Function at 0x406ce0
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
mov dword [ebp - 0xc], 0
je 0x406d5e
cmp dword [ebp + 0xc], 0
je 0x406d5e
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x406d5e
mov ecx, dword [ebp + 0x14]
test ecx, ecx
je 0x406d5e
mov dword [ecx], 0xffffffff
mov edi, dword [eax]
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0x402c0c
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, eax
test ecx, ecx
je 0x406db4
cmp ecx, 2
jne 0x406d8a
mov eax, dword [0x40f790]
mov esi, dword [eax]
mov esi, dword [esi + 4]
mov ecx, esi
test edi, edi
jne 0x406d69
push 0x402c0c
push 0x1e
push edi
push eax
call dword [0x41022c]
call esi
add esp, 0x10
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push edi
push 0x402c0c
push 0x27
push 0
push eax
call dword [0x41022c]
call esi
add esp, 0x14
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov edi, dword [0x40f790]
push 0x402c0c
push 0x14
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x41022c]
mov ecx, edi
call esi
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x200
call fcn.00408c00
mov ebx, eax
add esp, 4
mov dword [ebp - 0x20], ebx
test ebx, ebx
je 0x4070b8
xor eax, eax
mov dword [ebp - 8], 0x100
mov dword [ebp - 0x10], eax
xor esi, esi
lea eax, [ebp - 0x28]
mov dword [ebp - 4], esi
push eax
push esi
push esi
push esi
lea eax, [ebp - 8]
mov dword [ebp - 0x1c], 1
push eax
push ebx
push esi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov ecx, eax
cmp ecx, 0x103
je 0x40709c
lea ebx, [ebx]
test ecx, ecx
jne 0x407093
push ebx
mov dword [ebp - 0x14], ecx
call fcn.004079a0
test al, al
jne 0x406f92
push ebx
call fcn.004079a0
test al, al
jne 0x406f92
push 0x2e
push ebx
call dword [sym.imp.msvcrt.dll_wcschr]
push 0
push ebx
mov edi, eax
call dword [sym.imp.msvcrt.dll_wcschr]
mov esi, eax
add esp, 0x10
test esi, esi
je 0x406f8f
test edi, edi
je 0x406e77
lea eax, [ebp - 0x14]
push eax
push edi
push ebx
call fcn.0040d76b
test al, al
je 0x406f8f
mov eax, dword [ebp - 0x14]
add edi, 2
jmp 0x406eea
mov ax, word [esi]
mov ecx, ebx
sub ax, 0x30
cmp ax, 9
jbe 0x406f8f
xor eax, eax
cmp ax, word [ebx]
je 0x406f8f
cmp ebx, esi
jae 0x406f8f
lea ecx, [ecx]
cmp word [ecx], 0x30
jne 0x406ead
add ecx, 2
cmp ecx, esi
jb 0x406ea0
mov eax, esi
sub eax, ecx
and eax, 0xfffffffe
cmp eax, 0x14
jg 0x406f8f
push 0xa
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push eax
push ecx
call dword [sym.imp.msvcrt.dll_wcstoul]
add esp, 0xc
cmp esi, dword [ebp - 0x18]
jne 0x406f8f
cmp eax, 0x7fffffff
ja 0x406f8f
xor edi, edi
mov esi, dword [ebp - 4]
test edi, edi
jne 0x406f92
cmp eax, esi
jle 0x406f92
mov esi, dword [ebp - 8]
mov dword [ebp - 4], eax
inc esi
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x406f15
push eax
call dword [sym.imp.msvcrt.dll____V_YAXPAX_Z]
add esp, 4
xor ecx, ecx
mov eax, esi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00408c00
add esp, 4
mov dword [ebp - 0x10], eax
test eax, eax
je 0x4070b8
test esi, esi
je 0x4070b8
cmp esi, 0x7fffffff
ja 0x407057
mov edx, SysReAllocString
mov edi, ebx
sub edx, esi
mov ecx, eax
sub edi, eax
lea esp, [esp]
lea eax, [edx + esi]
test eax, eax
je 0x406f82
movzx eax, word [edi + ecx]
test ax, ax
je 0x406f7b
mov word [ecx], ax
add ecx, 2
sub esi, 1
jne 0x406f60
test esi, esi
jne 0x406f82
sub ecx, 2
xor eax, eax
mov word [ecx], ax
test esi, esi
je 0x4070b8
mov esi, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
mov eax, ecx
inc ecx
mov dword [ebp - 8], 0x100
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x28]
push ecx
push 0
push 0
push 0
lea ecx, [ebp - 8]
push ecx
push ebx
push eax
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov ecx, eax
cmp ecx, 0x103
jne 0x406e10
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x40709c
mov edi, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov ebx, dword [ebp + 0xc]
push eax
mov dword [edi], eax
lea eax, [ebp - 0x1c]
push 0x17
push eax
push ebx
push 0x402c98
push 0x40f78c
mov dword [ecx], esi
call fcn.004079d0
add esp, 0x18
test al, al
je 0x4070b8
push dword [ebp + 8]
mov esi, dword [edi]
mov edi, dword [ebx]
mov bl, 1
push 0x20019
push 0
push edi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, eax
test ecx, ecx
je 0x4070ba
cmp ecx, 2
jne 0x407074
mov eax, dword [0x40f790]
test esi, esi
mov esi, dword [eax]
mov esi, dword [esi + 4]
mov ecx, esi
jne 0x40705e
push edi
push 0x1e
push 0
push eax
call dword [0x41022c]
call esi
add esp, 0x10
jmp 0x4070b8
xor ecx, ecx
mov word [eax], cx
jmp 0x4070b8
push dword [ebp - 0x1c]
push edi
push 0x27
push 0
push eax
call dword [0x41022c]
call esi
add esp, 0x14
jmp 0x4070b8
push dword [ebp - 0x18]
push 0x14
mov edi, dword [0x40f790]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x41022c]
mov ecx, edi
call esi
jmp 0x4070b8
push 0x402c0c
push 0x13
jmp 0x407079
mov eax, dword [0x40f790]
push 0x1d
push 0
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 4]
mov ecx, esi
call dword [0x41022c]
call esi
add esp, 0xc
xor bl, bl
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4070c8
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x4070d9
push eax
call dword [sym.imp.msvcrt.dll____V_YAXPAX_Z]
add esp, 4
pop edi
pop esi
invalid