Function at 0x1e0267dd
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
jmp case.default.0x1e0267fe
mov ebx, dword [ebp + 0xc]
mov dword [ebx], esi
mov eax, dword [esi + 0x38]
cmp eax, 7
ja case.default.0x1e0267fe
jmp dword [eax*4 + 0x1e026b09]
lea ecx, [edi + 0x438]
mov eax, dword [ecx]
test al, 4
jne 0x1e0268e2
mov eax, dword [edi + 0x43c]
test byte [eax + 0x20], 0x10
je 0x1e0268b6
mov ebx, dword [edi + 0x440]
and ebx, 0x20
mov eax, dword [eax + 0x10]
mov dword [esi + 0x38], 3
mov ecx, dword [esi + 0x20]
mov dword [ebp - 8], eax
mov dword [esi + 0x1c], ecx
je 0x1e02684b
mov ecx, dword [esi + 0x18]
mov dword [ebp + 8], ecx
jmp 0x1e02684f
and dword [ebp + 8], 0
mov ecx, ebx
neg ecx
sbb ecx, ecx
lea edx, [esi + 0x1c]
and ecx, edx
push ecx
push dword [ebp + 8]
lea ecx, [esi + 0x14]
push ecx
push 0
push eax
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne case.default.0x1e0267fe
push dword [ebp - 8]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
mov ecx, dword [esi + 0x10]
lea eax, [eax + eax + 2]
shl ecx, 1
cmp eax, ecx
ja case.default.0x1e0267fe
push dword [ebp - 8]
push dword [esi + 0xc]
call fcn.1e017cc5
and dword [esi + 0x3c], 0xfffffffb
test ebx, ebx
mov eax, dword [esi + 0x3c]
je 0x1e026b01
and eax, 0xfffffff7
mov dword [esi + 0x3c], eax
jmp 0x1e026b01
mov eax, dword [edi + 0x440]
and eax, 0x20
push eax
push esi
call fcn.1e0263b0
test eax, eax
je 0x1e0268e7
mov dword [esi + 0x38], 2
jmp 0x1e026b01
lea ecx, [edi + 0x438]
mov eax, dword [ecx]
test al, 4
je 0x1e0268f3
and eax, 0xfffffffb
mov dword [ecx], eax
mov dword [esi + 0x38], 3
jmp case.default.0x1e0267fe
mov eax, dword [edi + 0x440]
and eax, 0x20
push eax
push esi
call fcn.1e026323
test eax, eax
jne 0x1e026b01
mov dword [esi + 0x38], 3
test byte [edi + 0x440], 2
je 0x1e026a69
cmp dword [esi + 0x24], 0
je 0x1e026a69
mov dword [esi + 0x38], 4
lea ecx, [edi + 0x438]
mov eax, dword [ecx]
test al, 2
jne 0x1e026980
mov eax, dword [esi + 0x40]
cmp eax, dword [edi + 0x448]
jae 0x1e026985
push esi
call fcn.1e02643a
test eax, eax
je 0x1e026985
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
push 0
push edi
mov dword [esi + 0x38], 5
call fcn.1e0264be
test eax, eax
jne 0x1e0269af
cmp dword [ebp - 4], eax
je 0x1e0269dc
mov esi, dword [ebp + 8]
lea ecx, [edi + 0x438]
mov eax, dword [ecx]
test al, 2
je 0x1e026991
and eax, 0xfffffffd
mov dword [ecx], eax
mov dword [esi + 0x38], 6
jmp case.default.0x1e0267fe
push esi
call fcn.1e0263c7
test eax, eax
je 0x1e0269ef
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
push 0
push edi
call fcn.1e0264be
test eax, eax
je 0x1e0269d2
mov ecx, dword [edi + 0x440]
test cl, 1
je case.default.0x1e0267fe
test cl, 0x10
je case.default.0x1e0267fe
and dword [eax + 0x3c], 0xfffffffe
mov dword [ebx], eax
jmp 0x1e026b01
cmp dword [ebp - 4], 0
jne case.default.0x1e0267fe
mov dword [edi + 0x464], 2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
mov dword [esi + 0x38], 6
test byte [edi + 0x440], 2
jne 0x1e026a15
cmp dword [esi + 8], 0
je 0x1e026a15
mov eax, dword [edi + 0x43c]
test byte [eax + 0x20], 8
je 0x1e026ad3
mov dword [esi + 0x38], 7
mov eax, dword [edi + 0x440]
test al, 1
je 0x1e026a34
test al, 0x10
jne 0x1e026a34
test byte [esi + 0x3c], 1
jne 0x1e026adc
push 0
push edi
call fcn.1e026239
jmp case.default.0x1e0267fe
mov edx, dword [edi + 0x440]
test dl, 1
je 0x1e026a58
test dl, 0x10
je 0x1e026a58
test byte [esi + 0x3c], 1
jne 0x1e026afd
lea ecx, [edi + 0x438]
mov eax, dword [ecx]
test al, 1
je 0x1e026a8a
and eax, 0xfffffffe
mov dword [ecx], eax
mov dword [esi + 0x38], 7
push 0
push edi
call fcn.1e0261f3
mov esi, eax
test esi, esi
mov dword [ebp + 8], esi
jne 0x1e0267ed
jmp 0x1e0269e6
and edx, 2
je 0x1e026aa1
cmp dword [esi + 8], 0
je 0x1e026aa1
mov eax, dword [edi + 0x43c]
test byte [eax + 0x20], 8
je 0x1e026ad3
cmp dword [esi + 0x24], 0
je 0x1e026abe
mov eax, dword [edi + 0x43c]
movzx eax, byte [eax + 0x20]
and eax, 1
or eax, 2
shl eax, 1
mov dword [esi + 0x38], eax
jmp case.default.0x1e0267fe
test edx, edx
jne 0x1e026a69
cmp dword [esi + 8], edx
je 0x1e026a69
mov eax, dword [edi + 0x43c]
test byte [eax + 0x20], 8
jne 0x1e026a69
mov dword [esi + 0x38], 1
jmp case.default.0x1e0267fe
and dword [esi + 0x3c], 0xfffffffe
mov eax, dword [esi + 0xc]
test eax, eax
je 0x1e026b01
push eax
push dword [0x1e02f464]
call fcn.1e01b736
and dword [esi + 0xc], 0
or dword [esi + 0x3c], 4
jmp 0x1e026b01
and dword [esi + 0x3c], 0xfffffffe
xor eax, eax
inc eax
jmp 0x1e0269e8