Function at 0x5ba90207
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x5bb70c3c]
or dword [ebp - 0x128], 0xffffffff
push ebx
push esi
xor esi, esi
push edi
xor edi, edi
mov ebx, ecx
inc edi
cmp dword [ebp + 8], esi
mov dword [ebp - 4], eax
mov dword [ebp - 0x130], ebx
mov dword [ebp - 0x11c], esi
mov dword [ebp - 0x124], esi
mov dword [ebp - 0x13c], esi
mov dword [ebp - 0x120], esi
mov dword [ebp - 0x118], esi
mov dword [ebp - 0x12c], esi
jne 0x5ba90287
test dword [ebx + 8], edi
jne 0x5ba905aa
call fcn.5baabb80
test dword [0x5bb7381c], 0x40
je 0x5ba9027b
mov ecx, ebx
call fcn.5bb27cb1
mov dword [ebp - 0x114], 0x5ba4f194
jmp 0x5ba902cd
cmp dword [ebp + 8], edi
jne 0x5ba902ac
test dword [ebx + 8], 2
jne 0x5ba905aa
mov ecx, ebx
call fcn.5baabb80
mov dword [ebp - 0x114], 0x5ba4f1a0
jmp 0x5ba902cd
cmp dword [ebp + 8], 2
jne 0x5ba9055a
test dword [ebx + 8], 0x10
jne 0x5ba905aa
mov dword [ebp - 0x114], 0x5ba4f1ac
lea eax, [ebp - 0x13c]
push eax
lea eax, [ebp - 0x124]
push eax
push 0xf003f
push dword [ebp - 0x114]
call fcn.5ba7bd2a
cmp eax, esi
je 0x5ba902fd
jle 0x5ba90356
and eax, 0xffff
or eax, 0x80070000
jmp 0x5ba90356
push 4
pop esi
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x12c]
push eax
push 0
push 0
mov edi, 0x5ba4cabc
push edi
push dword [ebp - 0x124]
mov dword [ebp - 0x120], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x5ba9035d
push esi
lea eax, [ebp - 0x12c]
push eax
push esi
push 0
push edi
push dword [ebp - 0x124]
mov dword [ebp - 0x12c], 0x50000
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x5ba9035d
jg 0x5ba902f1
mov edi, eax
jmp 0x5ba9055f
push dword [ebp + 8]
call fcn.5baab971
mov edi, eax
test edi, edi
jl 0x5ba9055f
lea eax, [ebp - 0x120]
push eax
push 0
push 0
mov esi, 0x5ba4f1e0
push esi
push dword [ebp - 0x114]
call fcn.5ba57361
test eax, eax
je 0x5ba903a2
cmp eax, 2
je 0x5ba9053b
mov edi, 0x80004005
jmp 0x5ba9055f
push dword [ebp - 0x120]
lea eax, [ebp - 0x11c]
push eax
call fcn.5baaee23
mov edi, eax
test edi, edi
jl 0x5ba9055f
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x11c]
push 0
push esi
push dword [ebp - 0x114]
call fcn.5ba57361
test eax, eax
jne 0x5ba90398
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov ebx, 0x104
push ebx
push dword [ebp - 0x114]
lea eax, [ebp - 0x110]
push eax
call esi
push ebx
push 0x5ba4cc98
lea eax, [ebp - 0x110]
push eax
call sub.SHLWAPI.dll_StrCatBuffA
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x138], eax
mov eax, dword [ebp - 0x11c]
mov byte [ebp - 0xc], 0x30
mov byte [ebp - 0xb], 0x58
mov dword [ebp - 0x114], eax
cmp byte [eax], 0
je 0x5ba90535
mov eax, dword [ebp - 0x118]
test eax, eax
je 0x5ba90451
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
and dword [ebp - 0x118], 0
lea eax, [ebp - 0x118]
push eax
call fcn.5baae95c
mov edi, eax
test edi, edi
jl 0x5ba9055f
push 0x5ba4cc68
push dword [ebp - 0x114]
call sub.SHLWAPI.dll_StrStrA
mov edi, eax
test edi, edi
mov dword [ebp - 0x134], edi
je 0x5ba9048d
mov byte [edi], 0
inc edi
mov dword [ebp - 0x134], edi
mov eax, dword [ebp - 0x138]
mov ecx, ebx
sub ecx, eax
push ecx
push dword [ebp - 0x114]
lea eax, [ebp + eax - 0x110]
push eax
call esi
mov eax, dword [ebp - 0x118]
mov ecx, dword [eax]
lea edx, [ebp - 0x110]
push edx
push eax
call dword [ecx + 0x24]
test eax, eax
jl 0x5ba9050c
push 4
push dword [ebp - 0x114]
lea eax, [ebp - 0xa]
push eax
call esi
and dword [ebp - 0x128], 0
lea eax, [ebp - 0x128]
push eax
push 1
lea eax, [ebp - 0xc]
push eax
call sub.SHLWAPI.dll_StrToIntExA
push dword [ebp + 8]
mov ecx, dword [ebp - 0x130]
push dword [ebp - 0x118]
push dword [ebp - 0x128]
call fcn.5bab044b
mov edi, eax
test edi, edi
jl 0x5ba9055f
mov edi, dword [ebp - 0x134]
test edi, edi
jne 0x5ba90524
push dword [ebp - 0x114]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add dword [ebp - 0x114], eax
jmp 0x5ba9052a
mov dword [ebp - 0x114], edi
mov eax, dword [ebp - 0x114]
jmp 0x5ba90431
mov ebx, dword [ebp - 0x130]
xor edi, edi
cmp dword [ebp + 8], edi
jne 0x5ba90548
or dword [ebx + 8], 1
jmp 0x5ba9055f
cmp dword [ebp + 8], 1
jne 0x5ba90554
or dword [ebx + 8], 2
jmp 0x5ba9055f
or dword [ebx + 8], 0x10
jmp 0x5ba9055f
mov edi, 0x80070057
xor esi, esi
cmp dword [ebp - 0x11c], esi
je 0x5ba90580
mov eax, dword [0x5bb73714]
push dword [ebp - 0x11c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov dword [ebp - 0x11c], esi
mov eax, dword [ebp - 0x118]
cmp eax, esi
je 0x5ba90596
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 0x118], esi
cmp dword [ebp - 0x124], esi
je 0x5ba905aa
push dword [ebp - 0x124]
call dword [entry0]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
pop ebx
call fcn.5bb3f314
leave
ret 4