Function at 0x78348dd1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x22c
lea ebp, [esp - 4]
mov eax, dword [0x783c8018]
xor eax, ebp
mov dword [ebp + 0x22c], eax
push 0x60
mov eax, 0x783a8a4e
call fcn.783a76f8
mov eax, dword [ebp + 0x238]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x23c]
xor ebx, ebx
push 0x782f2778
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x10], ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x782eefe0
push eax
mov dword [ebp - 0x20], eax
call edi
cmp eax, ebx
je 0x78348ff1
call eax
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
movzx eax, ax
mov dword [ebp - 0x1c], eax
movzx eax, ax
mov ecx, eax
shr eax, 0xa
mov ebx, 0x3ff
shl eax, 0xa
and ecx, ebx
movzx ecx, cx
movzx eax, ax
or eax, ecx
push eax
mov dword [ebp - 0x24], ecx
call esi
push dword [ebp - 0x24]
mov dword [ebp - 0x3c], eax
call esi
push 0x782f2794
push dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x10], 2
call edi
test eax, eax
je 0x78348eb3
call eax
movzx eax, ax
mov dword [ebp - 0x1c], eax
movzx eax, ax
mov ecx, eax
shr eax, 0xa
shl eax, 0xa
and ecx, ebx
movzx edi, cx
movzx eax, ax
or eax, edi
push eax
call esi
push edi
mov dword [ebp - 0x34], eax
call esi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x10], 4
xor ebx, ebx
mov eax, dword [ebp - 0x10]
inc dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x3c], 0x800
push 0x105
lea eax, [ebp]
push eax
mov esi, sym.MFC80U.DLL_Ordinal_1621
push esi
mov word [ebp + 0x20a], bx
mov word [ebp + 0x208], bx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, ebx
je 0x78348fcc
push 0x20
pop edi
push edi
lea eax, [ebp - 0x6c]
push ebx
push eax
call sub.MSVCR80.dll_memset
mov dword [ebp - 0x6c], edi
or edi, 0xffffffff
add esp, 0xc
cmp byte [0x783ce48f], 0
lea eax, [ebp]
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x58], 0x3e8
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x68], 0x88
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], ebx
jne 0x78348f34
lea eax, [ebp - 0x18]
push eax
call fcn.78348d09
mov dword [ebp - 4], ebx
mov eax, dword [0x783ce4b0]
cmp eax, ebx
je 0x78348f57
cmp dword [ebp - 0x18], edi
jne 0x78348f73
lea ecx, [ebp - 0x6c]
push ecx
call eax
cmp eax, edi
mov dword [ebp - 0x18], eax
setne al
test al, al
je 0x78348f73
mov eax, dword [0x783ce4b8]
cmp eax, ebx
je 0x78348f73
cmp dword [ebp - 0x18], edi
je 0x78348f73
cmp dword [ebp - 0x14], ebx
jne 0x78348f73
lea ecx, [ebp - 0x14]
push ecx
push dword [ebp - 0x18]
call eax
xor esi, esi
cmp dword [ebp - 0x10], ebx
jle 0x78348f9c
push dword [ebp + esi*4 - 0x3c]
mov ecx, dword [ebp - 0x48]
push dword [ebp - 0x28]
call fcn.78348c19
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0x40], eax
jne 0x7834911d
inc esi
cmp esi, dword [ebp - 0x10]
jl 0x78348f7a
mov dword [ebp - 4], edi
cmp dword [0x783ce4b4], ebx
je 0x78348fcc
cmp dword [ebp - 0x18], edi
je 0x78348fcc
mov eax, dword [0x783ce4bc]
cmp eax, ebx
je 0x78348fc3
mov ecx, dword [ebp - 0x14]
cmp ecx, ebx
je 0x78348fc3
push ecx
push ebx
mov dword [ebp - 0x14], ebx
call eax
push dword [ebp - 0x18]
call dword [0x783ce4b4]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x22c]
xor ecx, ebp
call fcn.783a505e
add ebp, 0x230
leave
ret
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x783490b5
lea eax, [ebp - 0x20]
push eax
push 0x20019
push ebx
push 0x782f27b0
push 0x80000001
mov dword [ebp - 0x20], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x78348eb5
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp + 0x20c]
push eax
lea eax, [ebp - 0x44]
push eax
push ebx
push ebx
push dword [ebp - 0x20]
mov dword [ebp - 0x4c], 0x20
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x783490a7
cmp dword [ebp - 0x44], 1
jne 0x783490a7
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp + 0x20c]
push 0x782f27fc
push eax
call dword [sym.imp.MSVCR80.dll_swscanf_s]
add esp, 0xc
cmp eax, 1
jne 0x783490a7
movzx eax, word [ebp - 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov dword [ebp - 0x1c], eax
movzx eax, word [ebp - 0x24]
mov ecx, eax
shr eax, 0xa
shl eax, 0xa
and ecx, 0x3ff
movzx edi, cx
movzx eax, ax
or eax, edi
push eax
call esi
push edi
mov dword [ebp - 0x3c], eax
call esi
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x10], 2
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x78348eb5
push 0x782f2804
call esi
cmp eax, ebx
je 0x78348eb5
lea ecx, [ebp - 0x1c]
push ecx
push 0x78348cf3
push 1
push 0x10
push eax
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_EnumResourceLanguagesW]
cmp word [ebp - 0x1c], bx
je 0x78348eb5
movzx eax, word [ebp - 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_ConvertDefaultLocale]
mov ecx, eax
shr eax, 0xa
shl eax, 0xa
and ecx, 0x3ff
movzx edi, cx
movzx eax, ax
or eax, edi
push eax
call esi
push edi
mov dword [ebp - 0x3c], eax
call esi
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x10], 2
jmp 0x78348eb5
mov dword [ebp - 4], edi
cmp dword [0x783ce4b4], ebx
je 0x7834914d
cmp dword [ebp - 0x18], edi
je 0x7834914d
mov eax, dword [0x783ce4bc]
cmp eax, ebx
je 0x78349144
mov ecx, dword [ebp - 0x14]
cmp ecx, ebx
je 0x78349144
push ecx
push ebx
mov dword [ebp - 0x14], ebx
call eax
push dword [ebp - 0x18]
call dword [0x783ce4b4]
mov eax, dword [ebp - 0x40]
jmp 0x78348fce