Function at 0x5d1070
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0xb1c]
sub esp, 0xb1c
push 0xfffffffffffffffe
push 0x6756d8
push 0x5dfbd0
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x6aae14]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0xb18], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 0xb24]
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp + 0xb30]
mov dword [ebp - 0x4c], ecx
mov edx, dword [ebp + 0xb34]
mov dword [ebp - 0x44], edx
mov eax, dword [ebp + 0xb38]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp + 0xb40]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp + 0xb44]
mov dword [ebp - 0x60], edx
mov edi, dword [ebp + 0xb48]
mov dword [ebp - 0x24], edi
mov eax, dword [ebp + 0xb50]
mov dword [ebp - 0x58], eax
mov ecx, dword [ebp + 0xb54]
mov dword [ebp - 0x64], ecx
mov edx, dword [ebp + 0xb58]
mov dword [ebp - 0x54], edx
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x50], ebx
xor esi, esi
mov byte [ebp + 0xa08], bl
push 0x103
push ebx
lea eax, [ebp + 0xa09]
push eax
call fcn.005dfd60
add esp, 0xc
inc dword [0x765ef4]
cmp edi, ebx
jne 0x5d1313
push ebx
push 1
push str._MMC__SetServerForClients___Started...
push 0x6aec98
call fcn.004311c0
add esp, 0x10
cmp dword [ebp + 0xb28], ebx
je 0x5d1175
push str._MMC__SetServerForClients___Started...
push ebx
call fcn.004f0f30
add esp, 8
cmp dword [0x6b0554], ebx
jne 0x5d11f6
push 0x762998
push 0x762890
push 1
call fcn.0050ffd0
mov dword [0x6b0554], eax
cmp eax, ebx
jne 0x5d11c9
push ebx
push 1
push str._MMC__SetServerForClients___Finished._LoadLibrary_Failed_
push 0x6aec98
call fcn.004311c0
add esp, 0x10
cmp dword [ebp + 0xb28], ebx
je 0x5d11c2
push str._MMC__SetServerForClients___Finished._LoadLibrary_Failed_
push ebx
call fcn.004f0f30
add esp, 8
xor eax, eax
jmp 0x5d1a43
push str.SendFileToAgent
push eax
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call esi
mov dword [0x762364], eax
push str.SendFileToAgentEx
mov ecx, dword [0x6b0554]
push ecx
call esi
mov dword [0x76246c], eax
mov esi, 1
jmp 0x5d120f
cmp byte [0x762998], bl
jne 0x5d120f
push 0x762998
push 0x762890
push 1
call fcn.0050ffd0
cmp dword [0x762574], ebx
jne 0x5d12a5
mov dword [0x762574], 1
cmp byte [0x762998], bl
je 0x5d12a5
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x34], ebx
mov edx, dword [str.4.0.0.449]
mov dword [ebp + 0xb0c], edx
mov eax, dword [0x6658a8]
mov dword [ebp + 0xb10], eax
mov cx, word [0x6658ac]
mov word [ebp + 0xb14], cx
lea edx, [ebp - 0x20]
push edx
lea eax, [ebp - 0x28]
push eax
push 0x762998
call fcn.004eb670
lea ecx, [ebp - 0x34]
push ecx
lea edx, [ebp - 0x2c]
push edx
lea eax, [ebp + 0xb0c]
push eax
call fcn.004eb670
add esp, 0x18
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
cmp eax, ecx
ja 0x5d129b
jne 0x5d12a5
mov ecx, dword [ebp - 0x20]
cmp ecx, dword [ebp - 0x34]
jb 0x5d12a5
mov dword [0x76267c], 1
mov eax, dword [0x762364]
cmp eax, ebx
jne 0x5d12e4
push ebx
push 1
push str._MMC__GetProcAddress_Failed_
push 0x6aec98
call fcn.004311c0
add esp, 0x10
cmp dword [ebp + 0xb28], ebx
je 0x5d11c2
push str._MMC__GetProcAddress_Failed_
push ebx
call fcn.004f0f30
add esp, 8
xor eax, eax
jmp 0x5d1a43
cmp esi, ebx
je 0x5d12ee
push ebx
push ebx
push ebx
push ebx
call eax
mov eax, dword [ebp - 0x4c]
cmp eax, ebx
je 0x5d12f7
mov dword [eax], ebx
mov eax, dword [ebp - 0x44]
cmp eax, ebx
je 0x5d1300
mov dword [eax], ebx
mov eax, dword [ebp - 0x3c]
cmp eax, ebx
je 0x5d1309
mov dword [eax], ebx
cmp dword [ebp - 0x30], ebx
je 0x5d1313
mov edx, dword [ebp - 0x30]
mov dword [edx], ebx
cmp byte [0x765df0], bl
jne 0x5d133c
push str.SOFTWAREMicroWorldeScan_for_WindowsMMCMon
push 0x765df0
call fcn.005dfb23
push str.SOFTWAREMicroWorldeScan_for_WindowsManagementConsoleMMCManaged_Computers
push 0x765ce8
call fcn.005dfb23
add esp, 0x10
cmp edi, ebx
je 0x5d1360
cmp byte [edi], bl
je 0x5d1360
push edi
push 0x765ce8
push 0x612438
lea eax, [ebp + 0xa08]
push eax
call fcn.005dfb23
add esp, 0x10
jmp 0x5d1379
push 0x765ce8
push 0x60c800
lea ecx, [ebp + 0xa08]
push ecx
call fcn.005dfb23
add esp, 0xc
lea edx, [ebp - 0x40]
push edx
push str.ForceSendCommand
push 0x765ce8
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
cmp dword [ebp - 0x40], ebx
je 0x5d13aa
push str.ForceSendCommand
push 0x765ce8
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004e9430
mov edi, dword [ebp + 0xb2c]
xor eax, eax
cmp edi, 1
jne 0x5d13e2
jmp 0x5d13c0
mov cl, byte [ebp + eax + 0xa08]
mov byte [eax + 0x765be0], cl
inc eax
cmp cl, bl
jne 0x5d13c0
lea eax, [ebp - 0x1c]
push eax
push 9
push ebx
lea ecx, [ebp + 0xa08]
push ecx
jmp 0x5d13ff
mov cl, byte [eax + 0x765df0]
mov byte [eax + 0x765be0], cl
inc eax
cmp cl, bl
jne 0x5d13e2
lea edx, [ebp - 0x1c]
push edx
push 9
push ebx
push 0x765df0
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004dc0a0
mov esi, eax
add esp, 0x14
cmp esi, ebx
jne 0x5d1964
mov dword [ebp - 0x28], ebx
mov byte [ebp + 0x400], bl
mov dword [ebp - 0x2c], 0x400
lea eax, [ebp + 0xb0c]
push eax
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp + 0x400]
push edx
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov edi, dword [ebp + 0xb4c]
cmp eax, ebx
jne 0x5d186c
mov dword [ebp - 0x20], 1
jmp 0x5d1460
cmp dword [ebp + 0xb28], ebx
je 0x5d14b8
push str._MMC__
push ebx
call fcn.004f0f30
add esp, 8
mov esi, dword [ebp - 0x24]
cmp esi, ebx
je 0x5d149d
cmp byte [esi], bl
je 0x5d149d
lea ecx, [ebp + 0x400]
push ecx
push esi
mov edx, dword [ebp - 0x20]
push edx
push str._MMC__GroupName__u_:__s_s
push ebx
call fcn.004f0f30
add esp, 0x14
jmp 0x5d14bb
lea eax, [ebp + 0x400]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
push str._MMC__GroupName__u_:__s
push ebx
call fcn.004f0f30
add esp, 0x10
jmp 0x5d14bb
mov esi, dword [ebp - 0x24]
push str.Group_Tasks
lea edx, [ebp + 0x400]
push edx
call fcn.005f095a
add esp, 8
test eax, eax
je 0x5d17f0
push str.Policies
lea eax, [ebp + 0x400]
push eax
call fcn.005f095a
add esp, 8
test eax, eax
je 0x5d17f0
push str.Criteria
lea ecx, [ebp + 0x400]
push ecx
call fcn.005f095a
add esp, 8
test eax, eax
je 0x5d17f0
push str.Administrator_Servers
lea edx, [ebp + 0x400]
push edx
call fcn.005f095a
add esp, 8
test eax, eax
je 0x5d17f0
cmp byte [ebp + 0x400], bl
je 0x5d17f0
mov dword [ebp - 0x38], ebx
lea eax, [ebp - 0x38]
push eax
push 9
push ebx
lea ecx, [ebp + 0x400]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call fcn.004dc0a0
add esp, 0x14
mov esi, eax
cmp esi, ebx
jne 0x5d17ab
mov byte [ebp], bl
push 0x3ff
push ebx
lea eax, [ebp + 1]
push eax
call fcn.005dfd60
add esp, 0xc
mov dword [ebp - 0x34], 0x400
lea ecx, [ebp - 0x34]
push ecx
lea edx, [ebp]
push edx
push ebx
push ebx
push ebx
mov eax, dword [ebp - 0x38]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 0x38]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp + 0xb2c], 1
jne 0x5d1671
push 0x64f600
lea edx, [ebp + 0x400]
push edx
call fcn.005f095a
add esp, 8
test eax, eax
je 0x5d1671
cmp byte [ebp], bl
je 0x5d1757
push str.Group
lea eax, [ebp]
push eax
call fcn.005f095a
add esp, 8
test eax, eax
jne 0x5d1757
mov eax, dword [ebp - 0x24]
cmp eax, ebx
je 0x5d160d
cmp byte [eax], bl
je 0x5d160d
lea ecx, [ebp + 0x400]
push ecx
push eax
push 0x612438
lea edx, [ebp + 0x800]
push edx
call fcn.005dfb23
add esp, 0x10
jmp 0x5d1628
lea eax, [ebp + 0x400]
push eax
push 0x60c800
lea ecx, [ebp + 0x800]
push ecx
call fcn.005dfb23
add esp, 0xc
mov edx, dword [ebp - 0x54]
push edx
mov eax, dword [ebp - 0x64]
push eax
mov ecx, dword [ebp - 0x58]
push ecx
push edi
lea edx, [ebp + 0x800]
push edx
mov eax, dword [ebp - 0x60]
push eax
mov ecx, dword [ebp - 0x30]
push ecx
mov edx, dword [ebp + 0xb3c]
push edx
mov eax, dword [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 0x44]
push ecx
mov edx, dword [ebp - 0x4c]
push edx
push 1
mov eax, dword [ebp + 0xb28]
push eax
mov ecx, dword [ebp - 0x48]
push ecx
call fcn.005d1070
add esp, 0x38
jmp 0x5d182d
mov esi, dword [ebp - 0x24]
cmp dword [ebp + 0xb28], ebx
je 0x5d16b1
cmp esi, ebx
je 0x5d169c
cmp byte [esi], bl
je 0x5d169c
lea edx, [ebp + 0x400]
push edx
push esi
push str._MMC__Processing_Group_B_:__s_s
push ebx
call fcn.004f0f30
add esp, 0x10
jmp 0x5d16b1
lea eax, [ebp + 0x400]
push eax
push str._MMC__Processing_Group_C_:__s
push ebx
call fcn.004f0f30
add esp, 0xc
cmp esi, ebx
je 0x5d16d7
cmp byte [esi], bl
je 0x5d16d7
lea ecx, [ebp + 0x400]
push ecx
push esi
push 0x612438
lea edx, [ebp + 0x800]
push edx
call fcn.005dfb23
add esp, 0x10
jmp 0x5d16f2
lea eax, [ebp + 0x400]
push eax
push 0x60c800
lea ecx, [ebp + 0x800]
push ecx
call fcn.005dfb23
add esp, 0xc
mov edx, dword [0x765ef4]
push edx
mov eax, dword [ebp - 0x54]
push eax
mov ecx, dword [ebp - 0x64]
push ecx
mov edx, dword [ebp - 0x58]
push edx
push edi
push ebx
mov eax, dword [ebp - 0x60]
push eax
mov ecx, dword [ebp - 0x30]
push ecx
mov esi, dword [ebp - 0x50]
push esi
mov edx, dword [ebp + 0xb3c]
push edx
mov eax, dword [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 0x44]
push ecx
mov edx, dword [ebp - 0x4c]
push edx
mov eax, dword [ebp + 0xb2c]
push eax
mov ecx, dword [ebp + 0xb28]
push ecx
mov edx, dword [ebp - 0x40]
push edx
lea eax, [ebp + 0x800]
push eax
mov ecx, dword [ebp - 0x48]
push ecx
call fcn.005ce680
add esp, 0x48
or dword [ebp - 0x5c], eax
inc esi
mov dword [ebp - 0x50], esi
jmp 0x5d182d
cmp dword [ebp + 0xb28], ebx
je 0x5d182d
mov eax, dword [ebp - 0x24]
cmp eax, ebx
je 0x5d178d
cmp byte [eax], bl
je 0x5d178d
lea edx, [ebp]
push edx
lea ecx, [ebp + 0x400]
push ecx
push eax
push str._MMC__Ignoring_B___s_s__Def__s_
push ebx
call fcn.004f0f30
add esp, 0x14
jmp 0x5d182d
lea edx, [ebp]
push edx
lea eax, [ebp + 0x400]
push eax
push str._MMC__Ignoring_B___s__Def__s_
push ebx
call fcn.004f0f30
add esp, 0x10
jmp 0x5d182d
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [ebp + 0xb28], ebx
je 0x5d182d
push esi
cmp dword [ebp + 0xb2c], 1
jne 0x5d17db
lea ecx, [ebp + 0xa08]
push ecx
push str._MMC__Unable_to_open_key_B___s__LastError:__d
push ebx
call fcn.004f0f30
add esp, 0x10
jmp 0x5d182d
push 0x765df0
push str._MMC__Unable_to_open_key_B___s__LastError:__d
push ebx
call fcn.004f0f30
add esp, 0x10
jmp 0x5d182d
cmp dword [ebp + 0xb28], ebx
je 0x5d182d
cmp esi, ebx
je 0x5d1818
cmp byte [esi], bl
je 0x5d1818
lea edx, [ebp + 0x400]
push edx
push esi
push str._MMC__Ignoring_A___s_s_
push ebx
call fcn.004f0f30
add esp, 0x10
jmp 0x5d182d
lea eax, [ebp + 0x400]
push eax
push str._MMC__Ignoring_A___s_
push ebx
call fcn.004f0f30
add esp, 0xc
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
inc dword [ebp - 0x20]
mov byte [ebp + 0x400], bl
mov dword [ebp - 0x2c], 0x400
lea ecx, [ebp + 0xb0c]
push ecx
push ebx
push ebx
push ebx
lea edx, [ebp - 0x2c]
push edx
lea ecx, [ebp + 0x400]
push ecx
push eax
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, ebx
je 0x5d1460
cmp dword [ebp - 0x28], ebx
jne 0x5d1995
cmp dword [ebp + 0xb28], ebx
je 0x5d18a2
cmp dword [ebp + 0xb2c], 1
jne 0x5d188f
lea eax, [ebp + 0xa08]
push eax
jmp 0x5d1894
push 0x765df0
push str._MMC__Nothing_present_under__s_
push ebx
call fcn.004f0f30
add esp, 0xc
cmp dword [ebp + 0xb2c], 1
jne 0x5d1995
mov ecx, dword [str.EScanDummy]
mov dword [ebp + 0x904], ecx
mov edx, dword [0x6656f0]
mov dword [ebp + 0x908], edx
mov ax, word [0x6656f4]
mov word [ebp + 0x90c], ax
mov cl, byte [0x6656f6]
mov byte [ebp + 0x90e], cl
push 0xf9
push ebx
lea edx, [ebp + 0x90f]
push edx
call fcn.005dfd60
add esp, 0xc
mov esi, dword [ebp + 0xb28]
cmp esi, ebx
je 0x5d1914
lea eax, [ebp + 0x904]
push eax
push str._MMC__Processing_Group_A_:__s
push ebx
call fcn.004f0f30
add esp, 0xc
mov ecx, dword [0x765ef4]
push ecx
mov edx, dword [ebp - 0x54]
push edx
mov eax, dword [ebp - 0x64]
push eax
mov ecx, dword [ebp - 0x58]
push ecx
push edi
push ebx
mov edx, dword [ebp - 0x60]
push edx
mov eax, dword [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x50]
push ecx
mov edx, dword [ebp + 0xb3c]
push edx
mov eax, dword [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 0x44]
push ecx
mov edx, dword [ebp - 0x4c]
push edx
push 1
push esi
mov eax, dword [ebp - 0x40]
push eax
lea ecx, [ebp + 0x904]
push ecx
mov edx, dword [ebp - 0x48]
push edx
call fcn.005ce680
add esp, 0x48
jmp 0x5d1995
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [ebp + 0xb28], ebx
je 0x5d1995
push esi
cmp edi, 1
jne 0x5d1982
lea eax, [ebp + 0xa08]
push eax
jmp 0x5d1987
push 0x765df0
push str._MMC__Unable_to_open_key_A___s__LastError:__d
push ebx
call fcn.004f0f30
add esp, 0x10
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
je 0x5d19a6
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x24], ebx
jne 0x5d1a15
cmp dword [0x762360], ebx
jne 0x5d1a15
mov dword [ebp - 4], ebx
mov esi, dword [ebp + 0xb28]
cmp esi, ebx
je 0x5d19ce
push str._MMC__Calling_ProcessClientComputers_for_INI_Validation.
push ebx
call fcn.004f0f30
add esp, 8
mov ecx, dword [0x765ef4]
push ecx
push ebx
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 1
push esi
push ebx
push ebx
mov edx, dword [ebp - 0x48]
push edx
call fcn.005ce680
add esp, 0x48
jmp 0x5d1a0e
mov dword [ebp - 4], 0xfffffffe
push ebx
push 1
push str._MMC__SetServerForClients___Finished.
push 0x6aec98
call fcn.004311c0
add esp, 0x10
cmp dword [ebp + 0xb28], ebx
je 0x5d1a40
push str._MMC__SetServerForClients___Finished.
push ebx
call fcn.004f0f30
add esp, 8
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xb18]
xor ecx, ebp
call fcn.005dfbbe
add ebp, 0xb1c
mov esp, ebp
pop ebp
ret