Function at 0x5a64e0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5a6759
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x5a672e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x647e48]
call fcn.005a5bd8
push ebp
mov eax, 0x5a676c
call fcn.005a5c8c
pop ecx
test al, al
je 0x5a653e
push 0
push 0
mov ecx, 0x5a676c
xor edx, edx
mov eax, dword [0x647e48]
call fcn.005a5ae0
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0x5a6770
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x5a65fb
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
jne 0x5a65f2
mov eax, dword [ebp - 0x18]
dec eax
test eax, eax
jl 0x5a65f2
inc eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.004050e4
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
call fcn.00404f58
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegEnumKeyExA
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.004050e4
push ebp
xor ecx, ecx
mov edx, dword [ebp - 0x14]
mov eax, 0x5a6798
call fcn.005a5dcc
pop ecx
inc dword [ebp - 8]
dec dword [ebp - 0x20]
jne 0x5a659a
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0x5a67b8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x5a66f1
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
jne 0x5a66f1
mov eax, dword [ebp - 0x18]
dec eax
test eax, eax
jl 0x5a66f1
inc eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.004050e4
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
call fcn.00404f58
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegEnumKeyExA
mov eax, dword [ebp - 0x14]
call fcn.00404f58
mov edx, 0x5a67c8
mov ecx, 4
call fcn.004097f0
test eax, eax
je 0x5a66c9
mov eax, dword [ebp - 0x14]
call fcn.00404f58
mov edx, 0x5a67d0
mov ecx, 4
call fcn.004097f0
test eax, eax
jne 0x5a66e5
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.004050e4
push ebp
mov cl, 1
mov edx, dword [ebp - 0x14]
mov eax, 0x5a67e0
call fcn.005a5dcc
pop ecx
inc dword [ebp - 8]
dec dword [ebp - 0x20]
jne 0x5a665f
push ebp
mov eax, 0x5a67e0
mov cl, 1
xor edx, edx
call fcn.005a5dcc
pop ecx
push ebp
mov eax, 0x5a67e0
mov cl, 2
xor edx, edx
call fcn.005a5dcc
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a6735
cmp dword [ebp - 0xc], 0
je 0x5a672d
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret