Function at 0xffa50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 6
push 0
push 0
dec ecx
jne 0xffa59
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0xffe58
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebx], 0
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x28]
call fcn.00025a70
lea eax, [ebp - 0x2c]
call fcn.00025a70
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x14]
call fcn.000145ac
lea eax, [ebp - 0x30]
call fcn.00029ddc
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 4]
call fcn.00013d6c
cmp byte [ebx], 0
jne 0xffc65
mov eax, edi
mov edx, dword [0xf5394]
call fcn.00015964
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 0x28]
mov edx, 0xffe74
call fcn.00013ff4
lea eax, [ebp - 0x18]
push eax
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, case.0x1ffea.3
push eax
push 0
mov eax, dword [ebp - 0x1c]
call fcn.0001416c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [ebp - 8], eax
cmp dword [ebp - 0x18], 0
je 0xffc51
xor eax, eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0xffeb4
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov dword [ebp - 8], eax
cmp dword [ebp - 0x24], 0
jbe 0xffc51
cmp dword [ebp - 0x24], 0x2800
ja 0xffc51
mov eax, dword [ebp - 0x24]
push eax
mov eax, edi
mov ecx, 1
mov edx, dword [0xf5394]
call fcn.00015958
add esp, 4
mov eax, dword [edi]
mov edx, dword [ebp - 0x24]
call fcn.00018100
lea eax, [ebp - 0x24]
push eax
mov eax, dword [edi]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0xffeb4
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov dword [ebp - 8], eax
xor esi, esi
jmp 0xffbb0
mov eax, dword [ebp - 0x14]
call fcn.00014630
add eax, eax
push eax
mov eax, dword [ebp - 0x14]
call fcn.00014620
mov edx, eax
mov eax, dword [edi]
add eax, esi
pop ecx
call fcn.00027350
mov byte [ebx], al
inc esi
cmp byte [ebx], 0
jne 0xffbdc
mov eax, dword [ebp - 0x14]
call fcn.00014630
add eax, eax
add eax, esi
cdq
push edx
push eax
mov eax, dword [ebp - 0x24]
xor edx, edx
cmp edx, dword [esp + 4]
jne 0xffbd8
cmp eax, dword [esp]
pop edx
pop eax
ja 0xffb8e
jmp 0xffbdc
pop edx
pop eax
jg 0xffb8e
lea eax, [ebp - 0x20]
mov edx, 0x20
call fcn.000271f0
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x24], 0x1f
lea eax, [ebp - 0x34]
call fcn.00028ac4
mov ecx, dword [ebp - 0x34]
lea eax, [ebp - 0x10]
mov edx, 0xffecc
call fcn.00013ff4
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x20]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 0x10]
call fcn.0001416c
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
cmp dword [ebp - 0xc], 1
jne 0xffc44
cmp dword [ebp - 0x24], 1
jbe 0xffc44
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x20]
call fcn.00013ee0
lea eax, [ebp - 0x20]
mov edx, 0x20
call fcn.00027218
cmp dword [ebp - 0x18], 0
je 0xffc60
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x18], eax
cmp byte [ebx], 0
jne 0xffe13
mov eax, edi
mov edx, dword [0xf5394]
call fcn.00015964
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 0x28]
mov edx, 0xffeec
call fcn.00013ff4
lea eax, [ebp - 0x18]
push eax
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, case.0x1ffea.3
push eax
push 0
mov eax, dword [ebp - 0x1c]
call fcn.0001416c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [ebp - 8], eax
cmp dword [ebp - 0x18], 0
je 0xffdff
xor eax, eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0xffeb4
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov dword [ebp - 8], eax
cmp dword [ebp - 0x24], 0
jbe 0xffdff
cmp dword [ebp - 0x24], 0x2800
ja 0xffdff
mov eax, dword [ebp - 0x24]
push eax
mov eax, edi
mov ecx, 1
mov edx, dword [0xf5394]
call fcn.00015958
add esp, 4
mov eax, dword [edi]
mov edx, dword [ebp - 0x24]
call fcn.00018100
lea eax, [ebp - 0x24]
push eax
mov eax, dword [edi]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0xffeb4
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov dword [ebp - 8], eax
xor esi, esi
jmp 0xffd5e
mov eax, dword [ebp - 0x14]
call fcn.00014630
add eax, eax
push eax
mov eax, dword [ebp - 0x14]
call fcn.00014620
mov edx, eax
mov eax, dword [edi]
add eax, esi
pop ecx
call fcn.00027350
mov byte [ebx], al
inc esi
cmp byte [ebx], 0
jne 0xffd8a
mov eax, dword [ebp - 0x14]
call fcn.00014630
add eax, eax
add eax, esi
cdq
push edx
push eax
mov eax, dword [ebp - 0x24]
xor edx, edx
cmp edx, dword [esp + 4]
jne 0xffd86
cmp eax, dword [esp]
pop edx
pop eax
ja 0xffd3c
jmp 0xffd8a
pop edx
pop eax
jg 0xffd3c
lea eax, [ebp - 0x20]
mov edx, 0x20
call fcn.000271f0
xor eax, eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x24], 0x1f
lea eax, [ebp - 0x38]
call fcn.00028ac4
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x10]
mov edx, 0xffecc
call fcn.00013ff4
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x20]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 0x10]
call fcn.0001416c
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
cmp dword [ebp - 0xc], 1
jne 0xffdf2
cmp dword [ebp - 0x24], 1
jbe 0xffdf2
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x20]
call fcn.00013ee0
lea eax, [ebp - 0x20]
mov edx, 0x20
call fcn.00027218
cmp dword [ebp - 0x18], 0
je 0xffe0e
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x18], eax
cmp byte [ebx], 0
jne 0xffe25
mov eax, edi
mov edx, dword [0xf5394]
call fcn.00015964
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xffe5f
lea eax, [ebp - 0x38]
mov edx, 5
call fcn.00013d3c
lea eax, [ebp - 0x1c]
call fcn.00013d18
lea eax, [ebp - 0x14]
call fcn.000143f0
lea eax, [ebp - 0x10]
call fcn.00013d18
ret