Function at 0x406280
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
xor eax, eax
mov ecx, 0xa
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x684]
push ebx
sub esp, 0x6bc
mov dword [ebp - 0x654], 0x45
mov dword [ebp - 0x640], 0x100
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x694]
mov dword [ebp - 0x634], 1
mov dword [ebp - 0x658], 0xffff0001
mov dword [esp + 4], str.CLSID_
mov dword [esp], 0x80000000
mov dword [esp + 8], eax
mov eax, dword [sym.imp.advapi32.dll_RegOpenKeyW]
mov dword [ebp - 0x6a0], eax
call eax
sub esp, 0xc
test eax, eax
jne 0x4065fe
mov edi, dword [sym.imp.user32.dll_SendMessageW]
lea ebx, [ebp - 0x618]
mov dword [ebp - 0x69c], 0xffffffff
lea esi, [esi]
add dword [ebp - 0x69c], 1
mov dword [esp + 0xc], 0x100
mov eax, dword [ebp - 0x69c]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x694]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegEnumKeyW]
sub esp, 0x10
test eax, eax
jne 0x4065a0
lea eax, [ebp - 0x690]
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x694]
mov dword [esp], eax
call dword [ebp - 0x6a0]
sub esp, 0xc
test eax, eax
jne 0x406310
mov eax, dword [0x41a710]
lea esi, [ebp - 0x68c]
mov dword [ebp - 0x688], 0x200
mov dword [esp + 4], str.InProcServer32
mov dword [esp + 8], esi
mov dword [ebp - 0x65c], eax
mov eax, dword [ebp - 0x690]
mov dword [esp], eax
call dword [ebp - 0x6a0]
sub esp, 0xc
test eax, eax
lea edx, [ebp - 0x688]
je 0x406610
lea eax, [ebp - 0x418]
mov ecx, dword [sym.imp.advapi32.dll_RegQueryValueW]
mov dword [ebp - 0x6a4], eax
mov eax, dword [ebp - 0x6a4]
mov dword [ebp - 0x688], 0x200
mov dword [esp + 0xc], edx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x690]
mov dword [esp], eax
call ecx
sub esp, 0x10
test eax, eax
jne 0x406590
cmp word [ebp - 0x418], 0
je 0x406590
mov eax, dword [ebp - 0x6a4]
mov dword [ebp - 0x644], eax
mov dword [esp], 0
mov ecx, ebx
mov edx, ebx
mov eax, 6
call dbg.CreateITEM_INFO
mov dword [ebp - 0x630], eax
mov eax, dword [ebp - 0x65c]
test eax, eax
je 0x406460
lea eax, [ebp - 0x65c]
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1132
mov dword [esp + 0xc], eax
mov eax, dword [0x41a4d0]
mov dword [esp], eax
call edi
sub esp, 0x10
mov eax, dword [ebp - 0x690]
mov dword [esp + 8], esi
mov dword [esp + 4], str.Implemented_Categories
mov dword [esp], eax
call dword [ebp - 0x6a0]
sub esp, 0xc
test eax, eax
jne 0x406577
lea eax, [ebp - 0x218]
mov dword [esp + 0xc], 0x100
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x68c]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegEnumKeyW]
sub esp, 0x10
test eax, eax
jne 0x4065a0
mov eax, dword [ebp - 0x68c]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, dword [0x41a704]
sub esp, 4
test eax, eax
je 0x406790
mov dword [esp + 0xc], eax
mov dword [esp + 8], 4
jmp 0x406558
mov dword [ebp - 0x680], eax
lea eax, [ebp - 0x684]
mov dword [esp + 8], 0
mov dword [esp + 4], 0x113e
mov dword [esp + 0xc], eax
mov eax, dword [0x41a4d0]
mov dword [esp], eax
call edi
sub esp, 0x10
test eax, eax
je 0x406577
mov eax, dword [ebp - 0x660]
test eax, eax
je 0x40654c
lea edx, [ebp - 0x218]
add eax, 2
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.kernel32.dll_lstrcmpW]
sub esp, 8
test eax, eax
je 0x406710
mov dword [esp + 0xc], esi
mov dword [esp + 8], 1
mov eax, dword [0x41a4d0]
mov dword [esp + 4], 0x110a
mov dword [esp], eax
call edi
sub esp, 0x10
test eax, eax
mov esi, eax
jne 0x4064f0
mov eax, dword [ebp - 0x690]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
jmp 0x406310
mov dword [ebp - 0x644], ebx
jmp 0x406414
mov eax, dword [ebp - 0x694]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, dword [0x41a70c]
sub esp, 4
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1113
mov dword [esp + 0xc], eax
mov eax, dword [0x41a4d0]
mov dword [esp], eax
call edi
mov eax, dword [0x41a710]
sub esp, 0x10
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1113
mov dword [esp + 0xc], eax
mov eax, dword [0x41a4d0]
mov dword [esp], eax
call edi
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x418]
mov ecx, dword [sym.imp.advapi32.dll_RegQueryValueW]
mov dword [esp + 0xc], edx
mov dword [ebp - 0x6ac], edx
mov dword [esp + 4], 0
mov dword [ebp - 0x6a4], eax
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x68c]
mov dword [ebp - 0x6a8], ecx
mov dword [esp], eax
call ecx
sub esp, 0x10
test eax, eax
mov ecx, dword [ebp - 0x6a8]
mov edx, dword [ebp - 0x6ac]
jne 0x4066e0
cmp word [ebp - 0x418], 0
je 0x4066e0
mov ecx, dword [sym.imp.ucrtbase.dll_memcmp]
mov eax, dword [ebp - 0x6a4]
mov dword [esp + 8], 0x12
mov dword [esp + 4], str.ole32.dll
mov dword [ebp - 0x6b0], ecx
mov dword [esp], eax
call ecx
test eax, eax
mov ecx, dword [ebp - 0x6a8]
mov edx, dword [ebp - 0x6ac]
je 0x4066d2
mov eax, dword [ebp - 0x6a4]
mov ecx, dword [ebp - 0x6b0]
mov dword [esp + 8], 0x18
mov dword [esp + 4], str.oleaut32.dll
mov dword [esp], eax
call ecx
test eax, eax
mov ecx, dword [ebp - 0x6a8]
mov edx, dword [ebp - 0x6ac]
jne 0x4066e0
mov eax, dword [0x41a70c]
mov dword [ebp - 0x65c], eax
lea esi, [esi]
mov eax, dword [ebp - 0x68c]
mov dword [ebp - 0x6ac], edx
mov dword [ebp - 0x6a8], ecx
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov edx, dword [ebp - 0x6ac]
sub esp, 4
mov ecx, dword [ebp - 0x6a8]
jmp 0x4063c4
mov dword [ebp - 0x65c], esi
lea esi, [ebp - 0x60c]
mov dword [esp + 8], 0x1f4
mov dword [esp + 4], ebx
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_memmove]
mov eax, dword [str.CLSID_]
mov ecx, esi
mov edx, ebx
mov dword [ebx], eax
mov eax, dword [0x410424]
mov dword [ebx + 4], eax
mov eax, dword [0x410428]
mov dword [ebx + 8], eax
mov dword [esp], 0
mov eax, 7
call dbg.CreateITEM_INFO
mov dword [ebp - 0x630], eax
lea eax, [ebp - 0x65c]
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1132
mov dword [esp + 0xc], eax
mov eax, dword [0x41a4d0]
mov dword [esp], eax
call edi
sub esp, 0x10
jmp 0x406577
mov dword [esp + 0xc], 0xffff0000
jmp 0x4064dd