Function at 0x5f71c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x5978
call fcn.00637690
mov dword [ebp - 4], 0
lea eax, [ebp - 0xc04]
push eax
lea ecx, [ebp - 0x804]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.005f6f90
add esp, 0xc
test eax, eax
je 0x5f778e
mov dword [ebp - 0xc08], 0
lea eax, [ebp - 0xc04]
push eax
push 0x6fbf44
lea ecx, [ebp - 0x1d78]
call fcn.005e5400
mov ecx, eax
call fcn.005e5430
push eax
lea ecx, [ebp - 0x404]
push ecx
call fcn.006374e0
add esp, 0xc
lea edx, [ebp - 0xc08]
push edx
push 0x20019
push 0
lea eax, [ebp - 0x404]
push eax
push 0x80000002
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x5f778e
mov dword [ebp - 0xc0c], 0x10
lea ecx, [ebp - 0xc0c]
push ecx
lea edx, [ebp - 0xc1c]
push edx
push 0
push 0
push 0x6fbf54
lea ecx, [ebp - 0x2178]
call fcn.005e5400
mov ecx, eax
call fcn.005e5430
push eax
mov eax, dword [ebp - 0xc08]
push eax
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x5f7781
push 0x6fbf60
lea ecx, [ebp - 0x2578]
call fcn.005e5400
mov ecx, eax
call fcn.005e5430
push eax
lea ecx, [ebp - 0xc1c]
push ecx
call fcn.006379a0
add esp, 8
test eax, eax
jne 0x5f7781
mov dword [ebp - 0xd68], 0x40
lea edx, [ebp - 0xd68]
push edx
lea eax, [ebp - 0xd60]
push eax
push 0
push 0
push 0x6fbf6c
lea ecx, [ebp - 0x2978]
call fcn.005e5400
mov ecx, eax
call fcn.005e5430
push eax
mov ecx, dword [ebp - 0xc08]
push ecx
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
mov edx, dword [ebp + 0xc]
mov al, byte [ebp - 0xd60]
mov byte [edx + 0x180], al
mov dword [ebp - 0xd64], 0x80
lea ecx, [ebp - 0xd64]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0
push 0
push 0x6fbf90
lea ecx, [ebp - 0x2d78]
call fcn.005e5400
mov ecx, eax
call fcn.005e5430
push eax
mov eax, dword [ebp - 0xc08]
push eax
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
mov dword [ebp - 0xd64], 0x80
lea ecx, [ebp - 0xd64]
push ecx
mov edx, dword [ebp + 0xc]
add edx, 0x80
push edx
push 0
push 0
push 0x6fbfa0
lea ecx, [ebp - 0x3178]
call fcn.005e5400
mov ecx, eax
call fcn.005e5430
push eax
mov eax, dword [ebp - 0xc08]
push eax
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
mov dword [ebp - 0xd64], 0x80
lea ecx, [ebp - 0xd64]
push ecx
mov edx, dword [ebp + 0xc]
add edx, 0x100
push edx
push 0
push 0
push 0x6fbfb4
lea ecx, [ebp - 0x3578]
call fcn.005e5400
mov ecx, eax
call fcn.005e5430
push eax
mov eax, dword [ebp - 0xc08]
push eax
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
lea ecx, [ebp - 0xc04]
push ecx
lea edx, [ebp - 0xd20]
push edx
call fcn.006373f0
add esp, 8
lea eax, [ebp - 0xc04]
push eax
lea ecx, [ebp - 0x804]
push ecx
lea edx, [ebp - 0x804]
push edx
call fcn.005f6f90
add esp, 0xc
mov dword [ebp - 0xc20], eax
cmp dword [ebp - 0xc20], 0
jne 0x5f744f
mov eax, dword [ebp + 0xc]
mov dword [eax + 0x689], 1
lea ecx, [ebp - 0xc04]
push ecx
lea edx, [ebp - 0xd20]
push edx
call fcn.005f70f0
add esp, 8
mov dword [ebp - 0xc20], eax
cmp dword [ebp - 0xc20], 0
je 0x5f777a
lea eax, [ebp - 0xc04]
push eax
push 0x6fbfc8
lea ecx, [ebp - 0x3978]
call fcn.005e5400
mov ecx, eax
call fcn.005e5430
push eax
lea ecx, [ebp - 0x1570]
push ecx
call fcn.006374e0
add esp, 0xc
lea edx, [ebp - 0xd70]
push edx
push 0x20019
push 0
lea eax, [ebp - 0x1570]
push eax
push 0x80000002
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x5f76be
mov dword [ebp - 0x1574], 0x100
lea ecx, [ebp - 0x1574]
push ecx
mov edx, dword [ebp + 0xc]
add edx, 0x281
push edx
push 0
push 0
push 0x6fbfd8
lea ecx, [ebp - 0x3d78]
call fcn.005e5400
mov ecx, eax
call fcn.005e5430
push eax
mov eax, dword [ebp - 0xd70]
push eax
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
mov dword [ebp - 0x1574], 0x400
lea ecx, [ebp - 0x1574]
push ecx
mov edx, dword [ebp + 0xc]
add edx, 0x181
push edx
push 0
push 0
push 0x6fbfe4
lea ecx, [ebp - 0x4178]
call fcn.005e5400
mov ecx, eax
call fcn.005e5430
push eax
mov eax, dword [ebp - 0xd70]
push eax
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
mov dword [ebp - 0x1574], 0x100
lea ecx, [ebp - 0x1574]
push ecx
lea edx, [ebp - 0x1974]
push edx
push 0
push 0
push 0x6fbff4
lea ecx, [ebp - 0x4578]
call fcn.005e5400
mov ecx, eax
call fcn.005e5430
push eax
mov eax, dword [ebp - 0xd70]
push eax
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
mov dword [ebp - 0x1978], 0
lea ecx, [ebp - 0x1974]
push ecx
push 0x6fc000
lea ecx, [ebp - 0x4978]
call fcn.005e5400
mov ecx, eax
call fcn.005e5430
push eax
lea edx, [ebp - 0x1570]
push edx
call fcn.006374e0
add esp, 0xc
lea eax, [ebp - 0x1978]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x1570]
push ecx
push 0x80000002
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x5f76b1
mov dword [ebp - 0x1574], 0x100
lea edx, [ebp - 0x1574]
push edx
mov eax, dword [ebp + 0xc]
add eax, 0x381
push eax
push 0
push 0
push 0x6fc034
lea ecx, [ebp - 0x4d78]
call fcn.005e5400
mov ecx, eax
call fcn.005e5430
push eax
mov ecx, dword [ebp - 0x1978]
push ecx
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
mov dword [ebp - 0x1574], 0x100
lea edx, [ebp - 0x1574]
push edx
mov eax, dword [ebp + 0xc]
add eax, 0x481
push eax
push 0
push 0
push 0x6fc044
lea ecx, [ebp - 0x5178]
call fcn.005e5400
mov ecx, eax
call fcn.005e5430
push eax
mov ecx, dword [ebp - 0x1978]
push ecx
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
mov dword [ebp - 0x1574], 0x100
lea edx, [ebp - 0x1574]
push edx
mov eax, dword [ebp + 0xc]
add eax, 0x581
push eax
push 0
push 0
push 0x6fc050
lea ecx, [ebp - 0x5578]
call fcn.005e5400
mov ecx, eax
call fcn.005e5430
push eax
mov ecx, dword [ebp - 0x1978]
push ecx
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
mov edx, dword [ebp - 0x1978]
push edx
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, dword [ebp - 0xd70]
push eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
push 0x400
push 0
lea ecx, [ebp - 0x1170]
push ecx
call fcn.00637390
add esp, 0xc
mov edx, dword [ebp + 0xc]
mov dword [edx + 0x681], 0
mov dword [ebp - 0xd6c], 0
push 0x6fc060
lea ecx, [ebp - 0x5978]
call fcn.005e5400
mov ecx, eax
call fcn.005e5430
push eax
lea eax, [ebp - 0x1170]
push eax
call fcn.006379a0
add esp, 8
test eax, eax
je 0x5f777a
lea ecx, [ebp - 0xc04]
push ecx
lea edx, [ebp - 0x1170]
push edx
lea eax, [ebp - 0x804]
push eax
call fcn.005f6f90
add esp, 0xc
test eax, eax
je 0x5f774e
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x681]
add edx, 1
mov eax, dword [ebp + 0xc]
mov dword [eax + 0x681], edx
jmp 0x5f7750
jmp 0x5f777a
lea ecx, [ebp - 0x1170]
push ecx
lea edx, [ebp - 0x804]
push edx
call fcn.006373f0
add esp, 8
mov eax, dword [ebp - 0xd6c]
add eax, 1
mov dword [ebp - 0xd6c], eax
jmp 0x5f76eb
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0xc08]
push ecx
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret