Function at 0x1006573
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x18]
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
push 0x108
inc edi
push 0x40
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], ebx
mov dword [eax], ebx
mov dword [ebp - 0xc], edi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, dword [ebp + 0x10]
mov dword [esi], eax
cmp eax, ebx
jne 0x10065b8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x14], eax
jmp 0x1006a9a
mov edx, dword [ebp + 0xc]
mov ecx, edx
and ecx, edi
mov dword [eax], ecx
mov eax, dword [esi]
mov dword [eax + 4], 0x1001a00
mov eax, dword [esi]
mov dword [eax + 8], 0x1001c34
mov eax, dword [esi]
mov dword [eax + 0xc], 0x1001c1c
mov eax, dword [esi]
mov dword [eax + 0x10], 0x18
mov eax, dword [esi]
mov dword [eax + 0x14], edi
mov ebx, dword [esi]
push 4
pop eax
and edx, eax
mov dword [ebx + 0x18], edx
mov dword [ebp + 0x10], edx
mov edx, dword [esi]
mov dword [edx + 0x1c], 0x1001a00
mov edx, dword [esi]
mov dword [edx + 0x20], 0x1001bf8
mov edx, dword [esi]
mov dword [edx + 0x24], 0x1001a90
mov edx, dword [esi]
mov dword [edx + 0x28], eax
mov edx, dword [esi]
mov dword [edx + 0x2c], eax
mov edx, dword [esi]
mov dword [edx + 0x30], ecx
mov ecx, dword [esi]
mov ebx, 0x1001938
mov dword [ecx + 0x34], ebx
mov ecx, dword [esi]
mov dword [ecx + 0x38], 0x1001be4
mov ecx, dword [esi]
mov dword [ecx + 0x3c], 0x1001be0
mov ecx, dword [esi]
mov dword [ecx + 0x40], 2
mov ecx, dword [esi]
mov dword [ecx + 0x44], edi
mov edx, dword [esi]
mov ecx, dword [ebp + 0xc]
and ecx, 8
mov dword [edx + 0x48], ecx
mov ecx, dword [esi]
mov dword [ecx + 0x4c], 0x1001978
mov ecx, dword [esi]
mov dword [ecx + 0x50], 0x1001bc8
mov ecx, dword [esi]
mov dword [ecx + 0x54], 0x1001bc4
mov ecx, dword [esi]
mov dword [ecx + 0x58], eax
mov ecx, dword [esi]
mov dword [ecx + 0x5c], edi
mov edx, dword [esi]
mov ecx, dword [ebp + 0xc]
and ecx, 2
mov dword [edx + 0x60], ecx
mov ecx, dword [esi]
mov edx, dword [ebp + 0x10]
mov dword [ecx + 0x64], ebx
mov ecx, dword [esi]
mov dword [ecx + 0x68], 0x1001ba4
mov ecx, dword [esi]
mov dword [ecx + 0x6c], 0x1001bc4
mov ecx, dword [esi]
mov dword [ecx + 0x70], eax
mov ecx, dword [esi]
mov dword [ecx + 0x74], edi
mov ecx, dword [esi]
mov dword [ecx + 0x78], edx
mov ecx, dword [esi]
mov dword [ecx + 0x7c], ebx
mov ecx, dword [esi]
mov dword [ecx + 0x80], 0x1001b88
mov ecx, dword [esi]
mov dword [ecx + 0x84], 0x1001b80
mov ecx, dword [esi]
mov dword [ecx + 0x88], 6
mov ecx, dword [esi]
mov dword [ecx + 0x8c], edi
mov edx, dword [esi]
mov ecx, dword [ebp + 0xc]
and ecx, 0x40
mov dword [edx + 0x90], ecx
mov ecx, dword [esi]
mov dword [ecx + 0x94], ebx
mov ecx, dword [esi]
mov dword [ecx + 0x98], 0x1001b60
mov ecx, dword [esi]
mov dword [ecx + 0x9c], 0x1001b58
mov ecx, dword [esi]
mov dword [ecx + 0xa0], 6
mov ecx, dword [esi]
mov dword [ecx + 0xa4], edi
mov edx, dword [esi]
mov ecx, dword [ebp + 0xc]
shr ecx, 7
not ecx
and ecx, edi
mov dword [edx + 0xa8], ecx
mov edx, dword [esi]
mov dword [edx + 0xac], ebx
mov edx, dword [esi]
mov dword [edx + 0xb0], 0x1001b34
mov edx, dword [esi]
mov dword [edx + 0xb4], 0x1001a94
mov edx, dword [esi]
mov dword [edx + 0xb8], eax
mov edx, dword [esi]
mov dword [edx + 0xbc], eax
mov edx, dword [esi]
mov dword [edx + 0xc0], ecx
mov ecx, dword [esi]
mov dword [ecx + 0xc4], ebx
mov ecx, dword [esi]
mov dword [ecx + 0xc8], 0x1001b18
mov ecx, dword [esi]
mov dword [ecx + 0xcc], 0x1001bc4
mov ecx, dword [esi]
mov dword [ecx + 0xd0], eax
mov eax, dword [esi]
mov dword [eax + 0xd4], edi
mov ecx, dword [esi]
mov eax, dword [ebp + 0xc]
and eax, 0x10
cmp dword [ebp + 0x10], 0
mov dword [ecx + 0xd8], eax
mov eax, dword [esi]
mov dword [eax + 0xdc], 0x1001910
mov eax, dword [esi]
mov dword [eax + 0xe0], 0x1001af4
mov eax, dword [esi]
mov dword [eax + 0xe4], 0x1001aec
mov eax, dword [esi]
mov dword [eax + 0xe8], 8
mov eax, dword [esi]
mov dword [eax + 0xec], edi
mov dword [ebp - 0x10], 0xa
jne 0x10067f9
test byte [ebp + 0xc], 0x20
je 0x1006a9a
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push 0x1001ac0
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ecx, ecx
cmp eax, ecx
jne 0x1006860
lea eax, [ebp - 4]
push eax
push ecx
push ecx
push ecx
push 0x1001a98
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1006860
push dword [ebp - 4]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
test eax, eax
je 0x10068a2
lea ecx, [ebp - 4]
push ecx
push eax
push 0
push 0
push 0x1001a98
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x100689f
mov eax, dword [ebp + 0x18]
mov eax, dword [eax]
test eax, eax
je 0x1006870
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
and dword [ebp - 0xc], 0
push 8
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
test eax, eax
je 0x100689f
mov ecx, dword [0x10090dc]
mov dword [eax], ecx
mov ecx, dword [0x10090e0]
mov dword [eax + 4], ecx
mov dword [ebp - 4], 8
mov ecx, dword [ebp + 0x18]
cmp dword [ecx], 0
je 0x1006a9a
test byte [ebp + 0xc], 0x20
mov edx, dword [ebp - 0xc]
je 0x10068ea
test edx, edx
jne 0x10068c7
mov eax, dword [ebp - 4]
lea eax, [eax*8 - 1]
cmp eax, 0xd
jb 0x10068d3
mov eax, dword [ecx]
and dword [eax], 0xffffdfff
test edx, edx
jne 0x10068e2
mov eax, dword [ebp - 4]
lea eax, [eax*8 - 1]
cmp eax, 0xd
jb 0x10068ea
mov eax, dword [ecx]
and dword [eax], 0xffffdfff
cmp dword [ebp + 0x10], 0
je 0x1006a56
test edx, edx
jne 0x1006906
mov eax, dword [ebp - 4]
lea eax, [eax*8 - 1]
cmp eax, edi
jb 0x100690f
mov eax, dword [ecx]
and dword [eax], 0xfffffffd
test edx, edx
jne 0x100691d
mov eax, dword [ebp - 4]
lea eax, [eax*8 - 1]
cmp eax, edi
jb 0x1006926
mov eax, dword [ecx]
and dword [eax], 0xfffffffd
test edx, edx
jne 0x1006935
mov eax, dword [ebp - 4]
lea eax, [eax*8 - 1]
cmp eax, 9
jb 0x1006941
mov eax, dword [ecx]
and dword [eax], 0xfffffdff
test edx, edx
jne 0x1006950
mov eax, dword [ebp - 4]
lea eax, [eax*8 - 1]
cmp eax, 9
jb 0x100695c
mov eax, dword [ecx]
and dword [eax], 0xfffffdff
test edx, edx
jne 0x100696b
mov eax, dword [ebp - 4]
lea eax, [eax*8 - 1]
cmp eax, 0xb
jb 0x1006977
mov eax, dword [ecx]
and dword [eax], 0xfffff7ff
test edx, edx
jne 0x1006986
mov eax, dword [ebp - 4]
lea eax, [eax*8 - 1]
cmp eax, 0xb
jb 0x1006992
mov eax, dword [ecx]
and dword [eax], 0xfffff7ff
test edx, edx
jne 0x10069a1
mov eax, dword [ebp - 4]
lea eax, [eax*8 - 1]
cmp eax, 0xc
jb 0x10069ad
mov eax, dword [ecx]
and dword [eax], 0xffffefff
test edx, edx
jne 0x10069bc
mov eax, dword [ebp - 4]
lea eax, [eax*8 - 1]
cmp eax, 0xc
jb 0x10069c8
mov eax, dword [ecx]
and dword [eax], 0xffffefff
test edx, edx
jne 0x10069d7
mov eax, dword [ebp - 4]
lea eax, [eax*8 - 1]
cmp eax, 2
jb 0x10069e0
mov eax, dword [ecx]
and dword [eax], 0xfffffffb
test edx, edx
jne 0x10069ef
mov eax, dword [ebp - 4]
lea eax, [eax*8 - 1]
cmp eax, 2
jb 0x10069f8
mov eax, dword [ecx]
and dword [eax], 0xfffffffb
test edx, edx
jne 0x1006a07
mov eax, dword [ebp - 4]
lea eax, [eax*8 - 1]
cmp eax, 3
jb 0x1006a10
mov eax, dword [ecx]
and dword [eax], 0xfffffff7
test edx, edx
jne 0x1006a1f
mov eax, dword [ebp - 4]
lea eax, [eax*8 - 1]
cmp eax, 3
jb 0x1006a28
mov eax, dword [ecx]
and dword [eax], 0xfffffff7
test edx, edx
jne 0x1006a37
mov eax, dword [ebp - 4]
lea eax, [eax*8 - 1]
cmp eax, 0x21
jb 0x1006a41
mov eax, dword [ecx]
and dword [eax + 4], 0xfffffffd
test edx, edx
jne 0x1006a50
mov eax, dword [ebp - 4]
lea eax, [eax*8 - 1]
cmp eax, 0x21
jb 0x1006a56
mov eax, dword [ecx]
and dword [eax + 4], 0xfffffffd
mov eax, dword [esi]
mov dword [eax + 0xf0], edi
mov eax, dword [esi]
mov dword [eax + 0xf4], ebx
mov eax, dword [esi]
mov dword [eax + 0xf8], 0x1001a98
mov eax, dword [esi]
mov ecx, dword [ecx]
mov dword [eax + 0xfc], ecx
mov eax, dword [esi]
mov ecx, dword [ebp - 4]
mov dword [eax + 0x100], ecx
mov eax, dword [esi]
mov dword [eax + 0x104], 3
mov dword [ebp - 0x10], 0xb
cmp dword [ebp - 8], 0
pop edi
pop esi
pop ebx
je 0x1006aac
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
mov eax, dword [ebp - 0x14]
leave
ret 0x14