Function at 0x405f90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x5014
call fcn.0046f430
mov eax, dword [0x5a83f8]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x18]
call fcn.00403ce0
mov dword [ebp - 0x5008], 0
lea eax, [ebp - 0x5008]
push eax
push 1
push 0
mov ecx, dword [ebp + 0xc]
call fcn.00401be0
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x405fe2
xor al, al
jmp 0x4061fc
xor edx, edx
mov word [ebp - 0x5004], dx
push 0x4ffe
push 0
lea eax, [ebp - 0x5002]
push eax
call fcn.004efc10
add esp, 0xc
mov dword [ebp - 0x5010], 0x2800
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
mov dword [ebp - 0x5014], edx
lea eax, [ebp - 0x5010]
push eax
lea ecx, [ebp - 0x5004]
push ecx
lea edx, [ebp - 0x5014]
push edx
push 0
mov ecx, dword [ebp + 0x10]
call fcn.00401be0
push eax
mov eax, dword [ebp - 0x5008]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x500c], eax
cmp dword [ebp - 0x500c], 0
jne 0x4060e9
mov ecx, dword [ebp + 0x14]
cmp dword [ecx], 1
jne 0x40606f
lea edx, [ebp - 0x5004]
push edx
mov ecx, dword [ebp + 0x18]
call fcn.00406480
jmp 0x4060d0
mov eax, dword [ebp + 0x14]
cmp dword [eax], 4
je 0x40607f
mov ecx, dword [ebp + 0x14]
cmp dword [ecx], 3
jne 0x4060b2
mov edx, dword [ebp - 0x5004]
push edx
push 0x598cec
push 0xffffffffffffffff
push 0x2800
lea eax, [ebp - 0x5004]
push eax
call fcn.00405b70
add esp, 0x14
lea ecx, [ebp - 0x5004]
push ecx
mov ecx, dword [ebp + 0x18]
call fcn.00406480
jmp 0x4060d0
mov edx, dword [ebp + 0x14]
cmp dword [edx], 7
jne 0x4060d0
mov eax, dword [ebp - 0x5010]
push eax
lea ecx, [ebp - 0x5004]
push ecx
mov ecx, dword [ebp + 0x18]
call fcn.00405960
mov edx, dword [ebp - 0x5008]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x4061fc
cmp dword [ebp - 0x500c], 2
jne 0x4061ed
lea eax, [ebp - 0x5008]
push eax
push 0x101
push 0
mov ecx, dword [ebp + 0xc]
call fcn.00401be0
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x406122
xor al, al
jmp 0x4061fc
lea edx, [ebp - 0x5010]
push edx
lea eax, [ebp - 0x5004]
push eax
lea ecx, [ebp - 0x5014]
push ecx
push 0
mov ecx, dword [ebp + 0x10]
call fcn.00401be0
push eax
mov edx, dword [ebp - 0x5008]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x500c], eax
cmp dword [ebp - 0x500c], 0
jne 0x4061ed
mov eax, dword [ebp + 0x14]
cmp dword [eax], 1
jne 0x40617b
lea ecx, [ebp - 0x5004]
push ecx
mov ecx, dword [ebp + 0x18]
call fcn.00406480
jmp 0x4061dc
mov edx, dword [ebp + 0x14]
cmp dword [edx], 4
je 0x40618b
mov eax, dword [ebp + 0x14]
cmp dword [eax], 3
jne 0x4061be
mov ecx, dword [ebp - 0x5004]
push ecx
push 0x598cf4
push 0xffffffffffffffff
push 0x2800
lea edx, [ebp - 0x5004]
push edx
call fcn.00405b70
add esp, 0x14
lea eax, [ebp - 0x5004]
push eax
mov ecx, dword [ebp + 0x18]
call fcn.00406480
jmp 0x4061dc
mov ecx, dword [ebp + 0x14]
cmp dword [ecx], 7
jne 0x4061dc
mov edx, dword [ebp - 0x5010]
push edx
lea eax, [ebp - 0x5004]
push eax
mov ecx, dword [ebp + 0x18]
call fcn.00405960
mov ecx, dword [ebp - 0x5008]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x4061fc
mov edx, dword [ebp - 0x5008]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046ec22
mov esp, ebp
pop ebp
ret