Function at 0x10065a8
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30c
mov eax, dword [0x101803c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
lea ecx, [ebp - 0x2fc]
mov dword [ebp - 0x300], edi
mov dword [ebp - 0x30c], esi
mov dword [ebp - 0x2fc], ebx
call fcn.01005bd9
push eax
push 0x20019
push ebx
push esi
push edi
call fcn.01005c13
add esp, 0x14
cmp eax, ebx
je 0x100662f
cmp eax, 2
je 0x100662a
push esi
push eax
push 0x10016c8
call fcn.0100d383
add esp, 0xc
lea ecx, [ebp - 0x2fc]
call fcn.01005bf7
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0100d419
leave
ret
xor ebx, ebx
inc ebx
jmp 0x100660e
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x308]
push eax
lea eax, [ebp - 0x2f8]
push eax
mov dword [ebp - 0x304], ebx
push ebx
jmp 0x100668f
push dword [ebp + 0x10]
lea eax, [ebp - 0x2f8]
push eax
push dword [ebp - 0x2fc]
call fcn.010065a8
add esp, 0xc
test eax, eax
je 0x100660e
cmp byte [ebp + 0x10], bl
je 0x1006677
inc dword [ebp - 0x304]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x308]
push eax
lea eax, [ebp - 0x2f8]
push eax
push dword [ebp - 0x304]
push dword [ebp - 0x2fc]
mov dword [ebp - 0x308], 0x1f4
call edi
mov esi, eax
cmp esi, ebx
je 0x1006650
cmp esi, 0x103
je 0x10066c1
push esi
push 0x1001698
call fcn.0100d383
pop ecx
pop ecx
jmp 0x100660e
push ebx
lea ecx, [ebp - 0x2fc]
call fcn.01005bb5
mov edi, dword [ebp - 0x30c]
cmp byte [ebp + 0x10], bl
jne 0x10066f9
push edi
push dword [ebp - 0x300]
call fcn.01005c4a
mov esi, eax
pop ecx
pop ecx
cmp esi, ebx
je 0x100682d
cmp esi, 5
jne 0x10067db
push 0x100167c
call fcn.0100623e
pop ecx
test al, al
je 0x10067db
push edi
push dword [ebp - 0x300]
call fcn.010063f2
mov esi, eax
pop ecx
pop ecx
cmp esi, ebx
je 0x100673d
push edi
push esi
push 0x1001638
call fcn.0100d383
add esp, 0xc
cmp byte [ebp + 0x10], bl
je 0x10067db
jmp 0x100660e
lea ecx, [ebp - 0x2fc]
call fcn.01005bd9
push eax
push 0x60000
push ebx
push edi
push dword [ebp - 0x300]
call fcn.01005c13
mov esi, eax
add esp, 0x14
cmp esi, ebx
jne 0x10067c0
push dword [ebp - 0x2fc]
call fcn.01006590
mov esi, eax
pop ecx
cmp esi, ebx
jne 0x1006785
push edi
push 0x10015f0
call fcn.0100d383
pop ecx
pop ecx
jmp 0x100679d
push esi
push edi
push 0x10015b0
call fcn.0100d383
add esp, 0xc
cmp byte [ebp + 0x10], bl
jne 0x100660e
push ebx
lea ecx, [ebp - 0x2fc]
call fcn.01005bb5
cmp byte [ebp + 0x10], bl
jne 0x10067db
push edi
push dword [ebp - 0x300]
call fcn.01005c4a
pop ecx
pop ecx
mov esi, eax
jmp 0x10067db
push edi
push esi
push 0x10014c8
call fcn.0100d383
add esp, 0xc
push ebx
lea ecx, [ebp - 0x2fc]
call fcn.01005bb5
cmp esi, ebx
je 0x1006821
cmp byte [ebp + 0x10], bl
jne 0x1006826
push ebx
push 0x100
lea eax, [ebp - 0x104]
push eax
push ebx
push esi
push ebx
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
jne 0x100680f
push edi
push esi
push 0x1001580
jmp 0x1006606
lea eax, [ebp - 0x104]
push eax
push edi
push 0x1001558
jmp 0x1006606
cmp byte [ebp + 0x10], bl
je 0x100682d
mov eax, 0x1001544
jmp 0x1006832
mov eax, 0x1001538
push edi
push eax
push 0x100152c
call fcn.0100d383
xor ebx, ebx
add esp, 0xc
inc ebx
mov byte [0x101977a], bl
jmp 0x100660e