Function at 0x405a5f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x354
mov eax, dword [0x42104c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0x14]
xor ecx, ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x348], eax
mov eax, dword [ebp + 0x18]
push 0x21c
mov dword [ebp - 0x354], eax
mov dword [eax], ecx
push ecx
lea eax, [ebp - 0x320]
push eax
mov dword [ebp - 0x33c], edi
mov dword [ebp - 0x334], ecx
mov dword [ebp - 0x324], ecx
mov dword [ebp - 0x330], ecx
mov dword [ebp - 0x338], ecx
mov dword [ebp - 0x344], ecx
mov dword [ebp - 0x340], ecx
call fcn.00411211
push 0xffffffffffffffff
push esi
lea eax, [ebp - 0x318]
push 0x80
push eax
mov dword [ebp - 0x320], 0x21c
mov dword [ebp - 0x31c], 0xf
call fcn.00411144
add esp, 0x1c
lea eax, [ebp - 0x32c]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push 0
push 0x401780
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x32c], 4
call edi
mov esi, eax
test esi, esi
jle 0x405b39
and esi, 0xffff
or esi, 0x80070000
test esi, esi
js 0x40609b
lea eax, [ebp - 0x32c]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x40178c
push dword [ebp - 0x33c]
mov dword [ebp - 0x32c], 4
call edi
mov esi, eax
test esi, esi
jle 0x405b7c
and esi, 0xffff
or esi, 0x80070000
test esi, esi
js 0x40609b
lea eax, [ebp - 0x32c]
push eax
lea eax, [ebp - 0x210]
push eax
push 0
push 0
push 0x4017a8
push dword [ebp - 0x33c]
mov dword [ebp - 0x32c], 4
call edi
mov esi, eax
test esi, esi
jle 0x405bbf
and esi, 0xffff
or esi, 0x80070000
test esi, esi
js 0x40609b
lea eax, [ebp - 0x334]
push eax
lea eax, [ebp - 0x320]
push eax
push ebx
push dword [ebp - 0x348]
call fcn.004059e2
mov esi, eax
test esi, esi
js 0x40609b
lea eax, [ebp - 0x324]
push eax
push 0x20019
push 0
push 0x4017bc
push dword [ebp - 0x33c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jle 0x405c1a
and esi, 0xffff
or esi, 0x80070000
cmp esi, 0x80070002
jne 0x405c25
xor esi, esi
inc esi
test esi, esi
js 0x40609b
jne 0x405da2
mov edi, pe_nt_image_headers32
push edi
lea eax, [ebp - 0x338]
push eax
call fcn.00416d68
mov esi, eax
test esi, esi
js 0x40609b
lea eax, [ebp - 0x32c]
push eax
push dword [ebp - 0x338]
xor ecx, ecx
push ecx
push ecx
lea eax, [ebp - 0x328]
push eax
lea eax, [ebp - 0x104]
push eax
mov ebx, ecx
mov dword [ebp - 0x32c], 0x200
push ecx
jmp 0x405d5d
cmp esi, 0xea
jne 0x405cf8
mov ecx, dword [ebp - 0x32c]
lea eax, [ecx + ecx]
cmp edi, eax
jae 0x405d98
lea edi, [ecx*2 + 0x32]
push edi
lea eax, [ebp - 0x338]
push eax
call fcn.00416d68
mov esi, eax
test esi, esi
js 0x40609b
lea eax, [edi + edi]
mov dword [ebp - 0x32c], eax
lea eax, [ebp - 0x32c]
push eax
push dword [ebp - 0x338]
lea eax, [ebp - 0x328]
push 0
push 0
push eax
lea eax, [ebp - 0x104]
push eax
push ebx
push dword [ebp - 0x324]
mov dword [ebp - 0x328], 0x80
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov esi, eax
test esi, esi
jle 0x405d0a
and esi, 0xffff
or esi, 0x80070000
test esi, esi
js 0x40609b
push dword [ebp - 0x338]
mov eax, dword [ebp - 0x334]
mov ecx, dword [eax]
lea edx, [ebp - 0x104]
push edx
push eax
call dword [ecx + 0x1c]
mov esi, eax
test esi, esi
js 0x40609b
lea eax, [edi + edi]
mov dword [ebp - 0x32c], eax
lea eax, [ebp - 0x32c]
push eax
push dword [ebp - 0x338]
lea eax, [ebp - 0x328]
push 0
push 0
push eax
lea eax, [ebp - 0x104]
inc ebx
push eax
push ebx
push dword [ebp - 0x324]
mov dword [ebp - 0x328], 0x80
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov esi, eax
cmp esi, 0x103
jne 0x405c80
push dword [ebp - 0x324]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call ebx
and dword [ebp - 0x324], 0
jmp 0x405da8
mov esi, 0x8000ffff
jmp 0x40609b
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x324]
push eax
push 0x20019
push 0
push 0x4017e8
push dword [ebp - 0x33c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jle 0x405dd9
and esi, 0xffff
or esi, 0x80070000
cmp esi, 0x80070002
jne 0x405de4
xor esi, esi
inc esi
test esi, esi
js 0x40609b
jne 0x405f10
lea eax, [ebp - 0x350]
push eax
xor edi, edi
xor ecx, ecx
push ecx
push ecx
push ecx
lea eax, [ebp - 0x328]
push eax
lea eax, [ebp - 0x104]
push eax
push ecx
jmp 0x405ec1
lea eax, [ebp - 0x330]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x324]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jle 0x405e49
and esi, 0xffff
or esi, 0x80070000
test esi, esi
js 0x40609b
mov eax, dword [ebp - 0x334]
mov ecx, dword [eax]
lea edx, [ebp - 0x344]
push edx
push dword [ebp - 0x348]
lea edx, [ebp - 0x104]
push dword [ebp - 0x330]
push edx
push eax
call dword [ecx + 0x48]
mov ecx, dword [ebp - 0x344]
test ecx, ecx
je 0x405e97
mov eax, dword [ecx + 4]
mov eax, dword [eax + 4]
add ecx, 4
add eax, ecx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
and dword [ebp - 0x344], 0
push dword [ebp - 0x330]
call ebx
xor ecx, ecx
lea eax, [ebp - 0x350]
push eax
push ecx
push ecx
push ecx
lea eax, [ebp - 0x328]
push eax
lea eax, [ebp - 0x104]
inc edi
push eax
mov dword [ebp - 0x330], ecx
push edi
push dword [ebp - 0x324]
mov dword [ebp - 0x328], 0x80
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
test esi, esi
je 0x405e14
jle 0x405eef
and esi, 0xffff
or esi, 0x80070000
cmp esi, 0x80070103
jne 0x405ef9
xor esi, esi
test esi, esi
js 0x40609b
push dword [ebp - 0x324]
call ebx
and dword [ebp - 0x324], 0
lea eax, [ebp - 0x324]
push eax
push 0x20019
push 0
push 0x4017d4
push dword [ebp - 0x33c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jle 0x405f41
and esi, 0xffff
or esi, 0x80070000
cmp esi, 0x80070002
jne 0x405f4c
xor esi, esi
inc esi
test esi, esi
js 0x40609b
jne 0x406078
lea eax, [ebp - 0x350]
push eax
xor edi, edi
xor ecx, ecx
push ecx
push ecx
push ecx
lea eax, [ebp - 0x328]
push eax
lea eax, [ebp - 0x104]
push eax
push ecx
jmp 0x40602d
lea eax, [ebp - 0x330]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x324]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jle 0x405fb1
and esi, 0xffff
or esi, 0x80070000
test esi, esi
js 0x40609b
mov eax, dword [ebp - 0x334]
mov ecx, dword [eax]
lea edx, [ebp - 0x340]
push edx
push dword [ebp - 0x330]
lea edx, [ebp - 0x104]
push edx
push eax
call dword [ecx + 0x2c]
mov esi, eax
test esi, esi
js 0x40609b
mov ecx, dword [ebp - 0x340]
test ecx, ecx
je 0x406003
mov eax, dword [ecx + 4]
mov eax, dword [eax + 4]
add ecx, 4
add eax, ecx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
and dword [ebp - 0x340], 0
push dword [ebp - 0x330]
call ebx
xor ecx, ecx
lea eax, [ebp - 0x350]
push eax
push ecx
push ecx
push ecx
lea eax, [ebp - 0x328]
push eax
lea eax, [ebp - 0x104]
inc edi
push eax
mov dword [ebp - 0x330], ecx
push edi
push dword [ebp - 0x324]
mov dword [ebp - 0x328], 0x80
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
test esi, esi
je 0x405f7c
jle 0x40605b
and esi, 0xffff
or esi, 0x80070000
cmp esi, 0x80070103
jne 0x406065
xor esi, esi
test esi, esi
js 0x40609b
push dword [ebp - 0x324]
call ebx
and dword [ebp - 0x324], 0
mov eax, dword [ebp - 0x334]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x74]
mov eax, dword [ebp - 0x334]
mov ecx, dword [ebp - 0x354]
and dword [ebp - 0x334], 0
mov dword [ecx], eax
xor esi, esi
mov ecx, dword [ebp - 0x340]
test ecx, ecx
je 0x4060b6
mov eax, dword [ecx + 4]
mov eax, dword [eax + 4]
add ecx, 4
add eax, ecx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0x344]
test ecx, ecx
je 0x4060d1
mov eax, dword [ecx + 4]
mov eax, dword [eax + 4]
add ecx, 4
add eax, ecx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebp - 0x338], 0
je 0x4060e5
push dword [ebp - 0x338]
call fcn.00417131
cmp dword [ebp - 0x330], 0
je 0x4060fa
push dword [ebp - 0x330]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x324], 0
je 0x40610f
push dword [ebp - 0x324]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x334]
test ecx, ecx
je 0x40613a
mov eax, dword [ecx]
push ecx
call dword [eax + 0x7c]
mov ecx, dword [ebp - 0x334]
test ecx, ecx
je 0x40613a
mov eax, dword [ecx + 4]
mov eax, dword [eax + 4]
add ecx, 4
add eax, ecx
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.00410f5c
leave
ret 0x14