Function at 0x7cfb39f7
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xaf4
mov eax, dword [ebp + 0xc]
push ebx
cmp eax, dword [ebp + 0x10]
mov ebx, ecx
mov dword [ebp - 0x30], ebx
ja 0x7cfb3da0
push edi
push esi
mov esi, dword [sym.imp.COMCTL32.dll_DSA_Create]
push 1
push 8
call esi
push 1
push 0x28
mov dword [ebp - 0x18], eax
call esi
xor edi, edi
mov dword [ebp - 0x28], eax
cmp eax, edi
je 0x7cfb3d9b
cmp dword [ebp - 0x18], edi
je 0x7cfb3d9b
lea eax, [ebp - 0x10]
push eax
push 0x7cf3cbf0
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x7cfb3d8f
lea eax, [ebp - 0x2d4]
push 0x104
push eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], edi
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x7cfb3d86
lea eax, [ebp - 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
push eax
lea eax, [ebp - 0x2d4]
push eax
push dword [ebp - 0x10]
call esi
test eax, eax
jne 0x7cfb3d6f
lea eax, [ebp - 0x2d4]
push 0x7cf3cc84
push eax
mov dword [ebp + 0x14], 0x208
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
mov ebx, eax
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp - 0x6e4]
push eax
lea eax, [ebp - 0x14]
push eax
push edi
neg ebx
push edi
push dword [ebp - 0xc]
sbb ebx, ebx
inc ebx
call dword [sym.imp.SHLWAPI.dll_SHQueryValueExW]
test eax, eax
jne 0x7cfb3d63
push edi
lea eax, [ebp - 0xcc]
push 0x7cf34808
push eax
mov dword [ebp - 8], edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xcc]
push eax
push dword [ebp - 0xc]
call esi
test eax, eax
jne 0x7cfb3d63
lea eax, [ebp + 0x14]
mov esi, 0x208
push eax
lea eax, [ebp - 0xaf4]
push eax
lea eax, [ebp - 0x14]
push eax
push edi
push edi
mov dword [ebp + 0x14], esi
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_SHQueryValueExW]
test eax, eax
jne 0x7cfb3d20
push dword [ebp - 4]
call fcn.7cfb3980
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp - 0x4dc]
push eax
lea eax, [ebp - 0x14]
push eax
push edi
push 0x7cf3cc70
mov dword [ebp + 0x14], esi
push dword [ebp - 4]
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
call esi
test eax, eax
je 0x7cfb3b71
mov word [ebp - 0x4dc], di
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x6e4]
push eax
call sym.SHELL32.dll_SHCLSIDFromString
mov eax, dword [ebp - 8]
mov dword [ebp + 0x14], 0x208
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x4c], eax
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp - 0x8ec]
push eax
lea eax, [ebp - 0x14]
push eax
push edi
push 0x7cf3cc58
push dword [ebp - 4]
call esi
test eax, eax
jne 0x7cfb3bc4
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x8ec]
push eax
call sym.SHELL32.dll_SHCLSIDFromString
jmp 0x7cfb3bd0
mov esi, 0x7cf4c670
lea edi, [ebp - 0x48]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x10
mov edi, 0x7cf39c90
pop ecx
lea esi, [ebp - 0x48]
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x7cfb3bf3
push 0x40000022
call sym.SHELL32.dll_SHRestricted
test eax, eax
je 0x7cfb3d2b
push 0x10
mov edi, 0x7cf39f50
pop ecx
lea esi, [ebp - 0x48]
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
sete al
test eax, eax
mov dword [ebp - 0x24], eax
je 0x7cfb3c1e
push 0x80
call sym.SHELL32.dll_SHRestricted
test eax, eax
jne 0x7cfb3d2b
push 0x10
mov edi, 0x7cf39c80
pop ecx
lea esi, [ebp - 0x48]
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x7cfb3d2b
lea eax, [ebp - 0x60]
mov edi, ParseURLA
push eax
push edi
push dword [ebp - 0x28]
call dword [sym.imp.COMCTL32.dll_DSA_InsertItem]
push 0x414
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x7cfb3c8e
mov eax, dword [ebp - 0x2c]
push 0x104
mov dword [esi + 0x410], eax
lea eax, [esi + 0x208]
push eax
lea eax, [ebp - 0x4dc]
push eax
call dword [sym.imp.SHLWAPI.dll_SHUnicodeToUnicode]
push 0x104
lea eax, [ebp - 0xaf4]
push esi
push eax
call dword [sym.imp.SHLWAPI.dll_SHUnicodeToUnicode]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x8c], 0x2c
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0x88], 0x32
push eax
push edi
push dword [ebp - 0x18]
mov dword [ebp - 0x84], 0x100
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x38], esi
call dword [sym.imp.COMCTL32.dll_DSA_InsertItem]
cmp eax, 0xffffffff
je 0x7cfb3d13
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x7cfb3cf2
cmp dword [ebp - 0x24], eax
je 0x7cfb3cf2
lea ecx, [ebp - 0x8c]
push ecx
push 1
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_InsertMenuItemW]
mov dword [ebp - 0x1c], eax
jmp 0x7cfb3d13
cmp ebx, eax
je 0x7cfb3d00
xor ecx, ecx
cmp dword [ebp - 0x1c], eax
setne cl
mov edi, ecx
lea eax, [ebp - 0x8c]
push eax
push 1
push edi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_InsertMenuItemW]
inc dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp + 0x10]
ja 0x7cfb3d61
xor edi, edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x7cfb3d2d
xor edi, edi
inc dword [ebp - 8]
lea eax, [ebp - 0xcc]
push dword [ebp - 8]
push 0x7cf34808
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xcc]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
jmp 0x7cfb3b06
xor edi, edi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0x30]
inc dword [ebp - 0x20]
lea eax, [ebp - 0x2d4]
push 0x104
push eax
push dword [ebp - 0x20]
jmp 0x7cfb3a6c
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x28]
mov dword [ebx + 0x40], eax
mov eax, dword [ebp - 0x18]
mov dword [ebx + 0x48], eax
mov eax, dword [ebp + 0xc]
pop esi
pop edi
pop ebx
leave
ret 0x10