Function at 0x1006f81
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x2024
call fcn.0100b490
mov eax, dword [0x100dd30]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 8]
imul esi, esi, 3
add esi, dword [ebp + 0xc]
push edi
shl esi, 5
mov ebx, dword [esi + 0x1022a04]
xor edi, edi
mov dword [ebp - 0x2020], eax
cmp ebx, edi
jne 0x1006fc8
mov eax, 0x80004005
jmp 0x10072b8
xor eax, eax
push 0x1ffe
mov word [ebp - 0x2004], ax
lea eax, [ebp - 0x2002]
push edi
push eax
call sub.msvcrt.dll_memset
mov eax, dword [esi + 0x1022a00]
mov eax, dword [eax*4 + 0x1020628]
xor edx, edx
add esp, 0xc
mov dword [ebp - 0x2014], edi
mov dword [ebp - 0x2010], edi
mov dword [ebp - 0x2018], edi
cmp eax, edx
je 0x1006fbe
movzx ecx, word [esi + 0x1022a08]
cmp ecx, 3
je 0x10071f2
cmp ecx, 8
je 0x100717c
cmp ecx, 0x2000
jne 0x10072b6
lea ecx, [ebp - 0x200c]
push ecx
push edx
lea ecx, [ebp - 0x201c]
push ecx
push edx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_RegQueryValueExW]
push eax
call ebx
mov dword [ebp - 0x2008], eax
test eax, eax
jne 0x10070aa
push dword [ebp - 0x200c]
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
mov dword [ebp - 0x2014], eax
test eax, eax
jne 0x100707a
mov dword [ebp - 0x2008], 0x8007000e
jmp 0x1007293
lea ecx, [ebp - 0x200c]
push ecx
push eax
lea eax, [ebp - 0x201c]
push eax
mov eax, dword [esi + 0x1022a00]
push 0
push dword [esi + 0x1022a04]
push dword [eax*4 + 0x1020628]
call ebx
mov dword [ebp - 0x2008], eax
test eax, eax
je 0x10070d3
cmp dword [ebp - 0x2008], 2
jne 0x10070c3
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0100680f
jmp 0x1007293
push dword [ebp - 0x2008]
call fcn.0100611a
jmp 0x1007233
mov ebx, dword [ebp - 0x2014]
xor esi, esi
cmp dword [ebp - 0x200c], 2
jb 0x100715d
sub dword [ebp - 0x200c], 2
cmp word [ebx], 0
je 0x100715d
mov eax, dword [ebp - 0x200c]
shr eax, 1
cmp esi, eax
jae 0x100715d
push 8
call dword [sym.imp.msvcrt.dll_malloc]
mov edi, eax
pop ecx
test edi, edi
je 0x100716d
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1007111
sub eax, edx
sar eax, 1
push ebx
lea esi, [esi + eax + 1]
call dword [sym.imp.msvcrt.dll__wcsdup]
pop ecx
mov dword [edi], eax
test eax, eax
je 0x100716d
mov eax, dword [ebp - 0x2018]
mov dword [ebp - 0x2018], edi
test eax, eax
jne 0x1007149
mov dword [ebp - 0x2010], edi
jmp 0x100714c
mov dword [eax + 4], edi
mov eax, dword [ebp - 0x2014]
and dword [edi + 4], 0
lea ebx, [eax + esi*2]
test ebx, ebx
jne 0x10070eb
mov eax, dword [ebp - 0x2010]
mov dword [0x101fe10], eax
jmp 0x1007293
mov dword [ebp - 0x2008], 0x8007000e
jmp 0x100723f
lea ecx, [ebp - 0x200c]
push ecx
lea ecx, [ebp - 0x2004]
push ecx
lea ecx, [ebp - 0x201c]
push ecx
push edx
push ebx
push eax
mov dword [ebp - 0x200c], 0x2000
call dword [sym.imp.KERNEL32.dll_RegQueryValueExW]
mov dword [ebp - 0x2008], eax
test eax, eax
je 0x10071c9
cmp eax, 2
jne 0x10071c3
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0100680f
jmp 0x1006fbe
push eax
jmp 0x10070c9
lea eax, [ebp - 0x2004]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ecx, dword [ebp - 0x2020]
mov dword [ecx + 8], eax
test eax, eax
jne 0x1007233
push 0x4de
call fcn.01005b14
jmp 0x1006fbe
lea ecx, [ebp - 0x200c]
push ecx
lea ecx, [ebp - 0x2024]
push ecx
lea ecx, [ebp - 0x201c]
push ecx
push edx
push ebx
push eax
mov dword [ebp - 0x200c], 4
call dword [sym.imp.KERNEL32.dll_RegQueryValueExW]
mov dword [ebp - 0x2008], eax
test eax, eax
jne 0x10071ae
mov eax, dword [ebp - 0x2024]
mov ecx, dword [ebp - 0x2020]
mov dword [ecx + 8], eax
cmp dword [ebp - 0x2008], 0x8007000e
jne 0x1007293
mov esi, dword [ebp - 0x2010]
test esi, esi
je 0x1007276
jmp 0x1007251
mov esi, dword [ebp - 0x2010]
mov eax, dword [esi]
mov ebx, esi
test eax, eax
je 0x1007261
push eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov esi, dword [esi + 4]
push ebx
mov dword [ebp - 0x2010], esi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
test esi, esi
jne 0x100724b
test edi, edi
je 0x1007293
mov eax, dword [edi]
test eax, eax
je 0x100728b
push eax
call dword [sym.imp.msvcrt.dll_free]
and dword [edi], 0
pop ecx
push edi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
cmp dword [ebp - 0x2014], 0
je 0x10072a9
push dword [ebp - 0x2014]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
cmp dword [ebp - 0x2008], 0
jne 0x1006fbe
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100b427
leave
ret 0xc