Function at 0x71a2852c
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x71a3405c]
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push edi
mov esi, ecx
mov dword [ebp - 0x10c], eax
mov edi, 0x104
je 0x71a2aa75
push 1
push edi
lea ecx, [ebp - 0x108]
push ecx
push 0x71a28198
push eax
call fcn.71a27406
cmp eax, ebx
je 0x71a2876a
push edi
lea eax, [esi + 0x34]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x108]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor ecx, ecx
test eax, eax
setg cl
mov eax, ecx
cmp eax, ebx
je 0x71a2876a
cmp dword [ebp + 0xc], ebx
je 0x71a2aab3
lea eax, [ebp - 0x110]
push eax
push ebx
push ebx
push ebx
push 0x71a28774
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x71a2876a
cmp dword [esi + 0x20], ebx
jne 0x71a2876a
mov eax, dword [ebp - 0x110]
cmp eax, edi
jae 0x71a2876a
add eax, eax
push eax
call fcn.71a225f6
cmp eax, ebx
pop ecx
mov dword [esi + 0x20], eax
je 0x71a2876a
push 1
push edi
lea eax, [ebp - 0x108]
push eax
push 0x71a28774
push dword [ebp - 0x10c]
call fcn.71a27406
cmp eax, ebx
je 0x71a2876a
push dword [ebp - 0x110]
lea eax, [ebp - 0x108]
push dword [esi + 0x20]
push 0xffffffffffffffff
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor ecx, ecx
test eax, eax
setg cl
mov eax, ecx
cmp eax, ebx
je 0x71a2876a
cmp dword [ebp + 0xc], ebx
je 0x71a2aaf0
push 0x10
pop eax
push 3
push eax
mov dword [ebp - 0x118], eax
lea eax, [ebp - 0x118]
push eax
push 0x71a2818c
push dword [ebp - 0x10c]
lea ecx, [esi + 0x24]
mov dword [ebp - 0x114], ecx
call fcn.71a27406
cmp eax, ebx
je 0x71a2876a
cmp dword [ebp + 0xc], ebx
push 4
lea eax, [esi + 0x14]
pop edi
je 0x71a2ab21
push edi
push edi
push eax
push 0x71a2817c
push dword [ebp - 0x10c]
call fcn.71a27406
cmp eax, ebx
jne 0x71a286ac
or dword [esi + 0x14], 0xffffffff
push edi
push edi
lea eax, [esi + 0x10]
push eax
push 0x71a28168
push dword [ebp - 0x10c]
call fcn.71a27406
cmp eax, ebx
je 0x71a2876a
cmp dword [ebp + 0xc], ebx
push edi
je 0x71a2ab5f
push edi
lea eax, [ebp - 0x110]
push eax
push 0x71a28160
push dword [ebp - 0x10c]
call fcn.71a27406
cmp eax, ebx
je 0x71a2876a
cmp dword [ebp - 0x110], ebx
setne cl
mov byte [esi + 0x1c], cl
cmp eax, ebx
je 0x71a2876a
cmp dword [ebp + 0xc], ebx
lea eax, [esi + 0x18]
push edi
je 0x71a2ab89
push edi
push eax
push 0x71a28158
push dword [ebp - 0x10c]
call fcn.71a27406
cmp eax, ebx
je 0x71a2876a
cmp dword [ebp + 0xc], ebx
push edi
je 0x71a2ab9f
push edi
lea eax, [ebp - 0x110]
push eax
push 0x71a28140
push dword [ebp - 0x10c]
call fcn.71a27406
cmp eax, ebx
je 0x71a2876a
cmp dword [ebp - 0x110], ebx
setne cl
mov byte [esi + 0x1d], cl
cmp eax, ebx
je 0x71a2876a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.71a2269d
leave
ret 8
mov eax, 0x2afb
jmp 0x71a2875b
push ebx
push ebx
push edi
lea eax, [ebp - 0x108]
push eax
push 0xffffffffffffffff
lea eax, [esi + 0x34]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x71a2876a
push 1
lea eax, [ebp - 0x108]
push eax
push 0x71a28198
push dword [ebp - 0x10c]
call fcn.71a31f1b
jmp 0x71a28599
push ebx
push ebx
push edi
lea eax, [ebp - 0x108]
push eax
push 0xffffffffffffffff
push dword [esi + 0x20]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x71a2876a
push 1
lea eax, [ebp - 0x108]
push eax
push 0x71a28774
push dword [ebp - 0x10c]
call fcn.71a31f1b
jmp 0x71a2863d
lea eax, [esi + 0x24]
push 3
mov dword [ebp - 0x114], eax
lea eax, [ebp - 0x118]
push eax
push 0x71a2818c
push dword [ebp - 0x10c]
mov dword [ebp - 0x118], 0x10
call fcn.71a31f1b
jmp 0x71a2867a
cmp dword [eax], 0xffffffff
je 0x71a2ab3a
push edi
push eax
push 0x71a2817c
push dword [ebp - 0x10c]
call fcn.71a31f1b
jmp 0x71a2ab3d
xor eax, eax
inc eax
cmp eax, ebx
je 0x71a2876a
push edi
lea eax, [esi + 0x10]
push eax
push 0x71a28168
push dword [ebp - 0x10c]
call fcn.71a31f1b
jmp 0x71a286c2
xor eax, eax
cmp byte [esi + 0x1c], bl
setne al
mov dword [ebp - 0x110], eax
lea eax, [ebp - 0x110]
push eax
push 0x71a28160
push dword [ebp - 0x10c]
call fcn.71a31f1b
jmp 0x71a286fc
push eax
push 0x71a28158
push dword [ebp - 0x10c]
call fcn.71a31f1b
jmp 0x71a2871f
xor eax, eax
cmp byte [esi + 0x1d], bl
setne al
mov dword [ebp - 0x110], eax
lea eax, [ebp - 0x110]
push eax
push 0x71a28140
push dword [ebp - 0x10c]
call fcn.71a31f1b
jmp 0x71a28755