Function at 0x5058da
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x56edfe
call fcn.0053c1d0
sub esp, 0x500
mov ecx, dword [ebp + 0xc]
mov eax, dword [0x5af710]
push ebx
mov dword [ebp - 0x438], ecx
xor eax, ebp
lea ecx, [ebp - 0x420]
push ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
push str.Bindings
xor ebx, ebx
push eax
mov dword [ebp - 0x428], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x505cdb
push edi
mov edi, 0x400
push edi
lea eax, [ebp - 0x410]
push ebx
push eax
mov dword [ebp - 0x424], ebx
mov dword [ebp - 0x418], edi
call fcn.0053c340
add esp, 0xc
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x410]
push eax
push ebx
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x505cce
push esi
inc dword [ebp - 0x424]
push 5
lea eax, [ebp - 0x410]
push str.MSTCP
push eax
call fcn.00547123
add esp, 0xc
test eax, eax
jne 0x505c2e
push 1
push 2
lea ecx, [ebp - 0x4d4]
call fcn.00404a20
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x4d4]
push str.EnumNetwork_
push eax
mov dword [ebp - 4], ebx
call fcn.00403980
pop ecx
pop ecx
push eax
call fcn.00403980
push edi
lea eax, [ebp - 0x410]
push ebx
push eax
mov dword [ebp - 0x418], edi
call fcn.0053c340
add esp, 0x14
lea eax, [ebp - 0x50c]
push eax
lea ecx, [ebp - 0x4d4]
call fcn.00407320
cmp dword [eax + 0x18], 0x10
jb 0x5059f9
mov eax, dword [eax + 4]
jmp 0x5059fc
add eax, 4
cmp eax, ebx
je 0x505ab5
cmp byte [eax], bl
je 0x505ab5
lea ecx, [ebp - 0x42c]
push ecx
push 0x20019
push ebx
push eax
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x505ab5
mov eax, dword [ebp - 0x418]
mov dword [ebp - 0x434], eax
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x41c]
push eax
push ebx
push 0x575738
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x42c]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
jne 0x505ab5
cmp dword [ebp - 0x41c], 1
je 0x505a84
cmp dword [ebp - 0x41c], 7
jne 0x505aac
mov edx, dword [ebp - 0x418]
xor ecx, ecx
dec edx
cmp edx, ebx
jbe 0x505aac
cmp ecx, dword [ebp - 0x434]
jae 0x505aac
lea eax, [ebp + ecx - 0x410]
cmp byte [eax], bl
jne 0x505aa7
mov byte [eax], 0x20
inc ecx
cmp ecx, edx
jb 0x505a91
mov byte [ebp - 0x411], 1
jmp 0x505abb
mov byte [ebp - 0x411], bl
push ebx
push 1
lea ecx, [ebp - 0x50c]
call fcn.00402c50
cmp byte [ebp - 0x411], bl
je 0x505c0a
push 0x572aed
lea ecx, [ebp - 0x454]
call fcn.00405500
lea eax, [ebp - 0x454]
push eax
lea ecx, [ebp - 0x4d0]
mov byte [ebp - 4], 1
call fcn.0040bb6a
push ebx
push 1
lea ecx, [ebp - 0x454]
mov byte [ebp - 4], bl
call fcn.00402c50
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x4d4]
push str.SystemCurrentControlSetServicesClass_
push eax
call fcn.00403980
pop ecx
pop ecx
push eax
call fcn.00403980
push edi
lea eax, [ebp - 0x410]
push ebx
push eax
mov dword [ebp - 0x418], edi
call fcn.0053c340
add esp, 0x14
lea eax, [ebp - 0x4f0]
push eax
lea ecx, [ebp - 0x4d4]
call fcn.00407320
cmp dword [eax + 0x18], 0x10
jb 0x505b60
mov eax, dword [eax + 4]
jmp 0x505b63
add eax, 4
cmp eax, ebx
je 0x505bd0
cmp byte [eax], bl
je 0x505bd0
lea ecx, [ebp - 0x430]
push ecx
push 0x20019
push ebx
push eax
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x505bd0
mov edi, dword [ebp - 0x418]
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x41c]
push eax
push ebx
push 0x573c04
push dword [ebp - 0x430]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x430]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x505c5c
mov edi, 0x400
mov byte [ebp - 0x411], bl
xor esi, esi
push ebx
inc esi
push esi
lea ecx, [ebp - 0x4f0]
call fcn.00402c50
cmp byte [ebp - 0x411], bl
je 0x505c0a
push dword [ebp - 0x438]
lea eax, [ebp - 0x410]
push eax
call fcn.0053dba0
test eax, eax
pop ecx
pop ecx
je 0x505ca3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x488]
call fcn.004028d0
lea ecx, [ebp - 0x488]
mov dword [ebp - 0x488], 0x572840
call fcn.0054dfcb
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x410]
push eax
push dword [ebp - 0x424]
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
je 0x50596f
jmp 0x505ccd
cmp dword [ebp - 0x41c], 1
je 0x505c6e
cmp dword [ebp - 0x41c], 7
jne 0x505c92
mov edx, dword [ebp - 0x418]
xor ecx, ecx
dec edx
cmp edx, ebx
jbe 0x505c92
cmp ecx, edi
jae 0x505c92
lea eax, [ebp + ecx - 0x410]
cmp byte [eax], bl
jne 0x505c8d
mov byte [eax], 0x20
inc ecx
cmp ecx, edx
jb 0x505c7b
mov byte [ebp - 0x411], 1
mov edi, 0x400
jmp 0x505bd6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x488]
mov dword [ebp - 0x428], esi
call fcn.004028d0
lea ecx, [ebp - 0x488]
mov dword [ebp - 0x488], 0x572840
call fcn.0054dfcb
pop esi
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x428]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
pop ebx
call fcn.0053aaae
leave
ret