Function at 0x535ca0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x58
push 0
push 0
dec ecx
jne 0x535ca9
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5360cd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.00404474
cmp dword [ebp - 8], 0
je 0x535cf7
push dword [ebp - 0x14]
push 0x5360e4
push dword [ebp - 8]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.0040476c
lea eax, [ebp - 0x18]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 0x14]
call fcn.004048ac
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x5360a7
xor eax, eax
push ebp
push 0x5360a0
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp - 9], 0
jne 0x535d4c
mov eax, dword [ebp - 8]
call fcn.004048ac
mov edx, eax
lea eax, [ebp - 0x91]
call fcn.00409d84
mov byte [ebp - 0x25], 1
jmp 0x535db3
cmp byte [ebp - 9], 1
jne 0x535d7e
mov dword [ebp - 0x24], 0x65
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x91]
push eax
push 0
push 0
push 0x5360e8
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
sete byte [ebp - 0x25]
jmp 0x535db3
cmp byte [ebp - 9], 2
jne 0x535d9d
mov esi, 0x5360fc
lea edi, [ebp - 0x91]
mov ecx, 0x19
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov byte [ebp - 0x25], 1
jmp 0x535db3
mov ecx, 0x53616c
mov dl, 1
mov eax, dword [0x407d88]
call fcn.0040da34
call fcn.00403d74
cmp byte [ebp - 0x25], 0
je 0x536089
mov dword [ebp - 0x24], pe_nt_image_headers32
cmp byte [ebp - 9], 2
jne 0x535def
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x191]
push eax
push 0
push 0
push 0x536188
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
sete byte [ebp - 0x25]
jmp 0x535e12
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x191]
push eax
push 0
push 0
push 0x536190
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
sete byte [ebp - 0x25]
cmp byte [ebp - 0x25], 0
je 0x536089
xor eax, eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 8]
dec eax
test eax, eax
jl 0x535e78
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0x10]
call fcn.0041e8fc
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x20]
call fcn.004048ac
lea edx, [ebp - 0x91]
call fcn.00408e24
test eax, eax
je 0x535e78
xor eax, eax
mov dword [ebp - 0x1c], eax
inc dword [ebp - 0x10]
dec dword [ebp - 0x2c]
jne 0x535e3d
cmp dword [ebp - 0x1c], 0
jne 0x53604b
mov byte [ebp - 0x1d], 0
mov dword [ebp - 0x24], 0xb
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x29c]
push eax
push 0
push 0
push 0x53619c
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x535ecb
mov edx, 0x5361a4
lea eax, [ebp - 0x29c]
mov ecx, 3
call fcn.00409e88
test eax, eax
jne 0x535ecb
mov byte [ebp - 0x1d], 1
mov dword [ebp - 0x24], pe_nt_image_headers32
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x291]
push eax
push 0
push 0
push 0x5361a8
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x535efa
mov byte [ebp - 0x291], 0
cmp byte [ebp - 9], 2
jne 0x535fe1
lea eax, [ebp - 0x2a4]
lea edx, [ebp - 0x191]
mov ecx, pe_nt_image_headers32
call fcn.0040465c
mov eax, dword [ebp - 0x2a4]
lea edx, [ebp - 0x2a0]
call fcn.00409c50
cmp dword [ebp - 0x2a0], 0
je 0x535fe1
lea eax, [ebp - 0x2ac]
lea edx, [ebp - 0x191]
mov ecx, pe_nt_image_headers32
call fcn.0040465c
mov eax, dword [ebp - 0x2ac]
lea edx, [ebp - 0x2a8]
call fcn.00409c18
mov eax, dword [ebp - 0x2a8]
push eax
lea eax, [ebp - 0x2b0]
lea edx, [ebp - 0x291]
mov ecx, pe_nt_image_headers32
call fcn.0040465c
mov eax, dword [ebp - 0x2b0]
push eax
mov al, byte [ebp - 0x1d]
push eax
lea eax, [ebp - 0x2b8]
lea edx, [ebp - 0x191]
mov ecx, pe_nt_image_headers32
call fcn.0040465c
mov eax, dword [ebp - 0x2b8]
lea edx, [ebp - 0x2b4]
call fcn.00409afc
mov eax, dword [ebp - 0x2b4]
push eax
lea eax, [ebp - 0x2bc]
lea edx, [ebp - 0x91]
mov ecx, 0x65
call fcn.0040465c
mov edx, dword [ebp - 0x2bc]
mov eax, dword [0x59bac0]
pop ecx
call fcn.00535960
mov dword [ebp - 0x1c], eax
jmp 0x53604b
push 0
lea eax, [ebp - 0x2c0]
lea edx, [ebp - 0x291]
mov ecx, pe_nt_image_headers32
call fcn.0040465c
mov eax, dword [ebp - 0x2c0]
push eax
mov al, byte [ebp - 0x1d]
push eax
lea eax, [ebp - 0x2c4]
lea edx, [ebp - 0x191]
mov ecx, pe_nt_image_headers32
call fcn.0040465c
mov eax, dword [ebp - 0x2c4]
push eax
lea eax, [ebp - 0x2c8]
lea edx, [ebp - 0x91]
mov ecx, 0x65
call fcn.0040465c
mov edx, dword [ebp - 0x2c8]
mov eax, dword [0x59bac0]
pop ecx
call fcn.00535960
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
cmp dword [eax + 0x14], 0
jne 0x536089
cmp dword [ebp - 0x1c], 0
je 0x536089
cmp dword [ebp - 8], 0
jne 0x536089
cmp byte [ebp - 9], 2
je 0x536089
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x24]
call fcn.00535b4c
pop ecx
test al, al
je 0x536089
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x1c]
mov dword [eax + 0x14], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5360a7
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5360d4
lea eax, [ebp - 0x2c8]
mov edx, 0xb
call fcn.00404400
lea eax, [ebp - 0x14]
call fcn.004043dc
ret