Function at 0x2a3c4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0xc], edx
mov ebx, eax
lea esi, [ebp - 0x14]
lea edi, [ebp - 8]
xor eax, eax
push ebp
push 0x2a733
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0002997c
lea eax, [ebp - 0xc]
call fcn.00025330
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x2a70e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
mov eax, dword [0x1b3998]
add eax, 0x20019
push eax
push 0
lea eax, [ebp - 0x1c]
call fcn.00025330
mov eax, dword [ebp - 0x1c]
call fcn.00014090
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x2a6ec
mov dword [ebp - 0x18], 4
xor eax, eax
mov dword [esi], eax
xor eax, eax
mov dword [edi], eax
lea eax, [ebp - 0x18]
push eax
push edi
push esi
push 0
push 0x2a744
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x2a482
cmp dword [esi], 4
jne 0x2a482
cmp dword [edi], 1
sete al
mov byte [ebx + 7], al
mov dword [ebp - 0x18], 4
xor eax, eax
mov dword [esi], eax
xor eax, eax
mov dword [edi], eax
lea eax, [ebp - 0x18]
push eax
push edi
push esi
push 0
push 0x2a768
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x2a4c4
cmp dword [esi], 4
jne 0x2a4c4
cmp dword [edi], 0
jb 0x2a4c4
cmp dword [edi], 0x17
ja 0x2a4c4
mov al, byte [edi]
mov byte [ebx + 1], al
mov dword [ebp - 0x18], 4
xor eax, eax
mov dword [esi], eax
xor eax, eax
mov dword [edi], eax
lea eax, [ebp - 0x18]
push eax
push edi
push esi
push 0
push 0x2a788
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x2a500
cmp dword [esi], 4
jne 0x2a500
cmp dword [edi], 1
sete al
mov byte [ebx + 5], al
mov dword [ebp - 0x18], 4
xor eax, eax
mov dword [esi], eax
xor eax, eax
mov dword [edi], eax
lea eax, [ebp - 0x18]
push eax
push edi
push esi
push 0
push 0x2a7ac
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x2a53b
cmp dword [esi], 4
jne 0x2a53b
cmp dword [edi], 1
sete al
mov byte [ebx], al
mov dword [ebp - 0x18], 4
xor eax, eax
mov dword [esi], eax
xor eax, eax
mov dword [edi], eax
lea eax, [ebp - 0x18]
push eax
push edi
push esi
push 0
push 0x2a7c4
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x2a577
cmp dword [esi], 4
jne 0x2a577
cmp dword [edi], 1
sete al
mov byte [ebx + 3], al
mov dword [ebp - 0x18], 4
xor eax, eax
mov dword [esi], eax
xor eax, eax
mov dword [edi], eax
lea eax, [ebp - 0x18]
push eax
push edi
push esi
push 0
push 0x2a7e8
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x2a5c3
cmp dword [esi], 4
jne 0x2a5c3
cmp dword [edi], 0
je 0x2a5be
cmp dword [edi], 0xf
je 0x2a5be
cmp dword [edi], 0x1e
je 0x2a5be
cmp dword [edi], 0x2d
jne 0x2a5c3
mov al, byte [edi]
mov byte [ebx + 2], al
mov dword [ebp - 0x18], 4
xor eax, eax
mov dword [esi], eax
xor eax, eax
mov dword [edi], eax
lea eax, [ebp - 0x18]
push eax
push edi
push esi
push 0
push 0x2a804
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x2a5ff
cmp dword [esi], 4
jne 0x2a5ff
cmp dword [edi], 1
sete al
mov byte [ebx + 6], al
mov dword [ebp - 0x18], 4
xor eax, eax
mov dword [esi], eax
xor eax, eax
mov dword [edi], eax
lea eax, [ebp - 0x18]
push eax
push edi
push esi
push 0
push 0x2a828
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x2a63b
cmp dword [esi], 4
jne 0x2a63b
cmp dword [edi], 1
sete al
mov byte [ebx + 9], al
mov dword [ebp - 0x18], 4
xor eax, eax
mov dword [esi], eax
xor eax, eax
mov dword [edi], eax
lea eax, [ebp - 0x18]
push eax
push edi
push esi
push 0
push 0x2a84c
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x2a677
cmp dword [esi], 4
jne 0x2a677
cmp dword [edi], 1
sete al
mov byte [ebx + 4], al
mov dword [ebp - 0x18], 4
xor eax, eax
mov dword [esi], eax
xor eax, eax
mov dword [edi], eax
lea eax, [ebp - 0x18]
push eax
push edi
push esi
push 0
push 0x2a870
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x2a6b3
cmp dword [esi], 4
jne 0x2a6b3
cmp dword [edi], 1
sete al
mov byte [ebx + 8], al
cmp byte [ebx + 3], 0
jne 0x2a6ec
cmp byte [ebx + 4], 0
jne 0x2a6ec
cmp byte [ebx + 5], 0
jne 0x2a6ec
cmp byte [ebx + 6], 0
jne 0x2a6ec
cmp byte [ebx + 7], 0
jne 0x2a6ec
cmp byte [ebx + 8], 0
jne 0x2a6ec
cmp byte [ebx + 9], 0
jne 0x2a6ec
cmp byte [ebx], 0
je 0x2a6ec
mov byte [ebx], 0
mov dword [ebp - 4], 0xd
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x2a715
cmp dword [ebp - 0x10], 0
je 0x2a708
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x10], eax
ret