Function at 0x4050e0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46e33c
mov eax, dword fs:[0]
push eax
sub esp, 0x3e8
mov eax, dword [0x496d50]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ebx, 7
xor esi, esi
xor edx, edx
mov dword [ebp - 0x370], eax
mov dword [ebp - 0x36c], ecx
mov dword [ebp - 0x31c], ebx
mov dword [ebp - 0x320], esi
mov word [ebp - 0x330], dx
mov dword [ebp - 4], esi
xor eax, eax
mov dword [ebp - 0x2c8], ebx
mov dword [ebp - 0x2cc], esi
mov word [ebp - 0x2dc], ax
xor ecx, ecx
mov dword [ebp - 0x2ac], ebx
mov dword [ebp - 0x2b0], esi
mov word [ebp - 0x2c0], cx
mov dword [ebp - 0x300], ebx
mov dword [ebp - 0x304], esi
mov word [ebp - 0x314], dx
mov dword [ebp - 0x274], ebx
mov dword [ebp - 0x278], esi
mov word [ebp - 0x288], ax
mov dword [ebp - 0x338], ebx
mov dword [ebp - 0x33c], esi
mov word [ebp - 0x34c], cx
mov dword [ebp - 0x2e4], ebx
mov dword [ebp - 0x2e8], esi
mov word [ebp - 0x2f8], dx
mov byte [ebp - 4], 6
push 0x2c
mov dword [ebp - 0x3ac], esi
call fcn.0044e9d2
add esp, 4
cmp eax, esi
je 0x4065ee
mov dword [ebp - 0x3b0], eax
mov dword [eax], eax
mov eax, dword [ebp - 0x3b0]
mov dword [eax + 4], eax
mov eax, dword [ebp - 0x3b0]
mov dword [eax + 8], eax
mov eax, dword [ebp - 0x3b0]
mov byte [eax + 0x28], 1
mov ecx, dword [ebp - 0x3b0]
mov byte [ecx + 0x29], 1
mov byte [ebp - 4], bl
push 0x48
mov dword [ebp - 0x394], esi
call fcn.0044e9d2
add esp, 4
cmp eax, esi
je 0x4065bb
mov dword [ebp - 0x398], eax
mov dword [eax], eax
mov eax, dword [ebp - 0x398]
mov dword [eax + 4], eax
mov eax, dword [ebp - 0x398]
mov dword [eax + 8], eax
mov edx, dword [ebp - 0x398]
mov byte [edx + 0x44], 1
mov eax, dword [ebp - 0x398]
mov byte [eax + 0x45], 1
mov dword [ebp - 0x3c4], esi
mov dword [ebp - 0x3c0], esi
mov dword [ebp - 0x3bc], esi
mov dword [ebp - 0x3d4], esi
mov dword [ebp - 0x3d0], esi
mov dword [ebp - 0x3cc], esi
mov dword [ebp - 0x384], esi
mov dword [ebp - 0x380], esi
mov dword [ebp - 0x37c], esi
mov byte [ebp - 4], 0xb
xor ecx, ecx
push 5
mov word [ebp - 0x2a4], cx
push str.CLSID
lea ecx, [ebp - 0x2a4]
mov dword [ebp - 0x360], esi
mov dword [ebp - 0x3a4], esi
mov dword [ebp - 0x354], esi
mov dword [ebp - 0x290], ebx
mov dword [ebp - 0x294], esi
call fcn.00401740
mov byte [ebp - 4], 0xc
push 0xe
xor edx, edx
push str._localappdata_
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x220], esi
mov word [ebp - 0x230], dx
call fcn.00401740
lea ecx, [ebp - 0x230]
lea edi, [ebp - 0x3d4]
mov byte [ebp - 4], 0xd
call int.0040ecc0
mov byte [ebp - 4], 0xc
cmp dword [ebp - 0x21c], 8
jb 0x405314
mov eax, dword [ebp - 0x230]
push eax
call fcn.0044e60d
add esp, 4
xor ecx, ecx
push 0x12
mov word [ebp - 0x230], cx
push str._windir_installer
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x220], esi
call fcn.00401740
lea ecx, [ebp - 0x230]
lea edi, [ebp - 0x3d4]
mov byte [ebp - 4], 0xe
call int.0040ecc0
mov byte [ebp - 4], 0xc
cmp dword [ebp - 0x21c], 8
jb 0x40536c
mov edx, dword [ebp - 0x230]
push edx
call fcn.0044e60d
add esp, 4
push 0x3d
xor eax, eax
push str._system_config_systemprofileLocal_SettingsApplication_Data
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x220], esi
mov word [ebp - 0x230], ax
call fcn.00401740
lea ecx, [ebp - 0x230]
lea edi, [ebp - 0x3d4]
mov byte [ebp - 4], 0xf
call int.0040ecc0
mov byte [ebp - 4], 0xc
cmp dword [ebp - 0x21c], 8
jb 0x4053c4
mov ecx, dword [ebp - 0x230]
push ecx
call fcn.0044e60d
add esp, 4
push 0x34
xor edx, edx
push str..globalroot_systemrootInstaller_.__n._
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x220], esi
mov word [ebp - 0x230], dx
call fcn.00401740
lea ecx, [ebp - 0x230]
lea edi, [ebp - 0x3c4]
mov byte [ebp - 4], 0x10
call int.0040ecc0
mov byte [ebp - 4], 0xc
cmp dword [ebp - 0x21c], 8
jb 0x40541c
mov eax, dword [ebp - 0x230]
push eax
call fcn.0044e60d
add esp, 4
mov ecx, dword [ebp - 0x370]
push str._.__n._
add ecx, 0x268
push ecx
lea edx, [ebp - 0x24c]
push edx
call fcn.00414c90
add esp, 0xc
push eax
lea ecx, [ebp - 0x330]
mov byte [ebp - 4], 0x11
call fcn.00401560
mov byte [ebp - 4], 0xc
cmp dword [ebp - 0x238], 8
jb 0x405469
mov eax, dword [ebp - 0x24c]
push eax
call fcn.0044e60d
add esp, 4
call fcn.0043a1b1
mov edi, eax
mov dword [ebp - 0x358], edi
call fcn.0043a06b
push esi
lea ecx, [ebp - 0x350]
mov ebx, eax
call fcn.00439fa0
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x405495
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x350]
call fcn.00439fc8
mov ecx, 0x4743dc
push ecx
mov eax, 0x4743d8
push eax
sub esp, 0xc
mov byte [ebp - 4], 0x12
mov dword [ebp - 0x35c], esp
mov ebx, esp
push ecx
mov eax, esp
mov dword [ebp - 0x35c], esp
push esi
lea ecx, [ebp - 0x364]
mov dword [eax], edi
call fcn.00439fa0
mov eax, dword [edi + 4]
cmp eax, 0xffffffff
jae 0x4054de
inc eax
mov dword [edi + 4], eax
lea ecx, [ebp - 0x364]
call fcn.00439fc8
mov eax, 0x4743e0
call fcn.004169e0
add esp, 4
lea ecx, [ebp - 0x330]
call fcn.00416b00
add esp, 0x14
mov bl, 0xc
push 0
lea ecx, [ebp - 0x350]
mov byte [ebp - 4], bl
call fcn.00439fa0
mov eax, dword [edi + 4]
test eax, eax
je 0x405526
cmp eax, 0xffffffff
jae 0x405526
dec eax
mov dword [edi + 4], eax
mov esi, dword [edi + 4]
neg esi
sbb esi, esi
lea ecx, [ebp - 0x350]
not esi
call fcn.00439fc8
and esi, edi
je 0x405548
mov edx, dword [esi]
mov eax, dword [edx]
push 1
mov ecx, esi
call eax
lea ecx, [ebp - 0x330]
lea edi, [ebp - 0x3c4]
call int.0040ecc0
mov eax, dword [ebp - 0x370]
add eax, 0x284
push 0x4743e4
push eax
lea ecx, [ebp - 0x24c]
push ecx
mov dword [ebp - 0x3d8], eax
call fcn.00414c90
add esp, 0xc
push eax
lea ecx, [ebp - 0x2dc]
mov byte [ebp - 4], 0x13
call fcn.00401560
mov byte [ebp - 4], bl
pop ebp
cld
cmp dword [ebp - 0x238], 8
jb 0x4055aa
mov edx, dword [ebp - 0x24c]
push edx
call fcn.0044e60d
add esp, 4
call fcn.0043a1b1
mov esi, eax
mov dword [ebp - 0x358], esi
call fcn.0043a06b
push 0
lea ecx, [ebp - 0x350]
mov edi, eax
call fcn.00439fa0
mov eax, dword [edi + 4]
cmp eax, 0xffffffff
jae 0x4055d7
inc eax
mov dword [edi + 4], eax
lea ecx, [ebp - 0x350]
call fcn.00439fc8
mov ecx, 0x4743dc
push ecx
mov eax, 0x4743d8
push eax
sub esp, 0xc
mov byte [ebp - 4], 0x14
mov dword [ebp - 0x35c], esp
mov ebx, esp
push ecx
mov eax, esp
mov dword [ebp - 0x35c], esp
push 0
lea ecx, [ebp - 0x364]
mov dword [eax], esi
call fcn.00439fa0
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
jae 0x405621
inc eax
mov dword [esi + 4], eax
lea ecx, [ebp - 0x364]
call fcn.00439fc8
mov eax, 0x4743e0
call fcn.004169e0
add esp, 4
lea ecx, [ebp - 0x2dc]
call fcn.00416b00
add esp, 0x14
push 0
lea ecx, [ebp - 0x350]
mov byte [ebp - 4], 0xc
call fcn.00439fa0
mov eax, dword [esi + 4]
test eax, eax
je 0x405668
cmp eax, 0xffffffff
jae 0x405668
dec eax
mov dword [esi + 4], eax
mov edi, dword [esi + 4]
neg edi
sbb edi, edi
lea ecx, [ebp - 0x350]
not edi
call fcn.00439fc8
and edi, esi
je 0x40568a
mov eax, dword [edi]
mov edx, dword [eax]
push 1
mov ecx, edi
call edx
call fcn.0043a1b1
mov esi, eax
mov dword [ebp - 0x358], esi
call fcn.0043a06b
push 0
lea ecx, [ebp - 0x350]
mov edi, eax
call fcn.00439fa0
mov eax, dword [edi + 4]
cmp eax, 0xffffffff
jae 0x4056b7
inc eax
mov dword [edi + 4], eax
lea ecx, [ebp - 0x350]
call fcn.00439fc8
mov ecx, 0x474400
push ecx
mov eax, 0x4743fc
push eax
sub esp, 0xc
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x35c], esp
mov ebx, esp
push ecx
mov eax, esp
mov dword [ebp - 0x35c], esp
push 0
lea ecx, [ebp - 0x364]
mov dword [eax], esi
call fcn.00439fa0
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
jae 0x405701
inc eax
mov dword [esi + 4], eax
lea ecx, [ebp - 0x364]
call fcn.00439fc8
mov eax, 0x474404
call fcn.004169e0
add esp, 4
lea ecx, [ebp - 0x2dc]
call fcn.00416b00
add esp, 0x14
push 0
lea ecx, [ebp - 0x350]
mov byte [ebp - 4], 0xc
call fcn.00439fa0
mov eax, dword [esi + 4]
test eax, eax
je 0x405748
cmp eax, 0xffffffff
jae 0x405748
dec eax
mov dword [esi + 4], eax
mov edi, dword [esi + 4]
neg edi
sbb edi, edi
lea ecx, [ebp - 0x350]
not edi
call fcn.00439fc8
and edi, esi
je 0x40576a
mov eax, dword [edi]
mov edx, dword [eax]
push 1
mov ecx, edi
call edx
push 1
mov eax, 0x474404
lea esi, [ebp - 0x2dc]
call fcn.00412040
mov ecx, esi
lea edi, [ebp - 0x3c4]
call int.0040ecc0
cmp dword [ebp - 0x290], 8
mov eax, dword [ebp - 0x2a4]
jae 0x40579e
lea eax, [ebp - 0x2a4]
lea ecx, [ebp - 0x38c]
push ecx
push 0x20119
xor ebx, ebx
push ebx
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x405d8e
mov ecx, dword [ebp - 0x38c]
push ebx
push ebx
push ebx
push ebx
lea edx, [ebp - 0x3f0]
push edx
push ebx
push ebx
lea eax, [ebp - 0x3a0]
push eax
push ebx
push ebx
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov eax, dword [ebp - 0x3a0]
cmp eax, ebx
je 0x405d4a
xor edi, edi
mov dword [ebp - 0x350], edi
cmp eax, ebx
jbe 0x405d4a