Function at 0x615988
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
push ebx
push esi
push edi
mov esi, eax
mov dword [ebp - 0x38], 0x6f7834
mov dword [ebp - 0x34], esp
mov eax, 0x56498f
mov dword [ebp - 0x3c], eax
mov edi, edx
mov word [ebp - 0x30], 0
xor edx, edx
mov dword [ebp - 0x24], edx
mov ecx, dword fs:[0]
mov dword [ebp - 0x40], ecx
lea eax, [ebp - 0x40]
mov dword fs:[0], eax
cmp dword [edi], 0
sete dl
and edx, 1
test dl, dl
je 0x6159ea
mov eax, esi
call fcn.00405528
mov edx, dword [ebp - 0x40]
mov dword fs:[0], edx
mov eax, edx
jmp 0x616046
mov dword [ebp - 0x44], 0x80000001
cmp dword [edi], 0
je 0x615a10
mov eax, dword [edi]
test eax, eax
jne 0x615a00
xor ebx, ebx
jmp 0x615a16
cmp dword [eax + 4], 0
je 0x615a0b
mov ebx, dword [eax + 4]
jmp 0x615a16
lea ebx, [eax + 8]
jmp 0x615a16
mov ebx, dword [0x6a9384]
mov edx, str.HKEY_CLASSES_ROOT
mov eax, edi
call fcn.0040b140
test al, al
je 0x615a35
mov dword [ebp - 0x44], 0x80000000
add ebx, 0x22
jmp 0x615ade
mov edx, str.HKEY_CURRENT_CONFIG
mov eax, edi
call fcn.0040b140
test al, al
je 0x615a54
mov dword [ebp - 0x44], 0x80000005
add ebx, 0x26
jmp 0x615ade
mov edx, str.HKEY_CURRENT_USER
mov eax, edi
call fcn.0040b140
test al, al
je 0x615a70
mov dword [ebp - 0x44], 0x80000001
add ebx, 0x22
jmp 0x615ade
mov edx, str.HKEY_LOCAL_MACHINE
mov eax, edi
call fcn.0040b140
test al, al
je 0x615a8c
mov dword [ebp - 0x44], 0x80000002
add ebx, 0x24
jmp 0x615ade
mov edx, str.HKEY_USERS
mov eax, edi
call fcn.0040b140
test al, al
je 0x615aa8
mov dword [ebp - 0x44], 0x80000003
add ebx, 0x14
jmp 0x615ade
mov edx, str.HKEY_PERFORMANCE_DATA
mov eax, edi
call fcn.0040b140
test al, al
je 0x615ac4
mov dword [ebp - 0x44], 0x80000004
add ebx, 0x2a
jmp 0x615ade
mov edx, str.HKEY_DYN_DATA
mov eax, edi
call fcn.0040b140
test al, al
je 0x615ade
mov dword [ebp - 0x44], 0x80000006
add ebx, 0x1a
cmp word [ebx], 0x5c
jne 0x615ae7
add ebx, 2
mov edi, ebx
mov eax, ebx
call fcn.0043a9bc
add eax, eax
add ebx, eax
sub ebx, 2
jmp 0x615afc
sub ebx, 2
cmp ebx, edi
jb 0x615b06
cmp word [ebx], 0x5c
jne 0x615af9
mov word [ebp - 0x30], 8
lea edx, [ebx + 2]
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x48]
call fcn.00408c54
mov dword [ebp - 4], eax
inc dword [ebp - 0x24]
mov word [ebp - 0x30], 0x14
cmp edi, ebx
ja 0x615b30
cmp word [ebx], 0x5c
je 0x615b33
add ebx, 2
mov word [ebp - 0x30], 0x20
mov dword [ebp - 0x4c], edi
sub ebx, edi
sar ebx, 1
jns 0x615b45
adc ebx, 0
mov edx, ebx
mov eax, dword [ebp - 0x4c]
call fcn.00408cc8
mov dword [ebp - 8], eax
inc dword [ebp - 0x24]
mov word [ebp - 0x30], 0x14
cmp dword [0x6a7c90], 0
je 0x615ba5
lea edx, [ebp - 0x50]
push edx
push 0x20019
push 0
cmp dword [ebp - 8], 0
je 0x615b90
mov eax, dword [ebp - 8]
test eax, eax
jne 0x615b80
xor ecx, ecx
jmp 0x615b96
cmp dword [eax + 4], 0
je 0x615b8b
mov ecx, dword [eax + 4]
jmp 0x615b96
lea ecx, [eax + 8]
jmp 0x615b96
mov ecx, dword [0x6a9384]
push ecx
mov eax, dword [ebp - 0x44]
push eax
call dword [0x6a7c90]
mov ebx, eax
jmp 0x615bf5
lea eax, [ebp - 0x50]
xor edx, edx
push eax
push 0x20019
push 0
lea eax, [ebp - 8]
mov word [ebp - 0x30], 0x2c
mov dword [ebp - 0x10], edx
lea edx, [ebp - 0x10]
inc dword [ebp - 0x24]
call fcn.004019c0
cmp dword [ebp - 0x10], 0
je 0x615bd4
mov ecx, dword [ebp - 0x10]
jmp 0x615bd9
mov ecx, 0x6f7a04
push ecx
mov eax, dword [ebp - 0x44]
push eax
call sub.ADVAPI32.DLL_RegOpenKeyExA
mov ebx, eax
dec dword [ebp - 0x24]
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00696870
test ebx, ebx
je 0x615c37
mov eax, esi
call fcn.00405528
dec dword [ebp - 0x24]
cmp dword [ebp - 8], 0
je 0x615c11
mov eax, dword [ebp - 8]
call fcn.00408920
mov word [ebp - 0x30], 0x14
dec dword [ebp - 0x24]
cmp dword [ebp - 4], 0
je 0x615c28
mov eax, dword [ebp - 4]
call fcn.00408920
mov edx, dword [ebp - 0x40]
mov dword fs:[0], edx
jmp 0x616046
mov word [ebp - 0x30], 0x50
xor ecx, ecx
mov dword [ebp - 0xc], ecx
inc dword [ebp - 0x24]
mov word [ebp - 0x30], 0x14
cmp dword [0x6a7c8c], 0
jne 0x615c88
mov word [ebp - 0x30], 0x5c
xor eax, eax
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 4]
inc dword [ebp - 0x24]
call fcn.004019c0
lea edx, [ebp - 0x14]
lea eax, [ebp - 0xc]
call fcn.006968a0
dec dword [ebp - 0x24]
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00696870
cmp dword [0x6a7c8c], 0
je 0x615cd3
lea ecx, [ebp - 0x54]
lea edx, [ebp - 0x58]
push ecx
push 0
push edx
push 0
cmp dword [ebp - 4], 0
je 0x615cbe
mov eax, dword [ebp - 4]
test eax, eax
jne 0x615cae
xor ecx, ecx
jmp 0x615cc4
cmp dword [eax + 4], 0
je 0x615cb9
mov ecx, dword [eax + 4]
jmp 0x615cc4
lea ecx, [eax + 8]
jmp 0x615cc4
mov ecx, dword [0x6a9384]
push ecx
mov eax, dword [ebp - 0x50]
push eax
call dword [0x6a7c8c]
mov ebx, eax
jmp 0x615cfb
lea eax, [ebp - 0x54]
lea edx, [ebp - 0x58]
push eax
push 0
push edx
push 0
cmp dword [ebp - 0xc], 0
je 0x615cea
mov ecx, dword [ebp - 0xc]
jmp 0x615cef
mov ecx, 0x6f7a04
push ecx
mov eax, dword [ebp - 0x50]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
mov ebx, eax
test ebx, ebx
je 0x615d56
mov eax, dword [ebp - 0x50]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, esi
call fcn.00405528
dec dword [ebp - 0x24]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00696870
dec dword [ebp - 0x24]
cmp dword [ebp - 8], 0
je 0x615d30
mov eax, dword [ebp - 8]
call fcn.00408920
mov word [ebp - 0x30], 0x14
dec dword [ebp - 0x24]
cmp dword [ebp - 4], 0
je 0x615d47
mov eax, dword [ebp - 4]
call fcn.00408920
mov edx, dword [ebp - 0x40]
mov dword fs:[0], edx
jmp 0x616046
mov ecx, dword [ebp - 0x58]
cmp ecx, 8
ja case.0x615d64.0
mov cl, byte [ecx + 0x615d6b]
jmp dword [ecx*4 + 0x615d74]
mov eax, dword [ebp - 0x50]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, esi
call fcn.00405528
dec dword [ebp - 0x24]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00696870
dec dword [ebp - 0x24]
cmp dword [ebp - 8], 0
je 0x615db3
mov eax, dword [ebp - 8]
call fcn.00408920
mov word [ebp - 0x30], 0x14
dec dword [ebp - 0x24]
cmp dword [ebp - 4], 0
je 0x615dca
mov eax, dword [ebp - 4]
call fcn.00408920
mov edx, dword [ebp - 0x40]
mov dword fs:[0], edx
jmp 0x616046
mov ecx, dword [ebp - 0x54]
push ecx
call fcn.00560068
pop ecx
mov dword [ebp - 0x5c], eax
mov word [ebp - 0x30], 0x14
mov word [ebp - 0x30], 0x98
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x60], eax
mov word [ebp - 0x30], 0x98
cmp dword [0x6a7c8c], 0
je 0x615e49
lea edx, [ebp - 0x60]
push edx
mov ecx, dword [ebp - 0x5c]
push ecx
push 0
push 0
cmp dword [ebp - 4], 0
je 0x615e34
mov eax, dword [ebp - 4]
test eax, eax
jne 0x615e24
xor edx, edx
jmp 0x615e3a
cmp dword [eax + 4], 0
je 0x615e2f
mov edx, dword [eax + 4]
jmp 0x615e3a
lea edx, [eax + 8]
jmp 0x615e3a
mov edx, dword [0x6a9384]
push edx
mov eax, dword [ebp - 0x50]
push eax
call dword [0x6a7c8c]
mov ebx, eax
jmp 0x615e71
lea eax, [ebp - 0x60]
push eax
mov edx, dword [ebp - 0x5c]
push edx
push 0
push 0
cmp dword [ebp - 0xc], 0
je 0x615e60
mov ecx, dword [ebp - 0xc]
jmp 0x615e65
mov ecx, 0x6f7a04
push ecx
mov eax, dword [ebp - 0x50]
push eax
call sub.ADVAPI32.DLL_RegQueryValueExA
mov ebx, eax
cmp ebx, 0xea
jne 0x615e8f
mov eax, dword [ebp - 0x5c]
push eax
call fcn.0055ffb4
pop ecx
add dword [ebp - 0x54], 0x400
jmp case.0x615d64.2
test ebx, ebx
je 0x615ee4
mov edx, dword [ebp - 0x50]
push edx
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, esi
call fcn.00405528
dec dword [ebp - 0x24]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00696870
dec dword [ebp - 0x24]
cmp dword [ebp - 8], 0
je 0x615ec4
mov eax, dword [ebp - 8]
call fcn.00408920
dec dword [ebp - 0x24]
cmp dword [ebp - 4], 0
je 0x615ed5
mov eax, dword [ebp - 4]
call fcn.00408920
mov edx, dword [ebp - 0x40]
mov dword fs:[0], edx
jmp 0x616046
mov ecx, dword [ebp - 0x58]
dec ecx
sub ecx, 2
jb 0x615f47
dec ecx
je 0x615ef8
dec ecx
je 0x615f0d
jmp 0x615fbc
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
xor edx, edx
push edx
push eax
mov eax, esi
call fcn.00405ea4
jmp 0x615fbc
mov edx, dword [ebp - 0x5c]
mov ecx, dword [edx]
mov edx, ecx
mov eax, ecx
shr edx, 8
shr eax, 0x18
and edx, 0xff00
add eax, edx
mov edx, ecx
shl edx, 8
and edx, 0xff0000
shl ecx, 0x18
add eax, edx
add eax, ecx
xor edx, edx
mov ecx, eax
push edx
mov eax, ecx
push eax
mov eax, esi
call fcn.00405ea4
jmp 0x615fbc
cmp dword [0x6a7c8c], 0
je 0x615f87
mov word [ebp - 0x30], 0xbc
mov ebx, dword [ebp - 0x5c]
mov eax, ebx
call fcn.00408c54
mov dword [ebp - 0x18], eax
lea edx, [ebp - 0x18]
inc dword [ebp - 0x24]
mov eax, esi
call fcn.00405c5c
dec dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x615f7f
call fcn.00408920
mov word [ebp - 0x30], 0x98
jmp 0x615fbc
mov word [ebp - 0x30], 0xd4
mov ebx, dword [ebp - 0x5c]
mov eax, ebx
call fcn.00408d58
mov dword [ebp - 0x1c], eax
lea edx, [ebp - 0x1c]
inc dword [ebp - 0x24]
mov eax, esi
call fcn.00405c5c
dec dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x615fb6
call fcn.00408920
mov word [ebp - 0x30], 0x98
mov word [ebp - 0x30], 0x14
jmp 0x615fee
mov eax, dword [ebp - 0x50]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
mov edx, dword [ebp - 0x5c]
push edx
call fcn.0055ffb4
pop ecx
jmp 0x616008
dec dword [ebp - 0x24]
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00696870
dec dword [ebp - 0x24]
mov eax, dword [ebp - 8]
test eax, eax
je 0x616027
call fcn.00408920
mov word [ebp - 0x30], 0x14
dec dword [ebp - 0x24]
mov eax, dword [ebp - 4]
test eax, eax
je 0x61603c
call fcn.00408920
mov edx, dword [ebp - 0x40]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret