Function at 0x536440
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x536764
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.00432564
xor eax, eax
push ebp
push 0x536747
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x536488
call fcn.00403e20
jmp 0x53674e
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x5366c9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x59bac0]
call fcn.00535a64
push ebp
mov eax, 0x536778
call fcn.00535b4c
pop ecx
test al, al
je 0x5364d2
push 0
push 0
push 0
mov ecx, 0x536778
xor edx, edx
mov eax, dword [0x59bac0]
call fcn.00535960
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], eax
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0x53677c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x53658f
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
jne 0x536586
mov eax, dword [ebp - 0x18]
dec eax
test eax, eax
jl 0x536586
inc eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.00404a38
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
call fcn.004048ac
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegEnumKeyExA
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.00404a38
push ebp
xor ecx, ecx
mov edx, dword [ebp - 0x14]
mov eax, 0x5367a4
call fcn.00535ca0
pop ecx
inc dword [ebp - 8]
dec dword [ebp - 0x24]
jne 0x53652e
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0x5367c4
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x536685
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
jne 0x536685
mov eax, dword [ebp - 0x18]
dec eax
test eax, eax
jl 0x536685
inc eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.00404a38
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
call fcn.004048ac
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegEnumKeyExA
mov eax, dword [ebp - 0x14]
call fcn.004048ac
mov edx, 0x5367d4
mov ecx, 4
call fcn.00408e44
test eax, eax
je 0x53665d
mov eax, dword [ebp - 0x14]
call fcn.004048ac
mov edx, 0x5367dc
mov ecx, 4
call fcn.00408e44
test eax, eax
jne 0x536679
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.00404a38
push ebp
mov cl, 1
mov edx, dword [ebp - 0x14]
mov eax, 0x5367ec
call fcn.00535ca0
pop ecx
inc dword [ebp - 8]
dec dword [ebp - 0x24]
jne 0x5365f3
push ebp
call fcn.005361b4
pop ecx
push ebp
mov eax, 0x5367ec
mov cl, 1
xor edx, edx
call fcn.00535ca0
pop ecx
push ebp
mov eax, 0x5367ec
mov cl, 2
xor edx, edx
call fcn.00535ca0
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5366d0
cmp dword [ebp - 0xc], 0
je 0x5366c8
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x53676b
lea eax, [ebp - 0x14]
call fcn.004043dc
ret