Function at 0x5001a0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x43
push 0
push 0
dec ecx
jne 0x5001a8
lea eax, [ebp - 0x1e0]
mov edx, dword [0x4084f0]
call fcn.0040553c
xor eax, eax
push ebp
push 0x500a31
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x500888
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [0x56cf30], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
lea eax, [eax*4 + 0x56cf38]
call fcn.00404978
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xa
jne 0x5001ed
mov dword [0x56cf34], 0xffffffff
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x500a3c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x5002c7
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
jne 0x5002be
mov eax, dword [ebp - 0x18]
dec eax
test eax, eax
jl 0x5002be
inc eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00404ff0
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404e64
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegEnumKeyExA
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00404ff0
push ebp
mov dl, 1
mov eax, dword [ebp - 0xc]
call fcn.004ffcc4
pop ecx
inc dword [ebp - 0x14]
dec dword [ebp - 0x20]
jne 0x50026b
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x500a5c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x5003b8
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
jne 0x5003b8
mov eax, dword [ebp - 0x18]
dec eax
test eax, eax
jl 0x5003b8
inc eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00404ff0
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404e64
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegEnumKeyExA
mov eax, dword [ebp - 0xc]
call fcn.00404e64
mov edx, 0x500a6c
mov ecx, 4
call fcn.00409470
test eax, eax
je 0x500395
mov eax, dword [ebp - 0xc]
call fcn.00404e64
mov edx, 0x500a74
mov ecx, 4
call fcn.00409470
test eax, eax
jne 0x5003ac
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00404ff0
push ebp
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.004ffcc4
pop ecx
inc dword [ebp - 0x14]
dec dword [ebp - 0x20]
jne 0x50032b
cmp dword [0x56cf30], 0
jle 0x5003c8
push ebp
call fcn.004fff00
pop ecx
cmp dword [0x56cf00], 0
jne 0x500430
mov dword [ebp - 8], 0x64
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x85]
push eax
push 0
push 0
push 0x500a7c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x500430
lea eax, [ebp - 0x1e8]
lea edx, [ebp - 0x85]
mov ecx, 0x65
call fcn.00404bf8
mov eax, dword [ebp - 0x1e8]
lea edx, [ebp - 0x1e4]
call fcn.004094c4
mov edx, dword [ebp - 0x1e4]
mov eax, 0x56cf00
call fcn.004049cc
cmp dword [0x56cf00], 0
je 0x5004be
lea edx, [ebp - 0x1ec]
mov eax, dword [0x56cf00]
call fcn.0040a080
mov edx, dword [ebp - 0x1ec]
mov eax, 0x56cf28
call fcn.004049cc
lea eax, [ebp - 0x1f4]
push eax
mov eax, dword [0x56cf28]
call fcn.00404c64
mov edx, eax
sub edx, 3
mov ecx, 4
mov eax, dword [0x56cf28]
call fcn.00404ec4
mov eax, dword [ebp - 0x1f4]
lea edx, [ebp - 0x1f0]
call fcn.00409340
mov eax, dword [ebp - 0x1f0]
mov edx, 0x500a8c
call fcn.00404db0
jne 0x5004be
mov eax, dword [0x56cf28]
call fcn.00404c64
mov edx, eax
sub edx, 4
mov eax, 0x56cf28
call fcn.00404ff0
cmp dword [0x56cf00], 0
jne 0x500826
cmp dword [0x56cf2c], 0
jne 0x50057c
cmp dword [0x56cf30], 0
jle 0x500503
cmp dword [0x56cf34], 0xffffffff
je 0x500503
mov eax, 0x56cf28
mov edx, dword [0x56cf34]
mov edx, dword [edx*4 + 0x56cf38]
call fcn.004049cc
jmp 0x50050d
mov eax, 0x56cf28
call fcn.00404978
cmp dword [0x56cf28], 0
jne 0x50055e
mov dword [ebp - 8], 0x64
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x85]
push eax
push 0
push 0
push 0x500a94
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x50055e
mov eax, dword [ebp - 8]
mov byte [ebp + eax - 0x86], 0
mov eax, 0x56cf28
lea edx, [ebp - 0x85]
mov ecx, 0x65
call fcn.00404bf8
cmp dword [0x56cf28], 0
jne 0x5005f8
mov eax, 0x56cf00
mov edx, 0x500aa8
call fcn.004049cc
jmp 0x5005f8
mov eax, dword [0x56cf30]
dec eax
test eax, eax
jl 0x5005d3
inc eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], 0
mov eax, dword [0x56cf2c]
call fcn.00404e64
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax*4 + 0x56cf88]
call fcn.00404e64
pop edx
call fcn.00409430
test eax, eax
jne 0x5005cb
mov eax, 0x56cf28
mov edx, dword [ebp - 0x14]
mov edx, dword [edx*4 + 0x56cf38]
call fcn.004049cc
jmp 0x5005d3
inc dword [ebp - 0x14]
dec dword [ebp - 0x20]
jne 0x500591
cmp dword [0x56cf28], 0
jne 0x5005f8
mov eax, 0x56cf00
mov ecx, dword [0x56cf2c]
mov edx, 0x500ab8
call fcn.00404cb0
push ebp
call fcn.00500108
pop ecx
cmp dword [0x56cf28], 0
je 0x500826
lea eax, [ebp - 0x10]
call fcn.00404978
mov eax, dword [0x56cf28]
call fcn.00404c64
mov edx, dword [0x56cf28]
cmp byte [edx + eax - 1], 0x5c
jne 0x50063b
mov eax, dword [0x56cf28]
call fcn.00404c64
mov edx, eax
dec edx
mov eax, 0x56cf28
call fcn.00404ff0
push dword [0x56cf28]
push 0x500ac4
push 0x500aa8
lea eax, [ebp - 0x1f8]
mov edx, 3
call fcn.00404d24
mov eax, dword [ebp - 0x1f8]
lea ecx, [ebp - 0x1e0]
mov edx, 0x3f
call fcn.00409ea8
test eax, eax
jne 0x5006a4
push dword [0x56cf28]
push 0x500ac4
push 0x500aa8
mov eax, 0x56cf00
mov edx, 3
call fcn.00404d24
lea eax, [ebp - 0x1e0]
call fcn.00409f1c
jmp 0x5007dd
push dword [0x56cf28]
push 0x500ad4
push 0x500aa8
lea eax, [ebp - 0x1fc]
mov edx, 3
call fcn.00404d24
mov eax, dword [ebp - 0x1fc]
lea ecx, [ebp - 0x1e0]
mov edx, 0x3f
call fcn.00409ea8
test eax, eax
jne 0x50070d
push dword [0x56cf28]
push 0x500ad4
push 0x500aa8
mov eax, 0x56cf00
mov edx, 3
call fcn.00404d24
lea eax, [ebp - 0x1e0]
call fcn.00409f1c
jmp 0x5007dd
push dword [0x56cf28]
push 0x500ac4
push 0x500ae0
lea eax, [ebp - 0x200]
mov edx, 3
call fcn.00404d24
mov eax, dword [ebp - 0x200]
lea ecx, [ebp - 0x1e0]
mov edx, 0x3f
call fcn.00409ea8
test eax, eax
jne 0x5007dd
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x204]
xor edx, edx
mov eax, dword [ebp - 0x1d4]
call fcn.00409fb8
mov eax, dword [ebp - 0x204]
mov ecx, 6
mov edx, 4
call fcn.00404ec4
mov eax, dword [ebp - 0xc]
cmp byte [eax], 0x30
jb 0x5007bf
mov eax, dword [ebp - 0xc]
cmp byte [eax], 0x39
ja 0x5007bf
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
call fcn.00404db0
jbe 0x5007bf
push dword [0x56cf28]
push 0x500ac4
push dword [ebp - 0x1d4]
mov eax, 0x56cf00
mov edx, 3
call fcn.00404d24
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.00404a10
lea eax, [ebp - 0x1e0]
call fcn.00409ef8
test eax, eax
je 0x50074b
lea eax, [ebp - 0x1e0]
call fcn.00409f1c
cmp dword [0x56cf00], 0
jne 0x500826
cmp dword [0x56cf2c], 0
jne 0x500800
mov eax, 0x56cf00
mov edx, 0x500aa8
call fcn.004049cc
jmp 0x500826
push dword [0x56cf28]
push 0x500ac4
push 0x500af4
mov eax, 0x56cf00
mov edx, 3
call fcn.00404d24
push ebp
call fcn.00500108
pop ecx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x85]
push eax
push 0
push 0
push 0x500af8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x500860
mov edx, 0x500b00
lea eax, [ebp - 0x85]
mov ecx, 3
call fcn.0040a3e4
test eax, eax
je 0x500864
xor eax, eax
jmp 0x500866
mov al, 1
mov byte [0x56cf24], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x50088f
cmp dword [ebp - 4], 0
je 0x500887
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret