Function at 0x404bb0
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x98
push ebx
mov ebx, dword [esp + 0xa4]
push ebp
push esi
push edi
mov esi, ecx
xor eax, eax
mov edi, ebx
or ecx, 0xffffffff
mov dword [esp + 0x10], eax
repne scasb al, byte es:[edi]
not ecx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xb4]
dec ecx
mov dword [esp + 0x1c], esi
cmp eax, ecx
jae 0x404e10
mov ebp, dword [sym.imp.MSVCRT.dll__mbsstr]
add eax, ebx
push 0x40b0f0
push eax
call ebp
mov edi, eax
add esp, 8
test edi, edi
jne 0x404c2a
mov ecx, dword [esp + 0xbc]
mov edx, dword [esp + 0xac]
push ecx
push ebx
push edx
mov ecx, esi
call dword [esp + 0xc4]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x98
ret 0x14
lea esi, [edi + 3]
push 0x40b0ec
push esi
mov dword [esp + 0x2c], esi
call ebp
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x404c6b
mov eax, dword [esp + 0xbc]
mov ecx, dword [esp + 0xac]
push eax
push ebx
push ecx
mov ecx, dword [esp + 0x28]
call dword [esp + 0xc4]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x98
ret 0x14
mov byte [ebp], 0
inc ebp
mov byte [edi], 0
cmp byte [ebp], 0x5c
jne 0x404c7a
inc ebp
mov eax, dword [esp + 0xac]
lea edx, [esp + 0x18]
push edx
push 0x20019
push 0
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, dword [esp + 0x18]
test ecx, ecx
jne 0x404cac
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x98
ret 0x14
test eax, eax
jne 0x404dff
push eax
push eax
push eax
push eax
push eax
push eax
lea edx, [esp + 0x38]
lea eax, [esp + 0x28]
push edx
push eax
push 0
push 0
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x404df4
mov eax, dword [esp + 0x10]
test eax, eax
jbe 0x404df4
push 0
push 0
push 0
lea ecx, [esp + 0x2c]
push 0
lea edx, [esp + 0x38]
dec eax
push ecx
push edx
mov dword [esp + 0x28], eax
push eax
mov eax, dword [esp + 0x34]
push eax
mov dword [esp + 0x40], 0x80
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp byte [esi], 0
je 0x404d2c
lea ecx, [esp + 0x28]
push esi
push ecx
mov ecx, dword [esp + 0x24]
call fcn.00401c80
test eax, eax
je 0x404de8
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ebx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [esp + 0x28]
add edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [edx + ecx + 3]
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
mov al, byte [ebp]
add esp, 4
test al, al
je 0x404d80
lea ecx, [esp + 0x28]
push ebp
push ecx
push ebx
push 0x40b0e0
push esi
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x14
jmp 0x404d95
lea edx, [esp + 0x28]
push edx
push ebx
push 0x40b0d8
push esi
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
mov eax, dword [esp + 0xbc]
mov ecx, dword [esp + 0xb8]
push eax
push ecx
lea edi, [esp + 0x30]
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esp + 0xbc]
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx + edx + 2]
mov ecx, dword [esp + 0xb4]
push eax
push esi
push ecx
mov ecx, dword [esp + 0x30]
call fcn.00404bb0
mov edx, dword [esp + 0x14]
push esi
add edx, eax
mov dword [esp + 0x18], edx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov esi, dword [esp + 0x28]
add esp, 4
mov eax, dword [esp + 0x10]
test eax, eax
ja 0x404ce5
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x98
ret 0x14
mov eax, dword [esp + 0xbc]
mov ecx, dword [esp + 0xac]
push eax
push ebx
push ecx
mov ecx, esi
call dword [esp + 0xc4]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x98
ret 0x14