Function at 0x5e934
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x10
push 0
push 0
dec ecx
jne 0x5e93c
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5ee52
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x3c]
mov eax, 0x5ee60
call fcn.00031d88
lea edx, [ebp - 0xc]
mov eax, 0x5ee60
call fcn.00031d88
lea edx, [ebp - 0x34]
mov eax, 0x5ee60
call fcn.00031d88
lea edx, [ebp - 0x24]
mov eax, 0x5ee60
call fcn.00031d88
lea edx, [ebp - 0x14]
mov eax, 0x5ee60
call fcn.00031d88
lea edx, [ebp - 0x18]
mov eax, 0x5ee60
call fcn.00031d88
lea edx, [ebp - 0x20]
mov eax, 0x5ee60
call fcn.00031d88
mov eax, dword [ebp - 4]
call fcn.00013c3c
xor eax, eax
push ebp
push 0x5ed38
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x1c], eax
mov eax, 0x400
call fcn.00019220
mov dword [ebp - 0x38], eax
xor eax, eax
push ebp
push 0x5ed27
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0x20019
push eax
push 0
push 0
push 0
push 0x5ee64
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
cmp dword [ebp - 0x1c], 0
je 0x5ecfd
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 8]
push eax
mov ecx, 0x5ee94
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
call fcn.000189b4
test eax, eax
jne 0x5ea69
cmp dword [ebp - 0x30], 1
jne 0x5ea69
cmp dword [ebp - 8], 0
jbe 0x5ea69
mov eax, dword [ebp - 0x38]
call fcn.00018994
cmp eax, dword [ebp - 8]
jbe 0x5ea69
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0x38]
call fcn.0001899c
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 8]
push eax
mov ecx, 0x5eea0
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
call fcn.000189b4
test eax, eax
jne 0x5eab3
cmp dword [ebp - 0x30], 1
jne 0x5eab3
cmp dword [ebp - 8], 0
jbe 0x5eab3
mov eax, dword [ebp - 0x38]
call fcn.00018994
cmp eax, dword [ebp - 8]
jbe 0x5eab3
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 0x38]
call fcn.0001899c
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 8]
push eax
mov ecx, 0x5eeac
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
call fcn.000189b4
test eax, eax
jne 0x5eafd
cmp dword [ebp - 0x30], 1
jne 0x5eafd
cmp dword [ebp - 8], 0
jbe 0x5eafd
mov eax, dword [ebp - 0x38]
call fcn.00018994
cmp eax, dword [ebp - 8]
jbe 0x5eafd
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0x38]
call fcn.0001899c
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 8]
push eax
mov ecx, 0x5eec0
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
call fcn.000189b4
test eax, eax
jne 0x5eb47
cmp dword [ebp - 0x30], 1
jne 0x5eb47
cmp dword [ebp - 8], 0
jbe 0x5eb47
mov eax, dword [ebp - 0x38]
call fcn.00018994
cmp eax, dword [ebp - 8]
jbe 0x5eb47
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0x38]
call fcn.0001899c
mov dword [ebp - 8], 4
xor eax, eax
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x30]
push eax
push 0
push 0x5eed0
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x5ec69
cmp dword [ebp - 0x30], 4
jne 0x5ec69
cmp dword [ebp - 8], 4
jne 0x5ec69
mov eax, dword [ebp - 0x10]
mov ecx, 0x15180
xor edx, edx
div ecx
mov dword [ebp - 0x28], eax
imul eax, dword [ebp - 0x28], 0x15180
mov ebx, dword [ebp - 0x10]
sub ebx, eax
mov eax, ebx
mov ecx, 0xe10
xor edx, edx
div ecx
mov edi, eax
imul eax, edi, 0xe10
sub ebx, eax
mov eax, ebx
mov ecx, 0x3c
xor edx, edx
div ecx
mov esi, eax
imul eax, esi, 0x3c
sub ebx, eax
mov cx, 1
mov dx, 1
mov ax, 0x7b2
call fcn.0002cbc4
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x48], eax
xor eax, eax
mov dword [ebp - 0x44], eax
fild qword [ebp - 0x48]
faddp st(1)
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x40]
call fcn.0002f270
push dword [ebp - 0x40]
lea edx, [ebp - 0x4c]
mov eax, 0x5eedc
call fcn.00031d88
push dword [ebp - 0x4c]
lea edx, [ebp - 0x50]
mov eax, edi
call fcn.0002c174
push dword [ebp - 0x50]
lea edx, [ebp - 0x54]
mov eax, 0x5eee0
call fcn.00031d88
push dword [ebp - 0x54]
lea edx, [ebp - 0x58]
mov eax, esi
call fcn.0002c174
push dword [ebp - 0x58]
lea edx, [ebp - 0x5c]
mov eax, 0x5eee0
call fcn.00031d88
push dword [ebp - 0x5c]
lea edx, [ebp - 0x60]
mov eax, ebx
call fcn.0002c174
push dword [ebp - 0x60]
lea eax, [ebp - 0x3c]
mov edx, 7
call fcn.00013f8c
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 8]
push eax
mov ecx, 0x5eee4
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
call fcn.000189b4
test eax, eax
jne 0x5ecb3
cmp dword [ebp - 0x30], 1
jne 0x5ecb3
cmp dword [ebp - 8], 0
jbe 0x5ecb3
mov eax, dword [ebp - 0x38]
call fcn.00018994
cmp eax, dword [ebp - 8]
jbe 0x5ecb3
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 0x38]
call fcn.0001899c
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 8]
push eax
mov ecx, 0x5eef0
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
call fcn.000189b4
test eax, eax
jne 0x5ecfd
cmp dword [ebp - 0x30], 1
jne 0x5ecfd
cmp dword [ebp - 8], 0
jbe 0x5ecfd
mov eax, dword [ebp - 0x38]
call fcn.00018994
cmp eax, dword [ebp - 8]
jbe 0x5ecfd
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 0x38]
call fcn.0001899c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ed2e
cmp dword [ebp - 0x1c], 0
je 0x5ed19
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x38]
call fcn.00019230
ret