Function at 0x5c16ed
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
push edx
push ecx
call fcn.005c1cbf
add esp, 8
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0
cmp dword [ebp - 0x24], 0xffffffff
je 0x5c1935
push 0x3fff
call fcn.0057bffb
add esp, 4
mov dword [ebp - 0xc], eax
push 4
call fcn.0057bffb
add esp, 4
mov dword [ebp - 0x18], eax
push 4
call fcn.0057bffb
add esp, 4
mov esi, eax
push 0
push 0
push esi
call fcn.0057c1be
add esp, 0xc
push 0x3fff
push 0
push dword [ebp - 0x18]
call fcn.0057c1be
add esp, 0xc
push ebx
call fcn.0056a99e
add esp, 4
mov ebx, eax
push dword [ebp - 0x18]
call fcn.0057c05d
add esp, 4
push eax
push dword [ebp - 0xc]
call fcn.0057c05d
add esp, 4
push eax
push esi
call fcn.0057c05d
add esp, 4
push eax
push 0
push ebx
push dword [ebp - 0x24]
call sub.ADVAPI32.DLL_RegQueryValueExA
mov edi, eax
push ebx
call fcn.0056b454
add esp, 4
mov eax, edi
cmp eax, 0
jne 0x5c1925
mov dword [ebp - 0x14], 0x6212f8
push 0
push esi
call fcn.0057c1a5
add esp, 8
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp eax, 7
je 0x5c17ff
cmp eax, 2
je 0x5c1881
cmp eax, 1
je 0x5c1881
cmp eax, 3
je 0x5c1881
cmp eax, 4
je 0x5c18da
jmp 0x5c18f5
mov esi, 0
push 0
push dword [ebp - 0x18]
call fcn.0057c1a5
add esp, 8
mov ebx, eax
sub ebx, 1
jmp 0x5c187b
push esi
push dword [ebp - 0xc]
call fcn.0057c12f
add esp, 8
cmp eax, 0
jne 0x5c1854
push 0
push dword [ebp - 0x18]
call fcn.0057c1a5
add esp, 8
sub eax, 1
cmp esi, eax
jne 0x5c183f
jmp 0x5c1852
push 0x621324
push dword [ebp - 0x14]
call fcn.0056a1e6
add esp, 8
mov dword [ebp - 0x14], eax
jmp 0x5c1878
push esi
push dword [ebp - 0xc]
call fcn.0057c12f
add esp, 8
push eax
call fcn.00569d19
add esp, 4
push eax
push dword [ebp - 0x14]
call fcn.0056a1e6
add esp, 8
mov dword [ebp - 0x14], eax
add esi, 1
cmp esi, ebx
jle 0x5c1818
jmp 0x5c18f5
mov esi, 0
push 0
push dword [ebp - 0x18]
call fcn.0057c1a5
add esp, 8
mov ebx, eax
sub ebx, 1
jmp 0x5c18d4
push esi
push dword [ebp - 0xc]
call fcn.0057c12f
add esp, 8
cmp eax, 0
jne 0x5c18ad
jmp 0x5c18d8
push esi
push dword [ebp - 0xc]
call fcn.0057c12f
add esp, 8
push eax
call fcn.00569d19
add esp, 4
push eax
push dword [ebp - 0x14]
call fcn.0056a1e6
add esp, 8
mov dword [ebp - 0x14], eax
add esi, 1
cmp esi, ebx
jle 0x5c189a
jmp 0x5c18f5
push 0
push dword [ebp - 0xc]
call fcn.0057c1a5
add esp, 8
push eax
call fcn.00569d65
add esp, 4
mov dword [ebp - 0x14], eax
jmp 0x5c18f5
cmp dword [ebp + 0x18], 0
je 0x5c1923
push dword [ebp - 0x14]
push 0x621314
push dword [ebp - 0x20]
call fcn.00569d65
add esp, 4
push eax
call fcn.0056a1e6
add esp, 8
push eax
call fcn.0056a1e6
add esp, 8
mov dword [ebp - 0x14], eax
jmp 0x5c192a
mov dword [0x6212f4], eax
push dword [ebp - 0x24]
call fcn.005c1d3a
add esp, 4
cmp dword [ebp - 0x20], 2
jne 0x5c1ac3
mov dword [ebp - 0x10], 0x6212f8
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov edi, 0x6212f8
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov dword [ebp - 0x1c], eax
jmp 0x5c1a81
push 0x621334
push 1
mov eax, dword [ebp - 8]
add eax, 1
push eax
push dword [ebp - 4]
call fcn.0059e668
add esp, 0xc
push eax
call fcn.0056a094
add esp, 8
cmp eax, 0
jne 0x5c1a5a
mov eax, dword [ebp - 8]
add eax, 1
mov esi, eax
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 8]
jmp 0x5c1a50
mov dword [ebp - 8], esi
push 0x621334
push 1
mov eax, esi
add eax, 1
push eax
push dword [ebp - 4]
call fcn.0059e668
add esp, 0xc
push eax
call fcn.0056a094
add esp, 8
cmp eax, 0
jne 0x5c1a2e
push edi
call fcn.00567a96
add esp, 4
mov ebx, eax
push 0x6212f8
push ebx
call fcn.0056a094
add esp, 8
cmp eax, 0
je 0x5c19fc
push ebx
push dword [ebp - 0x10]
call fcn.0056a1e6
add esp, 8
mov dword [ebp - 0x10], eax
jmp 0x5c1a27
push 0x621334
push edi
push 0x621334
call fcn.0056a1e6
add esp, 8
push eax
call fcn.0056a1e6
add esp, 8
push eax
push dword [ebp - 0x10]
call fcn.0056a1e6
add esp, 8
mov dword [ebp - 0x10], eax
mov edi, 0x6212f8
jmp 0x5c1a58
push 1
mov eax, esi
add eax, 1
push eax
push dword [ebp - 4]
call fcn.0059e668
add esp, 0xc
push eax
push edi
call fcn.0056a1e6
add esp, 8
mov edi, eax
add esi, 1
cmp esi, ebx
jle 0x5c19a4
jmp 0x5c1a7d
push 1
mov eax, dword [ebp - 8]
add eax, 1
push eax
push dword [ebp - 4]
call fcn.0059e668
add esp, 0xc
push eax
push dword [ebp - 0x10]
call fcn.0056a1e6
add esp, 8
mov dword [ebp - 0x10], eax
add dword [ebp - 8], 1
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 8], eax
jle 0x5c1966
push 0x6212f8
push edi
call fcn.0056a094
add esp, 8
cmp eax, 0
je 0x5c1abd
push edi
push 0x621334
call fcn.0056a1e6
add esp, 8
push eax
push dword [ebp - 0x10]
call fcn.0056a1e6
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
jmp 0x5c1ac8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret