Function at 0x5ba7fc9c
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x5bb70c3c]
push ebx
push esi
push edi
lea ecx, [ebp - 0x118]
push ecx
lea ecx, [ebp - 0x120]
push ecx
lea ecx, [ebp - 0x124]
push ecx
xor ebx, ebx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0x5ba47400
push eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x118], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x5ba7fcf3
mov dword [ebp - 0x120], ebx
cmp dword [ebp - 0x120], ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, 0x20019
jne 0x5ba7fe36
lea eax, [ebp - 0x10c]
push eax
push edi
push ebx
push 0x5ba4c734
push SysReAllocString
call esi
test eax, eax
jne 0x5ba7fd82
push 7
push 0x5ba47374
push ebx
push dword [ebp - 0x10c]
push dword [ebp - 0x110]
call fcn.5baef37b
push 0xf
push 0x5ba47390
push 0x5ba4c53c
push dword [ebp - 0x10c]
push dword [ebp - 0x110]
call fcn.5baef37b
push 0xd
push 0x5ba473cc
push 0x5ba4c544
push dword [ebp - 0x10c]
push dword [ebp - 0x110]
call fcn.5baef37b
push dword [ebp - 0x10c]
call dword [entry0]
lea eax, [ebp - 0x128]
push eax
push edi
push ebx
push 0x5ba4c760
push SysReAllocString
call esi
test eax, eax
jne 0x5ba7fe2c
push 0x104
push 0x5ba4c668
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push 0x104
push 0x5ba4c6e8
lea eax, [ebp - 0x108]
push eax
call sub.SHLWAPI.dll_StrCatBuffA
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
lea eax, [ebp - 0x108]
push eax
call fcn.5ba57156
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x5ba7fe20
cmp dword [ebp - 0x12c], 2
je 0x5ba7fe14
push dword [ebp - 0x130]
push dword [ebp - 0x128]
call sub.MSOERT2.dll_CopyRegistry
push dword [ebp - 0x130]
call dword [entry0]
push dword [ebp - 0x128]
call dword [entry0]
mov dword [ebp - 0x120], 1
cmp dword [ebp - 0x120], 1
jne 0x5ba7ffc3
or dword [ebp - 0x11c], 0xffffffff
lea eax, [ebp - 0x10c]
push eax
push edi
push ebx
push 0x5ba4c53c
push dword [ebp - 0x110]
call esi
test eax, eax
jne 0x5ba7feda
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x124]
push eax
push ebx
push 0x5ba4d680
push dword [ebp - 0x10c]
mov dword [ebp - 0x118], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x5ba7fece
cmp word [ebp - 0x114], bx
je 0x5ba7fece
push 1
push dword [ebp - 0x114]
push dword [ebp - 0x10c]
push dword [ebp - 0x110]
call fcn.5baef496
test eax, eax
je 0x5ba7fece
mov eax, dword [ebp - 0x114]
shr eax, 0x10
mov dword [ebp - 0x11c], eax
push dword [ebp - 0x10c]
call dword [entry0]
lea eax, [ebp - 0x10c]
push eax
push edi
push ebx
push 0x5ba4c544
push dword [ebp - 0x110]
call esi
test eax, eax
push 4
pop edi
jne 0x5ba7ff71
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x124]
push eax
push ebx
push 0x5ba4d680
push dword [ebp - 0x10c]
mov dword [ebp - 0x118], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x5ba7ff65
cmp word [ebp - 0x114], bx
je 0x5ba7ff65
push ebx
push dword [ebp - 0x114]
push dword [ebp - 0x10c]
push dword [ebp - 0x110]
call fcn.5baef496
test eax, eax
je 0x5ba7ff65
cmp dword [ebp - 0x11c], 0xffffffff
jne 0x5ba7ff65
mov eax, dword [ebp - 0x114]
shr eax, 0x10
mov dword [ebp - 0x11c], eax
push dword [ebp - 0x10c]
call dword [entry0]
cmp dword [ebp - 0x11c], 0xffffffff
mov dword [ebp - 0x118], edi
je 0x5ba7ffc3
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x124]
push eax
push ebx
mov esi, 0x5ba4da00
push esi
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x5ba7ffc3
push edi
lea eax, [ebp - 0x11c]
push eax
push edi
push ebx
push esi
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.5bb3f314
leave
ret 4