Function at 0x703a3de0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [edx + edx + 0x26]
push edi
mov edi, eax
push esi
mov esi, ecx
push ebx
sub esp, 0xcc
mov dword [esp + 0x24], 0
mov dword [esp], ebp
call dword [sym.imp.ucrtbase.dll_malloc]
lea edx, [ebp - 0x24]
mov ebx, eax
mov eax, dword [str.PROTOCOLSHandler_]
mov dword [ebx], eax
mov eax, dword [0x703e1da4]
mov dword [ebx + 4], eax
mov eax, dword [0x703e1da8]
mov dword [ebx + 8], eax
mov eax, dword [0x703e1dac]
mov dword [ebx + 0xc], eax
mov eax, dword [0x703e1db0]
mov dword [ebx + 0x10], eax
mov eax, dword [0x703e1db4]
mov dword [ebx + 0x14], eax
mov eax, dword [0x703e1db8]
mov dword [ebx + 0x18], eax
mov eax, dword [0x703e1dbc]
mov dword [ebx + 0x1c], eax
mov eax, dword [0x703e1dc0]
mov dword [ebx + 0x20], eax
lea eax, [ebx + 0x24]
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov dword [esp], eax
call sub.ucrtbase.dll_memcpy
lea eax, [esp + 0x24]
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov dword [esp], ParseURLW
call dword [sym.imp.advapi32.dll_RegOpenKeyW]
sub esp, 0xc
mov edi, eax
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_free]
test edi, edi
jne 0x703a4000
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], pe_nt_image_headers32
mov dword [esp + 0x14], eax
lea eax, [esp + 0x28]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x24]
lea ebx, [esp + 0x40]
mov dword [esp + 0x10], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], str.CLSID
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
sub esp, 0x18
mov ebp, eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
test ebp, ebp
jne 0x703a3fc0
cmp dword [esp + 0x28], 1
jne 0x703a3fc0
lea ebp, [esp + 0x30]
mov dword [esp], ebx
mov dword [esp + 4], ebp
call dword [sym.imp.ole32.dll_CLSIDFromString]
sub esp, 8
test eax, eax
mov ebx, eax
js 0x703a3f80
test esi, esi
je 0x703a3f2f
mov eax, dword [esp + 0x30]
mov dword [esi], eax
mov eax, dword [esp + 0x34]
mov dword [esi + 4], eax
mov eax, dword [esp + 0x38]
mov dword [esi + 8], eax
mov eax, dword [esp + 0x3c]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0xe0]
test eax, eax
je 0x703a3f71
mov eax, dword [esp + 0xe0]
mov dword [esp + 0xc], 0x703edd18
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], ebp
mov dword [esp + 0x10], eax
call dword [sym.imp.ole32.dll_CoGetClassObject]
sub esp, 0x14
test eax, eax
js 0x703a3ff1
add esp, 0xcc
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [0x703d8428], 4
jne 0x703a3f90
mov edi, ebx
jmp 0x703a3f71
mov dword [esp + 0x10], eax
mov edi, ebx
mov dword [esp + 0xc], str.CLSIDFromString_failed:__08lx_n
mov dword [esp + 8], str.get_protocol_cf
mov dword [esp + 4], 0x703d8428
mov dword [esp], 2
call fcn.703a33b0
jmp 0x703a3f71
test byte [0x703d8428], 4
je 0x703a3ff1
mov dword [esp + 0x10], ebp
mov dword [esp + 0xc], str.Could_not_get_protocol_CLSID_res_ld_n
mov dword [esp + 8], str.get_protocol_cf
mov dword [esp + 4], 0x703d8428
mov dword [esp], 2
call fcn.703a33b0
mov edi, 0x800401e4
jmp 0x703a3f71
test byte [0x703d8428], 8
je 0x703a3ff1
mov dword [esp + 0xc], str.Could_not_open_protocol_handler_key_n
mov dword [esp + 8], str.get_protocol_cf
mov dword [esp + 4], 0x703d8428
mov dword [esp], 3
call fcn.703a33b0
jmp 0x703a3ff1