Function at 0x55b970
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c2fd8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1a8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], 0
jne 0x55b9f2
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x55b9b3
mov esi, dword [ebp + 0x10]
test esi, esi
jne 0x55b9f8
mov eax, dword [ecx + 0x30]
test eax, eax
je 0x55bde5
push eax
call fcn.0057e90a
add esp, 4
cmp eax, 3
jbe 0x55bde5
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x30]
push ecx
call fcn.00580313
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
test edi, edi
mov dword [ebp + 0xc], 0x104
je 0x55ba6d
mov eax, dword [ecx + 0x3a0]
test eax, eax
jne 0x55ba1e
push edi
call fcn.0055dc10
test al, al
je 0x55bde5
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx + 0x3a0]
lea edx, [ebp + 0xc]
lea eax, [ebp - 0x1b4]
push edx
push eax
push 0
push 0
push 0x6554b0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x55bad8
mov edx, dword [ebp - 0x14]
push 0x66e33c
mov ecx, dword [edx + 0x398]
call fcn.0050bf00
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push esi
push ebx
lea eax, [ebp - 0xb0]
push 0x66db84
push eax
call fcn.0057f2ea
add esp, 0x10
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0xb0]
push ecx
push 0xf003f
push 0
push edx
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x55bde5
mov edx, dword [ebp - 0x18]
lea eax, [ebp + 0xc]
lea ecx, [ebp - 0x1b4]
push eax
push ecx
push 0
push 0
push 0x6554b0
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x55bde5
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [0x6754d4]
mov dword [ebp + 0x10], ecx
lea edx, [ebp - 0x1b4]
mov byte [ebp - 4], 1
push edx
call fcn.00581730
add esp, 4
cmp eax, 0xffffffff
jne 0x55bb24
lea eax, [ebp - 0x1b4]
lea ecx, [ebp + 0x10]
push eax
push 0x667710
push ecx
call fcn.00593b08
add esp, 0xc
test edi, edi
je 0x55bb93
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [eax + 0x398]
jmp 0x55bb4d
lea ecx, [ebp - 0x1b4]
lea edx, [ebp + 0x10]
push ecx
push 0x6676f8
push edx
call fcn.00593b08
add esp, 0xc
test edi, edi
je 0x55bb93
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ecx + 0x398]
call fcn.0050bf00
push edi
lea edx, [ebp - 0xb0]
push 0x6680a8
push edx
call fcn.0057f2ea
add esp, 0xc
lea eax, [ebp - 0x30]
lea ecx, [ebp + 8]
lea edx, [ebp - 0xb0]
push eax
push ecx
push 0
push 0xf003f
push 0
push 0x679a28
push 0
push edx
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
jmp 0x55bbce
push esi
push ebx
lea eax, [ebp - 0xb0]
push 0x667eec
push eax
call fcn.0057f2ea
add esp, 0x10
lea ecx, [ebp + 8]
lea edx, [ebp - 0xb0]
push ecx
push 0xf003f
push 0
push edx
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x55bdd9
mov edx, dword [ebp + 8]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp + 0xc]
lea ecx, [ebp - 0x2c]
push eax
push ecx
push 0
push 0
push 0x655480
push edx
mov dword [ebp + 0xc], 0x10
call ebx
test eax, eax
jne 0x55bdcf
lea edi, [ebp - 0x1b4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
add ecx, 9
push ecx
call fcn.005970d9
mov esi, eax
add esp, 4
test esi, esi
je 0x55bdd9
mov eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x55bd4c
mov edi, eax
push eax
lea eax, [ebp - 0x1c]
push 0x668740
push eax
call fcn.0057f2ea
add esp, 0xc
lea ecx, [ebp + 0xc]
lea edx, [ebp - 0x2c]
lea eax, [ebp - 0x1c]
push ecx
mov ecx, dword [ebp + 8]
push edx
push 0
push 0
push eax
push ecx
call ebx
test eax, eax
jne 0x55bca6
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x1b4]
push edx
push eax
push 0x66d380
push esi
call fcn.0057f2ea
push esi
call fcn.00581730
add esp, 0x14
cmp eax, 0xffffffff
push esi
jne 0x55bc83
push 0x667710
jmp 0x55bc88
push 0x6676f8
lea ecx, [ebp + 0x10]
push ecx
call fcn.00593b08
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 0x10]
add esp, 0xc
mov ecx, dword [eax + 0x398]
push edx
call fcn.0050bf00
push edi
lea ecx, [ebp - 0x1c]
push 0x64eff4
push ecx
call fcn.0057f2ea
add esp, 0xc
lea edx, [ebp + 0xc]
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x1c]
push edx
mov edx, dword [ebp + 8]
push eax
push 0
push 0
push ecx
push edx
call ebx
test eax, eax
je 0x55bcf8
push eax
lea eax, [ebp + 0x10]
push 0x66e308
push eax
call fcn.00593b08
mov ecx, dword [ebp + 0x10]
mov edi, dword [ebp - 0x14]
add esp, 0xc
push ecx
mov ecx, dword [edi + 0x398]
call fcn.0050bf00
jmp 0x55bd4f
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x1b4]
push edx
push eax
push 0x66d380
push esi
call fcn.0057f2ea
push esi
call fcn.00581730
add esp, 0x14
cmp eax, 0xffffffff
push esi
jne 0x55bd45
push 0x667710
lea ecx, [ebp + 0x10]
push ecx
call fcn.00593b08
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 0x10]
add esp, 0xc
mov ecx, dword [eax + 0x398]
push edx
call fcn.0050bf00
jmp 0x55bc1d
push 0x6676f8
jmp 0x55bd22
mov edi, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
lea ecx, [ebp + 0xc]
lea edx, [ebp - 0x2c]
push ecx
push edx
push 0
push 0
push 0x66e304
push eax
call ebx
test eax, eax
jne 0x55bdc6
mov ecx, dword [ebp - 0x2c]
lea edx, [ebp - 0x1b4]
push ecx
push edx
push 0x66d380
push esi
call fcn.0057f2ea
push esi
call fcn.00581730
add esp, 0x14
cmp eax, 0xffffffff
push esi
jne 0x55bda6
lea eax, [ebp + 0x10]
push 0x667710
push eax
call fcn.00593b08
mov ecx, dword [ebp + 0x10]
add esp, 0xc
push ecx
jmp 0x55bdbb
lea edx, [ebp + 0x10]
push 0x6676f8
push edx
call fcn.00593b08
mov eax, dword [ebp + 0x10]
add esp, 0xc
push eax
mov ecx, dword [edi + 0x398]
call fcn.0050bf00
push esi
call fcn.00597102
add esp, 4
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 0x10]
mov byte [ebp - 4], 0
call fcn.0059ad3d
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc