Function at 0x405ee0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
xor eax, eax
mov ecx, 0xa
mov ebp, esp
push edi
lea edi, [ebp - 0x678]
push esi
push ebx
sub esp, 0x69c
mov dword [ebp - 0x648], 0x45
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x688]
mov dword [ebp - 0x634], 0x100
mov dword [ebp - 0x628], 1
mov dword [ebp - 0x64c], 0xffff0001
mov dword [esp + 8], eax
mov eax, dword [sym.imp.advapi32.dll_RegOpenKeyW]
mov dword [esp + 4], str.CLSID_
mov dword [esp], 0x80000000
mov dword [ebp - 0x68c], eax
call eax
sub esp, 0xc
test eax, eax
jne 0x40643e
lea ebx, [ebp - 0x60c]
mov esi, 0xffffffff
nop
add esi, 1
mov dword [esp + 0xc], 0x100
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov eax, dword [ebp - 0x688]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegEnumKeyW]
sub esp, 0x10
test eax, eax
jne 0x4063d8
lea eax, [ebp - 0x684]
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x688]
mov dword [esp], eax
mov eax, dword [ebp - 0x68c]
call eax
sub esp, 0xc
test eax, eax
jne 0x405f60
mov eax, dword [0x419670]
lea edi, [ebp - 0x680]
mov dword [ebp - 0x67c], 0x200
mov dword [ebp - 0x650], eax
mov dword [esp + 8], edi
mov dword [esp + 4], str.InProcServer32
mov eax, dword [ebp - 0x684]
mov dword [esp], eax
mov eax, dword [ebp - 0x68c]
call eax
lea ecx, [ebp - 0x67c]
sub esp, 0xc
test eax, eax
je 0x406130
mov edx, dword [sym.imp.advapi32.dll_RegQueryValueW]
lea eax, [ebp - 0x40c]
mov dword [ebp - 0x690], eax
mov dword [ebp - 0x67c], 0x200
mov dword [esp + 0xc], ecx
mov eax, dword [ebp - 0x690]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x684]
mov dword [esp], eax
call edx
mov edx, eax
sub esp, 0x10
mov eax, ebx
test edx, edx
jne 0x406055
cmp word [ebp - 0x40c], 0
mov eax, dword [ebp - 0x690]
cmove eax, ebx
mov dword [ebp - 0x638], eax
mov eax, dword [sym.imp.ucrtbase.dll_calloc]
mov dword [esp + 4], 0x60c
mov dword [esp], 1
mov dword [ebp - 0x690], eax
call eax
mov edx, eax
mov byte [eax], 6
xor eax, eax
nop
movzx ecx, word [ebx + eax]
mov word [edx + eax + 2], cx
add eax, 2
test cx, cx
jne 0x406080
xor eax, eax
lea esi, [esi]
nop
movzx ecx, word [ebx + eax]
mov word [edx + eax + 0x202], cx
add eax, 2
test cx, cx
jne 0x406098
mov eax, dword [ebp - 0x650]
mov dword [ebp - 0x624], edx
test eax, eax
je 0x4060e7
lea eax, [ebp - 0x650]
mov dword [esp + 8], 0
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x1132
mov eax, dword [0x419030]
mov dword [esp], eax
call dword [sym.imp.user32.dll_SendMessageW]
sub esp, 0x10
mov dword [esp + 8], edi
mov dword [esp + 4], str.Implemented_Categories
mov eax, dword [ebp - 0x684]
mov dword [esp], eax
mov eax, dword [ebp - 0x68c]
call eax
sub esp, 0xc
test eax, eax
je 0x406220
mov eax, dword [ebp - 0x684]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
jmp 0x405f60
lea eax, [ebp - 0x40c]
mov dword [esp + 0xc], ecx
mov edx, dword [sym.imp.advapi32.dll_RegQueryValueW]
mov dword [ebp - 0x698], ecx
mov dword [ebp - 0x690], eax
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x680]
mov dword [esp], eax
mov dword [ebp - 0x694], edx
call edx
mov edx, dword [ebp - 0x694]
sub esp, 0x10
test eax, eax
mov ecx, dword [ebp - 0x698]
jne 0x4061f0
cmp word [ebp - 0x40c], 0
je 0x4061f0
mov dword [esp + 8], 0x12
mov dword [esp + 4], str.ole32.dll
mov eax, dword [ebp - 0x690]
mov dword [esp], eax
call sub.ucrtbase.dll_memcmp
mov edx, dword [ebp - 0x694]
test eax, eax
mov ecx, dword [ebp - 0x698]
je 0x4061e2
mov dword [esp + 8], 0x18
mov dword [esp + 4], str.oleaut32.dll
mov eax, dword [ebp - 0x690]
mov dword [esp], eax
call sub.ucrtbase.dll_memcmp
mov edx, dword [ebp - 0x694]
test eax, eax
mov ecx, dword [ebp - 0x698]
jne 0x4061f0
mov eax, dword [0x41966c]
mov dword [ebp - 0x650], eax
lea esi, [esi]
mov eax, dword [ebp - 0x680]
mov dword [ebp - 0x698], ecx
mov dword [ebp - 0x694], edx
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x698]
mov edx, dword [ebp - 0x694]
sub esp, 4
jmp 0x40600e
lea eax, [ebp - 0x20c]
mov dword [esp + 0xc], 0x100
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x680]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegEnumKeyW]
sub esp, 0x10
test eax, eax
jne 0x4063d8
mov eax, dword [ebp - 0x680]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, dword [0x419664]
sub esp, 4
test eax, eax
je 0x406446
mov dword [esp + 0xc], eax
mov dword [esp + 8], 4
jmp 0x406294
mov dword [esp + 0xc], edi
mov dword [esp + 8], 1
mov dword [esp + 4], 0x110a
mov eax, dword [0x419030]
mov dword [esp], eax
call dword [sym.imp.user32.dll_SendMessageW]
sub esp, 0x10
mov edi, eax
test eax, eax
je 0x40610f
mov dword [ebp - 0x674], eax
lea eax, [ebp - 0x678]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0x113e
mov eax, dword [0x419030]
mov dword [esp], eax
call dword [sym.imp.user32.dll_SendMessageW]
sub esp, 0x10
test eax, eax
je 0x40610f
mov eax, dword [ebp - 0x654]
test eax, eax
je 0x406288
lea edx, [ebp - 0x20c]
add eax, 2
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_lstrcmpW]
sub esp, 8
test eax, eax
jne 0x406288
mov dword [ebp - 0x650], edi
lea edi, [ebp - 0x600]
mov dword [esp + 8], 0x1f4
mov dword [esp + 4], ebx
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_memmove]
mov dword [ebx], 0x4c0043
mov dword [ebx + 4], 0x490053
mov dword [ebx + 8], 0x5c0044
mov dword [esp + 4], 0x60c
mov dword [esp], 1
mov eax, dword [ebp - 0x690]
call eax
mov edx, eax
mov byte [eax], 7
xor eax, eax
nop
movzx ecx, word [ebx + eax]
mov word [edx + eax + 2], cx
add eax, 2
test cx, cx
jne 0x406370
xor eax, eax
lea esi, [esi]
nop
movzx ecx, word [edi + eax]
mov word [edx + eax + 0x202], cx
add eax, 2
test cx, cx
jne 0x406388
lea eax, [ebp - 0x650]
mov dword [ebp - 0x624], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1132
mov eax, dword [0x419030]
mov dword [esp], eax
call dword [sym.imp.user32.dll_SendMessageW]
sub esp, 0x10
jmp 0x40610f
mov eax, dword [ebp - 0x688]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, dword [0x41966c]
sub esp, 4
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1113
mov dword [esp + 0xc], eax
mov eax, dword [0x419030]
mov dword [esp], eax
call dword [sym.imp.user32.dll_SendMessageW]
mov eax, dword [0x419670]
sub esp, 0x10
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1113
mov dword [esp + 0xc], eax
mov eax, dword [0x419030]
mov dword [esp], eax
call dword [sym.imp.user32.dll_SendMessageW]
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0xc], 0xffff0000
jmp 0x406277