Function at 0x406bd0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x11c
call fcn.00596bf0
mov eax, dword [0x616930]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x114]
push eax
push 0xf013f
xor ebx, ebx
push ebx
push str.SoftwareMicrosoftInstallerProductsF1322DA684FF95D4CA6204A5AF2ED37B
mov esi, ecx
push closesocket
mov dword [ebp - 0x11c], esi
mov dword [ebp - 0x114], ebx
call edi
test eax, eax
jne 0x406c33
push 0xf013f
push str.SoftwareMicrosoftInstallerProductsF1322DA684FF95D4CA6204A5AF2ED37B
push closesocket
mov ecx, esi
call fcn.00407a00
lea ecx, [ebp - 0x114]
push ecx
push 0xf013f
push ebx
push str.SoftwareAdventNetDesktopCentralDCAgent
push closesocket
call edi
test eax, eax
jne 0x406c66
push 0xf013f
push str.SoftwareAdventNetDesktopCentralDCAgent
push closesocket
mov ecx, esi
call fcn.00407a00
lea edx, [ebp - 0x114]
push edx
push 0xf013f
push ebx
push ebx
push reloc.WS2_32.dll_closesocket
call edi
cmp eax, ebx
je 0x406ca0
push eax
push str.main_:_Error_in_opening_HKEY_:__d_n
call fcn.00402b00
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057af8a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x114]
push 0x104
lea eax, [ebp - 0x110]
push eax
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x406d77
lea edi, [ebp - 0x110]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x406cd0
mov dx, word [0x5adcac]
mov word [edi], dx
lea edi, [ebp - 0x110]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x406cf0
mov ecx, 0x11
mov esi, str.SoftwareMicrosoftInstallerProductsF1322DA684FF95D4CA6204A5AF2ED37B
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x118]
push eax
push 0xf013f
push 0
movsw word es:[edi], word [esi]
lea ecx, [ebp - 0x110]
push ecx
push reloc.WS2_32.dll_closesocket
movsb byte es:[edi], byte [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x406d47
mov ecx, dword [ebp - 0x11c]
push 0xf013f
lea edx, [ebp - 0x110]
push edx
push reloc.WS2_32.dll_closesocket
call fcn.00407a00
mov eax, dword [ebp - 0x118]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x114]
push 0x104
lea ecx, [ebp - 0x110]
push ecx
inc ebx
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x406cc2
mov ecx, dword [ebp - 0x114]
push 0x104
lea eax, [ebp - 0x110]
push eax
xor ebx, ebx
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x406e46
lea edi, [ebp - 0x110]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x406da2
mov dx, word [0x5adcac]
mov word [edi], dx
lea edi, [ebp - 0x110]
dec edi
jmp 0x406dc0
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x406dc0
mov ecx, 0xa
mov esi, str.SoftwareAdventNetDesktopCentralDCAgent
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x118]
push eax
push 0xf013f
push 0
lea ecx, [ebp - 0x110]
push ecx
push reloc.WS2_32.dll_closesocket
movsw word es:[edi], word [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x406e16
mov ecx, dword [ebp - 0x11c]
push 0xf013f
lea edx, [ebp - 0x110]
push edx
push reloc.WS2_32.dll_closesocket
call fcn.00407a00
mov eax, dword [ebp - 0x118]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x114]
push 0x104
lea ecx, [ebp - 0x110]
push ecx
inc ebx
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x406d9b
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.0057af8a
mov esp, ebp
pop ebp
ret