Function at 0x1066c54
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x828
mov eax, dword [0x10d0640]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
dec eax
push edi
mov dword [ebp - 0x818], esi
mov dword [ebp - 0x810], esi
je 0x1066c87
push 0x88e
jmp 0x1066c8c
push 0x88d
call fcn.0108bbbd
push eax
call fcn.0109c1c3
mov ebx, 0x10042f8
push ebx
call fcn.0109c1c3
test byte [ebp + 8], 1
pop ecx
pop ecx
lea eax, [ebp - 0x818]
push eax
push 9
push esi
mov edi, 0x1013040
push edi
push 0
pop eax
setne al
add eax, 0x80000001
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x80c], eax
cmp eax, esi
je 0x1066d22
push edi
push eax
push esi
push 0x1012fe8
call fcn.0108bc9c
push 0x88f
call fcn.0108bbbd
push eax
call fcn.0109c1c3
push ebx
call fcn.0109c1c3
pop ecx
pop ecx
push dword [ebp - 0x80c]
push 0x62f013a
push edi
call fcn.0108c53e
cmp dword [ebp - 0x80c], 2
jne 0x1066f1b
mov dword [ebp - 0x80c], esi
jmp 0x1066f1b
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [ebp - 0x828]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x404]
push eax
mov dword [ebp - 0x820], esi
mov ebx, 0x200
push esi
jmp 0x1066e5c
lea eax, [ebp - 0x810]
push eax
push 9
push esi
lea eax, [ebp - 0x404]
push eax
push dword [ebp - 0x818]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x808], eax
cmp eax, esi
jne 0x1066eaf
lea eax, [ebp - 0x828]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x804]
push eax
mov dword [ebp - 0x81c], esi
push esi
jmp 0x1066e03
push dword [ebp - 0x810]
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x404]
push eax
call fcn.0106666c
mov dword [ebp - 0x808], eax
cmp eax, esi
je 0x1066dcb
push eax
push 0x67a013a
call fcn.0108c503
cmp dword [ebp - 0x80c], esi
jne 0x1066ddf
mov eax, dword [ebp - 0x808]
mov dword [ebp - 0x80c], eax
inc dword [ebp - 0x81c]
lea eax, [ebp - 0x828]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x804]
push eax
push dword [ebp - 0x81c]
push dword [ebp - 0x810]
mov dword [ebp - 0x814], ebx
call edi
mov dword [ebp - 0x808], eax
cmp eax, esi
je 0x1066d9d
cmp eax, 0x103
jne 0x1066ee7
push dword [ebp - 0x810]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x820]
lea eax, [ebp - 0x828]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x404]
push eax
push dword [ebp - 0x820]
mov dword [ebp - 0x810], esi
push dword [ebp - 0x818]
mov dword [ebp - 0x814], ebx
call edi
mov dword [ebp - 0x808], eax
cmp eax, esi
je 0x1066d51
cmp eax, 0x103
je 0x1066f1b
push eax
push 0x1013020
call fcn.0108bd70
cmp dword [ebp - 0x80c], esi
jne 0x1066ea2
mov eax, dword [ebp - 0x808]
mov dword [ebp - 0x80c], eax
push dword [ebp - 0x808]
push 0x64f013a
jmp 0x1066f16
push eax
push 0x1012fe8
call fcn.0108bd70
cmp dword [ebp - 0x80c], esi
jne 0x1066ece
mov eax, dword [ebp - 0x808]
mov dword [ebp - 0x80c], eax
push dword [ebp - 0x808]
lea eax, [ebp - 0x404]
push 0x65e013a
push eax
call fcn.0108c53e
jmp 0x1066f1b
push dword [ebp - 0x808]
push 0x1013020
call fcn.0108bd70
cmp dword [ebp - 0x80c], esi
jne 0x1066f0b
mov eax, dword [ebp - 0x808]
mov dword [ebp - 0x80c], eax
push dword [ebp - 0x808]
push 0x677013a
call fcn.0108c503
cmp dword [ebp - 0x810], esi
je 0x1066f2f
push dword [ebp - 0x810]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x818], esi
pop edi
pop esi
pop ebx
je 0x1066f46
push dword [ebp - 0x818]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x80c]
xor ecx, ebp
call fcn.01077d0b
leave
ret 4