Function at 0x4596c0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a20cc
mov eax, dword fs:[0]
push eax
sub esp, 0x4a8
mov eax, dword [0x50c0b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x4ac], 0
lea ecx, [ebp - 0x4a4]
call fcn.00421ed0
mov dword [ebp - 4], 0
mov ecx, 0x1a
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths
lea edi, [ebp - 0x78]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x494], 0
lea eax, [ebp - 0x494]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x78]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x459961
push 0x208
push 0
lea edx, [ebp - 0x280]
push edx
call sub.MSVCR110.dll_memset
add esp, 0xc
mov dword [ebp - 0x4a8], 0
mov dword [ebp - 0x4a0], 0
jmp 0x459782
mov eax, dword [ebp - 0x4a0]
add eax, 1
mov dword [ebp - 0x4a0], eax
cmp dword [ebp - 0x4a8], 0
jne 0x459954
mov dword [ebp - 0x4b0], 0x104
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x4b0]
push ecx
lea edx, [ebp - 0x280]
push edx
mov eax, dword [ebp - 0x4a0]
push eax
mov ecx, dword [ebp - 0x494]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0x4a8], eax
cmp dword [ebp - 0x4a8], 0
jne 0x45994f
lea edx, [ebp - 0x280]
push edx
lea ecx, [ebp - 0x490]
call fcn.00421e50
mov byte [ebp - 4], 1
lea eax, [ebp - 0x280]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
lea ecx, [ebp - 0x280]
push ecx
lea ecx, [ebp - 0x498]
call fcn.00421e50
mov byte [ebp - 4], 2
mov edx, dword [ebp + 0xc]
push edx
lea ecx, [ebp - 0x490]
call fcn.00461460
test eax, eax
je 0x459839
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x498]
call fcn.00461460
test eax, eax
jne 0x459931
lea ecx, [ebp - 0x78]
push ecx
lea ecx, [ebp - 0x48c]
call fcn.00421e50
mov byte [ebp - 4], 3
push 0x4b14e0
lea ecx, [ebp - 0x48c]
call fcn.00460ab0
lea edx, [ebp - 0x490]
push edx
lea ecx, [ebp - 0x48c]
call fcn.00460a90
mov dword [ebp - 0x49c], 0
lea eax, [ebp - 0x49c]
push eax
push 1
push 0
lea ecx, [ebp - 0x48c]
call fcn.00431330
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x459902
push 0x208
push 0
lea ecx, [ebp - 0x488]
push ecx
call sub.MSVCR110.dll_memset
add esp, 0xc
mov dword [ebp - 0x4b4], 0x208
lea edx, [ebp - 0x4b4]
push edx
lea eax, [ebp - 0x488]
push eax
push 0
push 0
push 0
mov ecx, dword [ebp - 0x49c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4598f5
lea edx, [ebp - 0x488]
push edx
lea ecx, [ebp - 0x4a4]
call fcn.0042ee70
mov eax, dword [ebp - 0x49c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x48c]
call fcn.0042a1b0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x498]
call fcn.0042a1b0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x490]
call fcn.0042a1b0
jmp 0x459954
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x498]
call fcn.0042a1b0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x490]
call fcn.0042a1b0
jmp 0x459773
mov ecx, dword [ebp - 0x494]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x4a4]
push edx
mov ecx, dword [ebp + 8]
call fcn.00421e30
mov eax, dword [ebp - 0x4ac]
or eax, 1
mov dword [ebp - 0x4ac], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4a4]
call fcn.0042a1b0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049a2a4
mov esp, ebp
pop ebp
ret