Function at 0x5d22e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x20]
push ebx
push esi
push edi
cmp byte [0x6f1d40], 0
je 0x5d2529
mov eax, dword [0x6f1cc0]
mov dword [ebp - 4], eax
jmp 0x5d2326
add dword [0x6f1cc0], 0x1000
mov eax, dword [0x6f1cc0]
mov dword [ebp - 4], eax
mov edx, dword [0x6f1cc0]
mov eax, 0x6f1cb0
call fcn.00410910
lea eax, [ebp - 4]
push eax
push dword [0x6f1cb0]
push 0
push 0
mov eax, 0x6d5d20
push eax
push 0x80000004
call sub.advapi32.dll_RegQueryValueExA
cmp eax, 0xea
je 0x5d2304
mov eax, dword [0x6f1cb0]
mov eax, dword [eax + 0x18]
add eax, dword [0x6f1cb0]
mov dword [0x6f1cd0], eax
mov eax, dword [0x6f1cb0]
mov edx, dword [eax + 0x1c]
mov ebx, 1
cmp edx, ebx
jl 0x5d2396
sub ebx, 1
mov esi, esi
add ebx, 1
mov eax, dword [0x6f1cd0]
cmp dword [eax + 0xc], 0xee
je 0x5d2396
mov eax, dword [0x6f1cd0]
mov ecx, dword [eax]
add dword [0x6f1cd0], ecx
cmp edx, ebx
jg 0x5d2374
mov eax, dword [0x6f1cd0]
cmp dword [eax + 0xc], 0xee
je 0x5d23c4
mov ecx, str.Unable_to_locate_the__Processor__performance_object
mov eax, 0x6557a0
mov edx, 1
call fcn.00435360
mov edx, 0x5d23a4
mov ecx, ebp
call fcn.0040eda0
cmp dword [0x6f1cf0], 0
jge 0x5d23fb
mov eax, dword [0x6f1cd0]
mov edx, dword [eax + 0x28]
mov dword [0x6f1cf0], edx
shl edx, 3
mov eax, 0x6f1d00
call fcn.004108b0
mov edx, dword [0x6f1cf0]
shl edx, 3
mov eax, 0x6f1d10
call fcn.004108b0
mov eax, dword [0x6f1cd0]
mov edx, dword [eax + 8]
mov eax, dword [0x6f1cd0]
lea eax, [edx + eax]
mov dword [0x6f1ce0], eax
mov eax, dword [0x6f1cd0]
mov edx, dword [eax + 0x20]
mov ebx, 1
cmp edx, ebx
jl 0x5d2448
sub ebx, 1
add ebx, 1
mov eax, dword [0x6f1ce0]
cmp dword [eax + 4], 6
je 0x5d2448
mov eax, dword [0x6f1ce0]
mov eax, dword [eax]
add eax, dword [0x6f1ce0]
mov dword [0x6f1ce0], eax
cmp edx, ebx
jg 0x5d2424
mov eax, dword [0x6f1ce0]
cmp dword [eax + 4], 6
je 0x5d2473
mov ecx, str.Unable_to_locate_the____of_CPU_usage__performance_counter
mov eax, 0x6557a0
mov edx, 1
call fcn.00435360
mov edx, 0x5d2453
mov ecx, ebp
call fcn.0040eda0
mov eax, dword [0x6f1cd0]
mov edx, dword [eax + 4]
mov eax, dword [0x6f1cd0]
lea eax, [edx + eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x6f1cf0]
sub eax, 1
mov edx, eax
mov ebx, 0
cmp edx, ebx
jl 0x5d24ee
sub ebx, 1
add ebx, 1
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
mov edi, dword [ebp - 0x1c]
lea eax, [ecx + edi]
mov esi, eax
mov ecx, dword [0x6f1d10]
mov eax, dword [0x6f1d00]
mov edi, dword [eax + ebx*8]
mov dword [ecx + ebx*8], edi
mov eax, dword [eax + ebx*8 + 4]
mov dword [ecx + ebx*8 + 4], eax
mov eax, dword [0x6f1ce0]
mov eax, dword [eax + 0x24]
lea eax, [eax + esi]
mov ecx, dword [0x6f1d00]
mov edi, dword [eax]
mov dword [ecx + ebx*8], edi
mov eax, dword [eax + 4]
mov dword [ecx + ebx*8 + 4], eax
mov eax, dword [esi]
lea eax, [eax + esi]
mov dword [ebp - 0x1c], eax
cmp edx, ebx
jg 0x5d249c
mov eax, dword [0x6f1d20]
mov dword [0x6f1d30], eax
mov eax, dword [0x6f1d24]
mov dword [0x6f1d34], eax
lea eax, [ebp - 0xc]
push eax
mov eax, dword [0x6f1cb0]
add eax, 0x24
push eax
call sub.kernel32.dll_SystemTimeToFileTime
mov eax, dword [ebp - 0xc]
mov dword [0x6f1d20], eax
mov eax, dword [ebp - 8]
mov dword [0x6f1d24], eax
jmp 0x5d2621
cmp byte [0x6f1d50], 0
jne 0x5d25f9
lea eax, [ebp - 0x10]
push eax
push 0xf003f
push 0
mov eax, str.PerfStatsStartStat
push eax
push 0x80000006
call sub.advapi32.dll_RegOpenKeyExA
mov dword [ebp - 0x20], eax
test dword [ebp - 0x20], 0xffffffff
je 0x5d257d
mov ecx, str.Unable_to_start_performance_monitoring
mov eax, 0x6557a0
mov edx, 1
call fcn.00435360
mov edx, 0x5d255d
mov ecx, ebp
call fcn.0040eda0
mov dword [ebp - 0x14], 4
lea eax, [ebp - 0x14]
push eax
mov eax, 0x6f1d60
push eax
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, str.KERNELCPUUsage
push eax
push dword [ebp - 0x10]
call sub.advapi32.dll_RegQueryValueExA
push dword [ebp - 0x10]
call sub.advapi32.dll_RegCloseKey
push 0x6f1d70
push 0x20019
push 0
mov eax, str.PerfStatsStatData
push eax
push 0x80000006
call sub.advapi32.dll_RegOpenKeyExA
mov dword [ebp - 0x20], eax
test dword [ebp - 0x20], 0xffffffff
je 0x5d25f2
mov ecx, str.Unable_to_read_performance_data
mov eax, 0x6557a0
mov edx, 1
call fcn.00435360
mov edx, 0x5d25d2
mov ecx, ebp
call fcn.0040eda0
mov byte [0x6f1d50], 1
mov dword [ebp - 0x14], 4
lea eax, [ebp - 0x14]
push eax
mov eax, 0x6f1d60
push eax
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, str.KERNELCPUUsage
push eax
push dword [0x6f1d70]
call sub.advapi32.dll_RegQueryValueExA
pop edi
pop esi
pop ebx
leave
ret