Function at 0x7d024af1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c0
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x18]
push edi
push eax
lea eax, [ebp - 0xb8]
xor edi, edi
push eax
push edi
push ebx
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x18], 0xa0
call fcn.7cf5aef1
test eax, eax
je 0x7d024b28
xor eax, eax
jmp 0x7d024d67
lea eax, [ebp - 0x10]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
push eax
lea eax, [ebp - 0xb8]
push eax
push ebx
call esi
test eax, eax
je 0x7d024b44
mov dword [ebp - 0x10], ebx
lea eax, [ebp - 4]
push eax
push 0x7cf489c8
push dword [ebp - 0x10]
call esi
test eax, eax
jne 0x7d024d54
mov ebx, dword [ebp + 0x10]
cmp ebx, edi
je 0x7d024b89
lea eax, [ebp - 0x14]
push eax
push 0x7cf489b8
push dword [ebp - 4]
call esi
test eax, eax
jne 0x7d024b87
push ebx
push dword [ebp - 0x14]
call fcn.7d024ab2
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x7d024b89
mov dword [ebx], edi
lea eax, [ebp + 0x10]
mov ebx, 0x208
push eax
lea eax, [ebp - 0x2c0]
push eax
lea eax, [ebp - 8]
push eax
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_SHQueryValueExW]
push 0x7cf489a4
push dword [ebp - 4]
mov dword [ebp + 0x10], ebx
call edi
test eax, eax
jne 0x7d024bda
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], 1
test eax, eax
je 0x7d024d45
and dword [eax + 8], 0
and dword [eax + 4], 0
mov dword [eax], 5
jmp 0x7d024d45
lea eax, [ebp + 0x10]
mov dword [ebp + 0x10], ebx
push eax
lea eax, [ebp - 0x2c0]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x7cf35e04
push dword [ebp - 4]
call edi
push 1
test eax, eax
pop esi
jne 0x7d024c20
cmp dword [ebp - 8], esi
je 0x7d024c0a
cmp dword [ebp - 8], 2
jne 0x7d024c20
mov dword [ebp - 0xc], esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x7d024d45
mov dword [esi], 4
jmp 0x7d024c62
lea eax, [ebp + 0x10]
mov dword [ebp + 0x10], ebx
push eax
lea eax, [ebp - 0x2c0]
push eax
lea eax, [ebp - 8]
xor ebx, ebx
push eax
push ebx
push 0x7cf442ac
push dword [ebp - 4]
call edi
test eax, eax
jne 0x7d024c81
cmp dword [ebp - 8], esi
je 0x7d024c4e
cmp dword [ebp - 8], 2
jne 0x7d024c81
mov dword [ebp - 0xc], esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x7d024d45
mov dword [esi], 6
mov eax, dword [ebp - 4]
mov dword [esi + 0xc], eax
lea eax, [ebp - 0x2c0]
push eax
call dword [sym.imp.SHLWAPI.dll_StrDupW]
and dword [ebp - 4], 0
mov dword [esi + 4], eax
jmp 0x7d024d45
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 8]
push ebx
push eax
push ebx
mov ebx, 0x7cf48998
push ebx
push dword [ebp - 4]
call edi
test eax, eax
jne 0x7d024d45
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x7d024d45
mov dword [ebp - 0xc], esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x7d024d45
push eax
push 0x40
mov dword [esi], 3
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
mov dword [esi + 4], eax
je 0x7d024d45
cmp dword [ebp - 8], 1
jne 0x7d024d34
push dword [ebp + 0x10]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
mov dword [ebp + 0xc], eax
je 0x7d024d25
lea ecx, [ebp + 0x10]
push ecx
push eax
lea eax, [ebp - 8]
push eax
push 0
push ebx
push dword [ebp - 4]
call edi
push dword [ebp + 0x10]
push dword [esi + 4]
push dword [ebp + 0xc]
call dword [sym.imp.SHLWAPI.dll_SHUnicodeToAnsi]
mov edi, dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi + 8], eax
test eax, eax
jne 0x7d024d1e
push dword [esi + 4]
call edi
and dword [esi + 4], 0
push dword [ebp + 0xc]
call edi
jmp 0x7d024d45
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
and dword [esi + 4], 0
jmp 0x7d024d45
lea ecx, [ebp + 0x10]
push ecx
push eax
lea eax, [ebp - 8]
push eax
push 0
push ebx
push dword [ebp - 4]
call edi
cmp dword [ebp - 4], 0
je 0x7d024d54
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 8]
je 0x7d024d63
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
pop esi
pop edi
pop ebx
leave
ret 0xc