Function at 0x465750
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
mov eax, dword [0x5402b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 1
push edi
mov dword [ebp - 0x24c], eax
mov dword [ebp - 0x248], eax
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x226]
push ecx
mov word [ebp - 0x228], ax
call fcn.004c5470
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
add esp, 0xc
xor edx, edx
lea eax, [ebp - 0x250]
push eax
lea ecx, [ebp - 0x228]
push ecx
mov word [ebp - 0x240], dx
lea edx, [ebp - 0x248]
push edx
push str.Extension
push str.MIMEDatabaseContent_Typeimage_png
push SysReAllocStringLen
mov dword [ebp - 0x250], 0x208
mov dword [ebp - 0x22c], 7
mov dword [ebp - 0x230], 0
call edi
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov bl, 0xff
test eax, eax
je 0x46590c
cmp eax, 5
je 0x465a41
cmp eax, 2
jne 0x465810
mov dword [ebp - 0x248], 1
mov eax, dword [ebp - 0x248]
push 0
push 0x51c620
push eax
push 0x51c620
push str.MIMEDatabaseContent_Typeimage_png
push SysReAllocStringLen
call esi
mov ecx, dword [ebp - 0x248]
push 0xa
push str..png
push ecx
push str.Extension
push str.MIMEDatabaseContent_Typeimage_png
push SysReAllocStringLen
call esi
test eax, eax
je 0x46585b
cmp eax, 5
je 0x465a41
mov edx, dword [ebp - 0x248]
push 0x4e
push str.A3CCEDF7_2DE2_11D0_86F4_00A0C913F750
push edx
push str.Image_Filter_CLSID
push str.MIMEDatabaseContent_Typeimage_png
push SysReAllocStringLen
call esi
mov eax, dword [ebp - 0x248]
push 0
push 0x51c620
push eax
push 0x51c620
push str.MIMEDatabaseContent_Typeimage_pngBits
push SysReAllocStringLen
call esi
push 0x15
lea ecx, [ebp - 0x1c]
push ecx
push 3
push 0x51e60c
push str.MIMEDatabaseContent_Typeimage_pngBits
push SysReAllocStringLen
mov byte [ebp - 0x1c], 8
mov byte [ebp - 0x1b], 0
mov byte [ebp - 0x1a], 0
mov byte [ebp - 0x19], 0
mov byte [ebp - 0x18], bl
mov byte [ebp - 0x17], bl
mov byte [ebp - 0x16], bl
mov byte [ebp - 0x15], bl
mov byte [ebp - 0x14], bl
mov byte [ebp - 0x13], bl
mov byte [ebp - 0x12], bl
mov byte [ebp - 0x11], bl
mov byte [ebp - 0x10], 0x89
mov byte [ebp - 0xf], 0x50
mov byte [ebp - 0xe], 0x4e
mov byte [ebp - 0xd], 0x47
mov byte [ebp - 0xc], 0xd
mov byte [ebp - 0xb], 0xa
mov byte [ebp - 0xa], 0x1a
mov byte [ebp - 9], 0xa
mov byte [ebp - 8], 0
call esi
test eax, eax
je 0x46590c
mov dword [ebp - 0x24c], 0
lea edx, [ebp - 0x250]
push edx
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x248]
push ecx
push str.Extension
push str.MIMEDatabaseContent_Typeimage_x_png
push SysReAllocStringLen
mov dword [ebp - 0x248], 1
mov dword [ebp - 0x250], 0x208
call edi
test eax, eax
je 0x465a83
cmp eax, 5
je 0x465a41
cmp eax, 2
jne 0x465966
mov dword [ebp - 0x248], 1
mov edx, dword [ebp - 0x248]
push 0xa
push str..png
push edx
push str.Extension
push str.MIMEDatabaseContent_Typeimage_x_png
push SysReAllocStringLen
call esi
test eax, eax
je 0x465992
cmp eax, 5
je 0x465a41
mov eax, dword [ebp - 0x248]
push 0x4e
push str.A3CCEDF7_2DE2_11D0_86F4_00A0C913F750
push eax
push str.Image_Filter_CLSID
push str.MIMEDatabaseContent_Typeimage_x_png
push SysReAllocStringLen
call esi
mov ecx, dword [ebp - 0x248]
push 0
push 0x51c620
push ecx
push 0x51c620
push str.MIMEDatabaseContent_Typeimage_x_pngBits
push SysReAllocStringLen
call esi
push 0x14
lea edx, [ebp - 0x18]
push edx
push 3
push 0x51e60c
push str.MIMEDatabaseContent_Typeimage_x_pngBits
push SysReAllocStringLen
mov byte [ebp - 0x18], 8
mov byte [ebp - 0x17], 0
mov byte [ebp - 0x16], 0
mov byte [ebp - 0x15], 0
mov byte [ebp - 0x14], bl
mov byte [ebp - 0x13], bl
mov byte [ebp - 0x12], bl
mov byte [ebp - 0x11], bl
mov byte [ebp - 0x10], bl
mov byte [ebp - 0xf], bl
mov byte [ebp - 0xe], bl
mov byte [ebp - 0xd], bl
mov byte [ebp - 0xc], 0x89
mov byte [ebp - 0xb], 0x50
mov byte [ebp - 0xa], 0x4e
mov byte [ebp - 9], 0x47
mov byte [ebp - 8], 0xd
mov byte [ebp - 7], 0xa
mov byte [ebp - 6], 0x1a
mov byte [ebp - 5], 0xa
call esi
test eax, eax
je 0x465a83
mov dword [ebp - 0x24c], 0
jmp 0x465a83
cmp byte [ebp + 8], 0
je 0x465a83
xor eax, eax
mov word [ebp - 0x1c], ax
push 0xa
mov eax, str.asADforPic
lea esi, [ebp - 0x20]
mov dword [ebp - 8], 7
mov dword [ebp - 0xc], 0
call fcn.004017f0
mov edi, esi
call fcn.00465680
cmp dword [ebp - 8], 8
jb 0x465a83
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.004c097a
add esp, 4
cmp dword [ebp - 0x22c], 8
pop edi
pop esi
pop ebx
jb 0x465a9e
mov edx, dword [ebp - 0x240]
push edx
call fcn.004c097a
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x24c]
xor ecx, ebp
call fcn.004c0985
mov esp, ebp
pop ebp
ret 4