Function at 0x4067e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x40c
or ecx, 0xffffffff
push ebx
push ebp
push esi
push edi
mov byte [eax], 0
mov edi, str.HKEY_LOCAL_MACHINE
xor eax, eax
mov esi, dword [esp + 0x420]
repne scasb al, byte es:[edi]
mov ebp, dword [sym.imp.MSVCRT.dll_strncmp]
not ecx
dec ecx
push ecx
push str.HKEY_LOCAL_MACHINE
push esi
call ebp
add esp, 0xc
test eax, eax
jne 0x406827
mov ebx, 0x80000002
jmp 0x4068c1
mov edi, str.HKEY_CLASSES_ROOT
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.HKEY_CLASSES_ROOT
push esi
call ebp
add esp, 0xc
test eax, eax
jne 0x40684d
mov ebx, 0x80000000
jmp 0x4068c1
mov edi, str.HKEY_CURRENT_USER
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.HKEY_CURRENT_USER
push esi
call ebp
add esp, 0xc
test eax, eax
jne 0x406873
mov ebx, 0x80000001
jmp 0x4068c1
mov edi, str.HKEY_USERS
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.HKEY_USERS
push esi
call ebp
add esp, 0xc
test eax, eax
jne 0x406899
mov ebx, 0x80000003
jmp 0x4068c1
mov edi, str.HKEY_CURRENT_CONFIG
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.HKEY_CURRENT_CONFIG
push esi
call ebp
add esp, 0xc
test eax, eax
jne 0x406a24
mov ebx, 0x80000005
push 0x400
lea ecx, [esp + 0x20]
push esi
push ecx
call fcn.004049c0
mov ebp, dword [sym.imp.MSVCRT.dll_strchr]
lea edx, [esp + 0x28]
push 0x5c
push edx
call ebp
mov edi, eax
lea eax, [esp + 0x30]
push 0x5c
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
add esp, 0x1c
mov esi, eax
test edi, edi
jne 0x406906
lea ecx, [esp + 0x1c]
push 0x2f
push ecx
call ebp
add esp, 8
mov edi, eax
test esi, esi
jne 0x406914
push 0x2f
push esi
call ebp
add esp, 8
mov esi, eax
test edi, edi
je 0x406a24
test esi, esi
je 0x406a24
test ebx, ebx
je 0x406a24
lea edx, [esp + 0x14]
mov byte [esi], 0
inc esi
push edx
push 0x20019
inc edi
push 0
push edi
push ebx
mov dword [esp + 0x28], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x406a24
mov ebx, dword [esp + 0x428]
mov dword [esp + 0x10], 0x400
cmp ebx, 0xffffffff
je 0x40696d
mov dword [esp + 0x10], ebx
mov ecx, dword [esp + 0x424]
mov edi, dword [esp + 0x14]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x10]
push eax
lea edx, [esp + 0x1c]
push ecx
push edx
push 0
push esi
push edi
mov dword [esp + 0x30], 0
call ebp
test eax, eax
jne 0x4069c3
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0x424]
test edi, edi
mov byte [eax + esi - 1], 0
je 0x4069b6
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40c
ret
cmp ebx, 0xffffffff
mov dword [esp + 0x10], 0x400
je 0x4069d4
mov dword [esp + 0x10], ebx
mov ebx, dword [esp + 0x424]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push ebx
push edx
push 0
push esi
push edi
mov dword [esp + 0x2c], 0
call ebp
test eax, eax
jne 0x406a19
mov eax, dword [esp + 0x10]
test edi, edi
mov byte [eax + ebx - 1], 0
je 0x406a0c
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x40c
ret
test edi, edi
je 0x406a24
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x40c
ret