Function at 0x54f090
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x44
mov eax, dword [0x5b3480]
xor eax, esp
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x48]
lea ecx, [esp + 0x10]
push ebx
push ebp
push esi
push edi
push ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x18], 0
push ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x28], 0x20
push ecx
xor edi, edi
push edi
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x54f2ce
mov eax, dword [esp + 0x2c]
sub eax, 1
je 0x54f0f3
sub eax, 3
jne 0x54f2ce
mov edi, dword [esp + 0x30]
jmp 0x54f2ca
mov esi, dword [esp + 0x20]
shr esi, 1
dec esi
cmp esi, 0xffffffff
jne 0x54f115
lea esi, [esp + 0x30]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x54f106
sub esi, ecx
sar esi, 1
lea eax, [esp + 0x30]
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], eax
lea ecx, [esp + 0x24]
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x571024
push eax
mov dword [esp + 0x1c], 1
mov ebx, 1
call fcn.00485c00
test al, al
jne 0x54f179
mov eax, 0xa
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], eax
mov ebp, str.Dictionary
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ebp
lea ebx, [eax - 7]
lea eax, [esp + 0x14]
push eax
call fcn.00485c00
test al, al
jne 0x54f185
mov byte [esp + 0x13], al
jmp 0x54f193
mov eax, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
mov byte [esp + 0x13], 1
mov dword [esp + 0x14], ebx
test bl, 2
je 0x54f1d2
mov eax, dword [esp + 0x1c]
and ebx, 0xfffffffd
test eax, eax
jns 0x54f1d2
and eax, 0x7fffffff
lea ecx, [eax*2 + 2]
mov eax, ebp
cmp ecx, 0x1000
jb 0x54f1c8
mov ebp, dword [eax - 4]
add ecx, 0x23
sub eax, ebp
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x54f2e8
push ecx
push ebp
call fcn.00491173
add esp, 8
and ebx, 0xfffffffe
cmp byte [esp + 0x13], 0
je 0x54f1e6
mov edi, 0x1002
jmp 0x54f297
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x57634c
push eax
lea ecx, [esp + 0x28]
mov dword [esp + 0x1c], 1
or ebx, 4
call fcn.00485c00
test al, al
jne 0x54f23c
mov eax, 5
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], eax
mov ebp, str.Array
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ebp
lea ebx, [eax + 3]
lea eax, [esp + 0x14]
push eax
call fcn.00485c00
test al, al
jne 0x54f248
mov byte [esp + 0x13], al
jmp 0x54f252
mov eax, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
mov byte [esp + 0x13], 1
test bl, 8
je 0x54f28a
mov eax, dword [esp + 0x1c]
test eax, eax
jns 0x54f28a
and eax, 0x7fffffff
lea ecx, [eax*2 + 2]
mov eax, ebp
cmp ecx, 0x1000
jb 0x54f280
mov ebp, dword [eax - 4]
add ecx, 0x23
sub eax, ebp
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x54f2e8
push ecx
push ebp
call fcn.00491173
add esp, 8
cmp byte [esp + 0x13], 0
mov eax, 0x1001
cmovne edi, eax
test esi, esi
jns 0x54f2ca
lea esi, [esi*2 + 2]
lea ecx, [esp + 0x30]
cmp esi, 0x1000
jb 0x54f2c0
mov eax, ecx
add esi, 0x23
mov ecx, dword [eax - 4]
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x54f2e8
push esi
push ecx
call fcn.00491173
add esp, 8
test edi, edi
jne 0x54f2d3
mov edi, 0x1002
mov ecx, dword [esp + 0x50]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004913e0
add esp, 0x44
ret
call fcn.004956fe
int3