Function at 0x5d8c60
Capabilities:
Get common file path
Query or enumerate registry value
Read file on windows
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x64f3dc
mov eax, dword fs:[0]
push eax
mov eax, 0x303b0
call fcn.0063fe40
mov eax, dword [0x6a9fa4]
xor eax, esp
mov dword [esp + 0x303a8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6a9fa4]
xor eax, esp
push eax
lea eax, [esp + 0x303c4]
mov dword fs:[0], eax
mov eax, dword [esp + 0x303d8]
mov ebx, dword [esp + 0x303d4]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x303dc]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], edx
mov dword [esp + 0x34], eax
call fcn.005b5890
test al, al
je 0x5d8db5
push 2
mov edi, 0xf
xor esi, esi
push 0x674628
lea ecx, [esp + 0x68]
mov dword [esp + 0x80], edi
mov dword [esp + 0x7c], esi
mov byte [esp + 0x6c], 0
call fcn.00405590
mov dword [esp + 0x303cc], esi
lea esi, [esp + 0x44]
call fcn.005b5940
lea edx, [esp + 0x60]
lea esi, [esp + 0x7c]
mov byte [esp + 0x303cc], 1
call fcn.005b6a50
mov ebp, 0x10
cmp dword [eax + 0x18], ebp
jb 0x5d8d2c
mov ecx, dword [eax + 4]
jmp 0x5d8d2f
lea ecx, [eax + 4]
lea edx, [esp + 0xb4]
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
test al, al
jne 0x5d8d36
cmp dword [esp + 0x94], ebp
jb 0x5d8d5d
mov ecx, dword [esp + 0x80]
push ecx
call fcn.0062414c
add esp, 4
xor esi, esi
cmp dword [esp + 0x5c], ebp
mov dword [esp + 0x94], edi
mov dword [esp + 0x90], esi
mov byte [esp + 0x80], 0
jb 0x5d8d88
mov edx, dword [esp + 0x48]
push edx
call fcn.0062414c
add esp, 4
mov dword [esp + 0x303cc], 0xffffffff
cmp dword [esp + 0x78], ebp
mov dword [esp + 0x5c], edi
mov dword [esp + 0x58], esi
mov byte [esp + 0x48], 0
jb 0x5d8dcd
mov eax, dword [esp + 0x64]
push eax
call fcn.0062414c
add esp, 4
jmp 0x5d8dcd
push 0x104
lea ecx, [esp + 0xb8]
push ecx
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryA]
mov ebp, 0x10
lea eax, [esp + 0xb4]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x5d8dd7
sub eax, edx
cmp byte [esp + eax + 0xb3], 0x5c
je 0x5d8e0a
lea edi, [esp + 0xb4]
add edi, 0xffffffff
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x5d8df6
mov dx, word [0x67d788]
mov word [edi], dx
lea eax, [esp + 0xb4]
add eax, 0xffffffff
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x5d8e14
mov ecx, dword [str.popcreg.dat]
mov edx, dword [0x685278]
mov dword [eax], ecx
mov ecx, dword [0x68527c]
mov dword [eax + 4], edx
lea edx, [esp + 0xb4]
push 0x665358
push edx
mov dword [eax + 8], ecx
call fcn.00624db9
mov esi, eax
add esp, 8
test esi, esi
je 0x5d8fb8
push esi
push 1
lea eax, [esp + 0x20]
push 2
push eax
call fcn.00625156
add esp, 0x10
cmp eax, 1
jne 0x5d8faf
movzx eax, word [esp + 0x18]
push esi
push eax
lea ecx, [esp + 0x3c4]
push 1
push ecx
mov byte [esp + eax + 0x3cc], 0
call fcn.00625156
push esi
push 1
lea edx, [esp + 0x30]
push 2
push edx
call fcn.00625156
add esp, 0x20
cmp eax, 1
jne 0x5d8faf
movzx eax, word [esp + 0x18]
push esi
push eax
mov byte [esp + eax + 0x103c4], 0
lea eax, [esp + 0x103c4]
push 1
push eax
call fcn.00625156
push esi
push 1
lea ecx, [esp + 0x30]
push 2
push ecx
call fcn.00625156
add esp, 0x20
cmp eax, 1
jne 0x5d8faf
movzx eax, word [esp + 0x18]
push esi
push eax
lea edx, [esp + 0x203c4]
push 1
push edx
mov byte [esp + eax + 0x203cc], 0
call fcn.00625156
push esi
push 1
lea eax, [esp + 0x44]
push 2
push eax
call fcn.00625156
add esp, 0x20
cmp eax, 1
jne 0x5d8faf
push esi
push eax
lea ecx, [esp + 0x30]
push 2
push ecx
call fcn.00625156
add esp, 0x10
cmp eax, 1
jne 0x5d8faf
lea eax, [esp + 0x3bc]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x5d8f40
mov edi, dword [ebx + 0x58]
sub eax, edx
mov ebp, eax
cmp edi, ebp
mov eax, edi
mov ecx, edi
jb 0x5d8f5a
mov ecx, ebp
cmp dword [ebx + 0x5c], 0x10
jb 0x5d8f65
mov eax, dword [ebx + 0x48]
jmp 0x5d8f68
lea eax, [ebx + 0x48]
push ecx
lea edx, [esp + 0x3c0]
push edx
push eax
call fcn.00459930
add esp, 0xc
test eax, eax
jne 0x5d8f8f
cmp edi, ebp
jb 0x5d8f8f
cmp edi, ebp
setne al
test eax, eax
je 0x5d91d4
push esi
push 1
lea eax, [esp + 0x20]
push 2
push eax
call fcn.00625156
add esp, 0x10
cmp eax, 1
mov ebp, 0x10
je 0x5d8e72
push esi
call fcn.00624e3e
add esp, 4
add ebx, 0x7c
push ebx
mov edi, str.SOFTWARE_
lea esi, [esp + 0x48]
call fcn.00447340
add esp, 4
mov edi, eax
lea eax, [esp + 0x98]
mov dword [esp + 0x303cc], 2
call fcn.005b7100
mov ebx, 4
mov byte [esp + 0x303cc], bl
cmp dword [esp + 0x5c], ebp
jb 0x5d9005
mov ecx, dword [esp + 0x48]
push ecx
call fcn.0062414c
add esp, 4
cmp dword [esp + 0xb0], ebp
mov eax, dword [esp + 0x9c]
mov dword [esp + 0x5c], 0xf
mov dword [esp + 0x58], 0
mov byte [esp + 0x48], 0
jae 0x5d9031
lea eax, [esp + 0x9c]
lea edx, [esp + 0x24]
push edx
push 0x20006
push 0
push eax
push 0x80000002
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x5d9191
mov esi, dword [sym.imp.advapi32.dll_RegQueryValueExA]
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0x2c0]
push ecx
lea edx, [esp + 0x28]
push edx
push 0
push str.RegName
mov edi, pe_nt_image_headers32
push eax
mov dword [esp + 0x38], 1
mov dword [esp + 0x34], edi
call esi
test eax, eax
jne 0x5d90be
mov ecx, dword [esp + 0x1c]
mov byte [esp + ecx + 0x2bc], al
lea eax, [esp + 0x2bc]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x5d90a1
mov ecx, dword [esp + 0x38]
sub eax, edx
push eax
lea edx, [esp + 0x2c0]
push edx
call fcn.00405590
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0x1c0]
push ecx
lea edx, [esp + 0x28]
push edx
push 0
push str.RegCode
push eax
mov dword [esp + 0x38], 1
mov dword [esp + 0x34], edi
call esi
test eax, eax
jne 0x5d9120
mov ecx, dword [esp + 0x1c]
mov byte [esp + ecx + 0x1bc], al
lea eax, [esp + 0x1bc]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x5d9103
mov ecx, dword [esp + 0x3c]
sub eax, edx
push eax
lea edx, [esp + 0x1c0]
push edx
call fcn.00405590
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x28]
push edx
push 0
push str.TimesPlayed
push eax
mov dword [esp + 0x38], ebx
mov dword [esp + 0x34], ebx
call esi
test eax, eax
jne 0x5d9153
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x40]
mov dword [edx], ecx
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x28]
push edx
push 0
push str.TimesExecuted
push eax
mov dword [esp + 0x38], ebx
mov dword [esp + 0x34], ebx
call esi
test eax, eax
jne 0x5d9186
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
mov dword [edx], ecx
mov eax, dword [esp + 0x24]
push eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
cmp dword [esp + 0xb0], ebp
jb 0x5d91aa
mov ecx, dword [esp + 0x9c]
push ecx
call fcn.0062414c
add esp, 4
mov ecx, dword [esp + 0x303c4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x303a8]
xor ecx, esp
call fcn.00626d59
add esp, 0x303bc
ret 0xc
lea ecx, [esp + 0x103bc]
push ecx
mov ecx, dword [esp + 0x3c]
call fcn.00405560
mov ecx, dword [esp + 0x3c]
lea edx, [esp + 0x203bc]
push edx
call fcn.00405560
movsx eax, word [esp + 0x2c]
mov ecx, dword [esp + 0x40]
movsx edx, word [esp + 0x28]
mov dword [ecx], eax
mov eax, dword [esp + 0x34]
push esi
mov dword [eax], edx
call fcn.00624e3e
jmp 0x5d91a7