Function at 0x1006265
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x1035030]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
xor esi, esi
push 0x4c
mov word [ebp - 0x54], ax
lea eax, [ebp - 0x52]
push esi
push eax
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x60], esi
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x58]
push eax
push 0xf003f
push esi
push 0x1002380
push 0x80000002
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x70], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
je 0x10062f9
mov ecx, dword [0x1035014]
cmp ecx, 0x1035014
je 0x10064b9
test byte [ecx + 0x1c], 4
je 0x10064b9
push eax
push 0x1002040
push 0xd9
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01004eb4
jmp 0x10064b9
push esi
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x60]
push eax
push esi
push esi
push esi
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x10064b9
cmp dword [ebp - 0x60], esi
jne 0x1006351
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x10064b9
test byte [eax + 0x1c], 4
je 0x10064b9
push 0x1002040
push 0xda
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01004e8e
jmp 0x10064b9
mov dword [ebp - 0x5c], esi
cmp dword [ebp - 0x60], esi
jbe 0x10064b9
push ebx
push edi
mov ebx, 0x1035014
mov edi, 0x1002040
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x5c]
mov dword [ebp - 0x64], 0x27
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, esi
jne 0x1006495
lea eax, [ebp - 0x70]
push eax
push 0x1002370
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x58]
call fcn.01012bef
test eax, eax
jne 0x1006484
cmp dword [ebp - 0x70], 1
je 0x1006484
lea eax, [ebp - 0x6c]
push eax
push 0x1002358
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x58]
call fcn.01012e5c
test eax, eax
jne 0x100640b
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 0x68]
jb 0x1006484
mov edx, dword [ebp - 0x6c]
ja 0x10063ea
cmp dword [ebp + 8], edx
jbe 0x1006484
mov ecx, dword [ebp + 8]
sub ecx, edx
sbb eax, dword [ebp - 0x68]
mov edx, dword [ebp - 0x74]
cmp eax, dword [edx + 0x1dc]
jb 0x1006484
ja 0x100640b
cmp ecx, dword [edx + 0x1d8]
jbe 0x1006484
push 1
push 0x1002370
push esi
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x58]
call fcn.01012d36
cmp eax, esi
je 0x1006449
mov ecx, dword [0x1035014]
cmp ecx, ebx
je 0x1006449
test byte [ecx + 0x1c], 1
je 0x1006449
push eax
lea eax, [ebp - 0x54]
push eax
push edi
push 0xdc
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01004f4d
push 0x1002358
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x58]
call fcn.010130c8
cmp eax, esi
je 0x1006484
mov ecx, dword [0x1035014]
cmp ecx, ebx
je 0x1006484
test byte [ecx + 0x1c], 2
je 0x1006484
push eax
lea eax, [ebp - 0x54]
push eax
push edi
push 0xdd
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01004f4d
inc dword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
cmp eax, dword [ebp - 0x60]
jb 0x1006369
jmp 0x10064b7
mov ecx, dword [0x1035014]
cmp ecx, ebx
je 0x10064b7
test byte [ecx + 0x1c], 1
je 0x10064b7
push eax
push edi
push 0xdb
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01004eb4
pop edi
pop ebx
cmp dword [ebp - 0x58], esi
pop esi
je 0x10064c8
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01011f27
leave
ret 8