Function at 0x405940
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
xor eax, eax
mov ecx, 0xa
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x684]
push ebx
sub esp, 0x69c
mov dword [ebp - 0x654], 0x45
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x694]
mov dword [ebp - 0x640], 0x100
mov dword [ebp - 0x634], 1
mov dword [ebp - 0x658], 0xffff0001
mov dword [esp + 8], eax
mov dword [esp + 4], str.CLSID_
mov dword [esp], 0x80000000
call sym._RegOpenKeyW_12
sub esp, 0xc
test eax, eax
jne 0x405db3
mov esi, 0xffffffff
lea ebx, [ebp - 0x618]
lea esi, [esi]
nop
add esi, 1
mov dword [esp + 0xc], 0x100
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov eax, dword [ebp - 0x694]
mov dword [esp], eax
call sym._RegEnumKeyW_16
sub esp, 0x10
test eax, eax
jne 0x405d50
lea eax, [ebp - 0x690]
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x694]
mov dword [esp], eax
call sym._RegOpenKeyW_12
sub esp, 0xc
test eax, eax
jne 0x4059c0
mov eax, dword [0x416670]
lea edi, [ebp - 0x68c]
mov dword [ebp - 0x688], 0x200
mov dword [ebp - 0x65c], eax
mov dword [esp + 8], edi
mov dword [esp + 4], str.InProcServer32
mov eax, dword [ebp - 0x690]
mov dword [esp], eax
call sym._RegOpenKeyW_12
lea edx, [ebp - 0x688]
sub esp, 0xc
test eax, eax
je 0x405b30
mov dword [ebp - 0x688], 0x200
lea eax, [ebp - 0x418]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x690]
mov dword [esp], eax
call sym._RegQueryValueW_16
mov edx, eax
sub esp, 0x10
mov eax, ebx
test edx, edx
jne 0x405a9f
cmp word [ebp - 0x418], 0
lea eax, [ebp - 0x418]
cmove eax, ebx
mov dword [ebp - 0x644], eax
mov ecx, ebx
mov edx, ebx
mov eax, 6
mov dword [esp], 0
call sym._CreateITEM_INFO
mov dword [ebp - 0x630], eax
mov eax, dword [ebp - 0x65c]
test eax, eax
je 0x405af4
lea eax, [ebp - 0x65c]
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x1132
mov eax, dword [0x416030]
mov dword [esp], eax
call sym._SendMessageW_16
sub esp, 0x10
mov dword [esp + 8], edi
mov dword [esp + 4], str.Implemented_Categories
mov eax, dword [ebp - 0x690]
mov dword [esp], eax
call sym._RegOpenKeyW_12
sub esp, 0xc
test eax, eax
je 0x405bd8
mov eax, dword [ebp - 0x690]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
jmp 0x4059c0
lea eax, [ebp - 0x418]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x68c]
mov dword [esp], eax
call sym._RegQueryValueW_16
sub esp, 0x10
test eax, eax
jne 0x405bb8
cmp word [ebp - 0x418], 0
je 0x405bb8
lea eax, [ebp - 0x418]
mov dword [esp + 8], 0x12
mov dword [esp + 4], str.ole32.dll
mov dword [esp], eax
call sym._memcmp
test eax, eax
je 0x405ba9
lea eax, [ebp - 0x418]
mov dword [esp + 8], 0x18
mov dword [esp + 4], str.oleaut32.dll
mov dword [esp], eax
call sym._memcmp
test eax, eax
jne 0x405bb8
mov eax, dword [0x41666c]
mov dword [ebp - 0x65c], eax
lea esi, [esi]
mov eax, dword [ebp - 0x68c]
mov dword [esp], eax
call sym._RegCloseKey_4
lea edx, [ebp - 0x688]
sub esp, 4
jmp 0x405a55
lea eax, [ebp - 0x218]
mov dword [esp + 0xc], 0x100
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x68c]
mov dword [esp], eax
call sym._RegEnumKeyW_16
sub esp, 0x10
test eax, eax
jne 0x405d50
mov eax, dword [ebp - 0x68c]
mov dword [esp], eax
call sym._RegCloseKey_4
mov eax, dword [0x416664]
sub esp, 4
test eax, eax
je 0x405dc0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 4
jmp 0x405c4c
mov dword [esp + 0xc], edi
mov dword [esp + 8], 1
mov dword [esp + 4], 0x110a
mov eax, dword [0x416030]
mov dword [esp], eax
call sym._SendMessageW_16
sub esp, 0x10
mov edi, eax
test eax, eax
je 0x405b19
mov dword [ebp - 0x680], eax
lea eax, [ebp - 0x684]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0x113e
mov eax, dword [0x416030]
mov dword [esp], eax
call sym._SendMessageW_16
sub esp, 0x10
test eax, eax
je 0x405b19
mov eax, dword [ebp - 0x660]
test eax, eax
je 0x405c40
lea ecx, [ebp - 0x218]
add eax, 2
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_lstrcmpW]
sub esp, 8
test eax, eax
jne 0x405c40
mov dword [ebp - 0x65c], edi
lea edi, [ebp - 0x60c]
mov dword [esp + 8], 0x1f4
mov dword [esp + 4], ebx
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_memmove]
mov dword [ebx], 0x4c0043
mov ecx, edi
mov edx, ebx
mov dword [ebx + 4], 0x490053
mov eax, 7
mov dword [ebx + 8], 0x5c0044
mov dword [esp], 0
call sym._CreateITEM_INFO
mov dword [ebp - 0x630], eax
lea eax, [ebp - 0x65c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1132
mov eax, dword [0x416030]
mov dword [esp], eax
call sym._SendMessageW_16
sub esp, 0x10
jmp 0x405b19
mov eax, dword [ebp - 0x694]
mov dword [esp], eax
call sym._RegCloseKey_4
mov eax, dword [0x41666c]
sub esp, 4
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1113
mov eax, dword [0x416030]
mov dword [esp], eax
call sym._SendMessageW_16
mov eax, dword [0x416670]
sub esp, 0x10
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1113
mov eax, dword [0x416030]
mov dword [esp], eax
call sym._SendMessageW_16
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0xc], 0xffff0000
jmp 0x405c2d