Function at 0x5d3fd0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
push esi
mov eax, 0x90
sub eax, dword [ebp - 0x24]
movzx ecx, byte [ebp - 0xc1]
add eax, ecx
mov word [ebp - 0xc0], ax
mov edx, 2
mov word [ebp - 0x80], dx
mov eax, dword [ebp - 0x38]
sub eax, dword [ebp - 0xd8]
mov ecx, dword [ebp - 0x48]
lea edx, [eax + ecx - 0x47]
mov word [ebp - 0x64], dx
mov eax, dword [ebp - 0x34]
and eax, 0x55
and eax, dword [ebp - 0x58]
and eax, dword [ebp - 0x24]
mov dword [ebp - 0x48], eax
movzx ecx, byte [ebp - 0xb]
add ecx, dword [ebp - 0x34]
add ecx, dword [ebp - 0x58]
movzx edx, word [ebp - 0xc8]
sub ecx, edx
sub ecx, dword [ebp - 0xb4]
sub ecx, dword [ebp - 0x60]
add ecx, dword [ebp - 0xf0]
mov dword [ebp - 0x74], ecx
mov eax, 0x29
sub eax, dword [ebp - 4]
add eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xdc]
and ecx, 0x3b
movzx edx, word [ebp - 0x4c]
and ecx, edx
xor eax, ecx
mov word [ebp - 0x18], ax
mov eax, dword [ebp - 0x70]
sub eax, dword [ebp - 0xd8]
mov byte [ebp - 0xa9], al
cmp dword [ebp - 0x44], 0x7b
je 0x5d40af
movzx ecx, word [ebp - 0xcc]
cmp ecx, 0xb9
je 0x5d40af
movzx edx, word [ebp - 0xc0]
add edx, dword [ebp - 0xd8]
and edx, 0xffffff75
movzx eax, word [ebp - 0x18]
and eax, dword [ebp - 0x88]
or edx, eax
mov word [ebp - 0x118], dx
jmp 0x5d40b8
mov ecx, dword [ebp - 0x44]
mov dword [ebp - 0xd8], ecx
mov edx, dword [ebp - 4]
sub edx, 0x46
sub edx, dword [ebp - 0xb8]
movzx eax, word [ebp - 0x18]
sub edx, eax
sub edx, 0x3f
movzx ecx, word [ebp - 0xf8]
movzx eax, word [ebp - 0x64]
sub ecx, eax
movzx eax, byte [ebp - 0xaa]
and ecx, eax
or edx, ecx
mov dword [ebp - 0x108], edx
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x124], ecx
mov edx, dword [ebp - 0x124]
sub edx, 0x2a
mov dword [ebp - 0x124], edx
cmp dword [ebp - 0x124], 0xa1
ja case.0x5d4120.1
mov eax, dword [ebp - 0x124]
movzx ecx, byte [eax + 0x5d43a0]
jmp dword [ecx*4 + 0x5d4384]
movzx edx, byte [ebp - 0x1f]
mov dword [ebp - 0xb4], edx
jmp 0x5d41f5
mov eax, dword [ebp - 0x9c]
sub eax, dword [ebp - 0x98]
movzx ecx, word [ebp - 0x90]
add eax, ecx
sub eax, dword [ebp - 0x48]
mov word [ebp - 0x2c], ax
jmp 0x5d41f5
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x44]
lea ecx, [eax + edx - 0x5f]
movzx edx, word [ebp - 0x100]
sub ecx, edx
retf 0xb60f
test dword [esi], edi
invalid
invalid
jmp [ebx]
enter 0xffffffffffffc181, 0xffffffffffffff8a
add byte [eax], al
add byte [ecx + 0x77ebfc4d], cl
mov ecx, 0x69
sub ecx, dword [ebp - 0x38]
sub ecx, dword [ebp - 0x10c]
mov dword [ebp - 0x9c], ecx
jmp 0x5d41f5
mov byte [ebp - 0x1e], 0x98
jmp 0x5d41f5
movzx edx, byte [ebp - 0xd1]
sub edx, 0xa1
movzx eax, byte [ebp - 0xc2]
sub edx, eax
or edx, dword [ebp - 0x88]
mov dword [ebp - 0x88], edx
jmp 0x5d41f5
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_InitializeAcl]
mov esi, eax
sub esi, dword [ebp - 0x10c]
sub esi, 0x28
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessWorkingSetSize]
sub eax, dword [ebp - 0x34]
movzx ecx, byte [ebp - 0xad]
sub eax, ecx
or esi, eax
mov dword [ebp - 0x98], esi
mov dword [ebp - 0x28], 0xad
movzx edx, byte [ebp - 0xc1]
cmp dword [ebp - 0xf0], edx
je 0x5d423f
movzx eax, word [ebp - 0x64]
cmp eax, 0x6a
je 0x5d423f
mov ecx, 0x3d
sub ecx, dword [ebp - 0xf0]
add ecx, dword [ebp - 0x24]
movzx edx, byte [ebp - 0xaa]
sub edx, dword [ebp - 0x60]
sub edx, dword [ebp - 0xdc]
movzx eax, word [ebp - 0x7c]
sub edx, eax
and ecx, edx
mov byte [ebp - 0x6a], cl
jmp 0x5d4252
movzx ecx, word [ebp - 0xcc]
add ecx, dword [ebp - 0x70]
sub ecx, dword [ebp - 0x88]
mov dword [ebp - 0x48], ecx
movzx edx, byte [ebp - 0xe9]
test edx, edx
je 0x5d426d
movzx eax, word [ebp - 0xcc]
add eax, dword [ebp - 0x24]
mov word [ebp - 0x14], ax
jmp 0x5d4282
movzx ecx, byte [ebp - 0x1f]
mov edx, dword [ebp - 0x11c]
lea eax, [ecx + edx + 0x43]
mov word [ebp - 0xe4], ax
cmp dword [ebp - 4], 0
jne 0x5d4290
movzx ecx, word [ebp - 0x68]
test ecx, ecx
jne 0x5d42aa
mov edx, dword [ebp - 0xf0]
add edx, dword [ebp - 0xd8]
and edx, dword [ebp - 0x60]
movzx eax, word [ebp - 0x7c]
and edx, eax
mov dword [ebp - 0x38], edx
jmp 0x5d42b6
mov ecx, dword [ebp - 0x5c]
and ecx, dword [ebp - 0x10c]
mov byte [ebp - 0x3d], cl
mov dx, word [ebp - 0xe8]
mov word [ebp - 0xe8], dx
movzx eax, byte [ebp - 0xaa]
mov ecx, 0xde
sub ecx, dword [ebp - 0x10]
and eax, ecx
movzx edx, word [ebp - 0xe0]
sub edx, 0x41
and eax, edx
and eax, 0xfb
mov byte [ebp - 0xab], al
cmp dword [ebp - 0x28], 0xf3
jne 0x5d4329
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_SetTokenInformation]
add eax, dword [ebp - 0x5c]
and eax, dword [ebp - 0xf0]
movzx ecx, word [ebp - 0x118]
add ecx, dword [ebp - 0x98]
sub ecx, dword [ebp - 0xf0]
shr ecx, 0x50
and eax, ecx
mov dword [ebp - 0x34], eax
jmp 0x5d4350
mov edx, dword [ebp - 0x74]
sub edx, dword [ebp - 0x58]
movzx eax, word [ebp - 0xa8]
add edx, eax
sub edx, dword [ebp - 8]
add edx, dword [ebp - 0x48]
movzx ecx, word [ebp - 0xe4]
sub edx, ecx
add edx, dword [ebp - 0x48]
mov dword [ebp - 0x88], edx
movzx esi, byte [ebp - 0x101]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add eax, dword [ebp - 0x5c]
and esi, eax
and esi, 0xd
mov dword [ebp - 0x10c], esi
mov ax, word [ebp - 0x8c]
pop esi
mov esp, ebp
pop ebp
ret