Function at 0x59f640
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
jmp 0x59f640
sub esp, 0x248
mov eax, dword [0x774458]
xor eax, esp
mov dword [esp + 0x244], eax
mov eax, dword [esp + 0x250]
mov ecx, dword [esp + 0x254]
push ebx
mov ebx, dword [esp + 0x250]
push esi
mov byte [ebx], 0
mov byte [eax], 0
mov dword [esp + 0x2c], eax
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
push str.SOFTWAREPyroCommandos1.0
mov esi, 0xff
push reloc.WSOCK32.dll_accept
mov dword [esp + 0x34], ecx
mov dword [ecx], 0
mov dword [esp + 0x38], esi
mov dword [esp + 0x1c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x59f88e
lea ecx, [esp + 0x44]
push ecx
lea edx, [esp + 0x44]
push edx
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x44]
push ecx
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x54]
push ecx
lea edx, [esp + 0x50]
push edx
mov edx, dword [esp + 0x2c]
push 0
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x174]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x59f883
mov eax, dword [esp + 0x10]
push ebp
push eax
call fcn.0065014a
mov ebp, eax
xor eax, eax
add esp, 4
cmp dword [esp + 0x20], eax
mov dword [esp + 0x18], eax
jbe 0x59f879
push edi
jmp 0x59f725
mov esi, 0xff
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x20]
push edx
push ebp
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x38]
push ecx
push 0
lea edx, [esp + 0x20]
push edx
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x68]
push ecx
push eax
push edx
mov dword [esp + 0x30], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp dword [esp + 0x10], 0
je 0x59f863
cmp dword [esp + 0x20], 0
je 0x59f863
mov eax, dword [esp + 0x30]
cmp eax, 1
je 0x59f7ab
cmp eax, 3
jbe 0x59f863
cmp eax, 5
ja 0x59f863
mov edi, str.Type
lea esi, [esp + 0x54]
mov ecx, 5
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x59f863
mov ecx, dword [ebp]
mov edx, dword [esp + 0x28]
mov dword [edx], ecx
jmp 0x59f863
mov edi, str.DirIns
lea esi, [esp + 0x54]
mov ecx, 7
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x59f80c
mov edi, dword [esp + 0x34]
mov edx, edi
mov eax, ebp
sub edx, ebp
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x59f7d0
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x59f7e1
sub eax, edx
je 0x59f80c
cmp byte [edi + eax - 1], 0x5c
je 0x59f80c
add edi, 0xffffffff
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x59f7f8
mov cx, word [0x6f3bb4]
mov word [edi], cx
mov edi, str.DirCd
lea esi, [esp + 0x54]
mov ecx, 6
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x59f863
mov edx, ebx
mov eax, ebp
sub edx, ebp
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x59f826
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x59f837
sub eax, edx
je 0x59f863
cmp byte [ebx + eax - 1], 0x5c
je 0x59f863
mov edi, ebx
add edi, 0xffffffff
mov al, byte [edi + 1]
add edi, 1
test al, al
jne 0x59f850
mov ax, word [0x6f3bb4]
mov word [edi], ax
mov eax, dword [esp + 0x1c]
add eax, 1
cmp eax, dword [esp + 0x24]
mov dword [esp + 0x1c], eax
jb 0x59f720
pop edi
push ebp
call fcn.00651684
add esp, 4
pop ebp
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x24c]
pop esi
pop ebx
xor ecx, esp
call fcn.00651675
add esp, 0x248
ret