Function at 0x2e007c96
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
and dword [ebp - 0xc], 0
push edi
push 4
pop ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x2e0019f8
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
test eax, eax
jne 0x2e007d47
mov ecx, dword [ebp - 0x10]
lea edx, [ecx - 3]
cmp edx, 0x39
ja 0x2e007d50
mov dword [0x2e021e98], ecx
mov edi, 0x80070000
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x2e0019e4
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
cmp eax, 2
je 0x2e007d16
test eax, eax
je 0x2e007d16
jle 0x2e007d0e
and eax, 0xffff
or eax, edi
test eax, eax
jl 0x2e007f73
push 3
pop eax
cmp dword [ebp - 0xc], eax
jbe 0x2e007d21
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0xc]
xor eax, eax
cmp dword [ecx], eax
je 0x2e007d7c
cmp dword [ebp - 0xc], eax
jne 0x2e007d70
xor edi, edi
inc edi
push edi
call fcn.2e013385
push edi
push edi
call fcn.2e0133cc
mov eax, dword [ebp + 0xc]
and dword [eax], 0
jmp 0x2e007dae
cmp eax, 2
je 0x2e007cdc
test eax, eax
jg 0x2e007d57
mov edi, 0x80070000
jmp 0x2e007d63
and eax, 0xffff
mov edi, 0x80070000
or eax, edi
test eax, eax
jl 0x2e007f73
jmp 0x2e007ce1
push 1
push dword [ebp - 0xc]
call fcn.2e0133cc
jmp 0x2e007db3
cmp dword [ebp - 0xc], eax
jbe 0x2e007db3
xor edi, edi
inc edi
push edi
push dword [ebp - 0xc]
call fcn.2e0133cc
push edi
push 0
push 0x2e0019dc
push 0x2e0019d4
push 0
call fcn.2e0132a0
test eax, eax
jl 0x2e007f73
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
mov edi, 0x80070000
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x2e0019b8
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
test eax, eax
jne 0x2e007ddf
cmp dword [ebp - 0x14], eax
setne al
mov dword [0x2e021e9c], eax
jmp 0x2e007df7
cmp eax, 2
je 0x2e007df7
test eax, eax
jle 0x2e007df1
and eax, 0xffff
or eax, edi
test eax, eax
jl 0x2e007f73
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x2e00199c
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
test eax, eax
jne 0x2e007e25
mov ecx, dword [ebp - 0x10]
test ecx, ecx
jbe 0x2e007e35
mov dword [0x2e021ea0], ecx
jmp 0x2e007e3d
cmp eax, 2
je 0x2e007e3d
test eax, eax
jle 0x2e007e37
and eax, 0xffff
or eax, edi
test eax, eax
jl 0x2e007f73
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x2e001978
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
test eax, eax
jne 0x2e007e69
cmp dword [ebp - 0x14], eax
setne al
mov dword [0x2e021ea4], eax
jmp 0x2e007e81
cmp eax, 2
je 0x2e007e81
test eax, eax
jle 0x2e007e7b
and eax, 0xffff
or eax, edi
test eax, eax
jl 0x2e007f73
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x2e001954
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
test eax, eax
jne 0x2e007eaf
mov ecx, dword [ebp - 0x10]
test ecx, ecx
jbe 0x2e007ebf
mov dword [0x2e021ea8], ecx
jmp 0x2e007ec7
cmp eax, 2
je 0x2e007ec7
test eax, eax
jle 0x2e007ec1
and eax, 0xffff
or eax, edi
test eax, eax
jl 0x2e007f73
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x2e00192c
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
test eax, eax
jne 0x2e007ef3
cmp dword [ebp - 0x14], eax
setne al
mov dword [0x2e021eac], eax
jmp 0x2e007f07
cmp eax, 2
je 0x2e007f07
test eax, eax
jle 0x2e007f05
and eax, 0xffff
or eax, edi
test eax, eax
jl 0x2e007f73
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x2e001904
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
test eax, eax
jne 0x2e007f35
mov ecx, dword [ebp - 0x10]
test ecx, ecx
jbe 0x2e007f45
mov dword [0x2e021eb0], ecx
jmp 0x2e007f49
cmp eax, 2
je 0x2e007f49
test eax, eax
jle 0x2e007f47
and eax, 0xffff
or eax, edi
test eax, eax
jl 0x2e007f73
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x2e0018ec
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call esi
test eax, eax
jne 0x2e007f73
cmp dword [ebp - 0x14], eax
setne al
mov dword [0x2e021eb4], eax
pop edi
pop esi
pop ebx
leave
ret 8