Function at 0x406022
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa88
mov dword [ebp - 0xa88], 0
mov dword [ebp - 0x874], 0
mov dword [ebp - 0x870], 0x104
mov dword [ebp - 0x664], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x65c], 0
mov eax, dword [ebp + 0x10]
push eax
push 1
call fcn.00402f0d
add esp, 8
lea ecx, [ebp - 0xa88]
push ecx
push 0x20019
push 0
mov edx, dword [ebp + 0x10]
add edx, 0x618
push edx
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x65c], eax
cmp dword [ebp - 0x65c], 0
je 0x4060a9
jmp 0x4062f3
lea eax, [ebp - 0x87c]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 0x870]
push ecx
lea edx, [ebp - 0xa84]
push edx
mov eax, dword [ebp - 0x874]
push eax
mov ecx, dword [ebp - 0xa88]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0x65c], eax
cmp dword [ebp - 0x65c], 0
jne 0x4062b3
lea edx, [ebp - 0x664]
push edx
push 0x20019
push 0
lea eax, [ebp - 0xa84]
push eax
mov ecx, dword [ebp - 0xa88]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x65c], eax
cmp dword [ebp - 0x65c], 0
je 0x406121
jmp 0x4062f1
mov dword [ebp - 4], 0x208
mov word [ebp - 0x86c], 0
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x86c]
push eax
lea ecx, [ebp - 0x660]
push ecx
push 0
push 0x40c084
mov edx, dword [ebp - 0x664]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x406275
lea eax, [ebp - 0x86c]
push eax
call sub.MSVCRT.dll_wcslen
add esp, 4
test eax, eax
jbe 0x406275
mov dword [ebp - 4], 0x654
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x658]
push edx
lea eax, [ebp - 0x660]
push eax
push 0
push 0x40c09c
mov ecx, dword [ebp - 0x664]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x406238
push 0x103
lea edx, [ebp - 0x654]
push edx
mov eax, dword [ebp + 0x10]
add eax, 0xa28
push eax
call sub.MSVCRT.dll_wcsncpy
add esp, 0xc
mov ecx, dword [ebp + 0x10]
mov word [ecx + 0xc2e], 0
push 0x103
lea edx, [ebp - 0x54c]
push edx
mov eax, dword [ebp + 0x10]
add eax, 0xe9c
push eax
call sub.MSVCRT.dll_wcsncpy
add esp, 0xc
mov ecx, dword [ebp + 0x10]
mov word [ecx + 0x10a2], 0
push 0x27
lea edx, [ebp - 0x86c]
push edx
mov eax, dword [ebp + 0x10]
add eax, 0x10a4
push eax
call sub.MSVCRT.dll_wcsncpy
add esp, 0xc
mov ecx, dword [ebp + 0x10]
mov word [ecx + 0x10f2], 0
mov edx, dword [ebp + 0x10]
push edx
push 1
push SysStringLen
call fcn.00407821
add esp, 0xc
jmp 0x406275
push 0x103
lea eax, [ebp - 0xa84]
push eax
mov ecx, dword [ebp + 0x10]
add ecx, 0xa28
push ecx
call sub.MSVCRT.dll_wcsncpy
add esp, 0xc
mov edx, dword [ebp + 0x10]
mov word [edx + 0xc2e], 0
mov eax, dword [ebp + 0x10]
push eax
push 1
push SysStringLen
call fcn.004068e0
add esp, 0xc
cmp dword [ebp - 0x664], 0
je 0x406295
mov ecx, dword [ebp - 0x664]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x664], 0
mov dword [ebp - 0x870], 0x104
mov edx, dword [ebp - 0x874]
add edx, 1
mov dword [ebp - 0x874], edx
jmp 0x4060a9
mov dword [ebp - 0x65c], 0
cmp dword [ebp - 0x664], 0
je 0x4062d3
mov eax, dword [ebp - 0x664]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xa88], 0
je 0x4062e9
mov ecx, dword [ebp - 0xa88]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x65c]
jmp 0x4062f5
jmp 0x4062bd
jmp 0x4062bd
mov esp, ebp
pop ebp
ret