Function at 0x5363c4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x54
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x536901
cmp word [ebx], 0
je 0x536901
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x536901
cmp word [eax], 0
je 0x536901
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x536901
cmp word [eax], 0
je 0x536901
push 0x80
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x53642e
call fcn.0055fcf7
push 0x4a
push 0x5c4378
push edi
mov esi, 0x80
call fcn.0055fcbe
mov eax, dword [ebx - 4]
add esp, 0xc
cdq
sub eax, edx
mov dword [esp + 0x10], 0x4a
sar eax, 1
add eax, eax
mov dword [esp + 0x20], eax
je 0x5364e7
lea ecx, [eax + 0x4a]
mov dword [esp + 0x10], ecx
cmp ecx, esi
jbe 0x5364d9
mov eax, ecx
mov esi, ecx
and eax, 0x7f
sub esi, eax
add esi, 0x80
jne 0x536481
mov dword [esp + 0x18], esi
jmp 0x536499
push esi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x18], eax
test eax, eax
jne 0x53649e
call fcn.0055fcf7
cmp esi, 0x80
jae 0x5364ab
call fcn.0055fcf7
push 0x80
push edi
push dword [esp + 0x20]
call fcn.0055fcbe
add esp, 0xc
test edi, edi
je 0x5364d1
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
push eax
lea eax, [edi + 0x4a]
push ebx
push eax
call fcn.0055fcbe
add esp, 0xc
mov eax, dword [esp + 0x10]
lea ebx, [eax + 2]
mov dword [esp + 0x20], ebx
cmp ebx, esi
jbe 0x53656a
mov eax, ebx
and eax, 0x7f
sub ebx, eax
add ebx, 0x80
jne 0x53650b
mov dword [esp + 0x18], ebx
jmp 0x536523
push ebx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x18], eax
test eax, eax
jne 0x536528
call fcn.0055fcf7
cmp esi, ebx
jbe 0x536531
call fcn.0055fcf7
test esi, esi
je 0x536546
push esi
mov esi, dword [esp + 0x1c]
push edi
push esi
call fcn.0055fcbe
add esp, 0xc
jmp 0x53654a
mov esi, dword [esp + 0x18]
test edi, edi
je 0x53655e
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x10]
mov edi, esi
mov esi, ebx
mov ebx, dword [esp + 0x20]
push 2
add eax, edi
push 0x5c4374
push eax
call fcn.0055fcbe
mov eax, dword [ebp + 0xc]
add esp, 0xc
mov eax, dword [eax - 4]
cdq
sub eax, edx
sar eax, 1
lea eax, [eax*2 + 2]
mov dword [esp + 0x20], eax
test eax, eax
je 0x536624
add ebx, eax
cmp ebx, esi
jbe 0x53660e
mov eax, ebx
and eax, 0x7f
sub ebx, eax
add ebx, 0x80
jne 0x5365b5
mov dword [esp + 0x18], ebx
jmp 0x5365cd
push ebx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x18], eax
test eax, eax
jne 0x5365d2
call fcn.0055fcf7
cmp esi, ebx
jbe 0x5365db
call fcn.0055fcf7
test esi, esi
je 0x5365f0
push esi
mov esi, dword [esp + 0x1c]
push edi
push esi
call fcn.0055fcbe
add esp, 0xc
jmp 0x5365f4
mov esi, dword [esp + 0x18]
test edi, edi
je 0x536608
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x20]
mov edi, esi
push eax
mov eax, dword [esp + 0x14]
push dword [ebp + 0xc]
add eax, 2
add eax, edi
push eax
call fcn.0055fcbe
add esp, 0xc
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0
push eax
push edi
push SysReAllocStringLen
mov dword [esp + 0x28], 0
mov dword [esp + 0x20], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x53667c
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x14]
push eax
push 0
lea eax, [esp + 0x24]
push eax
push 0
push dword [ebp + 0x10]
push dword [esp + 0x20]
call ebx
test eax, eax
je 0x5366ba
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp + 0x14]
lea ecx, [ebp + 0x14]
xor eax, eax
mov byte [esp + 0x58], 0
mov word [esp + 0x38], ax
mov word [esp + 0x48], ax
cmp dx, 8
jne 0x536746
mov ebx, dword [ebp + 0x24]
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0x34], eax
mov dword [esp + 0x59], 0
mov dword [ebx], 0
jmp 0x5368ac
cmp dword [esp + 0x1c], 1
je 0x5366d5
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 0x80004005
jmp 0x5368e2
mov eax, dword [esp + 0x14]
cmp eax, 2
jbe 0x536735
add eax, 0xfffffffe
push eax
push 0
call dword [sym.imp.OLEAUT32.dll_DllRegisterServer]
mov esi, eax
lea eax, [esp + 0x14]
push eax
push esi
lea eax, [esp + 0x24]
push eax
push 0
push dword [ebp + 0x10]
push dword [esp + 0x20]
call ebx
test eax, eax
je 0x536721
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 0x8000ffff
jmp 0x5368e2
mov eax, dword [esp + 0x14]
add eax, 0xfffffffe
shr eax, 1
xor ecx, ecx
mov word [esi + eax*2], cx
mov eax, dword [ebp + 0x24]
mov dword [eax], esi
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
jmp 0x5368e2
mov eax, 0x4008
cmp dx, ax
jne 0x53676f
mov eax, dword [ebp + 0x1c]
mov ebx, dword [ebp + 0x24]
mov eax, dword [eax]
mov dword [esp + 0x34], eax
mov dword [esp + 0x59], 0
mov dword [ebx], 0
jmp 0x5368ac
mov ebx, dword [ebp + 0x1c]
xor eax, eax
mov dword [esp + 0x34], eax
cmp dx, 0xa
jne 0x5367a1
cmp ebx, 0x80020004
jne 0x5367a1
mov eax, dword [ebp + 0x24]
mov byte [esp + 0x58], 1
mov dword [esp + 0x59], 0x80020005
mov dword [eax], 0
jmp 0x5368bc
cmp dx, 9
je 0x5367b9
movzx esi, dx
mov dword [esp + 0x20], 0x4009
cmp si, word [esp + 0x20]
jne 0x536817
test edx, 0x4000
je 0x5367c3
mov ebx, dword [ebx]
test ebx, ebx
je 0x53688f
push 0
push 0
lea ecx, [esp + 0x40]
xor eax, eax
push ecx
lea ecx, [esp + 0x30]
mov dword [esp + 0x30], eax
push ecx
push 3
push 0
push 0x5c0a38
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov eax, dword [ebx]
push 0
push ebx
call dword [eax + 0x18]
mov esi, eax
mov dword [esp + 0x59], esi
test esi, esi
js 0x536889
movzx esi, word [esp + 0x38]
lea ecx, [esp + 0x38]
mov eax, dword [esp + 0x34]
mov edx, 0x4008
cmp si, dx
jne 0x53682e
mov eax, dword [ecx + 8]
xor esi, esi
mov eax, dword [eax]
mov dword [esp + 0x34], eax
jmp 0x536894
cmp si, 8
jne 0x53683f
mov eax, dword [ecx + 8]
xor esi, esi
mov dword [esp + 0x34], eax
jmp 0x536894
cmp si, 1
jne 0x53684c
mov esi, 0x800a005e
jmp 0x536894
mov eax, 0x400c
cmp si, ax
jne 0x53685e
mov ecx, dword [ecx + 8]
cmp word [ecx], ax
je 0x536856
push 8
push 2
push 0x400
push ecx
lea eax, [esp + 0x58]
push eax
call dword [sym.imp.OLEAUT32.dll_SafeArrayPtrOfIndex]
mov esi, eax
mov dword [esp + 0x59], esi
test esi, esi
js 0x536889
mov eax, dword [esp + 0x50]
xor esi, esi
mov dword [esp + 0x34], eax
jmp 0x536894
mov eax, dword [esp + 0x34]
jmp 0x536898
mov esi, 0x800a005b
mov dword [esp + 0x59], esi
cmp byte [esp + 0x58], 0
mov ebx, dword [ebp + 0x24]
mov dword [ebx], 0
jne 0x5368bc
test esi, esi
js 0x5368be
test eax, eax
je 0x5368bc
push dword [eax - 4]
push eax
call dword [sym.imp.OLEAUT32.dll_DllRegisterServer]
mov dword [ebx], eax
xor esi, esi
cmp word [esp + 0x38], 0
mov ebx, dword [sym.imp.OLEAUT32.dll_VariantCopy]
je 0x5368d3
lea eax, [esp + 0x38]
push eax
call ebx
cmp word [esp + 0x48], 0
je 0x5368e2
lea eax, [esp + 0x48]
push eax
call ebx
test edi, edi
je 0x5368f6
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
pop edi
pop esi
mov eax, 0x80004005
pop ebx
mov esp, ebp
pop ebp
ret 0x20