Function at 0x6734dfa0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x67409ea5
mov eax, dword fs:[0]
push eax
sub esp, 0xa4
mov eax, dword [0x67460ecc]
xor eax, esp
mov dword [esp + 0x9c], eax
push ebp
push esi
push edi
mov eax, dword [0x67460ecc]
xor eax, esp
push eax
lea eax, [esp + 0xb4]
mov dword fs:[0], eax
mov eax, dword [esp + 0xc4]
push 0x10000
mov dword [esp + 0x2c], eax
mov dword [esp + 0x18], 0x10000
call dword [sym.imp.MSVCR80.dll_malloc]
add esp, 4
push 0x310
push 0xe6
lea ecx, [esp + 0x74]
mov edi, eax
push str._d__d
push ecx
mov dword [esp + 0x20], edi
call dword [sym.imp.USER32.dll_wsprintfW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add esp, 0x10
lea edx, [esp + 0x14]
push edx
push edi
push 0
push 0
lea eax, [esp + 0x7c]
push eax
push Ordinal_7
call esi
cmp eax, 0xea
jne 0x6734e089
mov ebp, dword [sym.imp.MSVCR80.dll_realloc]
jmp 0x6734e050
mov eax, dword [esp + 0x14]
add eax, 0x400
push eax
push edi
mov dword [esp + 0x1c], eax
call ebp
add esp, 8
lea ecx, [esp + 0x14]
push ecx
push eax
push 0
push 0
lea edx, [esp + 0x7c]
push edx
push Ordinal_7
mov dword [esp + 0x28], eax
call esi
cmp eax, 0xea
mov edi, dword [esp + 0x10]
je 0x6734e050
mov esi, dword [edi + 0x18]
add esi, edi
cmp dword [edi + 0x1c], 0
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], 0
jbe 0x6734e27e
cmp dword [esi + 0xc], 0xe6
je 0x6734e0b8
add esi, dword [esi]
mov dword [esp + 0x1c], esi
jmp 0x6734e26a
mov ebp, dword [ebx + 8]
cmp dword [ebx + 4], ebp
jbe 0x6734e0c6
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov edi, dword [ebx + 4]
cmp edi, dword [ebx + 8]
jbe 0x6734e0d4
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
cmp edi, ebp
je 0x6734e106
mov eax, dword [ebx + 8]
sub eax, ebp
sar eax, 2
test eax, eax
lea ecx, [eax*4]
lea edx, [ecx + edi]
mov dword [esp + 0x18], edx
jle 0x6734e0ff
push ecx
push ebp
push ecx
push edi
call dword [sym.imp.MSVCR80.dll_memmove_s]
add esp, 0x10
mov eax, dword [esp + 0x18]
mov dword [ebx + 8], eax
mov edi, dword [esi + 8]
mov ebp, dword [esi + 4]
add edi, esi
lea ecx, [esp + 0x50]
mov dword [esp + 0x24], edi
add ebp, esi
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
lea ecx, [esp + 0x34]
mov dword [esp + 0xbc], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
mov byte [esp + 0xbc], 1
cmp dword [esi + 0x28], 0
mov dword [esp + 0x18], 0
jle 0x6734e23f
jmp 0x6734e154
mov edi, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
push ecx
lea ecx, [esp + 0x54]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
mov edx, dword [ebp + 0x10]
add edx, ebp
push edx
lea ecx, [esp + 0x38]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
lea esi, [esp + 0x50]
call fcn.6734b450
lea esi, [esp + 0x34]
call fcn.6734b450
push 0
lea eax, [esp + 0x54]
push eax
mov ecx, esi
call dword [sym.imp.MSVCP80.dll_public:_unsigned_int___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::find_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___unsigned_int_const]
mov ecx, dword [sym.imp.MSVCP80.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
cmp eax, dword [ecx]
je 0x6734e21c
mov edx, dword [esp + 0x1c]
mov ecx, dword [edx + 0x20]
xor eax, eax
test ecx, ecx
jbe 0x6734e21c
jmp 0x6734e1b0
cmp dword [edi + 4], 0x310
je 0x6734e1c4
add edi, dword [edi]
add eax, 1
cmp eax, ecx
jb 0x6734e1b0
jmp 0x6734e21c
mov eax, dword [ebp]
mov edi, dword [edi + 0x24]
add eax, ebp
add edi, eax
mov eax, dword [ebx + 4]
test eax, eax
jne 0x6734e1d9
xor edx, edx
jmp 0x6734e1e1
mov edx, dword [ebx + 8]
sub edx, eax
sar edx, 2
test eax, eax
je 0x6734e200
mov ecx, dword [ebx + 0xc]
sub ecx, eax
sar ecx, 2
cmp edx, ecx
jae 0x6734e200
mov eax, dword [ebx + 8]
mov ecx, dword [edi]
mov dword [eax], ecx
add eax, 4
mov dword [ebx + 8], eax
jmp 0x6734e21c
mov esi, dword [ebx + 8]
cmp eax, esi
jbe 0x6734e20d
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
push esi
push ebx
push edi
lea edx, [esp + 0x38]
push edx
mov eax, ebx
call fcn.6734e5c0
mov eax, dword [ebp]
mov ecx, dword [esp + 0x1c]
add eax, ebp
mov ebp, dword [eax]
add ebp, eax
mov eax, dword [esp + 0x18]
add eax, 1
cmp eax, dword [ecx + 0x28]
mov dword [esp + 0x18], eax
jl 0x6734e150
mov esi, ecx
lea ecx, [esp + 0x34]
mov byte [esp + 0xbc], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esp + 0x50]
mov dword [esp + 0xbc], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x20]
add eax, 1
cmp eax, dword [edi + 0x1c]
mov dword [esp + 0x20], eax
jb 0x6734e0a4
push edi
call dword [sym.imp.MSVCR80.dll_free]
add esp, 4
push Ordinal_7
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0xb4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.673f06fa
add esp, 0xb0
ret