Function at 0x500b20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x30
push ecx
push edi
lea edi, [esp + 8]
mov eax, 0xcccccccc
mov ecx, 0xc
rep stosd dword es:[edi], eax
pop edi
pop ecx
mov dword [ebp - 0x34], ecx
push 0x10
call fcn.00494950
pop ecx
cmp eax, 0
je 0x500b54
mov ecx, eax
call fcn.004ff190
mov eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [ebp + 8]
call fcn.0058a720
push eax
mov eax, dword [ebp - 0x34]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], 0
je 0x500b9f
mov edx, dword [ebp - 0x18]
inc dword [edx]
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x2c]
call fcn.004ff270
cmp dword [ebp - 0x18], 0
je 0x500bb9
mov ecx, dword [ebp - 0x18]
call fcn.00589d70
mov edx, dword [ebp - 8]
dec edx
cmp edx, 6
ja case.0x500bc6.5
jmp dword [edx*4 + 0x595c40]
cmp dword [ebp - 8], 2
jne 0x500bdf
push 4
mov ecx, dword [ebp - 0x2c]
call fcn.004ff350
jmp 0x500be9
push 0
mov ecx, dword [ebp - 0x2c]
call fcn.004ff350
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], 0
je 0x500bfc
mov edx, dword [ebp - 0x1c]
inc dword [edx]
movzx eax, byte [ebp + 0xc]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x34]
call fcn.00500500
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x10]
call fcn.0058a7b0
cmp dword [ebp - 0x20], 0
je 0x500c2b
mov ecx, dword [ebp - 0x20]
call fcn.00589d70
cmp dword [ebp - 0x1c], 0
je 0x500c39
mov ecx, dword [ebp - 0x1c]
call fcn.00589d70
cmp dword [ebp - 0x10], 0
je 0x500c47
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0xc]
jmp 0x500c4c
mov eax, 0
push eax
lea ecx, [ebp - 0x10]
call fcn.0058a720
push eax
mov ecx, dword [ebp - 0x2c]
call fcn.004ff2d0
jmp 0x500d32
push 1
mov ecx, dword [ebp - 0x2c]
call fcn.004ff350
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], 0
je 0x500c80
mov edx, dword [ebp - 0x24]
inc dword [edx]
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x34]
call fcn.005008a0
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x24], 0
je 0x500c9d
mov ecx, dword [ebp - 0x24]
call fcn.00589d70
push 4
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x2c]
call fcn.004ff2d0
jmp 0x500d32
push 2
mov ecx, dword [ebp - 0x2c]
call fcn.004ff350
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov dword [ebp - 0x28], edx
cmp dword [ebp - 0x28], 0
je 0x500ccd
mov edx, dword [ebp - 0x28]
inc dword [edx]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x34]
call fcn.00500930
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x28], 0
je 0x500cee
mov ecx, dword [ebp - 0x28]
call fcn.00589d70
push dword [ebp - 0xc]
push dword [ebp - 0x30]
mov ecx, dword [ebp - 0x2c]
call fcn.004ff2d0
jmp 0x500d32
cmp dword [ebp - 0x2c], 0
je 0x500d15
mov ecx, dword [ebp - 0x2c]
call fcn.004ff220
push dword [ebp - 0x2c]
call fcn.004949a0
pop ecx
mov ebx, 0
cmp dword [ebp - 0x10], 0
je 0x500d28
mov ecx, dword [ebp - 0x10]
call fcn.00589d70
mov eax, ebx
lea esp, [ebp - 4]
pop ebx
pop ebp
ret 8
mov ebx, dword [ebp - 0x2c]
cmp dword [ebp - 0x10], 0
je 0x500d43
mov ecx, dword [ebp - 0x10]
call fcn.00589d70
mov eax, ebx
lea esp, [ebp - 4]
pop ebx
pop ebp
ret 8