Function at 0x1006fc64
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x1007641c]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
call fcn.1004ddfa
push 0x100766b8
mov dword [ebp - 0x50], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x10006798
call fcn.10025d3f
push 0x11
mov ebx, 0x89
push ebx
push eax
push 1
push 0xc
call fcn.1006ee56
cmp dword [ebp - 0x50], 0x3a4
jne 0x1006fcb6
push 0x10006784
jmp 0x1006fcbb
push 0x1000676c
call fcn.10025d3f
push 0x11
mov esi, 0x8a
push esi
xor edi, edi
push eax
push edi
push 0xc
call fcn.1006ee56
cmp dword [ebp - 0x50], 0x3b5
jne 0x1006fce3
push 0x10006764
jmp 0x1006fce8
push 0x10006758
call fcn.10025d3f
push 0x31
push ebx
push eax
push 1
push 0xe
mov dword [ebp - 0x48], eax
call fcn.1006ee56
push 0x31
push esi
push dword [ebp - 0x48]
push edi
push 0xe
call fcn.1006ee56
cmp dword [ebp - 0x50], 0x3b6
mov eax, 0x1000674c
je 0x1006fd1e
mov eax, 0x10006738
push eax
call fcn.10025d3f
push 0x36
push ebx
push eax
push 1
push 0xf
mov dword [ebp - 0x54], eax
call fcn.1006ee56
push 0x36
push esi
push dword [ebp - 0x54]
push edi
push 0xf
call fcn.1006ee56
cmp dword [ebp - 0x50], 0x3a8
mov eax, 0x10006730
je 0x1006fd55
mov eax, 0x10006720
push eax
call fcn.10025d3f
push 0x36
push ebx
push eax
push 1
push 0xd
mov dword [ebp - 0x48], eax
call fcn.1006ee56
push 0x36
push esi
push dword [ebp - 0x48]
push edi
push 0xd
call fcn.1006ee56
push dword [0x10076258]
call fcn.10025d3f
push 0x20
pop ebx
push ebx
push 8
push eax
push 1
push edi
mov dword [ebp - 0x48], eax
call fcn.1006ee56
push ebx
push 8
push dword [ebp - 0x48]
push 1
push 8
call fcn.1006ee56
push dword [0x10076224]
call fcn.10025d3f
push ebx
push 0xa
push eax
push edi
push edi
mov dword [ebp - 0x48], eax
call fcn.1006ee56
push ebx
push 0xa
push dword [ebp - 0x48]
push edi
push 1
call fcn.1006ee56
push ebx
push 8
push dword [ebp - 0x48]
push 1
push 1
call fcn.1006ee56
push ebx
push 0xa
push dword [ebp - 0x48]
push edi
push 8
call fcn.1006ee56
push dword [0x10076260]
call fcn.10025d3f
push edi
push 8
push eax
push 1
push 0xa
mov dword [ebp - 0x48], eax
call fcn.1006ee56
push edi
push 0xa
push dword [ebp - 0x48]
push edi
push 0xa
call fcn.1006ee56
call fcn.1006a5b8
test al, al
je 0x1006fe23
push dword [0x10076234]
jmp 0x1006fe29
push dword [0x10076258]
call fcn.10025d3f
push ebx
push 8
push eax
push 1
push 0xb
call fcn.1006ee56
push dword [0x10076254]
call fcn.10025d3f
push ebx
push 0xe
push eax
push edi
push 0xb
call fcn.1006ee56
call fcn.1006a5b8
test al, al
mov edi, 0x88
je 0x1006fee4
push dword [0x10076264]
call fcn.10025d3f
push ebx
push edi
push eax
push 1
push 0x23
mov dword [ebp - 0x48], eax
call fcn.1006ee56
push ebx
push esi
push dword [ebp - 0x48]
push 0
push 0x23
call fcn.1006ee56
push ebx
push edi
push dword [ebp - 0x48]
push 1
push 0x13
call fcn.1006ee56
push ebx
push esi
push dword [ebp - 0x48]
push 0
push 0x13
call fcn.1006ee56
push dword [0x1007625c]
call fcn.10025d3f
mov dword [ebp - 0x4c], 0x17
mov dword [ebp - 0x48], eax
push ebx
push edi
push dword [ebp - 0x48]
push 1
push dword [ebp - 0x4c]
call fcn.1006ee56
push ebx
push esi
push dword [ebp - 0x48]
push 0
push dword [ebp - 0x4c]
call fcn.1006ee56
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], 0x1e
jle 0x1006febd
push dword [0x10076248]
call fcn.10025d3f
push ebx
push edi
push eax
push 1
push 0x19
mov dword [ebp - 0x48], eax
call fcn.1006ee56
push ebx
push esi
push dword [ebp - 0x48]
push 0
push 0x19
call fcn.1006ee56
push dword [0x1007624c]
call fcn.10025d3f
push ebx
push edi
push eax
push 1
push 0x1d
mov dword [ebp - 0x48], eax
call fcn.1006ee56
push ebx
push esi
push dword [ebp - 0x48]
push 0
push 0x1d
call fcn.1006ee56
push dword [0x10076250]
call fcn.10025d3f
push ebx
push edi
push eax
push 1
push 0x1c
mov dword [ebp - 0x48], eax
call fcn.1006ee56
push ebx
push esi
push dword [ebp - 0x48]
push 0
push 0x1c
call fcn.1006ee56
push dword [0x1007623c]
call fcn.10025d3f
push ebx
push edi
push eax
push 1
push 0x16
mov dword [ebp - 0x48], eax
call fcn.1006ee56
push ebx
push esi
push dword [ebp - 0x48]
push 0
push 0x16
call fcn.1006ee56
push dword [0x10076240]
call fcn.10025d3f
push ebx
push edi
push eax
push 1
push 0x1b
mov dword [ebp - 0x48], eax
call fcn.1006ee56
push ebx
push esi
push dword [ebp - 0x48]
push 0
push 0x1b
call fcn.1006ee56
push dword [0x10076244]
call fcn.10025d3f
push ebx
push edi
mov dword [ebp - 0x48], eax
push eax
push 1
push 0x18
call fcn.1006ee56
push ebx
push esi
push dword [ebp - 0x48]
push 0
push 0x18
call fcn.1006ee56
push dword [0x10076268]
or word [0x1007678c], 0xffff
call fcn.10025d3f
push ebx
push edi
push eax
push 1
push 0x14
mov dword [ebp - 0x48], eax
call fcn.1006ee56
push ebx
push esi
push dword [ebp - 0x48]
push 0
push 0x14
call fcn.1006ee56
push dword [0x1007626c]
call fcn.10025d3f
push ebx
push edi
push eax
push 1
push 0x15
mov dword [ebp - 0x48], eax
call fcn.1006ee56
push ebx
push esi
push dword [ebp - 0x48]
xor edi, edi
push edi
push 0x15
call fcn.1006ee56
cmp dword [0x10076a54], 2
jne 0x100700a7
and dword [ebp - 0x4c], edi
lea eax, [ebp - 0x4c]
push eax
push 1
push edi
push 0x10006688
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100700a7
and dword [ebp - 0x58], eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x58]
push eax
push edi
push 0x10006674
push dword [ebp - 0x4c]
mov dword [ebp - 0x5c], 0x40
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10070094
cmp dword [ebp - 0x58], 1
jne 0x10070094
lea eax, [ebp - 0x44]
push eax
call fcn.10025d3f
inc edi
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x4c], 0
je 0x100700a3
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x100700c3
cmp dword [ebp - 0x50], 0x3a8
mov eax, 0x1000665c
je 0x100700ba
mov eax, 0x10006628
push eax
call fcn.10025d3f
mov dword [ebp - 0x48], eax
push 0x2e
pop edi
cmp edi, 0x2f
mov eax, dword [ebp - 0x48]
je 0x100700d1
mov eax, dword [ebp - 0x54]
push ebx
push 0x89
push eax
push 1
push edi
call fcn.1006ee56
cmp edi, 0x2f
mov eax, dword [ebp - 0x48]
je 0x100700eb
mov eax, dword [ebp - 0x54]
push ebx
push esi
push eax
push 0
push edi
call fcn.1006ee56
inc edi
cmp edi, 0x32
jl 0x100700c6
call fcn.1006edfe
push 0x100766b8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.1007344b
leave
ret