Function at 0xe16e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x1b
push 0
push 0
dec ecx
jne 0xe16e9
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0x24]
lea esi, [ebp - 0x28]
xor eax, eax
push ebp
push 0xe2117
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x28]
mov byte [eax], 2
mov eax, dword [ebp + 0x30]
mov byte [eax], 1
mov eax, dword [ebp + 0x48]
mov byte [eax], 0
mov eax, dword [ebp + 0x2c]
mov byte [eax], 5
mov eax, dword [ebp + 0x44]
mov byte [eax], 0
mov eax, dword [ebp + 0x1c]
mov byte [eax], 0
mov eax, dword [ebp + 0x18]
mov byte [eax], 0
mov eax, dword [ebp + 0x34]
mov byte [eax], 1
mov eax, dword [ebp + 0x20]
mov byte [eax], 0
mov eax, dword [ebp + 0x10]
mov byte [eax], 0
mov eax, dword [ebp - 8]
mov byte [eax], 1
mov eax, dword [ebp - 0xc]
mov byte [eax], 0
mov byte [edi], 7
mov eax, dword [ebp + 0x14]
mov byte [eax], 1
mov eax, dword [ebp - 4]
mov byte [eax], 1
mov eax, dword [ebp + 0xc]
mov byte [eax], 1
mov eax, dword [ebp + 0x40]
call fcn.000143f0
mov eax, dword [ebp + 0x3c]
mov byte [eax], 0
mov eax, dword [ebp + 0x38]
mov byte [eax], 0
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, case.0x1ffea.3
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x30]
call fcn.00026f34
mov eax, dword [ebp - 0x30]
call fcn.0001416c
push eax
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
mov ebx, eax
test ebx, ebx
jne 0xe20dd
lea eax, [ebp - 0x14]
mov edx, 0x400
call fcn.000271f0
lea eax, [ebp - 0x2c]
mov edx, 0x400
call fcn.000271f0
mov edx, 0x400
mov eax, dword [ebp - 0x14]
call fcn.00018100
mov dword [esi], 0x3ff
push esi
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0xe212c
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov ebx, eax
test ebx, ebx
jne 0xe186c
cmp dword [ebp - 0x10], 1
jne 0xe186c
cmp dword [esi], 0
jbe 0xe186c
cmp dword [esi], 0xc8
ja 0xe186c
lea eax, [ebp - 0x3c]
mov edx, dword [ebp - 0x14]
call fcn.00013ee0
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x38]
call fcn.000272e8
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x34]
call fcn.000273cc
mov eax, dword [ebp - 0x34]
push eax
lea edx, [ebp - 0x40]
mov eax, 0xe2148
call fcn.000273cc
mov edx, dword [ebp - 0x40]
pop eax
call fcn.000140b8
mov eax, dword [ebp - 4]
sete byte [eax]
mov edx, 0x400
mov eax, dword [ebp - 0x14]
call fcn.00018100
mov dword [esi], 0x3ff
push esi
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0xe214c
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov ebx, eax
test ebx, ebx
jne 0xe18f2
cmp dword [ebp - 0x10], 1
jne 0xe18f2
cmp dword [esi], 0
jbe 0xe18f2
cmp dword [esi], 0xc8
ja 0xe18f2
lea eax, [ebp - 0x4c]
mov edx, dword [ebp - 0x14]
call fcn.00013ee0
mov eax, dword [ebp - 0x4c]
lea edx, [ebp - 0x48]
call fcn.000272e8
mov eax, dword [ebp - 0x48]
lea edx, [ebp - 0x44]
call fcn.000273cc
mov eax, dword [ebp - 0x44]
push eax
lea edx, [ebp - 0x50]
mov eax, 0xe2148
call fcn.000273cc
mov edx, dword [ebp - 0x50]
pop eax
call fcn.000140b8
mov eax, dword [ebp - 8]
sete byte [eax]
mov edx, 0x400
mov eax, dword [ebp - 0x14]
call fcn.00018100
mov dword [esi], 0x3ff
push esi
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0xe2174
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov ebx, eax
test ebx, ebx
jne 0xe1978
cmp dword [ebp - 0x10], 1
jne 0xe1978
cmp dword [esi], 0
jbe 0xe1978
cmp dword [esi], 0xc8
ja 0xe1978
lea eax, [ebp - 0x5c]
mov edx, dword [ebp - 0x14]
call fcn.00013ee0
mov eax, dword [ebp - 0x5c]
lea edx, [ebp - 0x58]
call fcn.000272e8
mov eax, dword [ebp - 0x58]
lea edx, [ebp - 0x54]
call fcn.000273cc
mov eax, dword [ebp - 0x54]
push eax
lea edx, [ebp - 0x60]
mov eax, 0xe2148
call fcn.000273cc
mov edx, dword [ebp - 0x60]
pop eax
call fcn.000140b8
mov eax, dword [ebp - 0xc]
sete byte [eax]
mov edx, 0x400
mov eax, dword [ebp - 0x14]
call fcn.00018100
mov dword [esi], 0x3ff
push esi
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0xe219c
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov ebx, eax
test ebx, ebx
jne 0xe1a19
cmp dword [ebp - 0x10], 1
jne 0xe19fe
cmp dword [esi], 0
jbe 0xe19fe
cmp dword [esi], 0xc8
ja 0xe19fe
lea eax, [ebp - 0x6c]
mov edx, dword [ebp - 0x14]
call fcn.00013ee0
mov eax, dword [ebp - 0x6c]
lea edx, [ebp - 0x68]
call fcn.000272e8
mov eax, dword [ebp - 0x68]
lea edx, [ebp - 0x64]
call fcn.000273cc
mov eax, dword [ebp - 0x64]
push eax
lea edx, [ebp - 0x70]
mov eax, 0xe2148
call fcn.000273cc
mov edx, dword [ebp - 0x70]
pop eax
call fcn.000140b8
mov eax, dword [ebp + 0x44]
sete byte [eax]
mov eax, dword [ebp + 0x44]
cmp byte [eax], 0
je 0xe1a0e
mov eax, dword [ebp - 0xc]
cmp byte [eax], 0
je 0xe1a12
xor eax, eax
jmp 0xe1a14
mov al, 1
mov edx, dword [ebp + 0x44]
mov byte [edx], al
mov edx, 0x400
mov eax, dword [ebp - 0x14]
call fcn.00018100
mov dword [esi], 0x3ff
push esi
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0xe21cc
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov ebx, eax
test ebx, ebx
jne 0xe1a88
cmp dword [ebp - 0x10], 1
jne 0xe1a88
cmp dword [esi], 0
jbe 0xe1a88
cmp dword [esi], 4
ja 0xe1a88
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
call fcn.00013ee0
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
call fcn.00012d14
cmp dword [ebp - 0x24], 0
jne 0xe1a88
cmp ax, 1
jb 0xe1a88
cmp ax, 0x14
ja 0xe1a88
mov edx, dword [ebp + 0x2c]
mov byte [edx], al
mov edx, 0x400
mov eax, dword [ebp - 0x14]
call fcn.00018100
mov dword [esi], 0x3ff
push esi
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0xe21fc
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov ebx, eax
test ebx, ebx
jne 0xe1afd
cmp dword [ebp - 0x10], 1
jne 0xe1afd
cmp dword [esi], 0
jbe 0xe1afd
cmp dword [esi], 3
ja 0xe1afd
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
call fcn.00013ee0
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
call fcn.00012d14
cmp dword [ebp - 0x24], 0
jne 0xe1afd
cmp ax, 2
je 0xe1af8
cmp ax, 3
je 0xe1af8
cmp ax, 1
jne 0xe1afd
mov edx, dword [ebp + 0x28]
mov byte [edx], al
mov edx, 0x400
mov eax, dword [ebp - 0x14]
call fcn.00018100
mov dword [esi], 0x3ff
push esi
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0xe2218
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov ebx, eax
test ebx, ebx
jne 0xe1b68
cmp dword [ebp - 0x10], 1
jne 0xe1b68
cmp dword [esi], 0
jbe 0xe1b68
cmp dword [esi], 4
ja 0xe1b68
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
call fcn.00013ee0
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
call fcn.00012d14
cmp dword [ebp - 0x24], 0
jne 0xe1b68
test ax, ax
jb 0xe1b68
cmp ax, 0xff
ja 0xe1b68
mov byte [edi], al
mov edx, 0x400
mov eax, dword [ebp - 0x14]
call fcn.00018100
mov dword [esi], 0x3ff
push esi
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0xe2230
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov ebx, eax
test ebx, ebx
jne 0xe1bd6
cmp dword [ebp - 0x10], 1
jne 0xe1bd6
cmp dword [esi], 0
jbe 0xe1bd6
cmp dword [esi], 4
ja 0xe1bd6
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
call fcn.00013ee0
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
call fcn.00012d14
cmp dword [ebp - 0x24], 0
jne 0xe1bd6
test ax, ax
jb 0xe1bd6
cmp ax, 0xff
ja 0xe1bd6
mov edx, dword [ebp + 0x20]
mov byte [edx], al
mov eax, dword [ebp + 0x28]
cmp byte [eax], 2
jne 0xe1c03
cmp byte [edi], 1
jb 0xe1bf8
cmp byte [edi], 0xe
ja 0xe1bf8
mov eax, dword [ebp + 0x20]
cmp byte [eax], 0
jb 0xe1bf8
mov eax, dword [ebp + 0x20]
cmp byte [eax], 0x17
jbe 0xe1c5c
mov byte [edi], 1
mov eax, dword [ebp + 0x20]
mov byte [eax], 0
jmp 0xe1c5c
mov eax, dword [ebp + 0x28]
cmp byte [eax], 3
jne 0xe1c45
cmp byte [edi], 0
jb 0xe1c3a
cmp byte [edi], 0x17
ja 0xe1c3a
mov eax, dword [ebp + 0x20]
cmp byte [eax], 0
jb 0xe1c3a
mov eax, dword [ebp + 0x20]
cmp byte [eax], 0x3b
ja 0xe1c3a
cmp byte [edi], 0
jne 0xe1c5c
mov eax, dword [ebp + 0x20]
cmp byte [eax], 0xa
jae 0xe1c5c
mov eax, dword [ebp + 0x20]
mov byte [eax], 0xa
jmp 0xe1c5c
mov byte [edi], 4
mov eax, dword [ebp + 0x20]
mov byte [eax], 0
jmp 0xe1c5c
mov eax, dword [ebp + 0x28]
cmp byte [eax], 1
je 0xe1c5c
mov eax, dword [ebp + 0x28]
mov byte [eax], 3
mov byte [edi], 4
mov eax, dword [ebp + 0x20]
mov byte [eax], 0
mov edx, 0x400
mov eax, dword [ebp - 0x14]
call fcn.00018100
mov dword [esi], 0x3ff
push esi
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0xe2248
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov ebx, eax
test ebx, ebx
jne 0xe1ce2
cmp dword [ebp - 0x10], 1
jne 0xe1ce2
cmp dword [esi], 0
jbe 0xe1ce2
cmp dword [esi], 0xc8
ja 0xe1ce2
lea eax, [ebp - 0x7c]
mov edx, dword [ebp - 0x14]
call fcn.00013ee0
mov eax, dword [ebp - 0x7c]
lea edx, [ebp - 0x78]
call fcn.000272e8
mov eax, dword [ebp - 0x78]
lea edx, [ebp - 0x74]
call fcn.000273cc
mov eax, dword [ebp - 0x74]
push eax
lea edx, [ebp - 0x80]
mov eax, 0xe2148
call fcn.000273cc
mov edx, dword [ebp - 0x80]
pop eax
call fcn.000140b8
mov eax, dword [ebp + 0x34]
sete byte [eax]
mov eax, dword [ebp + 0x34]
mov byte [eax], 1
mov edx, 0x400
mov eax, dword [ebp - 0x14]
call fcn.00018100
mov dword [esi], 0x3ff
push esi
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0xe227c
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov ebx, eax
test ebx, ebx
jne 0xe1d86
cmp dword [ebp - 0x10], 1
jne 0xe1d86
cmp dword [esi], 0
jbe 0xe1d86
cmp dword [esi], 0xc8
ja 0xe1d86
lea eax, [ebp - 0x8c]
mov edx, dword [ebp - 0x14]
call fcn.00013ee0
mov eax, dword [ebp - 0x8c]
lea edx, [ebp - 0x88]
call fcn.000272e8
mov eax, dword [ebp - 0x88]
lea edx, [ebp - 0x84]
call fcn.000273cc
mov eax, dword [ebp - 0x84]
push eax
lea edx, [ebp - 0x90]
mov eax, 0xe2148
call fcn.000273cc
mov edx, dword [ebp - 0x90]
pop eax
call fcn.000140b8
mov eax, dword [ebp + 0x30]
sete byte [eax]
mov edx, 0x400
mov eax, dword [ebp - 0x14]
call fcn.00018100
mov dword [esi], 0x3ff
push esi
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0xe22bc
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov ebx, eax
test ebx, ebx
jne 0xe1e24
cmp dword [ebp - 0x10], 1
jne 0xe1e24
cmp dword [esi], 0
jbe 0xe1e24
cmp dword [esi], 0xc8
ja 0xe1e24
lea eax, [ebp - 0x9c]
mov edx, dword [ebp - 0x14]
call fcn.00013ee0
mov eax, dword [ebp - 0x9c]
lea edx, [ebp - 0x98]
call fcn.000272e8
mov eax, dword [ebp - 0x98]
lea edx, [ebp - 0x94]
call fcn.000273cc
mov eax, dword [ebp - 0x94]
push eax
lea edx, [ebp - 0xa0]
mov eax, 0xe2148
call fcn.000273cc
mov edx, dword [ebp - 0xa0]
pop eax
call fcn.000140b8
mov eax, dword [ebp + 0x18]
sete byte [eax]
mov eax, dword [ebp + 0x18]
cmp byte [eax], 0
je 0xe1e37
mov eax, dword [ebp + 0x14]
mov byte [eax], 0
jmp 0xe1ed5
mov edx, 0x400
mov eax, dword [ebp - 0x14]
call fcn.00018100
mov dword [esi], 0x3ff
push esi
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0xe2324
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov ebx, eax
test ebx, ebx
jne 0xe1ed5
cmp dword [ebp - 0x10], 1
jne 0xe1ed5
cmp dword [esi], 0
jbe 0xe1ed5
cmp dword [esi], 0xc8
ja 0xe1ed5
lea eax, [ebp - 0xac]
mov edx, dword [ebp - 0x14]
call fcn.00013ee0
mov eax, dword [ebp - 0xac]
lea edx, [ebp - 0xa8]
call fcn.000272e8
mov eax, dword [ebp - 0xa8]
lea edx, [ebp - 0xa4]
call fcn.000273cc
mov eax, dword [ebp - 0xa4]
push eax
lea edx, [ebp - 0xb0]
mov eax, 0xe2148
call fcn.000273cc
mov edx, dword [ebp - 0xb0]
pop eax
call fcn.000140b8
mov eax, dword [ebp + 0x14]
sete byte [eax]
mov eax, dword [ebp + 0x10]
mov byte [eax], 0
mov edx, 0x400
mov eax, dword [ebp - 0x14]
call fcn.00018100
mov dword [esi], 0x3ff
push esi
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0xe2388
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov ebx, eax
test ebx, ebx
jne 0xe1f79
cmp dword [ebp - 0x10], 1
jne 0xe1f79
cmp dword [esi], 0
jbe 0xe1f79
cmp dword [esi], 0xc8
ja 0xe1f79
lea eax, [ebp - 0xbc]
mov edx, dword [ebp - 0x14]
call fcn.00013ee0
mov eax, dword [ebp - 0xbc]
lea edx, [ebp - 0xb8]
call fcn.000272e8
mov eax, dword [ebp - 0xb8]
lea edx, [ebp - 0xb4]
call fcn.000273cc
mov eax, dword [ebp - 0xb4]
push eax
lea edx, [ebp - 0xc0]
mov eax, 0xe2148
call fcn.000273cc
mov edx, dword [ebp - 0xc0]
pop eax
call fcn.000140b8
mov eax, dword [ebp + 0x10]
sete byte [eax]
mov eax, dword [ebp + 0xc]
mov byte [eax], 1
mov edx, 0x400
mov eax, dword [ebp - 0x14]
call fcn.00018100
mov dword [esi], 0x3ff
push esi
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0xe23b8
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov ebx, eax
test ebx, ebx
jne 0xe201d
cmp dword [ebp - 0x10], 1
jne 0xe201d
cmp dword [esi], 0
jbe 0xe201d
cmp dword [esi], 0xc8
ja 0xe201d
lea eax, [ebp - 0xcc]
mov edx, dword [ebp - 0x14]
call fcn.00013ee0
mov eax, dword [ebp - 0xcc]
lea edx, [ebp - 0xc8]
call fcn.000272e8
mov eax, dword [ebp - 0xc8]
lea edx, [ebp - 0xc4]
call fcn.000273cc
mov eax, dword [ebp - 0xc4]
push eax
lea edx, [ebp - 0xd0]
mov eax, 0xe2148
call fcn.000273cc
mov edx, dword [ebp - 0xd0]
pop eax
call fcn.000140b8
mov eax, dword [ebp + 0xc]
sete byte [eax]
mov eax, dword [ebp + 8]
mov byte [eax], 1
mov edx, 0x400
mov eax, dword [ebp - 0x14]
call fcn.00018100
mov dword [esi], 0x3ff
push esi
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0xe23d8
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov ebx, eax
test ebx, ebx
jne 0xe20c3
cmp dword [ebp - 0x10], 1
jne 0xe20c3
cmp dword [esi], 0
jbe 0xe20c3
cmp dword [esi], 0xc8
ja 0xe20c3
lea eax, [ebp - 0xdc]
mov edx, dword [ebp - 0x14]
call fcn.00013ee0
mov eax, dword [ebp - 0xdc]
lea edx, [ebp - 0xd8]
call fcn.000272e8
mov eax, dword [ebp - 0xd8]
lea edx, [ebp - 0xd4]
call fcn.000273cc
mov eax, dword [ebp - 0xd4]
push eax
lea eax, [ebp - 0xe0]
push eax
mov eax, 0xe2148
pop edx
call fcn.000273cc
mov edx, dword [ebp - 0xe0]
pop eax
call fcn.000140b8
mov eax, dword [ebp + 8]
sete byte [eax]
lea eax, [ebp - 0x2c]
mov edx, 0x400
call fcn.00027218
lea eax, [ebp - 0x14]
mov edx, 0x400
call fcn.00027218
cmp dword [ebp - 0x18], 0
je 0xe20ec
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xe211e
lea eax, [ebp - 0xe0]
mov edx, 0x2d
call fcn.00013d3c
lea eax, [ebp - 0x1c]
call fcn.00013d18
ret