Function at 0x5f3390
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbc4
mov eax, 0x69d2ab
xor edx, edx
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x30], 0x6e5ba8
mov dword [ebp - 0x2c], esp
mov dword [ebp - 0x34], eax
mov word [ebp - 0x28], 0
mov dword [ebp - 0x1c], edx
mov ecx, dword fs:[0]
mov dword [ebp - 0x38], ecx
lea eax, [ebp - 0x38]
mov dword fs:[0], eax
mov eax, dword [ebx + 8]
mov edi, eax
mov esi, dword [ebx + 4]
push esi
push eax
push edi
call fcn.004057f0
add esp, 0xc
mov edx, dword [ebx + 8]
sub edi, esi
test edi, edi
jns 0x5f33ee
add edi, 0xf
sar edi, 4
shl edi, 4
sub dword [ebx + 8], edi
push edx
push eax
push ebx
call fcn.0040445c
add esp, 0xc
push 0x6ddad4
mov eax, dword [ebp + 0x10]
push eax
push 0x6ddab2
push 0x6ddaab
lea ecx, [ebp - 0x150]
push ecx
call fcn.006a0ad0
add esp, 0x14
lea eax, [ebp - 0x3c]
push eax
push 0x20019
push 0
lea edx, [ebp - 0x150]
push edx
push reloc.WSOCK32.DLL_bind
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x5f3455
mov ecx, dword [ebp - 0x38]
mov dword fs:[0], ecx
mov eax, ecx
jmp 0x5f3677
mov dword [ebp - 0x40], 0xc8
mov dword [ebp - 0x44], 0x1f4
xor esi, esi
jmp 0x5f3639
mov al, byte [ebp - 0x218]
test al, al
je 0x5f362a
mov word [ebp - 0x28], 8
lea edx, [ebp - 0x4c]
push edx
lea ecx, [ebp - 0x218]
push ecx
lea eax, [ebp - 0x10]
push eax
call fcn.0069a6ec
add esp, 0xc
inc dword [ebp - 0x1c]
mov edx, dword [ebx + 8]
mov ecx, dword [ebx + 0x18]
cmp edx, ecx
je 0x5f358a
mov eax, dword [ebx + 8]
mov dword [ebp - 0x50], eax
mov edx, dword [ebp - 0x50]
mov dword [ebp - 0x14], edx
test edx, edx
je 0x5f3584
mov word [ebp - 0x28], 0x14
xor eax, eax
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x54]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 8]
mov ecx, dword [edx - 0xc]
inc ecx
test ecx, ecx
jle 0x5f351d
mov eax, dword [ebp - 8]
mov dword [ebp - 0x58], eax
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x58]
mov dword [edx + 8], ecx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x5c], eax
mov edx, dword [ebp - 0x5c]
mov ecx, dword [edx + 8]
mov dword [ebp - 0x414], ecx
mov eax, dword [ebp - 0x14]
mov edx, dword [eax + 8]
add edx, 0xfffffff4
mov dword [ebp - 0x60], edx
mov ecx, 0x6ff36c
mov eax, dword [ebp - 0x60]
cmp ecx, eax
je 0x5f357e
mov edx, dword [ebp - 0x60]
push edx
call sub.KERNEL32.DLL_InterlockedIncrement
jmp 0x5f357e
mov ecx, dword [ebp - 8]
mov edi, dword [ecx - 4]
push edi
push edi
mov eax, dword [ebp - 0x14]
push eax
call fcn.0069a874
add esp, 0xc
mov dword [ebp - 0x68], eax
mov edx, dword [ebp - 0x68]
add edx, 0xc
mov dword [ebp - 0x64], edx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x64]
mov dword [ecx + 8], eax
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x6c], edx
mov ecx, dword [ebp - 0x6c]
mov eax, dword [ecx + 8]
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x70], edi
mov edx, dword [ebp - 8]
mov dword [ebp - 0x74], edx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx + 8]
mov dword [ebp - 0x78], eax
mov edx, dword [ebp - 0x70]
push edx
mov ecx, dword [ebp - 0x74]
push ecx
mov eax, dword [ebp - 0x78]
push eax
call fcn.0069cc60
add esp, 0xc
mov word [ebp - 0x28], 8
add dword [ebx + 8], 0x10
jmp 0x5f359b
lea edx, [ebp - 0x10]
push edx
mov ecx, dword [ebx + 8]
push ecx
push ebx
call fcn.004069b4
add esp, 0xc
dec dword [ebp - 0x1c]
mov eax, dword [ebp - 8]
test eax, eax
je 0x5f362a
mov edx, dword [ebp - 8]
mov ecx, dword [edx - 0xc]
inc ecx
test ecx, ecx
je 0x5f35e5
mov edi, dword [ebp - 8]
add edi, 0xfffffff4
cmp edi, 0x6ff36c
je 0x5f35dc
cmp edi, 0x6ff36c
je 0x5f35d5
push edi
call sub.KERNEL32.DLL_InterlockedDecrement
mov eax, dword [edi]
inc eax
jmp 0x5f35e1
mov eax, 1
jmp 0x5f35e1
mov eax, 1
test eax, eax
jne 0x5f362a
mov edx, dword [ebp - 8]
add edx, 0xfffffff4
mov dword [ebp - 0x7c], edx
mov ecx, dword [ebp - 8]
add ecx, 0xfffffff4
mov dword [ebp - 0x80], ecx
mov eax, dword [ebp - 0x80]
push eax
call fcn.0067ac7c
pop ecx
xor edx, edx
mov dword [ebp - 0x84], edx
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 0x84]
mov dword [ebp - 8], ecx
mov dword [ebp - 0x88], eax
mov edx, dword [ebp - 0x88]
mov ecx, dword [edx + 8]
mov dword [ebp - 0x434], ecx
mov dword [ebp - 0x40], 0xc8
mov dword [ebp - 0x44], 0x1f4
inc esi
lea eax, [ebp - 0x44]
push eax
lea edx, [ebp - 0x40c]
push edx
push 0
push 0
lea ecx, [ebp - 0x40]
push ecx
lea eax, [ebp - 0x218]
push eax
push esi
mov edx, dword [ebp - 0x3c]
push edx
call sub.ADVAPI32.DLL_RegEnumValueA
test eax, eax
je 0x5f346a
mov ecx, dword [ebp - 0x3c]
push ecx
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, dword [ebp - 0x38]
mov dword fs:[0], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret