Function at 0x7039ffb0
Capabilities:
Query or enumerate registry key
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
mov edi, eax
push esi
push ebx
sub esp, 0x9c
mov dword [esp + 0x34], eax
lea eax, [esp + 0x68]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x64]
mov dword [esp + 0x10], eax
mov eax, dword [sym.imp.advapi32.dll_RegQueryInfoKeyW]
mov dword [esp + 0x40], edx
mov dword [esp + 0x38], ecx
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], edi
mov dword [esp + 0x3c], eax
call eax
sub esp, 0x30
test eax, eax
jne 0x703a052d
mov eax, dword [esp + 0x64]
mov ebp, 1
test eax, eax
jne 0x703a0058
add esp, 0x9c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [esp + 0x68]
add ebx, 1
lea eax, [ebx + ebx]
mov dword [esp], eax
mov eax, dword [sym.imp.ucrtbase.dll_malloc]
mov dword [esp + 0x44], eax
call eax
mov dword [esp + 0x30], eax
test eax, eax
je 0x703a05f9
xor esi, esi
jmp 0x703a0094
add esi, 1
cmp esi, dword [esp + 0x64]
jae 0x703a0210
mov eax, dword [esp + 0x68]
lea ebx, [eax + 1]
lea eax, [esp + 0x6c]
mov dword [esp + 0x6c], ebx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 8], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x10], 0
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegEnumKeyExW]
sub esp, 0x20
mov ebp, eax
test eax, eax
jne 0x703a0378
mov edi, dword [esp + 0x6c]
cmp dword [esp + 0xb0], edi
jb 0x703a0080
mov edx, dword [esp + 0x38]
mov ecx, 1
lea eax, [esp + 0x74]
mov dword [esp], eax
mov eax, dword [esp + 0x30]
call fcn.7039fd70
test eax, eax
je 0x703a0080
lea eax, [esp + 0x70]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x34]
mov dword [esp], eax
mov eax, dword [sym.imp.advapi32.dll_RegOpenKeyW]
mov dword [esp + 0x48], eax
call eax
sub esp, 0xc
test eax, eax
jne 0x703a05b0
mov ebx, dword [esp + 0x74]
cmp dword [esp + 0x38], ebx
je 0x703a03c8
mov dword [esp + 4], edi
lea eax, [esp + 0x78]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call fcn.703b28e0
lea eax, [esp + 0x80]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x14], eax
lea eax, [esp + 0x7c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
call eax
sub esp, 0x30
mov edi, eax
test eax, eax
jne 0x703a0400
mov eax, dword [esp + 0x7c]
test eax, eax
jne 0x703a0230
mov eax, dword [esp + 0x78]
test eax, eax
je 0x703a03a0
mov eax, dword [esp + 0x70]
add esi, 1
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
cmp esi, dword [esp + 0x64]
jb 0x703a008d
lea esi, [esi]
mov ebp, 1
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_free]
add esp, 0x9c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [esp + 0x80]
add ecx, 1
lea eax, [ecx + ecx]
mov dword [esp + 0x50], ecx
mov dword [esp], eax
mov eax, dword [esp + 0x44]
call eax
mov ecx, dword [esp + 0x50]
test eax, eax
mov dword [esp + 0x4c], eax
je 0x703a0513
mov edx, dword [esp + 0x38]
mov dword [esp + 0x58], ecx
test edx, edx
je 0x703a0506
mov eax, ebx
mov ecx, dword [esp + 0x44]
sub eax, edx
mov dword [esp + 0x54], eax
mov dword [esp], eax
call ecx
mov edx, eax
test eax, eax
je 0x703a0506
mov eax, dword [esp + 0x54]
mov dword [esp], edx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x50], edx
sub eax, 2
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call sub.ucrtbase.dll_memcpy
mov eax, dword [esp + 0x50]
xor ecx, ecx
mov dword [esp + 0x5c], ebx
mov edx, dword [esp + 0x54]
mov dword [esp + 0x54], esi
mov ebx, dword [esp + 0x4c]
mov esi, eax
mov word [eax + edx - 2], cx
mov ecx, dword [esp + 0x58]
jmp 0x703a0304
lea eax, [esp + 0x88]
xor ecx, ecx
mov edx, esi
mov dword [esp], eax
mov eax, ebx
call fcn.7039fd70
test eax, eax
jne 0x703a045a
add edi, 1
cmp edi, dword [esp + 0x7c]
jae 0x703a04df
mov eax, dword [esp + 0x80]
lea ecx, [eax + 1]
lea eax, [esp + 0x84]
mov dword [esp + 0x84], ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegEnumKeyExW]
sub esp, 0x20
test eax, eax
je 0x703a02d0
mov edi, ebx
mov eax, dword [esp + 0x50]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_free]
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_free]
jmp 0x703a0409
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_free]
add esp, 0x9c
mov ebp, 0x8000ffff
pop ebx
mov eax, ebp
pop esi
pop edi
pop ebp
ret
mov edx, dword [esp + 0x38]
mov eax, ebx
sub eax, edx
mov dword [esp], edx
sar eax, 1
sub eax, 1
movzx eax, ax
mov dword [esp + 4], eax
call dword [sym.imp.ucrtbase.dll_wcschr]
test eax, eax
jne 0x703a01f0
lea esi, [esi]
mov ecx, dword [esp + 0xb4]
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x70]
call fcn.7039fc20
mov edi, dword [sym.imp.advapi32.dll_RegCloseKey]
mov ebx, eax
mov eax, dword [esp + 0x70]
mov dword [esp], eax
call edi
sub esp, 4
test ebx, ebx
je 0x703a0080
jmp 0x703a0215
test byte [0x703d83b0], 2
jne 0x703a0423
mov eax, dword [esp + 0x70]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
mov ebp, 0x8000ffff
jmp 0x703a0215
mov eax, dword [esp + 0x30]
call fcn.7039d9b0
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Unable_to_query_info_for_key__s:__ld_n
mov dword [esp + 8], str.search_domain_for_zone
mov dword [esp + 4], 0x703d83b0
mov dword [esp], 1
call fcn.7039dc50
jmp 0x703a0409
lea eax, [esp + 0x8c]
mov edi, dword [esp + 0x4c]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x70]
mov esi, dword [esp + 0x54]
mov dword [esp + 4], edi
mov dword [esp], eax
mov eax, dword [esp + 0x48]
call eax
sub esp, 0xc
test eax, eax
je 0x703a0563
mov ebx, eax
test byte [0x703d83b0], 2
je 0x703a0358
mov eax, dword [esp + 0x30]
call fcn.7039d9b0
mov esi, eax
mov eax, edi
call fcn.7039d9b0
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Unable_to_open_subdomain_key__s_of__s:__ld_n
mov dword [esp + 8], str.search_domain_for_zone
mov dword [esp + 4], 0x703d83b0
mov dword [esp], 1
call fcn.7039dc50
jmp 0x703a0358
mov eax, dword [esp + 0x4c]
mov esi, dword [esp + 0x54]
mov ebx, dword [esp + 0x5c]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_free]
mov eax, dword [esp + 0x50]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_free]
jmp 0x703a01e4
mov edi, dword [esp + 0x4c]
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_free]
mov eax, dword [esp + 0x70]
mov ebp, 0x8007000e
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
jmp 0x703a0215
test byte [0x703d83b0], 4
je 0x703a0385
mov dword [esp + 0xc], str.Failed_to_retrieve_information_about_key_n
mov dword [esp + 8], str.search_for_domain_mapping
mov dword [esp + 4], 0x703d83b0
mov dword [esp], 2
call fcn.7039dc50
jmp 0x703a0385
mov ecx, dword [esp + 0xb4]
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x8c]
call fcn.7039fc20
mov edi, dword [sym.imp.advapi32.dll_RegCloseKey]
mov ebx, eax
mov eax, dword [esp + 0x8c]
mov dword [esp], eax
call edi
sub esp, 4
mov eax, dword [esp + 0x4c]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_free]
mov eax, dword [esp + 0x50]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_free]
jmp 0x703a03e4
mov ebx, eax
test byte [0x703d83b0], 2
je 0x703a0419
mov eax, dword [esp + 0x30]
call fcn.7039d9b0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.Failed_to_open_domain_key__s:__ld_n
mov dword [esp + 8], str.search_domain_for_zone
mov dword [esp + 4], 0x703d83b0
mov dword [esp], 1
call fcn.7039dc50
jmp 0x703a0419
mov ebp, 0x8007000e
jmp 0x703a0046