Function at 0x64198280
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x24c
mov dword [ebp - 0x230], ecx
mov ebx, dword [ebp + 0x14]
xor ecx, ecx
mov word [ebp - 0x220], cx
lea ecx, [ebp - 0x228]
mov esi, dword [ebp + 0xc]
mov dword [ebx], 0
mov edi, dword [sym.imp.advapi32.dll_RegQueryValueExW]
mov dword [ebp - 0x234], edx
mov edx, dword [ebp + 8]
mov dword [esp + 0x14], ecx
lea ecx, [ebp - 0x220]
mov dword [esp + 0x10], ecx
lea ecx, [ebp - 0x224]
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x228], 0x208
mov dword [esp + 0xc], ecx
mov dword [esp + 8], 0
mov dword [esp + 4], edx
mov dword [esp], eax
call edi
sub esp, 0x18
cmp eax, 0xea
je 0x641983f0
test eax, eax
jne 0x6419847b
movzx eax, word [ebp - 0x220]
test ax, ax
je 0x6419847b
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x22c], ecx
mov edx, dword [sym.imp.ucrtbase.dll_wcscpy]
mov edi, dword [ebp - 0x22c]
mov dword [ebp - 0x238], edx
cmp ax, 0x5c
je 0x641984c9
test ax, ax
jne 0x64198538
mov eax, dword [ebp - 0x230]
add dword [ebx], eax
test esi, esi
je 0x64198488
cmp eax, dword [ebp + 0x10]
jae 0x64198488
mov eax, dword [ebp - 0x234]
mov dword [esp], esi
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x238]
call eax
mov eax, dword [ebp - 0x230]
mov dword [esp], edi
sub dword [ebp + 0x10], eax
add esi, eax
call dword [sym.imp.ucrtbase.dll_wcslen]
lea eax, [eax + eax + 2]
mov dword [ebp - 0x228], eax
cmp eax, dword [ebp + 0x10]
jbe 0x64198518
mov eax, dword [ebp - 0x228]
xor esi, esi
add dword [ebx], eax
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_wcslen]
cmp dword [ebp - 0x224], 7
je 0x641984a8
lea edx, [ebp - 0x220]
cmp dword [ebp - 0x22c], edx
je 0x641983de
mov eax, dword [ebp - 0x22c]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_free]
lea esp, [ebp - 0xc]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [0x6419a04c], 8
jne 0x64198590
mov eax, dword [ebp - 0x228]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov dword [ebp - 0x22c], eax
test eax, eax
je 0x6419847b
mov eax, dword [ebp - 0x22c]
xor edx, edx
mov word [eax], dx
lea edx, [ebp - 0x228]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x224]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x14], edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x238]
mov dword [esp + 8], 0
mov dword [esp], eax
call edi
sub esp, 0x18
test eax, eax
jne 0x6419846c
mov eax, dword [ebp - 0x22c]
movzx eax, word [eax]
test ax, ax
jne 0x64198327
mov eax, dword [ebp - 0x22c]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_free]
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], edi
xor esi, esi
call dword [sym.imp.ucrtbase.dll_wcslen]
lea eax, [eax + eax + 2]
mov dword [ebp - 0x228], eax
jmp 0x641983a9
lea edi, [edi + eax*2 + 2]
cmp word [edi], 0
je 0x64198548
mov eax, dword [ebp - 0x22c]
movzx eax, word [eax]
cmp ax, 0x5c
jne 0x64198343
mov eax, dword [ebp - 0x22c]
movzx eax, word [eax + 2]
cmp ax, 0x5c
je 0x641984f4
cmp ax, 0x3a
jne 0x6419834c
mov eax, dword [ebp - 0x22c]
cmp word [eax + 4], 0x5c
jne 0x6419834c
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_wcslen]
lea eax, [eax + eax + 2]
mov dword [ebp - 0x228], eax
test esi, esi
je 0x641983a9
cmp eax, dword [ebp + 0x10]
ja 0x641983a1
mov dword [esp], esi
mov dword [esp + 4], edi
call dword [sym.imp.ucrtbase.dll_wcscpy]
mov eax, dword [ebp - 0x228]
sub dword [ebp + 0x10], eax
add esi, eax
jmp 0x641983a9
mov eax, dword [ebp - 0x22c]
movzx eax, word [eax + 2]
jmp 0x641984d9
lea ecx, [ebp - 0x220]
cmp dword [ebp - 0x22c], ecx
je 0x64198568
mov eax, dword [ebp - 0x22c]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_free]
lea esi, [esi]
add dword [ebx], 2
cmp dword [ebp + 0x10], 1
jbe 0x641983de
test esi, esi
je 0x641983de
xor eax, eax
mov word [esi], ax
jmp 0x641983de
mov eax, dword [ebp - 0x228]
mov dword [esp + 0xc], str.need_dynamic_buffer:__lu_n
mov dword [esp + 8], str.get_filename_from_reg
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0x6419a04c
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x641983fd