Function at 0x30008175
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x35c
mov eax, dword [0x30020490]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x340], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [ebp - 0x350], eax
mov eax, dword [ebp + 0x14]
push edi
xor edi, edi
mov dword [ebp - 0x344], eax
mov eax, dword [ebp + 0x18]
mov esi, 0x21c
push esi
mov dword [ebp - 0x354], eax
mov dword [eax], edi
lea eax, [ebp - 0x320]
push edi
push eax
mov dword [ebp - 0x338], edi
mov dword [ebp - 0x324], edi
mov dword [ebp - 0x334], edi
mov dword [ebp - 0x33c], edi
mov dword [ebp - 0x34c], edi
mov dword [ebp - 0x348], edi
call fcn.30014b52
add esp, 0xc
push ebx
push 0x80
lea eax, [ebp - 0x318]
push eax
mov dword [ebp - 0x320], esi
mov dword [ebp - 0x31c], 0xf
call fcn.30005abb
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x32c]
push eax
lea eax, [ebp - 0x218]
push eax
push edi
push edi
push 0x300018d4
push dword [ebp - 0x340]
mov dword [ebp - 0x32c], 4
call ebx
mov esi, eax
cmp esi, edi
jle 0x30008253
and esi, 0xffff
or esi, 0x80070000
cmp esi, edi
jl 0x300087d7
lea eax, [ebp - 0x32c]
push eax
lea eax, [ebp - 0x214]
push eax
push edi
push edi
push 0x300018b8
push dword [ebp - 0x340]
mov dword [ebp - 0x32c], 4
call ebx
mov esi, eax
cmp esi, edi
jle 0x30008294
and esi, 0xffff
or esi, 0x80070000
cmp esi, edi
jl 0x300087d7
lea eax, [ebp - 0x32c]
push eax
lea eax, [ebp - 0x210]
push eax
push edi
push edi
push 0x300018a4
push dword [ebp - 0x340]
mov dword [ebp - 0x32c], 4
call ebx
mov esi, eax
cmp esi, edi
jle 0x300082d5
and esi, 0xffff
or esi, 0x80070000
cmp esi, edi
jl 0x300087d7
lea eax, [ebp - 0x338]
push eax
lea eax, [ebp - 0x320]
push eax
push dword [ebp - 0x344]
push dword [ebp - 0x350]
call fcn.300080fa
mov esi, eax
cmp esi, edi
jl 0x300087d7
lea eax, [ebp - 0x324]
push eax
push 0x20019
push edi
push 0x3000188c
push dword [ebp - 0x340]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jle 0x30008330
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, 0x80070002
jne 0x3000833d
xor esi, esi
inc esi
cmp esi, edi
jl 0x300087d7
jne 0x300084c7
mov eax, 0x100
push eax
mov dword [ebp - 0x344], eax
lea eax, [ebp - 0x33c]
push eax
call fcn.300111a2
mov esi, eax
cmp esi, edi
jl 0x300087d7
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
lea eax, [ebp - 0x32c]
push eax
push dword [ebp - 0x33c]
lea eax, [ebp - 0x328]
push edi
push edi
push eax
lea eax, [ebp - 0x104]
push eax
mov dword [ebp - 0x330], edi
mov dword [ebp - 0x32c], 0x200
push edi
jmp 0x30008498
cmp eax, 0xea
jne 0x30008426
mov eax, dword [ebp - 0x32c]
lea ecx, [eax + eax]
cmp dword [ebp - 0x344], ecx
jae 0x30008538
lea eax, [eax + eax + 0x32]
push eax
mov dword [ebp - 0x344], eax
lea eax, [ebp - 0x33c]
push eax
call fcn.300111a2
mov esi, eax
cmp esi, edi
jl 0x300087d7
mov eax, dword [ebp - 0x344]
add eax, eax
mov dword [ebp - 0x32c], eax
lea eax, [ebp - 0x32c]
push eax
push dword [ebp - 0x33c]
lea eax, [ebp - 0x328]
push edi
push edi
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x330]
mov dword [ebp - 0x328], 0x80
push dword [ebp - 0x324]
call ebx
cmp eax, edi
jle 0x30008434
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, edi
jl 0x300087d7
push dword [ebp - 0x33c]
mov eax, dword [ebp - 0x338]
mov ecx, dword [eax]
lea edx, [ebp - 0x104]
push edx
push eax
call dword [ecx + 0x1c]
mov esi, eax
cmp esi, edi
jl 0x300087d7
inc dword [ebp - 0x330]
mov eax, dword [ebp - 0x344]
add eax, eax
mov dword [ebp - 0x32c], eax
lea eax, [ebp - 0x32c]
push eax
push dword [ebp - 0x33c]
lea eax, [ebp - 0x328]
push edi
push edi
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x330]
push dword [ebp - 0x324]
mov dword [ebp - 0x328], 0x80
call ebx
cmp eax, 0x103
jne 0x300083a6
push dword [ebp - 0x324]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x324], edi
lea eax, [ebp - 0x324]
push eax
push 0x20019
push edi
push 0x300018f4
push dword [ebp - 0x340]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jle 0x300084f3
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, 0x80070002
jne 0x30008500
xor esi, esi
inc esi
cmp esi, edi
jl 0x300087d7
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jne 0x30008646
lea eax, [ebp - 0x35c]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x328]
push eax
lea eax, [ebp - 0x104]
push eax
mov dword [ebp - 0x330], edi
push edi
jmp 0x300085f8
mov esi, 0x8000ffff
jmp 0x300087d7
lea eax, [ebp - 0x334]
push eax
push 0x20019
push edi
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x324]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, edi
jle 0x30008576
and esi, 0xffff
or esi, 0x80070000
cmp esi, edi
jl 0x300087d7
mov eax, dword [ebp - 0x338]
mov ecx, dword [eax]
lea edx, [ebp - 0x34c]
push edx
push dword [ebp - 0x350]
lea edx, [ebp - 0x104]
push dword [ebp - 0x334]
push edx
push eax
call dword [ecx + 0x48]
mov eax, dword [ebp - 0x34c]
cmp eax, edi
je 0x300085c2
mov ecx, dword [eax + 4]
mov ecx, dword [ecx + 4]
lea eax, [ecx + eax + 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 0x34c], edi
push dword [ebp - 0x334]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x330]
lea eax, [ebp - 0x35c]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x328]
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x330]
mov dword [ebp - 0x334], edi
push dword [ebp - 0x324]
mov dword [ebp - 0x328], 0x80
call ebx
mov esi, eax
cmp esi, edi
je 0x30008542
jle 0x30008622
and esi, 0xffff
or esi, 0x80070000
cmp esi, 0x80070103
jne 0x3000862c
xor esi, esi
cmp esi, edi
jl 0x300087d7
push dword [ebp - 0x324]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x324], edi
lea eax, [ebp - 0x324]
push eax
push 0x20019
push edi
push 0x300018e0
push dword [ebp - 0x340]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jle 0x30008672
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, 0x80070002
jne 0x3000867f
xor esi, esi
inc esi
cmp esi, edi
jl 0x300087d7
jne 0x300087b5
lea eax, [ebp - 0x35c]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x328]
push eax
lea eax, [ebp - 0x104]
push eax
mov dword [ebp - 0x330], edi
push edi
jmp 0x3000876b
lea eax, [ebp - 0x334]
push eax
push 0x20019
push edi
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x324]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, edi
jle 0x300086e5
and esi, 0xffff
or esi, 0x80070000
cmp esi, edi
jl 0x300087d7
mov eax, dword [ebp - 0x338]
mov ecx, dword [eax]
lea edx, [ebp - 0x348]
push edx
push dword [ebp - 0x334]
lea edx, [ebp - 0x104]
push edx
push eax
call dword [ecx + 0x2c]
mov esi, eax
cmp esi, edi
jl 0x300087d7
mov eax, dword [ebp - 0x348]
cmp eax, edi
je 0x30008735
mov ecx, dword [eax + 4]
mov ecx, dword [ecx + 4]
lea eax, [ecx + eax + 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 0x348], edi
push dword [ebp - 0x334]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x330]
lea eax, [ebp - 0x35c]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x328]
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x330]
mov dword [ebp - 0x334], edi
push dword [ebp - 0x324]
mov dword [ebp - 0x328], 0x80
call ebx
mov esi, eax
cmp esi, edi
je 0x300086b1
jle 0x30008795
and esi, 0xffff
or esi, 0x80070000
cmp esi, 0x80070103
jne 0x3000879f
xor esi, esi
cmp esi, edi
jl 0x300087d7
push dword [ebp - 0x324]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x324], edi
mov eax, dword [ebp - 0x338]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x74]
mov eax, dword [ebp - 0x338]
mov ecx, dword [ebp - 0x354]
mov dword [ecx], eax
mov dword [ebp - 0x338], edi
xor esi, esi
mov eax, dword [ebp - 0x348]
cmp eax, edi
je 0x300087f1
mov ecx, dword [eax + 4]
mov ecx, dword [ecx + 4]
lea eax, [ecx + eax + 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x34c]
cmp eax, edi
je 0x3000880b
mov ecx, dword [eax + 4]
mov ecx, dword [ecx + 4]
lea eax, [ecx + eax + 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebp - 0x33c], edi
je 0x3000881e
push dword [ebp - 0x33c]
call fcn.300113ed
cmp dword [ebp - 0x334], edi
je 0x30008832
push dword [ebp - 0x334]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x324], edi
je 0x30008846
push dword [ebp - 0x324]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x338]
cmp eax, edi
je 0x30008870
mov ecx, dword [eax]
push eax
call dword [ecx + 0x7c]
mov eax, dword [ebp - 0x338]
cmp eax, edi
je 0x30008870
mov ecx, dword [eax + 4]
mov ecx, dword [ecx + 4]
lea eax, [ecx + eax + 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.30014af0
leave
ret 0x14