Function at 0x42791b
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2ec
mov eax, dword [0x4a02f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
lea eax, [ebp - 0x298]
push ebx
push eax
call fcn.004403d6
pop ecx
pop ecx
lea eax, [ebp - 0x298]
push eax
lea ecx, [ebp - 0x260]
call fcn.00401f50
push eax
call fcn.00404ed0
neg al
sbb al, al
pop ecx
inc al
lea ecx, [ebp - 0x260]
mov byte [ebp - 0x2d1], al
call fcn.00401f80
cmp byte [ebp - 0x2d1], bl
je 0x42798b
push ebx
push 1
lea ecx, [ebp - 0x298]
call fcn.00402b70
jmp 0x427c6c
push esi
push edi
xor eax, eax
push 7
mov word [ebp - 0x27c], ax
pop esi
lea eax, [ebp - 0x27c]
push eax
mov dword [ebp - 0x268], esi
mov dword [ebp - 0x26c], ebx
call fcn.0042e23d
pop ecx
push ebx
test al, al
jne 0x4279bf
xor edi, edi
inc edi
jmp 0x427c51
call dword [sym.imp.ole32.dll_OleInitialize]
xor edi, edi
inc edi
test eax, eax
js 0x427c50
push edi
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
lea eax, [ebp - 0x298]
push eax
lea ecx, [ebp - 0x2b4]
call fcn.00401f50
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x2b4]
call fcn.00401a30
push eax
lea ecx, [ebp - 0x2b4]
call fcn.00401490
lea ecx, [ebp - 0x260]
call fcn.00401f80
xor eax, eax
push str.plugins
lea ecx, [ebp - 0x260]
mov dword [ebp - 0x24c], esi
mov dword [ebp - 0x250], ebx
mov word [ebp - 0x260], ax
call fcn.00401fb0
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x2d0]
call fcn.00401f50
push eax
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x2b4]
call fcn.00401b70
push eax
lea ecx, [ebp - 0x2b4]
call fcn.00401490
lea ecx, [ebp - 0x228]
call fcn.00401f80
lea ecx, [ebp - 0x2d0]
call fcn.00401f80
push ebx
push edi
lea ecx, [ebp - 0x260]
call fcn.00402b70
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push ebx
push eax
call fcn.0046e0e0
add esp, 0xc
lea eax, [ebp - 0x2e8]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x2ec]
push eax
push ebx
push str.CLSID7978461C_CC22_48F2_BC69_02220D3E101DInprocServer32
push SysReAllocString
mov dword [ebp - 0x2ec], edi
mov dword [ebp - 0x2e8], 0x208
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x427aef
sub eax, edx
sar eax, 1
je 0x427b15
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x427c3f
xor eax, eax
push str.pta.dll
lea ecx, [ebp - 0x244]
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x234], ebx
mov word [ebp - 0x244], ax
call fcn.00401fb0
xor eax, eax
push str.itrusenroll.dll
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x218], ebx
mov word [ebp - 0x228], ax
call fcn.00401fb0
lea eax, [ebp - 0x244]
mov dword [ebp - 0x2dc], eax
mov dword [ebp - 0x2d8], 2
push dword [ebp - 0x2dc]
lea eax, [ebp - 0x2d0]
push eax
lea ecx, [ebp - 0x2b4]
call fcn.00401a30
push eax
lea ecx, [ebp - 0x260]
call fcn.00401f50
lea ecx, [ebp - 0x2d0]
call fcn.00401f80
cmp dword [ebp - 0x24c], 8
mov eax, dword [ebp - 0x260]
jae 0x427bb9
lea eax, [ebp - 0x260]
push 8
push ebx
push eax
mov dword [ebp - 0x2e0], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
cmp esi, 0x20
jbe 0x427bff
push 0x4908f4
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x2e4], eax
cmp eax, ebx
je 0x427bf8
push dword [ebp - 0x2e0]
call fcn.0045979e
pop ecx
call dword [ebp - 0x2e4]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebx
push edi
lea ecx, [ebp - 0x260]
call fcn.00402b70
add dword [ebp - 0x2dc], 0x1c
dec dword [ebp - 0x2d8]
jne 0x427b75
lea esi, [ebp - 0x20c]
mov dword [ebp - 0x2d8], edi
push ebx
sub esi, 0x1c
push edi
mov ecx, esi
call fcn.00402b70
dec dword [ebp - 0x2d8]
jns 0x427c2b
call dword [sym.imp.ole32.dll_OleUninitialize]
lea ecx, [ebp - 0x2b4]
call fcn.00401f80
push ebx
push edi
lea ecx, [ebp - 0x27c]
call fcn.00402b70
push ebx
push edi
lea ecx, [ebp - 0x298]
call fcn.00402b70
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0046e0cd
leave
ret