Function at 0x404be0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x67c
pxor xmm0, xmm0
movdqu xmmword [ebp - 0x88], xmm0
movdqu xmmword [ebp - 0x78], xmm0
pxor xmm0, xmm0
movq qword [ebp - 0x68], xmm0
mov dword [ebp - 0x58], 0x45
mov dword [ebp - 0x44], 0x100
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x5c], 0xffff0001
lea eax, [ebp - 0x18]
push eax
push str.CLSID_
push 0x80000000
call dword [sym.imp.advapi32.dll_RegOpenKeyW]
test eax, eax
jne 0x404c8e
lea edi, [ebp - 0x288]
push 0x100
push edi
push 0
push dword [ebp - 0x18]
call dword [sym.imp.advapi32.dll_RegEnumKeyW]
test eax, eax
je 0x404c99
push dword [ebp - 0x18]
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov esi, dword [0x40d144]
mov edi, dword [sym.imp.user32.dll_SendMessageW]
push dword [0x419678]
push 0
push 0x1113
push dword [esi + 0x10]
call edi
push dword [0x41967c]
push 0
push 0x1113
push dword [esi + 0x10]
call edi
add esp, 0x67c
pop esi
pop edi
pop ebx
pop ebp
ret
xor ebx, ebx
lea esi, [ebp - 0x14]
jmp 0x404cc1
push dword [ebp - 0x14]
call dword [sym.imp.advapi32.dll_RegCloseKey]
lea esi, [ebp - 0x14]
inc ebx
push 0x100
push edi
push ebx
push dword [ebp - 0x18]
call dword [sym.imp.advapi32.dll_RegEnumKeyW]
test eax, eax
jne 0x404c55
push esi
push edi
push dword [ebp - 0x18]
call dword [sym.imp.advapi32.dll_RegOpenKeyW]
test eax, eax
jne 0x404cac
mov dword [ebp - 0x1c], 0x200
mov eax, dword [0x41967c]
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x10]
push eax
push str.InProcServer32
push dword [ebp - 0x14]
call dword [sym.imp.advapi32.dll_RegOpenKeyW]
test eax, eax
jne 0x404d8f
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x488]
push eax
push 0
push dword [ebp - 0x10]
call dword [sym.imp.advapi32.dll_RegQueryValueW]
test eax, eax
jne 0x404d86
cmp word [ebp - 0x488], 0
je 0x404d86
movdqu xmm0, xmmword [ebp - 0x488]
pcmpeqb xmm0, xmmword [0x40d560]
movzx eax, word [ebp - 0x478]
movd xmm1, eax
pcmpeqb xmm1, xmmword [0x40d570]
pand xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
je 0x404d7e
movdqu xmm0, xmmword [ebp - 0x488]
pcmpeqb xmm0, xmmword [0x40d590]
movdqu xmm1, xmmword [ebp - 0x480]
pcmpeqb xmm1, xmmword [str.ut32.dlloleaut32]
pand xmm1, xmm0
pmovmskb eax, xmm1
cmp eax, 0xffff
jne 0x404d86
mov eax, dword [0x419678]
mov dword [ebp - 0x60], eax
push dword [ebp - 0x10]
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov dword [ebp - 0x1c], 0x200
lea eax, [ebp - 0x1c]
push eax
lea esi, [ebp - 0x488]
push esi
push 0
push dword [ebp - 0x14]
call dword [sym.imp.advapi32.dll_RegQueryValueW]
cmp word [ebp - 0x488], 0
mov ecx, edi
cmovne ecx, esi
test eax, eax
cmovne ecx, edi
mov dword [ebp - 0x48], ecx
push 0x60c
push 1
call dword [sym.imp.ucrtbase.dll_calloc]
add esp, 8
mov byte [eax], 6
xor ecx, ecx
nop word cs:[eax + eax]
movzx edx, word [ebp + ecx - 0x288]
mov word [eax + ecx + 2], dx
add ecx, 2
test dx, dx
jne 0x404de0
xor ecx, ecx
nop word [eax + eax]
movzx edx, word [ebp + ecx - 0x288]
mov word [eax + ecx + 0x202], dx
add ecx, 2
test dx, dx
jne 0x404e00
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x60], 0
je 0x404e3a
lea eax, [ebp - 0x60]
push eax
push 0
push 0x1132
mov eax, dword [0x40d144]
push dword [eax + 0x10]
call dword [sym.imp.user32.dll_SendMessageW]
lea eax, [ebp - 0x10]
push eax
push str.Implemented_Categories
push dword [ebp - 0x14]
call dword [sym.imp.advapi32.dll_RegOpenKeyW]
test eax, eax
jne 0x404ca0
push 0x100
lea eax, [ebp - 0x688]
push eax
push 0
push dword [ebp - 0x10]
call dword [sym.imp.advapi32.dll_RegEnumKeyW]
test eax, eax
jne 0x404c55
push dword [ebp - 0x10]
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, dword [0x419670]
test eax, eax
mov ecx, 0xffff0000
cmove eax, ecx
push eax
push 4
push 0x110a
mov eax, dword [0x40d144]
push dword [eax + 0x10]
call dword [sym.imp.user32.dll_SendMessageW]
test eax, eax
je 0x404ca0
mov esi, eax
jmp 0x404ed0
push esi
push 1
push 0x110a
mov eax, dword [0x40d144]
push dword [eax + 0x10]
call dword [sym.imp.user32.dll_SendMessageW]
mov esi, eax
test eax, eax
je 0x404ca0
mov dword [ebp - 0x84], esi
lea eax, [ebp - 0x88]
push eax
push 0
push 0x113e
mov eax, dword [0x40d144]
push dword [eax + 0x10]
call dword [sym.imp.user32.dll_SendMessageW]
test eax, eax
je 0x404ca0
mov eax, dword [ebp - 0x64]
test eax, eax
je 0x404eb0
add eax, 2
lea ecx, [ebp - 0x688]
push ecx
push eax
call dword [sym.imp.kernel32.dll_lstrcmpW]
test eax, eax
jne 0x404eb0
mov dword [ebp - 0x60], esi
push 0x1f4
push edi
lea eax, [ebp - 0x27c]
push eax
call sym._memmove
add esp, 0xc
mov dword [ebp - 0x288], 0x4c0043
mov dword [ebp - 0x284], 0x490053
mov dword [ebp - 0x280], 0x5c0044
push 0x60c
push 1
call dword [sym.imp.ucrtbase.dll_calloc]
add esp, 8
mov byte [eax], 7
xor ecx, ecx
nop word cs:[eax + eax]
movzx edx, word [ebp + ecx - 0x288]
mov word [eax + ecx + 2], dx
add ecx, 2
test dx, dx
jne 0x404f70
xor ecx, ecx
nop word [eax + eax]
movzx edx, word [ebp + ecx - 0x27c]
mov word [eax + ecx + 0x202], dx
add ecx, 2
test dx, dx
jne 0x404f90
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x60]
push eax
push 0
push 0x1132
mov eax, dword [0x40d144]
push dword [eax + 0x10]
call dword [sym.imp.user32.dll_SendMessageW]
jmp 0x404ca0