Function at 0x57b890
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x57baef
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, dword [ebx + 0x8f0]
call fcn.0049ed9c
mov eax, dword [0x6e4284]
cmp dword [eax], 4
jl 0x57b8da
mov eax, dword [0x6e5800]
cmp dword [eax], 0xa
jl 0x57b8da
mov eax, dword [0x6e6644]
cmp dword [eax], 1
je 0x57b8f6
mov eax, dword [0x6e4284]
cmp dword [eax], 4
jl 0x57bac7
mov eax, dword [0x6e6644]
cmp dword [eax], 2
jne 0x57bac7
mov eax, 4
call fcn.00402b48
mov esi, eax
mov eax, dword [ebx + 0x8e0]
mov eax, dword [eax + 0x218]
sub eax, 1
jb 0x57b917
je 0x57b926
jmp 0x57b933
lea eax, [ebp - 0xc]
mov edx, 0x57bb08
call fcn.00404c38
jmp 0x57b933
lea eax, [ebp - 0xc]
mov edx, 0x57bb18
call fcn.00404c38
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x10]
mov ecx, 0x57bb24
mov edx, dword [ebp - 0xc]
call fcn.00404ed8
mov eax, dword [ebp - 0x10]
call fcn.0040508c
push eax
push 0x80000000
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x57babb
mov eax, 4
call fcn.00402b48
mov edi, eax
mov dword [edi], 1
mov eax, 0x400
mov dword [esi], eax
lea edx, [ebp - 8]
xchg edx, eax
call fcn.00405218
push esi
lea eax, [ebp - 8]
call fcn.004050e4
push eax
push edi
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x57baa6
mov eax, dword [esi]
test eax, eax
jbe 0x57b9be
mov edx, eax
dec edx
lea eax, [ebp - 8]
call fcn.00405218
jmp 0x57b9c6
lea eax, [ebp - 8]
call fcn.00404ba0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
cmp dword [ebp - 8], 0
je 0x57baaf
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push dword [ebp - 0xc]
push 0x57bb34
push dword [ebp - 8]
push 0x57bb44
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404f4c
mov eax, dword [ebp - 0x14]
call fcn.0040508c
push eax
push 0x80000000
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x57baaf
mov dword [edi], 1
mov eax, 0x400
mov dword [esi], eax
lea edx, [ebp - 8]
xchg edx, eax
call fcn.00405218
push esi
lea eax, [ebp - 8]
call fcn.004050e4
push eax
push edi
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x57ba9b
mov eax, dword [esi]
test eax, eax
jbe 0x57ba61
mov edx, eax
dec edx
lea eax, [ebp - 8]
call fcn.00405218
jmp 0x57ba69
lea eax, [ebp - 8]
call fcn.00404ba0
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 8]
call fcn.004054bc
mov edx, dword [ebp - 0x18]
mov eax, dword [ebx + 0x8f0]
call fcn.0049ed9c
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 8]
call fcn.004054bc
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebx + 0x8f0]
call fcn.0049edc0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp 0x57baaf
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov edx, 4
mov eax, edi
call fcn.00402b78
mov edx, 4
mov eax, esi
call fcn.00402b78
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57baf6
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.004052f0
lea eax, [ebp - 0x14]
mov edx, 4
call fcn.00404bc4
ret