Function at 0x1e02a5aa
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
jmp case.default.0x1e02a5cd
mov ebx, dword [ebp + 0xc]
mov dword [ebx], esi
mov eax, dword [esi + 0x38]
cmp eax, 7
ja case.default.0x1e02a5cd
jmp dword [eax*4 + 0x1e02a8d3]
lea ecx, [edi + 0x438]
mov eax, dword [ecx]
test al, 4
jne 0x1e02a6ac
mov eax, dword [edi + 0x43c]
test byte [eax + 0x20], 0x10
je 0x1e02a680
mov ebx, dword [edi + 0x440]
and ebx, 0x20
mov eax, dword [eax + 0x10]
mov dword [esi + 0x38], 3
mov ecx, dword [esi + 0x20]
mov dword [ebp - 8], eax
mov dword [esi + 0x1c], ecx
je 0x1e02a61a
mov ecx, dword [esi + 0x18]
mov dword [ebp + 8], ecx
jmp 0x1e02a61e
and dword [ebp + 8], 0
mov ecx, ebx
neg ecx
sbb ecx, ecx
lea edx, [esi + 0x1c]
and ecx, edx
push ecx
push dword [ebp + 8]
lea ecx, [esi + 0x14]
push ecx
push 0
push eax
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne case.default.0x1e02a5cd
push dword [ebp - 8]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
mov ecx, dword [esi + 0x10]
lea eax, [eax + eax + 2]
shl ecx, 1
cmp eax, ecx
ja case.default.0x1e02a5cd
push dword [ebp - 8]
push dword [esi + 0xc]
call fcn.1e01bca8
and dword [esi + 0x3c], 0xfffffffb
test ebx, ebx
je 0x1e02a8cb
and dword [esi + 0x3c], 0xfffffff7
jmp 0x1e02a8cb
mov eax, dword [edi + 0x440]
and eax, 0x20
push eax
push esi
call fcn.1e02a137
test eax, eax
je 0x1e02a6b1
mov dword [esi + 0x38], 2
jmp 0x1e02a8cb
lea ecx, [edi + 0x438]
mov eax, dword [ecx]
test al, 4
je 0x1e02a6bd
and eax, 0xfffffffb
mov dword [ecx], eax
mov dword [esi + 0x38], 3
jmp case.default.0x1e02a5cd
mov eax, dword [edi + 0x440]
and eax, 0x20
push eax
push esi
call fcn.1e02a0a3
test eax, eax
jne 0x1e02a8cb
mov dword [esi + 0x38], 3
test byte [edi + 0x440], 2
je 0x1e02a833
cmp dword [esi + 0x24], 0
je 0x1e02a833
mov dword [esi + 0x38], 4
lea ecx, [edi + 0x438]
mov eax, dword [ecx]
test al, 2
jne 0x1e02a74a
mov eax, dword [esi + 0x40]
cmp eax, dword [edi + 0x448]
jae 0x1e02a74f
push esi
call fcn.1e02a1d4
test eax, eax
je 0x1e02a74f
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
push 0
push edi
mov dword [esi + 0x38], 5
call fcn.1e02a276
test eax, eax
jne 0x1e02a779
cmp dword [ebp - 4], eax
je 0x1e02a7a6
mov esi, dword [ebp + 8]
lea ecx, [edi + 0x438]
mov eax, dword [ecx]
test al, 2
je 0x1e02a75b
and eax, 0xfffffffd
mov dword [ecx], eax
mov dword [esi + 0x38], 6
jmp case.default.0x1e02a5cd
push esi
call fcn.1e02a157
test eax, eax
je 0x1e02a7b9
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
push 0
push edi
call fcn.1e02a276
test eax, eax
je 0x1e02a79c
mov ecx, dword [edi + 0x440]
test cl, 1
je case.default.0x1e02a5cd
test cl, 0x10
je case.default.0x1e02a5cd
and dword [eax + 0x3c], 0xfffffffe
mov dword [ebx], eax
jmp 0x1e02a8cb
cmp dword [ebp - 4], 0
jne case.default.0x1e02a5cd
mov dword [edi + 0x464], 2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
mov dword [esi + 0x38], 6
test byte [edi + 0x440], 2
jne 0x1e02a7df
cmp dword [esi + 8], 0
je 0x1e02a7df
mov eax, dword [edi + 0x43c]
test byte [eax + 0x20], 8
je 0x1e02a89d
mov dword [esi + 0x38], 7
mov eax, dword [edi + 0x440]
test al, 1
je 0x1e02a7fe
test al, 0x10
jne 0x1e02a7fe
test byte [esi + 0x3c], 1
jne 0x1e02a8a6
push 0
push edi
call fcn.1e029fb1
jmp case.default.0x1e02a5cd
mov edx, dword [edi + 0x440]
test dl, 1
je 0x1e02a822
test dl, 0x10
je 0x1e02a822
test byte [esi + 0x3c], 1
jne 0x1e02a8c7
lea ecx, [edi + 0x438]
mov eax, dword [ecx]
test al, 1
je 0x1e02a854
and eax, 0xfffffffe
mov dword [ecx], eax
mov dword [esi + 0x38], 7
push 0
push edi
call fcn.1e029f62
mov esi, eax
test esi, esi
mov dword [ebp + 8], esi
jne 0x1e02a5bc
jmp 0x1e02a7b0
and edx, 2
je 0x1e02a86b
cmp dword [esi + 8], 0
je 0x1e02a86b
mov eax, dword [edi + 0x43c]
test byte [eax + 0x20], 8
je 0x1e02a89d
cmp dword [esi + 0x24], 0
je 0x1e02a888
mov eax, dword [edi + 0x43c]
movzx eax, byte [eax + 0x20]
and eax, 1
or eax, 2
shl eax, 1
mov dword [esi + 0x38], eax
jmp case.default.0x1e02a5cd
test edx, edx
jne 0x1e02a833
cmp dword [esi + 8], edx
je 0x1e02a833
mov eax, dword [edi + 0x43c]
test byte [eax + 0x20], 8
jne 0x1e02a833
mov dword [esi + 0x38], 1
jmp case.default.0x1e02a5cd
and dword [esi + 0x3c], 0xfffffffe
mov eax, dword [esi + 0xc]
test eax, eax
je 0x1e02a8cb
push eax
push dword [0x1e03347c]
call fcn.1e01fd58
and dword [esi + 0xc], 0
or dword [esi + 0x3c], 4
jmp 0x1e02a8cb
and dword [esi + 0x3c], 0xfffffffe
xor eax, eax
inc eax
jmp 0x1e02a7b2