Function at 0x2688f989
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x268eea31
call fcn.268eb4dc
mov eax, 0x1118
call fcn.268eb500
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ebx
mov edx, 0x4000
lea eax, [ebp - 0x10]
call fcn.268e60d7
lea eax, [ebp - 0x1c]
push eax
push ebx
lea eax, [ebp - 0x8bc]
push eax
push ebx
push dword [ebp + 0x10]
lea esi, [ebp - 0x20]
xor edi, edi
call fcn.26890e53
add esp, 0x14
jmp 0x2688fa4a
push ebx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x8bc]
push eax
lea eax, [ebp - 0x20]
push eax
push edi
push dword [ebp + 0x10]
lea ebx, [ebp - 0x1c]
call fcn.2688fc33
add esp, 0x18
cmp eax, 2
jne 0x2688f9fc
test edi, edi
je 0x2688fa2b
test eax, eax
jne 0x2688fb2d
push dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
push eax
push dword [ebp - 0x1c]
lea eax, [ebp - 0x8bc]
push dword [ebp - 0x10]
push dword [ebp - 0x20]
push eax
mov eax, dword [ebp + 0xc]
call fcn.268910a6
test eax, eax
je 0x2688fb2d
lea eax, [ebp - 0x1c]
push eax
push 0
lea eax, [ebp - 0x8bc]
push eax
inc edi
push edi
push dword [ebp + 0x10]
lea esi, [ebp - 0x20]
call fcn.26890e53
add esp, 0x14
xor ebx, ebx
test eax, eax
jne 0x2688f9d4
lea eax, [ebp - 0xcf0]
push eax
lea eax, [ebp - 0x1124]
push eax
mov eax, dword [ebp + 0x10]
call fcn.268909dd
pop ecx
mov esi, 0x21a
pop ecx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], esi
mov byte [ebp - 4], 1
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], esi
mov byte [ebp - 4], 2
lea eax, [ebp - 0x18]
push eax
push 8
lea eax, [ebp - 0xcf0]
push ebx
push eax
lea edi, [ebp - 0x1124]
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], ebx
call fcn.2689093e
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x2688fbe5
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x24], ebx
mov edi, 0x26911198
lea eax, [ebp - 0x54]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x488]
push eax
push dword [ebp - 0x24]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, ebx
mov dword [ebp - 0x28], eax
je 0x2688fb48
cmp eax, 0x103
je 0x2688fbd1
push dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov eax, dword [esi + 8]
push 0x13fa6
mov ebx, 0x268f3f58
call fcn.268e6bb2
mov esi, dword [esi + 8]
mov eax, dword [ebp - 0x28]
pop ecx
pop ecx
push 0
call fcn.268e72f2
and dword [ebp - 0x14], 0
mov esi, 0x21a
jmp 0x2688fbcf
or dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x10]
test esi, esi
je 0x2688fb41
call fcn.268e5db4
and dword [ebp - 0x10], 0
xor eax, eax
jmp 0x2688fc22
push dword [ebp + 0x10]
mov dword [ebp - 0x38], ebx
lea ebx, [ebp - 0x3c]
call fcn.26892244
xor eax, eax
push edi
inc eax
call fcn.268b70c3
lea eax, [ebp - 0x488]
call fcn.268848a8
lea ecx, [ebp - 0x488]
push ecx
call fcn.268b70c3
push dword [ebp + 0xc]
and dword [ebp - 0x48], 0
lea ebx, [ebp - 0x4c]
call fcn.26892244
xor eax, eax
push edi
inc eax
call fcn.268b70c3
lea eax, [ebp - 0x488]
call fcn.268848a8
lea ecx, [ebp - 0x488]
push ecx
call fcn.268b70c3
mov eax, dword [0x26929248]
xor ecx, ecx
cmp dword [ebp - 0x48], ecx
mov edx, eax
je 0x2688fbb6
mov edx, dword [ebp - 0x4c]
cmp dword [ebp - 0x38], ecx
je 0x2688fbbe
mov eax, dword [ebp - 0x3c]
push ecx
push dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
push edx
push eax
call fcn.2688f626
mov dword [ebp - 0x14], eax
xor ebx, ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x14], ebx
mov dword [ebp - 0x2c], esi
je 0x2688fbe5
cmp dword [ebp - 0x28], ebx
je 0x2688fac8
cmp dword [ebp - 0x18], ebx
je 0x2688fbf3
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 1
push dword [ebp - 0x4c]
mov esi, dword [sym.imp.MSVCRT.dll_free]
call esi
mov byte [ebp - 4], bl
push dword [ebp - 0x3c]
call esi
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x10]
cmp esi, ebx
je 0x2688fc1f
call fcn.268e5db4
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10