Function at 0x2e00d46d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2824
call fcn.2e0142c9
mov eax, dword [0x2e021014]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov dword [ebp - 0x2818], eax
mov eax, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x2824], eax
mov eax, dword [ebp + 0x14]
xor ebx, ebx
mov esi, 0x25f8
push esi
mov dword [ebp - 0x2820], eax
mov dword [eax], ebx
lea eax, [ebp - 0x2810]
push ebx
push eax
mov dword [ebp - 0x281c], ebx
call fcn.2e0140ad
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0x2808]
push 0x80
push eax
mov dword [ebp - 0x2810], esi
mov dword [ebp - 0x280c], 0x2f
call fcn.2e014127
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add esp, 0x1c
lea eax, [ebp - 0x2814]
push eax
lea eax, [ebp - 0x2708]
push eax
push ebx
push ebx
push 0x2e002070
push dword [ebp - 0x2818]
mov dword [ebp - 0x2814], 0x208
call edi
cmp eax, ebx
jle 0x2e00d524
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, 0x80070002
jne 0x2e00d546
push 0x208
lea eax, [ebp - 0x2708]
push ebx
push eax
call fcn.2e0140ad
xor esi, esi
add esp, 0xc
inc esi
cmp esi, ebx
jl 0x2e00d836
lea eax, [ebp - 0x2814]
push eax
lea eax, [ebp - 0x2500]
push eax
push ebx
push ebx
push 0x2e002048
push dword [ebp - 0x2818]
mov dword [ebp - 0x2814], 0x1048
call edi
cmp eax, ebx
jle 0x2e00d583
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, 0x80070002
jne 0x2e00d5a5
push 0x1048
lea eax, [ebp - 0x2500]
push ebx
push eax
call fcn.2e0140ad
xor esi, esi
add esp, 0xc
inc esi
cmp esi, ebx
jl 0x2e00d836
lea eax, [ebp - 0x2814]
push eax
lea eax, [ebp - 0x14a8]
push eax
push ebx
push ebx
push 0x2e00180c
push dword [ebp - 0x2818]
mov dword [ebp - 0x2814], 4
call edi
cmp eax, ebx
jle 0x2e00d5e2
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, 0x80070002
jne 0x2e00d5f5
xor esi, esi
inc esi
mov dword [ebp - 0x14a8], esi
cmp esi, ebx
jl 0x2e00d836
lea eax, [ebp - 0x2814]
push eax
lea eax, [ebp - 0x14b8]
push eax
push ebx
push ebx
push 0x2e002038
push dword [ebp - 0x2818]
mov dword [ebp - 0x2814], 4
call edi
cmp eax, ebx
jle 0x2e00d632
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, 0x80070002
jne 0x2e00d645
xor esi, esi
mov dword [ebp - 0x14b8], ebx
inc esi
cmp esi, ebx
jl 0x2e00d836
lea eax, [ebp - 0x2814]
push eax
lea eax, [ebp - 0x14b4]
push eax
push ebx
push ebx
push 0x2e002024
push dword [ebp - 0x2818]
mov dword [ebp - 0x2814], 4
call edi
cmp eax, ebx
jle 0x2e00d682
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, 0x80070002
jne 0x2e00d695
xor esi, esi
mov dword [ebp - 0x14b4], ebx
inc esi
cmp esi, ebx
jl 0x2e00d836
cmp dword [ebp - 0x14b4], 0x8003
je 0x2e00d6b5
cmp dword [ebp - 0x14b4], 0x8004
jne 0x2e00d724
lea eax, [ebp - 0x2814]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push ebx
push 0x2e002018
push dword [ebp - 0x2818]
mov dword [ebp - 0x2814], 0x14
call edi
cmp eax, ebx
jle 0x2e00d6e7
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, ebx
jne 0x2e00d70b
or dword [ebp - 0x280c], 0x10
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14ac], eax
mov eax, dword [ebp - 0x2814]
mov dword [ebp - 0x14b0], eax
jmp 0x2e00d724
cmp esi, 0x80070002
jne 0x2e00d71c
xor esi, esi
mov dword [ebp - 0x14ac], ebx
inc esi
cmp esi, ebx
jl 0x2e00d836
lea eax, [ebp - 0x2814]
push eax
lea eax, [ebp - 0x118]
push eax
push ebx
push ebx
push 0x2e001ff8
push dword [ebp - 0x2818]
mov dword [ebp - 0x2814], 0x100
call edi
cmp eax, ebx
jle 0x2e00d759
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, 0x80070002
jne 0x2e00d77b
push 0x100
lea eax, [ebp - 0x118]
push ebx
push eax
call fcn.2e0140ad
xor esi, esi
add esp, 0xc
inc esi
cmp esi, ebx
jl 0x2e00d836
lea eax, [ebp - 0x2814]
push eax
lea eax, [ebp - 0x218]
push eax
push ebx
push ebx
push 0x2e001fd4
push dword [ebp - 0x2818]
mov dword [ebp - 0x2814], 0x100
call edi
cmp eax, ebx
jle 0x2e00d7b8
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, 0x80070002
jne 0x2e00d7da
push 0x100
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.2e0140ad
xor esi, esi
add esp, 0xc
inc esi
cmp esi, ebx
jl 0x2e00d836
lea eax, [ebp - 0x281c]
push eax
push ebx
lea eax, [ebp - 0x2810]
push eax
push dword [ebp - 0x2824]
call fcn.2e00d3f8
mov esi, eax
cmp esi, ebx
jl 0x2e00d836
mov eax, dword [ebp - 0x281c]
mov ecx, dword [eax]
lea edx, [ebp - 0x218]
push edx
lea edx, [ebp - 0x118]
push edx
push eax
call dword [ecx + 0x78]
mov esi, eax
cmp esi, ebx
jl 0x2e00d836
mov eax, dword [ebp - 0x281c]
mov ecx, dword [ebp - 0x2820]
mov dword [ecx], eax
xor eax, eax
mov dword [ebp - 0x281c], eax
jmp 0x2e00d83c
mov eax, dword [ebp - 0x281c]
cmp eax, ebx
je 0x2e00d850
mov ecx, dword [eax + 4]
mov ecx, dword [ecx + 4]
lea eax, [ecx + eax + 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.2e013f7c
leave
ret 0x10