Function at 0x50d930
Capabilities:
Query or enumerate registry value
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6d3bc1
mov eax, dword fs:[0]
push eax
sub esp, 0x158
mov eax, dword [0x75aa5c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x164], 0
mov eax, 1
test eax, eax
je 0x50dbc7
cmp dword [0x765564], 0
jne 0x50da9d
lea ecx, [ebp - 0x30]
call fcn.00405380
mov dword [ebp - 4], 0
call fcn.004d88c0
add eax, 0xb8
mov ecx, eax
call fcn.00405490
push eax
call fcn.004d88c0
add eax, 0x9c
mov ecx, eax
call fcn.00405490
push eax
push 0x6ffef0
lea ecx, [ebp - 0x30]
push ecx
call fcn.0042f540
add esp, 0x10
lea edx, [ebp - 0x10]
push edx
push 0x20019
push 0
lea ecx, [ebp - 0x30]
call fcn.00405490
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x50d9fa
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00405410
jmp 0x50dbc7
xor eax, eax
mov word [ebp - 0xb4], ax
push 0x7e
push 0
lea ecx, [ebp - 0xb2]
push ecx
call fcn.005a7100
add esp, 0xc
mov dword [ebp - 0xb8], 0x80
lea edx, [ebp - 0xb8]
push edx
lea eax, [ebp - 0xb4]
push eax
push 0
push 0
push 0x6fff10
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x50da63
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00405410
jmp 0x50dbc7
lea eax, [ebp - 0xb4]
push eax
mov ecx, dword [ebp + 8]
call fcn.004053a0
mov ecx, dword [ebp - 0x164]
or ecx, 1
mov dword [ebp - 0x164], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00405410
mov eax, dword [ebp + 8]
jmp 0x50dbe6
push 0x6fff24
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x160]
push eax
call fcn.0040b210
add esp, 0xc
mov dword [ebp - 4], 1
mov dword [ebp - 0xc0], 0
push 0x6fff30
lea ecx, [ebp - 0x160]
call fcn.00405490
push eax
lea ecx, [ebp - 0xc0]
push ecx
call fcn.005b1600
add esp, 0xc
cmp dword [ebp - 0xc0], 0
jne 0x50db06
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x160]
call fcn.00405410
jmp 0x50dbc7
xor edx, edx
mov word [ebp - 0x144], dx
push 0x7e
push 0
lea eax, [ebp - 0x142]
push eax
call fcn.005a7100
add esp, 0xc
mov ecx, dword [ebp - 0xc0]
push ecx
push 0x7e
push 2
lea edx, [ebp - 0x144]
push edx
call fcn.005b218b
add esp, 0x10
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0
jne 0x50db6e
mov eax, dword [ebp - 0xc0]
push eax
call fcn.005ab232
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x160]
call fcn.00405410
jmp 0x50dbc7
mov ecx, dword [ebp - 0xc0]
push ecx
call fcn.005ab232
add esp, 4
xor edx, edx
mov eax, dword [ebp - 0xbc]
mov word [ebp + eax*2 - 0x144], dx
lea ecx, [ebp - 0x144]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004053a0
mov edx, dword [ebp - 0x164]
or edx, 1
mov dword [ebp - 0x164], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x160]
call fcn.00405410
mov eax, dword [ebp + 8]
jmp 0x50dbe6
push 0x6fff38
mov ecx, dword [ebp + 8]
call fcn.004053a0
mov eax, dword [ebp - 0x164]
or eax, 1
mov dword [ebp - 0x164], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005a6f18
mov esp, ebp
pop ebp
ret