Function at 0x40710f
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x2d4
mov eax, 0x5bbe52
call fcn.00580f0a
mov esi, ecx
mov dword [ebp - 0x27c], esi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x284], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2a0], eax
mov dword [ebp - 0x28c], reloc.OLEAUT32.dll_SysReAllocString
xor ebx, ebx
mov byte [ebp - 0x26d], bl
mov dword [ebp - 0x274], ebx
lea eax, [ebp - 0x274]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
jne 0x407170
mov dword [ebp - 0x274], eax
jmp 0x407176
mov eax, dword [ebp - 0x274]
cmp eax, 1
jne 0x407181
mov dword [ebp - 0x274], eax
mov edi, 0x670fe8
cmp dword [esi + 0x18], 8
jb 0x407191
mov edx, dword [esi + 4]
jmp 0x407194
lea edx, [esi + 4]
lea ecx, [ebp - 0x29c]
push ecx
dec eax
neg eax
sbb eax, eax
mov ecx, 0x100
and eax, ecx
add eax, ecx
or eax, 0x20019
push eax
push ebx
push edx
push dword [ebp - 0x28c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x407471
push dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x29c]
lea esi, [ebp - 0x2a4]
call fcn.0040e3e6
mov dword [ebp - 4], ebx
mov dword [ebp - 0x288], 0xff
mov dword [ebp - 0x278], ebx
mov dword [ebp - 0x280], ebx
mov byte [ebp - 4], 1
mov dword [ebp - 0x288], 0xff
mov eax, dword [ebp - 0x280]
inc dword [ebp - 0x280]
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x288]
push ecx
lea ecx, [ebp - 0x218]
push ecx
push eax
push dword [ebp - 0x29c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0x278], eax
cmp eax, ebx
jne 0x40741d
lea eax, [ebp - 0x298]
push eax
call fcn.0040512b
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x274]
dec eax
neg eax
sbb eax, eax
and eax, 0xfffffffd
add eax, 4
mov dword [ebp - 0x298], eax
mov eax, dword [ebp - 0x28c]
call fcn.0040e439
push eax
lea eax, [ebp - 0x294]
push eax
call fcn.00408606
push edi
lea eax, [ebp - 0x294]
push eax
call fcn.00408624
mov eax, dword [ebp - 0x27c]
cmp dword [eax + 0x18], 8
jb 0x407299
mov eax, dword [eax + 4]
jmp 0x40729c
add eax, 4
push eax
lea eax, [ebp - 0x294]
push eax
call fcn.00408624
push edi
lea eax, [ebp - 0x294]
push eax
call fcn.00408624
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x294]
push eax
call fcn.00408624
push str.InprocServer32
lea esi, [ebp - 0x2c0]
call fcn.004081bb
mov byte [ebp - 4], 3
push dword [ebp - 0x288]
lea eax, [ebp - 0x218]
push eax
lea esi, [ebp - 0x2dc]
call fcn.00408197
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2c0]
push ecx
mov edx, eax
lea ecx, [ebp - 0x234]
call fcn.00406985
pop ecx
mov byte [ebp - 4], 6
push ebx
push 1
call fcn.00409c0f
mov byte [ebp - 4], 7
push ebx
push 1
lea esi, [ebp - 0x2c0]
call fcn.00409c0f
cmp dword [ebp - 0x220], ebx
je 0x4073a6
push dword [ebp - 0x2a0]
lea esi, [ebp - 0x26c]
call fcn.004081da
mov byte [ebp - 4], 8
push edi
mov eax, esi
push eax
call fcn.00408208
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x234]
mov ecx, esi
call fcn.004097f9
push ebx
lea eax, [ebp - 0x298]
push eax
push dword [ebp - 0x284]
mov ecx, esi
call fcn.0040644d
add esp, 0xc
test al, al
jne 0x40739a
push ebx
lea eax, [ebp - 0x298]
push eax
push dword [ebp - 0x284]
lea ecx, [ebp - 0x234]
call fcn.0040644d
add esp, 0xc
mov byte [ebp - 4], 7
lea esi, [ebp - 0x26c]
jmp 0x4073f3
push dword [ebp - 0x27c]
lea esi, [ebp - 0x250]
call fcn.004081da
mov byte [ebp - 4], 9
push edi
mov eax, esi
push eax
call fcn.00408208
lea eax, [ebp - 0x218]
push eax
mov eax, esi
push eax
call fcn.00408208
push dword [ebp - 0x2a0]
push dword [ebp - 0x284]
push dword [ebp - 0x28c]
mov ecx, esi
call fcn.00406c9b
add esp, 0xc
mov byte [ebp - 4], 7
push ebx
push 1
call fcn.00409c0f
mov byte [ebp - 4], 2
push ebx
push 1
lea esi, [ebp - 0x234]
call fcn.00409c0f
mov byte [ebp - 4], 1
lea eax, [ebp - 0x298]
push eax
call fcn.0040515e
mov dword [ebp - 4], ebx
jmp 0x407433
cmp dword [ebp - 0x278], ebx
je 0x4071f5
cmp dword [ebp - 0x278], 0x103
jne 0x407452
mov byte [ebp - 0x26d], 1
or dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x2a4]
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 4]
mov esi, dword [ebp - 0x27c]
mov eax, dword [ebp - 0x274]
mov ecx, eax
dec eax
mov dword [ebp - 0x274], eax
test ecx, ecx
jne 0x407186
mov al, byte [ebp - 0x26d]
call fcn.00580f66
ret