Function at 0x5c9230
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x62fc9e
push eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], esp
sub esp, 8
mov dword [0x6f4138], eax
mov dword [0x6f4144], ecx
push ebx
push ebp
push esi
xor esi, esi
push edi
mov dword [0x6f40c4], esi
mov dword [0x6f40f0], esi
mov dword [0x6f410c], esi
mov dword [0x6f4108], esi
mov dword [0x6f4100], esi
mov dword [0x6f413c], esi
mov dword [0x6f40c8], esi
mov dword [0x6f40cc], esi
mov dword [0x6f40b0], esi
mov dword [0x6f40b8], esi
mov dword [0x6f40c0], esi
mov dword [0x6f4118], esi
mov dword [0x6f411c], esi
mov dword [0x6f40b4], esi
mov dword [0x6f40bc], esi
mov dword [0x6f4104], esi
mov dword [0x6f4168], esi
mov dword [0x6f416c], esi
mov dword [0x6f40fc], esi
mov dword [0x6f40f8], esi
mov dword [0x6f4140], esi
mov dword [0x6f4148], esi
mov dword [0x6f414c], esi
mov dword [0x6f40ec], esi
mov dword [0x6f4110], esi
mov dword [0x6f40f4], esi
mov dword [0x6f4190], esi
mov dword [0x6f4194], esi
mov dword [0x6f4188], esi
mov edx, dword [ecx]
push 1
push str.Commenting_Tools
call dword [edx + 8]
cmp eax, esi
mov dword [0x6f40c4], eax
jne 0x5c9348
mov ecx, dword [0x6f4144]
push esi
push str.Commenting_Tools
push str.Commenting_Tools
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [0x6f40c4], eax
mov edx, dword [eax]
push 1
mov ecx, eax
call dword [edx + 0x18]
mov eax, dword [0x6f4138]
mov edi, dword [sym.imp.USER32.dll_LoadImageA]
push esi
push esi
push esi
push 2
push 0x2146
push eax
call edi
mov ecx, dword [0x6f4138]
push esi
push esi
push esi
push 2
push 0x214b
push ecx
mov dword [0x6f410c], eax
call edi
mov edx, dword [0x6f4138]
push esi
push esi
push esi
push 2
push 0x2147
push edx
mov dword [0x6f4108], eax
call edi
push 0x38
mov dword [0x6f40e8], eax
call fcn.005e6f29
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, esi
mov dword [esp + 0x20], esi
je 0x5c93b4
mov ecx, eax
call fcn.005ce340
jmp 0x5c93b6
xor eax, eax
mov ecx, dword [0x6f4144]
mov dword [0x6f4100], eax
or ebx, 0xffffffff
push eax
mov edx, dword [ecx]
mov dword [esp + 0x24], ebx
call dword [edx + 0x10]
push 0x18
call fcn.005e6f29
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, esi
mov dword [esp + 0x20], 1
je 0x5c93f1
mov ecx, eax
call fcn.005cdea0
jmp 0x5c93f3
xor eax, eax
mov ecx, dword [0x6f4144]
mov dword [0x6f413c], eax
push eax
mov dword [esp + 0x24], ebx
mov edx, dword [ecx]
call dword [edx + 0xc]
mov eax, dword [0x6f4138]
push esi
push esi
push esi
push esi
push 0x215b
push eax
call edi
cmp eax, esi
mov dword [0x6f40c8], eax
jne 0x5c9437
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov ecx, dword [0x6f4138]
push esi
push esi
push esi
push esi
push 0x215a
push ecx
call edi
cmp eax, esi
mov dword [0x6f40cc], eax
jne 0x5c9467
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov ecx, dword [0x6f40c4]
mov ebp, 0xff00
mov dword [0x6f40d0], ebp
mov dword [0x6f40d4], 0x6ed3f8
mov dword [0x6f40d8], 0x6ed3e0
mov dword [0x6f40dc], 1
mov dword [0x6f40e0], esi
mov edx, dword [ecx]
push 0x6f40c8
call dword [edx + 0x30]
mov ecx, dword [0x6f413c]
mov dword [0x6f40b0], eax
mov edx, dword [eax]
push ecx
mov ecx, eax
call dword [edx + 4]
push 0x38
call fcn.005e6f29
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, esi
mov dword [esp + 0x20], 2
je 0x5c94dc
mov ecx, eax
call fcn.005cd180
jmp 0x5c94de
xor eax, eax
mov ecx, dword [0x6f4144]
mov dword [0x6f40b8], eax
push eax
mov dword [esp + 0x24], ebx
mov edx, dword [ecx]
call dword [edx + 0x10]
push 0x14
call fcn.005e6f29
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, esi
mov dword [esp + 0x20], 3
je 0x5c9516
mov ecx, eax
call fcn.005ccce0
jmp 0x5c9518
xor eax, eax
mov ecx, dword [0x6f4144]
mov dword [0x6f40c0], eax
push eax
mov dword [esp + 0x24], ebx
mov edx, dword [ecx]
call dword [edx + 0xc]
mov eax, dword [0x6f4138]
push esi
push esi
push esi
push esi
push 0x215e
push eax
call edi
cmp eax, esi
mov dword [0x6f4118], eax
jne 0x5c955c
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov ecx, dword [0x6f4138]
push esi
push esi
push esi
push esi
push 0x2159
push ecx
call edi
cmp eax, esi
mov dword [0x6f411c], eax
jne 0x5c958c
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov ecx, dword [0x6f40c4]
mov dword [0x6f4120], ebp
mov dword [0x6f4124], 0x6ed3d0
mov dword [0x6f4128], 0x6ed3b8
mov dword [0x6f412c], 1
mov dword [0x6f4130], esi
mov edx, dword [ecx]
push 0x6f4118
call dword [edx + 0x30]
mov ecx, dword [0x6f40c0]
mov dword [0x6f40b4], eax
mov edx, dword [eax]
push ecx
mov ecx, eax
call dword [edx + 4]
push 0x38
call fcn.005e6f29
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, esi
mov dword [esp + 0x20], 4
je 0x5c95fc
mov ecx, eax
call fcn.005cbfc0
jmp 0x5c95fe
xor eax, eax
mov ecx, dword [0x6f4144]
mov dword [0x6f40bc], eax
push eax
mov dword [esp + 0x24], ebx
mov edx, dword [ecx]
call dword [edx + 0x10]
push 0x18
call fcn.005e6f29
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, esi
mov dword [esp + 0x20], 5
je 0x5c9636
mov ecx, eax
call fcn.005cbb20
jmp 0x5c9638
xor eax, eax
mov ecx, dword [0x6f4144]
mov dword [0x6f4104], eax
push eax
mov dword [esp + 0x24], ebx
mov edx, dword [ecx]
call dword [edx + 0xc]
mov eax, dword [0x6f4138]
push esi
push esi
push esi
push esi
push 0x215d
push eax
call edi
cmp eax, esi
mov dword [0x6f4168], eax
jne 0x5c967c
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov ecx, dword [0x6f4138]
push esi
push esi
push esi
push esi
push 0x2158
push ecx
call edi
cmp eax, esi
mov dword [0x6f416c], eax
jne 0x5c96ac
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov ecx, dword [0x6f40c4]
mov dword [0x6f4170], ebp
mov dword [0x6f4174], 0x6ed3a8
mov dword [0x6f4178], 0x6ed390
mov dword [0x6f417c], 1
mov dword [0x6f4180], esi
mov edx, dword [ecx]
push 0x6f4168
call dword [edx + 0x30]
mov ecx, dword [0x6f4104]
mov dword [0x6f40fc], eax
mov edx, dword [eax]
push ecx
mov ecx, eax
call dword [edx + 4]
push 0x38
call fcn.005e6f29
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, esi
mov dword [esp + 0x20], 6
je 0x5c971c
mov ecx, eax
call fcn.005cadd0
jmp 0x5c971e
xor eax, eax
mov ecx, dword [0x6f4144]
mov dword [0x6f40f8], eax
push eax
mov dword [esp + 0x24], ebx
mov edx, dword [ecx]
call dword [edx + 0x10]
push 0x18
call fcn.005e6f29
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, esi
mov dword [esp + 0x20], 7
je 0x5c9756
mov ecx, eax
call fcn.005ca930
jmp 0x5c9758
xor eax, eax
mov ecx, dword [0x6f4144]
mov dword [0x6f4140], eax
push eax
mov dword [esp + 0x24], ebx
mov edx, dword [ecx]
call dword [edx + 0xc]
mov eax, dword [0x6f4138]
push esi
push esi
push esi
push esi
push 0x2179
push eax
call edi
cmp eax, esi
mov dword [0x6f4148], eax
jne 0x5c979c
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov ecx, dword [0x6f4138]
push esi
push esi
push esi
push esi
push 0x2178
push ecx
call edi
cmp eax, esi
mov dword [0x6f414c], eax
jne 0x5c97cc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov ecx, dword [0x6f40c4]
mov dword [0x6f4150], ebp
mov dword [0x6f4154], 0x6ed380
mov dword [0x6f4158], 0x6ed368
mov dword [0x6f415c], 1
mov dword [0x6f4160], esi
mov edx, dword [ecx]
push 0x6f4148
call dword [edx + 0x30]
mov ecx, dword [0x6f4140]
mov dword [0x6f40ec], eax
mov edx, dword [eax]
push ecx
mov ecx, eax
call dword [edx + 4]
push 0x38
call fcn.005e6f29
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, esi
mov dword [esp + 0x20], 8
je 0x5c983c
mov ecx, eax
call fcn.005ca0a0
jmp 0x5c983e
xor eax, eax
mov ecx, dword [0x6f4144]
mov dword [0x6f4110], eax
push eax
mov dword [esp + 0x24], ebx
mov edx, dword [ecx]
call dword [edx + 0x10]
push 0x14
call fcn.005e6f29
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, esi
mov dword [esp + 0x20], 9
je 0x5c9876
mov ecx, eax
call fcn.005c9c00
jmp 0x5c9878
xor eax, eax
mov ecx, dword [0x6f4144]
mov dword [0x6f40f4], eax
push eax
mov dword [esp + 0x24], ebx
mov edx, dword [ecx]
call dword [edx + 0xc]
mov eax, dword [0x6f4138]
push esi
push esi
push esi
push esi
push 0x2144
push eax
call edi
cmp eax, esi
mov dword [0x6f4190], eax
jne 0x5c98bc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov ecx, dword [0x6f4138]
push esi
push esi
push esi
push esi
push 0x2145
push ecx
call edi
cmp eax, esi
mov dword [0x6f4194], eax
jne 0x5c98ec
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov ecx, dword [0x6f40c4]
mov edi, 1
mov dword [0x6f4198], ebp
mov dword [0x6f419c], 0x6ed35c
mov dword [0x6f41a0], 0x6ed348
mov dword [0x6f41a4], edi
mov dword [0x6f41a8], esi
mov edx, dword [ecx]
push 0x6f4190
call dword [edx + 0x30]
mov ecx, dword [0x6f40f4]
mov dword [0x6f4188], eax
mov edx, dword [eax]
push ecx
mov ecx, eax
call dword [edx + 4]
lea edx, [esp + 0x28]
mov dword [esp + 0x28], esi
push edx
push edi
push esi
push str.SoftwareFoxit_SoftwareFoxit_ReaderAnnotation
push SysReAllocStringLen
mov dword [esp + 0x40], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x5c998c
mov edx, dword [esp + 0x28]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x2c]
push eax
push ecx
push esi
push esi
push str.SelectMode
push edx
mov dword [esp + 0x28], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x2c]
dec eax
je 0x5c99d0
dec eax
je 0x5c99b1
mov eax, edi
mov dword [0x6f40f0], esi
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov eax, edi
pop edi
pop esi
pop ebp
mov dword [0x6f40f0], 2
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret
mov ecx, dword [esp + 0x18]
mov dword [0x6f40f0], edi
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret