Function at 0x2e007520
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x35c
mov eax, dword [0x2e022064]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x340], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [ebp - 0x350], eax
mov eax, dword [ebp + 0x14]
push edi
xor edi, edi
mov dword [ebp - 0x344], eax
mov eax, dword [ebp + 0x18]
mov esi, 0x21c
push esi
mov dword [ebp - 0x354], eax
mov dword [eax], edi
lea eax, [ebp - 0x320]
push edi
push eax
mov dword [ebp - 0x338], edi
mov dword [ebp - 0x324], edi
mov dword [ebp - 0x334], edi
mov dword [ebp - 0x33c], edi
mov dword [ebp - 0x34c], edi
mov dword [ebp - 0x348], edi
call fcn.2e01440c
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x318]
push 0x80
push eax
mov dword [ebp - 0x320], esi
mov dword [ebp - 0x31c], 0xf
call fcn.2e014486
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add esp, 0x1c
lea eax, [ebp - 0x32c]
push eax
lea eax, [ebp - 0x218]
push eax
push edi
push edi
push 0x2e0017fc
push dword [ebp - 0x340]
mov dword [ebp - 0x32c], 4
call ebx
mov esi, eax
cmp esi, edi
jle 0x2e007600
and esi, 0xffff
or esi, 0x80070000
cmp esi, edi
jl 0x2e007b84
lea eax, [ebp - 0x32c]
push eax
lea eax, [ebp - 0x214]
push eax
push edi
push edi
push 0x2e0017e0
push dword [ebp - 0x340]
mov dword [ebp - 0x32c], 4
call ebx
mov esi, eax
cmp esi, edi
jle 0x2e007641
and esi, 0xffff
or esi, 0x80070000
cmp esi, edi
jl 0x2e007b84
lea eax, [ebp - 0x32c]
push eax
lea eax, [ebp - 0x210]
push eax
push edi
push edi
push 0x2e0017cc
push dword [ebp - 0x340]
mov dword [ebp - 0x32c], 4
call ebx
mov esi, eax
cmp esi, edi
jle 0x2e007682
and esi, 0xffff
or esi, 0x80070000
cmp esi, edi
jl 0x2e007b84
lea eax, [ebp - 0x338]
push eax
lea eax, [ebp - 0x320]
push eax
push dword [ebp - 0x344]
push dword [ebp - 0x350]
call fcn.2e0074a5
mov esi, eax
cmp esi, edi
jl 0x2e007b84
lea eax, [ebp - 0x324]
push eax
push 0x20019
push edi
push 0x2e0017b4
push dword [ebp - 0x340]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jle 0x2e0076dd
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, 0x80070002
jne 0x2e0076ea
xor esi, esi
inc esi
cmp esi, edi
jl 0x2e007b84
jne 0x2e007874
mov eax, 0x100
push eax
mov dword [ebp - 0x344], eax
lea eax, [ebp - 0x33c]
push eax
call fcn.2e010bf3
mov esi, eax
cmp esi, edi
jl 0x2e007b84
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
lea eax, [ebp - 0x32c]
push eax
push dword [ebp - 0x33c]
lea eax, [ebp - 0x328]
push edi
push edi
push eax
lea eax, [ebp - 0x104]
push eax
mov dword [ebp - 0x330], edi
mov dword [ebp - 0x32c], 0x200
push edi
jmp 0x2e007845
cmp eax, 0xea
jne 0x2e0077d3
mov eax, dword [ebp - 0x32c]
lea ecx, [eax + eax]
cmp dword [ebp - 0x344], ecx
jae 0x2e0078e5
lea eax, [eax + eax + 0x32]
push eax
mov dword [ebp - 0x344], eax
lea eax, [ebp - 0x33c]
push eax
call fcn.2e010bf3
mov esi, eax
cmp esi, edi
jl 0x2e007b84
mov eax, dword [ebp - 0x344]
add eax, eax
mov dword [ebp - 0x32c], eax
lea eax, [ebp - 0x32c]
push eax
push dword [ebp - 0x33c]
lea eax, [ebp - 0x328]
push edi
push edi
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x330]
mov dword [ebp - 0x328], 0x80
push dword [ebp - 0x324]
call ebx
cmp eax, edi
jle 0x2e0077e1
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, edi
jl 0x2e007b84
push dword [ebp - 0x33c]
mov eax, dword [ebp - 0x338]
mov ecx, dword [eax]
lea edx, [ebp - 0x104]
push edx
push eax
call dword [ecx + 0x1c]
mov esi, eax
cmp esi, edi
jl 0x2e007b84
inc dword [ebp - 0x330]
mov eax, dword [ebp - 0x344]
add eax, eax
mov dword [ebp - 0x32c], eax
lea eax, [ebp - 0x32c]
push eax
push dword [ebp - 0x33c]
lea eax, [ebp - 0x328]
push edi
push edi
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x330]
push dword [ebp - 0x324]
mov dword [ebp - 0x328], 0x80
call ebx
cmp eax, 0x103
jne 0x2e007753
push dword [ebp - 0x324]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x324], edi
lea eax, [ebp - 0x324]
push eax
push 0x20019
push edi
push 0x2e00171c
push dword [ebp - 0x340]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jle 0x2e0078a0
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, 0x80070002
jne 0x2e0078ad
xor esi, esi
inc esi
cmp esi, edi
jl 0x2e007b84
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jne 0x2e0079f3
lea eax, [ebp - 0x35c]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x328]
push eax
lea eax, [ebp - 0x104]
push eax
mov dword [ebp - 0x330], edi
push edi
jmp 0x2e0079a5
mov esi, 0x8000ffff
jmp 0x2e007b84
lea eax, [ebp - 0x334]
push eax
push 0x20019
push edi
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x324]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, edi
jle 0x2e007923
and esi, 0xffff
or esi, 0x80070000
cmp esi, edi
jl 0x2e007b84
mov eax, dword [ebp - 0x338]
mov ecx, dword [eax]
lea edx, [ebp - 0x34c]
push edx
push dword [ebp - 0x350]
lea edx, [ebp - 0x104]
push dword [ebp - 0x334]
push edx
push eax
call dword [ecx + 0x48]
mov eax, dword [ebp - 0x34c]
cmp eax, edi
je 0x2e00796f
mov ecx, dword [eax + 4]
mov ecx, dword [ecx + 4]
lea eax, [ecx + eax + 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 0x34c], edi
push dword [ebp - 0x334]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x330]
lea eax, [ebp - 0x35c]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x328]
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x330]
mov dword [ebp - 0x334], edi
push dword [ebp - 0x324]
mov dword [ebp - 0x328], 0x80
call ebx
mov esi, eax
cmp esi, edi
je 0x2e0078ef
jle 0x2e0079cf
and esi, 0xffff
or esi, 0x80070000
cmp esi, 0x80070103
jne 0x2e0079d9
xor esi, esi
cmp esi, edi
jl 0x2e007b84
push dword [ebp - 0x324]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x324], edi
lea eax, [ebp - 0x324]
push eax
push 0x20019
push edi
push 0x2e001708
push dword [ebp - 0x340]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jle 0x2e007a1f
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, 0x80070002
jne 0x2e007a2c
xor esi, esi
inc esi
cmp esi, edi
jl 0x2e007b84
jne 0x2e007b62
lea eax, [ebp - 0x35c]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x328]
push eax
lea eax, [ebp - 0x104]
push eax
mov dword [ebp - 0x330], edi
push edi
jmp 0x2e007b18
lea eax, [ebp - 0x334]
push eax
push 0x20019
push edi
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x324]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, edi
jle 0x2e007a92
and esi, 0xffff
or esi, 0x80070000
cmp esi, edi
jl 0x2e007b84
mov eax, dword [ebp - 0x338]
mov ecx, dword [eax]
lea edx, [ebp - 0x348]
push edx
push dword [ebp - 0x334]
lea edx, [ebp - 0x104]
push edx
push eax
call dword [ecx + 0x2c]
mov esi, eax
cmp esi, edi
jl 0x2e007b84
mov eax, dword [ebp - 0x348]
cmp eax, edi
je 0x2e007ae2
mov ecx, dword [eax + 4]
mov ecx, dword [ecx + 4]
lea eax, [ecx + eax + 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 0x348], edi
push dword [ebp - 0x334]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x330]
lea eax, [ebp - 0x35c]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x328]
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x330]
mov dword [ebp - 0x334], edi
push dword [ebp - 0x324]
mov dword [ebp - 0x328], 0x80
call ebx
mov esi, eax
cmp esi, edi
je 0x2e007a5e
jle 0x2e007b42
and esi, 0xffff
or esi, 0x80070000
cmp esi, 0x80070103
jne 0x2e007b4c
xor esi, esi
cmp esi, edi
jl 0x2e007b84
push dword [ebp - 0x324]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x324], edi
mov eax, dword [ebp - 0x338]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x74]
mov eax, dword [ebp - 0x338]
mov ecx, dword [ebp - 0x354]
mov dword [ecx], eax
mov dword [ebp - 0x338], edi
xor esi, esi
mov eax, dword [ebp - 0x348]
cmp eax, edi
je 0x2e007b9e
mov ecx, dword [eax + 4]
mov ecx, dword [ecx + 4]
lea eax, [ecx + eax + 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x34c]
cmp eax, edi
je 0x2e007bb8
mov ecx, dword [eax + 4]
mov ecx, dword [ecx + 4]
lea eax, [ecx + eax + 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebp - 0x33c], edi
je 0x2e007bcb
push dword [ebp - 0x33c]
call fcn.2e010d00
cmp dword [ebp - 0x334], edi
je 0x2e007bdf
push dword [ebp - 0x334]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x324], edi
je 0x2e007bf3
push dword [ebp - 0x324]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x338]
cmp eax, edi
je 0x2e007c1d
mov ecx, dword [eax]
push eax
call dword [ecx + 0x7c]
mov eax, dword [ebp - 0x338]
cmp eax, edi
je 0x2e007c1d
mov ecx, dword [eax + 4]
mov ecx, dword [ecx + 4]
lea eax, [ecx + eax + 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.2e0142db
leave
ret 0x14