Function at 0x5b8aa0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x62f7b6
push eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], esp
sub esp, 8
mov dword [0x6fe9c0], eax
mov dword [0x6fe968], ecx
push ebx
push ebp
push esi
xor esi, esi
push edi
mov dword [0x6fe85c], esi
mov dword [0x6fe82c], esi
mov dword [0x6fe9f8], esi
mov dword [0x6fe824], esi
mov dword [0x6fea04], esi
mov dword [0x6fe9c8], esi
mov dword [0x6fe888], esi
mov dword [0x6fe9b4], esi
mov dword [0x6fe898], esi
mov dword [0x6fe89c], esi
mov dword [0x6fe798], esi
mov dword [0x6fe9b8], esi
mov dword [0x6fe990], esi
mov dword [0x6fe994], esi
mov dword [0x6fe7a4], esi
mov dword [0x6fe88c], esi
mov dword [0x6fe7e0], esi
mov dword [0x6fe7e4], esi
mov dword [0x6fe828], esi
mov dword [0x6fe788], esi
mov dword [0x6fe820], esi
mov dword [0x6fe8f8], esi
mov dword [0x6fe8fc], esi
mov dword [0x6fe9d4], esi
mov dword [0x6fe9bc], esi
mov dword [0x6fea08], esi
mov dword [0x6fea0c], esi
mov dword [0x6fe8bc], esi
mov dword [0x6fe9c4], esi
mov dword [0x6fe890], esi
mov dword [0x6fe970], esi
mov dword [0x6fe974], esi
mov dword [0x6fe860], esi
mov dword [0x6fe9f4], esi
mov dword [0x6fe868], esi
mov dword [0x6fe86c], esi
mov dword [0x6fe7dc], esi
mov dword [0x6fe920], esi
mov dword [0x6fe9b0], esi
mov dword [0x6fe800], esi
mov dword [0x6fe804], esi
mov dword [0x6fea2c], esi
mov dword [0x6fe930], esi
mov dword [0x6fe838], esi
mov dword [0x6fe83c], esi
mov dword [0x6fe8f0], esi
mov dword [0x6fe790], esi
mov dword [0x6fe7ac], esi
mov dword [0x6fe7b8], esi
mov dword [0x6fe7bc], esi
mov dword [0x6fe9d8], esi
mov dword [0x6fe8c4], esi
mov dword [0x6fe91c], esi
mov dword [0x6fe8d0], esi
mov dword [0x6fe8d4], esi
mov dword [0x6fe7d8], esi
mov dword [0x6fe9fc], esi
mov dword [0x6fe938], esi
mov dword [0x6fe93c], esi
mov dword [0x6fe830], esi
mov edx, dword [ecx]
push 1
push 0x6e7ce8
call dword [edx + 0x10]
mov dword [0x6fe85c], eax
cmp eax, esi
jne 0x5b8c72
mov ecx, dword [0x6fe968]
push esi
push 0x6e7ce8
push 0x6e7ce8
mov eax, dword [ecx]
call dword [eax + 0xc]
mov dword [0x6fe85c], eax
mov edx, dword [eax]
push 1
mov ecx, eax
call dword [edx + 0x18]
mov eax, dword [0x6fe9c0]
mov edi, dword [sym.imp.USER32.dll_LoadImageA]
push esi
push esi
push esi
push 2
push 0x1773
push eax
call edi
mov ecx, dword [0x6fe9c0]
push esi
push esi
push esi
push 2
push 0x1770
push ecx
mov dword [0x6fe9f8], eax
call edi
mov edx, dword [0x6fe9c0]
push esi
push esi
push esi
push 2
push 0x1771
push edx
mov dword [0x6fe824], eax
call edi
push esi
push esi
mov dword [0x6fea04], eax
mov eax, dword [0x6fe9c0]
push esi
push 2
push 0x1772
push eax
call edi
mov dword [0x6fe9c8], eax
call fcn.00606265
mov ebx, dword [eax + 0xc]
mov ebp, dword [0x6fe9c0]
call fcn.00606265
push 0x177c
mov ecx, 0x6fe958
mov dword [eax + 0xc], ebp
call fcn.005eb614
push 0x177d
mov ecx, 0x6fe784
call fcn.005eb614
push 0x177e
mov ecx, 0x6fe9d0
call fcn.005eb614
push 0x177f
mov ecx, 0x6fe8c0
call fcn.005eb614
push 0x1780
mov ecx, 0x6fe780
call fcn.005eb614
push 0x1781
mov ecx, 0x6fe95c
call fcn.005eb614
push 0x1782
mov ecx, 0x6fe7a0
call fcn.005eb614
push 0x1783
mov ecx, 0x6fe8c8
call fcn.005eb614
push 0x1784
mov ecx, 0x6fe7a8
call fcn.005eb614
push 0x1785
mov ecx, 0x6fe960
call fcn.005eb614
push 0x1786
mov ecx, 0x6fe9cc
call fcn.005eb614
push 0x1787
mov ecx, 0x6fe9dc
call fcn.005eb614
push 0x1788
mov ecx, 0x6fe834
call fcn.005eb614
push 0x1789
mov ecx, 0x6fea00
call fcn.005eb614
push 0x178a
mov ecx, 0x6fe964
call fcn.005eb614
push 0x178b
mov ecx, 0x6fe858
call fcn.005eb614
push 0x178c
mov ecx, 0x6fe924
call fcn.005eb614
push 0x178d
mov ecx, 0x6fea28
call fcn.005eb614
push 0x178e
mov ecx, 0x6fe8b8
call fcn.005eb614
push 0x178f
mov ecx, 0x6fe7b0
call fcn.005eb614
push 0x1790
mov ecx, 0x6fe918
call fcn.005eb614
push 0x1791
mov ecx, 0x6fe928
call fcn.005eb614
push 0x1792
mov ecx, 0x6fe864
call fcn.005eb614
push 0x1793
mov ecx, 0x6fe92c
call fcn.005eb614
call fcn.00606265
push 0x7c
mov dword [eax + 0xc], ebx
call fcn.005e6fe9
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, esi
mov dword [esp + 0x20], esi
je 0x5b8e7b
mov ecx, eax
call fcn.005c6470
jmp 0x5b8e7d
xor eax, eax
mov ecx, dword [0x6fe968]
mov dword [0x6fe888], eax
or ebx, 0xffffffff
push eax
mov edx, dword [ecx]
mov dword [esp + 0x24], ebx
call dword [edx + 0x18]
push 0x28
call fcn.005e6fe9
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, esi
mov dword [esp + 0x20], 1
je 0x5b8eb8
mov ecx, eax
call fcn.005c5e80
jmp 0x5b8eba
xor eax, eax
mov ecx, dword [0x6fe968]
mov dword [0x6fe9b4], eax
push eax
mov dword [esp + 0x24], ebx
mov edx, dword [ecx]
call dword [edx + 0x14]
mov eax, dword [0x6fe9c0]
push esi
push esi
push esi
push esi
push 0x1774
push eax
call edi
cmp eax, esi
mov dword [0x6fe898], eax
jne 0x5b8efe
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov ecx, dword [0x6fe9c0]
push esi
push esi
push esi
push esi
push 0x1775
push ecx
call edi
cmp eax, esi
mov dword [0x6fe89c], eax
jne 0x5b8f2e
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov edx, dword [0x6fe958]
mov eax, dword [0x6fe784]
mov ecx, dword [0x6fe85c]
mov ebp, 0xff00
mov dword [0x6fe8a0], ebp
mov dword [0x6fe8a4], edx
mov dword [0x6fe8a8], eax
mov dword [0x6fe8ac], 1
mov dword [0x6fe8b0], esi
mov edx, dword [ecx]
push 0x6fe898
call dword [edx + 0x30]
mov ecx, dword [0x6fe9b4]
mov dword [0x6fe798], eax
mov edx, dword [eax]
push ecx
mov ecx, eax
call dword [edx + 4]
push 0x28
call fcn.005e6fe9
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, esi
mov dword [esp + 0x20], 2
je 0x5b8fa5
mov ecx, eax
call fcn.005c5840
jmp 0x5b8fa7
xor eax, eax
mov ecx, dword [0x6fe968]
mov dword [0x6fe9b8], eax
push eax
mov dword [esp + 0x24], ebx
mov edx, dword [ecx]
call dword [edx + 0x14]
mov eax, dword [0x6fe9c0]
push esi
push esi
push esi
push esi
push 0x1776
push eax
call edi
cmp eax, esi
mov dword [0x6fe990], eax
jne 0x5b8feb
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov ecx, dword [0x6fe9c0]
push esi
push esi
push esi
push esi
push 0x1777
push ecx
call edi
cmp eax, esi
mov dword [0x6fe994], eax
jne 0x5b901b
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov edx, dword [0x6fe9d0]
mov eax, dword [0x6fe8c0]
mov ecx, dword [0x6fe85c]
mov dword [0x6fe998], ebp
mov dword [0x6fe99c], edx
mov dword [0x6fe9a0], eax
mov dword [0x6fe9a4], 1
mov dword [0x6fe9a8], esi
mov edx, dword [ecx]
push 0x6fe990
call dword [edx + 0x30]
mov ecx, dword [0x6fe9b8]
mov dword [0x6fe7a4], eax
mov edx, dword [eax]
push ecx
mov ecx, eax
call dword [edx + 4]
push 0x28
call fcn.005e6fe9
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, esi
mov dword [esp + 0x20], 3
je 0x5b908d
mov ecx, eax
call fcn.005c4f40
jmp 0x5b908f
xor eax, eax
mov ecx, dword [0x6fe968]
mov dword [0x6fe88c], eax
push eax
mov dword [esp + 0x24], ebx
mov edx, dword [ecx]
call dword [edx + 0x14]
mov eax, dword [0x6fe9c0]
push esi
push esi
push esi
push esi
push 0x1782
push eax
call edi
cmp eax, esi
mov dword [0x6fe7e0], eax
jne 0x5b90d3
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov ecx, dword [0x6fe9c0]
push esi
push esi
push esi
push esi
push 0x1783
push ecx
call edi
cmp eax, esi
mov dword [0x6fe7e4], eax
jne 0x5b9103
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov edx, dword [0x6fe780]
mov eax, dword [0x6fe95c]
mov ecx, dword [0x6fe85c]
mov dword [0x6fe7e8], ebp
mov dword [0x6fe7ec], edx
mov dword [0x6fe7f0], eax
mov dword [0x6fe7f4], 1
mov dword [0x6fe7f8], esi
mov edx, dword [ecx]
push 0x6fe7e0
call dword [edx + 0x30]
mov ecx, dword [0x6fe88c]
mov dword [0x6fe828], eax
mov edx, dword [eax]
push ecx
mov ecx, eax
call dword [edx + 4]
push 0x68
call fcn.005e6fe9
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, esi
mov dword [esp + 0x20], 4
je 0x5b9175
mov ecx, eax
call fcn.005c38f0
jmp 0x5b9177
xor eax, eax
mov ecx, dword [0x6fe968]
mov dword [0x6fe788], eax
push eax
mov dword [esp + 0x24], ebx
mov edx, dword [ecx]
call dword [edx + 0x18]
push 0x38
call fcn.005e6fe9
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, esi
mov dword [esp + 0x20], 5
je 0x5b91af
mov ecx, eax
call fcn.005c30e0
jmp 0x5b91b1
xor eax, eax
mov ecx, dword [0x6fe968]
mov dword [0x6fe820], eax
push eax
mov dword [esp + 0x24], ebx
mov edx, dword [ecx]
call dword [edx + 0x14]
mov eax, dword [0x6fe9c0]
push esi
push esi
push esi
push esi
push 0x1778
push eax
call edi
cmp eax, esi
mov dword [0x6fe8f8], eax
jne 0x5b91f5
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov ecx, dword [0x6fe9c0]
push esi
push esi
push esi
push esi
push 0x1779
push ecx
call edi
cmp eax, esi
mov dword [0x6fe8fc], eax
jne 0x5b9225
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov edx, dword [0x6fe7a0]
mov eax, dword [0x6fe8c8]
mov ecx, dword [0x6fe85c]
mov dword [0x6fe900], ebp
mov dword [0x6fe904], edx
mov dword [0x6fe908], eax
mov dword [0x6fe90c], 1
mov dword [0x6fe910], esi
mov edx, dword [ecx]
push 0x6fe8f8
call dword [edx + 0x30]
mov ecx, dword [0x6fe820]
mov dword [0x6fe9d4], eax
mov edx, dword [eax]
push ecx
mov ecx, eax
call dword [edx + 4]
push 0x38
call fcn.005e6fe9
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, esi
mov dword [esp + 0x20], 6
je 0x5b9297
mov ecx, eax
call fcn.005c2760
jmp 0x5b9299
xor eax, eax
mov ecx, dword [0x6fe968]
mov dword [0x6fe9bc], eax
push eax
mov dword [esp + 0x24], ebx
mov edx, dword [ecx]
call dword [edx + 0x14]
mov eax, dword [0x6fe9c0]
push esi
push esi
push esi
push esi
push 0x1786
push eax
call edi
cmp eax, esi
mov dword [0x6fea08], eax
jne 0x5b92dd
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov ecx, dword [0x6fe9c0]
push esi
push esi
push esi
push esi
push 0x1785
push ecx
call edi
cmp eax, esi
mov dword [0x6fea0c], eax
jne 0x5b930d
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov edx, dword [0x6fe7a8]
mov eax, dword [0x6fe960]
mov ecx, dword [0x6fe85c]
mov dword [0x6fea10], ebp
mov dword [0x6fea14], edx
mov dword [0x6fea18], eax
mov dword [0x6fea1c], 1
mov dword [0x6fea20], esi
mov edx, dword [ecx]
push 0x6fea08
call dword [edx + 0x30]
mov ecx, dword [0x6fe9bc]
mov dword [0x6fe8bc], eax
mov edx, dword [eax]
push ecx
mov ecx, eax
call dword [edx + 4]
push 0x68
call fcn.005e6fe9
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, esi
mov dword [esp + 0x20], 7
je 0x5b937f
mov ecx, eax
call fcn.005c16f0
jmp 0x5b9381
xor eax, eax
mov ecx, dword [0x6fe968]
mov dword [0x6fe9c4], eax
push eax
mov dword [esp + 0x24], ebx
mov edx, dword [ecx]
call dword [edx + 0x18]
push 0x38
call fcn.005e6fe9
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, esi
mov dword [esp + 0x20], 8
je 0x5b93b9
mov ecx, eax
call fcn.005c0d80
jmp 0x5b93bb
xor eax, eax
mov ecx, dword [0x6fe968]
mov dword [0x6fe890], eax
push eax
mov dword [esp + 0x24], ebx
mov edx, dword [ecx]
call dword [edx + 0x14]
mov eax, dword [0x6fe9c0]
push esi
push esi
push esi
push esi
push 0x177a
push eax
call edi
cmp eax, esi
mov dword [0x6fe970], eax
jne 0x5b93ff
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov ecx, dword [0x6fe9c0]
push esi
push esi
push esi
push esi
push 0x177b
push ecx
call edi
cmp eax, esi
mov dword [0x6fe974], eax
jne 0x5b942f
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov edx, dword [0x6fe9cc]
mov eax, dword [0x6fe9dc]
mov ecx, dword [0x6fe85c]
mov dword [0x6fe978], ebp
mov dword [0x6fe97c], edx
mov dword [0x6fe980], eax
mov dword [0x6fe984], 1
mov dword [0x6fe988], esi
mov edx, dword [ecx]
push 0x6fe970
call dword [edx + 0x30]
mov ecx, dword [0x6fe890]
mov dword [0x6fe860], eax
mov edx, dword [eax]
push ecx
mov ecx, eax
call dword [edx + 4]
push 0x38
call fcn.005e6fe9
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, esi
mov dword [esp + 0x20], 9
je 0x5b94a1
mov ecx, eax
call fcn.005c0550
jmp 0x5b94a3
xor eax, eax
mov ecx, dword [0x6fe968]
mov dword [0x6fe9f4], eax
push eax
mov dword [esp + 0x24], ebx
mov edx, dword [ecx]
call dword [edx + 0x14]
mov eax, dword [0x6fe9c0]
push esi
push esi
push esi
push esi
push 0x1788
push eax
call edi
cmp eax, esi
mov dword [0x6fe868], eax
jne 0x5b94e7
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov ecx, dword [0x6fe9c0]
push esi
push esi
push esi
push esi
push 0x1787
push ecx
call edi
cmp eax, esi
mov dword [0x6fe86c], eax
jne 0x5b9517
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov edx, dword [0x6fe834]
mov eax, dword [0x6fea00]
mov ecx, dword [0x6fe85c]
mov dword [0x6fe870], ebp
mov dword [0x6fe874], edx
mov dword [0x6fe878], eax
mov dword [0x6fe87c], 1
mov dword [0x6fe880], esi
mov edx, dword [ecx]
push 0x6fe868
call dword [edx + 0x30]
mov ecx, dword [0x6fe9f4]
mov dword [0x6fe7dc], eax
mov edx, dword [eax]
push ecx
mov ecx, eax
call dword [edx + 4]
push 0x48
call fcn.005e6fe9
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, esi
mov dword [esp + 0x20], 0xa
je 0x5b9589
mov ecx, eax
call fcn.005bf5e0
jmp 0x5b958b
xor eax, eax
mov ecx, dword [0x6fe968]
mov dword [0x6fe920], eax
push eax
mov dword [esp + 0x24], ebx
mov edx, dword [ecx]
call dword [edx + 0x18]
push 0x3c
call fcn.005e6fe9
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, esi
mov dword [esp + 0x20], 0xb
je 0x5b95c3
mov ecx, eax
call fcn.005bebf0
jmp 0x5b95c5
xor eax, eax
mov ecx, dword [0x6fe968]
mov dword [0x6fe9b0], eax
push eax
mov dword [esp + 0x24], ebx
mov edx, dword [ecx]
call dword [edx + 0x14]
mov eax, dword [0x6fe9c0]
push esi
push esi
push esi
push esi
push 0x177d
push eax
call edi
cmp eax, esi
mov dword [0x6fe800], eax
jne 0x5b9609
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov ecx, dword [0x6fe9c0]
push esi
push esi
push esi
push esi
push 0x177c
push ecx
call edi
cmp eax, esi
mov dword [0x6fe804], eax
jne 0x5b9639
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov edx, dword [0x6fe964]
mov eax, dword [0x6fe858]
mov ecx, dword [0x6fe85c]
mov dword [0x6fe808], ebp
mov dword [0x6fe80c], edx
mov dword [0x6fe810], eax
mov dword [0x6fe814], 1
mov dword [0x6fe818], esi
mov edx, dword [ecx]
push 0x6fe800
call dword [edx + 0x30]
mov ecx, dword [0x6fe9b0]
mov dword [0x6fea2c], eax
mov edx, dword [eax]
push ecx
mov ecx, eax
call dword [edx + 4]
push 0x3c
call fcn.005e6fe9
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, esi
mov dword [esp + 0x20], 0xc
je 0x5b96ab
mov ecx, eax
call fcn.005be280
jmp 0x5b96ad
xor eax, eax
mov ecx, dword [0x6fe968]
mov dword [0x6fe930], eax
push eax
mov dword [esp + 0x24], ebx
mov edx, dword [ecx]
call dword [edx + 0x14]
mov eax, dword [0x6fe9c0]
push esi
push esi
push esi
push esi
push 0x1780
push eax
call edi
cmp eax, esi
mov dword [0x6fe838], eax
jne 0x5b96f1
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov ecx, dword [0x6fe9c0]
push esi
push esi
push esi
push esi
push 0x1781
push ecx
call edi
cmp eax, esi
mov dword [0x6fe83c], eax
jne 0x5b9721
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov edx, dword [0x6fe924]
mov eax, dword [0x6fea28]
mov ecx, dword [0x6fe85c]
mov dword [0x6fe840], ebp
mov dword [0x6fe844], edx
mov dword [0x6fe848], eax
mov dword [0x6fe84c], 1
mov dword [0x6fe850], esi
mov edx, dword [ecx]
push 0x6fe838
call dword [edx + 0x30]
mov ecx, dword [0x6fe930]
mov dword [0x6fe8f0], eax
mov edx, dword [eax]
push ecx
mov ecx, eax
call dword [edx + 4]
push 0x48
call fcn.005e6fe9
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, esi
mov dword [esp + 0x20], 0xd
je 0x5b9793
mov ecx, eax
call fcn.005bd4a0
jmp 0x5b9795
xor eax, eax
mov ecx, dword [0x6fe968]
mov dword [0x6fe790], eax
push eax
mov dword [esp + 0x24], ebx
mov edx, dword [ecx]
call dword [edx + 0x18]
push 0x3c
call fcn.005e6fe9
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, esi
mov dword [esp + 0x20], 0xe
je 0x5b97cd
mov ecx, eax
call fcn.005bc8b0
jmp 0x5b97cf
xor eax, eax
mov ecx, dword [0x6fe968]
mov dword [0x6fe7ac], eax
push eax
mov dword [esp + 0x24], ebx
mov edx, dword [ecx]
call dword [edx + 0x14]
mov eax, dword [0x6fe9c0]
push esi
push esi
push esi
push esi
push 0x177e
push eax
call edi
cmp eax, esi
mov dword [0x6fe7b8], eax
jne 0x5b9813
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov ecx, dword [0x6fe9c0]
push esi
push esi
push esi
push esi
push 0x177f
push ecx
call edi
cmp eax, esi
mov dword [0x6fe7bc], eax
jne 0x5b9843
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov edx, dword [0x6fe8b8]
mov eax, dword [0x6fe7b0]
mov ecx, dword [0x6fe85c]
mov dword [0x6fe7c0], ebp
mov dword [0x6fe7c4], edx
mov dword [0x6fe7c8], eax
mov dword [0x6fe7cc], 1
mov dword [0x6fe7d0], esi
mov edx, dword [ecx]
push 0x6fe7b8
call dword [edx + 0x30]
mov ecx, dword [0x6fe7ac]
mov dword [0x6fe9d8], eax
mov edx, dword [eax]
push ecx
mov ecx, eax
call dword [edx + 4]
push 0x6c
call fcn.005e6fe9
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, esi
mov dword [esp + 0x20], 0xf
je 0x5b98b5
mov ecx, eax
call fcn.005bad30
jmp 0x5b98b7
xor eax, eax
mov ecx, dword [0x6fe968]
mov dword [0x6fe8c4], eax
push eax
mov dword [esp + 0x24], ebx
mov edx, dword [ecx]
call dword [edx + 0x18]
push 0x44
call fcn.005e6fe9
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, esi
mov dword [esp + 0x20], 0x10
je 0x5b98ef
mov ecx, eax
call fcn.005ba4d0
jmp 0x5b98f1
xor eax, eax
mov ecx, dword [0x6fe968]
mov dword [0x6fe91c], eax
push eax
mov dword [esp + 0x24], ebx
mov edx, dword [ecx]
call dword [edx + 0x14]
mov eax, dword [0x6fe9c0]
push esi
push esi
push esi
push esi
push 0x1771
push eax
call edi
cmp eax, esi
mov dword [0x6fe8d0], eax
jne 0x5b9935
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov ecx, dword [0x6fe9c0]
push esi
push esi
push esi
push esi
push 0x1770
push ecx
call edi
cmp eax, esi
mov dword [0x6fe8d4], eax
jne 0x5b9965
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov edx, dword [0x6fe918]
mov eax, dword [0x6fe928]
mov ecx, dword [0x6fe85c]
mov dword [0x6fe8d8], ebp
mov dword [0x6fe8dc], edx
mov dword [0x6fe8e0], eax
mov dword [0x6fe8e4], 1
mov dword [0x6fe8e8], esi
mov edx, dword [ecx]
push 0x6fe8d0
call dword [edx + 0x30]
mov ecx, dword [0x6fe91c]
mov dword [0x6fe7d8], eax
mov edx, dword [eax]
push ecx
mov ecx, eax
call dword [edx + 4]
push 0x10
call fcn.005e6fe9
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, esi
mov dword [esp + 0x20], 0x11
je 0x5b99d7
mov ecx, eax
call fcn.005ba050
jmp 0x5b99d9
xor eax, eax
mov ecx, dword [0x6fe968]
mov dword [0x6fe9fc], eax
push eax
mov dword [esp + 0x24], ebx
mov edx, dword [ecx]
call dword [edx + 0x14]
mov eax, dword [0x6fe9c0]
push esi
push esi
push esi
push esi
push 0x1772
push eax
call edi
cmp eax, esi
mov dword [0x6fe938], eax
jne 0x5b9a1d
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov ecx, dword [0x6fe9c0]
push esi
push esi
push esi
push esi
push 0x1773
push ecx
call edi
cmp eax, esi
mov dword [0x6fe93c], eax
jne 0x5b9a4d
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov edx, dword [0x6fe864]
mov eax, dword [0x6fe92c]
mov ecx, dword [0x6fe85c]
mov edi, 1
mov dword [0x6fe940], ebp
mov dword [0x6fe944], edx
mov dword [0x6fe948], eax
mov dword [0x6fe94c], edi
mov dword [0x6fe950], esi
mov edx, dword [ecx]
push 0x6fe938
call dword [edx + 0x30]
mov ecx, dword [0x6fe9fc]
mov dword [0x6fe830], eax
mov edx, dword [eax]
push ecx
mov ecx, eax
call dword [edx + 4]
lea edx, [esp + 0x28]
mov dword [esp + 0x28], esi
push edx
push edi
push esi
push 0x6e4b60
push SysReAllocStringLen
mov dword [esp + 0x40], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x5b9aef
mov edx, dword [esp + 0x28]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x2c]
push eax
push ecx
push esi
push esi
push 0x6e4b54
push edx
mov dword [esp + 0x28], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x2c]
dec eax
je 0x5b9b0d
dec eax
je 0x5b9b01
mov dword [0x6fe82c], esi
jmp 0x5b9b13
mov dword [0x6fe82c], 2
jmp 0x5b9b13
mov dword [0x6fe82c], edi
mov ecx, dword [esp + 0x18]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret