Function at 0x4058a0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x950
mov eax, dword [0x4c000c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x938], 0xffffffff
cmp dword [ebp + 8], 0
je 0x4058c9
cmp dword [ebp + 0xc], 0x12
jge 0x4058d4
mov eax, dword [ebp - 0x938]
jmp 0x405bd8
mov dword [ebp - 0x930], 0
mov dword [ebp - 0x92c], 0
xor eax, eax
mov word [ebp - 0x310], ax
push 0x206
push 0
lea ecx, [ebp - 0x30e]
push ecx
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [ebp - 0x94c], 0
mov dword [ebp - 0x944], 0
mov dword [ebp - 0x93c], 0
mov dword [ebp - 0x948], 0x104
lea edx, [ebp - 0x930]
push edx
push 0x48d008
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x405955
mov eax, dword [ebp - 0x938]
jmp 0x405bd8
mov dword [ebp - 0x940], 0
jmp 0x40597a
mov eax, dword [ebp - 0x940]
add eax, 1
mov dword [ebp - 0x940], eax
mov dword [ebp - 0x948], 0x104
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x948]
push ecx
lea edx, [ebp - 0x928]
push edx
mov eax, dword [ebp - 0x940]
push eax
mov ecx, dword [ebp - 0x930]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x405bbc
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionNetworkCards_
push 0x104
lea edx, [ebp - 0x518]
push edx
call dword [sym.imp.MSVCR120.dll_wcscpy_s]
add esp, 0xc
lea eax, [ebp - 0x928]
push eax
push 0x104
lea ecx, [ebp - 0x518]
push ecx
call dword [sym.imp.MSVCR120.dll_wcscat_s]
add esp, 0xc
lea edx, [ebp - 0x92c]
push edx
lea eax, [ebp - 0x518]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x405a04
jmp 0x405961
mov dword [ebp - 0x944], 1
mov dword [ebp - 0x93c], 0x208
lea ecx, [ebp - 0x93c]
push ecx
lea edx, [ebp - 0x720]
push edx
lea eax, [ebp - 0x944]
push eax
push 0
push str.ServiceName
mov ecx, dword [ebp - 0x92c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x405baa
mov edx, dword [ebp - 0x92c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.._
push 0x104
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.MSVCR120.dll_wcscpy_s]
add esp, 0xc
lea ecx, [ebp - 0x720]
push ecx
push 0x104
lea edx, [ebp - 0x310]
push edx
call dword [sym.imp.MSVCR120.dll_wcscat_s]
add esp, 0xc
push 0
push 0
push 3
push 0
push 1
push SysReAllocString
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x934], eax
cmp dword [ebp - 0x934], 0xffffffff
je 0x405ba8
mov dword [ebp - 0x950], 0x1010101
push 0
lea ecx, [ebp - 0x93c]
push ecx
push 0x104
lea edx, [ebp - 0x108]
push edx
push 4
lea eax, [ebp - 0x950]
push eax
push 0x170002
mov ecx, dword [ebp - 0x934]
push ecx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov dword [ebp - 0x94c], eax
mov edx, dword [ebp - 0x934]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x934], 0xffffffff
cmp dword [ebp - 0x94c], 0
je 0x405ba8
mov eax, 1
imul ecx, eax, 5
movzx edx, byte [ebp + ecx - 0x108]
push edx
mov eax, 1
shl eax, 2
movzx ecx, byte [ebp + eax - 0x108]
push ecx
mov edx, 1
imul eax, edx, 3
movzx ecx, byte [ebp + eax - 0x108]
push ecx
mov edx, 1
shl edx, 1
movzx eax, byte [ebp + edx - 0x108]
push eax
mov ecx, 1
shl ecx, 0
movzx edx, byte [ebp + ecx - 0x108]
push edx
mov eax, 1
imul ecx, eax, 0
movzx edx, byte [ebp + ecx - 0x108]
push edx
push str._02X__02X__02X__02X__02X__02X
mov eax, dword [ebp + 0xc]
shr eax, 1
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR120.dll_swprintf_s]
add esp, 0x24
mov dword [ebp - 0x938], 0
jmp 0x405bbc
jmp 0x405bb7
mov edx, dword [ebp - 0x92c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x405961
cmp dword [ebp - 0x930], 0
je 0x405bd2
mov eax, dword [ebp - 0x930]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x938]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043fe23
mov esp, ebp
pop ebp
ret