Function at 0x7f2f046d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push edi
xor edi, edi
cmp dword [0x7f307acc], edi
je 0x7f2f0498
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryMultipleValuesW]
jmp 0x7f2f06e0
mov eax, dword [ebp + 0x10]
shl eax, 4
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [ebp - 8], edi
je 0x7f2f04bb
push eax
push 8
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 4], eax
jmp 0x7f2f04be
mov dword [ebp - 4], edi
cmp dword [ebp - 4], edi
jne 0x7f2f04cf
mov dword [ebp - 0x18], 0xe
jmp 0x7f2f06dc
mov eax, dword [ebp + 0x10]
shl eax, 8
je 0x7f2f04e8
push eax
push 8
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x14], eax
jmp 0x7f2f04eb
mov dword [ebp - 0x14], edi
push ebx
mov ebx, dword [ebp - 0x14]
cmp ebx, edi
jne 0x7f2f04ff
mov dword [ebp - 0x18], 0xe
jmp 0x7f2f06be
cmp dword [ebp + 0x10], edi
jbe 0x7f2f0550
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
sub eax, edi
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [edi]
cmp eax, 0xffff
jbe 0x7f2f0548
push 0
push 0
push 0x100
push ebx
push eax
call fcn.7f2da99a
pop ecx
push eax
push dword [edi]
push 0
push dword [0x7f307ac8]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + edi], ebx
add ebx, eax
add edi, 0x10
dec dword [ebp - 0x18]
jne 0x7f2f0515
mov edi, dword [ebp + 0x18]
test edi, edi
je 0x7f2f0571
mov eax, dword [edi]
test eax, eax
je 0x7f2f0571
push eax
push 8
mov dword [ebp - 0xc], eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 8], eax
jmp 0x7f2f0579
and dword [ebp - 0xc], 0
and dword [ebp - 8], 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push dword [ebp + 0x10]
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryMultipleValuesA]
test eax, eax
mov dword [ebp - 0x18], eax
jne 0x7f2f0668
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp + 0x18], edi
jbe 0x7f2f06ae
mov esi, dword [ebp - 4]
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x10]
add esi, 4
add ebx, 0xc
sub eax, dword [ebp + 0xc]
mov dword [ebp + 8], esi
mov dword [ebp - 0x10], eax
mov dword [ebp + 0x10], ecx
jmp 0x7f2f05ce
mov edi, dword [ebp + 0x18]
mov eax, dword [ebp - 0x10]
mov ecx, dword [esi]
mov edx, dword [ebp - 8]
mov dword [ebx - 8], ecx
mov eax, dword [ebx + eax]
mov dword [ebx], eax
lea eax, [edi + edx]
mov dword [ebx - 4], eax
mov eax, dword [ebx]
cmp eax, 1
je 0x7f2f061d
cmp eax, 2
je 0x7f2f061d
cmp eax, 7
je 0x7f2f061d
mov ecx, dword [esi]
mov eax, dword [ebp + 0x14]
mov esi, dword [esi + 4]
lea edi, [eax + edi*2]
mov eax, ecx
shr ecx, 2
add esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebp + 8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [eax]
add dword [ebp + 0x18], eax
mov edi, dword [ebp + 0x18]
mov esi, dword [ebp + 8]
jmp 0x7f2f0645
mov eax, dword [ebp - 0xc]
sub eax, edi
push eax
mov eax, dword [ebp + 0x14]
lea eax, [eax + edi*2]
push eax
push dword [esi]
mov eax, dword [esi + 4]
add eax, edx
push eax
push 0
push dword [0x7f307ac8]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebx - 8], eax
add edi, eax
add edi, 3
and edi, 0xfffffffc
add esi, 0x10
add ebx, 0x10
dec dword [ebp + 0x10]
mov dword [ebp + 0x18], edi
mov dword [ebp + 8], esi
jne 0x7f2f05c8
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
jmp 0x7f2f06ae
cmp eax, 0xea
jne 0x7f2f06ae
test edi, edi
je 0x7f2f06ae
mov eax, dword [0x7f307ac8]
cmp eax, 0x3a4
je 0x7f2f06a9
cmp eax, 0x3b5
je 0x7f2f06a9
cmp eax, 0x3b6
je 0x7f2f06a9
cmp eax, 0x3a8
je 0x7f2f06a9
cmp eax, 0x551
je 0x7f2f06a9
cmp eax, 0xd698
je 0x7f2f06a9
mov eax, dword [ebp - 0xc]
add eax, eax
jmp 0x7f2f06ac
mov eax, dword [ebp - 0xc]
mov dword [edi], eax
push dword [ebp - 0x14]
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor edi, edi
push dword [ebp - 4]
push edi
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
push eax
call ebx
cmp dword [ebp - 8], edi
je 0x7f2f06db
push dword [ebp - 8]
push edi
call esi
push eax
call ebx
pop ebx
mov eax, dword [ebp - 0x18]
pop esi
pop edi
leave
ret 0x14