Function at 0x1065f7b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x10cd598]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x410], 0
push esi
mov esi, dword [ebp + 0xc]
push edi
lea ecx, [ebp - 0x410]
push ecx
push 9
push 0
mov dword [ebp - 0x418], eax
mov eax, dword [ebp + 0x10]
push esi
push eax
mov dword [ebp - 0x41c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
je 0x1065fe3
push edi
push 0x1012ed8
call fcn.01088c53
push edi
push 0x410013a
push esi
call fcn.01089421
jmp 0x10662ba
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push ebx
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x414]
push eax
push 0
push 0x1012ec0
push dword [ebp - 0x410]
mov ebx, 0x400
mov dword [ebp - 0x40c], ebx
call esi
mov edi, eax
test edi, edi
je 0x106603a
push edi
push 0x1012ea0
call fcn.01088c53
push edi
push 0x420013a
push 0x1012ec0
jmp 0x10662b4
mov eax, dword [ebp - 0x40c]
shr eax, 1
xor ecx, ecx
push 0x897
mov word [ebp + eax*2 - 0x408], cx
call fcn.01088aa0
push eax
call fcn.01099014
push dword [ebp - 0x41c]
push dword [ebp - 0x418]
push 0x1012e8c
call fcn.01099014
add esp, 0x10
push 0x892
call fcn.01088aa0
push eax
call fcn.01099014
lea eax, [ebp - 0x408]
push eax
push 0x1008ad8
call fcn.01099014
add esp, 0xc
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x414]
push eax
push 0
push 0x1012e7c
push dword [ebp - 0x410]
mov dword [ebp - 0x40c], ebx
call esi
mov edi, eax
test edi, edi
je 0x10660e4
push edi
push 0x1012ea0
call fcn.01088c53
push edi
push 0x434013a
push 0x1012e7c
jmp 0x10662b4
mov eax, dword [ebp - 0x40c]
shr eax, 1
xor ecx, ecx
mov word [ebp + eax*2 - 0x408], cx
lea eax, [ebp - 0x408]
push eax
push 0x898
call fcn.01088aa0
push eax
call fcn.01099014
push 0x1004208
call fcn.01099014
add esp, 0xc
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x414]
push eax
push 0
push 0x1012e6c
push dword [ebp - 0x410]
mov dword [ebp - 0x40c], ebx
call esi
mov edi, eax
test edi, edi
jne 0x106618e
mov eax, dword [ebp - 0x40c]
shr eax, 1
xor ecx, ecx
mov word [ebp + eax*2 - 0x408], cx
lea eax, [ebp - 0x408]
push eax
push 0x1001d04
call fcn.01099014
pop ecx
pop ecx
lea eax, [ebp - 0x408]
push eax
call fcn.01065df3
mov edi, eax
test edi, edi
je 0x10661b6
push edi
push 0x44a013a
call fcn.010893e6
jmp 0x10661b6
cmp edi, 2
jne 0x106628b
push 0x884
call fcn.01088aa0
push eax
call fcn.01099014
mov dword [esp], 0x1004208
call fcn.01099014
pop ecx
xor edi, edi
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x414]
push eax
mov dword [ebp - 0x40c], ebx
push 0
mov ebx, 0x1012e54
push ebx
push dword [ebp - 0x410]
call esi
mov esi, eax
test esi, esi
jne 0x1066232
mov eax, dword [ebp - 0x40c]
shr eax, 1
xor ecx, ecx
mov word [ebp + eax*2 - 0x408], cx
lea eax, [ebp - 0x408]
push eax
push 0x1001d04
call fcn.01099014
pop ecx
pop ecx
lea eax, [ebp - 0x408]
push eax
call fcn.01065d88
mov esi, eax
test esi, esi
je 0x1066256
push esi
push 0x468013a
lea eax, [ebp - 0x408]
push eax
call fcn.01089421
jmp 0x1066256
cmp esi, 2
jne 0x106625e
push 0x886
call fcn.01088aa0
push eax
call fcn.01099014
mov dword [esp], 0x1004208
call fcn.01099014
pop ecx
xor esi, esi
test edi, edi
jne 0x10662b9
mov edi, esi
jmp 0x10662b9
push esi
push 0x885
call fcn.01088aa0
push eax
call fcn.01099014
push 0x1004208
call fcn.01099014
add esp, 0xc
test edi, edi
jne 0x1066282
mov edi, esi
push esi
push 0x478013a
push ebx
jmp 0x10662b4
push edi
push 0x885
call fcn.01088aa0
push eax
call fcn.01099014
push 0x1004208
call fcn.01099014
add esp, 0xc
push edi
push 0x456013a
push 0x1012e6c
call fcn.01089421
pop ebx
push 0x1004208
call fcn.01099014
cmp dword [ebp - 0x410], 0
pop ecx
je 0x10662da
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.01074bd5
leave
ret 0xc