Function at 0x7f2f1816
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push edi
xor edi, edi
cmp dword [0x7f30bacc], edi
je 0x7f2f1843
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryMultipleValuesW]
jmp 0x7f2f1a8b
mov eax, dword [ebp + 0x10]
shl eax, 4
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [ebp - 8], edi
je 0x7f2f1866
push eax
push 8
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 4], eax
jmp 0x7f2f1869
mov dword [ebp - 4], edi
cmp dword [ebp - 4], edi
jne 0x7f2f187a
mov dword [ebp - 0x18], 0xe
jmp 0x7f2f1a87
mov eax, dword [ebp + 0x10]
shl eax, 8
je 0x7f2f1893
push eax
push 8
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x14], eax
jmp 0x7f2f1896
mov dword [ebp - 0x14], edi
push ebx
mov ebx, dword [ebp - 0x14]
cmp ebx, edi
jne 0x7f2f18aa
mov dword [ebp - 0x18], 0xe
jmp 0x7f2f1a69
cmp dword [ebp + 0x10], edi
jbe 0x7f2f18fb
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
sub eax, edi
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [edi]
cmp eax, 0xffff
jbe 0x7f2f18f3
push 0
push 0
push 0x100
push ebx
push eax
call fcn.7f2daf04
pop ecx
push eax
push dword [edi]
push 0
push dword [0x7f30bac8]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + edi], ebx
add ebx, eax
add edi, 0x10
dec dword [ebp - 0x18]
jne 0x7f2f18c0
mov edi, dword [ebp + 0x18]
test edi, edi
je 0x7f2f191c
mov eax, dword [edi]
test eax, eax
je 0x7f2f191c
push eax
push 8
mov dword [ebp - 0xc], eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 8], eax
jmp 0x7f2f1924
and dword [ebp - 0xc], 0
and dword [ebp - 8], 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push dword [ebp + 0x10]
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryMultipleValuesA]
test eax, eax
mov dword [ebp - 0x18], eax
jne 0x7f2f1a13
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp + 0x18], edi
jbe 0x7f2f1a59
mov esi, dword [ebp - 4]
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x10]
add esi, 4
add ebx, 0xc
sub eax, dword [ebp + 0xc]
mov dword [ebp + 8], esi
mov dword [ebp - 0x10], eax
mov dword [ebp + 0x10], ecx
jmp 0x7f2f1979
mov edi, dword [ebp + 0x18]
mov eax, dword [ebp - 0x10]
mov ecx, dword [esi]
mov edx, dword [ebp - 8]
mov dword [ebx - 8], ecx
mov eax, dword [ebx + eax]
mov dword [ebx], eax
lea eax, [edi + edx]
mov dword [ebx - 4], eax
mov eax, dword [ebx]
cmp eax, 1
je 0x7f2f19c7
cmp eax, 2
je 0x7f2f19c7
cmp eax, 7
je 0x7f2f19c7
mov ecx, dword [esi]
mov eax, dword [ebp + 0x14]
mov esi, dword [esi + 4]
add edi, eax
mov eax, ecx
shr ecx, 2
add esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebp + 8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [eax]
add dword [ebp + 0x18], eax
mov edi, dword [ebp + 0x18]
mov esi, dword [ebp + 8]
jmp 0x7f2f19f0
mov eax, dword [ebp - 0xc]
sub eax, edi
shr eax, 1
push eax
mov eax, dword [ebp + 0x14]
add eax, edi
push eax
push dword [esi]
mov eax, dword [esi + 4]
add eax, edx
push eax
push 0
push dword [0x7f30bac8]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebx - 8], eax
add edi, eax
add edi, 3
and edi, 0xfffffffc
add esi, 0x10
add ebx, 0x10
dec dword [ebp + 0x10]
mov dword [ebp + 0x18], edi
mov dword [ebp + 8], esi
jne 0x7f2f1973
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
jmp 0x7f2f1a59
cmp eax, 0xea
jne 0x7f2f1a59
test edi, edi
je 0x7f2f1a59
mov eax, dword [0x7f30bac8]
cmp eax, 0x3a4
je 0x7f2f1a54
cmp eax, 0x3b5
je 0x7f2f1a54
cmp eax, 0x3b6
je 0x7f2f1a54
cmp eax, 0x3a8
je 0x7f2f1a54
cmp eax, 0x551
je 0x7f2f1a54
cmp eax, 0xd698
je 0x7f2f1a54
mov eax, dword [ebp - 0xc]
add eax, eax
jmp 0x7f2f1a57
mov eax, dword [ebp - 0xc]
mov dword [edi], eax
push dword [ebp - 0x14]
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor edi, edi
push dword [ebp - 4]
push edi
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
push eax
call ebx
cmp dword [ebp - 8], edi
je 0x7f2f1a86
push dword [ebp - 8]
push edi
call esi
push eax
call ebx
pop ebx
mov eax, dword [ebp - 0x18]
pop esi
pop edi
leave
ret 0x14