Function at 0x506b90
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
push rbx
sub rsp, 0x118
mov rbp, rsp
mov qword [rbp + 0x68], rcx
mov qword [rbp + 0x80], 0
mov qword [rbp + 0x78], 0
mov qword [rbp + 0x70], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x90], 0
mov qword [rbp + 0x98], 0
mov qword [rbp + 0xa8], 0
mov qword [rbp + 0xa0], 0
mov qword [rbp + 0xb0], 0
mov qword [rbp + 0xb8], 0
mov qword [rbp + 0xc8], 0
mov qword [rbp + 0xc0], 0
mov qword [rbp + 0xd8], 0
mov qword [rbp + 0xd0], 0
mov qword [rbp + 0xf8], 0
mov qword [rbp + 0xf0], 0
mov qword [rbp + 0xe8], 0
nop
mov rcx, 0xffffffff80000006
lea rdx, [0x005071b8]
xor r8, r8
mov r9d, 0x20019
lea rax, [rbp + 0x108]
mov qword [rsp + 0x20], rax
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x507105
mov rcx, qword [rbp + 0x108]
xor rdx, rdx
xor r8, r8
xor r9, r9
lea rax, [rbp + 0xe4]
mov qword [rsp + 0x20], rax
lea rax, [rbp + 0xe0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
jne 0x5070f9
mov eax, dword [rbp + 0xe0]
add eax, eax
mov dword [rbp + 0xe0], eax
mov ecx, 0x40
mov edx, dword [rbp + 0xe0]
add edx, edx
mov edx, edx
call sub.kernel32.dll_LocalAlloc
mov rbx, rax
sub dword [rbp + 0xe4], 1
cmp dword [rbp + 0xe4], 0
jb 0x5070f0
mov rcx, qword [rbp + 0x108]
mov edx, dword [rbp + 0xe4]
mov r8, rbx
mov r9d, dword [rbp + 0xe0]
call sub.advapi32.dll_RegEnumKeyA
test eax, eax
jne 0x5070f0
lea rcx, [rbp + 0xd0]
mov rdx, rbx
xor r8, r8
call fcn.00410cf0
mov rcx, rbp
lea rdx, [rbp + 0xd8]
mov r8, qword [rbp + 0x108]
mov r9, qword [rbp + 0xd0]
lea rax, [0x005071d8]
mov qword [rsp + 0x20], rax
call fcn.00506a70
lea rcx, [rbp + 0xf8]
mov rdx, qword [rbp + 0xd8]
call fcn.00410860
lea rcx, [rbp + 0xc0]
mov rdx, rbx
xor r8, r8
call fcn.00410cf0
mov rcx, rbp
lea rdx, [rbp + 0xc8]
mov r8, qword [rbp + 0x108]
mov r9, qword [rbp + 0xc0]
lea rax, [0x005071f0]
mov qword [rsp + 0x20], rax
call fcn.00506a70
lea rcx, [rbp + 0xf0]
mov rdx, qword [rbp + 0xc8]
call fcn.00410860
mov rcx, qword [rbp + 0xf0]
call fcn.004108b0
cmp eax, 4
jne 0x506e0d
mov rax, qword [rbp + 0xf0]
cmp dword [rax], 0x16
je 0x5070dc
lea rcx, [0x00507204]
mov rdx, qword [rbp + 0xf8]
mov r8d, 1
mov r9d, 0x7fffffff
mov rax, qword [0x00bb8188]
call qword [rax]
test eax, eax
jne 0x5070dc
lea rcx, [rbp + 0xb8]
lea rdx, [0x0050721c]
mov r8, qword [rbp + 0xf8]
call fcn.00410f60
mov rcx, qword [rbp + 0xb8]
call fcn.00411320
mov rcx, 0xffffffff80000002
mov rdx, rax
xor r8, r8
mov r9d, 0x20019
lea rax, [rbp + 0x100]
mov qword [rsp + 0x20], rax
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x5070dc
mov rcx, rbp
lea rdx, [rbp + 0xb0]
mov r8, qword [rbp + 0x100]
xor r9, r9
lea rax, [0x00507230]
mov qword [rsp + 0x20], rax
call fcn.00506a70
lea rcx, [rbp + 0xf8]
mov rdx, qword [rbp + 0xb0]
call fcn.00410860
cmp qword [rbp + 0xf8], 0
je 0x5070d0
mov rcx, qword [rbp + 0xf8]
lea rdx, [0x00507244]
call fcn.004112d0
test eax, eax
je 0x5070d0
mov rcx, qword [rbp + 0xf8]
lea rdx, [0x0050725c]
call fcn.004112d0
test eax, eax
je 0x5070d0
mov rcx, qword [rbp + 0xf8]
lea rdx, [0x00507274]
call fcn.004112d0
test eax, eax
je 0x5070d0
lea rcx, [rbp + 0xa0]
lea rdx, [0x0050728c]
mov r8, qword [rbp + 0xf8]
call fcn.00410f60
mov rcx, rbp
lea rdx, [rbp + 0xa8]
mov r8, 0xffffffff80000002
mov r9, qword [rbp + 0xa0]
mov qword [rsp + 0x20], 0
call fcn.00506a70
lea rcx, [rbp + 0xf8]
mov rdx, qword [rbp + 0xa8]
call fcn.00410860
mov rcx, rbp
lea rdx, [rbp + 0x98]
mov r8, qword [rbp + 0x100]
xor r9, r9
lea rax, [0x005072c4]
mov qword [rsp + 0x20], rax
call fcn.00506a70
lea rcx, [rbp + 0xf0]
mov rdx, qword [rbp + 0x98]
call fcn.00410860
mov rcx, rbp
lea rdx, [rbp + 0x90]
mov r8, qword [rbp + 0x100]
xor r9, r9
lea rax, [0x005072dc]
mov qword [rsp + 0x20], rax
call fcn.00506a70
lea rcx, [rbp + 0xe8]
mov rdx, qword [rbp + 0x90]
call fcn.00410860
cmp qword [rbp + 0xe8], 0
je 0x507029
lea rcx, [rbp + 0xf0]
mov edx, 4
lea r8, [0x00507308]
mov r9, qword [rbp + 0xe8]
lea rax, [0x00507318]
mov qword [rsp + 0x20], rax
mov rax, qword [rbp + 0xf0]
mov qword [rsp + 0x28], rax
call fcn.004111f0
mov rcx, rbp
lea rdx, [rbp + 0x88]
mov r8, qword [rbp + 0x100]
xor r9, r9
lea rax, [0x00507328]
mov qword [rsp + 0x20], rax
call fcn.00506a70
lea rcx, [rbp + 0xe8]
mov rdx, qword [rbp + 0x88]
call fcn.00410860
cmp qword [rbp + 0xe8], 0
je 0x507085
lea rcx, [rbp + 0xe8]
lea rdx, [0x0050728c]
mov r8, qword [rbp + 0xe8]
call fcn.00410f60
lea rcx, [rbp + 0x80]
mov rdx, qword [rbp + 0xf8]
call fcn.00411f60
lea rcx, [rbp + 0x78]
mov rdx, qword [rbp + 0xf0]
call fcn.00411f60
lea rcx, [rbp + 0x70]
mov rdx, qword [rbp + 0xe8]
call fcn.00411f60
mov rcx, qword [rbp + 0x68]
mov rdx, qword [rbp + 0x80]
mov r8, qword [rbp + 0x78]
mov r9, qword [rbp + 0x70]
call fcn.00506780
mov rcx, qword [rbp + 0x100]
call sub.advapi32.dll_RegCloseKey
sub dword [rbp + 0xe4], 1
cmp dword [rbp + 0xe4], 0xffffffff
jne 0x506d2c
nop
mov rcx, rbx
call sub.kernel32.dll_LocalFree
mov rcx, qword [rbp + 0x108]
call sub.advapi32.dll_RegCloseKey
nop
lea rcx, [rbp + 0x70]
mov edx, 3
call fcn.00410160
lea rcx, [rbp + 0x88]
mov edx, 0xb
call fcn.00410190
lea rcx, [rbp + 0xe8]
mov edx, 3
call fcn.00410190
lea rsp, [rbp + 0x118]
pop rbx
pop rbp
ret