Function at 0x58f720
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x6eb874]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x224], 1
mov dword [ebp - 0x220], 0x104
xor eax, eax
mov byte [ebp - 0x225], al
lea ecx, [ebp - 0x220]
push ecx
lea edx, [ebp - 0x20c]
push edx
lea eax, [ebp - 0x224]
push eax
push str.groupname
lea ecx, [ebp - 0x225]
call fcn.00595a40
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x58f8e0
lea ecx, [ebp - 0x20c]
push ecx
call fcn.00641e0e
add esp, 4
test eax, eax
je 0x58f8e0
lea edx, [ebp - 0x20c]
push edx
mov ecx, 0x6fc360
call fcn.00413a70
mov dword [ebp - 0x224], 1
mov dword [ebp - 0x220], 0x104
xor eax, eax
mov byte [ebp - 0x226], al
lea ecx, [ebp - 0x220]
push ecx
lea edx, [ebp - 0x20c]
push edx
lea eax, [ebp - 0x224]
push eax
push str.tagname
lea ecx, [ebp - 0x226]
call fcn.00596c40
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x58f825
lea ecx, [ebp - 0x20c]
push ecx
call fcn.00641e0e
add esp, 4
test eax, eax
je 0x58f825
lea edx, [ebp - 0x20c]
push edx
mov ecx, 0x6fc35c
call fcn.00413a70
mov dword [ebp - 0x224], 4
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x220], 4
xor eax, eax
mov byte [ebp - 0x227], al
lea ecx, [ebp - 0x220]
push ecx
lea edx, [ebp - 0x230]
push edx
lea eax, [ebp - 0x224]
push eax
push str.StartIndex
lea ecx, [ebp - 0x227]
call fcn.00597520
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x58f895
cmp dword [ebp - 0x230], 0
je 0x58f895
mov ecx, dword [ebp - 0x230]
mov dword [0x6fc36c], ecx
mov dword [ebp - 0x224], 4
mov dword [ebp - 0x220], 4
xor edx, edx
mov byte [ebp - 0x228], dl
lea eax, [ebp - 0x220]
push eax
push 0x6fc370
lea ecx, [ebp - 0x224]
push ecx
push str.LocalView
lea ecx, [ebp - 0x228]
call fcn.00596bf0
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea ecx, [ebp - 0x234]
call fcn.00413220
lea edx, [ebp - 0x21c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
movzx eax, word [ebp - 0x216]
push eax
movzx ecx, word [ebp - 0x21a]
push ecx
movzx edx, word [ebp - 0x21c]
push edx
push str._d__d__d
lea eax, [ebp - 0x234]
push eax
call fcn.00422a10
add esp, 0x14
mov dword [ebp - 0x224], 1
mov dword [ebp - 0x220], 0x104
push 0x208
push 0
lea ecx, [ebp - 0x20c]
push ecx
call fcn.0063a460
add esp, 0xc
mov dword [ebp - 0x238], 0
xor edx, edx
mov byte [ebp - 0x229], dl
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [ebp - 0x224]
push edx
push str.pageinfodate
lea ecx, [ebp - 0x229]
call fcn.005974d0
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x58f9bc
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x20c]
push ecx
call fcn.0051d5d0
add esp, 8
movzx edx, al
test edx, edx
je 0x58f9bc
mov dword [ebp - 0x238], 1
cmp dword [ebp - 0x238], 0
je 0x58f9f7
push 0x6a4774
mov ecx, 0x6fc360
call fcn.00413a70
push 0x6a477c
mov ecx, 0x6fc35c
call fcn.00413a70
mov dword [0x6fc36c], 0
mov dword [0x6fc370], 0
lea ecx, [ebp - 0x234]
call fcn.00413870
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.006135ac
mov esp, ebp
pop ebp
ret