Function at 0x3001855b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2158
call fcn.3001f58a
mov eax, dword [0x30034be8]
push ebx
push esi
push edi
push 0x3f
mov dword [ebp - 4], eax
pop ecx
push dword [ebp + 8]
xor ebx, ebx
xor eax, eax
mov word [ebp - 0x104], bx
lea edi, [ebp - 0x102]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0x1108], bx
mov ecx, 0x400
lea edi, [ebp - 0x1106]
push 0x30008788
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x104]
push 0x80
push eax
mov dword [ebp - 0x2154], ebx
call fcn.3000d759
mov esi, eax
add esp, 0x10
cmp esi, ebx
jge 0x300185de
push esi
push 0x30001400
call fcn.3000fdf9
push 0x30008774
jmp 0x3001883f
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 0xc]
call fcn.3001baed
mov esi, eax
cmp esi, ebx
jge 0x30018608
push esi
push 0x30001400
call fcn.3000fdf9
push 0x30008758
jmp 0x3001883f
lea eax, [ebp - 0x2154]
push eax
push 0x20019
push ebx
push 0x30008700
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jle 0x30018635
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
jl 0x3001872a
mov word [ebp - 0x2150], bx
xor eax, eax
mov ecx, 0x411
lea edi, [ebp - 0x214e]
rep stosd dword es:[edi], eax
push 0x300086cc
mov dword [ebp - 0x2158], 1
stosw word es:[edi], ax
mov dword [ebp + 8], 0x1048
call fcn.3000fe20
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x2150]
push eax
lea eax, [ebp - 0x2158]
push eax
push ebx
push 0x30001fd4
push dword [ebp - 0x2154]
call esi
mov edi, eax
cmp edi, ebx
jle 0x300186a8
and edi, 0xffff
or edi, 0x80070000
cmp edi, ebx
jge 0x300186f1
push 0x30008670
call fcn.3000fe20
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x2150]
push eax
lea eax, [ebp - 0x2158]
push eax
push ebx
push 0x30008660
push dword [ebp - 0x2154]
mov dword [ebp + 8], 0x1048
call esi
mov edi, eax
cmp edi, ebx
jle 0x300186ef
and edi, 0xffff
or edi, 0x80070000
cmp edi, ebx
jl 0x3001872a
cmp dword [ebp + 8], ebx
jbe 0x30018726
lea eax, [ebp - 0x2150]
push eax
push 0x30008640
call fcn.3000ff32
pop ecx
pop ecx
lea eax, [ebp - 0x2150]
push eax
push 0x801
lea eax, [ebp - 0x1108]
push eax
call fcn.3000cd1d
mov dword [0x30076cfc], eax
cmp edi, ebx
jge 0x30018743
push 0x30007f10
mov esi, 0x801
push esi
lea eax, [ebp - 0x1108]
push eax
call fcn.3000cd1d
jmp 0x30018748
mov esi, 0x801
push esi
lea eax, [ebp - 0x1108]
push eax
call fcn.3000db43
push dword [0x3007bd20]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x30008638
lea eax, [ebp - 0x1108]
push eax
call edi
sub esi, eax
push esi
lea eax, [ebp - 0x1108]
push eax
call edi
lea eax, [ebp + eax*2 - 0x1108]
push eax
call fcn.3000d759
mov esi, eax
add esp, 0x10
cmp esi, ebx
jge 0x300187a6
push esi
push 0x30001400
call fcn.3000fdf9
push 0x30008618
jmp 0x3001883f
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0x1108]
push eax
mov eax, dword [ebp + 0xc]
push 0x300085fc
push dword [eax]
push edi
call fcn.3001bbdd
mov esi, eax
cmp esi, ebx
jge 0x300187d8
push esi
push 0x30001400
call fcn.3000fdf9
push 0x300085d8
jmp 0x3001883f
mov eax, dword [ebp + 0xc]
push ebx
push ebx
push dword [edi]
push ebx
push ebx
push 0x300085c0
push dword [eax]
push dword [ebp + 0x14]
call fcn.3001bcbe
mov esi, eax
cmp esi, ebx
jge 0x30018808
push esi
push 0x30001400
call fcn.3000fdf9
push 0x30008598
jmp 0x3001883f
mov eax, dword [ebp + 0x14]
push ebx
push dword [eax]
mov eax, 0x30008580
push dword [edi]
push eax
push 0x30002184
push eax
mov eax, dword [ebp + 0xc]
push dword [eax]
push dword [ebp + 0x18]
call fcn.3001bcbe
mov esi, eax
cmp esi, ebx
jge 0x30018847
push esi
push 0x30001400
call fcn.3000fdf9
push 0x30008558
call fcn.3000fdf9
add esp, 0xc
cmp dword [ebp - 0x2154], ebx
je 0x3001885b
push dword [ebp - 0x2154]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
pop ebx
call fcn.3001f57d
leave
ret 0x14