Function at 0x405860
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
push edi
xor eax, eax
push 0x12c
mov dword [esp + 0x24], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x20], 0x12c
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebp, eax
push 0x12c
push ebp
mov dword [esp + 0x30], ebp
mov byte [ebp], 0
call fcn.00416d90
push 0x12c
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push 0x12c
push eax
mov dword [esp + 0x2c], eax
mov byte [eax], 0
call fcn.00416d90
push 0xbb9
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
push 0xbb9
push ebx
call fcn.00416d90
push 0x41e1bc
call fcn.0041bfd0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 0x28
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 0x3c]
and ecx, 3
test eax, eax
rep movsb byte es:[edi], byte [esi]
jne 0x405916
push str.Lgesgifm
call fcn.0041bfd0
add esp, 4
jmp 0x405954
push str.BYio__
call fcn.0041bfd0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
push str.h_dUYir
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0041bfd0
add esp, 8
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
push 0x41e150
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0041bfd0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
push str.Th__l
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0041bfd0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
push ebp
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00416df0
add esp, 0xc
test eax, eax
je 0x4059ef
call fcn.00416db0
cmp byte [ebp], 0
je 0x405a07
mov eax, ebp
cmp byte [eax], 0x2f
jne 0x4059ff
mov byte [eax], 0x5c
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4059f7
lea eax, [esp + 0x28]
push eax
push 0x20019
push 0
push ebp
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405b4d
mov dword [esp + 0x3c], 1
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0x2c]
push ecx
push 0
push 0
lea edx, [esp + 0x28]
push 0
push edx
push edi
push esi
push eax
mov dword [esp + 0x3c], 0x12c
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x405b51
inc esi
cmp esi, 1
mov dword [esp + 0x20], esi
jne 0x405a7f
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
jmp 0x405a98
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x41e0b4
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0041bfd0
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x18]
mov ecx, edx
and ecx, 3
inc eax
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x18], eax
cmp eax, ecx
jne 0x405a2f
mov eax, dword [esp + 0x3c]
mov edi, ecx
add eax, 0xbb8
add edi, 0xa
push eax
mov dword [esp + 0x14], edi
mov dword [esp + 0x40], eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebp, eax
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, dword [esp + 0x28]
mov eax, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x18]
push ecx
push edx
call fcn.00416e10
push ebx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov ebx, ebp
mov ebp, dword [esp + 0x34]
add esp, 0x10
jmp 0x405a2f
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x18]
test eax, eax
jle 0x405bb3
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x10], ecx
inc ecx
push ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ecx, dword [esp + 0x38]
mov edx, eax
mov edi, ebx
xor eax, eax
mov dword [ecx], edx
or ecx, 0xffffffff
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
mov edx, dword [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x38]
mov edi, dword [esp + 0x14]
mov dword [ecx], edx
push ebp
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push edi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push ebx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov eax, dword [esp + 0x24]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret