Function at 0x30006bc1
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x2c8]
sub esp, 0x348
mov eax, dword [0x30015078]
push ebx
xor ebx, ebx
push esi
mov dword [ebp + 0x2c4], eax
mov eax, dword [ebp + 0x2e0]
push edi
push dword [ebp + 0x2d0]
mov dword [eax], ebx
xor eax, eax
mov ecx, 0x87
lea edi, [ebp - 0x58]
rep stosd dword es:[edi], eax
push 0x80
lea eax, [ebp - 0x50]
push eax
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x58], 0x21c
mov dword [ebp - 0x54], 0xf
call fcn.3000448f
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp + 0xb0]
push eax
push ebx
push ebx
push 0x300018d8
push dword [ebp + 0x2d4]
mov dword [ebp - 0x60], 4
call edi
mov esi, eax
cmp esi, ebx
jle 0x30006c62
and esi, 0xffff
or esi, 0x80070000
cmp esi, ebx
jl 0x30007133
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp + 0xb4]
push eax
push ebx
push ebx
push 0x300018bc
push dword [ebp + 0x2d4]
mov dword [ebp - 0x60], 4
call edi
mov esi, eax
cmp esi, ebx
jle 0x30006c9d
and esi, 0xffff
or esi, 0x80070000
cmp esi, ebx
jl 0x30007133
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp + 0xb8]
push eax
push ebx
push ebx
push 0x300018a8
push dword [ebp + 0x2d4]
mov dword [ebp - 0x60], 4
call edi
mov esi, eax
cmp esi, ebx
jle 0x30006cd8
and esi, 0xffff
or esi, 0x80070000
cmp esi, ebx
jl 0x30007133
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x58]
push eax
push dword [ebp + 0x2dc]
push dword [ebp + 0x2d8]
call fcn.30006b46
mov esi, eax
cmp esi, ebx
jl 0x30007133
lea eax, [ebp - 0x5c]
push eax
push 0x20019
push ebx
push 0x30001890
push dword [ebp + 0x2d4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jle 0x30006d2a
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, 0x80070002
jne 0x30006d37
xor esi, esi
inc esi
cmp esi, ebx
jl 0x30007133
jne 0x30006e7c
mov eax, 0x100
push eax
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x6c]
push eax
call fcn.3001121a
mov esi, eax
cmp esi, ebx
jl 0x30007133
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
lea eax, [ebp - 0x60]
push eax
push dword [ebp - 0x6c]
lea eax, [ebp + 0x2d0]
push ebx
push ebx
push eax
lea eax, [ebp + 0x1c4]
push eax
mov dword [ebp + 0x2dc], ebx
mov dword [ebp - 0x60], 0x200
push ebx
jmp 0x30006e56
cmp eax, 0xea
jne 0x30006df6
mov eax, dword [ebp - 0x60]
lea ecx, [eax + eax]
cmp dword [ebp - 0x70], ecx
jae 0x30006ee7
lea eax, [eax + eax + 0x32]
push eax
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x6c]
push eax
call fcn.3001121a
mov esi, eax
cmp esi, ebx
jl 0x30007133
mov eax, dword [ebp - 0x70]
add eax, eax
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x60]
push eax
push dword [ebp - 0x6c]
lea eax, [ebp + 0x2d0]
push ebx
push ebx
push eax
lea eax, [ebp + 0x1c4]
push eax
push dword [ebp + 0x2dc]
mov dword [ebp + 0x2d0], 0x80
push dword [ebp - 0x5c]
call edi
cmp eax, ebx
jle 0x30006e04
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, ebx
jl 0x30007133
push dword [ebp - 0x6c]
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax]
lea edx, [ebp + 0x1c4]
push edx
push eax
call dword [ecx + 0x1c]
mov esi, eax
cmp esi, ebx
jl 0x30007133
inc dword [ebp + 0x2dc]
mov eax, dword [ebp - 0x70]
add eax, eax
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x60]
push eax
push dword [ebp - 0x6c]
lea eax, [ebp + 0x2d0]
push ebx
push ebx
push eax
lea eax, [ebp + 0x1c4]
push eax
push dword [ebp + 0x2dc]
push dword [ebp - 0x5c]
mov dword [ebp + 0x2d0], 0x80
call edi
cmp eax, 0x103
jne 0x30006d91
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x5c], ebx
lea eax, [ebp - 0x5c]
push eax
push 0x20019
push ebx
push 0x300018f8
push dword [ebp + 0x2d4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jle 0x30006ea5
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, 0x80070002
jne 0x30006eb2
xor esi, esi
inc esi
cmp esi, ebx
jl 0x30007133
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jne 0x30006fd8
lea eax, [ebp - 0x80]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp + 0x2d0]
push eax
lea eax, [ebp + 0x1c4]
push eax
mov dword [ebp + 0x2dc], ebx
push ebx
jmp 0x30006f93
mov esi, 0x8000ffff
jmp 0x30007133
lea eax, [ebp - 0x64]
push eax
push 0x20019
push ebx
lea eax, [ebp + 0x1c4]
push eax
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, ebx
jle 0x30006f1f
and esi, 0xffff
or esi, 0x80070000
cmp esi, ebx
jl 0x30007133
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax]
lea edx, [ebp - 0x78]
push edx
push dword [ebp + 0x2d8]
lea edx, [ebp + 0x1c4]
push dword [ebp - 0x64]
push edx
push eax
call dword [ecx + 0x48]
mov esi, eax
cmp esi, ebx
jl 0x30007133
mov eax, dword [ebp - 0x78]
cmp eax, ebx
je 0x30006f66
mov ecx, dword [eax + 4]
mov ecx, dword [ecx + 4]
lea eax, [ecx + eax + 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 0x78], ebx
push dword [ebp - 0x64]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp + 0x2dc]
lea eax, [ebp - 0x80]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp + 0x2d0]
push eax
lea eax, [ebp + 0x1c4]
push eax
push dword [ebp + 0x2dc]
mov dword [ebp - 0x64], ebx
push dword [ebp - 0x5c]
mov dword [ebp + 0x2d0], 0x80
call edi
mov esi, eax
cmp esi, ebx
je 0x30006ef1
jle 0x30006fba
and esi, 0xffff
or esi, 0x80070000
cmp esi, 0x80070103
jne 0x30006fc4
xor esi, esi
cmp esi, ebx
jl 0x30007133
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x5c], ebx
lea eax, [ebp - 0x5c]
push eax
push 0x20019
push ebx
push 0x300018e4
push dword [ebp + 0x2d4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jle 0x30007001
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, 0x80070002
jne 0x3000700e
xor esi, esi
inc esi
cmp esi, ebx
jl 0x30007133
jne 0x3000711a
lea eax, [ebp - 0x80]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp + 0x2d0]
push eax
lea eax, [ebp + 0x1c4]
push eax
mov dword [ebp + 0x2dc], ebx
push ebx
jmp 0x300070d9
lea eax, [ebp - 0x64]
push eax
push 0x20019
push ebx
lea eax, [ebp + 0x1c4]
push eax
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, ebx
jle 0x3000706b
and esi, 0xffff
or esi, 0x80070000
cmp esi, ebx
jl 0x30007133
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax]
lea edx, [ebp - 0x74]
push edx
push dword [ebp - 0x64]
lea edx, [ebp + 0x1c4]
push edx
push eax
call dword [ecx + 0x2c]
mov esi, eax
cmp esi, ebx
jl 0x30007133
mov eax, dword [ebp - 0x74]
cmp eax, ebx
je 0x300070ac
mov ecx, dword [eax + 4]
mov ecx, dword [ecx + 4]
lea eax, [ecx + eax + 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 0x74], ebx
push dword [ebp - 0x64]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp + 0x2dc]
lea eax, [ebp - 0x80]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp + 0x2d0]
push eax
lea eax, [ebp + 0x1c4]
push eax
push dword [ebp + 0x2dc]
mov dword [ebp - 0x64], ebx
push dword [ebp - 0x5c]
mov dword [ebp + 0x2d0], 0x80
call edi
mov esi, eax
cmp esi, ebx
je 0x3000703d
jle 0x30007100
and esi, 0xffff
or esi, 0x80070000
cmp esi, 0x80070103
jne 0x3000710a
xor esi, esi
cmp esi, ebx
jl 0x30007133
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x5c], ebx
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x74]
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp + 0x2e0]
mov dword [ecx], eax
mov dword [ebp - 0x68], ebx
xor esi, esi
mov eax, dword [ebp - 0x74]
cmp eax, ebx
je 0x3000714a
mov ecx, dword [eax + 4]
mov ecx, dword [ecx + 4]
lea eax, [ecx + eax + 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x78]
cmp eax, ebx
je 0x30007161
mov ecx, dword [eax + 4]
mov ecx, dword [ecx + 4]
lea eax, [ecx + eax + 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebp - 0x6c], ebx
je 0x3000716e
push dword [ebp - 0x6c]
call fcn.30011460
cmp dword [ebp - 0x64], ebx
je 0x3000717c
push dword [ebp - 0x64]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x5c], ebx
je 0x3000718a
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x68]
cmp eax, ebx
je 0x300071ae
mov ecx, dword [eax]
push eax
call dword [ecx + 0x7c]
mov eax, dword [ebp - 0x68]
cmp eax, ebx
je 0x300071ae
mov ecx, dword [eax + 4]
mov ecx, dword [ecx + 4]
lea eax, [ecx + eax + 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp + 0x2c4]
pop edi
mov eax, esi
pop esi
pop ebx
call fcn.30012b55
add ebp, 0x2c8
leave
ret 0x14