Function at 0x2e007d16
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
and dword [ebp - 0xc], 0
push edi
push 4
pop ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x2e0019b8
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
test eax, eax
jne 0x2e007dc7
mov ecx, dword [ebp - 0x10]
lea edx, [ecx - 3]
cmp edx, 0x39
ja 0x2e007dd0
mov dword [0x2e022ee8], ecx
mov edi, 0x80070000
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x2e0019a4
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
cmp eax, 2
je 0x2e007d96
test eax, eax
je 0x2e007d96
jle 0x2e007d8e
and eax, 0xffff
or eax, edi
test eax, eax
jl 0x2e007ff3
push 3
pop eax
cmp dword [ebp - 0xc], eax
jbe 0x2e007da1
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0xc]
xor eax, eax
cmp dword [ecx], eax
je 0x2e007dfc
cmp dword [ebp - 0xc], eax
jne 0x2e007df0
xor edi, edi
inc edi
push edi
call fcn.2e0136aa
push edi
push edi
call fcn.2e0136f1
mov eax, dword [ebp + 0xc]
and dword [eax], 0
jmp 0x2e007e2e
cmp eax, 2
je 0x2e007d5c
test eax, eax
jg 0x2e007dd7
mov edi, 0x80070000
jmp 0x2e007de3
and eax, 0xffff
mov edi, 0x80070000
or eax, edi
test eax, eax
jl 0x2e007ff3
jmp 0x2e007d61
push 1
push dword [ebp - 0xc]
call fcn.2e0136f1
jmp 0x2e007e33
cmp dword [ebp - 0xc], eax
jbe 0x2e007e33
xor edi, edi
inc edi
push edi
push dword [ebp - 0xc]
call fcn.2e0136f1
push edi
push 0
push 0x2e00199c
push 0x2e001994
push 0
call fcn.2e0135c5
test eax, eax
jl 0x2e007ff3
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
mov edi, 0x80070000
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x2e001978
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
test eax, eax
jne 0x2e007e5f
cmp dword [ebp - 0x14], eax
setne al
mov dword [0x2e022eec], eax
jmp 0x2e007e77
cmp eax, 2
je 0x2e007e77
test eax, eax
jle 0x2e007e71
and eax, 0xffff
or eax, edi
test eax, eax
jl 0x2e007ff3
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x2e00195c
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
test eax, eax
jne 0x2e007ea5
mov ecx, dword [ebp - 0x10]
test ecx, ecx
jbe 0x2e007eb5
mov dword [0x2e022ef0], ecx
jmp 0x2e007ebd
cmp eax, 2
je 0x2e007ebd
test eax, eax
jle 0x2e007eb7
and eax, 0xffff
or eax, edi
test eax, eax
jl 0x2e007ff3
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x2e001938
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
test eax, eax
jne 0x2e007ee9
cmp dword [ebp - 0x14], eax
setne al
mov dword [0x2e022ef4], eax
jmp 0x2e007f01
cmp eax, 2
je 0x2e007f01
test eax, eax
jle 0x2e007efb
and eax, 0xffff
or eax, edi
test eax, eax
jl 0x2e007ff3
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x2e001914
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
test eax, eax
jne 0x2e007f2f
mov ecx, dword [ebp - 0x10]
test ecx, ecx
jbe 0x2e007f3f
mov dword [0x2e022ef8], ecx
jmp 0x2e007f47
cmp eax, 2
je 0x2e007f47
test eax, eax
jle 0x2e007f41
and eax, 0xffff
or eax, edi
test eax, eax
jl 0x2e007ff3
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x2e0018ec
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
test eax, eax
jne 0x2e007f73
cmp dword [ebp - 0x14], eax
setne al
mov dword [0x2e022efc], eax
jmp 0x2e007f87
cmp eax, 2
je 0x2e007f87
test eax, eax
jle 0x2e007f85
and eax, 0xffff
or eax, edi
test eax, eax
jl 0x2e007ff3
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x2e0018c4
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
test eax, eax
jne 0x2e007fb5
mov ecx, dword [ebp - 0x10]
test ecx, ecx
jbe 0x2e007fc5
mov dword [0x2e022f00], ecx
jmp 0x2e007fc9
cmp eax, 2
je 0x2e007fc9
test eax, eax
jle 0x2e007fc7
and eax, 0xffff
or eax, edi
test eax, eax
jl 0x2e007ff3
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x2e0018ac
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
test eax, eax
jne 0x2e007ff3
cmp dword [ebp - 0x14], eax
setne al
mov dword [0x2e022f04], eax
pop edi
pop esi
pop ebx
leave
ret 8