Function at 0x405991
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbc
mov eax, dword [0x411008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp + 8]
mov dword [ebp - 0xbc], ecx
push eax
lea eax, [ebp - 0x94]
push str.TypeLib_
push eax
call dword [sym.imp.Common.dll_class_CTXStringW___cdecl_operator_wchar_t_const___class_CTXStringW_const__]
add esp, 0xc
lea eax, [ebp - 0x90]
xor edi, edi
lea ecx, [ebp - 0x94]
mov dword [ebp - 0x90], edi
push eax
push 0x20019
push edi
call dword [sym.imp.Common.dll_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::destructor_void_]
test eax, eax
je 0x405a36
push eax
push ecx
lea eax, [ebp - 0x94]
mov ecx, esp
push eax
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::constructor_class_CTXStringW_const__]
push str.Reg_RepairPptLibPath___s_Open_failed:_lu
push str.AudioVideoCTXPptCtrl
push 2
push str.func
push 0x11e
push str.file
call fcn.004020f4
add esp, 0x20
jmp 0x405bf8
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x9c]
mov esi, edi
push eax
lea eax, [ebp - 0x88]
mov dword [ebp - 0xa0], esi
push eax
push edi
jmp 0x405bcb
push str.0win32
lea eax, [ebp - 0x88]
push eax
push 0x40e864
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0xb8]
push eax
call dword [sym.imp.Common.dll_class_CTXStringW___cdecl_operator_class_CTXStringW_const___wchar_t_const__]
add esp, 0xc
push eax
lea eax, [ebp - 0xb4]
push eax
call dword [sym.imp.Common.dll_class_CTXStringW___cdecl_operator_class_CTXStringW_const___wchar_t_const__]
add esp, 0xc
push eax
lea eax, [ebp - 0x8c]
push eax
call dword [sym.imp.Common.dll_class_CTXStringW___cdecl_operator_class_CTXStringW_const___wchar_t_const__]
add esp, 0xc
lea ecx, [ebp - 0xb4]
call ebx
lea ecx, [ebp - 0xb8]
call ebx
push 0x40e868
lea ecx, [ebp - 0x98]
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::constructor_wchar_t_const__]
lea eax, [ebp - 0x98]
push eax
push ecx
lea ecx, [ebp - 0x8c]
call dword [sym.imp.Common.dll_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const]
mov edx, eax
mov ecx, SysReAllocString
call fcn.00402b5e
pop ecx
pop ecx
test eax, eax
je 0x405ba1
lea ecx, [ebp - 0x8c]
call dword [sym.imp.Common.dll_public:_wchar_t_const____thiscall_CTXStringW::operator_wchar_t_const__void_const]
push ecx
mov esi, eax
mov ecx, esp
lea eax, [ebp + 0xc]
push eax
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::constructor_class_CTXStringW_const__]
push ecx
mov edx, esi
mov esi, SysReAllocString
push 0x40e868
mov ecx, esi
call fcn.00402c83
add esp, 0xc
mov dword [ebp - 0xb0], esi
mov esi, dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::constructor_class_CTXStringW_const__]
lea eax, [ebp - 0x8c]
lea ecx, [ebp - 0xac]
push eax
call esi
push 0x40e868
lea ecx, [ebp - 0xa8]
call dword [sym.imp.Common.dll_public:_void___thiscall_CTXStringW::constructor_wchar_t_const__]
lea eax, [ebp - 0x98]
push eax
lea ecx, [ebp - 0xa4]
call esi
mov esi, dword [ebp - 0xbc]
lea ecx, [ebp - 0xb0]
push ecx
mov eax, dword [esi + 0x18]
cmp dword [esi + 0x1c], eax
je 0x405b7a
mov ecx, eax
call fcn.00405e74
add dword [esi + 0x18], 0x10
jmp 0x405b83
push eax
lea ecx, [esi + 0x14]
call fcn.00405cba
lea ecx, [ebp - 0xa4]
call ebx
lea ecx, [ebp - 0xa8]
call ebx
lea ecx, [ebp - 0xac]
call ebx
mov esi, dword [ebp - 0xa0]
inc esi
lea ecx, [ebp - 0x98]
mov dword [ebp - 0xa0], esi
call ebx
lea ecx, [ebp - 0x8c]
call ebx
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x88]
push eax
push esi
push dword [ebp - 0x90]
mov dword [ebp - 0x9c], 0x40
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x405a56
push dword [ebp - 0x90]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
inc edi
lea ecx, [ebp - 0x94]
call ebx
lea ecx, [ebp + 8]
call ebx
lea ecx, [ebp + 0xc]
call ebx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409178
leave
ret 8