Function at 0x3719c286
Capabilities:
Enumerate files on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x664
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
xor ebx, ebx
push 0x154
push ebx
push esi
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0xc]
or dword [esi], 0xffffffff
mov edi, 0x104
push eax
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x10]
push eax
push str.Theme
push 0x3719f068
push SysReAllocString
mov dword [ebp - 0x10], 1
mov dword [ebp - 0xc], edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
je 0x3719c2e6
and byte [ebp - 0x45c], bl
push edi
lea eax, [ebp - 0x664]
push ebx
push eax
call sub.MSVCRT.dll_memset
push 0x140
lea eax, [ebp - 0x150]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0x18
mov ebx, 0x103
lea eax, [ebp - 0x664]
push dword [ebp + 8]
push str._s.
push ebx
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
lea eax, [ebp - 0x150]
mov dword [ebp - 0x150], 0x10
push eax
lea eax, [ebp - 0x664]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp + 0xc], eax
cmp dword [ebp + 0xc], 0xffffffff
je 0x3719c4b4
test byte [ebp - 0x150], 0x10
je 0x3719c49c
cmp byte [ebp - 0x124], 0x2e
je 0x3719c49c
push edi
lea eax, [ebp - 0x254]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x254]
push dword [ebp + 8]
push str._s_s_
push ebx
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
push edi
lea eax, [ebp - 0x560]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0x20
lea eax, [ebp - 0x254]
push str.profile.ini
push eax
push str._s_s
lea eax, [ebp - 0x560]
push ebx
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
lea eax, [ebp - 0x358]
push edi
push eax
lea eax, [ebp - 0x560]
push eax
call fcn.3719c0d0
add esp, 0x20
test eax, eax
je 0x3719c49c
lea eax, [ebp - 0x358]
push eax
call sub.MSVCRT.dll_strlen
mov edi, eax
lea eax, [ebp - 0x254]
push eax
inc edi
call sub.MSVCRT.dll_strlen
mov ebx, eax
push edi
inc ebx
call dword [sym.imp.MSVCRT.dll_malloc]
push ebx
mov dword [ebp - 4], eax
call dword [sym.imp.MSVCRT.dll_malloc]
push edi
push 0
push dword [ebp - 4]
mov dword [ebp - 8], eax
call sub.MSVCRT.dll_memset
push ebx
push 0
push dword [ebp - 8]
call sub.MSVCRT.dll_memset
dec edi
lea eax, [ebp - 0x358]
push edi
mov edi, dword [ebp - 4]
push eax
push edi
call sub.MSVCRT.dll_memcpy
dec ebx
lea eax, [ebp - 0x254]
push ebx
mov ebx, dword [ebp - 8]
push eax
push ebx
call sub.MSVCRT.dll_memcpy
movzx eax, word [esi + 4]
add esp, 0x40
mov dword [esi + eax*4 + 0x14], edi
movzx eax, word [esi + 4]
push ebx
mov dword [esi + eax*4 + 0xb4], ebx
lea eax, [ebp - 0x45c]
push eax
call dword [sym.imp.MSVCRT.dll__stricmp]
pop ecx
test eax, eax
pop ecx
jne 0x3719c487
movzx eax, word [esi + 4]
mov dword [esi], eax
inc word [esi + 4]
cmp word [esi + 4], 0x27
je 0x3719c4b4
mov edi, 0x104
mov ebx, 0x103
lea eax, [ebp - 0x150]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x3719c348
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [esi], 0xffffffff
jne 0x3719c4c5
and dword [esi], 0
movzx eax, word [esi + 4]
pop edi
pop esi
pop ebx
leave
ret