Function at 0x4069ee
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xbc8
mov eax, 0x4a2d73
call fcn.00483f83
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xbd4], eax
xor eax, eax
xor ebx, ebx
cmp byte [0x4f3350], al
mov esi, SysReAllocStringLen
sete al
push 0x4f19f8
lea ecx, [ebp - 0xbb4]
mov dword [ebp - 4], ebx
add eax, esi
mov dword [ebp - 0xba8], eax
call fcn.004016bd
mov byte [ebp - 4], 1
cmp byte [ebp + 0x10], bl
je 0x406a9a
cmp byte [0x4ed02c], bl
jne 0x406a9a
mov eax, dword [0x4f3408]
cmp dword [eax - 0xc], ebx
jne 0x406a56
mov dword [ebp - 0xba8], esi
jmp 0x406aa0
push 0x4af858
lea eax, [ebp - 0xbac]
push 0x4f3408
mov esi, VariantInit
push eax
mov dword [ebp - 0xba8], esi
call fcn.00401e52
add esp, 0xc
push eax
lea ecx, [ebp - 0xbb4]
mov byte [ebp - 4], 2
call fcn.00401cd5
mov ecx, dword [ebp - 0xbac]
lea ecx, [ecx - 0x10]
call fcn.00404d08
jmp 0x406aa0
mov esi, dword [ebp - 0xba8]
mov dword [ebp - 0xbc4], ebx
mov dword [ebp - 0xbc0], ebx
mov dword [ebp - 0xbbc], ebx
push 3
pop eax
mov dword [ebp - 0xbcc], eax
mov byte [ebp - 4], al
call fcn.00407945
test al, al
jne 0x406adf
mov esi, dword [0x4f3280]
mov edi, esi
inc ebx
dec edi
cmp ebx, 0xe5
jb 0x406acf
mov esi, dword [ebp - 0xba8]
push 0x4af8c0
lea ecx, [ebp - 0xbb0]
call fcn.0040181c
push eax
lea eax, [ebp - 0xbb4]
push eax
lea eax, [ebp - 0xbc8]
push eax
mov byte [ebp - 4], 4
call fcn.00401dfd
push 0x4f340c
push eax
lea eax, [ebp - 0xbd0]
push eax
mov byte [ebp - 4], 5
call fcn.00401dfd
push 0x4af858
push eax
lea eax, [ebp - 0xba8]
push eax
mov byte [ebp - 4], 6
call fcn.00401e52
lea ecx, [ebp + 8]
push ecx
push eax
lea eax, [ebp - 0xbac]
push eax
mov byte [ebp - 4], 7
call fcn.00401dfd
add esp, 0x30
lea ecx, [ebp - 0xbc4]
push 1
push dword [eax]
push esi
call fcn.00407129
mov ecx, dword [ebp - 0xbac]
test eax, eax
lea ecx, [ecx - 0x10]
setne bl
call fcn.00404d08
mov ecx, dword [ebp - 0xba8]
lea ecx, [ecx - 0x10]
call fcn.00404d08
mov ecx, dword [ebp - 0xbd0]
lea ecx, [ecx - 0x10]
call fcn.00404d08
mov ecx, dword [ebp - 0xbc8]
lea ecx, [ecx - 0x10]
call fcn.00404d08
mov ecx, dword [ebp - 0xbb0]
push 3
pop eax
lea ecx, [ecx - 0x10]
mov byte [ebp - 4], al
call fcn.00404d08
test bl, bl
je 0x406bb7
xor ebx, ebx
jmp 0x406d31
xor eax, eax
push 0x7fe
mov word [ebp - 0x810], ax
xor ebx, ebx
lea eax, [ebp - 0x80e]
push ebx
push eax
mov dword [ebp - 0xbb8], 0x400
call fcn.004845c0
add esp, 0xc
mov edi, ebx
call fcn.00407987
test al, al
jne 0x406c10
mov ecx, dword [0x4f3280]
mov esi, ebx
test ecx, ecx
je 0x406c0a
mov eax, ecx
and eax, 1
add esi, eax
mov eax, ecx
cdq
sub eax, edx
mov ecx, eax
sar ecx, 1
jne 0x406bf8
mov dword [0x4f3280], esi
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0xbb8]
push eax
lea eax, [ebp - 0x810]
push eax
push edi
push dword [ebp - 0xbc4]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov esi, eax
inc edi
test esi, esi
je 0x406c42
cmp esi, 0x103
jne 0x406d1c
mov ecx, dword [0x4f3280]
mov dword [ebp - 0xbb0], 0xf
lea eax, [ecx + 1]
imul eax, ecx
cdq
idiv dword [ebp - 0xbb0]
cmp edx, 0xa
jne 0x406cb5
jmp 0x406cb1
mov eax, ecx
and eax, 0x80000001
jns 0x406c74
dec eax
or eax, 0xfffffffe
inc eax
jne 0x406c81
mov eax, ecx
cdq
sub eax, edx
mov ecx, eax
sar ecx, 1
jmp 0x406c88
lea ecx, [ecx*2 + 1]
mov eax, ecx
cdq
idiv dword [ebp - 0xbcc]
mov dword [0x4f3280], ecx
sub edx, ebx
je 0x406ca4
dec edx
dec edx
je 0x406ca7
dec edx
je 0x406ca8
jmp 0x406cb1
add ecx, 2
inc ecx
add ecx, 2
mov dword [0x4f3280], ecx
test ecx, ecx
jne 0x406c66
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0xba8]
call fcn.0040185d
mov eax, dword [ebp - 0xba8]
mov byte [ebp - 4], 8
cmp dword [eax - 0xc], 0
je 0x406ce9
mov ecx, dword [ebp - 0xbd4]
lea eax, [ebp - 0xba8]
push eax
call fcn.004079d7
push 0x800
lea eax, [ebp - 0x810]
push ebx
push eax
mov dword [ebp - 0xbb8], 0x400
call fcn.004845c0
mov ecx, dword [ebp - 0xba8]
add esp, 0xc
lea ecx, [ecx - 0x10]
push 3
pop eax
mov byte [ebp - 4], al
call fcn.00404d08
test esi, esi
je 0x406be3
lea ecx, [ebp - 0xbc4]
call fcn.0040694f
mov bl, 1
lea ecx, [ebp - 0xbc4]
call fcn.0040694f
mov ecx, dword [ebp - 0xbb4]
add ecx, 0xfffffff0
call fcn.00404d08
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00404d08
mov al, bl
call fcn.00483f32
ret