Function at 0x5bad438b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3ac
mov eax, dword [0x5bb70c3c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push edi
mov dword [ebp - 0x3a0], eax
mov eax, dword [ebp + 0xc]
push 0x40
mov dword [ebp - 0x3a8], eax
pop ecx
xor ebx, ebx
xor eax, eax
mov byte [ebp - 0x14c], bl
lea edi, [ebp - 0x14b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [ebp - 0x354], bl
mov ecx, 0x81
lea edi, [ebp - 0x353]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0xe
pop ecx
or dword [ebp - 0x394], 0xffffffff
xor eax, eax
push 8
mov dword [ebp - 0x390], ebx
lea edi, [ebp - 0x38c]
rep stosd dword es:[edi], eax
pop ecx
push 7
mov byte [ebp - 0x28], bl
lea edi, [ebp - 0x27]
rep stosd dword es:[edi], eax
pop ecx
mov byte [ebp - 0x48], bl
lea edi, [ebp - 0x47]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0xa
mov edi, 0x5bb72ab0
push edi
mov dword [ebp - 0x398], ebx
mov dword [ebp - 0x39c], ebx
mov dword [ebp - 0x3ac], ebx
call dword [sym.imp.KERNEL32.dll_GetACP]
push eax
call fcn.5bb36463
add esp, 0xc
call fcn.5ba6ffd0
cmp eax, ebx
je 0x5bad4534
push 0x5ba4cddc
push eax
push 0x5ba44cdc
lea eax, [ebp - 0x14c]
push 0x103
push eax
call fcn.5bac1045
push edi
lea eax, [ebp - 0x14c]
push eax
push 0x5ba43c98
lea eax, [ebp - 0x354]
push 0x207
push eax
call fcn.5bac1045
add esp, 0x28
lea eax, [ebp - 0x3ac]
push eax
lea eax, [ebp - 0x39c]
push eax
push ebx
push 0x20019
push ebx
push ebx
push ebx
lea eax, [ebp - 0x354]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x5bad4534
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x398]
push eax
lea eax, [ebp - 0x48]
push eax
push ebx
push ebx
push 0x5ba44ccc
push dword [ebp - 0x39c]
mov dword [ebp - 0x398], 0x20
call edi
test eax, eax
je 0x5bad44e6
mov byte [ebp - 0x48], bl
lea eax, [ebp - 0x398]
push eax
lea eax, [ebp - 0x394]
push eax
lea eax, [ebp - 0x3a4]
push eax
push ebx
push 0x5ba44cc0
push dword [ebp - 0x39c]
mov dword [ebp - 0x398], 4
mov dword [ebp - 0x3a4], 3
call edi
test eax, eax
je 0x5bad4528
or dword [ebp - 0x394], 0xffffffff
push dword [ebp - 0x39c]
call dword [entry0]
cmp dword [ebp + 0x10], ebx
mov edi, 0x5ba44a00
jne 0x5bad4543
mov edi, 0x5ba44a18
cmp dword [ebp - 0x394], 0xffffffff
jne 0x5bad4556
mov dword [ebp - 0x394], 2
mov eax, dword [ebp - 0x394]
push esi
inc eax
push eax
call fcn.5bac6f79
push 0x48
push 0x5a
push dword [ebp - 0x3a8]
mov esi, eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MulDiv]
neg eax
cmp byte [ebp - 0x48], bl
mov dword [ebp - 0x390], eax
mov dword [ebp - 0x380], 0x190
mov byte [ebp - 0x378], bl
mov byte [ebp - 0x377], bl
mov byte [ebp - 0x376], 1
mov byte [ebp - 0x379], 1
mov byte [ebp - 0x37c], bl
mov byte [ebp - 0x37b], bl
pop esi
jne 0x5bad4624
push 0x20
lea eax, [ebp - 0x28]
push eax
push dword [edi + 0x14]
push dword [ebp - 0x3a0]
call fcn.5ba6c8cb
cmp byte [ebp - 0x28], bl
lea eax, [ebp - 0x28]
jne 0x5bad4627
push 0x20
push eax
push 0x16b3
push dword [0x5bb73708]
call dword [sym.imp.USER32.dll_LoadStringA]
test eax, eax
je 0x5bad4636
lea eax, [ebp - 0x28]
push eax
push 0x1f
lea eax, [ebp - 0x374]
push eax
call fcn.5bad01a2
push ebx
push ebx
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x28]
push eax
push dword [edi + 0x14]
push dword [ebp - 0x3a0]
call fcn.5ba5c229
jmp 0x5bad4636
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x374]
push 0x1f
push eax
call fcn.5bad01a2
lea eax, [ebp - 0x390]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov ecx, dword [ebp - 4]
pop edi
pop ebx
call fcn.5bb3f314
leave
ret 0xc