Function at 0x5c9320
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x62fdfe
push eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], esp
sub esp, 8
mov dword [0x6fec20], eax
mov dword [0x6fec2c], ecx
push ebx
push ebp
push esi
xor esi, esi
push edi
mov dword [0x6febac], esi
mov dword [0x6febd8], esi
mov dword [0x6febf4], esi
mov dword [0x6febf0], esi
mov dword [0x6febe8], esi
mov dword [0x6fec24], esi
mov dword [0x6febb0], esi
mov dword [0x6febb4], esi
mov dword [0x6feb98], esi
mov dword [0x6feba0], esi
mov dword [0x6feba8], esi
mov dword [0x6fec00], esi
mov dword [0x6fec04], esi
mov dword [0x6feb9c], esi
mov dword [0x6feba4], esi
mov dword [0x6febec], esi
mov dword [0x6fec50], esi
mov dword [0x6fec54], esi
mov dword [0x6febe4], esi
mov dword [0x6febe0], esi
mov dword [0x6fec28], esi
mov dword [0x6fec30], esi
mov dword [0x6fec34], esi
mov dword [0x6febd4], esi
mov dword [0x6febf8], esi
mov dword [0x6febdc], esi
mov dword [0x6fec78], esi
mov dword [0x6fec7c], esi
mov dword [0x6fec70], esi
mov edx, dword [ecx]
push 1
push 0x6e7acc
call dword [edx + 0x10]
cmp eax, esi
mov dword [0x6febac], eax
jne 0x5c9438
mov ecx, dword [0x6fec2c]
push esi
push 0x6e7acc
push 0x6e7acc
mov eax, dword [ecx]
call dword [eax + 0xc]
mov dword [0x6febac], eax
mov edx, dword [eax]
push 1
mov ecx, eax
call dword [edx + 0x18]
mov eax, dword [0x6fec20]
mov edi, dword [sym.imp.USER32.dll_LoadImageA]
push esi
push esi
push esi
push 2
push 0x2146
push eax
call edi
mov ecx, dword [0x6fec20]
push esi
push esi
push esi
push 2
push 0x214b
push ecx
mov dword [0x6febf4], eax
call edi
mov edx, dword [0x6fec20]
push esi
push esi
push esi
push 2
push 0x2147
push edx
mov dword [0x6febf0], eax
call edi
push 0x38
mov dword [0x6febd0], eax
call fcn.005e6fe9
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, esi
mov dword [esp + 0x20], esi
je 0x5c94a4
mov ecx, eax
call fcn.005ce3c0
jmp 0x5c94a6
xor eax, eax
mov ecx, dword [0x6fec2c]
mov dword [0x6febe8], eax
or ebx, 0xffffffff
push eax
mov edx, dword [ecx]
mov dword [esp + 0x24], ebx
call dword [edx + 0x18]
push 0x18
call fcn.005e6fe9
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, esi
mov dword [esp + 0x20], 1
je 0x5c94e1
mov ecx, eax
call fcn.005cdf20
jmp 0x5c94e3
xor eax, eax
mov ecx, dword [0x6fec2c]
mov dword [0x6fec24], eax
push eax
mov dword [esp + 0x24], ebx
mov edx, dword [ecx]
call dword [edx + 0x14]
mov eax, dword [0x6fec20]
push esi
push esi
push esi
push esi
push 0x215b
push eax
call edi
cmp eax, esi
mov dword [0x6febb0], eax
jne 0x5c9527
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov ecx, dword [0x6fec20]
push esi
push esi
push esi
push esi
push 0x215a
push ecx
call edi
cmp eax, esi
mov dword [0x6febb4], eax
jne 0x5c9557
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov ecx, dword [0x6febac]
mov ebp, 0xff00
mov dword [0x6febb8], ebp
mov dword [0x6febbc], 0x6e7ed0
mov dword [0x6febc0], 0x6e7eb8
mov dword [0x6febc4], 1
mov dword [0x6febc8], esi
mov edx, dword [ecx]
push 0x6febb0
call dword [edx + 0x30]
mov ecx, dword [0x6fec24]
mov dword [0x6feb98], eax
mov edx, dword [eax]
push ecx
mov ecx, eax
call dword [edx + 4]
push 0x38
call fcn.005e6fe9
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, esi
mov dword [esp + 0x20], 2
je 0x5c95cc
mov ecx, eax
call fcn.005cd200
jmp 0x5c95ce
xor eax, eax
mov ecx, dword [0x6fec2c]
mov dword [0x6feba0], eax
push eax
mov dword [esp + 0x24], ebx
mov edx, dword [ecx]
call dword [edx + 0x18]
push 0x14
call fcn.005e6fe9
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, esi
mov dword [esp + 0x20], 3
je 0x5c9606
mov ecx, eax
call fcn.005ccd60
jmp 0x5c9608
xor eax, eax
mov ecx, dword [0x6fec2c]
mov dword [0x6feba8], eax
push eax
mov dword [esp + 0x24], ebx
mov edx, dword [ecx]
call dword [edx + 0x14]
mov eax, dword [0x6fec20]
push esi
push esi
push esi
push esi
push 0x215e
push eax
call edi
cmp eax, esi
mov dword [0x6fec00], eax
jne 0x5c964c
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov ecx, dword [0x6fec20]
push esi
push esi
push esi
push esi
push 0x2159
push ecx
call edi
cmp eax, esi
mov dword [0x6fec04], eax
jne 0x5c967c
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov ecx, dword [0x6febac]
mov dword [0x6fec08], ebp
mov dword [0x6fec0c], 0x6e7ea8
mov dword [0x6fec10], 0x6e7e90
mov dword [0x6fec14], 1
mov dword [0x6fec18], esi
mov edx, dword [ecx]
push 0x6fec00
call dword [edx + 0x30]
mov ecx, dword [0x6feba8]
mov dword [0x6feb9c], eax
mov edx, dword [eax]
push ecx
mov ecx, eax
call dword [edx + 4]
push 0x38
call fcn.005e6fe9
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, esi
mov dword [esp + 0x20], 4
je 0x5c96ec
mov ecx, eax
call fcn.005cc040
jmp 0x5c96ee
xor eax, eax
mov ecx, dword [0x6fec2c]
mov dword [0x6feba4], eax
push eax
mov dword [esp + 0x24], ebx
mov edx, dword [ecx]
call dword [edx + 0x18]
push 0x18
call fcn.005e6fe9
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, esi
mov dword [esp + 0x20], 5
je 0x5c9726
mov ecx, eax
call fcn.005cbba0
jmp 0x5c9728
xor eax, eax
mov ecx, dword [0x6fec2c]
mov dword [0x6febec], eax
push eax
mov dword [esp + 0x24], ebx
mov edx, dword [ecx]
call dword [edx + 0x14]
mov eax, dword [0x6fec20]
push esi
push esi
push esi
push esi
push 0x215d
push eax
call edi
cmp eax, esi
mov dword [0x6fec50], eax
jne 0x5c976c
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov ecx, dword [0x6fec20]
push esi
push esi
push esi
push esi
push 0x2158
push ecx
call edi
cmp eax, esi
mov dword [0x6fec54], eax
jne 0x5c979c
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov ecx, dword [0x6febac]
mov dword [0x6fec58], ebp
mov dword [0x6fec5c], 0x6e7e80
mov dword [0x6fec60], 0x6e7e68
mov dword [0x6fec64], 1
mov dword [0x6fec68], esi
mov edx, dword [ecx]
push 0x6fec50
call dword [edx + 0x30]
mov ecx, dword [0x6febec]
mov dword [0x6febe4], eax
mov edx, dword [eax]
push ecx
mov ecx, eax
call dword [edx + 4]
push 0x38
call fcn.005e6fe9
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, esi
mov dword [esp + 0x20], 6
je 0x5c980c
mov ecx, eax
call fcn.005caec0
jmp 0x5c980e
xor eax, eax
mov ecx, dword [0x6fec2c]
mov dword [0x6febe0], eax
push eax
mov dword [esp + 0x24], ebx
mov edx, dword [ecx]
call dword [edx + 0x18]
push 0x18
call fcn.005e6fe9
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, esi
mov dword [esp + 0x20], 7
je 0x5c9846
mov ecx, eax
call fcn.005caa20
jmp 0x5c9848
xor eax, eax
mov ecx, dword [0x6fec2c]
mov dword [0x6fec28], eax
push eax
mov dword [esp + 0x24], ebx
mov edx, dword [ecx]
call dword [edx + 0x14]
mov eax, dword [0x6fec20]
push esi
push esi
push esi
push esi
push 0x2179
push eax
call edi
cmp eax, esi
mov dword [0x6fec30], eax
jne 0x5c988c
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov ecx, dword [0x6fec20]
push esi
push esi
push esi
push esi
push 0x2178
push ecx
call edi
cmp eax, esi
mov dword [0x6fec34], eax
jne 0x5c98bc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov ecx, dword [0x6febac]
mov dword [0x6fec38], ebp
mov dword [0x6fec3c], 0x6e7e58
mov dword [0x6fec40], 0x6e7e40
mov dword [0x6fec44], 1
mov dword [0x6fec48], esi
mov edx, dword [ecx]
push 0x6fec30
call dword [edx + 0x30]
mov ecx, dword [0x6fec28]
mov dword [0x6febd4], eax
mov edx, dword [eax]
push ecx
mov ecx, eax
call dword [edx + 4]
push 0x38
call fcn.005e6fe9
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, esi
mov dword [esp + 0x20], 8
je 0x5c992c
mov ecx, eax
call fcn.005ca190
jmp 0x5c992e
xor eax, eax
mov ecx, dword [0x6fec2c]
mov dword [0x6febf8], eax
push eax
mov dword [esp + 0x24], ebx
mov edx, dword [ecx]
call dword [edx + 0x18]
push 0x14
call fcn.005e6fe9
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, esi
mov dword [esp + 0x20], 9
je 0x5c9966
mov ecx, eax
call fcn.005c9cf0
jmp 0x5c9968
xor eax, eax
mov ecx, dword [0x6fec2c]
mov dword [0x6febdc], eax
push eax
mov dword [esp + 0x24], ebx
mov edx, dword [ecx]
call dword [edx + 0x14]
mov eax, dword [0x6fec20]
push esi
push esi
push esi
push esi
push 0x2144
push eax
call edi
cmp eax, esi
mov dword [0x6fec78], eax
jne 0x5c99ac
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov ecx, dword [0x6fec20]
push esi
push esi
push esi
push esi
push 0x2145
push ecx
call edi
cmp eax, esi
mov dword [0x6fec7c], eax
jne 0x5c99dc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov ecx, dword [0x6febac]
mov edi, 1
mov dword [0x6fec80], ebp
mov dword [0x6fec84], 0x6e7e34
mov dword [0x6fec88], 0x6e7e20
mov dword [0x6fec8c], edi
mov dword [0x6fec90], esi
mov edx, dword [ecx]
push 0x6fec78
call dword [edx + 0x30]
mov ecx, dword [0x6febdc]
mov dword [0x6fec70], eax
mov edx, dword [eax]
push ecx
mov ecx, eax
call dword [edx + 4]
lea edx, [esp + 0x28]
mov dword [esp + 0x28], esi
push edx
push edi
push esi
push 0x6e4b60
push SysReAllocStringLen
mov dword [esp + 0x40], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x5c9a7c
mov edx, dword [esp + 0x28]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x2c]
push eax
push ecx
push esi
push esi
push 0x6e4b54
push edx
mov dword [esp + 0x28], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x2c]
dec eax
je 0x5c9ac0
dec eax
je 0x5c9aa1
mov eax, edi
mov dword [0x6febd8], esi
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov eax, edi
pop edi
pop esi
pop ebp
mov dword [0x6febd8], 2
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov ecx, dword [esp + 0x18]
mov dword [0x6febd8], edi
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret