Function at 0x5fd9522f
Capabilities:
Query or enumerate registry value

Disassembly:
xor edx, edx
call fcn.5fd9515b
mov dword [esp + 0x18], eax
test eax, eax
je 0x5fdb4562
mov edx, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
test eax, eax
je 0x5fd98fa8
push dword [ebp + 0x10]
mov ecx, eax
call fcn.5fd953b8
mov edi, dword [esp + 0xc]
mov ebx, eax
test ebx, ebx
jne 0x5fd95339
jmp 0x5fd95371
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
push esi
xor ebx, ebx
mov dword [esp + 8], ecx
push edi
mov edi, edx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov eax, dword [0x5fde9010]
mov esi, dword [ebp + 0xc]
cmp eax, 0x5fde9010
je 0x5fd95266
test byte [eax + 0x1c], 4
jne 0x5fdb4527
call fcn.5fd8ab26
mov eax, dword [0x5fde9010]
cmp eax, 0x5fde9010
je 0x5fd95281
test byte [eax + 0x1c], 4
jne 0x5fdb4547
cmp esi, 0x65
ja 0x5fdb461e
lea eax, [esi + esi*2]
shl eax, 2
mov dword [esp + 0x10], eax
mov edx, dword [eax + 0x5fdea240]
mov dword [esp + 0x14], edx
test edx, edx
je 0x5fdb461e
test edi, edi
jne 0x5fd98f91
mov ecx, dword [ebp + 8]
test ecx, ecx
jne 0x5fd951ea
mov edi, dword [esp + 0xc]
test edi, edi
je 0x5fdb4580
mov ecx, dword [edi]
test ecx, ecx
jne 0x5fdb45a5
mov eax, dword [edi + 0xc]
mov ecx, dword [esp + 0x10]
test eax, eax
je 0x5fd9531c
cmp byte [ecx + 0x5fdea24b], 0
je 0x5fd9531c
lea ecx, [esp + 0xc]
mov dword [esp + 0x18], 0
push ecx
push dword [ebp + 0x10]
lea ecx, [esp + 0x20]
mov dword [esp + 0x14], 4
push ecx
push 0
push edx
push eax
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov ebx, eax
test ebx, ebx
je 0x5fdb45cd
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov eax, dword [edi + 8]
mov dword [esp + 0x18], eax
test eax, eax
je 0x5fd95334
cmp byte [ecx + 0x5fdea24a], 0
jne 0x5fd95d4a
mov ebx, 2
mov eax, dword [0x5fdea718]
xor edx, edx
cmp eax, 0xffffffff
je 0x5fd9535e
mov ecx, 0x5fdea718
cmp eax, esi
je 0x5fd95d63
mov eax, dword [ecx + 0xc]
add ecx, 0xc
inc edx
cmp eax, 0xffffffff
jne 0x5fd9534a
test ebx, ebx
je 0x5fd95371
mov eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0x10]
mov eax, dword [eax + 0x5fdea244]
mov dword [ecx], eax
lea eax, [esp + 0x20]
cmp edi, eax
je 0x5fdb4612
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x5fd95390
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push eax
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push dword [ebp + 0x10]
mov ecx, eax
call fcn.5fd953b8
mov ebx, eax
test ebx, ebx
jne 0x5fd95334
jmp 0x5fd95371
lea eax, [edx + edx*2]
mov esi, dword [eax*4 + 0x5fdea720]
mov eax, dword [eax*4 + 0x5fdea71c]
cmp eax, 0xffffffff
je 0x5fd9535e
test edi, edi
je 0x5fd98f9c
xor ecx, ecx
xor edx, edx
lea ebx, [esp + 0x18]
push ebx
push eax
push ecx
mov ecx, edi
call fcn.5fd9522f
mov ebx, eax
test ebx, ebx
jne 0x5fd95362
jmp 0x5fdb45ed
mov eax, edi
mov dword [esp + 0x18], eax
jmp 0x5fd95205
mov edx, dword [esp + 0x18]
mov ecx, dword [ebp + 8]
jmp 0x5fd95d89
mov edi, dword [esp + 0xc]
jmp 0x5fd95371
push esi
push dword [ebp + 8]
mov edx, 0x5fdbd59c
push edi
push ecx
push dword [eax + 0x14]
mov ecx, 0xd
push dword [eax + 0x10]
call fcn.5fdce4f9
jmp 0x5fd95266
push esi
push dword [eax + 0x14]
mov edx, 0x5fdbd59c
mov ecx, 0xb
push dword [eax + 0x10]
call fcn.5fdc7d09
jmp 0x5fd95281
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
mov edi, dword [esp + 0xc]
mov ebx, eax
test ebx, ebx
jne 0x5fd95339
mov ebx, 0x3f3
jmp 0x5fd95339
push ecx
lea ecx, [esp + 0x24]
call fcn.5fd956d8
mov ebx, eax
test ebx, ebx
jne 0x5fd95339
mov edx, dword [esp + 0x14]
lea edi, [esp + 0x20]
mov eax, dword [esp + 0x10]
jmp 0x5fd952c5
cmp byte [eax + 0x5fdea248], 0
je 0x5fd952cf
push dword [ebp + 0x10]
call fcn.5fd953b8
mov ebx, eax
test ebx, ebx
je 0x5fd95371
mov edx, dword [esp + 0x14]
jmp 0x5fd952cf
cmp dword [esp + 0x18], 4
jne 0x5fdb45db
cmp dword [esp + 0xc], 4
je 0x5fdb45e0
mov ebx, 0x3f2
test ebx, ebx
jne 0x5fd95314
jmp 0x5fd95371
test esi, esi
je 0x5fdb4604
mov ecx, dword [ebp + 0x10]
xor eax, eax
cmp dword [esp + 0x18], eax
sete al
mov dword [ecx], eax
jmp 0x5fd95371
mov ecx, dword [ebp + 0x10]
mov eax, dword [esp + 0x18]
mov dword [ecx], eax
jmp 0x5fd95371
mov ecx, edi
call fcn.5fd959c0
jmp 0x5fd95385
mov eax, dword [ebp + 0x10]
mov dword [eax], ebx
mov eax, 0x57
jmp 0x5fd95387