Function at 0x540050
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x627b39
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
push 0x6f3a2c
call fcn.0053c0e0
push 0x6f3a28
call fcn.0053c320
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
add esp, 8
xor esi, esi
mov ebx, 2
mov dword [0x6f3a34], eax
push esi
push esi
push esi
push ebx
push 0x2714
push eax
mov dword [0x6f3a38], ecx
call dword [sym.imp.USER32.dll_LoadImageA]
push 1
mov ecx, 0x6f39a0
mov dword [0x6f3a40], eax
mov dword [0x6f39ac], esi
call fcn.0055c180
mov eax, dword [0x6f39a4]
push 1
mov ecx, 0x6f39b0
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [0x6f39bc], esi
call fcn.0055c180
mov eax, dword [0x6f39b4]
mov ebp, 3
push 1
mov ecx, 0x6f39c0
mov dword [eax], ebp
mov dword [eax + 4], ebp
mov dword [0x6f39cc], esi
call fcn.0055c180
mov eax, dword [0x6f39c4]
mov edi, 4
push ebx
mov ecx, 0x6f39d0
mov dword [eax], edi
mov dword [eax + 4], edi
mov dword [0x6f39dc], esi
call fcn.0055c180
mov eax, dword [0x6f39d4]
push ebx
mov ecx, 0x6f39e0
mov dword [eax], edi
mov dword [eax + 4], ebp
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebp
mov dword [0x6f39ec], esi
call fcn.0055c180
mov eax, dword [0x6f39e4]
push ebx
mov ecx, 0x6f39f0
mov dword [eax], edi
mov dword [eax + 4], ebp
mov dword [eax + 8], 0x10
mov dword [eax + 0xc], ebp
mov dword [0x6f39fc], esi
call fcn.0055c180
mov eax, dword [0x6f39f4]
lea edx, [esp + 0x10]
push edx
push 1
push esi
mov dword [eax], 8
mov dword [eax + 4], edi
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
push str.SoftwareFoxit_SoftwareFoxit_ReaderAnnotation
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, esi
jne 0x5401ca
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x14]
push eax
push ecx
push esi
push esi
push str.SelectMode
push edx
mov dword [esp + 0x30], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x14]
dec eax
je 0x5401e4
dec eax
je 0x5401dc
mov dword [0x6f3a3c], esi
jmp 0x5401ee
mov dword [0x6f3a3c], ebx
jmp 0x5401ee
mov dword [0x6f3a3c], 1
mov ecx, dword [0x6f3a38]
push 1
push str.Basic_Tools
mov edx, dword [ecx]
call dword [edx + 8]
cmp eax, esi
mov dword [0x6f3a44], eax
jne 0x54022d
mov ecx, dword [0x6f3a38]
push esi
push str.Basic_Tools
push str.Basic_Tools
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [0x6f3a44], eax
mov edx, dword [eax]
push 1
mov ecx, eax
call dword [edx + 0x18]
push 8
call fcn.005e6f29
add esp, 4
mov dword [esp + 0x2c], eax
cmp eax, esi
mov dword [esp + 0x24], esi
je 0x54024c
mov ecx, eax
call fcn.0053d760
jmp 0x54024e
xor eax, eax
mov ecx, dword [0x6f3a38]
mov dword [0x6f3a48], eax
or edi, 0xffffffff
push eax
mov edx, dword [ecx]
mov dword [esp + 0x28], edi
call dword [edx + 0x10]
push 0x30
call fcn.005e6f29
add esp, 4
mov dword [esp + 0x2c], eax
cmp eax, esi
mov dword [esp + 0x24], 1
je 0x540289
mov ecx, eax
call fcn.00560aa0
jmp 0x54028b
xor eax, eax
mov ecx, dword [0x6f3a38]
mov dword [0x6f3a4c], eax
push eax
mov dword [esp + 0x28], edi
mov edx, dword [ecx]
call dword [edx + 0x10]
mov dword [0x6f3a50], esi
mov dword [0x6f3a08], esi
mov dword [0x6f3a0c], esi
mov dword [0x6f3a54], esi
call fcn.006061a0
mov edi, dword [eax + 0xc]
mov ebx, dword [0x6f3a34]
call fcn.006061a0
push 0x2783
mov ecx, 0x6f3a30
mov dword [eax + 0xc], ebx
call fcn.005eb550
push 0x2784
mov ecx, 0x6f3a04
call fcn.005eb550
call fcn.006061a0
push 0x10
mov dword [eax + 0xc], edi
call fcn.005e6f29
add esp, 4
mov dword [esp + 0x2c], eax
cmp eax, esi
mov dword [esp + 0x24], 2
je 0x540317
mov ecx, eax
call fcn.005607d0
jmp 0x540319
xor eax, eax
mov ecx, dword [0x6f3a38]
mov dword [0x6f3a50], eax
or ebx, 0xffffffff
push eax
mov edx, dword [ecx]
mov dword [esp + 0x28], ebx
call dword [edx + 0xc]
mov eax, dword [0x6f3a34]
mov edi, dword [sym.imp.USER32.dll_LoadImageA]
push esi
push esi
push esi
push esi
push 0x2720
push eax
call edi
cmp eax, esi
mov dword [0x6f3a08], eax
jne 0x540366
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [0x6f3a34]
push esi
push esi
push esi
push esi
push 0x273e
push ecx
call edi
cmp eax, esi
mov dword [0x6f3a0c], eax
jne 0x540396
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov edx, dword [0x6f3a30]
mov eax, dword [0x6f3a04]
mov ecx, dword [0x6f3a44]
mov dword [0x6f3a10], 0xff00
mov dword [0x6f3a14], edx
mov dword [0x6f3a18], eax
mov dword [0x6f3a1c], 1
mov dword [0x6f3a20], esi
mov edx, dword [ecx]
push 0x6f3a08
call dword [edx + 0x30]
mov ecx, dword [0x6f3a50]
mov dword [0x6f3a54], eax
mov edx, dword [eax]
push ecx
mov ecx, eax
call dword [edx + 4]
push 0xa8
call fcn.005e6f29
add esp, 4
mov dword [esp + 0x2c], eax
cmp eax, esi
mov dword [esp + 0x24], ebp
je 0x54040b
mov ecx, eax
call fcn.00560740
jmp 0x54040d
xor eax, eax
push esi
push eax
mov dword [esp + 0x2c], ebx
call fcn.0053bf30
push 0xb8
call fcn.005e6f29
add esp, 0xc
mov dword [esp + 0x2c], eax
cmp eax, esi
mov dword [esp + 0x24], 4
je 0x54043e
mov ecx, eax
call fcn.0055ce50
jmp 0x540440
xor eax, eax
push esi
push eax
mov dword [esp + 0x2c], ebx
call fcn.0053bf30
push 0xa8
call fcn.005e6f29
add esp, 0xc
mov dword [esp + 0x2c], eax
cmp eax, esi
mov dword [esp + 0x24], 5
je 0x540471
mov ecx, eax
call fcn.00546d40
jmp 0x540473
xor eax, eax
push esi
push eax
mov dword [esp + 0x2c], ebx
call fcn.0053bf30
push 0xb8
call fcn.005e6f29
add esp, 0xc
mov dword [esp + 0x2c], eax
cmp eax, esi
mov dword [esp + 0x24], 6
je 0x5404a4
mov ecx, eax
call fcn.0055c7b0
jmp 0x5404a6
xor eax, eax
push esi
push eax
mov dword [esp + 0x2c], ebx
call fcn.0053bf30
mov ecx, dword [esp + 0x24]
add esp, 8
mov eax, 1
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret