Function at 0x100677a
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x101203c]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor esi, esi
xor eax, eax
lea edi, [ebp - 0x424]
mov dword [ebp - 0x428], esi
stosd dword es:[edi], eax
lea eax, [ebp - 0x418]
push eax
mov dword [ebp - 0x42c], esi
call fcn.01004d3c
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
or eax, 0x2001f
push eax
push esi
push 0x10014a0
mov edi, 0x80000002
push edi
call ebx
cmp eax, esi
je 0x1006803
cmp eax, 2
jne 0x10067e9
push 0x1001f34
call fcn.01004cb9
xor eax, eax
pop ecx
inc eax
jmp 0x1006adb
push eax
push 0x10014a0
push 0x1001efc
call fcn.01004cb9
add esp, 0xc
xor eax, eax
jmp 0x1006adb
lea eax, [ebp - 0x428]
push eax
push dword [ebp - 0x418]
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x428], eax
call fcn.010060ac
test eax, eax
je 0x1006ab5
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x418]
push eax
mov dword [ebp - 0x418], esi
call fcn.01004d3c
or eax, 0x2001f
push eax
push esi
push 0x10013a8
push edi
call ebx
cmp eax, esi
je 0x100689b
cmp eax, 2
jne 0x1006883
lea ecx, [ebp - 0x428]
cmp dword [ebp - 0x428], ecx
je 0x1006883
push 0x10013a8
push 0x1001ec0
call fcn.01004cb9
pop ecx
pop ecx
jmp 0x1006ab5
push eax
push 0x10013a8
push 0x1001e8c
call fcn.01004cb9
add esp, 0xc
jmp 0x1006ab5
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push dword [ebp - 0x418]
mov dword [ebp - 0x420], 0x104
call edi
mov dword [ebp - 0x41c], 1
jmp 0x100694c
lea eax, [ebp - 0x20c]
push 0x1001e7c
push eax
call fcn.01008113
test eax, eax
pop ecx
pop ecx
je 0x100691c
push dword [ebp + 8]
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x418]
call fcn.010064a5
test eax, eax
jne 0x100691c
lea eax, [ebp - 0x20c]
push eax
push 0x1001e4c
call fcn.01004cb9
pop ecx
pop ecx
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x41c]
mov dword [ebp - 0x420], 0x104
push dword [ebp - 0x418]
call edi
inc dword [ebp - 0x41c]
cmp eax, esi
je 0x10068d2
cmp eax, 0x103
je 0x100696b
push eax
push dword [ebp - 0x41c]
push 0x1001df8
call fcn.01004cb9
add esp, 0xc
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x414]
push 0x10013a8
push eax
mov dword [ebp - 0x418], esi
call fcn.01007ff2
lea eax, [ebp - 0x414]
push 0x1001de4
push eax
call fcn.01007fbf
add esp, 0x10
lea eax, [ebp - 0x418]
push eax
call fcn.01004d3c
or eax, 0x2001f
push eax
push esi
lea eax, [ebp - 0x414]
push eax
push 0x80000002
call ebx
cmp eax, esi
je 0x10069e9
cmp eax, 2
jne 0x10069dc
push 0x1001dc0
call fcn.01004cb9
pop ecx
jmp 0x1006aab
push eax
lea eax, [ebp - 0x414]
push eax
jmp 0x1006889
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push dword [ebp - 0x418]
mov ebx, 0x104
mov dword [ebp - 0x420], ebx
call edi
mov dword [ebp - 0x41c], 1
jmp 0x1006a7a
push dword [ebp + 8]
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x418]
call fcn.010064a5
test eax, eax
jne 0x1006a4e
lea eax, [ebp - 0x20c]
push eax
push 0x1001e4c
call fcn.01004cb9
pop ecx
pop ecx
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x41c]
mov dword [ebp - 0x420], ebx
push dword [ebp - 0x418]
call edi
inc dword [ebp - 0x41c]
cmp eax, esi
je 0x1006a1b
cmp eax, 0x103
je 0x1006a99
push eax
push dword [ebp - 0x41c]
push 0x1001d70
call fcn.01004cb9
add esp, 0xc
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x418], esi
mov dword [ebp - 0x42c], 1
cmp dword [ebp - 0x418], esi
je 0x1006ac9
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x428]
push eax
call fcn.01006080
mov eax, dword [ebp - 0x42c]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01007b7f
leave
ret 4