Function at 0x5c63fd
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x5bc
mov eax, 0x6dc7d7
call fcn.00648b50
mov esi, dword [ebp + 8]
push str.NewTreeNetwork::SharesFill
push ecx
lea ecx, [ebp - 0x5a8]
call fcn.005a14e8
xor ebx, ebx
lea ecx, [ebp - 0x450]
push 0x69c
mov dword [ebp - 4], ebx
call fcn.006c22f9
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x4a8]
push eax
mov dword [ebp - 0x4b0], ebx
call fcn.0052b35a
mov dword [ebp - 0x478], ebx
mov dword [ebp - 0x458], ebx
mov dword [ebp - 0x454], ebx
lea eax, [ebp - 0x4b0]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x58c]
mov ecx, esi
push eax
call fcn.005ad1f2
lea ecx, [ebp - 0x478]
mov byte [ebp - 4], 5
call fcn.0051f634
lea ecx, [ebp - 0x4a8]
call fcn.006c2344
lea ecx, [ebp - 0x450]
mov byte [ebp - 4], 6
call fcn.006c2344
lea eax, [ebp - 0x58c]
push eax
lea ecx, [ebp - 0x5c0]
call fcn.005ad02d
lea ecx, [ebp - 0x584]
mov byte [ebp - 4], 7
call fcn.00592f1a
mov esi, dword [ebp - 0x584]
push dword [esi + 0x274]
push dword [esi + 0x270]
call fcn.0059ad80
mov eax, dword [esi + 0x270]
mov dword [esi + 0x274], eax
xor esi, esi
mov edi, esi
mov dword [ebp - 0x568], esi
mov dword [ebp - 0x530], edi
mov dword [ebp - 0x564], esi
mov dword [ebp - 0x560], esi
mov dword [ebp - 0x550], esi
mov dword [ebp - 0x54c], esi
mov dword [ebp - 0x548], esi
mov ebx, 0x20019
mov byte [ebp - 4], 0xa
push ebx
push str.SYSTEMCurrentControlSetServicesLanmanServerShares
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x568]
call fcn.0051e4ac
test eax, eax
jne 0x5c68a4
push 0x208
lea eax, [ebp - 0x420]
push esi
push eax
call fcn.0066f220
add esp, 0xc
mov dword [ebp - 0x56c], esi
mov eax, 0x104
mov dword [ebp - 0x570], eax
mov dword [ebp - 0x538], eax
lea eax, [ebp - 0x5c8]
push eax
lea eax, [ebp - 0x590]
push eax
lea eax, [ebp - 0x594]
push eax
lea eax, [ebp - 0x598]
push eax
lea eax, [ebp - 0x534]
push eax
lea eax, [ebp - 0x59c]
push eax
lea eax, [ebp - 0x5a0]
push eax
lea eax, [ebp - 0x56c]
push eax
push esi
lea eax, [ebp - 0x570]
push eax
lea eax, [ebp - 0x420]
push eax
push dword [ebp - 0x568]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
lea ecx, [ebp - 0x568]
call fcn.0051e50a
cmp dword [ebp - 0x534], esi
je 0x5c68a4
push ebx
push str.SYSTEMCurrentControlSetServicesLanmanServerShares
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x550]
call fcn.0051e4ac
mov ebx, esi
mov dword [ebp - 0x544], ebx
cmp dword [ebp - 0x534], ebx
jbe 0x5c6891
push esi
push esi
push esi
xor eax, eax
mov dword [ebp - 0x538], 0x104
push esi
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x538]
push eax
lea eax, [ebp - 0x218]
push eax
push ebx
push dword [ebp - 0x550]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x5c687e
mov dword [ebp - 0x55c], esi
mov dword [ebp - 0x558], esi
mov dword [ebp - 0x554], esi
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 0xb
push eax
call fcn.0068cfcb
pop ecx
cmp word [ebp + eax*2 - 0x21a], 0x24
je 0x5c686f
lea eax, [ebp - 0x55c]
push eax
lea edx, [ebp - 0x218]
lea ecx, [ebp - 0x550]
call fcn.0058e550
pop ecx
test eax, eax
jne 0x5c686f
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x540]
call fcn.00515719
mov byte [ebp - 4], 0xc
call fcn.00515e26
push eax
lea ecx, [ebp - 0x52c]
call fcn.00515c3a
mov byte [ebp - 4], 0xd
mov esi, dword [ebp - 0x55c]
mov ebx, dword [ebp - 0x558]
cmp esi, ebx
je 0x5c6735
mov ecx, dword [esi]
sub ecx, 0x10
call fcn.00515476
lea edi, [eax + 0x10]
mov dword [ebp - 0x53c], edi
push 0
push 0x764138
lea ecx, [ebp - 0x53c]
mov byte [ebp - 4], 0xe
call fcn.00514fc9
test eax, eax
jne 0x5c6724
mov eax, dword [edi - 0xc]
lea ecx, [ebp - 0x53c]
add eax, 0xfffffffb
push eax
lea eax, [ebp - 0x574]
push eax
call fcn.0058efe6
push eax
lea ecx, [ebp - 0x52c]
mov byte [ebp - 4], 0xf
call fcn.005154cf
mov ecx, dword [ebp - 0x574]
lea ecx, [ecx - 0x10]
call fcn.00515ed6
lea ecx, [edi - 0x10]
mov byte [ebp - 4], 0xd
call fcn.00515ed6
add esi, 4
jmp 0x5c66bc
mov esi, dword [ebp - 0x52c]
mov ebx, dword [ebp - 0x544]
cmp dword [esi - 0xc], 0
je 0x5c6851
lea eax, [ebp - 0x52c]
push eax
lea ecx, [ebp - 0x480]
call fcn.006c22ac
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 0x10
push eax
lea ecx, [ebp - 0x450]
call fcn.00515719
xor eax, eax
mov dword [ebp - 0x448], eax
mov dword [ebp - 0x428], eax
push eax
push eax
lea eax, [ebp - 0x480]
mov byte [ebp - 4], 0x11
push eax
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 0x528]
call fcn.00530696
push eax
lea eax, [ebp - 0x57c]
mov byte [ebp - 4], 0x12
push eax
lea ecx, [ebp - 0x5c0]
call fcn.005ad24e
mov byte [ebp - 4], 0x13
mov ecx, dword [ebp - 0x578]
test ecx, ecx
je 0x5c67ca
call fcn.0051578b
lea ecx, [ebp - 0x528]
call fcn.00530663
lea ecx, [ebp - 0x450]
call fcn.006c2344
lea ecx, [ebp - 0x480]
mov byte [ebp - 4], 0xd
call fcn.006c2344
lea edx, [ebp - 0x52c]
lea ecx, [ebp - 0x438]
call fcn.00590d8b
mov edi, eax
lea edx, [ebp - 0x540]
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x468]
call fcn.00590d8b
mov edx, edi
mov byte [ebp - 4], 0x15
mov ecx, eax
call fcn.00593288
push 0
push 1
lea ecx, [ebp - 0x468]
call fcn.00529114
push 0
push 1
lea ecx, [ebp - 0x438]
call fcn.00529114
mov edi, dword [ebp - 0x530]
inc edi
mov dword [ebp - 0x530], edi
jmp 0x5c6857
mov edi, dword [ebp - 0x530]
lea ecx, [esi - 0x10]
call fcn.00515ed6
mov ecx, dword [ebp - 0x540]
lea ecx, [ecx - 0x10]
call fcn.00515ed6
xor esi, esi
lea ecx, [ebp - 0x55c]
mov byte [ebp - 4], 0xa
call fcn.0051a227
inc ebx
mov dword [ebp - 0x544], ebx
cmp ebx, dword [ebp - 0x534]
jb 0x5c65f8
lea ecx, [ebp - 0x550]
call fcn.0051e50a
test edi, edi
jne 0x5c6946
push esi
lea ecx, [ebp - 0x480]
call fcn.00515719
mov dword [ebp - 0x478], esi
mov dword [ebp - 0x458], esi
push str.No_network_shares
lea ecx, [ebp - 0x450]
mov byte [ebp - 4], 0x16
call fcn.00515719
mov dword [ebp - 0x448], esi
mov dword [ebp - 0x428], esi
push esi
push esi
lea eax, [ebp - 0x480]
mov byte [ebp - 4], 0x17
push eax
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 0x528]
call fcn.00530696
push eax
lea eax, [ebp - 0x57c]
mov byte [ebp - 4], 0x18
push eax
lea ecx, [ebp - 0x5c0]
call fcn.005ad24e
mov byte [ebp - 4], 0x19
mov ecx, dword [ebp - 0x578]
test ecx, ecx
je 0x5c6925
call fcn.0051578b
lea ecx, [ebp - 0x528]
call fcn.00530663
lea ecx, [ebp - 0x450]
call fcn.006c2344
lea ecx, [ebp - 0x480]
call fcn.006c2344
lea ecx, [ebp - 0x550]
call fcn.0051e50a
lea ecx, [ebp - 0x568]
call fcn.0051e50a
mov byte [ebp - 4], 0x1a
mov ecx, dword [ebp - 0x580]
test ecx, ecx
je 0x5c696f
call fcn.0051578b
lea ecx, [ebp - 0x5c0]
call fcn.005ad08b
mov byte [ebp - 4], 0x1b
mov ecx, dword [ebp - 0x588]
test ecx, ecx
je 0x5c698d
call fcn.0051578b
lea ecx, [ebp - 0x5a8]
call fcn.005a1446
call fcn.00648afa
ret 4