Function at 0x51a362
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
push ebx
mov edx, 0x11
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x51a369
call fcn.00408600
push dword [esp + 0x58]
call fcn.00401220
mov edx, dword [esp + 0x50]
lea ecx, [esp]
call fcn.004011b0
mov edx, dword [esp + 0x54]
lea ecx, [esp + 4]
call fcn.004011b0
push esp
push 0x3d
call fcn.00409350
add esp, 8
push 0x2002f3
call fcn.00521f18
push 0x2002f4
call fcn.00521f18
mov edx, 0x4c31a6
lea ecx, [esp + 8]
call fcn.004011b8
push 0x2002f5
call fcn.00521f18
lea edx, [esp + 0x18]
push edx
push 0
push 0x18
push 1
mov eax, 1
push 1
call fcn.00521fae
call fcn.00407c95
push 0x2002f7
call fcn.00521f18
call fcn.0050adb4
push 0x2002f7
call fcn.00522048
and eax, eax
je 0x51a423
mov eax, 1
jmp 0x51a425
xor eax, eax
and eax, eax
je 0x51a447
push 0x2002f8
call fcn.00521f18
mov dword [esp + 0x3c], 0xf013f
push 0x2002f9
call fcn.00521f18
jmp 0x51a463
push 0x2002f9
call fcn.00521f18
push 0x2002fa
call fcn.00521f18
mov dword [esp + 0x3c], 0xf003f
push 0x2002fb
call fcn.00521f18
push 0x2002fc
call fcn.00521f18
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x40]
push 0
mov eax, 0x4c31a6
push eax
push closesocket
call sub.ADVAPI32.dll_RegOpenKeyExW
push 0x2002fc
call fcn.00522048
mov ebx, eax
and ebx, ebx
jne 0x51a609
push 0x2002fd
call fcn.00521f18
lea eax, [esp + 0x10]
push eax
push dword [esp + 4]
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCreateKeyW
push 0x2002fd
call fcn.00522048
mov ebx, eax
and ebx, ebx
jne 0x51a5e2
push 0x2002fe
call fcn.00521f18
mov dword [esp + 0x38], 0x10000
push 0x2002ff
call fcn.00521f18
mov eax, dword [esp + 0x38]
inc eax
lea edx, [esp + 0x18]
push edx
push eax
call fcn.00521fae
call fcn.00407e52
push 0x200300
call fcn.00521f18
mov dword [esp + 0x14], 2
push 0x200301
call fcn.00521f18
lea eax, [esp + 0x38]
push eax
mov eax, 0
mov edx, dword [esp + 0x1c]
mov edx, dword [edx - 8]
call fcn.00521fbb
mov ebp, dword [esp + 0x1c]
lea eax, [ebp]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
push dword [esp + 0x14]
push dword [esp + 0x24]
call sub.ADVAPI32.dll_RegQueryValueExW
push 0x200301
call fcn.00522048
mov ebx, eax
and ebx, ebx
jne 0x51a5bb
push 0x200302
call fcn.00521f18
push edx
call fcn.00408730
pop edx
push eax
push edx
call fcn.00408730
pop edx
push eax
push 0x19
push dword [esp + 0x44]
mov eax, 0
mov edx, dword [esp + 0x28]
mov edx, dword [edx - 8]
call fcn.00521fbb
mov ebp, dword [esp + 0x28]
lea eax, [ebp]
push eax
call fcn.00408140
call fcn.004083b0
lea eax, [esp + 0xc]
push eax
call fcn.00408560
push 0x200303
call fcn.00521f18
push 0x200304
call fcn.00521f18
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegCloseKey
push 0x200304
call fcn.00522048
push 0x200305
call fcn.00521f18
push 0x200306
call fcn.00521f18
push dword [esp + 0xc]
call sub.ADVAPI32.dll_RegCloseKey
push 0x200306
call fcn.00522048
push 0x200307
call fcn.00521f18
push 0x200308
call fcn.00521f18
mov edx, dword [esp + 8]
push edx
call fcn.00408730
pop edx
push eax
push edx
call fcn.00408640
pop eax
push eax
call fcn.004011e0
pop edx
add eax, edx
jmp 0x51a64f
push edx
push eax
call fcn.00409480
pop eax
push dword [esp + 0xc]
call fcn.00408690
push dword [esp + 8]
call fcn.00408690
push dword [esp + 4]
call fcn.00408690
push eax
push dword [esp + 0x20]
call fcn.00407e02
pop eax
pop edx
add esp, 0x44
pop ebx
pop ebp
ret 8