Function at 0x405c87
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa88
mov dword [ebp - 0xa88], 0
mov dword [ebp - 0x874], 0
mov dword [ebp - 0x870], 0x104
mov dword [ebp - 0x664], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x65c], 0
mov eax, dword [ebp + 0x10]
push eax
push 1
call fcn.00402b05
add esp, 8
lea ecx, [ebp - 0xa88]
push ecx
push 0x20019
push 0
mov edx, dword [ebp + 0x10]
add edx, 0x618
push edx
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x65c], eax
cmp dword [ebp - 0x65c], 0
je 0x405d0e
jmp 0x405f58
lea eax, [ebp - 0x87c]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 0x870]
push ecx
lea edx, [ebp - 0xa84]
push edx
mov eax, dword [ebp - 0x874]
push eax
mov ecx, dword [ebp - 0xa88]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0x65c], eax
cmp dword [ebp - 0x65c], 0
jne 0x405f18
lea edx, [ebp - 0x664]
push edx
push 0x20019
push 0
lea eax, [ebp - 0xa84]
push eax
mov ecx, dword [ebp - 0xa88]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x65c], eax
cmp dword [ebp - 0x65c], 0
je 0x405d86
jmp 0x405f56
mov dword [ebp - 4], 0x208
mov word [ebp - 0x86c], 0
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x86c]
push eax
lea ecx, [ebp - 0x660]
push ecx
push 0
push 0x40c19c
mov edx, dword [ebp - 0x664]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x405eda
lea eax, [ebp - 0x86c]
push eax
call sub.MSVCRT.dll_wcslen
add esp, 4
test eax, eax
jbe 0x405eda
mov dword [ebp - 4], 0x654
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x658]
push edx
lea eax, [ebp - 0x660]
push eax
push 0
push 0x40c1b4
mov ecx, dword [ebp - 0x664]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x405e9d
push 0x103
lea edx, [ebp - 0x654]
push edx
mov eax, dword [ebp + 0x10]
add eax, 0xa28
push eax
call sub.MSVCRT.dll_wcsncpy
add esp, 0xc
mov ecx, dword [ebp + 0x10]
mov word [ecx + 0xc2e], 0
push 0x103
lea edx, [ebp - 0x54c]
push edx
mov eax, dword [ebp + 0x10]
add eax, 0xe9c
push eax
call sub.MSVCRT.dll_wcsncpy
add esp, 0xc
mov ecx, dword [ebp + 0x10]
mov word [ecx + 0x10a2], 0
push 0x27
lea edx, [ebp - 0x86c]
push edx
mov eax, dword [ebp + 0x10]
add eax, 0x10a4
push eax
call sub.MSVCRT.dll_wcsncpy
add esp, 0xc
mov ecx, dword [ebp + 0x10]
mov word [ecx + 0x10f2], 0
mov edx, dword [ebp + 0x10]
push edx
push 1
push SysStringLen
call fcn.0040736c
add esp, 0xc
jmp 0x405eda
push 0x103
lea eax, [ebp - 0xa84]
push eax
mov ecx, dword [ebp + 0x10]
add ecx, 0xa28
push ecx
call sub.MSVCRT.dll_wcsncpy
add esp, 0xc
mov edx, dword [ebp + 0x10]
mov word [edx + 0xc2e], 0
mov eax, dword [ebp + 0x10]
push eax
push 1
push SysStringLen
call fcn.00406471
add esp, 0xc
cmp dword [ebp - 0x664], 0
je 0x405efa
mov ecx, dword [ebp - 0x664]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x664], 0
mov dword [ebp - 0x870], 0x104
mov edx, dword [ebp - 0x874]
add edx, 1
mov dword [ebp - 0x874], edx
jmp 0x405d0e
mov dword [ebp - 0x65c], 0
cmp dword [ebp - 0x664], 0
je 0x405f38
mov eax, dword [ebp - 0x664]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xa88], 0
je 0x405f4e
mov ecx, dword [ebp - 0xa88]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x65c]
jmp 0x405f5a
jmp 0x405f22
jmp 0x405f22
mov esp, ebp
pop ebp
ret