Function at 0x3013865a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x3002450c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x18]
push edi
xor edi, edi
and dword [ebp - 0x114], edi
test eax, eax
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x10c], ecx
je 0x3013869b
cmp dword [eax], 0x10
jne 0x3013869b
cmp dword [eax + 4], 1
je 0x301386a5
mov edi, 0x80070057
jmp 0x30138ed8
test ecx, ecx
je 0x3013869b
cmp dword [ecx], 0x10
jne 0x3013869b
cmp dword [ecx + 4], 2
jne 0x3013869b
test esi, esi
je 0x3013869b
cmp dword [esi], 0x25f8
jne 0x3013869b
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x301386d2
cmp dword [eax], 0x10
jne 0x3013869b
cmp dword [eax + 4], 3
jne 0x3013869b
test byte [esi + 4], 1
je 0x301386f3
push dword [ecx + 0xc]
lea eax, [esi + 8]
push 0x80
push eax
call fcn.300f303c
mov edi, eax
test edi, edi
jl 0x30138ed8
test byte [esi + 4], 2
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
je 0x30138765
lea ecx, [ebp - 0x108]
push ecx
lea eax, [esi + 0x108]
push eax
mov eax, dword [ebp - 0x10c]
push 0
push 0
push 0x30024950
push dword [eax + 8]
mov dword [ebp - 0x108], 0x208
call ebx
test eax, eax
jle 0x3013873a
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp edi, 0x80070002
jne 0x3013875d
push 0x208
lea eax, [esi + 0x108]
push 0
push eax
call sub.MSVCR80.dll_memset
xor edi, edi
add esp, 0xc
inc edi
test edi, edi
jl 0x30138ed7
test byte [esi + 4], 4
je 0x301387d0
lea ecx, [ebp - 0x108]
push ecx
lea eax, [esi + 0x310]
push eax
mov eax, dword [ebp - 0x10c]
push 0
push 0
push 0x30024998
push dword [eax + 8]
mov dword [ebp - 0x108], 0x1048
call ebx
test eax, eax
jle 0x301387a5
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp edi, 0x80070002
jne 0x301387c8
push 0x1048
lea eax, [esi + 0x310]
push 0
push eax
call sub.MSVCR80.dll_memset
xor edi, edi
add esp, 0xc
inc edi
test edi, edi
jl 0x30138ed7
test byte [esi + 4], 8
je 0x30138837
lea eax, [ebp - 0x108]
push eax
mov eax, dword [ebp - 0x10c]
lea edi, [esi + 0x1358]
push edi
push 0
push 0
push 0x30024af0
push dword [eax + 8]
mov dword [ebp - 0x108], 4
call ebx
test eax, eax
mov ecx, eax
jle 0x30138814
and ecx, 0xffff
or ecx, 0x80070000
cmp ecx, 0x80070002
jne 0x3013881f
and dword [edi], 0
test eax, eax
jle 0x3013882d
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
test edi, edi
jl 0x30138ed7
test byte [esi + 4], 0x10
je 0x301388f3
lea eax, [ebp - 0x108]
push eax
mov eax, dword [ebp - 0x10c]
lea edi, [esi + 0x135c]
push edi
push 0
push 0
push 0x30024adc
push dword [eax + 8]
mov dword [ebp - 0x108], 4
call ebx
test eax, eax
mov ecx, eax
jle 0x3013887f
and ecx, 0xffff
or ecx, 0x80070000
cmp ecx, 0x80070002
jne 0x3013888a
and dword [edi], 0
test eax, eax
mov edi, eax
jle 0x3013889c
and edi, 0xffff
or edi, 0x80070000
test edi, edi
jl 0x30138ed7
mov ecx, dword [esi + 0x135c]
cmp ecx, 0x8003
je 0x301388ba
cmp ecx, 0x8004
jne 0x301388db
lea eax, [esi + 0x1360]
push eax
push dword [esi + 0x1364]
mov eax, dword [ebp - 0x10c]
push 0
push 0
push 0x30024ad0
push dword [eax + 8]
call ebx
test eax, eax
jle 0x301388e9
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
test edi, edi
jl 0x30138ed7
test byte [esi + 4], 0x20
je 0x3013893d
lea eax, [ebp - 0x108]
push eax
lea eax, [esi + 0x1368]
push eax
mov eax, dword [ebp - 0x10c]
push 0
push 0
push 0x300248f4
push dword [eax + 8]
mov dword [ebp - 0x108], 4
call ebx
test eax, eax
jle 0x30138933
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
test edi, edi
jl 0x30138ed7
test byte [esi + 4], 0x40
je 0x301389d9
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x104]
push eax
mov eax, dword [ebp - 0x10c]
push 0
push 0
push 0x300249c0
push dword [eax + 8]
mov dword [ebp - 0x108], 0x100
call ebx
test eax, eax
jle 0x30138981
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
test edi, edi
jne 0x301389bf
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x118]
call fcn.30138143
mov edi, eax
test edi, edi
jl 0x30138ec3
mov eax, dword [ebp - 0x114]
and dword [ebp - 0x114], 0
mov dword [esi + 0x136c], eax
jmp 0x301389d1
cmp edi, 0x80070002
jne 0x301389d1
and dword [esi + 0x136c], 0
xor edi, edi
inc edi
test edi, edi
jl 0x30138ed7
test byte [esi + 4], 0x80
je 0x30138a75
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x104]
push eax
mov eax, dword [ebp - 0x10c]
push 0
push 0
push 0x30024aac
push dword [eax + 8]
mov dword [ebp - 0x108], 0x100
call ebx
test eax, eax
jle 0x30138a1d
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
test edi, edi
jne 0x30138a5b
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x118]
call fcn.3013801b
mov edi, eax
test edi, edi
jl 0x30138ec3
mov eax, dword [ebp - 0x114]
and dword [ebp - 0x114], 0
mov dword [esi + 0x1370], eax
jmp 0x30138a6d
cmp edi, 0x80070002
jne 0x30138a6d
and dword [esi + 0x1370], 0
xor edi, edi
inc edi
test edi, edi
jl 0x30138ed7
test dword [esi + 4], 0x100000
je 0x30138af5
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x110]
push eax
mov eax, dword [ebp - 0x10c]
xor edi, edi
push edi
push edi
push 0x30024aa0
push dword [eax + 8]
mov dword [ebp - 0x108], 4
call ebx
cmp eax, edi
mov ecx, eax
jle 0x30138abc
and ecx, 0xffff
or ecx, 0x80070000
cmp ecx, 0x80070002
jne 0x30138aca
mov dword [ebp - 0x110], edi
cmp eax, edi
jle 0x30138ad8
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
test edi, edi
jl 0x30138ed7
mov eax, dword [ebp - 0x110]
and dword [esi + 0x137c], 0
mov dword [esi + 0x1378], eax
test dword [esi + 4], 0x200000
je 0x30138b75
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x110]
push eax
mov eax, dword [ebp - 0x10c]
xor edi, edi
push edi
push edi
push 0x3000ea4c
push dword [eax + 8]
mov dword [ebp - 0x108], 4
call ebx
cmp eax, edi
mov ecx, eax
jle 0x30138b3c
and ecx, 0xffff
or ecx, 0x80070000
cmp ecx, 0x80070002
jne 0x30138b4a
mov dword [ebp - 0x110], edi
cmp eax, edi
jle 0x30138b58
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
test edi, edi
jl 0x30138ed7
mov eax, dword [ebp - 0x110]
and dword [esi + 0x1384], 0
mov dword [esi + 0x1380], eax
test dword [esi + 4], 0x400000
je 0x30138d06
lea eax, [ebp - 0x108]
push eax
mov eax, dword [ebp - 0x10c]
lea edi, [esi + 0x1388]
push edi
push 0
push 0
push 0x30024a88
push dword [eax + 8]
mov dword [ebp - 0x108], 4
call ebx
test eax, eax
mov ecx, eax
jle 0x30138bc0
and ecx, 0xffff
or ecx, 0x80070000
cmp ecx, 0x80070002
jne 0x30138bcb
and dword [edi], 0
test eax, eax
jle 0x30138bd9
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
test edi, edi
jl 0x30138ed7
lea eax, [ebp - 0x108]
push eax
mov eax, dword [ebp - 0x10c]
lea edi, [esi + 0x138c]
push edi
push 0
push 0
push 0x30024a6c
push dword [eax + 8]
mov dword [ebp - 0x108], 4
call ebx
test eax, eax
mov ecx, eax
jle 0x30138c21
and ecx, 0xffff
or ecx, 0x80070000
cmp ecx, 0x80070002
jne 0x30138c2c
and dword [edi], 0
test eax, eax
jle 0x30138c3a
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
test edi, edi
jl 0x30138ed7
lea eax, [ebp - 0x108]
push eax
mov eax, dword [ebp - 0x10c]
lea edi, [esi + 0x1390]
push edi
push 0
push 0
push 0x30024a54
push dword [eax + 8]
mov dword [ebp - 0x108], 4
call ebx
test eax, eax
mov ecx, eax
jle 0x30138c82
and ecx, 0xffff
or ecx, 0x80070000
cmp ecx, 0x80070002
jne 0x30138c8d
and dword [edi], 0
test eax, eax
jle 0x30138c9b
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
test edi, edi
jl 0x30138ed7
lea eax, [ebp - 0x108]
push eax
mov eax, dword [ebp - 0x10c]
lea edi, [esi + 0x1394]
push edi
push 0
push 0
push 0x30024a34
push dword [eax + 8]
mov dword [ebp - 0x108], 4
call ebx
test eax, eax
mov ecx, eax
jle 0x30138ce3
and ecx, 0xffff
or ecx, 0x80070000
cmp ecx, 0x80070002
jne 0x30138cee
and dword [edi], 0
test eax, eax
jle 0x30138cfc
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
test edi, edi
jl 0x30138ed7
test dword [esi + 4], 0x800000
je 0x30138d73
lea eax, [ebp - 0x108]
push eax
mov eax, dword [ebp - 0x10c]
lea edi, [esi + 0x1398]
push edi
push 0
push 0
push 0x30024a20
push dword [eax + 8]
mov dword [ebp - 0x108], 4
call ebx
test eax, eax
mov ecx, eax
jle 0x30138d4d
and ecx, 0xffff
or ecx, 0x80070000
cmp ecx, 0x80070002
jne 0x30138d5b
mov dword [edi], 1
test eax, eax
jle 0x30138d69
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
test edi, edi
jl 0x30138ed7
test dword [esi + 4], 0x1000000
je 0x30138e69
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x110]
push eax
mov eax, dword [ebp - 0x10c]
xor edi, edi
push edi
push edi
push 0x30024a00
push dword [eax + 8]
mov dword [ebp - 0x11c], edi
mov dword [ebp - 0x108], 4
call ebx
cmp eax, edi
jle 0x30138dc0
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp edi, 0x80070002
jne 0x30138dd4
and dword [ebp - 0x110], 0
xor edi, edi
inc edi
test edi, edi
jl 0x30138ed7
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x11c]
push eax
mov eax, dword [ebp - 0x10c]
push 0
push 0
push 0x300249e0
push dword [eax + 8]
mov dword [ebp - 0x108], 4
call ebx
test eax, eax
jle 0x30138e16
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp edi, 0x80070002
jne 0x30138e31
and dword [ebp - 0x110], 0
and dword [ebp - 0x11c], 0
xor edi, edi
inc edi
test edi, edi
jl 0x30138ed7
and dword [esi + 0x13a4], 0
mov eax, dword [ebp - 0x110]
mov edx, dword [esi + 0x13a4]
mov cl, 0x20
call fcn.301f8713
or eax, dword [ebp - 0x11c]
xor ecx, ecx
or edx, ecx
mov dword [esi + 0x13a0], eax
mov dword [esi + 0x13a4], edx
test dword [esi + 4], 0x2000000
je 0x30138e98
mov ecx, dword [ebp + 0x10]
push 0x104
lea eax, [esi + 0x13a8]
push eax
push dword [ebp - 0x118]
push dword [ebp - 0x10c]
call fcn.30138356
mov edi, eax
test edi, edi
jl 0x30138ed7
test dword [esi + 4], 0x4000000
je 0x30138ed7
mov edi, dword [ebp - 0x10c]
push 0x824
add esi, 0x15b0
push esi
push dword [ebp + 0x14]
push dword [ebp - 0x118]
call fcn.301384e1
mov edi, eax
cmp dword [ebp - 0x114], 0
je 0x30138ed7
push dword [ebp - 0x114]
call fcn.30137d22
pop ebx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.30136bd1
leave
ret 0x14