Function at 0x5fda501b
Capabilities:
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0x2c]
cmp eax, dword [ebx]
jbe 0x5fda5ac0
mov ecx, eax
call fcn.5fd85d21
mov dword [esp + 0xa8], eax
test eax, eax
je 0x5fda5ac8
lea ecx, [esp + 0x2c]
push ecx
push eax
lea eax, [esp + 0x44]
push eax
xor eax, eax
push eax
push dword [ebx - 8]
push dword [esp + 0x44]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov edx, dword [ebx + 4]
mov esi, eax
mov ecx, dword [ebx + 8]
mov eax, dword [esp + 0xa8]
mov dword [edx], eax
test ecx, ecx
je 0x5fda55ea
mov eax, dword [esp + 0x2c]
mov dword [ecx], eax
jmp 0x5fda55ea
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x314
mov eax, dword [0x5fde94a8]
xor eax, esp
mov dword [esp + 0x310], eax
push ebx
push esi
push edi
xor ebx, ebx
mov dword [esp + 0xa4], edx
push 0x58
lea eax, [esp + 0x48]
mov dword [esp + 0x44], ebx
mov esi, ecx
push ebx
push eax
mov dword [esp + 0x3c], esi
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
mov eax, ebx
mov dword [esp + 0xb8], 3
mov dword [esp + 0x1c], eax
add esp, 0xc
mov dword [esp + 0x38], eax
xor edx, edx
mov dword [esp + 0x1c], eax
inc edx
mov dword [esp + 0x34], eax
mov edi, ebx
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x7c]
mov dword [esp + 0xbc], eax
lea eax, [esp + 0x78]
mov dword [esp + 0xe0], eax
lea eax, [esp + 0x40]
mov dword [esp + 0x104], eax
lea eax, [esp + 0x44]
mov dword [esp + 0x108], eax
lea eax, [esp + 0x48]
push 4
pop ecx
mov dword [esp + 0x128], eax
lea eax, [esp + 0x4c]
mov dword [esp + 0xb0], 0x5fda4c14
mov dword [esp + 0xb4], ecx
mov dword [esp + 0xb8], ecx
mov dword [esp + 0xc0], ebx
mov byte [esp + 0xc4], bl
mov dword [esp + 0xc8], edx
mov dword [esp + 0xcc], ebx
mov dword [esp + 0xd0], ebx
mov dword [esp + 0xd4], 0x5fda4c24
mov dword [esp + 0xd8], ecx
mov dword [esp + 0xdc], ecx
mov dword [esp + 0xe4], ebx
mov byte [esp + 0xe8], bl
mov dword [esp + 0xec], edx
mov dword [esp + 0xf0], ebx
mov dword [esp + 0xf4], ebx
mov dword [esp + 0xf8], 0x5fda4c40
mov dword [esp + 0xfc], 7
mov dword [esp + 0x100], ebx
mov byte [esp + 0x10c], bl
mov dword [esp + 0x110], edx
mov dword [esp + 0x114], ebx
mov dword [esp + 0x118], ebx
mov dword [esp + 0x11c], 0x5fda563c
mov dword [esp + 0x120], ecx
mov dword [esp + 0x124], ecx
mov dword [esp + 0x12c], ebx
mov byte [esp + 0x130], bl
mov dword [esp + 0x134], 2
mov dword [esp + 0x138], ebx
mov dword [esp + 0x13c], ebx
mov dword [esp + 0x140], 0x5fda5670
mov dword [esp + 0x144], ecx
mov dword [esp + 0x148], ecx
mov dword [esp + 0x14c], eax
mov dword [esp + 0x150], ebx
mov byte [esp + 0x154], bl
mov dword [esp + 0x158], 2
mov dword [esp + 0x15c], ebx
mov dword [esp + 0x160], ebx
mov dword [esp + 0x164], 0x5fda4c4c
lea eax, [esp + 0x54]
mov dword [esp + 0x168], edx
mov dword [esp + 0x170], eax
lea eax, [esp + 0x58]
mov dword [esp + 0x174], eax
lea eax, [esp + 0x50]
mov dword [esp + 0x194], eax
lea eax, [esp + 0x5c]
mov dword [esp + 0x1b8], eax
lea eax, [esp + 0x60]
mov dword [esp + 0x1bc], eax
lea eax, [esp + 0x64]
mov dword [esp + 0x1dc], eax
lea eax, [esp + 0x68]
mov dword [esp + 0x200], eax
lea eax, [esp + 0x6c]
mov dword [esp + 0x224], eax
lea eax, [esp + 0x70]
mov dword [esp + 0x248], eax
lea eax, [esp + 0x74]
mov dword [esp + 0x24c], eax
lea eax, [esp + 0x80]
mov dword [esp + 0x26c], eax
lea eax, [esp + 0x84]
mov dword [esp + 0x16c], ebx
mov byte [esp + 0x178], dl
mov dword [esp + 0x17c], edx
mov dword [esp + 0x180], ebx
mov dword [esp + 0x184], ebx
mov dword [esp + 0x188], 0x5fda56a4
mov dword [esp + 0x18c], ecx
mov dword [esp + 0x190], ecx
mov dword [esp + 0x198], ebx
mov byte [esp + 0x19c], bl
mov dword [esp + 0x1a0], 2
mov dword [esp + 0x1a4], ebx
mov dword [esp + 0x1a8], ebx
mov dword [esp + 0x1ac], 0x5fda56dc
mov dword [esp + 0x1b0], edx
mov dword [esp + 0x1b4], ebx
mov byte [esp + 0x1c0], bl
mov dword [esp + 0x1c4], ecx
mov dword [esp + 0x1c8], ebx
mov dword [esp + 0x1cc], ebx
mov dword [esp + 0x1d0], 0x5fda570c
mov dword [esp + 0x1d4], ecx
mov dword [esp + 0x1d8], ecx
mov dword [esp + 0x1e0], ebx
mov byte [esp + 0x1e4], bl
mov dword [esp + 0x1e8], ecx
mov dword [esp + 0x1ec], ebx
mov dword [esp + 0x1f0], ebx
mov dword [esp + 0x1f4], 0x5fda5750
mov dword [esp + 0x1f8], ecx
mov dword [esp + 0x1fc], ecx
mov dword [esp + 0x204], ebx
mov byte [esp + 0x208], bl
mov dword [esp + 0x20c], ecx
mov dword [esp + 0x210], ebx
mov dword [esp + 0x214], ebx
mov dword [esp + 0x218], 0x5fda5794
mov dword [esp + 0x21c], ecx
mov dword [esp + 0x220], ecx
mov dword [esp + 0x228], ebx
mov byte [esp + 0x22c], bl
mov dword [esp + 0x230], ecx
mov dword [esp + 0x234], ebx
mov dword [esp + 0x238], ebx
mov dword [esp + 0x23c], 0x5fda57c0
mov dword [esp + 0x240], edx
mov dword [esp + 0x244], ebx
mov byte [esp + 0x250], bl
mov dword [esp + 0x254], ecx
mov dword [esp + 0x258], ebx
mov dword [esp + 0x25c], ebx
mov dword [esp + 0x260], 0x5fda57ec
mov dword [esp + 0x264], edx
mov dword [esp + 0x268], ebx
mov dword [esp + 0x270], eax
mov byte [esp + 0x274], bl
mov dword [esp + 0x278], 8
lea eax, [esp + 0x88]
mov dword [esp + 0x27c], ebx
mov dword [esp + 0x290], eax
lea eax, [esp + 0x8c]
mov dword [esp + 0x2b4], eax
lea eax, [esp + 0xac]
mov dword [esp + 0x2c4], eax
lea eax, [esp + 0x90]
mov dword [esp + 0x2d8], eax
lea eax, [esp + 0x94]
mov dword [esp + 0x2dc], eax
lea eax, [esp + 0x98]
mov dword [esp + 0x280], ebx
mov dword [esp + 0x294], ebx
mov dword [esp + 0x2a0], ebx
mov dword [esp + 0x2a4], ebx
mov dword [esp + 0x2b8], ebx
mov dword [esp + 0x2d4], ebx
mov dword [esp + 0x2e8], ebx
mov dword [esp + 0x2ec], ebx
mov dword [esp + 0x300], ebx
mov byte [esp + 0x304], bl
mov dword [esp + 0x30c], ebx
mov dword [esp + 0x310], ebx
mov dword [esp + 0x20], ebx
lea ebx, [esp + 0xb8]
mov dword [esp + 0x284], 0x5fda5810
mov dword [esp + 0x288], ecx
mov dword [esp + 0x28c], ecx
mov byte [esp + 0x298], dl
mov dword [esp + 0x29c], 8
mov dword [esp + 0x2a8], 0x5fda5828
mov dword [esp + 0x2ac], ecx
mov dword [esp + 0x2b0], ecx
mov byte [esp + 0x2bc], dl
mov dword [esp + 0x2c0], 8
mov dword [esp + 0x2c8], ecx
mov dword [esp + 0x2cc], 0x5fda583c
mov dword [esp + 0x2d0], edx
mov byte [esp + 0x2e0], dl
mov dword [esp + 0x2e4], 8
mov dword [esp + 0x2f0], 0x5fda4c74
mov dword [esp + 0x2f4], ecx
mov dword [esp + 0x2f8], ecx
mov dword [esp + 0x2fc], eax
mov dword [esp + 0x308], 0x10
mov eax, dword [ebx - 4]
lea ecx, [esp + 0x2c]
mov dword [esp + 0x3c], eax
mov eax, dword [ebx]
push ecx
mov dword [esp + 0x30], eax
mov eax, dword [ebx + 4]
push eax
lea eax, [esp + 0x44]
push eax
xor eax, eax
push eax
push dword [ebx - 8]
push esi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
je 0x5fda561b
mov eax, dword [ebx - 4]
cmp dword [esp + 0x3c], eax
je 0x5fda4fb5
mov edx, dword [ebx + 4]
mov eax, dword [esp + 0x2c]
test esi, esi
je 0x5fda561b
cmp byte [ebx + 0xc], 1
je 0x5fda560e
mov ecx, dword [ebx + 0x10]
cmp ecx, 1
je 0x5fdb9e90
test dword [esp + 0x78], ecx
jne 0x5fdb9e90
cmp dword [ebx + 0x14], edi
jne 0x5fda5a9b
xor eax, eax
mov esi, eax
mov eax, dword [esp + 0x20]
add ebx, 0x24
inc eax
mov dword [esp + 0x20], eax
cmp eax, 0x11
jae 0x5fda5850
mov esi, dword [esp + 0x30]
jmp 0x5fda55ac
mov ebx, 0x5fde9010
mov ecx, dword [0x5fde9010]
cmp dword [esp + 0x7c], 2
ja 0x5fdb9e88
test esi, esi
jne 0x5fda5a7b
test byte [esp + 0x78], 0x1e
je 0x5fdb9ee2
test byte [esp + 0x78], 2
jne 0x5fdb9f16
test byte [esp + 0x78], 4
jne 0x5fdb9f69
test byte [esp + 0x78], 8
jne 0x5fdb9fcd
test byte [esp + 0x78], 0x10
je 0x5fda5ad0
lea edx, [esp + 0x14]
lea ecx, [esp + 0x40]
call fcn.5fda4d4e
mov esi, eax
test esi, esi
jne 0x5fdba01d
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
test ecx, ecx
jne 0x5fda58e0
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x5fda58e0
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x5fda58e0
test ebx, ebx
je 0x5fdba04c
mov edx, dword [esp + 0x44]
mov eax, dword [esp + 0x40]
shr edx, 1
mov dword [esp + 0x18], edx
xor edx, edx
mov dword [esp + 0x14], eax
cmp word [eax], dx
mov edx, dword [esp + 0x18]
je 0x5fda5a4b
xor ecx, ecx
mov dword [esp + 0x30], ecx
lea ecx, [esp + 0x20]
push ecx
mov ecx, eax
call fcn.5fda7043
test eax, eax
js 0x5fda5aee
cmp dword [esp + 0x20], 0
je 0x5fda5a47
test byte [esp + 0x78], 0x1e
je 0x5fda5aee
push 0x34
pop ecx
call fcn.5fd85d21
mov edi, eax
test edi, edi
je 0x5fda5ad9
xor ecx, ecx
inc ecx
lock xadd dword [edi], ecx
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x30]
xor edx, edx
push eax
inc edx
call fcn.5fd85671
test eax, eax
js 0x5fda5ae4
mov esi, dword [esp + 0x30]
xor eax, eax
shld eax, esi, 1
xor ecx, ecx
add esi, esi
cmp eax, ecx
ja 0x5fda5ae4
jb 0x5fda5984
cmp esi, 0xffffffff
ja 0x5fda5ae4
mov ecx, esi
call fcn.5fd85d21
mov dword [edi + 0x24], eax
test eax, eax
je 0x5fda5ad9
push esi
push dword [esp + 0x18]
push eax
call sub.api_ms_win_core_crt_l1_1_0.dll_memcpy
mov eax, dword [edi + 0x24]
mov ecx, esi
shr ecx, 1
xor edx, edx
add esp, 0xc
mov word [eax + ecx*2 - 2], dx
mov dword [edi + 0x28], esi
mov eax, dword [esp + 0x78]
test al, 2
jne 0x5fdba053
xor esi, esi
test al, 4
jne 0x5fdba078
test al, 8
jne 0x5fdba09b
test al, 0x10
je 0x5fda59e7
test ebx, ebx
je 0x5fda59e7
xor eax, eax
mov dword [edi + 0x30], ebx
inc eax
lock xadd dword [ebx], eax
mov ebx, esi
mov eax, dword [esp + 0x54]
test eax, eax
je 0x5fda59f8
cmp word [eax], si
jne 0x5fdba0be
mov esi, dword [esp + 0xa4]
mov ecx, esi
push edi
call dword [0x5fdec34c]
call esi
mov esi, eax
test esi, esi
jne 0x5fdba179
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
lea eax, [eax + ecx*2]
add eax, 2
mov dword [esp + 0x14], eax
or eax, 0xffffffff
sub eax, ecx
mov ecx, edi
add dword [esp + 0x18], eax
call fcn.5fda6f68
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov edi, ecx
cmp word [eax], cx
jne 0x5fdba169
mov ecx, dword [esp + 0x10]
test ecx, ecx
jne 0x5fdba1af
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x5fdba1b9
mov eax, dword [esp + 0x28]
test eax, eax
jne 0x5fdba1c5
test ebx, ebx
jne 0x5fdba1d1
test edi, edi
jne 0x5fdba1dd
lea ecx, [esp + 0x40]
call fcn.5fda4d91
mov ecx, dword [esp + 0x31c]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.5fd83560
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebx + 0x18]
test ecx, ecx
je 0x5fda5617
cmp eax, ecx
jb 0x5fda5617
push ecx
push dword [ebx + 0x14]
push edx
call sub.api_ms_win_core_crt_l1_1_0.dll_memcpy
add esp, 0xc
jmp 0x5fda5617
mov edx, dword [ebx + 4]
jmp 0x5fda55ee
push 8
pop esi
jmp 0x5fda5850
mov ebx, dword [esp + 0x24]
jmp 0x5fda58c0
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_GetLastError]
jmp 0x5fdba172
mov esi, 0x216
jmp 0x5fda5a47
push 0x57
pop esi
jmp 0x5fda5a47
push 0x32
pop esi
jmp 0x5fda5a7b
mov ecx, dword [0x5fde9010]
mov ebx, 0x5fde9010
cmp ecx, ebx
je 0x5fda585b
test dword [ecx + 0x1c], 0x400
je 0x5fda585b
mov edx, dword [esp + 0x40]
test edx, edx
jne 0x5fdb9ebd
mov edx, 0x5fdbd20c
imul eax, dword [esp + 0x20], 0x24
push dword [esp + eax + 0xb0]
push edx
push dword [ecx + 0x14]
mov edx, 0x5fdbda58
push dword [ecx + 0x10]
push 0xa
pop ecx
call fcn.5fdc7ecc
jmp 0x5fda5855
push 0x32
pop esi
cmp ecx, ebx
je 0x5fda5a7b
test dword [ecx + 0x1c], 0x400
je 0x5fda5a7b
push dword [esp + 0x78]
mov edx, 0x5fdbda58
push dword [ecx + 0x14]
push dword [ecx + 0x10]
push 0xb
pop ecx
call fcn.5fdc7d09
jmp 0x5fda5a7b
lea edx, [esp + 0x38]
lea ecx, [esp + 0x40]
call fcn.5fdd18b6
mov esi, eax
test esi, esi
je 0x5fdb9f5c
mov eax, dword [0x5fde9010]
cmp eax, ebx
je 0x5fdb9f4f
test dword [eax + 0x1c], 0x400
je 0x5fdb9f4f
push esi
push dword [eax + 0x14]
mov edx, 0x5fdbda58
push dword [eax + 0x10]
push 0xc
pop ecx
call fcn.5fdc7d09
mov ecx, dword [esp + 0x38]
mov ebx, dword [esp + 0x24]
jmp 0x5fda5a4b
mov eax, dword [esp + 0x38]
mov dword [esp + 0x10], eax
jmp 0x5fda5884
call fcn.5fdd2363
test al, al
je 0x5fda588f
lea edx, [esp + 0x34]
lea ecx, [esp + 0x40]
call fcn.5fdd1790
mov esi, eax
test esi, esi
je 0x5fdb9fc0
mov eax, dword [0x5fde9010]
cmp eax, ebx
je 0x5fdb9faf
test dword [eax + 0x1c], 0x400
je 0x5fdb9faf
push esi
push dword [eax + 0x14]
mov edx, 0x5fdbda58
push dword [eax + 0x10]
push 0xd
pop ecx
call fcn.5fdc7d09
mov eax, dword [esp + 0x34]
mov dword [esp + 0x1c], eax
mov ebx, dword [esp + 0x24]
jmp 0x5fda5a47
mov eax, dword [esp + 0x34]
mov dword [esp + 0x1c], eax
jmp 0x5fda588f
lea edx, [esp + 0x18]
lea ecx, [esp + 0x40]
call fcn.5fdd1918
mov esi, eax
test esi, esi
je 0x5fdba010
mov eax, dword [0x5fde9010]
cmp eax, ebx
je 0x5fdba006
test dword [eax + 0x1c], 0x400
je 0x5fdba006
push esi
push dword [eax + 0x14]
mov edx, 0x5fdbda58
push dword [eax + 0x10]
push 0xe
pop ecx
call fcn.5fdc7d09
mov eax, dword [esp + 0x18]
mov dword [esp + 0x28], eax
jmp 0x5fdb9fb7
mov eax, dword [esp + 0x18]
mov dword [esp + 0x28], eax
jmp 0x5fda589a
mov eax, dword [0x5fde9010]
cmp eax, ebx
je 0x5fdba043
test dword [eax + 0x1c], 0x400
je 0x5fdba043
push esi
push dword [eax + 0x14]
mov edx, 0x5fdbda58
push dword [eax + 0x10]
push 0xf
pop ecx
call fcn.5fdc7d09
mov ebx, dword [esp + 0x14]
jmp 0x5fda5a47
mov esi, eax
jmp 0x5fda5a7b
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x5fda59c1
xor eax, eax
mov dword [edi + 0x14], ecx
inc eax
lock xadd dword [ecx], eax
mov eax, dword [esp + 0x78]
xor esi, esi
mov dword [esp + 0x10], esi
jmp 0x5fda59c3
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x5fda59cb
xor eax, eax
mov dword [edi + 0x18], ecx
inc eax
lock xadd dword [ecx], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 0x1c], esi
jmp 0x5fda59cb
mov ecx, dword [esp + 0x28]
test ecx, ecx
je 0x5fda59d3
xor eax, eax
mov dword [edi + 0x2c], ecx
inc eax
lock xadd dword [ecx], eax
mov eax, dword [esp + 0x78]
mov dword [esp + 0x28], esi
jmp 0x5fda59d3
cmp dword [edi + 0x14], esi
je 0x5fdba10f
mov ecx, dword [esp + 0x58]
call fcn.5fd85d21
mov ecx, dword [edi + 0x14]
mov dword [ecx + 0x34], eax
mov eax, dword [edi + 0x14]
cmp dword [eax + 0x34], 0
je 0x5fda5ad9
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [eax + 0x34]
call sub.api_ms_win_core_crt_l1_1_0.dll_memcpy
mov eax, dword [edi + 0x14]
add esp, 0xc
mov ecx, dword [esp + 0x58]
shr ecx, 1
xor edx, edx
mov eax, dword [eax + 0x34]
mov word [eax + ecx*2 - 2], dx
mov ecx, dword [edi + 0x14]
mov eax, dword [esp + 0x58]
mov dword [ecx + 0x38], eax
cmp dword [edi + 0x18], esi
je 0x5fda59f8
mov ecx, dword [esp + 0x58]
call fcn.5fd85d21
mov ecx, dword [edi + 0x18]
mov dword [ecx + 0x58], eax
mov eax, dword [edi + 0x18]
cmp dword [eax + 0x58], 0
je 0x5fda5ad9
push dword [esp + 0x58]
push dword [esp + 0x58]
push dword [eax + 0x58]
call sub.api_ms_win_core_crt_l1_1_0.dll_memcpy
mov eax, dword [edi + 0x18]
add esp, 0xc
mov ecx, dword [esp + 0x58]
shr ecx, 1
xor edx, edx
mov eax, dword [eax + 0x58]
mov word [eax + ecx*2 - 2], dx
mov ecx, dword [edi + 0x18]
mov eax, dword [esp + 0x58]
mov dword [ecx + 0x5c], eax
jmp 0x5fda59f8
mov edx, dword [esp + 0x18]
jmp 0x5fda5903
mov esi, eax
jmp 0x5fda5a47
mov eax, dword [0x5fde9010]
cmp eax, 0x5fde9010
je 0x5fda5a47
test dword [eax + 0x1c], 0x400
je 0x5fda5a47
push esi
push dword [eax + 0x14]
mov edx, 0x5fdbda58
push dword [eax + 0x10]
push 0x10
pop ecx
call fcn.5fdc7d09
jmp 0x5fda5a47
call fcn.5fdd1ac1
jmp 0x5fda5a53
mov ecx, eax
call fcn.5fdd1a59
jmp 0x5fda5a5f
mov ecx, eax
call fcn.5fdd1b08
jmp 0x5fda5a6b
mov ecx, ebx
call fcn.5fd83e2e
jmp 0x5fda5a73
mov ecx, edi
call fcn.5fda6f68
jmp 0x5fda5a7b