Function at 0x2a41fb96
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x238
mov eax, 0x2a4a1a33
call fcn.2a40924e
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x230], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x238], eax
lea eax, [ebp - 0x220]
xor ebx, ebx
mov dword [ebp - 0x244], ebx
mov edi, 0x208
push eax
mov dword [ebp - 0x240], esi
mov dword [ebp - 0x22c], edi
call fcn.2a419b83
mov eax, dword [eax]
lea ecx, [ebp - 0x22c]
push ecx
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x228]
push ecx
push ebx
push eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call esi
test eax, eax
jne 0x2a41fed3
cmp dword [ebp - 0x228], 1
mov byte [ebp - 0x219], 1
jne 0x2a41fed3
lea ecx, [ebp - 0x220]
call fcn.2a40567c
cmp byte [ebp - 0x219], bl
je 0x2a41fccc
xor eax, eax
mov word [ebp - 0x12], ax
cmp word [ebp - 0x218], bx
je 0x2a41fede
push dword [ebp - 0x230]
lea ecx, [ebp - 0x220]
call fcn.2a409959
lea ecx, [ebp - 0x220]
mov dword [ebp - 4], ebx
call fcn.2a41fefd
lea eax, [ebp - 0x224]
push eax
call fcn.2a419b83
lea ecx, [ebp - 0x224]
mov byte [ebp - 4], 1
call fcn.2a41fefd
mov ecx, dword [ebp - 0x238]
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x220]
push eax
call fcn.2a41c70f
mov ecx, eax
call fcn.2a428355
mov ecx, eax
call fcn.2a426b52
lea ecx, [ebp - 0x224]
mov byte [ebp - 4], bl
call fcn.2a40567c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x220]
call fcn.2a40567c
cmp word [ebp - 0x218], bx
je 0x2a41fede
lea eax, [ebp - 0x220]
push eax
mov dword [ebp - 0x22c], edi
call fcn.2a4188e5
mov eax, dword [eax]
lea ecx, [ebp - 0x22c]
push ecx
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x228]
push ecx
push ebx
push eax
push dword [ebp - 0x240]
call esi
test eax, eax
jne 0x2a41fee2
cmp dword [ebp - 0x228], 1
mov byte [ebp - 0x219], 1
jne 0x2a41fee2
lea ecx, [ebp - 0x220]
call fcn.2a40567c
cmp byte [ebp - 0x219], bl
je 0x2a41fddc
xor eax, eax
mov word [ebp - 0x12], ax
cmp word [ebp - 0x218], bx
je 0x2a41fddc
push dword [ebp - 0x230]
lea ecx, [ebp - 0x224]
call fcn.2a409959
lea ecx, [ebp - 0x224]
mov dword [ebp - 4], 2
call fcn.2a41fefd
lea eax, [ebp - 0x220]
push eax
call fcn.2a4188e5
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 3
call fcn.2a41fefd
mov ecx, dword [ebp - 0x238]
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.2a41c70f
mov ecx, eax
call fcn.2a428355
mov ecx, eax
call fcn.2a426b52
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 2
call fcn.2a40567c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x224]
call fcn.2a40567c
push 4
pop edi
lea eax, [ebp - 0x220]
push eax
mov dword [ebp - 0x22c], edi
call fcn.2a419bc1
mov eax, dword [eax]
lea ecx, [ebp - 0x22c]
push ecx
lea ecx, [ebp - 0x244]
push ecx
lea ecx, [ebp - 0x228]
push ecx
push ebx
push eax
push dword [ebp - 0x240]
call esi
test eax, eax
jne 0x2a41feed
mov byte [ebp - 0x219], 1
cmp dword [ebp - 0x228], edi
jne 0x2a41feed
lea ecx, [ebp - 0x220]
call fcn.2a40567c
cmp byte [ebp - 0x219], bl
je 0x2a41fec9
push dword [ebp - 0x230]
lea ecx, [ebp - 0x234]
call fcn.2a409959
lea ecx, [ebp - 0x234]
mov dword [ebp - 4], edi
call fcn.2a41fefd
lea eax, [ebp - 0x23c]
push eax
call fcn.2a419bc1
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 5
call fcn.2a41fefd
push dword [ebp - 0x244]
mov ecx, dword [ebp - 0x238]
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.2a41c70f
mov ecx, eax
call fcn.2a428355
mov ecx, eax
call fcn.2a419c0b
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 4
call fcn.2a40567c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x234]
call fcn.2a40567c
mov al, 1
call fcn.2a40cba9
ret 0xc
mov byte [ebp - 0x219], bl
jmp 0x2a41fc1d
xor al, al
jmp 0x2a41fecb
mov byte [ebp - 0x219], bl
jmp 0x2a41fd28
mov byte [ebp - 0x219], bl
jmp 0x2a41fe2d