Function at 0x406efd
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xe10
mov eax, 0x4e2d61
call fcn.004c2a93
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xe1c], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, 0x5401f0
cmp dword [0x541bfc], ebx
je 0x406faf
cmp dword [0x541c00], ebx
je 0x406faf
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0xdf8]
push 0x541c70
push eax
call fcn.00401e15
add esp, 0xc
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 1
call fcn.00401ced
mov ecx, dword [ebp - 0xdf8]
mov byte [ebp - 4], bl
lea ecx, [ecx - 0x10]
call fcn.00404fef
push esi
lea ecx, [ebp - 0xdf4]
call fcn.00401718
mov ecx, dword [0x541c00]
push ebx
lea eax, [ebp - 0xdf4]
push eax
lea eax, [ebp + 8]
push eax
mov byte [ebp - 4], 2
call fcn.00415ca3
push dword [ebp - 0xdf4]
lea ecx, [ebp + 8]
call fcn.00401d90
mov ecx, dword [ebp - 0xdf4]
mov byte [ebp - 4], bl
lea ecx, [ecx - 0x10]
call fcn.00404fef
xor eax, eax
cmp byte [0x541c04], al
mov edi, SysReAllocStringLen
sete al
push 0x13
add eax, edi
mov dword [ebp - 0xdf4], eax
mov eax, dword [0x541ad4]
lea ecx, [eax + 1]
imul eax, ecx
cdq
pop ecx
idiv ecx
cmp edx, 7
jne 0x406ff3
call fcn.004c2f1b
mov ecx, dword [0x541ad4]
cmp ecx, eax
jne 0x406ff3
dec ecx
mov dword [0x541ad4], ecx
push esi
lea ecx, [ebp - 0xe04]
call fcn.00401718
cmp byte [ebp + 0x10], 0
mov esi, dword [0x541ad4]
mov byte [ebp - 4], 3
je 0x4070bd
mov eax, esi
imul eax, esi
push 0x12
cdq
pop ecx
idiv ecx
cmp edx, 8
jne 0x40703b
xor eax, eax
inc eax
mov edx, eax
add ecx, 0x78
dec ecx
lea esi, [eax + edx]
lea edx, [eax]
mov eax, esi
jns 0x40702b
mov dword [0x541ad4], esi
cmp byte [0x53b03c], 0
jne 0x407093
mov eax, dword [0x541d0c]
cmp dword [eax - 0xc], 0
je 0x407099
push 0x4f6850
lea eax, [ebp - 0xdf8]
push 0x541d0c
push eax
mov edi, SysReAllocStringLen
call fcn.00401e6a
add esp, 0xc
push eax
lea ecx, [ebp - 0xe04]
mov byte [ebp - 4], 4
call fcn.00401ced
mov ecx, dword [ebp - 0xdf8]
lea ecx, [ecx - 0x10]
call fcn.00404fef
mov esi, dword [0x541ad4]
jmp 0x407099
mov edi, dword [ebp - 0xdf4]
call fcn.00408456
test al, al
jne 0x4070c3
mov eax, esi
sub eax, ebx
je 0x4070b8
dec eax
je 0x4070ae
inc esi
jmp 0x4070b0
mov esi, ebx
mov dword [0x541ad4], esi
jmp 0x4070c3
push 2
pop esi
jmp 0x4070b0
mov edi, dword [ebp - 0xdf4]
mov dword [ebp - 0xe14], ebx
mov dword [ebp - 0xe10], ebx
mov dword [ebp - 0xe0c], ebx
mov eax, esi
imul eax, esi
imul eax, esi
push 0x18
cdq
pop ecx
idiv ecx
push 0x12
pop eax
mov byte [ebp - 4], 5
cmp edx, eax
jne 0x40714d
mov esi, ebx
call fcn.004c2f1b
movd xmm0, eax
cvtdq2pd xmm0, xmm0
inc esi
movsd qword [ebp + esi*8 - 0xdf8], xmm0
mov edx, 0xbc
cmp esi, edx
jb 0x4070f0
lea ecx, [edx - 1]
mov eax, ecx
cmp ebx, ecx
jge 0x407148
movsd xmm0, qword [ebp + eax*8 - 0xdf0]
movsd xmm1, qword [ebp + eax*8 - 0xdf8]
comisd xmm0, xmm1
jbe 0x407143
movsd qword [ebp + eax*8 - 0xdf0], xmm1
movsd qword [ebp + eax*8 - 0xdf8], xmm0
dec eax
cmp eax, ebx
jg 0x407119
inc ebx
cmp ebx, edx
jl 0x407113
push str.Software_
lea ecx, [ebp - 0xe00]
call fcn.004017e3
push eax
lea eax, [ebp - 0xe04]
push eax
lea eax, [ebp - 0xe18]
push eax
mov byte [ebp - 4], 6
call fcn.00401e15
push 0x541c94
push eax
lea eax, [ebp - 0xdfc]
push eax
mov byte [ebp - 4], 7
call fcn.00401e15
push 0x4f6850
push eax
lea eax, [ebp - 0xdf4]
push eax
mov byte [ebp - 4], 8
call fcn.00401e6a
lea ecx, [ebp + 8]
push ecx
push eax
lea eax, [ebp - 0xdf8]
push eax
mov byte [ebp - 4], 9
call fcn.00401e15
add esp, 0x30
lea ecx, [ebp - 0xe14]
push 1
push dword [eax]
push edi
call fcn.004079e9
mov ecx, dword [ebp - 0xdf8]
test eax, eax
lea ecx, [ecx - 0x10]
setne bl
call fcn.00404fef
mov ecx, dword [ebp - 0xdf4]
lea ecx, [ecx - 0x10]
call fcn.00404fef
mov ecx, dword [ebp - 0xdfc]
lea ecx, [ecx - 0x10]
call fcn.00404fef
mov ecx, dword [ebp - 0xe18]
lea ecx, [ecx - 0x10]
call fcn.00404fef
mov ecx, dword [ebp - 0xe00]
mov byte [ebp - 4], 5
lea ecx, [ecx - 0x10]
call fcn.00404fef
test bl, bl
je 0x407223
xor ebx, ebx
jmp 0x407486
xor eax, eax
push 0x7fe
mov word [ebp - 0x810], ax
xor ebx, ebx
lea eax, [ebp - 0x80e]
push ebx
push eax
mov dword [ebp - 0xe08], 0x400
call fcn.004c3990
add esp, 0xc
call fcn.0040847a
mov ecx, dword [0x541ad4]
test al, al
jne 0x40726a
push 1
test ecx, ecx
pop eax
cmove ecx, eax
mov dword [0x541ad4], ecx
lea eax, [ecx + 1]
imul eax, ecx
cdq
push 0xc
pop ecx
idiv ecx
xor eax, eax
inc eax
mov esi, ebx
cmp edx, eax
jne 0x4072ae
push 0x28
call fcn.004c0e30
pop ecx
mov edi, eax
call fcn.004c2f1b
add eax, dword [0x541ad4]
mov dword [edi + esi*4], eax
inc esi
cmp esi, 0xa
jl 0x407289
mov eax, dword [edi + 0x24]
push edi
mov dword [0x541ad4], eax
call fcn.004c1c8e
pop ecx
mov esi, ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0xe08]
push eax
lea eax, [ebp - 0x810]
push eax
push esi
push dword [ebp - 0xe14]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov edi, eax
inc esi
mov dword [ebp - 0xe00], esi
test edi, edi
je 0x4072e6
cmp edi, 0x103
jne 0x40743e
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0xdfc]
call fcn.00401824
mov ecx, dword [0x541ad4]
mov eax, ecx
imul eax, ecx
imul eax, ecx
push 0x18
cdq
pop ecx
idiv ecx
mov byte [ebp - 4], 0xa
cmp edx, 0xa
jne 0x40731b
inc dword [0x541ce4]
mov eax, dword [ebp - 0xdfc]
cmp dword [eax - 0xc], 0
je 0x4073e1
cmp dword [0x541bfc], 0
je 0x4073cf
cmp dword [0x541c00], 0
je 0x4073cf
push 0x5401f0
lea ecx, [ebp - 0xdf4]
call fcn.00401718
push dword [ebp - 0xdfc]
lea ecx, [ebp - 0xdf8]
mov byte [ebp - 4], 0xb
call fcn.004017a2
mov ecx, dword [0x541bfc]
lea eax, [ebp - 0xdf4]
push eax
lea eax, [ebp - 0xdf8]
push eax
mov byte [ebp - 4], 0xc
call fcn.0041555a
push 0x4fa988
push dword [0x541c70]
lea ecx, [ebp - 0xdf4]
call fcn.0040500b
lea eax, [ebp - 0xdf4]
push eax
lea ecx, [ebp - 0xdfc]
call fcn.00401ced
mov ecx, dword [ebp - 0xdf8]
lea ecx, [ecx - 0x10]
call fcn.00404fef
mov ecx, dword [ebp - 0xdf4]
mov byte [ebp - 4], 0xa
lea ecx, [ecx - 0x10]
call fcn.00404fef
mov ecx, dword [ebp - 0xe1c]
lea eax, [ebp - 0xdfc]
push eax
call fcn.00408509
push 0x800
lea eax, [ebp - 0x810]
push ebx
push eax
mov dword [ebp - 0xe08], 0x400
call fcn.004c3990
add esp, 0xc
call fcn.00408434
test al, al
jne 0x40742c
push 4
call fcn.004c1b05
mov esi, eax
call fcn.004c2f1b
mov dword [esi], eax
push esi
mov dword [0x541ad4], eax
call fcn.0042e00a
mov esi, dword [ebp - 0xe00]
pop ecx
pop ecx
mov ecx, dword [ebp - 0xdfc]
mov byte [ebp - 4], 5
lea ecx, [ecx - 0x10]
call fcn.00404fef
mov ecx, dword [0x541ad4]
mov dword [ebp - 0xe00], 0x15
lea eax, [ecx + 1]
imul eax, ecx
cdq
idiv dword [ebp - 0xe00]
cmp edx, 7
jne 0x40746e
push 1
test ecx, ecx
pop eax
cmove ecx, eax
mov dword [0x541ad4], ecx
test edi, edi
je 0x4072ae
lea ecx, [ebp - 0xe14]
call fcn.00406e5e
xor eax, eax
lea ebx, [eax + 1]
lea ecx, [ebp - 0xe14]
call fcn.00406e5e
mov ecx, dword [ebp - 0xe04]
add ecx, 0xfffffff0
call fcn.00404fef
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00404fef
mov al, bl
call fcn.004c2a42
ret