Function at 0x2e0074a0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x35c
mov eax, dword [0x2e021014]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x340], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [ebp - 0x350], eax
mov eax, dword [ebp + 0x14]
push edi
xor edi, edi
mov dword [ebp - 0x344], eax
mov eax, dword [ebp + 0x18]
mov esi, 0x21c
push esi
mov dword [ebp - 0x354], eax
mov dword [eax], edi
lea eax, [ebp - 0x320]
push edi
push eax
mov dword [ebp - 0x338], edi
mov dword [ebp - 0x324], edi
mov dword [ebp - 0x334], edi
mov dword [ebp - 0x33c], edi
mov dword [ebp - 0x34c], edi
mov dword [ebp - 0x348], edi
call fcn.2e0140ad
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x318]
push 0x80
push eax
mov dword [ebp - 0x320], esi
mov dword [ebp - 0x31c], 0xf
call fcn.2e014127
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add esp, 0x1c
lea eax, [ebp - 0x32c]
push eax
lea eax, [ebp - 0x218]
push eax
push edi
push edi
push 0x2e00183c
push dword [ebp - 0x340]
mov dword [ebp - 0x32c], 4
call ebx
mov esi, eax
cmp esi, edi
jle 0x2e007580
and esi, 0xffff
or esi, 0x80070000
cmp esi, edi
jl 0x2e007b04
lea eax, [ebp - 0x32c]
push eax
lea eax, [ebp - 0x214]
push eax
push edi
push edi
push 0x2e001820
push dword [ebp - 0x340]
mov dword [ebp - 0x32c], 4
call ebx
mov esi, eax
cmp esi, edi
jle 0x2e0075c1
and esi, 0xffff
or esi, 0x80070000
cmp esi, edi
jl 0x2e007b04
lea eax, [ebp - 0x32c]
push eax
lea eax, [ebp - 0x210]
push eax
push edi
push edi
push 0x2e00180c
push dword [ebp - 0x340]
mov dword [ebp - 0x32c], 4
call ebx
mov esi, eax
cmp esi, edi
jle 0x2e007602
and esi, 0xffff
or esi, 0x80070000
cmp esi, edi
jl 0x2e007b04
lea eax, [ebp - 0x338]
push eax
lea eax, [ebp - 0x320]
push eax
push dword [ebp - 0x344]
push dword [ebp - 0x350]
call fcn.2e007425
mov esi, eax
cmp esi, edi
jl 0x2e007b04
lea eax, [ebp - 0x324]
push eax
push 0x20019
push edi
push 0x2e0017f4
push dword [ebp - 0x340]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jle 0x2e00765d
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, 0x80070002
jne 0x2e00766a
xor esi, esi
inc esi
cmp esi, edi
jl 0x2e007b04
jne 0x2e0077f4
mov eax, 0x100
push eax
mov dword [ebp - 0x344], eax
lea eax, [ebp - 0x33c]
push eax
call fcn.2e010a8d
mov esi, eax
cmp esi, edi
jl 0x2e007b04
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
lea eax, [ebp - 0x32c]
push eax
push dword [ebp - 0x33c]
lea eax, [ebp - 0x328]
push edi
push edi
push eax
lea eax, [ebp - 0x104]
push eax
mov dword [ebp - 0x330], edi
mov dword [ebp - 0x32c], 0x200
push edi
jmp 0x2e0077c5
cmp eax, 0xea
jne 0x2e007753
mov eax, dword [ebp - 0x32c]
lea ecx, [eax + eax]
cmp dword [ebp - 0x344], ecx
jae 0x2e007865
lea eax, [eax + eax + 0x32]
push eax
mov dword [ebp - 0x344], eax
lea eax, [ebp - 0x33c]
push eax
call fcn.2e010a8d
mov esi, eax
cmp esi, edi
jl 0x2e007b04
mov eax, dword [ebp - 0x344]
add eax, eax
mov dword [ebp - 0x32c], eax
lea eax, [ebp - 0x32c]
push eax
push dword [ebp - 0x33c]
lea eax, [ebp - 0x328]
push edi
push edi
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x330]
mov dword [ebp - 0x328], 0x80
push dword [ebp - 0x324]
call ebx
cmp eax, edi
jle 0x2e007761
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, edi
jl 0x2e007b04
push dword [ebp - 0x33c]
mov eax, dword [ebp - 0x338]
mov ecx, dword [eax]
lea edx, [ebp - 0x104]
push edx
push eax
call dword [ecx + 0x1c]
mov esi, eax
cmp esi, edi
jl 0x2e007b04
inc dword [ebp - 0x330]
mov eax, dword [ebp - 0x344]
add eax, eax
mov dword [ebp - 0x32c], eax
lea eax, [ebp - 0x32c]
push eax
push dword [ebp - 0x33c]
lea eax, [ebp - 0x328]
push edi
push edi
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x330]
push dword [ebp - 0x324]
mov dword [ebp - 0x328], 0x80
call ebx
cmp eax, 0x103
jne 0x2e0076d3
push dword [ebp - 0x324]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x324], edi
lea eax, [ebp - 0x324]
push eax
push 0x20019
push edi
push 0x2e001754
push dword [ebp - 0x340]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jle 0x2e007820
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, 0x80070002
jne 0x2e00782d
xor esi, esi
inc esi
cmp esi, edi
jl 0x2e007b04
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jne 0x2e007973
lea eax, [ebp - 0x35c]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x328]
push eax
lea eax, [ebp - 0x104]
push eax
mov dword [ebp - 0x330], edi
push edi
jmp 0x2e007925
mov esi, 0x8000ffff
jmp 0x2e007b04
lea eax, [ebp - 0x334]
push eax
push 0x20019
push edi
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x324]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, edi
jle 0x2e0078a3
and esi, 0xffff
or esi, 0x80070000
cmp esi, edi
jl 0x2e007b04
mov eax, dword [ebp - 0x338]
mov ecx, dword [eax]
lea edx, [ebp - 0x34c]
push edx
push dword [ebp - 0x350]
lea edx, [ebp - 0x104]
push dword [ebp - 0x334]
push edx
push eax
call dword [ecx + 0x48]
mov eax, dword [ebp - 0x34c]
cmp eax, edi
je 0x2e0078ef
mov ecx, dword [eax + 4]
mov ecx, dword [ecx + 4]
lea eax, [ecx + eax + 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 0x34c], edi
push dword [ebp - 0x334]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x330]
lea eax, [ebp - 0x35c]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x328]
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x330]
mov dword [ebp - 0x334], edi
push dword [ebp - 0x324]
mov dword [ebp - 0x328], 0x80
call ebx
mov esi, eax
cmp esi, edi
je 0x2e00786f
jle 0x2e00794f
and esi, 0xffff
or esi, 0x80070000
cmp esi, 0x80070103
jne 0x2e007959
xor esi, esi
cmp esi, edi
jl 0x2e007b04
push dword [ebp - 0x324]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x324], edi
lea eax, [ebp - 0x324]
push eax
push 0x20019
push edi
push 0x2e001740
push dword [ebp - 0x340]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jle 0x2e00799f
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, 0x80070002
jne 0x2e0079ac
xor esi, esi
inc esi
cmp esi, edi
jl 0x2e007b04
jne 0x2e007ae2
lea eax, [ebp - 0x35c]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x328]
push eax
lea eax, [ebp - 0x104]
push eax
mov dword [ebp - 0x330], edi
push edi
jmp 0x2e007a98
lea eax, [ebp - 0x334]
push eax
push 0x20019
push edi
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x324]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, edi
jle 0x2e007a12
and esi, 0xffff
or esi, 0x80070000
cmp esi, edi
jl 0x2e007b04
mov eax, dword [ebp - 0x338]
mov ecx, dword [eax]
lea edx, [ebp - 0x348]
push edx
push dword [ebp - 0x334]
lea edx, [ebp - 0x104]
push edx
push eax
call dword [ecx + 0x2c]
mov esi, eax
cmp esi, edi
jl 0x2e007b04
mov eax, dword [ebp - 0x348]
cmp eax, edi
je 0x2e007a62
mov ecx, dword [eax + 4]
mov ecx, dword [ecx + 4]
lea eax, [ecx + eax + 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 0x348], edi
push dword [ebp - 0x334]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x330]
lea eax, [ebp - 0x35c]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x328]
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x330]
mov dword [ebp - 0x334], edi
push dword [ebp - 0x324]
mov dword [ebp - 0x328], 0x80
call ebx
mov esi, eax
cmp esi, edi
je 0x2e0079de
jle 0x2e007ac2
and esi, 0xffff
or esi, 0x80070000
cmp esi, 0x80070103
jne 0x2e007acc
xor esi, esi
cmp esi, edi
jl 0x2e007b04
push dword [ebp - 0x324]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x324], edi
mov eax, dword [ebp - 0x338]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x74]
mov eax, dword [ebp - 0x338]
mov ecx, dword [ebp - 0x354]
mov dword [ecx], eax
mov dword [ebp - 0x338], edi
xor esi, esi
mov eax, dword [ebp - 0x348]
cmp eax, edi
je 0x2e007b1e
mov ecx, dword [eax + 4]
mov ecx, dword [ecx + 4]
lea eax, [ecx + eax + 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x34c]
cmp eax, edi
je 0x2e007b38
mov ecx, dword [eax + 4]
mov ecx, dword [ecx + 4]
lea eax, [ecx + eax + 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebp - 0x33c], edi
je 0x2e007b4b
push dword [ebp - 0x33c]
call fcn.2e0110b3
cmp dword [ebp - 0x334], edi
je 0x2e007b5f
push dword [ebp - 0x334]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x324], edi
je 0x2e007b73
push dword [ebp - 0x324]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x338]
cmp eax, edi
je 0x2e007b9d
mov ecx, dword [eax]
push eax
call dword [ecx + 0x7c]
mov eax, dword [ebp - 0x338]
cmp eax, edi
je 0x2e007b9d
mov ecx, dword [eax + 4]
mov ecx, dword [ecx + 4]
lea eax, [ecx + eax + 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.2e013f7c
leave
ret 0x14