Function at 0x557b3d
Capabilities:
Print debug messages
Query or enumerate registry value

Disassembly:
mov eax, 0x5d48e2
call fcn.005a39e4
sub esp, 0x114
push ebx
push esi
push edi
push 0xc
pop esi
xor eax, eax
mov ecx, esi
mov edi, 0x648bc8
rep stosd dword es:[edi], eax
call fcn.0043caac
push dword [0x648738]
mov ecx, 0x6487b0
call fcn.005551e0
xor ebx, ebx
cmp byte [0x64896d], bl
jne 0x557b9a
cmp byte [0x64896e], bl
jne 0x557b9a
cmp byte [0x64896f], bl
jne 0x557b9a
call fcn.00551f20
test eax, eax
jne 0x557b9a
xor ecx, ecx
jmp 0x557b9d
push 1
pop ecx
cmp byte [0x648969], bl
jne 0x557bb9
cmp byte [0x64896a], bl
jne 0x557bb9
cmp byte [0x648960], bl
jne 0x557bb9
xor eax, eax
jmp 0x557bbc
push 1
pop eax
cmp ecx, ebx
jne 0x557bee
cmp eax, ebx
jne 0x557bee
cmp byte [0x648949], bl
mov dword [ebp - 0x14], ebx
jne 0x557bd4
call fcn.0054c2ed
push 8
call fcn.005bca7e
cmp eax, ebx
pop ecx
je 0x557bf7
mov dword [eax + 4], ebx
mov dword [eax], 0x5e59d4
mov dword [ebp - 0x18], eax
jmp 0x557bfa
mov dword [ebp - 0x14], 1
jmp 0x557bd4
mov dword [ebp - 0x18], ebx
mov eax, dword [ebp - 0x18]
mov dword [0x64b0a4], eax
push 0xf
xor eax, eax
pop ecx
lea edi, [ebp - 0x60]
rep stosd dword es:[edi], eax
or ecx, 0xffffffff
mov edi, 0x61dd50
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov dword [ebp - 0x60], esi
shr ecx, 2
lea edx, [ebp - 0x44]
mov esi, edi
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x60]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.gdi32.dll_CreateFontIndirectA]
mov ecx, dword [ebp - 0x18]
push eax
call fcn.005c40fd
cmp eax, ebx
jne 0x557c60
mov ecx, dword [0x64b0a4]
cmp ecx, ebx
je 0x557c60
mov eax, dword [ecx]
push 1
call dword [eax + 4]
mov dword [0x64b0a4], ebx
cmp dword [ebp - 0x14], ebx
push 1
pop edi
jne 0x557c7e
mov edx, edi
xor ecx, ecx
call fcn.0055301a
call fcn.00557b0c
test eax, eax
je 0x557ec7
cmp dword [ebp - 0x14], ebx
mov byte [ebp - 0xd], bl
jne 0x557d01
mov esi, 0x62d180
push edi
mov ecx, esi
call fcn.004454d6
cmp byte [0x648949], bl
push ebx
push ebx
je 0x557cd2
lea ecx, [ebp - 0x120]
call fcn.005464ce
lea ecx, [ebp - 0x120]
mov dword [ebp - 4], ebx
call fcn.005c14e6
cmp eax, edi
setne byte [ebp - 0xd]
cmp byte [ebp - 0xd], bl
jne 0x557cc6
call fcn.0054c2ed
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x120]
jmp 0x557cf5
lea ecx, [ebp - 0x120]
call fcn.005464ce
lea ecx, [ebp - 0x120]
mov dword [ebp - 4], edi
call fcn.00546fed
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x120]
call fcn.00546619
mov ecx, esi
call fcn.00445d25
push ebx
call dword [sym.imp.user32.dll_SetActiveWindow]
cmp byte [ebp - 0xd], bl
jne 0x557ec7
cmp dword [0x648b1c], edi
jne 0x557d27
mov byte [0x64893e], 1
mov byte [0x6487b3], 1
call fcn.005128d3
call fcn.00535ad4
call fcn.00535bd0
call fcn.00551f7a
test eax, eax
jge 0x557ec7
cmp byte [0x64896d], bl
je 0x557d65
mov ecx, dword [0x648974]
cmp dword [ecx - 8], ebx
je 0x557d65
call fcn.005513e5
mov dword [0x64878c], eax
jmp 0x557ec7
cmp byte [0x64896e], bl
mov al, byte [0x64896f]
jne 0x557d7a
cmp al, bl
je 0x557e0f
mov ecx, dword [0x648978]
cmp dword [ecx - 8], ebx
je 0x557e0f
mov esi, dword [0x64897c]
xor edx, edx
cmp dword [esi - 8], ebx
je 0x557d98
mov edx, esi
cmp byte [0x648970], bl
je 0x557db0
movsx eax, al
push 0x61dd38
push eax
call fcn.005520c5
jmp 0x557db9
movsx eax, al
push eax
call fcn.00551895
cmp eax, ebx
mov dword [0x64878c], eax
je 0x557ec7
mov ecx, dword [0x624c00]
mov dword [ebp - 0x14], ecx
mov ecx, eax
mov dword [ebp - 4], 2
call fcn.00550f58
push eax
push dword [0x64878c]
lea eax, [ebp - 0x14]
push 0x61dd08
push eax
call fcn.005bb02b
add esp, 0x10
push dword [ebp - 0x14]
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.005bcd3d
jmp 0x557ec7
call fcn.00557b0c
test eax, eax
je 0x557ec7
mov esi, 0x648df8
push 0x61bdc8
mov ecx, esi
call fcn.00557860
mov ecx, esi
call fcn.0055776e
test eax, eax
jne 0x557e3f
mov ecx, esi
call fcn.00557534
mov eax, dword [0x648b1c]
cmp eax, 0xffffffff
mov dword [0x648e08], ebx
mov byte [0x64ae40], bl
mov dword [0x64ae38], ebx
mov dword [0x64af4c], ebx
je 0x557e66
mov dword [0x6490c4], eax
call fcn.00536284
call fcn.00557989
push 0x24
call fcn.005bca7e
pop ecx
mov dword [ebp - 0x20], eax
cmp eax, ebx
mov dword [ebp - 4], 3
mov esi, 0x61cc1c
je 0x557e9a
push esi
push 0x61cc0c
mov ecx, eax
call fcn.0043e8cb
jmp 0x557e9c
xor eax, eax
or dword [ebp - 4], 0xffffffff
mov ecx, eax
mov dword [0x62d104], eax
call fcn.0043ebdb
mov eax, dword [0x62d104]
cmp dword [eax + 0x18], ebx
jne 0x557ebf
xor edx, edx
mov ecx, esi
call fcn.0053319d
cmp byte [0x64896c], bl
je 0x557ece
xor eax, eax
jmp 0x557f85
lea eax, [ebp - 0x24]
push eax
push 0x20019
push ebx
push 0x61cb50
push Ordinal_4
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x557f2d
push 4
pop esi
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push 0x61dcfc
push dword [ebp - 0x24]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x557f24
cmp dword [ebp - 0x18], esi
jne 0x557f24
mov eax, dword [ebp - 0x1c]
mov dword [0x635dac], eax
push dword [ebp - 0x24]
call dword [sym.imp.advapi32.dll_RegCloseKey]
push edi
mov edi, 0x635ae0
mov ecx, edi
call fcn.004bbc13
mov esi, 0x63d428
push pe_nt_image_headers32
mov ecx, esi
call fcn.0050bd05
mov ecx, esi
call fcn.0050d44c
fld dword [0x5d88a8]
push ecx
fstp dword [esp]
call fcn.0050f0a0
push 1
pop eax
push eax
push ebx
push 2
push 0x10
push 2
push 0xffffffffffffffff
push 2
push edi
mov dword [0x6490c8], ebx
call fcn.004bb604
add esp, 0x20
neg eax
sbb eax, eax
neg eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret