Function at 0x30008961
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
and dword [ebp - 0xc], 0
push edi
push 4
pop ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x30001ab8
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
test eax, eax
jne 0x30008a12
mov ecx, dword [ebp - 0x10]
lea edx, [ecx - 3]
cmp edx, 0x39
ja 0x30008a1b
mov dword [0x30021368], ecx
mov edi, 0x80070000
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x30001aa4
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
cmp eax, 2
je 0x300089e1
test eax, eax
je 0x300089e1
jle 0x300089d9
and eax, 0xffff
or eax, edi
test eax, eax
jl 0x30008c3e
push 3
pop eax
cmp dword [ebp - 0xc], eax
jbe 0x300089ec
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0xc]
xor eax, eax
cmp dword [ecx], eax
je 0x30008a47
cmp dword [ebp - 0xc], eax
jne 0x30008a3b
xor edi, edi
inc edi
push edi
call fcn.30013e80
push edi
push edi
call fcn.30013ec7
mov eax, dword [ebp + 0xc]
and dword [eax], 0
jmp 0x30008a79
cmp eax, 2
je 0x300089a7
test eax, eax
jg 0x30008a22
mov edi, 0x80070000
jmp 0x30008a2e
and eax, 0xffff
mov edi, 0x80070000
or eax, edi
test eax, eax
jl 0x30008c3e
jmp 0x300089ac
push 1
push dword [ebp - 0xc]
call fcn.30013ec7
jmp 0x30008a7e
cmp dword [ebp - 0xc], eax
jbe 0x30008a7e
xor edi, edi
inc edi
push edi
push dword [ebp - 0xc]
call fcn.30013ec7
push edi
push 0
push 0x30001a9c
push 0x30001a94
push 0
call fcn.30013d9b
test eax, eax
jl 0x30008c3e
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
mov edi, 0x80070000
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x30001a78
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
test eax, eax
jne 0x30008aaa
cmp dword [ebp - 0x14], eax
setne al
mov dword [0x3002136c], eax
jmp 0x30008ac2
cmp eax, 2
je 0x30008ac2
test eax, eax
jle 0x30008abc
and eax, 0xffff
or eax, edi
test eax, eax
jl 0x30008c3e
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x30001a5c
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
test eax, eax
jne 0x30008af0
mov ecx, dword [ebp - 0x10]
test ecx, ecx
jbe 0x30008b00
mov dword [0x30021370], ecx
jmp 0x30008b08
cmp eax, 2
je 0x30008b08
test eax, eax
jle 0x30008b02
and eax, 0xffff
or eax, edi
test eax, eax
jl 0x30008c3e
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x30001a38
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
test eax, eax
jne 0x30008b34
cmp dword [ebp - 0x14], eax
setne al
mov dword [0x30021374], eax
jmp 0x30008b4c
cmp eax, 2
je 0x30008b4c
test eax, eax
jle 0x30008b46
and eax, 0xffff
or eax, edi
test eax, eax
jl 0x30008c3e
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0
push fcn.30001a14
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
test eax, eax
jne 0x30008b7a
mov ecx, dword [ebp - 0x10]
test ecx, ecx
jbe 0x30008b8a
mov dword [0x30021378], ecx
jmp 0x30008b92
cmp eax, 2
je 0x30008b92
test eax, eax
jle 0x30008b8c
and eax, 0xffff
or eax, edi
test eax, eax
jl 0x30008c3e
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x300019ec
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
test eax, eax
jne 0x30008bbe
cmp dword [ebp - 0x14], eax
setne al
mov dword [0x3002137c], eax
jmp 0x30008bd2
cmp eax, 2
je 0x30008bd2
test eax, eax
jle 0x30008bd0
and eax, 0xffff
or eax, edi
test eax, eax
jl 0x30008c3e
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x300019c4
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
test eax, eax
jne 0x30008c00
mov ecx, dword [ebp - 0x10]
test ecx, ecx
jbe 0x30008c10
mov dword [0x30021380], ecx
jmp 0x30008c14
cmp eax, 2
je 0x30008c14
test eax, eax
jle 0x30008c12
and eax, 0xffff
or eax, edi
test eax, eax
jl 0x30008c3e
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x300019ac
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
test eax, eax
jne 0x30008c3e
cmp dword [ebp - 0x14], eax
setne al
mov dword [0x30021384], eax
pop edi
pop esi
pop ebx
leave
ret 8