Function at 0x2a40fdb1
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
xor eax, eax
mov word [ebp - 0x23c4], ax
jmp 0x2a41005b
xor eax, eax
mov word [ebp - 0x3364], ax
jmp 0x2a4100a9
mov dword [ebp - 0x3394], 1
jmp 0x2a410193
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x2a49601b
mov eax, dword fs:[0]
push eax
mov eax, 0x3394
call fcn.2a4095c0
mov eax, dword [0x2a4af584]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x337c]
push eax
xor ebx, ebx
push 9
push ebx
push 0x2a40ced0
mov dword [ebp - 0x3384], ecx
mov dword [ebp - 0x337c], ebx
mov dword [ebp - 0x3380], ebx
call fcn.2a410457
mov ecx, eax
call fcn.2a4103e3
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x2a433706
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x3388]
push eax
lea eax, [ebp - 0x74]
push eax
push ebx
push dword [ebp - 0x337c]
mov dword [ebp - 0x3388], 0x32
mov dword [ebp - 0x338c], ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x3398], eax
cmp eax, ebx
jne 0x2a40ff7f
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
inc dword [ebp - 0x338c]
lea eax, [ebp - 0x3370]
push eax
push 1
push ebx
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x337c]
mov dword [ebp - 0x3388], 0x32
mov dword [ebp - 0x3370], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x2a40ff50
lea ecx, [ebp - 0x3374]
mov dword [ebp - 0x3390], ebx
call fcn.2a40ab0f
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x3390]
push eax
mov eax, dword [ebp - 0x3384]
mov eax, dword [eax + 0x38]
push ecx
mov ecx, esp
mov dword [ebp - 0x33a0], esp
push eax
call fcn.2a40b54f
lea eax, [ebp - 0x339c]
push eax
call fcn.2a414583
push eax
lea ecx, [ebp - 0x3374]
mov byte [ebp - 4], 1
call fcn.2a40962b
lea ecx, [ebp - 0x339c]
mov byte [ebp - 4], bl
call fcn.2a40567c
lea eax, [ebp - 0x3378]
push eax
push 1
push ebx
push dword [ebp - 0x3374]
mov dword [ebp - 0x3378], ebx
push dword [ebp - 0x3370]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x2a40ff2d
cmp dword [ebp - 0x3390], 0xffffffff
jne 0x2a40feb5
cmp dword [ebp - 0x3378], ebx
jne 0x2a40ffbf
push dword [ebp - 0x3370]
call edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3374]
call fcn.2a40567c
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x3388]
push eax
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x338c]
push dword [ebp - 0x337c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0x3398], eax
cmp eax, ebx
je 0x2a40fe69
push dword [ebp - 0x337c]
call edi
cmp dword [ebp - 0x3380], ebx
jne 0x2a40ff9f
cmp dword [ebp - 0x3398], 0x103
jne 0x2a43372e
mov eax, dword [ebp - 0x3380]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.2a401bd9
leave
ret
lea eax, [ebp - 0x3368]
push eax
lea eax, [ebp - 0x484]
push eax
lea eax, [ebp - 0x336c]
push eax
push ebx
push 0x2a40cf34
push dword [ebp - 0x3370]
mov dword [ebp - 0x3368], 0x208
call esi
test eax, eax
jne 0x2a41025c
cmp dword [ebp - 0x3368], ebx
je 0x2a41025c
cmp dword [ebp - 0x336c], 1
jne 0x2a41025c
lea eax, [ebp - 0x3368]
push eax
lea eax, [ebp - 0x23c4]
push eax
lea eax, [ebp - 0x336c]
push eax
push ebx
push 0x2a408958
push dword [ebp - 0x3370]
mov dword [ebp - 0x3368], 0xfa0
call esi
test eax, eax
jne 0x2a40ec25
cmp dword [ebp - 0x3368], ebx
je 0x2a40ec25
cmp dword [ebp - 0x336c], 1
jne 0x2a40ec25
lea eax, [ebp - 0x3368]
push eax
lea eax, [ebp - 0x3364]
push eax
lea eax, [ebp - 0x336c]
push eax
push ebx
push 0x2a40893c
push dword [ebp - 0x3370]
mov dword [ebp - 0x3368], 0xfa0
call esi
test eax, eax
jne 0x2a40ec33
cmp dword [ebp - 0x3368], ebx
je 0x2a40ec33
cmp dword [ebp - 0x336c], 1
jne 0x2a40ec33
lea eax, [ebp - 0x3368]
push eax
lea eax, [ebp - 0x1424]
push eax
lea eax, [ebp - 0x336c]
push eax
push ebx
push 0x2a410224
push dword [ebp - 0x3370]
mov dword [ebp - 0x3368], 0xfa0
call esi
test eax, eax
jne 0x2a410240
cmp dword [ebp - 0x3368], ebx
je 0x2a410240
cmp dword [ebp - 0x336c], 1
jne 0x2a410240
lea eax, [ebp - 0x3368]
push eax
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x336c]
push eax
push ebx
push 0x2a41020c
push dword [ebp - 0x3378]
mov dword [ebp - 0x3368], 0x208
call esi
test eax, eax
jne 0x2a41024e
cmp dword [ebp - 0x3368], ebx
je 0x2a41024e
cmp dword [ebp - 0x336c], 1
jne 0x2a41024e
lea eax, [ebp - 0x3368]
push eax
lea eax, [ebp - 0x3394]
push eax
lea eax, [ebp - 0x336c]
push eax
push ebx
push 0x2a4101fc
push dword [ebp - 0x3378]
mov dword [ebp - 0x3368], 4
call esi
test eax, eax
jne 0x2a40ec41
cmp dword [ebp - 0x3368], ebx
je 0x2a40ec41
cmp dword [ebp - 0x336c], 4
jne 0x2a40ec41
mov ecx, dword [ebp - 0x3384]
lea eax, [ebp - 0x3374]
push eax
push dword [ebp - 0x3394]
lea eax, [ebp - 0x1424]
push eax
lea eax, [ebp - 0x3364]
push eax
lea eax, [ebp - 0x23c4]
push eax
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x484]
push eax
lea eax, [ebp - 0x74]
push eax
call fcn.2a414600
push dword [ebp - 0x3370]
mov dword [ebp - 0x3380], eax
cmp eax, ebx
jne 0x2a433710
mov eax, dword [ebp - 0x3384]
inc dword [eax + 0x2c]
call edi
push dword [ebp - 0x3378]
jmp 0x2a40ff3f
xor eax, eax
mov word [ebp - 0x1424], ax
jmp 0x2a4100f7
xor eax, eax
mov word [ebp - 0x27c], ax
jmp 0x2a410145
push dword [ebp - 0x3370]
jmp 0x2a4101ef
mov eax, 0x80004005
jmp 0x2a40ffa5
call edi
push dword [ebp - 0x3378]
call edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3374]
call fcn.2a40567c
jmp 0x2a40ff7f
mov dword [ebp - 0x3380], 0x80004005
jmp 0x2a40ff9f