Function at 0x1e028db4
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
jmp case.default.0x1e028dd7
mov ebx, dword [ebp + 0xc]
mov dword [ebx], esi
mov eax, dword [esi + 0x38]
cmp eax, 7
ja case.default.0x1e028dd7
jmp dword [eax*4 + 0x1e0290e0]
lea ecx, [edi + 0x438]
mov eax, dword [ecx]
test al, 4
jne 0x1e028eb9
mov eax, dword [edi + 0x43c]
test byte [eax + 0x20], 0x10
je 0x1e028e8d
mov ebx, dword [edi + 0x440]
and ebx, 0x20
mov eax, dword [eax + 0x10]
mov dword [esi + 0x38], 3
mov ecx, dword [esi + 0x20]
mov dword [ebp - 8], eax
mov dword [esi + 0x1c], ecx
je 0x1e028e24
mov ecx, dword [esi + 0x18]
mov dword [ebp + 8], ecx
jmp 0x1e028e28
and dword [ebp + 8], 0
mov ecx, ebx
neg ecx
sbb ecx, ecx
lea edx, [esi + 0x1c]
and ecx, edx
push ecx
push dword [ebp + 8]
lea ecx, [esi + 0x14]
push ecx
push 0
push eax
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne case.default.0x1e028dd7
mov eax, dword [ebp - 8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1e028e55
mov ecx, dword [esi + 0x10]
sub eax, edx
shl ecx, 2
inc eax
cmp eax, ecx
ja case.default.0x1e028dd7
push dword [ebp - 8]
push dword [esi + 0xc]
call fcn.1e01d8b9
and dword [esi + 0x3c], 0xfffffffb
test ebx, ebx
je 0x1e0290d8
and dword [esi + 0x3c], 0xfffffff7
jmp 0x1e0290d8
mov eax, dword [edi + 0x440]
and eax, 0x20
push eax
push esi
call fcn.1e028931
test eax, eax
je 0x1e028ebe
mov dword [esi + 0x38], 2
jmp 0x1e0290d8
lea ecx, [edi + 0x438]
mov eax, dword [ecx]
test al, 4
je 0x1e028eca
and eax, 0xfffffffb
mov dword [ecx], eax
mov dword [esi + 0x38], 3
jmp case.default.0x1e028dd7
mov eax, dword [edi + 0x440]
and eax, 0x20
push eax
push esi
call fcn.1e02889d
test eax, eax
jne 0x1e0290d8
mov dword [esi + 0x38], 3
test byte [edi + 0x440], 2
je 0x1e029040
cmp dword [esi + 0x24], 0
je 0x1e029040
mov dword [esi + 0x38], 4
lea ecx, [edi + 0x438]
mov eax, dword [ecx]
test al, 2
jne 0x1e028f57
mov eax, dword [esi + 0x40]
cmp eax, dword [edi + 0x448]
jae 0x1e028f5c
push esi
call fcn.1e0289cf
test eax, eax
je 0x1e028f5c
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
push 0
push edi
mov dword [esi + 0x38], 5
call fcn.1e028a71
test eax, eax
jne 0x1e028f86
cmp dword [ebp - 4], eax
je 0x1e028fb3
mov esi, dword [ebp + 8]
lea ecx, [edi + 0x438]
mov eax, dword [ecx]
test al, 2
je 0x1e028f68
and eax, 0xfffffffd
mov dword [ecx], eax
mov dword [esi + 0x38], 6
jmp case.default.0x1e028dd7
push esi
call fcn.1e028951
test eax, eax
je 0x1e028fc6
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
push 0
push edi
call fcn.1e028a71
test eax, eax
je 0x1e028fa9
mov ecx, dword [edi + 0x440]
test cl, 1
je case.default.0x1e028dd7
test cl, 0x10
je case.default.0x1e028dd7
and dword [eax + 0x3c], 0xfffffffe
mov dword [ebx], eax
jmp 0x1e0290d8
cmp dword [ebp - 4], 0
jne case.default.0x1e028dd7
mov dword [edi + 0x464], 2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
mov dword [esi + 0x38], 6
test byte [edi + 0x440], 2
jne 0x1e028fec
cmp dword [esi + 8], 0
je 0x1e028fec
mov eax, dword [edi + 0x43c]
test byte [eax + 0x20], 8
je 0x1e0290aa
mov dword [esi + 0x38], 7
mov eax, dword [edi + 0x440]
test al, 1
je 0x1e02900b
test al, 0x10
jne 0x1e02900b
test byte [esi + 0x3c], 1
jne 0x1e0290b3
push 0
push edi
call fcn.1e0287ab
jmp case.default.0x1e028dd7
mov edx, dword [edi + 0x440]
test dl, 1
je 0x1e02902f
test dl, 0x10
je 0x1e02902f
test byte [esi + 0x3c], 1
jne 0x1e0290d4
lea ecx, [edi + 0x438]
mov eax, dword [ecx]
test al, 1
je 0x1e029061
and eax, 0xfffffffe
mov dword [ecx], eax
mov dword [esi + 0x38], 7
push 0
push edi
call fcn.1e02875c
mov esi, eax
test esi, esi
mov dword [ebp + 8], esi
jne 0x1e028dc6
jmp 0x1e028fbd
and edx, 2
je 0x1e029078
cmp dword [esi + 8], 0
je 0x1e029078
mov eax, dword [edi + 0x43c]
test byte [eax + 0x20], 8
je 0x1e0290aa
cmp dword [esi + 0x24], 0
je 0x1e029095
mov eax, dword [edi + 0x43c]
movzx eax, byte [eax + 0x20]
and eax, 1
or eax, 2
shl eax, 1
mov dword [esi + 0x38], eax
jmp case.default.0x1e028dd7
test edx, edx
jne 0x1e029040
cmp dword [esi + 8], edx
je 0x1e029040
mov eax, dword [edi + 0x43c]
test byte [eax + 0x20], 8
jne 0x1e029040
mov dword [esi + 0x38], 1
jmp case.default.0x1e028dd7
and dword [esi + 0x3c], 0xfffffffe
mov eax, dword [esi + 0xc]
test eax, eax
je 0x1e0290d8
push eax
push dword [0x1e030d7c]
call fcn.1e01f7b4
and dword [esi + 0xc], 0
or dword [esi + 0x3c], 4
jmp 0x1e0290d8
and dword [esi + 0x3c], 0xfffffffe
xor eax, eax
inc eax
jmp 0x1e028fbf