Function at 0x18027da0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x63c
mov eax, dword [0x1804e020]
xor eax, esp
mov dword [esp + 0x638], eax
push ebx
push esi
xor esi, esi
push edi
xor eax, eax
mov ecx, 0x15
jmp 0x18027dd0
cmp dword [eax*8 + 0x18050fc8], ecx
je 0x18027e86
inc eax
cmp eax, 0x1a
jl 0x18027dd0
mov dword [esp + 0x2c], esi
mov eax, dword [0x18052e64]
cmp eax, 0xffffffff
jne 0x18027ff4
push 0x104
lea ecx, [esp + 0x43c]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
push esi
push 0x100
lea edx, [esp + 0x244]
push edx
push esi
push esi
push esi
lea eax, [esp + 0x454]
push esi
push eax
call dword [sym.imp.MSVCR90.dll__wsplitpath_s]
mov ecx, dword [esp + 0x50]
push ecx
lea edx, [esp + 0x58]
push 0x104
push edx
call dword [sym.imp.MSVCR90.dll_wcscpy_s]
lea eax, [esp + 0x268]
push eax
lea ecx, [esp + 0x64]
push 0x104
push ecx
call dword [sym.imp.MSVCR90.dll_wcscat_s]
mov eax, dword [0x180538b4]
add esp, 0x3c
cmp eax, esi
jne 0x18027e71
call fcn.1800e370
mov eax, dword [0x180538b4]
cmp eax, esi
je 0x18027e96
push 0xc
call eax
add esp, 4
cmp eax, esi
je 0x18027e96
mov eax, 0x409
jmp 0x18027fef
mov eax, dword [eax*8 + 0x18050fcc]
mov dword [esp + 0x2c], eax
jmp 0x18027de7
mov eax, dword [0x18052e64]
cmp eax, 0xffffffff
jne 0x18027ff4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x10]
push eax
push 0x20019
push esi
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0x30]
push 0x80000001
mov dword [esp + 0x30], edx
mov dword [esp + 0x2c], esi
call ebx
lea edi, [esp + 0x18]
mov esi, eax
call fcn.18002330
test esi, esi
jne 0x18027f3b
lea eax, [esp + 0x28]
push eax
push 0x18052e64
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x2c]
push esi
mov dword [esp + 0x2c], edx
mov edx, dword [esp + 0x20]
push str.LCID
push edx
mov dword [esp + 0x40], 4
mov dword [esp + 0x30], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edi, [esp + 0x18]
mov esi, eax
call fcn.18002330
test esi, esi
jne 0x18027f26
cmp dword [esp + 0x14], 4
je 0x18027f30
mov dword [0x18052e64], 0xffffffff
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x18052e64]
cmp eax, 0xffffffff
jne 0x18027ff4
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0x10]
push edx
push 0x20019
push 0
push eax
lea ecx, [esp + 0x30]
push 0x80000001
mov dword [esp + 0x30], ecx
mov dword [esp + 0x2c], 0
call ebx
lea edi, [esp + 0x18]
mov esi, eax
call fcn.18002330
test esi, esi
jne 0x18027fdf
lea edx, [esp + 0x28]
push edx
push 0x18052e64
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x2c]
push esi
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x20]
push str.LCID
mov ebx, 4
push ecx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x30], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edi, [esp + 0x18]
mov esi, eax
call fcn.18002330
test esi, esi
jne 0x18027fca
cmp dword [esp + 0x14], ebx
je 0x18027fd4
mov dword [0x18052e64], 0xffffffff
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x18052e64]
cmp eax, 0xffffffff
jne 0x18027ff4
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [0x18052e64], eax
mov ecx, dword [esp + 0x644]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1802929c
mov esp, ebp
pop ebp
ret