Function at 0x5b96b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x627840
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
test eax, eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 4], 0
je 0x5b9a77
mov ecx, dword [esi + 0x418]
test ecx, ecx
jne 0x5b96fd
push eax
mov ecx, esi
call fcn.005bd090
test al, al
je 0x5b9a77
mov edx, dword [esi + 0x108]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x5b9735
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push ecx
push edx
push 1
push eax
mov eax, dword [esi + 0x418]
push 0x6e0828
push eax
call ebx
jmp 0x5b973b
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esi + 0x10c]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x5b976b
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esi + 0x418]
push edx
push 1
push eax
push 0x6e0820
push ecx
call ebx
mov edx, dword [esi + 0x110]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x5b979b
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esi + 0x418]
push 1
push eax
push 0x6e0814
push edx
call ebx
mov edx, dword [esi + 0x114]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x5b97cb
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 1
push eax
mov eax, dword [esi + 0x418]
push 0x6e0808
push eax
call ebx
mov edx, dword [esi + 0x118]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x5b97f4
mov ecx, dword [esi + 0x418]
push edx
push 0x6e07fc
push ecx
call fcn.005aa580
add esp, 0xc
mov edx, dword [esi + 0xc8]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x5b9824
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esi + 0x418]
push 1
push eax
push 0x6e07f4
push edx
call ebx
mov edx, dword [esi + 0x138]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x5b9854
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 1
push eax
mov eax, dword [esi + 0x418]
push 0x6e07ec
push eax
call ebx
mov edx, dword [esi + 0x13c]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x5b9884
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esi + 0x418]
push edx
push 1
push eax
push 0x6e07e4
push ecx
call ebx
mov edx, dword [esi + 0x140]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x5b98b4
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esi + 0x418]
push 1
push eax
push 0x6e07dc
push edx
call ebx
mov edx, dword [esi + 0x144]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x5b98dd
mov eax, dword [esi + 0x418]
push edx
push 0x6e07d4
push eax
call fcn.005aa580
add esp, 0xc
mov edx, dword [esi + 0x148]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x5b990d
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esi + 0x418]
push edx
push 1
push eax
push 0x6e07cc
push ecx
call ebx
mov edx, dword [esi + 0x120]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x5b993d
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esi + 0x418]
push 1
push eax
push 0x6e07c4
push edx
call ebx
mov ecx, dword [esi + 0x12c]
lea eax, [esi + 0x128]
test ecx, ecx
jl 0x5b9969
jg 0x5b9954
cmp dword [eax], 0
jbe 0x5b9969
push 8
push eax
mov eax, dword [esi + 0x418]
push 0
push 0
push 0x6e07b8
push eax
call ebx
mov edx, dword [esi + 0x338]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x5b9999
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esi + 0x418]
push edx
push 1
push eax
push 0x6e07b0
push ecx
call ebx
mov edx, dword [esi + 0x33c]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x5b99c9
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esi + 0x418]
push 1
push eax
push 0x6e07a8
push edx
call ebx
mov edx, dword [esi + 0x340]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x5b99f9
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push 1
push eax
mov eax, dword [esi + 0x418]
push 0x6e07a0
push eax
call ebx
mov edx, dword [esi + 0x344]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x5b9a29
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esi + 0x418]
push edx
push 1
push eax
push 0x6e0794
push ecx
call ebx
mov al, byte [esi + 0x164]
test al, al
je 0x5b9a52
mov eax, dword [esi + 0x418]
lea edx, [ebp + 8]
push 4
push edx
push 4
push 0
push 0x6e078c
push eax
mov dword [ebp + 8], 1
call ebx
mov ecx, dword [esi + 0x130]
lea eax, [esi + 0x130]
test ecx, ecx
jle 0x5b9a77
mov ecx, dword [esi + 0x418]
push 4
push eax
push 0
push 0
push 0x6e0784
push ecx
call ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4