Function at 0x406e60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x390
push ebx
push esi
push edi
push 0x488288
lea eax, [ebp - 0x88]
push eax
call fcn.004202d0
add esp, 8
mov eax, dword [ebp + 0x10]
cmp dword [eax], 2
jne 0x406ead
push 0x4882ac
lea eax, [ebp - 0x88]
push eax
call fcn.004202e0
add esp, 8
call fcn.0040dfa6
mov dword [ebp - 8], eax
jmp 0x406eda
mov eax, dword [ebp + 0x10]
cmp dword [eax], 1
jne 0x406eda
push str.VxdHasp95
lea eax, [ebp - 0x88]
push eax
call fcn.004202e0
add esp, 8
push 3
call fcn.00416af8
add esp, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [eax + 0x118], 0
cmp dword [ebp + 0xc], 0x2b0
jbe 0x406f0b
test byte [ebp - 8], 2
je 0x406f0b
mov eax, dword [ebp + 8]
mov dword [eax + 0x118], 2
lea eax, [ebp - 0x290]
push eax
lea eax, [ebp - 0x88]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0
je 0x406f72
cmp dword [ebp - 0x28c], 2
jne 0x406f49
jmp 0x406f6d
push 0x2002000
call fcn.00406c68
add esp, 4
push 0x10001
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x407752
jmp 0x40772a
mov eax, dword [ebp + 8]
or dword [eax + 0x118], 1
mov dword [ebp - 4], 0x80
push 0x4882c0
lea eax, [ebp - 0x310]
push eax
call fcn.004202d0
add esp, 8
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x288]
push eax
push 0
lea eax, [ebp - 0x310]
push eax
mov eax, dword [ebp - 0x290]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0
je 0x406fe0
push 0x4882c8
mov eax, dword [ebp + 8]
push eax
call fcn.004202d0
add esp, 8
mov dword [ebp - 4], 0x14
push 0x4882d0
lea eax, [ebp - 0x310]
push eax
call fcn.004202d0
add esp, 8
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
add eax, 0x80
push eax
lea eax, [ebp - 0x288]
push eax
push 0
lea eax, [ebp - 0x310]
push eax
mov eax, dword [ebp - 0x290]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0
je 0x40704e
push 0x4882d8
mov eax, dword [ebp + 8]
add eax, 0x80
push eax
call fcn.004202d0
add esp, 8
mov dword [ebp - 4], 0x80
push 0x4882e0
lea eax, [ebp - 0x310]
push eax
call fcn.004202d0
add esp, 8
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
add eax, 0x120
push eax
lea eax, [ebp - 0x288]
push eax
push 0
lea eax, [ebp - 0x310]
push eax
mov eax, dword [ebp - 0x290]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0
je 0x4070bc
push 0x4882ec
mov eax, dword [ebp + 8]
add eax, 0x120
push eax
call fcn.004202d0
add esp, 8
mov eax, dword [ebp - 0x290]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0
je 0x40710d
cmp dword [ebp - 0x28c], 6
je 0x40710d
push 0x2002000
call fcn.00406c68
add esp, 4
push 0x10002
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x407752
push 0x4882f4
lea eax, [ebp - 0x88]
push eax
call fcn.004202e0
add esp, 8
lea eax, [ebp - 0x290]
push eax
lea eax, [ebp - 0x88]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0
jne 0x407682
mov dword [ebp - 4], 0x80
push 0x488300
lea eax, [ebp - 0x310]
push eax
call fcn.004202d0
add esp, 8
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x390]
push eax
push 0
push 0
lea eax, [ebp - 0x310]
push eax
mov eax, dword [ebp - 0x290]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0
je 0x4071b0
mov eax, dword [ebp + 8]
mov dword [eax + 0x94], 0xffffffff
jmp 0x407219
push 0x488310
lea eax, [ebp - 0x390]
push eax
call fcn.00420970
add esp, 8
test eax, eax
jne 0x4071de
mov eax, dword [ebp + 8]
mov dword [eax + 0x94], 1
jmp 0x407219
push 0x488314
lea eax, [ebp - 0x390]
push eax
call fcn.00420970
add esp, 8
test eax, eax
jne 0x40720c
mov eax, dword [ebp + 8]
mov dword [eax + 0x94], 2
jmp 0x407219
mov eax, dword [ebp + 8]
mov dword [eax + 0x94], 0xffffffff
mov dword [ebp - 4], 0x80
push 0x488318
lea eax, [ebp - 0x310]
push eax
call fcn.004202d0
add esp, 8
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
add eax, 0x98
push eax
lea eax, [ebp - 0x288]
push eax
push 0
lea eax, [ebp - 0x310]
push eax
mov eax, dword [ebp - 0x290]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0
je 0x407287
push 0x488328
mov eax, dword [ebp + 8]
add eax, 0x98
push eax
call fcn.004202d0
add esp, 8
mov dword [ebp - 4], 0x80
push 0x488330
lea eax, [ebp - 0x310]
push eax
call fcn.004202d0
add esp, 8
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x390]
push eax
lea eax, [ebp - 0x288]
push eax
push 0
lea eax, [ebp - 0x310]
push eax
mov eax, dword [ebp - 0x290]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0
je 0x4072ef
mov eax, dword [ebp + 8]
mov dword [eax + 0x1a0], 0xffffffff
jmp 0x4073b4
push 0x48833c
lea eax, [ebp - 0x390]
push eax
call fcn.004208f0
add esp, 8
test eax, eax
je 0x40731d
mov eax, dword [ebp + 8]
mov dword [eax + 0x1a0], 1
jmp 0x4073b4
push 0x488344
lea eax, [ebp - 0x390]
push eax
call fcn.004208f0
add esp, 8
test eax, eax
je 0x40734b
mov eax, dword [ebp + 8]
mov dword [eax + 0x1a0], 2
jmp 0x4073b4
push 0x488348
lea eax, [ebp - 0x390]
push eax
call fcn.004208f0
add esp, 8
test eax, eax
je 0x407379
mov eax, dword [ebp + 8]
mov dword [eax + 0x1a0], 4
jmp 0x4073b4
push 0x488350
lea eax, [ebp - 0x390]
push eax
call fcn.004208f0
add esp, 8
test eax, eax
je 0x4073a7
mov eax, dword [ebp + 8]
mov dword [eax + 0x1a0], 8
jmp 0x4073b4
mov eax, dword [ebp + 8]
mov dword [eax + 0x1a0], 0xffffffff
cmp dword [ebp + 0xc], 0x2b4
jne 0x4074ee
mov dword [ebp - 4], 0x80
push 0x488358
lea eax, [ebp - 0x310]
push eax
call fcn.004202d0
add esp, 8
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x390]
push eax
lea eax, [ebp - 0x288]
push eax
push 0
lea eax, [ebp - 0x310]
push eax
mov eax, dword [ebp - 0x290]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0
je 0x407429
mov eax, dword [ebp + 8]
mov dword [eax + 0x2b0], 0xffffffff
jmp 0x4074ee
push 0x488364
lea eax, [ebp - 0x390]
push eax
call fcn.00421830
add esp, 8
test eax, eax
jne 0x407457
mov eax, dword [ebp + 8]
mov dword [eax + 0x2b0], 3
jmp 0x4074ee
push 0x488374
lea eax, [ebp - 0x390]
push eax
call fcn.00421830
add esp, 8
test eax, eax
jne 0x407485
mov eax, dword [ebp + 8]
mov dword [eax + 0x2b0], 2
jmp 0x4074ee
push 0x488380
lea eax, [ebp - 0x390]
push eax
call fcn.00421830
add esp, 8
test eax, eax
jne 0x4074b3
mov eax, dword [ebp + 8]
mov dword [eax + 0x2b0], 1
jmp 0x4074ee
push 0x488384
lea eax, [ebp - 0x390]
push eax
call fcn.00421830
add esp, 8
test eax, eax
jne 0x4074e1
mov eax, dword [ebp + 8]
mov dword [eax + 0x2b0], 4
jmp 0x4074ee
mov eax, dword [ebp + 8]
mov dword [eax + 0x2b0], 0xffffffff
mov eax, dword [ebp + 0x10]
cmp dword [eax], 2
jne 0x407656
mov dword [ebp - 4], 0x80
push 0x48838c
lea eax, [ebp - 0x310]
push eax
call fcn.004202d0
add esp, 8
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x390]
push eax
lea eax, [ebp - 0x288]
push eax
push 0
lea eax, [ebp - 0x310]
push eax
mov eax, dword [ebp - 0x290]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0
je 0x407562
mov eax, dword [ebp + 8]
mov dword [eax + 0x1a4], 0xffffffff
jmp 0x407571
mov eax, dword [ebp - 0x390]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x1a4], eax
push 0x488394
lea eax, [ebp - 0x310]
push eax
call fcn.004202d0
add esp, 8
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x390]
push eax
lea eax, [ebp - 0x288]
push eax
push 0
lea eax, [ebp - 0x310]
push eax
mov eax, dword [ebp - 0x290]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0
je 0x4075d2
mov eax, dword [ebp + 8]
mov dword [eax + 0x1a8], 0xffffffff
jmp 0x4075e1
mov eax, dword [ebp - 0x390]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x1a8], eax
push 0x48839c
lea eax, [ebp - 0x310]
push eax
call fcn.004202d0
add esp, 8
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x390]
push eax
lea eax, [ebp - 0x288]
push eax
push 0
lea eax, [ebp - 0x310]
push eax
mov eax, dword [ebp - 0x290]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0
je 0x407642
mov eax, dword [ebp + 8]
mov dword [eax + 0x1ac], 0xffffffff
jmp 0x407651
mov eax, dword [ebp - 0x390]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x1ac], eax
jmp 0x40767d
mov eax, dword [ebp + 8]
mov dword [eax + 0x1a4], 0xffffffff
mov eax, dword [ebp + 8]
mov dword [eax + 0x1a8], 0xffffffff
mov eax, dword [ebp + 8]
mov dword [eax + 0x1ac], 0xffffffff
jmp 0x4076d9
mov eax, dword [ebp + 8]
mov dword [eax + 0x94], 0xffffffff
mov eax, dword [ebp + 8]
mov dword [eax + 0x1a0], 0xffffffff
mov eax, dword [ebp + 8]
mov dword [eax + 0x1a4], 0xffffffff
mov eax, dword [ebp + 8]
mov dword [eax + 0x1a8], 0xffffffff
mov eax, dword [ebp + 8]
mov dword [eax + 0x1ac], 0xffffffff
push 0x4883a4
mov eax, dword [ebp + 8]
add eax, 0x98
push eax
call fcn.004202d0
add esp, 8
mov eax, dword [ebp - 0x290]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 0
je 0x40772a
cmp dword [ebp - 0x28c], 6
je 0x40772a
push 0x2002000
call fcn.00406c68
add esp, 4
push 0x10002
call fcn.00406ccc
add esp, 4
mov eax, 0xffffffff
jmp 0x407752
mov eax, dword [ebp + 8]
mov dword [eax + 0x11c], 0
mov eax, dword [ebp + 8]
mov byte [eax + 0x1b0], 0
mov eax, dword [ebp + 8]
mov byte [eax + 0x230], 0
xor eax, eax
jmp 0x407752
pop edi
pop esi
pop ebx
leave
ret