Function at 0x405180
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x5014
call fcn.004c4990
mov eax, dword [0x4f1040]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x18]
call fcn.00401ba0
mov dword [ebp - 0x5008], 0
lea eax, [ebp - 0x5008]
push eax
push 1
push 0
mov ecx, dword [ebp + 0xc]
call fcn.00401b60
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4051f7
lea edx, [ebp - 0x5008]
push edx
push 0x101
push 0
mov ecx, dword [ebp + 0xc]
call fcn.00401b60
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4051f7
xor al, al
jmp 0x405408
push 0x5000
push 0
lea ecx, [ebp - 0x5004]
push ecx
call fcn.004a0100
add esp, 0xc
mov dword [ebp - 0x5010], 0x2800
mov edx, dword [ebp + 0x14]
mov eax, dword [edx]
mov dword [ebp - 0x5014], eax
lea ecx, [ebp - 0x5010]
push ecx
lea edx, [ebp - 0x5004]
push edx
lea eax, [ebp - 0x5014]
push eax
push 0
mov ecx, dword [ebp + 0x10]
call fcn.00401b60
push eax
mov ecx, dword [ebp - 0x5008]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x500c], eax
cmp dword [ebp - 0x500c], 0
jne 0x4052f5
mov edx, dword [ebp + 0x14]
cmp dword [edx], 1
jne 0x40527b
lea eax, [ebp - 0x5004]
push eax
mov ecx, dword [ebp + 0x18]
call fcn.004059e0
jmp 0x4052dc
mov ecx, dword [ebp + 0x14]
cmp dword [ecx], 4
je 0x40528b
mov edx, dword [ebp + 0x14]
cmp dword [edx], 3
jne 0x4052be
mov eax, dword [ebp - 0x5004]
push eax
push 0x4e416c
push 0xffffffffffffffff
push 0x2800
lea ecx, [ebp - 0x5004]
push ecx
call fcn.00404df0
add esp, 0x14
lea edx, [ebp - 0x5004]
push edx
mov ecx, dword [ebp + 0x18]
call fcn.004059e0
jmp 0x4052dc
mov eax, dword [ebp + 0x14]
cmp dword [eax], 7
jne 0x4052dc
mov ecx, dword [ebp - 0x5010]
push ecx
lea edx, [ebp - 0x5004]
push edx
mov ecx, dword [ebp + 0x18]
call fcn.00402bd0
mov eax, dword [ebp - 0x5008]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x405408
cmp dword [ebp - 0x500c], 2
jne 0x4053f9
lea ecx, [ebp - 0x5008]
push ecx
push 0x101
push 0
mov ecx, dword [ebp + 0xc]
call fcn.00401b60
push eax
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40532e
xor al, al
jmp 0x405408
lea eax, [ebp - 0x5010]
push eax
lea ecx, [ebp - 0x5004]
push ecx
lea edx, [ebp - 0x5014]
push edx
push 0
mov ecx, dword [ebp + 0x10]
call fcn.00401b60
push eax
mov eax, dword [ebp - 0x5008]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x500c], eax
cmp dword [ebp - 0x500c], 0
jne 0x4053f9
mov ecx, dword [ebp + 0x14]
cmp dword [ecx], 1
jne 0x405387
lea edx, [ebp - 0x5004]
push edx
mov ecx, dword [ebp + 0x18]
call fcn.004059e0
jmp 0x4053e8
mov eax, dword [ebp + 0x14]
cmp dword [eax], 4
je 0x405397
mov ecx, dword [ebp + 0x14]
cmp dword [ecx], 3
jne 0x4053ca
mov edx, dword [ebp - 0x5004]
push edx
push 0x4e4174
push 0xffffffffffffffff
push 0x2800
lea eax, [ebp - 0x5004]
push eax
call fcn.00404df0
add esp, 0x14
lea ecx, [ebp - 0x5004]
push ecx
mov ecx, dword [ebp + 0x18]
call fcn.004059e0
jmp 0x4053e8
mov edx, dword [ebp + 0x14]
cmp dword [edx], 7
jne 0x4053e8
mov eax, dword [ebp - 0x5010]
push eax
lea ecx, [ebp - 0x5004]
push ecx
mov ecx, dword [ebp + 0x18]
call fcn.00402bd0
mov edx, dword [ebp - 0x5008]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x405408
mov eax, dword [ebp - 0x5008]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040b76b
mov esp, ebp
pop ebp
ret