5D685A30 **fn_5D685A30: 5D685A30 55 push ebp 5D685A31 8BEC mov ebp,esp 5D685A33 83EC0C sub esp,0Ch 5D685A36 56 push esi 5D685A37 8D45F8 lea eax,[ebp-8] 5D685A3A 50 push eax 5D685A36 33C0 xor eax,eax 5D685A38 40 inc eax 5D685A39 EB57 jmp loc_5D685A92 5D685A3B 6A01 push 1 5D685A3D 33F6 xor esi,esi 5D685A3F 56 push esi 5D685A40 68B015685D push offset off_5D6815B0 ; 'SYSTEM\CurrentControlSet\Control\SafeBoot\Option',000h 5D685A45 6802000080 push 80000002h 5D685A4A FF157C10685D call dword ptr [RegOpenKeyExW] 5D685A50 85C0 test eax,eax 5D685A52 753B jnz loc_5D685A8F 5D685A54 8D45F4 lea eax,[ebp-0Ch] 5D685A57 50 push eax 5D685A58 8D45FC lea eax,[ebp-4] 5D685A5B 50 push eax 5D685A5C 56 push esi 5D685A5D 56 push esi 5D685A5E 689415685D push offset off_5D681594 ; 'OptionValue',000h 5D685A63 FF75F8 push dword ptr [ebp-8] 5D685A66 C745F404000000 mov dword ptr [ebp-0Ch],4 5D685A6D FF157810685D call dword ptr [RegQueryValueExW] 5D685A73 85C0 test eax,eax 5D685A75 750F jnz loc_5D685A86 5D685A77 837DFC01 cmp dword ptr [ebp-4],1 5D685A7B 7406 jz loc_5D685A83 5D685A7D 837DFC02 cmp dword ptr [ebp-4],2 5D685A81 7503 jnz loc_5D685A86 5D685A83 loc_5D685A83: ; Xref 5D685A7B 5D685A83 33F6 xor esi,esi 5D685A85 46 inc esi 5D685A86 loc_5D685A86: ; Xref 5D685A75 5D685A81 5D685A86 FF75F8 push dword ptr [ebp-8] 5D685A89 FF157410685D call dword ptr [RegCloseKey] 5D685A8F loc_5D685A8F: ; Xref 5D685A52 5D685A8F 8BC6 mov eax,esi 5D685A91 5E pop esi 5D685A92 loc_5D685A92: ; Xref 5D685A39 5D685A92 C9 leave 5D685A93 C3 ret