Function at 0x30008175
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x35c
mov eax, dword [0x30020490]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x340], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [ebp - 0x350], eax
mov eax, dword [ebp + 0x14]
push edi
xor edi, edi
mov dword [ebp - 0x344], eax
mov eax, dword [ebp + 0x18]
mov esi, 0x21c
push esi
mov dword [ebp - 0x354], eax
mov dword [eax], edi
lea eax, [ebp - 0x320]
push edi
push eax
mov dword [ebp - 0x338], edi
mov dword [ebp - 0x324], edi
mov dword [ebp - 0x334], edi
mov dword [ebp - 0x33c], edi
mov dword [ebp - 0x34c], edi
mov dword [ebp - 0x348], edi
call fcn.30014b52
add esp, 0xc
push ebx
push 0x80
lea eax, [ebp - 0x318]
push eax
mov dword [ebp - 0x320], esi
mov dword [ebp - 0x31c], 0xf
call fcn.30005abb
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x32c]
push eax
lea eax, [ebp - 0x218]
push eax
push edi
push edi
push 0x300018d4
push dword [ebp - 0x340]
mov dword [ebp - 0x32c], 4
call ebx
mov esi, eax
cmp esi, edi
jle 0x30008253
and esi, 0xffff
or esi, 0x80070000
cmp esi, edi
jl 0x300087d7
lea eax, [ebp - 0x32c]
push eax
lea eax, [ebp - 0x214]
push eax
push edi
push edi
push 0x300018b8
push dword [ebp - 0x340]
mov dword [ebp - 0x32c], 4
call ebx
mov esi, eax
cmp esi, edi
jle 0x30008294
and esi, 0xffff
or esi, 0x80070000
cmp esi, edi
jl 0x300087d7
lea eax, [ebp - 0x32c]
push eax
lea eax, [ebp - 0x210]
push eax
push edi
push edi
push 0x300018a4
push dword [ebp - 0x340]
mov dword [ebp - 0x32c], 4
call ebx
mov esi, eax
cmp esi, edi
jle 0x300082d5
and esi, 0xffff
or esi, 0x80070000
cmp esi, edi
jl 0x300087d7
lea eax, [ebp - 0x338]
push eax
lea eax, [ebp - 0x320]
push eax
push dword [ebp - 0x344]
push dword [ebp - 0x350]
call fcn.300080fa
mov esi, eax
cmp esi, edi
jl 0x300087d7
lea eax, [ebp - 0x324]
push eax
push 0x20019
push edi
push 0x3000188c
push dword [ebp - 0x340]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jle 0x30008330
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, 0x80070002
jne 0x3000833d
xor esi, esi
inc esi
cmp esi, edi
jl 0x300087d7
jne 0x300084c7
mov eax, 0x100
push eax
mov dword [ebp - 0x344], eax
lea eax, [ebp - 0x33c]
push eax
call fcn.300111a2
mov esi, eax
cmp esi, edi
jl 0x300087d7
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
lea eax, [ebp - 0x32c]
push eax
push dword [ebp - 0x33c]
lea eax, [ebp - 0x328]
push edi
push edi
push eax
lea eax, [ebp - 0x104]
push eax
mov dword [ebp - 0x330], edi
mov dword [ebp - 0x32c], 0x200
push edi
jmp 0x30008498
cmp eax, 0xea
jne 0x30008426
mov eax, dword [ebp - 0x32c]
lea ecx, [eax + eax]
cmp dword [ebp - 0x344], ecx
jae 0x30008538
lea eax, [eax + eax + 0x32]
push eax
mov dword [ebp - 0x344], eax
lea eax, [ebp - 0x33c]
push eax
call fcn.300111a2
mov esi, eax
cmp esi, edi
jl 0x300087d7
mov eax, dword [ebp - 0x344]
add eax, eax
mov dword [ebp - 0x32c], eax
lea eax, [ebp - 0x32c]
push eax
push dword [ebp - 0x33c]
lea eax, [ebp - 0x328]
push edi
push edi
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x330]
mov dword [ebp - 0x328], 0x80
push dword [ebp - 0x324]
call ebx
cmp eax, edi
jle 0x30008434
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, edi
jl 0x300087d7
push dword [ebp - 0x33c]
mov eax, dword [ebp - 0x338]
mov ecx, dword [eax]
lea edx, [ebp - 0x104]
push edx
push eax
call dword [ecx + 0x1c]
mov esi, eax
cmp esi, edi
jl 0x300087d7
inc dword [ebp - 0x330]
mov eax, dword [ebp - 0x344]
add eax, eax
mov dword [ebp - 0x32c], eax
lea eax, [ebp - 0x32c]
push eax
push dword [ebp - 0x33c]
lea eax, [ebp - 0x328]
push edi
push edi
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x330]
push dword [ebp - 0x324]
mov dword [ebp - 0x328], 0x80
call ebx
cmp eax, 0x103
jne 0x300083a6
push dword [ebp - 0x324]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x324], edi
lea eax, [ebp - 0x324]
push eax
push 0x20019
push edi
push 0x300018f4
push dword [ebp - 0x340]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jle 0x300084f3
and eax, 0xffff
mov esi, 0x8000ffff
jmp 0x300087d7