Function at 0x7cf6c109
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2320
call fcn.7d041c90
lea eax, [ebp - 4]
push ebx
push eax
xor ebx, ebx
push 0x20019
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x10], ecx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x7cf6c334
push edi
lea eax, [ebp + 8]
push esi
push eax
lea eax, [ebp - 0x20d4]
mov esi, dword [sym.imp.SHLWAPI.dll_SHQueryValueExW]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0x7cf49ffc
mov edi, 0x1048
push dword [ebp - 4]
mov dword [ebp - 0x2320], 0x2310
mov dword [ebp + 8], edi
call esi
test eax, eax
je 0x7cf6c179
mov word [ebp - 0x20d4], bx
lea eax, [ebp + 8]
mov dword [ebp + 8], edi
push eax
lea eax, [ebp - 0x108c]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0x7cf49fe0
push dword [ebp - 4]
call esi
test eax, eax
je 0x7cf6c1a1
mov word [ebp - 0x108c], bx
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x208
push eax
lea eax, [ebp - 0x22dc]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0x7cf49fc4
push dword [ebp - 4]
call esi
test eax, eax
je 0x7cf6c1cd
mov word [ebp - 0x22dc], bx
lea eax, [ebp + 8]
mov dword [ebp + 8], 4
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0x7cf37ecc
push dword [ebp - 4]
call esi
test eax, eax
je 0x7cf6c1f6
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x7cf6c1f9
mov eax, dword [ebp - 0xc]
mov ecx, eax
mov dword [ebp - 0x2310], ebx
and ecx, 3
mov dword [ebp + 8], 0x2c
mov dword [ebp - 0x2318], ecx
mov ecx, eax
shr eax, 0xe
and eax, 1
mov dword [ebp - 0x230c], eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x2308]
push eax
lea eax, [ebp - 8]
push eax
push ebx
shr ecx, 0xd
push 0x7cf49fb0
and ecx, 1
push dword [ebp - 4]
mov dword [ebp - 0x2314], ecx
call esi
test eax, eax
je 0x7cf6c256
push 0xb
xor eax, eax
pop ecx
lea edi, [ebp - 0x2308]
rep stosd dword es:[edi], eax
cmp dword [ebp - 0x22f4], ebx
jge 0x7cf6c268
mov dword [ebp - 0x22f4], 0x3fffffff
lea eax, [ebp + 8]
mov dword [ebp - 0x2308], 0x2c
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0x7cf49f94
mov dword [ebp + 8], 4
push dword [ebp - 4]
call esi
test eax, eax
je 0x7cf6c29b
mov dword [ebp - 0x44], 1
push 0x18
lea eax, [ebp + 8]
pop edi
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0x7cf49f70
mov dword [ebp + 8], edi
push dword [ebp - 4]
call esi
test eax, eax
jne 0x7cf6c2c1
cmp dword [ebp - 0x40], edi
je 0x7cf6c2db
lea eax, [ebp - 0x2308]
push 1
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.7d02fb63
or dword [ebp - 0x34], 0xffffffff
or dword [ebp - 0x30], 0xffffffff
lea eax, [ebp + 8]
mov dword [ebp + 8], edi
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0x7cf49f4c
push dword [ebp - 4]
call esi
test eax, eax
je 0x7cf6c30b
lea eax, [ebp - 0x2308]
push 1
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.7d02fb63
push dword [ebp + 0xc]
call dword [sym.imp.SHLWAPI.dll_StrToIntW]
mov esi, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x2320]
mov ecx, esi
push eax
call fcn.7cf6c339
push dword [ebp - 4]
inc dword [esi + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop edi
pop ebx
leave
ret 8