Function at 0x5d89a0
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0xa0
mov rbp, rsp
mov qword [rbp + 0x30], 0
mov qword [rbp + 0x28], 0
mov qword [rbp + 0x38], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x88], 0
mov qword [rbp + 0x80], 0
mov qword [rbp + 0x60], 0
mov qword [rbp + 0x50], 0
mov qword [rbp + 0x48], rbp
mov qword [rbp + 0xc0], rcx
nop
mov rcx, qword [0x005d8760]
mov dl, 1
call fcn.00407500
mov qword [rbp + 0x68], rax
lea rcx, [rbp + 0x60]
cmp qword [rbp + 0x68], 0
jne 0x5d8a22
mov rdx, qword [rbp + 0x68]
jmp 0x5d8a2a
mov rdx, qword [rbp + 0x68]
add rdx, 0x10
call fcn.0040f360
mov rax, qword [rbp + 0x68]
mov rcx, qword [rbp + 0xc0]
mov qword [rax + 0x38], rcx
mov rax, qword [rbp + 0x68]
mov rcx, qword [rax + 0x38]
call fcn.004b3a10
mov rcx, rax
call sub.user32.dll_GetDpiForWindow
mov ecx, 0x10
mov edx, eax
mov r8d, 0x60
call sub.kernel32.dll_MulDiv
mov dword [rbp + 0x7c], eax
mov rax, qword [rbp + 0x68]
mov rcx, qword [rax + 0x38]
call fcn.004b3a10
mov rcx, rax
call sub.user32.dll_GetDpiForWindow
mov ecx, 0x18
mov edx, eax
mov r8d, 0x60
call sub.kernel32.dll_MulDiv
mov dword [rbp + 0x78], eax
mov rcx, qword [0x0044db20]
mov dl, 1
call fcn.00461d80
mov qword [rbp + 0x90], rax
mov rcx, qword [0x00478aa8]
mov dl, 1
mov r8d, 0x20019
call fcn.0047a130
mov qword [rbp + 0x70], rax
mov rcx, qword [rbp + 0x70]
lea rdx, [0x005d8e88]
mov r8b, 1
call fcn.0047a3e0
mov rcx, qword [rbp + 0x70]
mov rdx, qword [rbp + 0x90]
call fcn.0047ac90
mov rcx, qword [rbp + 0x90]
call fcn.0045f7a0
mov qword [rbp + 0x98], rax
nop
jmp 0x5d8cea
mov rax, qword [rbp + 0x98]
mov qword [rbp + 0x58], rax
mov rax, qword [rbp + 0x58]
mov rax, qword [rax + 0x10]
mov rcx, rax
lea rdx, [rbp + 0x50]
mov r8, qword [rbp + 0x58]
mov r8d, dword [r8 + 8]
mov rbx, qword [rax]
call qword [rbx + 0x18]
mov rcx, qword [rbp + 0x68]
add rcx, 0x20
mov rdx, qword [rbp + 0x50]
call fcn.0040ae30
lea rcx, [rbp + 0x40]
lea rdx, [0x005d8ed8]
mov rax, qword [rbp + 0x68]
mov r8, qword [rax + 0x20]
call fcn.0040c010
mov rcx, qword [rbp + 0x70]
mov rdx, qword [rbp + 0x40]
xor r8, r8
call fcn.0047a3e0
mov rcx, qword [rbp + 0x70]
lea rdx, [0x005d8f2c]
call fcn.0047b400
test al, al
je 0x5d8cea
mov rcx, qword [rbp + 0x70]
lea rdx, [rbp + 0x38]
lea r8, [0x005d8f54]
call fcn.0047b0d0
lea rcx, [rbp + 0x88]
mov rdx, qword [rbp + 0x38]
call fcn.005d81c0
mov rcx, qword [rbp + 0x88]
call fcn.0040bbf0
mov rcx, rax
call sub.shlwapi.dll_PathFileExistsW
test eax, eax
jne 0x5d8bf8
call fcn.005ad210
mov rbx, rax
lea rcx, [0x005d8f72]
call sub.user32.dll_RegisterWindowMessageW
mov esi, eax
mov rax, qword [rbp + 0x68]
mov rcx, qword [rax + 0x20]
call fcn.005d4510
mov rcx, rbx
mov edx, esi
mov r8d, 0x1000
mov r9, rax
call sub.user32.dll_SendMessageW
xor rcx, rcx
cmp rcx, rax
je 0x5d8cea
mov rcx, qword [rbp + 0x70]
lea rdx, [rbp + 0x28]
lea r8, [0x005d8f9c]
call fcn.0047b0d0
lea rcx, [rbp + 0x30]
mov rdx, qword [rbp + 0x88]
mov r8, qword [rbp + 0x28]
call fcn.005d8470
mov rcx, qword [rbp + 0x68]
add rcx, 0x30
mov rdx, qword [rbp + 0x30]
call fcn.0040ae30
mov rax, qword [rbp + 0x70]
mov rcx, qword [rax + 8]
xor rdx, rdx
lea r8, [0x005d8fae]
xor r9, r9
call sub.shlwapi.dll_SHOpenRegStream2W
lea rcx, [rbp + 0x80]
mov rdx, rax
call fcn.0040f360
mov ecx, 4
call fcn.005a1200
mov rcx, qword [rbp + 0x80]
mov edx, dword [rbp + 0x7c]
mov r8d, dword [rbp + 0x78]
mov r9d, eax
or r9d, 0xff000000
call fcn.005a0870
mov rcx, qword [rbp + 0x68]
mov qword [rcx + 0x28], rax
mov rcx, qword [rbp + 0x70]
lea rdx, [0x005d8fd4]
call fcn.0047b400
test al, al
je 0x5d8cb2
mov rcx, qword [rbp + 0x70]
lea rdx, [0x005d8fd4]
call fcn.0047b1c0
test eax, eax
jne 0x5d8cb7
xor rax, rax
jmp 0x5d8cb9
mov al, 1
mov rcx, qword [rbp + 0x68]
mov byte [rcx + 0x18], al
xor rcx, rcx
cmp qword [rbp + 0x68], 0
jne 0x5d8cd0
mov rdx, qword [rbp + 0x68]
jmp 0x5d8cd8
mov rdx, qword [rbp + 0x68]
add rdx, 0x40
call fcn.0046e1d0
mov rax, qword [rbp + 0x68]
mov rcx, qword [rax + 0x28]
call sub.gdi32.dll_DeleteObject
mov rcx, qword [rbp + 0x98]
call fcn.0045e980
test al, al
jne 0x5d8b00
nop
cmp qword [rbp + 0x98], 0
je 0x5d8d2a
mov rcx, qword [rbp + 0x98]
mov dl, 1
mov rax, qword [rbp + 0x98]
mov rbx, qword [rax]
call qword [rbx - 8]
mov qword [rbp + 0x98], 0
mov rcx, qword [rbp + 0x70]
call fcn.004075c0
mov rcx, qword [rbp + 0x90]
call fcn.004075c0
nop
lea rcx, [rbp + 0x28]
mov edx, 4
call fcn.0040a8c0
lea rcx, [rbp + 0x50]
call fcn.0040a7e0
lea rcx, [rbp + 0x60]
call fcn.0040f320
lea rcx, [rbp + 0x80]
call fcn.0040f320
lea rcx, [rbp + 0x88]
call fcn.0040a7e0
lea rsp, [rbp + 0xa0]
pop rbx
pop rsi
pop rbp
ret