Function at 0x30018cf9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2158
call fcn.3001fd80
mov eax, dword [0x30034b3c]
push ebx
push esi
push edi
push 0x3f
mov dword [ebp - 4], eax
pop ecx
push dword [ebp + 8]
xor ebx, ebx
xor eax, eax
mov word [ebp - 0x104], bx
lea edi, [ebp - 0x102]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0x1108], bx
mov ecx, 0x400
lea edi, [ebp - 0x1106]
push 0x300087c8
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x104]
push 0x80
push eax
mov dword [ebp - 0x2154], ebx
call fcn.3000def7
mov esi, eax
add esp, 0x10
cmp esi, ebx
jge 0x30018d7c
push esi
push 0x30001420
call fcn.30010597
push 0x300087b4
jmp 0x30018fdd
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 0xc]
call fcn.3001c28b
mov esi, eax
cmp esi, ebx
jge 0x30018da6
push esi
push 0x30001420
call fcn.30010597
push 0x30008798
jmp 0x30018fdd
lea eax, [ebp - 0x2154]
push eax
push 0x20019
push ebx
push 0x30008740
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jle 0x30018dd3
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
jl 0x30018ec8
mov word [ebp - 0x2150], bx
xor eax, eax
mov ecx, 0x411
lea edi, [ebp - 0x214e]
rep stosd dword es:[edi], eax
push 0x3000870c
mov dword [ebp - 0x2158], 1
stosw word es:[edi], ax
mov dword [ebp + 8], 0x1048
call fcn.300105be
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x2150]
push eax
lea eax, [ebp - 0x2158]
push eax
push ebx
push 0x30001ff4
push dword [ebp - 0x2154]
call esi
mov edi, eax
cmp edi, ebx
jle 0x30018e46
and edi, 0xffff
or edi, 0x80070000
cmp edi, ebx
jge 0x30018e8f
push 0x300086b0
call fcn.300105be
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x2150]
push eax
lea eax, [ebp - 0x2158]
push eax
push ebx
push 0x300086a0
push dword [ebp - 0x2154]
mov dword [ebp + 8], 0x1048
call esi
mov edi, eax
cmp edi, ebx
jle 0x30018e8d
and edi, 0xffff
or edi, 0x80070000
cmp edi, ebx
jl 0x30018ec8
cmp dword [ebp + 8], ebx
jbe 0x30018ec4
lea eax, [ebp - 0x2150]
push eax
push 0x30008680
call fcn.300106d0
pop ecx
pop ecx
lea eax, [ebp - 0x2150]
push eax
push 0x801
lea eax, [ebp - 0x1108]
push eax
call fcn.3000d4b9
mov dword [0x30076d5c], eax
cmp edi, ebx
jge 0x30018ee1
push 0x30007f50
mov esi, 0x801
push esi
lea eax, [ebp - 0x1108]
push eax
call fcn.3000d4b9
jmp 0x30018ee6
mov esi, 0x801
push esi
lea eax, [ebp - 0x1108]
push eax
call fcn.3000e2e1
push dword [0x3007bda0]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x30008678
lea eax, [ebp - 0x1108]
push eax
call edi
sub esi, eax
push esi
lea eax, [ebp - 0x1108]
push eax
call edi
lea eax, [ebp + eax*2 - 0x1108]
push eax
call fcn.3000def7
mov esi, eax
add esp, 0x10
cmp esi, ebx
jge 0x30018f44
push esi
push 0x30001420
call fcn.30010597
push 0x30008658
jmp 0x30018fdd
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0x1108]
push eax
mov eax, dword [ebp + 0xc]
push 0x3000863c
push dword [eax]
push edi
call fcn.3001c37b
mov esi, eax
cmp esi, ebx
jge 0x30018f76
push esi
push 0x30001420
call fcn.30010597
push 0x30008618
jmp 0x30018fdd
mov eax, dword [ebp + 0xc]
push ebx
push ebx
push dword [edi]
push ebx
push ebx
push 0x30008600
push dword [eax]
push dword [ebp + 0x14]
call fcn.3001c45c
mov esi, eax
cmp esi, ebx
jge 0x30018fa6
push esi
push 0x30001420
call fcn.30010597
push 0x300085d8
jmp 0x30018fdd
mov eax, dword [ebp + 0x14]
push ebx
push dword [eax]
mov eax, 0x300085c0
push dword [edi]
push eax
push 0x300021a4
push eax
mov eax, dword [ebp + 0xc]
push dword [eax]
push dword [ebp + 0x18]
call fcn.3001c45c
mov esi, eax
cmp esi, ebx
jge 0x30018fe5
push esi
push 0x30001420
call fcn.30010597
push 0x30008598
call fcn.30010597
add esp, 0xc
cmp dword [ebp - 0x2154], ebx
je 0x30018ff9
push dword [ebp - 0x2154]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
pop ebx
call fcn.3001fd67
leave
ret 0x14