Function at 0x500a4efe
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x68]
sub esp, 0xac
push ebx
xor eax, eax
xor ebx, ebx
cmp dword [ebp + 0x78], ebx
push edi
setne al
mov edi, ecx
mov dword [ebp + 0x5c], ebx
mov dword [ebp + 0x54], eax
xor eax, eax
cmp dword [ebp + 0x7c], ebx
setne al
mov dword [ebp + 0x50], eax
lea eax, [ebp + 0x64]
push eax
push 0x20019
push ebx
push dword [ebp + 0x74]
push dword [ebp + 0x70]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
je 0x500a4f48
push eax
jmp 0x500a50b4
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp + 0x60]
push eax
push ebx
push ebx
push ebx
push dword [ebp + 0x64]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
cmp eax, ebx
mov dword [ebp + 0x58], eax
jne 0x500a50a1
cmp dword [edi + 0x2c], ebx
je 0x500a4f89
mov eax, dword [ebp + 0x60]
push 1
lea eax, [eax + eax*2]
push 5
pop ecx
shl eax, 1
xor edx, edx
div ecx
lea ecx, [edi + 0x14]
push eax
call fcn.5026d90b
cmp dword [ebp + 0x60], ebx
mov dword [ebp + 0x70], ebx
jbe 0x500a50a1
push esi
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp + 0x4c]
push eax
lea eax, [ebp - 0x44]
push eax
push dword [ebp + 0x70]
mov dword [ebp + 0x4c], 0x80
push dword [ebp + 0x64]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp dword [ebp + 0x54], ebx
mov dword [ebp + 0x58], eax
je 0x500a4ff6
mov esi, dword [ebp + 0x78]
lea eax, [ebp - 0x44]
mov dl, byte [esi]
mov cl, dl
cmp dl, byte [eax]
jne 0x500a4fe5
cmp cl, bl
je 0x500a4fe1
mov dl, byte [esi + 1]
mov cl, dl
cmp dl, byte [eax + 1]
jne 0x500a4fe5
inc esi
inc esi
inc eax
inc eax
cmp cl, bl
jne 0x500a4fc3
xor eax, eax
jmp 0x500a4fea
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x500a4ff6
mov dword [ebp + 0x54], ebx
jmp 0x500a5091
cmp dword [ebp + 0x50], ebx
je 0x500a5031
mov esi, dword [ebp + 0x7c]
lea eax, [ebp - 0x44]
mov dl, byte [esi]
mov cl, dl
cmp dl, byte [eax]
jne 0x500a5023
cmp cl, bl
je 0x500a501f
mov dl, byte [esi + 1]
mov cl, dl
cmp dl, byte [eax + 1]
jne 0x500a5023
inc esi
inc esi
inc eax
inc eax
cmp cl, bl
jne 0x500a5001
xor eax, eax
jmp 0x500a5028
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x500a5031
mov dword [ebp + 0x50], ebx
jmp 0x500a5091
mov eax, dword [edi]
lea ecx, [ebp + 0x74]
push ecx
mov ecx, edi
call dword [eax]
cmp eax, ebx
mov dword [ebp + 0x5c], eax
jl 0x500a50a0
mov ecx, dword [ebp + 0x74]
mov eax, dword [ecx]
lea edx, [ebp - 0x44]
push edx
push dword [ebp + 0x64]
call dword [eax + 0x38]
test eax, eax
jge 0x500a5065
mov ecx, dword [ebp + 0x74]
cmp ecx, ebx
je 0x500a5091
mov eax, dword [ecx]
push 1
call dword [eax + 0x24]
jmp 0x500a5091
push dword [ebp + 0x74]
lea ecx, [edi + 8]
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [edi + 0x2c], ebx
je 0x500a5091
lea eax, [ebp + 0x3c]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.50272bbe
push dword [ebp + 0x74]
lea eax, [ebp + 0x3c]
push eax
lea ecx, [edi + 0x14]
call fcn.50272bbe
inc dword [ebp + 0x70]
mov eax, dword [ebp + 0x70]
cmp eax, dword [ebp + 0x60]
jb 0x500a4f96
pop esi
push dword [ebp + 0x64]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0x5c]
cmp eax, ebx
jl 0x500a50b9
push dword [ebp + 0x58]
call fcn.5006846c
pop edi
pop ebx
add ebp, 0x68
leave
ret 0x10