call fcn.100d0738
mov esp, ebp
pop ebp
ret