Function at 0x58e485
Capabilities:
Enumerate process modules
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6d74b0
mov eax, dword fs:[0]
push eax
mov eax, 0x2070
call fcn.004333d8
mov eax, dword [0x6fe1c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor edx, edx
mov edi, dword [ebp + 0x18]
mov ebx, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x2068], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2064], ecx
mov dword [ebp - 0x205c], eax
mov dword [ebp - 0x2070], edi
mov dword [eax], edx
mov dword [edi], edx
mov dword [ebp - 0x2074], edx
mov dword [ebx], edx
mov dword [ebp - 0x206c], edx
test ecx, ecx
jne 0x58e5bc
test esi, esi
je 0x58e5bc
lea eax, [ebp - 0x2058]
mov dword [ebp - 0x2060], edx
push eax
lea eax, [ebp - 0x2060]
mov dword [ebp - 0x2058], edx
push eax
push 0x441d10
push esi
call fcn.00612f71
test eax, eax
jne 0x58e54c
mov eax, dword [ebp - 0x2058]
xor ecx, ecx
cmp word [eax], cx
je 0x58e544
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ecx, eax
mov eax, dword [ebp - 0x205c]
mov dword [eax], ecx
lea eax, [ebp - 0x2058]
push eax
lea eax, [ebp - 0x2060]
push eax
push 0x441d38
push esi
call fcn.00612f71
test eax, eax
jne 0x58e583
mov eax, dword [ebp - 0x2058]
xor ecx, ecx
cmp word [eax], cx
je 0x58e57f
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
jmp 0x58e581
mov eax, ecx
mov dword [edi], eax
lea eax, [ebp - 0x2058]
push eax
lea eax, [ebp - 0x2060]
push eax
push 0x58eadc
push esi
call fcn.00612f71
xor edx, edx
test eax, eax
jne 0x58e5bc
mov eax, dword [ebp - 0x2058]
cmp word [eax], dx
je 0x58e5b8
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
xor edx, edx
jmp 0x58e5ba
mov eax, edx
mov dword [ebx], eax
mov esi, dword [ebp - 0x205c]
cmp dword [esi], edx
jne 0x58e5d3
push esi
push 0x58eb10
call fcn.00585515
xor edx, edx
cmp dword [edi], edx
jne 0x58e5e4
push edi
push 0x58eb50
call fcn.00585515
xor edx, edx
cmp dword [ebx], edx
jne 0x58e5f5
push ebx
push 0x58eadc
call fcn.00585515
xor edx, edx
cmp dword [esi], edx
je 0x58e605
cmp dword [edi], edx
je 0x58e605
cmp dword [ebx], edx
jne 0x58eab6
cmp dword [ebp - 0x2064], 0
je 0x58e97c
push 0x58eb88
call fcn.00584c17
test al, al
je 0x58eab6
xor eax, eax
mov dword [ebp - 0x2078], eax
mov dword [ebp - 4], eax
push dword [ebp - 0x2064]
push eax
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [ebp - 0x2078], esi
test esi, esi
jne 0x58e656
or dword [ebp - 4], 0xffffffff
jmp 0x58eab6
lea eax, [ebp - 0x2058]
push eax
push 0x1000
lea eax, [ebp - 0x2050]
push eax
push esi
call sub.PSAPI.DLL_EnumProcessModules
test eax, eax
je 0x58e94c
cmp dword [ebp - 0x2058], 0x1000
ja 0x58e94c
mov eax, dword [ebp - 0x205c]
xor edx, edx
mov cl, dl
mov byte [ebp - 0x2051], dl
cmp dword [eax], edx
jne 0x58e69f
cmp dword [edi], edx
je 0x58e6a7
mov cl, 1
mov byte [ebp - 0x2051], cl
test dword [ebp - 0x2058], 0xfffffffc
mov dword [ebp - 0x2068], edx
jbe 0x58e93a
mov edi, 0x104
test cl, cl
je 0x58e6d0
xor eax, eax
cmp dword [ebx], eax
jne 0x58e92e
push edi
lea eax, [ebp - 0x830]
push eax
push dword [ebp + edx*4 - 0x2050]
push esi
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x58e90a
push edi
lea eax, [ebp - 0xc40]
push eax
push edi
lea eax, [ebp - 0xa38]
push eax
push edi
lea eax, [ebp - 0x420]
push eax
push edi
lea eax, [ebp - 0xe48]
push eax
lea eax, [ebp - 0x830]
push eax
call fcn.00574aa2
add esp, 0x24
lea eax, [ebp - 0xc40]
push 0x441d8c
push eax
call fcn.00611389
test eax, eax
jne 0x58e90a
cmp dword [ebx], eax
jne 0x58e75d
push 0x58ebd8
lea eax, [ebp - 0xa38]
push eax
call fcn.00611389
test eax, eax
jne 0x58e75d
lea eax, [ebp - 0x830]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [ebx], eax
mov cl, byte [ebp - 0x2051]
test cl, cl
jne 0x58e910
push 0x58ebe8
lea eax, [ebp - 0xa38]
push eax
call fcn.00611389
test eax, eax
jne 0x58e90a
lea ecx, [ebp - 0x420]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x2074]
jne 0x58e78d
sub ecx, edx
sar ecx, 1
cmp ecx, 2
jle 0x58e90a
push 0x5c
lea eax, [ecx - 2]
pop edx
cmp word [ebp + eax*2 - 0x420], dx
je 0x58e7be
sub eax, 1
jns 0x58e7af
mov dword [ebp - 0x2064], eax
test eax, eax
jle 0x58e90a
sub ecx, eax
sub ecx, 2
push ecx
lea ecx, [ebp - 0x41e]
lea eax, [ecx + eax*2]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov ecx, dword [ebp - 0x2070]
mov dword [ecx], eax
lea eax, [ebp - 0xe48]
push eax
lea eax, [ebp - 0x628]
push edi
push eax
call fcn.00574733
push dword [ebp - 0x2064]
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x628]
push edi
push eax
call fcn.00643c9a
add esp, 0x1c
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ecx, dword [ebp - 0x205c]
mov byte [ebp - 0x2051], 1
mov dword [ecx], eax
lea eax, [ebp - 0x2060]
push eax
push 0x20019
xor ecx, ecx
push ecx
push 0x441a80
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x2060], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x58e90a
lea eax, [ebp - 0x2064]
mov dword [ebp - 0x2064], edi
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x207c]
push eax
xor eax, eax
push eax
push 0x58ebf0
push dword [ebp - 0x2060]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x58e8fe
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x2074]
jne 0x58e8a0
sub ecx, edx
sar ecx, 1
push 0x5c
pop eax
cmp word [ebp + ecx*2 - 0x21a], ax
jne 0x58e8dd
lea ecx, [ecx*2 - 2]
cmp ecx, 0x208
jae 0x58ead4
xor eax, eax
mov word [ebp + ecx - 0x218], ax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x628]
push eax
call fcn.00611389
test eax, eax
jne 0x58e8fe
mov dword [ebp - 0x206c], 1
push dword [ebp - 0x2060]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov cl, byte [ebp - 0x2051]
mov edx, dword [ebp - 0x2068]
mov eax, dword [ebp - 0x2058]
inc edx
shr eax, 2
mov dword [ebp - 0x2068], edx
cmp edx, eax
jb 0x58e6c2
mov edi, dword [ebp - 0x2070]
mov eax, dword [ebp - 0x205c]
xor ecx, ecx
cmp dword [eax], ecx
je 0x58e956
xor eax, eax
cmp dword [edi], eax
je 0x58e958
cmp dword [ebx], eax
je 0x58e958
jmp 0x58e95e
xor eax, eax
mov dword [ebp - 0x206c], eax
jmp 0x58e934
xor eax, eax
mov dword [ebp - 0x206c], eax
or dword [ebp - 4], 0xffffffff
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov dword [ebp - 0x2078], eax
mov eax, dword [ebp - 0x206c]
jmp 0x58eab8
mov edi, 0x104
lea eax, [ebp - 0x420]
push edi
push eax
push edi
lea eax, [ebp - 0xa38]
push eax
push edi
lea eax, [ebp - 0x1050]
push eax
push edi
lea eax, [ebp - 0x1258]
push eax
push dword [ebp - 0x2068]
call fcn.00574aa2
add esp, 0x24
lea eax, [ebp - 0xa38]
push 0x58ec08
push eax
call fcn.00611389
test eax, eax
je 0x58e9dd
push 0x58ec1c
lea eax, [ebp - 0xa38]
push eax
call fcn.00611389
test eax, eax
jne 0x58eab6
push dword [ebp - 0x2068]
call fcn.005933b9
test al, al
je 0x58eab6
xor eax, eax
push eax
push eax
push eax
push eax
push edi
lea eax, [ebp - 0xc40]
push eax
push edi
lea eax, [ebp - 0xe48]
push eax
push dword [ebp - 0x2068]
call fcn.00574aa2
lea eax, [ebp - 0xe48]
push eax
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.00574733
lea eax, [ebp - 0xc40]
push eax
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.005746be
push 0x58ec2c
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.005746be
add esp, 0x48
lea eax, [ebp - 0x628]
push 0x58ec38
push edi
push eax
call fcn.00574733
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x830]
push edi
push eax
call fcn.00574733
push 0x58ec4c
lea eax, [ebp - 0x830]
push edi
push eax
call fcn.005746be
mov edi, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
lea eax, [ebp - 0x218]
add esp, 0x24
push eax
call edi
mov dword [esi], eax
lea eax, [ebp - 0x628]
push eax
call edi
mov ecx, dword [ebp - 0x2070]
mov dword [ecx], eax
lea eax, [ebp - 0x830]
push eax
call edi
mov dword [ebx], eax
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040548e
leave
ret 0x18
call fcn.0056750f
int3