Function at 0x10051c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xfb0
mov eax, dword [0x10495f8]
xor eax, esp
mov dword [esp + 0xfac], eax
mov edx, dword [0x104aaa4]
push esi
mov esi, dword [esp + 0xfb8]
push edi
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x7e8]
push ecx
push 0
push 0
push str.Extensions
mov edi, 0x7d0
push edx
mov dword [esp + 0x28], esi
mov dword [esp + 0x20], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x1005218
xor eax, eax
jmp 0x1005479
mov eax, esi
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1005220
sub eax, edx
cmp eax, edi
jae 0x1005211
push ebx
lea ebx, [esp + 0x18]
push ebp
mov dword [esp + 0x10], edi
mov eax, esi
sub ebx, esi
jmp 0x1005240
mov cl, byte [eax]
mov byte [ebx + eax], cl
inc eax
test cl, cl
jne 0x1005240
mov ebp, dword [0x104a9d0]
push 0x30000000
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x24]
push ecx
mov edx, ecx
push edx
call ebp
lea eax, [esp + 0x1c]
push 0x103b25c
push eax
call fcn.010224d0
add esp, 8
test eax, eax
je 0x10052a1
inc eax
lea edx, [esp + 0x1c]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x1005281
lea ecx, [esp + 0x1c]
push 0x103b25c
push ecx
call fcn.010224d0
add esp, 8
test eax, eax
jne 0x100527a
lea eax, [esp + 0x1c]
lea esi, [esp + 0x7ec]
mov dword [esp + 0x14], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10052b7
sub eax, edx
lea edx, [esp + 0x1c]
push 0x103b258
push edx
mov edi, eax
call fcn.01023e20
add esp, 8
test eax, eax
jne 0x1005350
push edi
lea eax, [esp + 0x20]
push eax
push esi
call fcn.01035077
add esp, 0xc
test eax, eax
jne 0x10052fe
mov al, byte [edi + esi]
cmp al, 0x20
je 0x1005465
test al, al
je 0x1005465
push 0x103b254
push esi
call fcn.010224d0
lea ecx, [edi + esi]
add esp, 8
cmp ecx, eax
jbe 0x1005337
push 0x103b254
push esi
call fcn.010224d0
sub eax, esi
push eax
lea edx, [esp + 0x28]
push edx
push esi
call fcn.01035077
add esp, 0x14
test eax, eax
je 0x1005465
push 0x103b250
push esi
call fcn.010224d0
mov esi, eax
add esp, 8
test esi, esi
je 0x1005350
add esi, 1
jne 0x10052d8
mov esi, dword [esp + 0x18]
push 0x3f
push esi
call fcn.01022410
add esp, 8
test eax, eax
je 0x1005473
mov eax, esi
lea esp, [esp]
mov cl, byte [eax]
mov byte [ebx + eax], cl
inc eax
test cl, cl
jne 0x1005370
push 0x30000000
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x24]
push ecx
mov edx, ecx
push edx
mov dword [esp + 0x20], 0x7d0
call ebp
lea eax, [esp + 0x1c]
push 0x3f
push eax
call fcn.01022410
lea ecx, [esp + 0x24]
push 0x2e
push ecx
mov byte [eax], 0
lea esi, [esp + 0x7fc]
call fcn.01023660
mov edi, eax
add esp, 0x10
test edi, edi
je 0x1005473
mov ebp, 1
add edi, ebp
push 0x103b24c
push edi
call fcn.01023e20
add esp, 8
test eax, eax
jne 0x1005473
cmp byte [edi], al
je 0x1005473
mov eax, edi
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10053f0
sub eax, edx
mov ebx, eax
jmp 0x1005400
push ebx
push edi
push esi
call fcn.01035077
add esp, 0xc
test eax, eax
jne 0x100541a
mov al, byte [ebx + esi]
cmp al, 0x20
je 0x100546f
test al, al
je 0x100546f
push 0x103b254
push esi
call fcn.010224d0
lea edx, [ebx + esi]
add esp, 8
cmp edx, eax
jbe 0x100544b
push 0x103b254
push esi
call fcn.010224d0
sub eax, esi
push eax
push edi
push esi
call fcn.01035077
add esp, 0x14
test eax, eax
je 0x100546f
push 0x103b250
push esi
call fcn.010224d0
mov esi, eax
add esp, 8
test esi, esi
je 0x1005473
add esi, ebp
jne 0x1005400
jmp 0x1005473
mov dword [esp + 0x14], 1
jmp 0x1005473
mov dword [esp + 0x14], ebp
mov eax, dword [esp + 0x14]
pop ebp
pop ebx
mov ecx, dword [esp + 0xfb4]
pop edi
pop esi
xor ecx, esp
call fcn.01022396
add esp, 0xfb0
ret 4