Function at 0x5f78e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3e3c
call fcn.00637690
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
push eax
push 0x6fc08c
lea ecx, [ebp - 0x123c]
call fcn.005e5400
mov ecx, eax
call fcn.005e5430
push eax
lea ecx, [ebp - 0x408]
push ecx
call fcn.006374e0
add esp, 0xc
lea edx, [ebp - 4]
push edx
push 0x20019
push 0
lea eax, [ebp - 0x408]
push eax
push 0x80000002
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x5f7dad
lea ecx, [ebp - 0xa30]
call fcn.005f8450
mov dword [ebp - 0x810], 4
lea ecx, [ebp - 0x810]
push ecx
lea edx, [ebp - 8]
push edx
push 0
push 0
push 0x6fc0c0
lea ecx, [ebp - 0x163c]
call fcn.005e5400
mov ecx, eax
call fcn.005e5430
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
mov dword [ebp - 0x810], 0x400
lea ecx, [ebp - 0x810]
push ecx
lea edx, [ebp - 0x80c]
push edx
push 0
push 0
push 0xa
lea eax, [ebp - 0x40c]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.00642abb
add esp, 0xc
push eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
push 5
push 0x6fc0cc
lea ecx, [ebp - 0x1a3c]
call fcn.005e5400
mov ecx, eax
call fcn.005e5430
push eax
lea eax, [ebp - 0x80c]
push eax
call fcn.00642970
add esp, 0xc
test eax, eax
jne 0x5f7a57
push 0x5c
lea ecx, [ebp - 0xa30]
call fcn.005f7dc0
lea ecx, [ebp - 0x80c]
push ecx
lea ecx, [ebp - 0xa30]
call fcn.005f8540
lea ecx, [ebp - 0xa30]
call fcn.005f7de0
sub eax, 2
mov edx, dword [ebp + 0xc]
mov dword [edx + 0x681], eax
push 0x6fc0d8
push 1
lea ecx, [ebp - 0xa30]
call fcn.005f7e00
push eax
call fcn.00642b50
add esp, 8
test eax, eax
jne 0x5f7a55
mov eax, dword [ebp + 0xc]
mov dword [eax + 0x685], 1
jmp 0x5f7a64
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 0x681], 0
push 0x100
lea edx, [ebp - 0x80c]
push edx
mov eax, dword [ebp + 0xc]
add eax, 0x6dd
push eax
call fcn.00637d90
add esp, 0xc
lea ecx, [ebp - 0x80c]
push ecx
push 0x6fc0e4
lea ecx, [ebp - 0x1e3c]
call fcn.005e5400
mov ecx, eax
call fcn.005e5430
push eax
lea edx, [ebp - 0x408]
push edx
call fcn.006374e0
add esp, 0xc
push 3
push 0x6fc10c
lea eax, [ebp - 0x80c]
push eax
call fcn.00637960
add esp, 0xc
test eax, eax
jne 0x5f7ad6
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 0x68d], 1
lea edx, [ebp - 0xa34]
push edx
push 0x20019
push 0
lea eax, [ebp - 0x408]
push eax
push 0x80000002
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x5f7d98
mov dword [ebp - 0x810], 0x40
lea ecx, [ebp - 0x810]
push ecx
mov edx, dword [ebp + 0xc]
add edx, 0x69d
push edx
push 0
push 0
push 0x6fc110
lea ecx, [ebp - 0x223c]
call fcn.005e5400
mov ecx, eax
call fcn.005e5430
push eax
mov eax, dword [ebp - 0xa34]
push eax
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
mov dword [ebp - 0x810], 4
lea ecx, [ebp - 0x810]
push ecx
mov edx, dword [ebp + 0xc]
add edx, 0x691
push edx
push 0
push 0
push 0x6fc128
lea ecx, [ebp - 0x263c]
call fcn.005e5400
mov ecx, eax
call fcn.005e5430
push eax
mov eax, dword [ebp - 0xa34]
push eax
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
mov dword [ebp - 0xe38], eax
mov dword [ebp - 0x810], 0x400
lea ecx, [ebp - 0x810]
push ecx
lea edx, [ebp - 0x408]
push edx
push 0
push 0
push 0x6fc138
lea ecx, [ebp - 0x2a3c]
call fcn.005e5400
mov ecx, eax
call fcn.005e5430
push eax
mov eax, dword [ebp - 0xa34]
push eax
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
mov dword [ebp - 0xe38], eax
push 0x6fc148
lea ecx, [ebp - 0x408]
push ecx
call fcn.006379a0
add esp, 8
test eax, eax
jne 0x5f7bf8
mov edx, dword [ebp + 0xc]
mov dword [edx + 0x685], 1
push 0x72cb78
lea eax, [ebp - 0xe34]
push eax
call fcn.006373f0
add esp, 8
mov dword [ebp - 0x810], 0x400
lea ecx, [ebp - 0x810]
push ecx
lea edx, [ebp - 0xe34]
push edx
push 0
push 0
push 0x6fc170
lea ecx, [ebp - 0x2e3c]
call fcn.005e5400
mov ecx, eax
call fcn.005e5430
push eax
mov eax, dword [ebp - 0xa34]
push eax
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x5f7d8b
lea ecx, [ebp - 0xe34]
push ecx
push 0x6fc17c
lea ecx, [ebp - 0x323c]
call fcn.005e5400
mov ecx, eax
call fcn.005e5430
push eax
lea edx, [ebp - 0x408]
push edx
call fcn.006374e0
add esp, 0xc
lea eax, [ebp - 0xe3c]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x408]
push ecx
push 0x80000002
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x5f7d8b
cmp dword [ebp + 0xc], 0
je 0x5f7d7e
mov dword [ebp - 0x810], 0x100
lea edx, [ebp - 0x810]
push edx
mov eax, dword [ebp + 0xc]
add eax, 0x481
push eax
push 0
push 0
push 0x6fc1b0
lea ecx, [ebp - 0x363c]
call fcn.005e5400
mov ecx, eax
call fcn.005e5430
push eax
mov ecx, dword [ebp - 0xe3c]
push ecx
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
mov dword [ebp - 0x810], 0x100
lea edx, [ebp - 0x810]
push edx
mov eax, dword [ebp + 0xc]
add eax, 0x581
push eax
push 0
push 0
push 0x6fc1bc
lea ecx, [ebp - 0x3a3c]
call fcn.005e5400
mov ecx, eax
call fcn.005e5430
push eax
mov ecx, dword [ebp - 0xe3c]
push ecx
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
mov dword [ebp - 0x810], 0x100
lea edx, [ebp - 0x810]
push edx
mov eax, dword [ebp + 0xc]
add eax, 0x181
push eax
push 0
push 0
push 0x6fc1cc
lea ecx, [ebp - 0x3e3c]
call fcn.005e5400
mov ecx, eax
call fcn.005e5430
push eax
mov ecx, dword [ebp - 0xe3c]
push ecx
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
mov edx, dword [ebp - 0xe3c]
push edx
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, dword [ebp - 0xa34]
push eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.advapi32.dll_RegCloseKey]
lea ecx, [ebp - 0xa30]
call fcn.005f84e0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret