Function at 0x5a5560
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push 0x328
push 1
call fcn.00580d1f
mov esi, eax
add esp, 8
test esi, esi
jne 0x5a5581
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push edi
lea eax, [ebp - 8]
mov dword [esi + 4], 1
push eax
push 0x20119
push 0
push str.SoftwareFreeRDPFreeRDPWinPRNTLM
push connect
mov dword [esi + 8], 0
mov dword [esi + 0x5c], 1
mov dword [esi + 0xc0], 0
mov dword [esi + 0x8c], 1
mov dword [esi + 0xc4], 1
mov dword [esi + 0x80], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x5a5746
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.NTLMv2
push dword [ebp - 8]
call ebx
test eax, eax
jne 0x5a5614
cmp dword [ebp - 4], eax
setne al
mov dword [esi + 4], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.UseMIC
push dword [ebp - 8]
call ebx
test eax, eax
jne 0x5a5639
cmp dword [ebp - 4], eax
setne al
mov dword [esi + 8], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.SendVersionInfo
push dword [ebp - 8]
call ebx
test eax, eax
jne 0x5a565e
cmp dword [ebp - 4], eax
setne al
mov dword [esi + 0x5c], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.SendSingleHostData
push dword [ebp - 8]
call ebx
test eax, eax
jne 0x5a5686
cmp dword [ebp - 4], eax
setne al
mov dword [esi + 0xc0], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.SendWorkstationName
push dword [ebp - 8]
call ebx
test eax, eax
jne 0x5a56ae
cmp dword [ebp - 4], eax
setne al
mov dword [esi + 0x8c], eax
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push 0x621d18
push dword [ebp - 8]
call ebx
test eax, eax
jne 0x5a5741
mov eax, dword [ebp - 0xc]
inc eax
push eax
call fcn.0058023c
mov edi, eax
add esp, 4
test edi, edi
jne 0x5a56ed
push esi
call fcn.00580204
add esp, 4
xor eax, eax
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0xc]
push eax
push edi
lea eax, [ebp - 0x10]
push eax
push 0
push str.WorkstationName
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 0xc]
push edi
push esi
mov byte [edi + eax], 0
call fcn.005a5ba0
add esp, 8
push edi
test eax, eax
jns 0x5a5733
call fcn.00580204
push esi
call fcn.00580204
add esp, 8
xor eax, eax
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
call fcn.00580204
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 4
push dword [ebp - 8]
call edi
lea eax, [ebp - 8]
mov dword [esi + 0x88], 0
push eax
push 0x20119
push 0
push str.SystemCurrentControlSetControlLSA
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x5a579c
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.SuppressExtendedProtection
push dword [ebp - 8]
call ebx
test eax, eax
jne 0x5a5797
cmp dword [ebp - 4], eax
setne al
mov dword [esi + 0x88], eax
push dword [ebp - 8]
call edi
movdqa xmm0, xmmword [0x621e80]
mov dword [esi + 0x7c], 0
mov dword [esi + 0x84], 3
mov dword [esi + 0xc], 0
movdqu xmmword [esi + 0x3c], xmm0
movdqu xmmword [esi + 0x4c], xmm0
cmp dword [esi + 4], 0
je 0x5a57d3
mov dword [esi + 8], 1
pop edi
pop ebx
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret