Function at 0x406bd0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x5014
call fcn.00472b30
mov eax, dword [0x13413f8]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x18]
call fcn.004049c0
mov dword [ebp - 0x5008], 0
lea eax, [ebp - 0x5008]
push eax
push 1
push 0
mov ecx, dword [ebp + 0xc]
call fcn.00401c20
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x406c22
xor al, al
jmp 0x406e3c
xor edx, edx
mov word [ebp - 0x5004], dx
push 0x4ffe
push 0
lea eax, [ebp - 0x5002]
push eax
call fcn.004f3400
add esp, 0xc
mov dword [ebp - 0x5010], 0x2800
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
mov dword [ebp - 0x5014], edx
lea eax, [ebp - 0x5010]
push eax
lea ecx, [ebp - 0x5004]
push ecx
lea edx, [ebp - 0x5014]
push edx
push 0
mov ecx, dword [ebp + 0x10]
call fcn.00401c20
push eax
mov eax, dword [ebp - 0x5008]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x500c], eax
cmp dword [ebp - 0x500c], 0
jne 0x406d29
mov ecx, dword [ebp + 0x14]
cmp dword [ecx], 1
jne 0x406caf
lea edx, [ebp - 0x5004]
push edx
mov ecx, dword [ebp + 0x18]
call fcn.004070c0
jmp 0x406d10
mov eax, dword [ebp + 0x14]
cmp dword [eax], 4
je 0x406cbf
mov ecx, dword [ebp + 0x14]
cmp dword [ecx], 3
jne 0x406cf2
mov edx, dword [ebp - 0x5004]
push edx
push 0x59cdf4
push 0xffffffffffffffff
push 0x2800
lea eax, [ebp - 0x5004]
push eax
call fcn.004067b0
add esp, 0x14
lea ecx, [ebp - 0x5004]
push ecx
mov ecx, dword [ebp + 0x18]
call fcn.004070c0
jmp 0x406d10
mov edx, dword [ebp + 0x14]
cmp dword [edx], 7
jne 0x406d10
mov eax, dword [ebp - 0x5010]
push eax
lea ecx, [ebp - 0x5004]
push ecx
mov ecx, dword [ebp + 0x18]
call fcn.00406510
mov edx, dword [ebp - 0x5008]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x406e3c
cmp dword [ebp - 0x500c], 2
jne 0x406e2d
lea eax, [ebp - 0x5008]
push eax
push 0x101
push 0
mov ecx, dword [ebp + 0xc]
call fcn.00401c20
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x406d62
xor al, al
jmp 0x406e3c
lea edx, [ebp - 0x5010]
push edx
lea eax, [ebp - 0x5004]
push eax
lea ecx, [ebp - 0x5014]
push ecx
push 0
mov ecx, dword [ebp + 0x10]
call fcn.00401c20
push eax
mov edx, dword [ebp - 0x5008]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x500c], eax
cmp dword [ebp - 0x500c], 0
jne 0x406e2d
mov eax, dword [ebp + 0x14]
cmp dword [eax], 1
jne 0x406dbb
lea ecx, [ebp - 0x5004]
push ecx
mov ecx, dword [ebp + 0x18]
call fcn.004070c0
jmp 0x406e1c
mov edx, dword [ebp + 0x14]
cmp dword [edx], 4
je 0x406dcb
mov eax, dword [ebp + 0x14]
cmp dword [eax], 3
jne 0x406dfe
mov ecx, dword [ebp - 0x5004]
push ecx
push 0x59cdfc
push 0xffffffffffffffff
push 0x2800
lea edx, [ebp - 0x5004]
push edx
call fcn.004067b0
add esp, 0x14
lea eax, [ebp - 0x5004]
push eax
mov ecx, dword [ebp + 0x18]
call fcn.004070c0
jmp 0x406e1c
mov ecx, dword [ebp + 0x14]
cmp dword [ecx], 7
jne 0x406e1c
mov edx, dword [ebp - 0x5010]
push edx
lea eax, [ebp - 0x5004]
push eax
mov ecx, dword [ebp + 0x18]
call fcn.00406510
mov ecx, dword [ebp - 0x5008]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x406e3c
mov edx, dword [ebp - 0x5008]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00472312
mov esp, ebp
pop ebp
ret