Function at 0x10006370
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x284
mov eax, dword [0x1002f2a4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x30]
test esi, esi
je 0x10006764
lea eax, [esi + 1]
lea eax, [eax + eax*2]
lea eax, [edi + eax*4]
push ebx
nop dword [eax]
lea ecx, [ebp - 0x274]
sub eax, 0xc
push ecx
push dword [edi + 0x3c]
dec esi
mov dword [ebp - 0x284], eax
push 0
push 0x10023708
push dword [eax]
mov dword [ebp - 0x280], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100066fd
xor ebx, ebx
mov dword [ebp - 0x270], 0x80
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x270]
mov dword [ebp - 0x278], ebx
push eax
lea eax, [ebp - 0x164]
push eax
push ebx
push dword [ebp - 0x274]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x100066e9
nop word [eax + eax]
mov eax, dword [ebp - 0x270]
lea edx, [eax + eax]
cmp edx, 0x160
jae 0x10006774
xor eax, eax
mov word [ebp + edx - 0x164], ax
cmp word [ebp - 0x164], 0x7b
jne 0x100066a7
cmp word [ebp - 0x152], 0x2d
jne 0x100066a7
cmp word [ebp - 0x148], 0x2d
jne 0x100066a7
cmp word [ebp - 0x13e], 0x2d
jne 0x100066a7
cmp word [ebp - 0x134], 0x2d
jne 0x100066a7
cmp word [ebp - 0x11a], 0x7d
jne 0x100066a7
cmp word [ebp - 0x118], ax
jne 0x100066a7
movzx ecx, word [ebp - 0x162]
lea eax, [ecx - 0x30]
cmp eax, 0xa
jb 0x100064b3
lea eax, [ecx - 0x41]
cmp eax, 6
jb 0x100064b3
lea eax, [ecx - 0x61]
cmp eax, 6
jae 0x100066a7
movups xmm0, xmmword [0x100235d4]
mov ax, word [0x100235e4]
movups xmmword [ebp + edx - 0x164], xmm0
mov word [ebp + edx - 0x154], ax
lea eax, [ebp - 0x26c]
push eax
push 1
push 0
lea eax, [ebp - 0x164]
push eax
push dword [ebp - 0x274]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100066a7
lea eax, [ebp - 0x268]
mov dword [ebp - 0x268], 0xfe
push eax
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x27c]
push eax
push 0
push 0
push dword [ebp - 0x26c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000653a
cmp dword [ebp - 0x27c], 1
jne 0x1000653a
mov ecx, dword [ebp - 0x268]
jmp 0x10006542
xor ecx, ecx
mov dword [ebp - 0x268], ecx
and ecx, 0xfffffffe
cmp ecx, 0x100
jae 0x10006774
xor edx, edx
mov word [ebp + ecx - 0x264], dx
test eax, eax
jne 0x1000674a
lea eax, [ebp - 0x264]
push eax
call fcn.10005f00
add esp, 4
test al, al
je 0x1000674a
push 0x809
push dword [ebp - 0x26c]
mov bl, 1
push edi
call fcn.10004cf0
mov eax, dword [ebp - 0x270]
add esp, 0xc
movups xmm0, xmmword [0x100235e8]
movups xmmword [ebp + eax*2 - 0x164], xmm0
lea eax, [ebp - 0x26c]
push eax
push 1
push 0
lea eax, [ebp - 0x164]
push eax
push dword [ebp - 0x274]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000670c
lea eax, [ebp - 0x268]
mov dword [ebp - 0x268], 0xfe
push eax
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x27c]
push eax
push 0
push 0
push dword [ebp - 0x26c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000660f
cmp dword [ebp - 0x27c], 1
jne 0x1000660f
mov ecx, dword [ebp - 0x268]
jmp 0x10006617
xor ecx, ecx
mov dword [ebp - 0x268], ecx
mov eax, ecx
and eax, 0xfffffffe
cmp eax, 0x100
jae 0x10006774
xor edx, edx
mov word [ebp + eax - 0x264], dx
cmp ecx, 0x18
jb 0x10006687
lea edx, [ebp - 0x264]
mov eax, str.VirtualBox.
mov esi, 0x12
mov ecx, dword [edx]
cmp ecx, dword [eax]
jne 0x10006657
add edx, 4
add eax, 4
sub esi, 4
jae 0x10006646
mov cl, byte [edx]
cmp cl, byte [eax]
jne 0x1000667e
mov cl, byte [edx + 1]
cmp cl, byte [eax + 1]
jne 0x1000667e
cmp esi, 0xfffffffe
je 0x1000667a
mov cl, byte [edx + 2]
cmp cl, byte [eax + 2]
jne 0x1000667e
mov cl, byte [edx + 3]
cmp cl, byte [eax + 3]
jne 0x1000667e
xor eax, eax
jmp 0x10006683
sbb eax, eax
or eax, 1
test eax, eax
je 0x10006689
xor bl, bl
push 0x820
push dword [ebp - 0x26c]
push edi
call fcn.10004cf0
add esp, 0xc
test bl, bl
jne 0x10006711
mov ebx, dword [ebp - 0x278]
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x270]
mov dword [ebp - 0x270], 0x80
push eax
lea eax, [ebp - 0x164]
inc ebx
push eax
push ebx
push dword [ebp - 0x274]
mov dword [ebp - 0x278], ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x10006410
mov esi, dword [ebp - 0x280]
push 0x839
push dword [ebp - 0x274]
push edi
call fcn.10004cf0
add esp, 0xc
test esi, esi
je 0x10006763
mov eax, dword [ebp - 0x284]
jmp 0x100063a0
cmp eax, 2
jne 0x100066a1
mov eax, dword [ebp - 0x270]
add eax, eax
cmp eax, 0x160
jae 0x10006774
xor ecx, ecx
mov word [ebp + eax - 0x164], cx
lea eax, [ebp - 0x164]
push 0x82b
push eax
push dword [ebp - 0x274]
push edi
call fcn.10005b40
add esp, 0x10
jmp 0x100066a1
push 0x809
push dword [ebp - 0x26c]
push edi
call fcn.10004cf0
add esp, 0xc
jmp 0x100066a7
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10008170
mov esp, ebp
pop ebp
ret
call fcn.10008093
int3