Function at 0x4657e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe30
mov eax, dword [0x8312b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
push 0x800
mov dword [ebp - 0xe24], eax
lea eax, [ebp - 0xe1c]
push 0
push eax
mov dword [ebp - 0xe30], ebx
call fcn.0070dcd0
add esp, 0xc
lea eax, [ebp - 0xe1c]
push ebx
push esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea ecx, [ebp - 0xe1c]
call fcn.00461b90
test al, al
jne 0x46585a
pop edi
pop esi
mov eax, 2
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006f4f1e
mov esp, ebp
pop ebp
ret 0x14
test edi, edi
je 0x465a74
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.0070dcd0
lea edx, [ebp - 0x414]
lea ecx, [ebp - 0xe1c]
call fcn.00462830
lea eax, [ebp - 0x414]
push edi
push eax
call fcn.00715821
add esp, 0x14
test eax, eax
jne 0x465a5c
mov esi, dword [ebp - 0xe24]
lea edi, [eax + 1]
xor bl, bl
test esi, esi
je 0x465a3b
push 0x208
push eax
lea eax, [ebp - 0x61c]
push eax
call fcn.0070dcd0
push esi
lea eax, [ebp - 0x61c]
push str.CLSID_sInProcServer32
push eax
call fcn.0045b740
add esp, 0x18
mov dword [ebp - 0xe28], 0
lea eax, [ebp - 0xe28]
push eax
movzx eax, byte [ebp + 0x18]
shl eax, 8
add eax, 0x20019
push eax
push 0
lea eax, [ebp - 0x61c]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x465a3d
push 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0070dcd0
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0xe2c]
add esp, 0xc
mov dword [ebp - 0xe2c], 0x104
mov dword [ebp - 0xe24], edi
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xe24]
push eax
push 0
push str.ThreadingModel
push dword [ebp - 0xe28]
call esi
test eax, eax
jne 0x465a0b
mov ecx, str.Both
lea eax, [ebp - 0x20c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x46599a
test dx, dx
je 0x465996
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x46599a
add eax, 4
add ecx, 4
test dx, dx
jne 0x465974
xor eax, eax
jmp 0x46599f
sbb eax, eax
or eax, 1
test eax, eax
jne 0x465a0b
push 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0070dcd0
add esp, 0xc
mov dword [ebp - 0xe2c], 0x104
lea eax, [ebp - 0xe2c]
mov dword [ebp - 0xe24], edi
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xe24]
push eax
push 0
push 0x7e6e28
push dword [ebp - 0xe28]
call esi
test eax, eax
jne 0x465a0b
push dword [ebp - 0xe30]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
movzx ebx, bl
cmovne ebx, edi
mov eax, dword [ebp - 0xe28]
test eax, eax
je 0x465a3d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
mov eax, 4
cmove edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006f4f1e
mov esp, ebp
pop ebp
ret 0x14
mov bl, 1
test bl, bl
mov eax, 4
cmove edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006f4f1e
mov esp, ebp
pop ebp
ret 0x14
pop edi
pop esi
mov eax, 3
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006f4f1e
mov esp, ebp
pop ebp
ret 0x14
mov bl, byte [ebp + 0x18]
lea edx, [ebp - 0xe1d]
mov al, bl
lea ecx, [ebp - 0xe1c]
xor al, 1
mov byte [ebp - 0xe1d], al
call fcn.00462c60
mov ecx, dword [ebp - 4]
xor eax, eax
cmp bl, byte [ebp - 0xe1d]
pop edi
sete al
xor ecx, ebp
pop esi
pop ebx
lea eax, [eax*2 + 1]
call fcn.006f4f1e
mov esp, ebp
pop ebp
ret 0x14