Function at 0x5bb140
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x634
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push esi
push edi
lea eax, [esp + 0x1c]
push eax
push 0x20019
mov esi, ecx
xor edi, edi
push edi
lea ecx, [esi + 0xd0]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x34], 0x80004005
mov dword [esp + 0x28], edi
mov dword [esp + 0x24], 0x208
mov dword [esp + 0x20], 0x32
mov dword [esi + 0x84], edi
call ebx
test eax, eax
jne 0x5bb401
lea edx, [esp + 0x18]
push edx
push 0x20019
push eax
mov eax, dword [esp + 0x28]
push str.License
push eax
call ebx
test eax, eax
jne 0x5bb3a6
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x2c]
push eax
mov eax, dword [esp + 0x24]
push edi
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x44c]
push edx
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
je 0x5bb39b
lea esp, [esp]
mov ecx, dword [esp + 0x14]
inc ecx
push 3
mov dword [esp + 0x18], ecx
push 0x5f7084
lea ecx, [esp + 0x440]
push ecx
call fcn.00462850
test eax, eax
je 0x5bb22d
push 1
push 0x5d49c0
lea edx, [esp + 0x440]
push edx
call fcn.00462850
test eax, eax
jne 0x5bb34d
push 1
push 0x5d49c0
lea eax, [esp + 0x30]
push eax
call fcn.00462850
test eax, eax
je 0x5bb34d
lea ecx, [esp + 0x28]
push ecx
mov ecx, esi
call fcn.005ba930
test eax, eax
mov dword [esp + 0x20], eax
jl 0x5bb34d
mov edx, dword [esi + 0x84]
mov ecx, dword [esi]
inc edx
mov dword [esi + 0x84], edx
call fcn.005bdec0
test eax, eax
jl 0x5bb292
cmp eax, 0x3ff
jge 0x5bb34d
mov eax, dword [esi]
test eax, eax
je 0x5bb292
mov ecx, dword [eax + 4]
test ecx, ecx
jne 0x5bb34d
test edi, edi
je 0x5bb330
mov eax, dword [esi + 0xce0]
test eax, eax
je 0x5bb30b
mov ecx, dword [esi]
call fcn.005bd160
mov ecx, edi
push eax
call fcn.005bd160
push eax
call dword [esi + 0xce0]
test eax, eax
je 0x5bb2e3
push edi
call fcn.00404b90
mov edi, dword [esi]
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x238]
push eax
mov dword [esi], 0
call fcn.005c43d6
add esp, 0xc
jmp 0x5bb34d
mov ecx, dword [esi]
call fcn.005bd160
mov ecx, edi
mov bx, ax
call fcn.005bd160
cmp ax, bx
jne 0x5bb34d
mov eax, dword [edi + 4]
test eax, eax
jne 0x5bb34d
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
test eax, eax
je 0x5bb34d
jmp 0x5bb2be
push edi
call fcn.00404b90
mov edi, dword [esi]
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x238]
push edx
mov dword [esi], 0
call fcn.005c43d6
add esp, 0xc
jmp 0x5bb34d
mov edi, dword [esi]
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x234]
push ecx
mov dword [esi], 0
call fcn.005c43d6
add esp, 8
mov eax, dword [esp + 0x14]
cmp eax, 0x15
mov dword [esp + 0x10], 0x208
mov dword [esp + 0xc], 0x32
ja 0x5bb39b
lea edx, [esp + 0xc]
push edx
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x2c]
push edx
push 0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x44c]
push edx
push eax
mov eax, dword [esp + 0x34]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
jne 0x5bb1f0
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x5bb401
mov eax, dword [esi]
test eax, eax
je 0x5bb3c4
push eax
call fcn.00404b90
add esp, 4
mov dword [esi], edi
mov esi, dword [esp + 0x648]
shr esi, 1
test esi, esi
jle 0x5bb3f3
mov edi, dword [esp + 0x644]
push esi
lea eax, [esp + 0x234]
push eax
push edi
call fcn.005c43dc
add esp, 0xc
mov word [edi + esi*2 - 2], 0
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x634
ret 8
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebx
add esp, 0x634
ret 8