Function at 0x5c2650
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x8761b0
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push ebx
push ebp
push esi
push edi
mov eax, dword [0x8ce6f4]
xor eax, esp
push eax
lea eax, [esp + 0x54]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x6c]
mov esi, dword [esp + 0x68]
lea eax, [esp + 0x18]
push eax
push 0x20019
xor edi, edi
push edi
push ecx
push esi
mov dword [esp + 0x70], edi
mov dword [esp + 0x2c], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x5c26de
mov eax, dword [esp + 0x6c]
add eax, 0xfffffff0
mov dword [esp + 0x5c], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x5c26c8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor al, al
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c
ret
push edi
push edi
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x44]
push eax
mov eax, dword [esp + 0x2c]
push edi
lea ecx, [esp + 0x40]
push ecx
lea edx, [esp + 0x54]
push edx
push edi
push edi
push edi
push eax
mov dword [esp + 0x68], edi
mov dword [esp + 0x58], edi
mov dword [esp + 0x64], edi
mov dword [esp + 0x50], edi
mov dword [esp + 0x5c], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x5c2741
mov eax, dword [esp + 0x6c]
add eax, 0xfffffff0
mov dword [esp + 0x5c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x5c26bc
mov eax, 1
add dword [esp + 0x28], eax
add dword [esp + 0x20], eax
call fcn.007cff5d
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x5c2768
push 0x80004005
call fcn.004a8210
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x3c]
push esi
push ecx
mov byte [esp + 0x64], 1
call fcn.005c24c0
mov edx, dword [esp + 0x74]
mov eax, dword [eax]
push edx
push eax
lea ecx, [esp + 0x24]
push 0x42b91c
push ecx
mov byte [esp + 0x74], 2
call fcn.004aa600
mov eax, dword [esp + 0x54]
add eax, 0xfffffff0
add esp, 0x18
mov byte [esp + 0x5c], 1
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x5c27cc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0x64]
mov edx, dword [esi]
mov eax, dword [esp + 0x14]
mov edx, dword [edx + 0x58]
push eax
mov ecx, esi
call edx
call fcn.007cff5d
xor ecx, ecx
cmp eax, edi
setne cl
cmp ecx, edi
jne 0x5c27f8
push 0x80004005
call fcn.004a8210
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebx, [eax + 0x10]
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x2c]
push ecx
mov byte [esp + 0x60], 3
call fcn.007c8558
xor edi, edi
add esp, 4
mov ebp, eax
mov dword [esp + 0x3c], edi
cmp dword [esp + 0x34], edi
jbe 0x5c29d2
lea esp, [esp]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x40], edx
mov dword [esp + 0x30], eax
test edx, edx
js 0x5c2a07
mov eax, dword [ebx - 8]
mov ecx, 1
sub ecx, dword [ebx - 4]
sub eax, edx
or eax, ecx
jge 0x5c2867
push edx
lea ecx, [esp + 0x20]
call fcn.004a8a90
mov ebx, dword [esp + 0x1c]
lea ecx, [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x1c]
push ebp
lea edx, [esp + 0x4c]
push edx
push 0
lea eax, [esp + 0x50]
push eax
push ebx
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x5c2a11
mov eax, dword [esp + 0x44]
dec eax
je 0x5c2943
sub eax, 2
je 0x5c28cf
dec eax
jne 0x5c2a78
mov edx, dword [ebp]
push edx
push ebx
lea eax, [esp + 0x1c]
push 0x42b8f8
push eax
call fcn.004aa600
mov edx, dword [esi]
mov eax, dword [esp + 0x24]
mov edx, dword [edx + 0x58]
add esp, 0x10
push eax
mov ecx, esi
call edx
jmp 0x5c29c3
movzx eax, byte [ebp]
push eax
push ebx
lea ecx, [esp + 0x1c]
push 0x42b8dc
push ecx
call fcn.004aa600
mov edx, dword [esi]
mov eax, dword [esp + 0x24]
mov edx, dword [edx + 0x58]
add esp, 0x10
push eax
mov ecx, esi
call edx
mov edi, 1
cmp dword [esp + 0x30], edi
jbe 0x5c292c
movzx eax, byte [edi + ebp]
push eax
lea ecx, [esp + 0x18]
push 0x42b8d0
push ecx
call fcn.004aa600
mov edx, dword [esi]
mov eax, dword [esp + 0x20]
mov edx, dword [edx + 0x58]
add esp, 0xc
push eax
mov ecx, esi
call edx
inc edi
cmp edi, dword [esp + 0x30]
jb 0x5c2900
mov eax, dword [esi]
mov edx, dword [eax + 0x58]
push 0x402308
mov ecx, esi
call edx
mov edi, dword [esp + 0x3c]
jmp 0x5c29c3
push ebp
lea ecx, [esp + 0x28]
call fcn.004a8f10
push 0x40da54
push 0x401fc4
lea ecx, [esp + 0x2c]
mov byte [esp + 0x64], 4
call fcn.004aa070
push 0x42b8c8
push 0x403954
lea ecx, [esp + 0x2c]
call fcn.004aa070
mov eax, dword [esp + 0x24]
push eax
push ebx
lea ecx, [esp + 0x1c]
push 0x42b8b0
push ecx
call fcn.004aa600
mov edx, dword [esi]
mov eax, dword [esp + 0x24]
mov edx, dword [edx + 0x58]
add esp, 0x10
push eax
mov ecx, esi
call edx
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
mov byte [esp + 0x5c], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5c29c3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
inc edi
mov dword [esp + 0x3c], edi
cmp edi, dword [esp + 0x34]
jb 0x5c2830
push ebp
call fcn.007c8563
mov edx, dword [esi]
mov eax, dword [edx + 0x58]
add esp, 4
push 0x402308
mov ecx, esi
call eax
call fcn.007cff5d
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x5c2b38
push 0x80004005
call fcn.004a8210
push 0x80070057
call fcn.004a8210
add ebx, 0xfffffff0
or edx, 0xffffffff
lea ecx, [ebx + 0xc]
mov byte [esp + 0x5c], 1
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5c2a32
mov ecx, dword [ebx]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push ebx
call edx
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x5c], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5c2a57
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x6c]
add eax, 0xfffffff0
mov dword [esp + 0x5c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x5c26bc
call fcn.007cff5d
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x5c2a92
push 0x80004005
call fcn.004a8210
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x3c], eax
mov ecx, dword [esp + 0x68]
push ecx
lea edx, [esp + 0x4c]
push edx
mov byte [esp + 0x64], 5
call fcn.005c24c0
mov ecx, dword [esp + 0x74]
mov edx, dword [eax]
push ebx
push ecx
push edx
lea eax, [esp + 0x50]
push 0x42b7d0
push eax
mov byte [esp + 0x78], 6
call fcn.004aa600
mov eax, dword [esp + 0x64]
add eax, 0xfffffff0
add esp, 0x1c
mov byte [esp + 0x5c], 5
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5c2afb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0x3c]
push 0
push 0x10
push esi
call fcn.007d3a8e
lea eax, [esi - 0x10]
mov byte [esp + 0x5c], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5c2b2a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push ebp
call fcn.007c8563
add esp, 4
jmp 0x5c2a11
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebx, [eax + 0x10]
mov dword [esp + 0x3c], ebx
cmp dword [esp + 0x38], 0
mov byte [esp + 0x5c], 7
mov dword [esp + 0x24], 0
jbe 0x5c2c69
mov edx, dword [esp + 0x28]
mov dword [esp + 0x4c], edx
test edx, edx
js 0x5c2a07
mov eax, dword [ebx - 8]
mov ecx, 1
sub ecx, dword [ebx - 4]
sub eax, edx
or eax, ecx
jge 0x5c2b8f
push edx
lea ecx, [esp + 0x40]
call fcn.004a8a90
mov ebx, dword [esp + 0x3c]
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x5c]
push ecx
push ebx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x5c2d1d
mov ecx, dword [esp + 0x6c]
push ebx
push ecx
lea edx, [esp + 0x1c]
push 0x40e190
push edx
call fcn.004aa600
mov edi, dword [esp + 0x24]
mov ecx, dword [edi - 0x10]
mov eax, dword [ecx]
mov edx, dword [eax + 0x10]
add esp, 0xc
mov dword [esp + 0x54], esp
mov dword [esp + 0x54], esp
call edx
cmp dword [edi - 4], 0
lea ecx, [edi - 4]
jl 0x5c2bff
cmp eax, dword [edi - 0x10]
jne 0x5c2bff
lea ebp, [edi - 0x10]
mov eax, 1
lock xadd dword [ecx], eax
jmp 0x5c2c37
mov ecx, dword [edi - 0xc]
mov edx, dword [eax]
mov edx, dword [edx]
push 2
push ecx
mov ecx, eax
call edx
mov ebp, eax
test ebp, ebp
je 0x5c2d6c
mov eax, dword [edi - 0xc]
mov dword [ebp + 4], eax
mov eax, dword [edi - 0xc]
lea ecx, [eax + eax + 2]
push ecx
lea edx, [eax + eax + 2]
push edi
push edx
lea eax, [ebp + 0x10]
push eax
call fcn.0080217f
add esp, 0x10
mov edx, dword [esp + 0x6c]
mov ecx, dword [esp + 0x54]
push edx
add ebp, 0x10
push esi
mov dword [ecx], ebp
call fcn.005c2650
add esp, 0xc
test al, al
je 0x5c2d71
mov eax, dword [esp + 0x24]
inc eax
mov dword [esp + 0x24], eax
cmp eax, dword [esp + 0x38]
jb 0x5c2b60
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add ebx, 0xfffffff0
mov byte [esp + 0x5c], 3
lea edx, [ebx + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x5c2c95
mov ecx, dword [ebx]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push ebx
call eax
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov byte [esp + 0x5c], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5c2cba
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x5c], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5c2cdf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x6c]
add eax, 0xfffffff0
mov dword [esp + 0x5c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5c2d07
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, 1
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c
ret
add ebx, 0xfffffff0
mov byte [esp + 0x5c], 3
lea eax, [ebx + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x5c2d3e
mov ecx, dword [ebx]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push ebx
call eax
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov byte [esp + 0x5c], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5c2a32
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x5c2a32
call fcn.004a8580
add ebx, 0xfffffff0
mov byte [esp + 0x5c], 3
lea ecx, [ebx + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x5c2d3e
mov ecx, dword [ebx]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push ebx
call edx
jmp 0x5c2d3e