Function at 0x537024
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x104c
push 0
push 0
dec ecx
jne 0x53702d
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00406b44
xor eax, eax
push ebp
push 0x537410
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x11], 1
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov edx, dword [eax]
call dword [edx + 0x44]
cmp byte [ebp + 8], 1
jne 0x537074
mov esi, 0xf013f
jmp 0x537079
mov esi, 0xf003f
lea eax, [ebp - 0x18]
push eax
push esi
push 0
mov eax, dword [ebp - 4]
call fcn.004075c4
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x5373c3
xor eax, eax
mov dword [ebp - 0x1c], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryInfoKeyW
mov ebx, dword [ebp - 0x1c]
dec ebx
test ebx, ebx
jl 0x5373b8
inc ebx
xor esi, esi
lea eax, [ebp - 0x8026]
xor ecx, ecx
mov edx, 0x7ffe
call fcn.004049c8
mov dword [ebp - 0x20], 0x3fff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x8026]
push eax
push esi
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegEnumValueW
lea eax, [ebp - 0x8230]
lea edx, [ebp - 0x8026]
mov ecx, 0x3fff
call fcn.00407668
mov eax, dword [ebp - 0x8230]
lea edx, [ebp - 0x822c]
call fcn.0041d61c
mov eax, dword [ebp - 0x822c]
mov dword [ebp - 0x8234], eax
mov eax, dword [ebp - 0x8234]
test eax, eax
je 0x537144
sub eax, 4
mov eax, dword [eax]
test eax, eax
je 0x5373b0
mov dword [ebp - 0x20], 0xff
mov edx, dword [ebp - 0x20]
add edx, edx
lea eax, [ebp - 0x8226]
xor ecx, ecx
call fcn.004049c8
lea eax, [ebp - 0x28]
push eax
push 0
lea eax, [ebp - 0x24]
push eax
push 0
lea eax, [ebp - 0x823c]
lea edx, [ebp - 0x8026]
mov ecx, 0x3fff
call fcn.00407668
mov eax, dword [ebp - 0x823c]
lea edx, [ebp - 0x8238]
call fcn.0041d61c
mov eax, dword [ebp - 0x8238]
call fcn.004075c4
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
cmp eax, 0xea
je 0x5371c1
cmp dword [ebp - 0x28], 0xff
jbe 0x5372dd
add dword [ebp - 0x28], 2
mov eax, dword [ebp - 0x28]
push eax
lea eax, [ebp - 0xc]
mov ecx, 1
mov edx, dword [0x536fec]
call fcn.004088fc
add esp, 4
mov edx, dword [ebp - 0x28]
add edx, edx
mov eax, dword [ebp - 0xc]
xor ecx, ecx
call fcn.004049c8
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x24]
push eax
push 0
lea eax, [ebp - 0x8244]
lea edx, [ebp - 0x8026]
mov ecx, 0x3fff
call fcn.00407668
mov eax, dword [ebp - 0x8244]
lea edx, [ebp - 0x8240]
call fcn.0041d61c
mov eax, dword [ebp - 0x8240]
call fcn.004075c4
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
mov edi, dword [ebp - 0xc]
mov dword [ebp - 0x8234], edi
mov edi, dword [ebp - 0x8234]
test edi, edi
je 0x537250
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x8234], eax
mov eax, dword [ebp - 0x8234]
mov ecx, edi
mov edx, 1
call fcn.00407988
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0
je 0x5372ae
lea eax, [ebp - 0x824c]
lea edx, [ebp - 0x8026]
mov ecx, 0x3fff
call fcn.00407668
mov eax, dword [ebp - 0x824c]
lea edx, [ebp - 0x8248]
call fcn.0041d61c
mov edx, dword [ebp - 0x8248]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
je 0x5373b0
lea edx, [ebp - 0x8250]
mov eax, dword [ebp - 8]
call fcn.0041d61c
mov edx, dword [ebp - 0x8250]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov ecx, dword [eax]
call dword [ecx + 0x38]
jmp 0x5373b0
test eax, eax
jne 0x5373b0
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x8226]
push eax
lea eax, [ebp - 0x24]
push eax
push 0
lea eax, [ebp - 0x8258]
lea edx, [ebp - 0x8026]
mov ecx, 0x3fff
call fcn.00407668
mov eax, dword [ebp - 0x8258]
lea edx, [ebp - 0x8254]
call fcn.0041d61c
mov eax, dword [ebp - 0x8254]
call fcn.004075c4
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0
je 0x537371
lea eax, [ebp - 0x8260]
lea edx, [ebp - 0x8026]
mov ecx, 0x3fff
call fcn.00407668
mov eax, dword [ebp - 0x8260]
lea edx, [ebp - 0x825c]
call fcn.0041d61c
mov edx, dword [ebp - 0x825c]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
je 0x5373b0
lea eax, [ebp - 0x8268]
lea edx, [ebp - 0x8226]
mov ecx, pe_nt_image_headers32
call fcn.00407668
mov eax, dword [ebp - 0x8268]
lea edx, [ebp - 0x8264]
call fcn.0041d61c
mov edx, dword [ebp - 0x8264]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc esi
dec ebx
jne 0x5370cc
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp 0x5373c7
mov byte [ebp - 0x11], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x537417
lea eax, [ebp - 0x8268]
mov edx, 0xd
call fcn.00406ac0
lea eax, [ebp - 0x8230]
mov edx, 2
call fcn.00406ac0
lea eax, [ebp - 0xc]
mov edx, dword [0x536fec]
call fcn.00408a20
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406ac0
ret