Function at 0x404a10
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0xe8
mov rax, qword [0x00408550]
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0x108], rdi
xor edi, edi
cmp qword [0x004085c8], rdi
je 0x404a41
lea eax, [rdi + 1]
jmp 0x404d77
lea rax, [rsp + 0x84]
lea rdx, str.Software
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0x20019
mov qword [rsp + 0xe0], r12
mov qword [rsp + 0x70], rdi
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov r12, qword [rsp + 0x70]
test r12, r12
je 0x404d6d
lea rax, [rsp + 0x8c]
lea rdx, str.Micro_Focus
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x68]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov rcx, r12
mov dword [rsp + 0x28], 0x20019
mov qword [rsp + 0xd8], r13
mov qword [rsp + 0x68], rdi
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov r13, qword [rsp + 0x68]
test r13, r13
je 0x404d5c
lea rax, [rsp + 0x88]
lea rdx, str.NetExpress
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov rcx, r13
mov dword [rsp + 0x28], 0x20019
mov qword [rsp + 0xf0], rbx
mov qword [rsp + 0x58], rdi
mov dword [rsp + 0x20], edi
mov qword [rsp + 0x100], rsi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x404bf6
mov rsi, qword [rsp + 0x58]
test rsi, rsi
je 0x404bfb
mov rdx, qword [0x004085c0]
mov rbx, rdi
mov dword [rsp + 0x60], 0x13
test rdx, rdx
mov byte [rsp + 0x90], bl
je 0x404b96
xor r8d, r8d
mov rcx, rsi
call fcn.00404720
test rax, rax
mov rbx, rax
jne 0x404be1
mov rsi, qword [rsp + 0x58]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x7c]
lea rdx, str.DefaultVersion
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x90]
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x404be1
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x90]
xor r8d, r8d
call fcn.00404720
mov rbx, rax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, rbx
mov qword [rsp + 0x58], rbx
jmp 0x404bfb
mov rsi, qword [rsp + 0x58]
test rsi, rsi
je 0x404d43
lea rax, [rsp + 0x78]
lea rdx, str.COBOL
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov rcx, rsi
mov dword [rsp + 0x28], 0x20019
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x404d04
mov rbx, qword [rsp + 0x50]
test rbx, rbx
je 0x404d09
mov rdx, qword [0x004085c0]
mov qword [rsp + 0xf8], rbp
mov dword [rsp + 0x64], 0x13
test rdx, rdx
mov rbp, rdi
mov byte [rsp + 0xa8], dil
je 0x404c99
xor r8d, r8d
mov rcx, rbx
call fcn.00404720
test rax, rax
mov rbp, rax
jne 0x404ce7
mov rbx, qword [rsp + 0x50]
lea rax, [rsp + 0x64]
lea r9, [rsp + 0x80]
lea rdx, str.Version
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xa8]
xor r8d, r8d
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x404ce7
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0xa8]
xor r8d, r8d
call fcn.00404720
mov rbp, rax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, rbp
mov qword [rsp + 0x50], rbp
mov rbp, qword [rsp + 0xf8]
jmp 0x404d09
mov rbx, qword [rsp + 0x50]
test rbx, rbx
je 0x404d3a
lea rdx, str.Config
xor r8d, r8d
mov rcx, rbx
call fcn.00404720
test rax, rax
je 0x404d31
mov qword [0x004085c8], rax
mov edi, 1
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x100]
mov rbx, qword [rsp + 0xf0]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r13, qword [rsp + 0xd8]
mov r12, qword [rsp + 0xe0]
mov eax, edi
mov rdi, qword [rsp + 0x108]
mov rcx, qword [rsp + 0xc0]
call fcn.00405710
add rsp, 0xe8
ret