Function at 0x7d00eca8
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa54
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x24], 0x104
mov ebx, ParseURLA
mov edi, 0x208
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x234]
push eax
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.SHLWAPI.dll_SHEnumKeyExW]
cmp eax, 0x103
je 0x7d00eeb9
cmp word [ebp - 0x234], 0x2e
mov word [ebp - 0x644], si
mov dword [ebp - 8], esi
jne 0x7d00edbf
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], edi
push eax
lea eax, [ebp - 0x644]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x43c]
push eax
lea eax, [ebp - 0x234]
push eax
mov dword [ebp - 0x28], edi
call fcn.7cfe0b40
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 4]
push eax
push 0x20019
lea eax, [ebp - 0x644]
push esi
push eax
push ebx
mov dword [ebp - 0x20], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x7d00ee52
push dword [ebp - 4]
call fcn.7cfe0b0b
test al, 1
mov dword [ebp - 8], eax
jne 0x7d00ed73
or dword [ebp - 8], 4
cmp dword [ebp - 0x2c], esi
jne 0x7d00ee52
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], edi
push eax
lea eax, [ebp - 0x84c]
push eax
push esi
push esi
push 0x7cf33560
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp eax, esi
mov dword [ebp - 0xc], eax
jne 0x7d00edb3
cmp word [ebp - 0x84c], si
je 0x7d00edb3
or byte [ebp - 7], 0x40
jmp 0x7d00ee52
mov dword [ebp - 8], 1
jmp 0x7d00ee52
cmp dword [ebp - 0x20], esi
jne 0x7d00eeb9
lea eax, [ebp - 4]
push eax
push 0x20019
lea eax, [ebp - 0x234]
push esi
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push dword [ebp - 4]
call fcn.7cfe0b0b
test al, 2
mov dword [ebp - 8], eax
je 0x7d00ee52
lea eax, [ebp - 0x234]
push 0x104
push eax
lea eax, [ebp - 0x644]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], edi
push eax
lea eax, [ebp - 0x43c]
push eax
push esi
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_SHQueryValueExW]
cmp eax, esi
mov dword [ebp - 0xc], eax
jne 0x7d00ee32
cmp word [ebp - 0x43c], si
jne 0x7d00ee4b
lea eax, [ebp - 0x234]
push 0x104
push eax
lea eax, [ebp - 0x43c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
mov word [ebp - 0x234], si
test byte [ebp - 8], 1
jne 0x7d00ee95
test byte [ebp - 8], 6
jne 0x7d00ee64
test byte [ebp - 7], 0x40
je 0x7d00ee95
push dword [ebp + 0x10]
lea eax, [ebp - 0x234]
push dword [ebp + 0xc]
push esi
push esi
push eax
lea eax, [ebp - 0x43c]
push eax
push dword [ebp + 8]
call fcn.7d00ef38
mov ecx, 0x80004004
cmp eax, ecx
jne 0x7d00ee95
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], 1
cmp dword [ebp - 4], esi
je 0x7d00eea6
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x14], esi
mov dword [ebp - 0x24], 0x104
je 0x7d00ecd6
cmp dword [ebp - 4], esi
je 0x7d00eeca
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], esi
cmp dword [ebp - 0x14], esi
jne 0x7d00ef2e
lea eax, [ebp - 0xa54]
push 0x104
push eax
push 0x1023
push dword [0x7d04cdfc]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x7d00ef2e
push 1
push 8
push esi
call sym.SHELL32.dll_SHCloneSpecialIDList
mov edi, eax
cmp edi, esi
je 0x7d00ef2e
push dword [ebp + 0x10]
lea eax, [ebp - 0xa54]
push dword [ebp + 0xc]
push esi
push edi
push 0x7cf347ec
push eax
push dword [ebp + 8]
call fcn.7d00ef38
mov ecx, 0x80004004
cmp eax, ecx
jne 0x7d00ef28
mov dword [ebp - 0x1c], ecx
push edi
call sym.SHELL32.dll_ILFree
mov eax, dword [ebp - 0x1c]
pop edi
pop esi
pop ebx
leave
ret 0xc