Function at 0x407091
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x2d4
mov eax, 0x5ca799
call fcn.0058ecca
mov esi, ecx
mov dword [ebp - 0x27c], esi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x284], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2a0], eax
mov dword [ebp - 0x28c], reloc.OLEAUT32.dll_SysReAllocString
xor ebx, ebx
mov byte [ebp - 0x26d], bl
mov dword [ebp - 0x274], ebx
lea eax, [ebp - 0x274]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
jne 0x4070f2
mov dword [ebp - 0x274], eax
jmp 0x4070f8
mov eax, dword [ebp - 0x274]
cmp eax, 1
jne 0x407103
mov dword [ebp - 0x274], eax
mov edi, 0x6810d0
cmp dword [esi + 0x18], 8
jb 0x407113
mov edx, dword [esi + 4]
jmp 0x407116
lea edx, [esi + 4]
lea ecx, [ebp - 0x29c]
push ecx
dec eax
neg eax
sbb eax, eax
mov ecx, 0x100
and eax, ecx
add eax, ecx
or eax, 0x20019
push eax
push ebx
push edx
push dword [ebp - 0x28c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4073f3
push dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x29c]
lea esi, [ebp - 0x2a4]
call fcn.0040e20e
mov dword [ebp - 4], ebx
mov dword [ebp - 0x288], 0xff
mov dword [ebp - 0x278], ebx
mov dword [ebp - 0x280], ebx
mov byte [ebp - 4], 1
mov dword [ebp - 0x288], 0xff
mov eax, dword [ebp - 0x280]
inc dword [ebp - 0x280]
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x288]
push ecx
lea ecx, [ebp - 0x218]
push ecx
push eax
push dword [ebp - 0x29c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0x278], eax
cmp eax, ebx
jne 0x40739f
lea eax, [ebp - 0x298]
push eax
call fcn.004050ad
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x274]
dec eax
neg eax
sbb eax, eax
and eax, 0xfffffffd
add eax, 4
mov dword [ebp - 0x298], eax
mov eax, dword [ebp - 0x28c]
call fcn.0040e261
push eax
lea eax, [ebp - 0x294]
push eax
call fcn.0040865a
push edi
lea eax, [ebp - 0x294]
push eax
call fcn.00408678
mov eax, dword [ebp - 0x27c]
cmp dword [eax + 0x18], 8
jb 0x40721b
mov eax, dword [eax + 4]
jmp 0x40721e
add eax, 4
push eax
lea eax, [ebp - 0x294]
push eax
call fcn.00408678
push edi
lea eax, [ebp - 0x294]
push eax
call fcn.00408678
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x294]
push eax
call fcn.00408678
push str.InprocServer32
lea esi, [ebp - 0x2c0]
call fcn.0040820f
mov byte [ebp - 4], 3
push dword [ebp - 0x288]
lea eax, [ebp - 0x218]
push eax
lea esi, [ebp - 0x2dc]
call fcn.004081eb
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2c0]
push ecx
mov edx, eax
lea ecx, [ebp - 0x234]
call fcn.00406907
pop ecx
mov byte [ebp - 4], 6
push ebx
push 1
call fcn.00409da6
mov byte [ebp - 4], 7
push ebx
push 1
lea esi, [ebp - 0x2c0]
call fcn.00409da6
cmp dword [ebp - 0x220], ebx
je 0x407328
push dword [ebp - 0x2a0]
lea esi, [ebp - 0x26c]
call fcn.0040822e
mov byte [ebp - 4], 8
push edi
mov eax, esi
push eax
call fcn.0040825c
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x234]
mov ecx, esi
call fcn.00409990
push ebx
lea eax, [ebp - 0x298]
push eax
push dword [ebp - 0x284]
mov ecx, esi
call fcn.004063cf
add esp, 0xc
test al, al
jne 0x40731c
push ebx
lea eax, [ebp - 0x298]
push eax
push dword [ebp - 0x284]
lea ecx, [ebp - 0x234]
call fcn.004063cf
add esp, 0xc
mov byte [ebp - 4], 7
lea esi, [ebp - 0x26c]
jmp 0x407375
push dword [ebp - 0x27c]
lea esi, [ebp - 0x250]
call fcn.0040822e
mov byte [ebp - 4], 9
push edi
mov eax, esi
push eax
call fcn.0040825c
lea eax, [ebp - 0x218]
push eax
mov eax, esi
push eax
call fcn.0040825c
push dword [ebp - 0x2a0]
push dword [ebp - 0x284]
push dword [ebp - 0x28c]
mov ecx, esi
call fcn.00406c1d
add esp, 0xc
mov byte [ebp - 4], 7
push ebx
push 1
call fcn.00409da6
mov byte [ebp - 4], 2
push ebx
push 1
lea esi, [ebp - 0x234]
call fcn.00409da6
mov byte [ebp - 4], 1
lea eax, [ebp - 0x298]
push eax
call fcn.004050e0
mov dword [ebp - 4], ebx
jmp 0x4073b5
cmp dword [ebp - 0x278], ebx
je 0x407177
cmp dword [ebp - 0x278], 0x103
jne 0x4073d4
mov byte [ebp - 0x26d], 1
or dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x2a4]
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax + 4]
mov esi, dword [ebp - 0x27c]
mov eax, dword [ebp - 0x274]
mov ecx, eax
dec eax
mov dword [ebp - 0x274], eax
test ecx, ecx
jne 0x407108
mov al, byte [ebp - 0x26d]
call fcn.0058ed26
ret