Function at 0x7d024d6d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a8
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
xor ecx, ecx
mov edi, 0xa0
cmp ebx, ecx
mov dword [ebp - 8], edi
mov dword [ebp - 4], ecx
je 0x7d024d9b
cmp dword [ebx], 0xffffffff
jne 0x7d024d99
xor eax, eax
jmp 0x7d024f8a
cmp ebx, ecx
mov esi, dword [ebp + 8]
jne 0x7d024da9
cmp word [esi + 0x19c], cx
je 0x7d024db9
cmp ebx, ecx
je 0x7d024ee7
cmp dword [ebx], ecx
jne 0x7d024ee3
lea eax, [esi + 0x112]
push eax
lea eax, [ebp - 0x108]
push 0x7cf48a0c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 8]
mov dword [ebp - 8], edi
mov edi, ParseURLA
push eax
lea eax, [ebp - 0x1a8]
push eax
lea eax, [ebp - 0x108]
push eax
push edi
call fcn.7cf5aef1
test eax, eax
jne 0x7d024e50
lea eax, [ebp - 0x1a8]
push eax
lea eax, [ebp - 0x108]
push 0x7cf3ccdc
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp + 0x10]
mov dword [ebp - 8], 0xa0
push eax
lea eax, [ebp - 0x108]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x7d024e50
lea eax, [esi + 0x194]
push eax
push dword [ebp + 0xc]
push dword [ebp + 0x10]
call fcn.7d024af1
push dword [ebp + 0x10]
mov dword [ebp - 4], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], 0
jne 0x7d024e8a
lea eax, [ebp + 0x10]
push eax
lea eax, [esi + 0x8e]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x7d024e8a
lea eax, [esi + 0x194]
push eax
push dword [ebp + 0xc]
push dword [ebp + 0x10]
call fcn.7d024af1
push dword [ebp + 0x10]
mov dword [ebp - 4], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x7d024f87
lea eax, [esi + 0x112]
push eax
lea eax, [esi + 0x8e]
push eax
lea eax, [ebp - 0x108]
push 0x7cf489dc
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x108]
push ebx
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x7d024edb
mov edi, dword [ebp + 0x14]
and dword [edi], eax
cmp dword [ebp - 4], eax
je 0x7d024f91
jmp 0x7d024f87
or dword [ebx], 0xffffffff
jmp 0x7d024f87
cmp ebx, ecx
jne 0x7d024f1a
cmp word [esi + 0x19c], cx
lea eax, [esi + 0x19c]
je 0x7d024f16
mov esi, dword [ebp + 0xc]
push eax
mov dword [esi], 4
call dword [sym.imp.SHLWAPI.dll_StrDupW]
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov dword [ebp - 4], 1
jmp 0x7d024f87
cmp ebx, ecx
je 0x7d024f87
mov edi, dword [ebp + 0x14]
push 0x40
lea edx, [ebp + 0xc]
pop eax
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], eax
lea eax, [esi + 0xe]
push edx
mov dword [ebp + 0x14], eax
push eax
lea eax, [ebp - 4]
add esi, 0x19c
push eax
lea eax, [ebp + 8]
push ecx
push eax
push esi
push dword [edi]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x7d024f78
inc dword [edi]
push 1
pop edi
cmp dword [ebp + 0xc], edi
ja 0x7d024f73
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [ebp + 0x14]
call dword [sym.imp.SHLWAPI.dll_PathRemoveExtensionW]
mov dword [ebp - 4], edi
jmp 0x7d024f87
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebx], 0xffffffff
and dword [ebp - 4], 0
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10
xor ecx, ecx
jmp 0x7d024f1d