Function at 0x405168
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x4081f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, edx
mov dword [ebp - 0x23c], ebx
push esi
mov esi, ecx
mov dword [ebp - 0x224], esi
test ebx, ebx
jne 0x40519d
mov eax, 0x80070057
jmp 0x405448
push edi
push 0x4027c2
push 0x34
call fcn.004072e1
pop ecx
xor edi, edi
pop ecx
test eax, eax
je 0x4051c7
mov edx, edi
mov ecx, dword [edx + 0x401064]
add edx, 8
mov dword [ecx + eax], edi
cmp edx, 0x68
jb 0x4051b4
jmp 0x4051c9
mov eax, edi
mov dword [ebx], eax
test eax, eax
jne 0x4051d9
mov eax, 0x8007000e
jmp 0x405447
push 0x208
lea eax, [ebp - 0x20c]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea edx, [ebp - 0x20c]
mov ebx, 0x104
mov ecx, esi
push ebx
call fcn.00406627
mov esi, eax
test esi, esi
js 0x405241
push 0x402070
mov edx, ebx
lea ecx, [ebp - 0x20c]
call fcn.0040499d
mov esi, eax
test esi, esi
js 0x405241
lea eax, [ebp - 0x220]
mov edx, ebx
push eax
lea ecx, [ebp - 0x20c]
call fcn.004049eb
mov esi, eax
test esi, esi
jns 0x405241
mov dword [ebp - 0x21c], edi
jmp 0x40524d
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0x21c], eax
mov edx, edi
mov ebx, edi
mov dword [ebp - 0x210], edx
test esi, esi
js 0x4052fa
push edi
push edi
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x230]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x4052e9
mov eax, dword [ebp - 0x218]
xor ecx, ecx
push 0x4027c2
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004072e1
mov ebx, eax
xor ecx, ecx
mov eax, dword [ebp - 0x214]
push 0x4027c2
push 2
shr eax, 1
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004072e1
mov edx, eax
add esp, 0x10
mov dword [ebp - 0x210], edx
test edx, edx
je 0x4052e2
test ebx, ebx
jne 0x4052fa
mov esi, 0x8007000e
jmp 0x4052fa
mov edx, edi
jg 0x4052f1
mov esi, eax
jmp 0x4052fa
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x22c], edi
mov ecx, edi
test esi, esi
js 0x405430
jmp 0x405312
mov edx, dword [ebp - 0x210]
cmp ecx, dword [ebp - 0x230]
jae 0x405430
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x234], eax
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x228], eax
lea eax, [ebp - 0x228]
push eax
push edx
push edi
push edi
lea eax, [ebp - 0x234]
push eax
push ebx
push ecx
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x40536b
jg 0x405360
mov esi, eax
jmp 0x40538c
movzx esi, ax
or esi, 0x80070000
jmp 0x40538c
mov eax, dword [ebp - 0x214]
xor edx, edx
mov ecx, dword [ebp - 0x210]
shr eax, 1
mov word [ecx + eax*2 - 2], dx
xor ecx, ecx
mov eax, dword [ebp - 0x218]
mov word [ebx + eax*2], cx
test esi, esi
js 0x40541b
lea edx, [ebp - 0x238]
mov ecx, ebx
call fcn.004050c1
test eax, eax
js 0x40541b
mov eax, dword [ebp - 0x238]
xor ecx, ecx
mov edx, dword [ebp - 0x228]
shr edx, 1
add edx, dword [ebp - 0x21c]
mov esi, dword [eax*8 + 0x401064]
mov eax, dword [ebp - 0x23c]
push 0x4027c2
mov dword [ebp - 0x240], edx
push 2
add esi, dword [eax]
mov eax, edx
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004072e1
mov dword [esi], eax
pop ecx
pop ecx
test eax, eax
jne 0x4053f8
mov esi, 0x8007000e
jmp 0x40541b
push dword [ebp - 0x210]
lea ecx, [ebp - 0x20c]
push ecx
push 0x402550
push dword [ebp - 0x240]
push eax
call fcn.00404c38
add esp, 0x14
mov esi, eax
mov ecx, dword [ebp - 0x22c]
inc ecx
mov dword [ebp - 0x22c], ecx
test esi, esi
jns 0x40530c
push dword [ebp - 0x210]
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void__]
push ebx
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void__]
pop ecx
pop ecx
mov eax, esi
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00406d40
leave
ret