Function at 0x405e70
Capabilities:
Query or enumerate registry value

Disassembly:
push edi
push esi
push ebp
push ebx
sub esp, 0x674
mov ebp, edx
mov edx, str.cXM3t3L2M_258PJ2MXZxcze9v3DxM7F3dmK5P726d_Y2M_E3vzP2NnDxcT248fLzcK7MPGz4rv0s_J397DxcSK5drew8XE2fbZx8vZz4T1zsbG1A
mov dword [esp + 0x670], eax
lea eax, [esp + 0x418]
call fcn.004224a0
mov edi, eax
lea eax, [esp + 0x518]
mov edx, str.69rGw8nL3sPFxO3FxQ
call fcn.004224a0
mov ebx, eax
mov dword [esp + 0x660], 0x20
call fcn.00422e10
test eax, eax
je 0x405fec
mov eax, dword [esp + 0x660]
mov dword [esp + 0x14], 0x542830
mov edx, edi
mov ecx, ebx
lea esi, [esp + 0x63f]
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], eax
mov eax, reloc.OLEAUT32.dll_SysReAllocString
call fcn.00405390
lea eax, [esp + 0x518]
mov edx, str.6cLB69ra4s_G2g
call fcn.004224a0
mov ebx, eax
mov dword [esp + 0x664], 0x27
call fcn.00422e10
test eax, eax
je 0x405f96
mov edi, dword [esp + 0x664]
mov dword [esp + 0x14], 0x542830
mov eax, reloc.OLEAUT32.dll_SysReAllocString
mov ecx, ebx
lea esi, [esp + 0x618]
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
lea edx, [esp + 0x418]
call fcn.00405390
test ebp, ebp
jne 0x405f65
movsx eax, byte [esp + 0x63f]
test eax, eax
jne 0x405f8b
movsx eax, byte [esp + 0x618]
test eax, eax
jne 0x405f8b
mov eax, dword [esp + 0x670]
mov dword [esp + 0xc], str.69rGw8nL3sPFxO3FxQ
mov edx, 1
mov ecx, str.cXM3t3L2M_258PJ2MXZxcze9v3DxM7F3dmK5P726d_Y2M_E3vzP2NnDxcT248fLzcK7MPGz4rv0s_J397DxcSK5drew8XE2fbZx8vZz4T1zsbG1A
mov dword [esp + 0x10], str.6cLB69ra4s_G2g
call fcn.004061c0
add esp, 0x674
pop ebx
pop ebp
pop esi
pop edi
ret
mov byte [esp + 0x618], 0
lea edi, [esp + 0x418]
lea esi, [esp + 0x218]
mov dword [esp + 0x66c], ebp
push 0x5428fc
push edi
call dword [sym.imp.MSVCR80.dll_strstr]
add esp, 8
mov ebp, eax
test ebp, ebp
je 0x40603c
sub ebp, edi
push ebp
push edi
push esi
call dword [sym.imp.MSVCR80.dll_memmove]
push 0
push 0x542830
add esi, ebp
push esi
call dword [sym.imp.MSVCR80.dll_memmove]
add esp, 0x18
lea edi, [ebp + edi + 1]
jmp 0x405fb3
mov byte [esp + 0x63f], 0
lea esi, [esp + 0x18]
mov dword [esp + 0x66c], ebp
push 0x5428fc
push edi
call dword [sym.imp.MSVCR80.dll_strstr]
add esp, 8
mov ebp, eax
test ebp, ebp
je 0x4060fc
sub ebp, edi
push ebp
push edi
push esi
call dword [sym.imp.MSVCR80.dll_memmove]
push 0
push 0x542830
add esi, ebp
push esi
call dword [sym.imp.MSVCR80.dll_memmove]
add esp, 0x18
lea edi, [ebp + edi + 1]
jmp 0x405fff
mov ebp, dword [esp + 0x66c]
mov edx, edi
mov ecx, edx
and edx, 0xfffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [edx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x406069
mov eax, edx
add edx, ecx
call fcn.00425520
inc eax
push eax
push edi
push esi
call dword [sym.imp.MSVCR80.dll_memmove]
add esp, 0xc
call fcn.00401b70
mov edx, 0x20119
mov ecx, 0x20019
test eax, eax
cmovne ecx, edx
lea eax, [esp + 0x66c]
push eax
push ecx
push 0
lea esi, [esp + 0x224]
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4060ed
lea esi, [esp + 0x618]
lea eax, [esp + 0x664]
push eax
xor edx, edx
push esi
push edx
push edx
push ebx
push dword [esp + 0x680]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, eax
push dword [esp + 0x66c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x405f49
mov byte [esi], 0
jmp 0x405f49
lea eax, [esp + 0x618]
mov byte [eax], 0
jmp 0x405f49
mov ebp, dword [esp + 0x66c]
mov edx, edi
mov ecx, edx
and edx, 0xfffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [edx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x406129
mov eax, edx
add edx, ecx
call fcn.00425520
inc eax
push eax
push edi
push esi
call dword [sym.imp.MSVCR80.dll_memmove]
add esp, 0xc
call fcn.00401b70
mov edx, 0x20119
mov ecx, 0x20019
test eax, eax
cmovne ecx, edx
lea eax, [esp + 0x668]
push eax
push ecx
push 0
lea esi, [esp + 0x24]
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4061aa
lea esi, [esp + 0x63f]
lea eax, [esp + 0x660]
push eax
xor edx, edx
push esi
push edx
push edx
push ebx
push dword [esp + 0x67c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, eax
push dword [esp + 0x668]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x405eed
mov byte [esi], 0
jmp 0x405eed
lea eax, [esp + 0x63f]
mov byte [eax], 0
jmp 0x405eed