Function at 0x5ba8034c
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x6cc
mov eax, dword [0x5bb70c3c]
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x674], si
lea edi, [ebp - 0x672]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
push 8
xor eax, eax
pop ecx
mov dword [ebp - 0x690], esi
lea edi, [ebp - 0x68c]
stosd dword es:[edi], eax
push 6
lea edi, [ebp - 0x6cc]
rep stosd dword es:[edi], eax
pop ecx
lea edi, [ebp - 0x6ac]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x65c]
push eax
mov ebx, 0x20019
push ebx
push 0x5ba4c928
mov dword [ebp - 0x684], esi
mov dword [ebp - 0x65c], esi
mov dword [ebp - 0x688], esi
mov dword [ebp - 0x660], esi
mov dword [ebp - 0x694], esi
mov dword [ebp - 0x634], esi
mov dword [ebp - 0x654], esi
mov dword [ebp - 0x630], esi
mov dword [ebp - 0x648], esi
mov dword [ebp - 0x64c], esi
mov dword [ebp - 0x638], esi
mov dword [ebp - 0x640], esi
mov dword [ebp - 0x678], esi
mov dword [ebp - 0x63c], esi
mov dword [ebp - 0x658], esi
mov dword [ebp - 0x644], esi
mov dword [ebp - 0x67c], esi
mov dword [ebp - 0x664], esi
mov dword [ebp - 0x650], esi
call fcn.5ba6c9c3
test eax, eax
jne 0x5ba80c41
push esi
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x688]
push eax
push esi
push esi
push esi
push dword [ebp - 0x65c]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x5ba80c41
cmp dword [ebp - 0x688], esi
je 0x5ba80c41
lea eax, [ebp - 0x694]
push eax
lea eax, [ebp - 0x660]
push eax
push 0xf003f
push 0x5ba4f194
call fcn.5ba7bd2a
test eax, eax
jne 0x5ba80c41
push 4
lea eax, [ebp - 0x634]
push eax
push 4
push esi
push 0x5ba4cabc
push dword [ebp - 0x660]
mov dword [ebp - 0x634], 0x50000
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x5ba80c41
lea eax, [ebp - 0x634]
push eax
push esi
push esi
mov edi, 0x5ba4f284
push edi
push esi
call fcn.5ba57361
cmp eax, esi
je 0x5ba804d1
cmp eax, 2
jmp 0x5ba80502
push dword [ebp - 0x634]
lea eax, [ebp - 0x654]
push eax
call fcn.5baaee23
test eax, eax
jl 0x5ba80c41
lea eax, [ebp - 0x634]
push eax
push dword [ebp - 0x654]
push esi
push edi
push esi
call fcn.5ba57361
test eax, eax
jne 0x5ba80c41
push esi
push esi
call fcn.5ba7f6b4
test eax, eax
je 0x5ba80c41
push 0x5bb7386c
push esi
call fcn.5ba7d52c
test eax, eax
jl 0x5ba80c41
mov eax, dword [0x5bb7386c]
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x5ba80c41
lea eax, [ebp - 0x684]
push eax
call sub.MSOEACCT.dll_HrCreateAccountManager
test eax, eax
jl 0x5ba80c41
mov eax, dword [ebp - 0x684]
mov ecx, dword [eax]
push 0x5bb73820
push 0x5ba518a8
push eax
call dword [ecx]
mov edi, eax
mov eax, dword [ebp - 0x684]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp edi, esi
jl 0x5ba80c41
mov eax, dword [0x5bb73820]
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x5ba80c41
push 0x208
lea eax, [ebp - 0x62c]
push eax
call fcn.5ba6aead
test eax, eax
jl 0x5ba80c41
push 0x24
call fcn.5ba5615b
cmp eax, esi
pop ecx
je 0x5ba805c6
push esi
mov ecx, eax
call fcn.5ba5e763
mov dword [ebp - 0x650], eax
jmp 0x5ba805cc
mov dword [ebp - 0x650], esi
mov eax, dword [ebp - 0x650]
cmp eax, esi
je 0x5ba80c41
mov ecx, dword [eax]
lea edx, [ebp - 0x62c]
push edx
push eax
call dword [ecx + 0xb0]
test eax, eax
jl 0x5ba80c41
push esi
push 0x5ba47824
lea eax, [ebp - 0x14]
push 0x10
push eax
mov dword [ebp - 0x680], esi
call sub.SHLWAPI.dll_wnsprintfA
add esp, 0x10
mov edi, 0x205
push edi
lea eax, [ebp - 0x424]
push eax
push 0x1800
push dword [0x5bb73708]
call dword [sym.imp.USER32.dll_LoadStringA]
test eax, eax
je 0x5ba80c41
lea eax, [ebp - 0x630]
push eax
push ebx
push esi
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x65c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x5ba80c41
jmp 0x5ba8065a
mov edi, 0x205
mov eax, dword [ebp - 0x648]
cmp eax, esi
je 0x5ba80670
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 0x648], esi
lea eax, [ebp - 0x648]
push eax
call fcn.5baae95c
test eax, eax
jl 0x5ba80c10
xor ebx, ebx
inc ebx
jmp 0x5ba806a0
mov eax, dword [ebp - 0x664]
cmp eax, esi
je 0x5ba8069f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 0x664], esi
inc ebx
push ebx
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x21c]
push edi
push eax
call sub.SHLWAPI.dll_wnsprintfA
mov eax, dword [0x5bb7386c]
mov ecx, dword [eax]
add esp, 0x10
lea edx, [ebp - 0x664]
push edx
push esi
lea edx, [ebp - 0x21c]
push edx
push eax
call dword [ecx + 0x14]
test eax, eax
je 0x5ba80689
xor eax, eax
lea edi, [ebp - 0x674]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea edx, [ebp - 0x674]
push edx
lea eax, [ebp - 0x21c]
push esi
mov dword [ebp - 0x66c], eax
mov eax, dword [ebp - 0x648]
push esi
mov word [ebp - 0x674], 0x1e
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
lea eax, [ebp - 0x634]
push eax
lea eax, [ebp - 0x64c]
push eax
push esi
push esi
push 0x5ba4d01c
push dword [ebp - 0x630]
mov dword [ebp - 0x634], 4
call sub.SHLWAPI.dll_SHQueryValueExA
xor eax, eax
lea edi, [ebp - 0x674]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
cmp dword [ebp - 0x64c], esi
lea edx, [ebp - 0x674]
setne al
push edx
push esi
push 1
mov word [ebp - 0x674], 0xb
mov word [ebp - 0x66c], ax
mov eax, dword [ebp - 0x648]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x638]
cmp eax, esi
je 0x5ba80789
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 0x638], esi
lea eax, [ebp - 0x638]
push eax
call fcn.5baaee51
test eax, eax
jl 0x5ba80c10
push 4
pop edi
lea eax, [ebp - 0x634]
push eax
lea eax, [ebp - 0x64c]
push eax
push esi
push esi
push 0x5ba4d0c4
push dword [ebp - 0x630]
xor ebx, ebx
mov dword [ebp - 0x634], edi
call sub.SHLWAPI.dll_SHQueryValueExA
cmp dword [ebp - 0x64c], esi
je 0x5ba80813
mov eax, dword [ebp - 0x638]
push esi
inc ebx
push ebx
lea edx, [ebp - 0x6cc]
push edx
push 2
push esi
mov dword [ebp - 0x6cc], 0x14
mov word [ebp - 0x6c4], si
mov dword [ebp - 0x6b4], esi
mov dword [ebp - 0x6c8], esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
test eax, eax
jl 0x5ba809a8
jmp 0x5ba80911
lea eax, [ebp - 0x634]
push eax
lea eax, [ebp - 0x64c]
push eax
push esi
push esi
push 0x5ba4d0a8
push dword [ebp - 0x630]
mov dword [ebp - 0x634], edi
call sub.SHLWAPI.dll_SHQueryValueExA
cmp dword [ebp - 0x64c], esi
je 0x5ba8085b
push dword [ebp - 0x638]
push 0x13
push 0x5ba4e754
push dword [ebp - 0x630]
call fcn.5baef9ae
mov ebx, eax
lea eax, [ebp - 0x634]
push eax
lea eax, [ebp - 0x64c]
push eax
push esi
push esi
push 0x5ba4d098
push dword [ebp - 0x630]
mov dword [ebp - 0x634], edi
call sub.SHLWAPI.dll_SHQueryValueExA
cmp dword [ebp - 0x64c], esi
je 0x5ba808a3
push dword [ebp - 0x638]
push 0xf
push 0x5ba4d0bc
push dword [ebp - 0x630]
call fcn.5baefd42
add ebx, eax
push dword [ebp - 0x638]
push 8
push 0x5ba4d038
push dword [ebp - 0x630]
call fcn.5baef7eb
push dword [ebp - 0x638]
add ebx, eax
push 0xc
push 0x5ba4d030
push dword [ebp - 0x630]
call fcn.5baefb80
push dword [ebp - 0x638]
add ebx, eax
push 0xa
push 0x5ba4d02c
push dword [ebp - 0x630]
call fcn.5baefb80
push dword [ebp - 0x638]
add ebx, eax
push 0xb
push 0x5ba4d028
push dword [ebp - 0x630]
call fcn.5baefb80
add ebx, eax
je 0x5ba809a8
push dword [ebp - 0x678]
push dword [ebp - 0x640]
call fcn.5ba7b96f
cmp dword [ebp - 0x640], esi
je 0x5ba80941
mov eax, dword [0x5bb73714]
push dword [ebp - 0x640]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov dword [ebp - 0x640], esi
mov eax, dword [ebp - 0x638]
mov ecx, dword [eax]
lea edx, [ebp - 0x678]
push edx
lea edx, [ebp - 0x640]
push edx
push esi
push eax
call dword [ecx + 0x14]
test eax, eax
jl 0x5ba809a8
xor eax, eax
lea edi, [ebp - 0x674]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x640]
lea edx, [ebp - 0x674]
push edx
push esi
mov dword [ebp - 0x668], eax
mov eax, dword [ebp - 0x648]
shl ebx, 5
push 2
mov word [ebp - 0x674], 0x41
mov dword [ebp - 0x66c], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
test eax, eax
jl 0x5ba80c10
mov eax, dword [ebp - 0x63c]
cmp eax, esi
je 0x5ba809be
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 0x63c], esi
lea eax, [ebp - 0x63c]
push eax
call fcn.5baaf56a
test eax, eax
jl 0x5ba80c10
push dword [ebp - 0x63c]
xor ebx, ebx
push dword [ebp - 0x650]
push dword [ebp - 0x630]
call fcn.5baf016c
test eax, eax
jne 0x5ba80a76
push 4
pop edi
lea eax, [ebp - 0x634]
push eax
lea eax, [ebp - 0x658]
push eax
push esi
push esi
push 0x5ba4d048
push dword [ebp - 0x630]
mov dword [ebp - 0x634], edi
call sub.SHLWAPI.dll_SHQueryValueExA
test dword [ebp - 0x658], 0x10
je 0x5ba80a34
mov dword [ebp - 0x6ac], 9
jmp 0x5ba80a4a
test dword [ebp - 0x658], 0x20
je 0x5ba80a7e
mov dword [ebp - 0x6ac], 8
mov eax, dword [ebp - 0x63c]
push esi
push 1
lea edx, [ebp - 0x6ac]
push edx
push esi
mov dword [ebp - 0x6a8], esi
mov word [ebp - 0x6a4], si
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
test eax, eax
jl 0x5ba80bc8
xor ebx, ebx
inc ebx
jmp 0x5ba80b32
test dword [ebp - 0x658], 1
je 0x5ba80ab0
push dword [ebp - 0x63c]
push 6
push 0x5ba4d068
push dword [ebp - 0x654]
push dword [ebp - 0x650]
push dword [ebp - 0x630]
call fcn.5baefdc1
mov ebx, eax
test dword [ebp - 0x658], 2
je 0x5ba80ae2
push dword [ebp - 0x63c]
push 1
push 0x5ba4d088
push dword [ebp - 0x654]
push dword [ebp - 0x650]
push dword [ebp - 0x630]
call fcn.5baefdc1
add ebx, eax
test dword [ebp - 0x658], edi
je 0x5ba80b04
push dword [ebp - 0x63c]
push 2
push 0x5ba4d0d4
push dword [ebp - 0x630]
call fcn.5baeff7b
add ebx, eax
test dword [ebp - 0x658], 8
je 0x5ba80b2a
push dword [ebp - 0x63c]
push 5
push 0x5ba4d0e0
push dword [ebp - 0x630]
call fcn.5baf00b1
add ebx, eax
cmp ebx, esi
je 0x5ba80bc8
push dword [ebp - 0x67c]
push dword [ebp - 0x644]
call fcn.5ba7b9fa
cmp dword [ebp - 0x644], esi
je 0x5ba80b62
mov eax, dword [0x5bb73714]
push dword [ebp - 0x644]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov dword [ebp - 0x644], esi
mov eax, dword [ebp - 0x63c]
mov ecx, dword [eax]
lea edx, [ebp - 0x67c]
push edx
lea edx, [ebp - 0x644]
push edx
push esi
push eax
call dword [ecx + 0x14]
test eax, eax
jl 0x5ba80bc8
xor eax, eax
lea edi, [ebp - 0x674]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebx + ebx*2]
shl eax, 3
mov dword [ebp - 0x66c], eax
mov eax, dword [ebp - 0x644]
lea edx, [ebp - 0x674]
push edx
push esi
mov dword [ebp - 0x668], eax
mov eax, dword [ebp - 0x648]
push 3
mov word [ebp - 0x674], 0x41
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
test eax, eax
jl 0x5ba80c10
mov eax, dword [ebp - 0x648]
or dword [ebp - 0x690], 0xffffffff
push 1
lea edx, [ebp - 0x690]
push edx
push esi
mov dword [ebp - 0x68c], eax
mov eax, dword [0x5bb7386c]
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x1c]
inc dword [ebp - 0x680]
push dword [ebp - 0x680]
lea eax, [ebp - 0x14]
push 0x5ba47824
push 0x10
push eax
call sub.SHLWAPI.dll_wnsprintfA
add esp, 0x10
push dword [ebp - 0x630]
call dword [entry0]
lea eax, [ebp - 0x630]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x65c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x5ba80655
push dword [ebp - 0x67c]
push dword [ebp - 0x644]
call fcn.5ba7b9fa
cmp dword [ebp - 0x644], esi
je 0x5ba80c71
mov eax, dword [0x5bb73714]
push dword [ebp - 0x644]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov dword [ebp - 0x644], esi
push dword [ebp - 0x678]
push dword [ebp - 0x640]
call fcn.5ba7b96f
cmp dword [ebp - 0x640], esi
je 0x5ba80ca1
mov eax, dword [0x5bb73714]
push dword [ebp - 0x640]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov dword [ebp - 0x640], esi
mov eax, dword [ebp - 0x63c]
cmp eax, esi
je 0x5ba80cb7
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 0x63c], esi
mov eax, dword [ebp - 0x638]
cmp eax, esi
je 0x5ba80ccd
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 0x638], esi
mov eax, dword [ebp - 0x648]
cmp eax, esi
je 0x5ba80ce3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 0x648], esi
cmp dword [ebp - 0x630], esi
je 0x5ba80cf7
push dword [ebp - 0x630]
call dword [entry0]
mov eax, dword [ebp - 0x650]
cmp eax, esi
je 0x5ba80d07
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [0x5bb73820]
cmp eax, esi
je 0x5ba80d1c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [0x5bb73820], esi
mov eax, dword [0x5bb7386c]
cmp eax, esi
je 0x5ba80d31
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [0x5bb7386c], esi
call fcn.5ba80d8f
cmp dword [ebp - 0x654], esi
je 0x5ba80d55
mov eax, dword [0x5bb73714]
push dword [ebp - 0x654]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov dword [ebp - 0x654], esi
cmp dword [ebp - 0x660], esi
je 0x5ba80d69
push dword [ebp - 0x660]
call dword [entry0]
cmp dword [ebp - 0x65c], esi
pop edi
pop esi
pop ebx
je 0x5ba80d80
push dword [ebp - 0x65c]
call dword [entry0]
mov ecx, dword [ebp - 4]
call fcn.5bb3f314
leave
ret