Function at 0x53bb70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc24
mov eax, dword [0x62d12c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, ecx
xor edi, edi
push 0x7fe
lea ecx, [ebp - 0xc02]
xor eax, eax
push edi
push ecx
mov dword [ebp - 0xc10], esi
mov dword [ebp - 0xc14], edi
mov word [ebp - 0xc04], ax
call fcn.0055aed0
push 9
push str.softwaremicrosoftwindows_ntcurrentversionperflib
push str._s_03x
lea edx, [ebp - 0xc04]
push 0x3ff
push edx
mov dword [ebp - 0xc18], 0x100
mov dword [ebp - 0xc0c], edi
mov dword [ebp - 0xc20], edi
call fcn.005613c2
add esp, 0x20
lea ecx, [ebp - 0xc14]
push ecx
push 0x20019
push edi
lea edx, [ebp - 0xc04]
push edx
xor eax, eax
push reloc.OLEAUT32.dll_SysReAllocString
mov word [ebp - 0x406], ax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x53bc4c
mov eax, dword [esi + 8]
push eax
call fcn.0053a1b0
add esp, 4
test al, al
je 0x53c0b6
mov ecx, dword [esi + 8]
push 0x62b628
push 0x346
push str.ReportEnvironment::ReportCurrentProcessesNT
push str._ENV__Could_not_open_performance_registry_key_
push edi
push edi
push edi
push 3
call ecx
add esp, 0x20
jmp 0x53c0b6
mov ecx, dword [ebp - 0xc14]
lea edx, [ebp - 0xc08]
push edx
push edi
lea eax, [ebp - 0xc1c]
push eax
push edi
push str.Counters
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x53bcac
mov edx, dword [esi + 8]
push edx
call fcn.0053a1b0
add esp, 4
test al, al
je 0x53c0b6
mov eax, dword [esi + 8]
push 0x62b628
push 0x356
push str.ReportEnvironment::ReportCurrentProcessesNT
push str._ENV__Could_not_open_counter_registry_key_
push edi
push edi
push edi
push 3
call eax
add esp, 0x20
jmp 0x53c0b6
mov edi, dword [ebp - 0xc08]
push ebx
push edi
call fcn.0055b249
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x53bce5
mov ecx, dword [esi + 8]
push ecx
call fcn.0053a1b0
add esp, 4
test al, al
je 0x53c0b5
push 0x62b628
push 0x360
jmp 0x53be52
push edi
push 0
push ebx
call fcn.0055aed0
mov edx, dword [ebp - 0xc14]
add esp, 0xc
lea eax, [ebp - 0xc08]
push eax
push ebx
lea ecx, [ebp - 0xc1c]
push ecx
push 0
push str.Counters
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x53bd45
mov eax, dword [esi + 8]
push eax
call fcn.0053a1b0
add esp, 4
test al, al
je 0x53c0a8
push 0x62b628
push 0x372
push str.ReportEnvironment::ReportCurrentProcessesNT
push str._ENV__Could_Not_Read_the_counter_Names_
jmp 0x53c098
cmp word [ebx], 0
mov edi, ebx
je 0x53be0e
push str.process
push edi
call fcn.0055ade6
add esp, 8
test eax, eax
jne 0x53bda3
lea esi, [edi - 4]
cmp esi, ebx
jb 0x53bd87
lea ebx, [ebx]
movzx edx, word [esi]
push edx
call fcn.0055bab3
add esp, 4
test eax, eax
je 0x53bd87
sub esi, 2
cmp esi, ebx
jae 0x53bd70
lea eax, [esi + 2]
lea edx, [ebp - 0xc04]
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x53bd92
jmp 0x53bde9
push str.id_process
push edi
call fcn.0055ade6
add esp, 8
test eax, eax
jne 0x53bde9
lea esi, [edi - 4]
cmp esi, ebx
jb 0x53bdd7
lea esp, [esp]
movzx eax, word [esi]
push eax
call fcn.0055bab3
add esp, 4
test eax, eax
je 0x53bdd7
sub esi, 2
cmp esi, ebx
jae 0x53bdc0
add esi, 2
push esi
call fcn.0055c838
add esp, 4
mov dword [ebp - 0xc0c], eax
mov eax, edi
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x53bdf0
sub eax, edx
sar eax, 1
cmp word [edi + eax*2 + 2], cx
lea edi, [edi + eax*2 + 2]
jne 0x53bd51
push ebx
call fcn.0055a19c
mov esi, 0xc800
push esi
mov dword [ebp - 0xc08], esi
call fcn.0055b249
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x53be71
mov esi, dword [ebp - 0xc10]
mov ecx, dword [esi + 8]
push ecx
call fcn.0053a1b0
add esp, 4
test al, al
je 0x53c0b5
push 0x62b628
push 0x39f
mov edx, dword [esi + 8]
push str.ReportEnvironment::ReportCurrentProcessesNT
push str._ENV__Out_of_Memory_
push 0
push 0
push 0
push 3
call edx
add esp, 0x20
jmp 0x53c0b5
push esi
push 0
push ebx
call fcn.0055aed0
add esp, 0xc
lea eax, [ebp - 0xc08]
push eax
push ebx
lea ecx, [ebp - 0xc1c]
push ecx
push 0
lea edx, [ebp - 0xc04]
push edx
push reloc.OLEAUT32.dll_SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x53bed5
cmp eax, 0xea
jne 0x53c06e
add esi, 0x6400
push esi
push ebx
call fcn.0055bff2
add esp, 8
test eax, eax
je 0x53c035
push esi
push 0
mov ebx, eax
mov dword [ebp - 0xc08], esi
push eax
jmp 0x53be75
cmp dword [ebp - 0xc08], 0
jbe 0x53c06e
test ebx, ebx
je 0x53c06e
cmp word [ebx], 0x50
jne 0x53c06e
cmp word [ebx + 2], 0x45
jne 0x53c06e
cmp word [ebx + 4], 0x52
jne 0x53c06e
cmp word [ebx + 6], 0x46
jne 0x53c06e
mov edx, dword [ebx + 0x18]
mov eax, dword [edx + ebx + 0x28]
add edx, ebx
mov dword [ebp - 0xc24], eax
cmp eax, 0x100
lea eax, [ebp - 0xc24]
jb 0x53bf37
lea eax, [ebp - 0xc18]
mov esi, dword [eax]
mov eax, dword [edx + 4]
mov ecx, dword [edx + 8]
add eax, edx
add ecx, edx
cmp ecx, eax
jae 0x53bf6c
jmp 0x53bf50
mov edx, dword [ebp - 0xc0c]
cmp dword [ecx + 4], edx
je 0x53bf63
add ecx, dword [ecx]
cmp ecx, eax
jb 0x53bf50
jmp 0x53bf6c
mov ecx, dword [ecx + 0x24]
mov dword [ebp - 0xc20], ecx
test esi, esi
je 0x53c0a8
mov dword [ebp - 0xc0c], esi
lea ebx, [ebx]
mov esi, dword [eax]
mov edi, dword [eax + 0x10]
mov edx, dword [ebp - 0xc20]
mov ecx, dword [ebp - 0xc10]
add esi, eax
add edi, eax
mov eax, dword [edx + esi]
mov edx, dword [ecx + 8]
push edx
mov dword [ebp - 0xc18], eax
call fcn.0053a1b0
add esp, 4
test al, al
je 0x53c023
xor eax, eax
push 0x3fe
push eax
lea ecx, [ebp - 0x402]
push ecx
mov word [ebp - 0x404], ax
call fcn.0055aed0
mov edx, dword [ebp - 0xc18]
push edx
push edi
push str._ENV__Running_Process:__s__ID:__u
lea eax, [ebp - 0x404]
push 0x1ff
push eax
call fcn.005301b0
mov edi, dword [ebp - 0xc10]
mov ecx, dword [edi + 8]
push ecx
call fcn.0053a1b0
add esp, 0x24
test al, al
je 0x53c023
mov eax, dword [edi + 8]
push 0x62b628
push 0x3f1
push str.ReportEnvironment::ReportCurrentProcessesNT
lea edx, [ebp - 0x404]
push edx
push 0
push 0
push 0
push 3
call eax
add esp, 0x20
mov eax, dword [esi]
add eax, esi
dec dword [ebp - 0xc0c]
jne 0x53bf80
jmp 0x53c0a8
mov esi, dword [ebp - 0xc10]
mov ecx, dword [esi + 8]
push ecx
call fcn.0053a1b0
add esp, 4
test al, al
je 0x53c0a8
mov edx, dword [esi + 8]
push 0x62b628
push 0x3c9
push str.ReportEnvironment::ReportCurrentProcessesNT
push str._ENV__Could_Not_Allocate_Performance_Data_
push 0
push 0
push 0
push 3
call edx
jmp 0x53c0a5
mov esi, dword [ebp - 0xc10]
mov eax, dword [esi + 8]
push eax
call fcn.0053a1b0
add esp, 4
test al, al
je 0x53c0a8
push 0x62b628
push 0x3cf
push str.ReportEnvironment::ReportCurrentProcessesNT
push str._ENV__Could_Not_Obtain_Performance_Data_
mov ecx, dword [esi + 8]
push 0
push 0
push 0
push 3
call ecx
add esp, 0x20
test ebx, ebx
je 0x53c0b5
push ebx
call fcn.0055a19c
add esp, 4
pop ebx
mov edx, dword [ebp - 0xc14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call esi
push reloc.OLEAUT32.dll_SysReAllocStringLen
call esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00558b78
mov esp, ebp
pop ebp
ret