Function at 0x5d4e14ae
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
or dword [ebp - 4], 0xffffffff
push ebx
push esi
xor esi, esi
cmp dword [0x5d4e3760], esi
push edi
jne 0x5d4e1778
lea eax, [ebp - 4]
push eax
push 0x20019
push esi
push 0x5d4e10e4
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, eax
cmp edi, esi
je 0x5d4e14f1
push edi
push 0x2ee3
jmp 0x5d4e1549
push 4
pop ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0x5d4e10d4
push dword [ebp - 4]
mov dword [ebp - 8], ebx
call esi
mov edi, eax
test edi, edi
je 0x5d4e1522
push edi
push 0x2ee4
jmp 0x5d4e1549
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x5d4e10c8
push dword [ebp - 4]
mov dword [ebp - 8], ebx
call esi
mov edi, eax
test edi, edi
je 0x5d4e1553
push edi
push 0x2ee5
call fcn.5d4e118a
jmp 0x5d4e1780
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
add dword [0x5d4e3014], eax
add dword [0x5d4e301c], ecx
add dword [0x5d4e304c], eax
add dword [0x5d4e3054], ecx
add dword [0x5d4e3074], eax
add dword [0x5d4e307c], ecx
add dword [0x5d4e309c], eax
add dword [0x5d4e30a4], ecx
add dword [0x5d4e30c4], eax
add dword [0x5d4e30cc], ecx
add dword [0x5d4e30ec], eax
add dword [0x5d4e30f4], ecx
add dword [0x5d4e3114], eax
add dword [0x5d4e311c], ecx
add dword [0x5d4e313c], eax
add dword [0x5d4e3144], ecx
add dword [0x5d4e3164], eax
add dword [0x5d4e316c], ecx
add dword [0x5d4e318c], eax
add dword [0x5d4e3194], ecx
add dword [0x5d4e31b4], eax
add dword [0x5d4e31bc], ecx
add dword [0x5d4e31dc], eax
add dword [0x5d4e31e4], ecx
add dword [0x5d4e320c], eax
add dword [0x5d4e3214], ecx
add dword [0x5d4e3244], eax
add dword [0x5d4e324c], ecx
add dword [0x5d4e326c], eax
add dword [0x5d4e3274], ecx
add dword [0x5d4e3294], eax
add dword [0x5d4e329c], ecx
add dword [0x5d4e32bc], eax
add dword [0x5d4e32c4], ecx
add dword [0x5d4e32e4], eax
add dword [0x5d4e32ec], ecx
add dword [0x5d4e330c], eax
add dword [0x5d4e3314], ecx
add dword [0x5d4e3334], eax
add dword [0x5d4e333c], ecx
add dword [0x5d4e335c], eax
add dword [0x5d4e3364], ecx
add dword [0x5d4e3384], eax
add dword [0x5d4e338c], ecx
add dword [0x5d4e33ac], eax
add dword [0x5d4e33b4], ecx
add dword [0x5d4e33d4], eax
add dword [0x5d4e33dc], ecx
add dword [0x5d4e33fc], eax
add dword [0x5d4e3404], ecx
add dword [0x5d4e3424], eax
add dword [0x5d4e342c], ecx
add dword [0x5d4e344c], eax
add dword [0x5d4e3454], ecx
add dword [0x5d4e3474], eax
add dword [0x5d4e347c], ecx
add dword [0x5d4e349c], eax
add dword [0x5d4e34a4], ecx
add dword [0x5d4e34c4], eax
add dword [0x5d4e34cc], ecx
add dword [0x5d4e34ec], eax
add dword [0x5d4e34f4], ecx
add dword [0x5d4e3514], eax
add dword [0x5d4e351c], ecx
add dword [0x5d4e353c], eax
add dword [0x5d4e3544], ecx
add dword [0x5d4e3564], eax
add dword [0x5d4e356c], ecx
add dword [0x5d4e358c], eax
add dword [0x5d4e3594], ecx
add dword [0x5d4e35b4], eax
add dword [0x5d4e35bc], ecx
add dword [0x5d4e35dc], eax
add dword [0x5d4e35e4], ecx
add dword [0x5d4e3604], eax
add dword [0x5d4e360c], ecx
add dword [0x5d4e362c], eax
add dword [0x5d4e3634], ecx
add dword [0x5d4e3654], eax
add dword [0x5d4e365c], ecx
add dword [0x5d4e367c], eax
add dword [0x5d4e3684], ecx
add dword [0x5d4e36a4], eax
add dword [0x5d4e36ac], ecx
add dword [0x5d4e36cc], eax
add dword [0x5d4e36d4], ecx
add dword [0x5d4e36f4], eax
add dword [0x5d4e36fc], ecx
call fcn.5d4e1380
mov dword [0x5d4e3764], 1
inc dword [0x5d4e3760]
xor edi, edi
cmp dword [ebp - 4], 0xffffffff
je 0x5d4e178f
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4