Function at 0x5b4938
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405168
xor eax, eax
push ebp
push 0x5b4b62
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.00404cac
mov dl, 1
mov eax, dword [0x42d344]
call fcn.0042d4b0
mov ebx, eax
mov dword [ebx + 0x18], 0x2001f
mov edx, 0x80000002
mov eax, ebx
call fcn.0042d58c
mov byte [ebp - 0x31], 0
mov eax, dword [ebp - 4]
call fcn.00404f80
add eax, dword [ebp + 8]
add eax, 2
call fcn.00402a88
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 4]
call fcn.00404f80
add eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
call fcn.00404f80
mov edx, eax
test edx, edx
jl 0x5b49df
inc edx
xor eax, eax
mov ecx, dword [ebp - 4]
mov cl, byte [ecx + eax]
mov esi, dword [ebp - 0x2c]
mov byte [esi + eax], cl
inc eax
dec edx
jne 0x5b49cf
xor ecx, ecx
mov edx, 0x5b4b7c
mov eax, ebx
call fcn.0042d6d0
test al, al
je 0x5b4b06
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0xff
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x138]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegEnumKeyExA
test eax, eax
jne 0x5b4aff
lea eax, [ebp - 0x28]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x138]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x5b4af7
xor esi, esi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], 0xff
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x30]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x238]
push eax
push esi
mov eax, dword [ebp - 0x28]
push eax
call sub.advapi32.dll_RegEnumValueA
test eax, eax
jne 0x5b4adb
mov eax, dword [ebp - 4]
call fcn.00404f80
mov edx, eax
add edx, dword [ebp - 0x20]
lea ecx, [ebp - 0x38]
mov eax, dword [ebp - 0x2c]
call fcn.004f0ef4
lea eax, [ebp - 0x23c]
lea edx, [ebp - 0x238]
mov ecx, pe_nt_image_headers32
call fcn.00404f14
mov edx, dword [ebp - 0x23c]
mov eax, dword [ebp - 0x38]
call fcn.004050c4
jne 0x5b4ae2
mov byte [ebp - 0x31], 1
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x138]
mov ecx, pe_nt_image_headers32
call fcn.00404f14
jmp 0x5b4ae8
cmp eax, 0x103
je 0x5b4ae8
inc esi
jmp 0x5b4a50
mov eax, dword [ebp - 0x28]
push eax
call sub.advapi32.dll_RegCloseKey_1
cmp byte [ebp - 0x31], 0
jne 0x5b4aff
inc dword [ebp - 0x14]
jmp 0x5b49fa
mov eax, ebx
call fcn.0042d55c
mov eax, ebx
call fcn.00403e80
cmp byte [ebp - 0x31], 0
je 0x5b4b2e
mov edx, dword [ebp - 0x20]
dec edx
test edx, edx
jl 0x5b4b2e
inc edx
xor eax, eax
mov ecx, dword [ebp - 0x30]
mov cl, byte [ecx + eax]
mov ebx, dword [ebp - 0xc]
mov byte [ebx + eax], cl
inc eax
dec edx
jne 0x5b4b1e
mov eax, dword [ebp - 0x2c]
call fcn.00402aa8
mov bl, byte [ebp - 0x31]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5b4b69
lea eax, [ebp - 0x23c]
call fcn.00404cac
lea eax, [ebp - 0x38]
call fcn.00404cac
lea eax, [ebp - 4]
call fcn.00404cac
ret