Function at 0x1006a34
Capabilities:
Delete registry value
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x101803c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov dword [ebp - 0x218], eax
cmp eax, ebx
jne 0x1006a63
mov eax, 0x10017b0
push eax
push 0x10018fc
call fcn.0100d383
pop ecx
pop ecx
lea ecx, [ebp - 0x200]
mov dword [ebp - 0x208], ebx
mov dword [ebp - 0x200], ebx
mov byte [ebp - 0x201], bl
call fcn.01005bd9
push eax
push 0x20019
push ebx
push esi
push 0x80000002
call fcn.01005c13
add esp, 0x14
cmp eax, ebx
je 0x1006adb
cmp eax, 2
jne 0x1006aca
mov bl, 1
lea ecx, [ebp - 0x200]
call fcn.01005bf7
lea ecx, [ebp - 0x208]
call fcn.01005bf7
mov al, bl
jmp 0x1006df8
push eax
push esi
push 0x10016ec
call fcn.0100d383
add esp, 0xc
jmp 0x1006aad
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x1f8]
push eax
mov dword [ebp - 0x1fc], ebx
mov dword [ebp - 0x20c], ebx
push ebx
jmp 0x1006d9b
inc dword [ebp - 0x20c]
mov esi, dword [ebp - 0x200]
lea ecx, [ebp - 0x1fc]
call fcn.01005bd9
push eax
lea eax, [ebp - 0x1f8]
cmp byte [ebp + 0x10], bl
jne 0x1006b4d
push 0x2001f
push ebx
push eax
push esi
call fcn.01005c13
mov esi, eax
add esp, 0x14
cmp esi, ebx
je 0x1006cba
cmp esi, 5
jne 0x1006ca9
jmp 0x1006b87
push 0x20019
push ebx
push eax
push esi
call fcn.01005c13
mov esi, eax
add esp, 0x14
cmp esi, ebx
jne 0x1006d62
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0x218]
push dword [ebp - 0x1fc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
cmp esi, ebx
jne 0x1006d62
push 0x100167c
call fcn.0100623e
pop ecx
test al, al
je 0x1006ca9
lea eax, [ebp - 0x1f8]
push eax
push dword [ebp - 0x200]
call fcn.010063f2
mov esi, eax
pop ecx
pop ecx
cmp esi, ebx
je 0x1006be2
lea eax, [ebp - 0x1f8]
push eax
push esi
push 0x1001638
call fcn.0100d383
add esp, 0xc
cmp byte [ebp + 0x10], bl
je 0x1006ca9
lea ecx, [ebp - 0x1fc]
call fcn.01005bf7
jmp 0x1006aad
mov esi, dword [ebp - 0x200]
lea ecx, [ebp - 0x208]
call fcn.01005bd9
push eax
push 0x60000
push ebx
lea eax, [ebp - 0x1f8]
push eax
push esi
call fcn.01005c13
mov esi, eax
add esp, 0x14
cmp esi, ebx
jne 0x1006c88
push dword [ebp - 0x208]
call fcn.01006590
mov esi, eax
pop ecx
lea eax, [ebp - 0x1f8]
cmp esi, ebx
jne 0x1006c37
push eax
push 0x10015f0
call fcn.0100d383
pop ecx
pop ecx
jmp 0x1006c4b
push esi
push eax
push 0x10018c0
call fcn.0100d383
add esp, 0xc
cmp byte [ebp + 0x10], bl
jne 0x1006bd2
push ebx
lea ecx, [ebp - 0x208]
call fcn.01005bb5
cmp byte [ebp + 0x10], bl
jne 0x1006ca9
mov esi, dword [ebp - 0x200]
lea ecx, [ebp - 0x1fc]
call fcn.01005bd9
push eax
push 0x2001f
push ebx
lea eax, [ebp - 0x1f8]
push eax
push esi
call fcn.01005c13
add esp, 0x14
mov esi, eax
jmp 0x1006ca9
lea eax, [ebp - 0x1f8]
push eax
push esi
push 0x10014c8
call fcn.0100d383
add esp, 0xc
push ebx
lea ecx, [ebp - 0x208]
call fcn.01005bb5
cmp esi, ebx
jne 0x1006d62
cmp byte [ebp + 0x10], bl
jne 0x1006d54
push dword [ebp - 0x218]
push dword [ebp - 0x1fc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 0x218]
mov esi, eax
push dword [ebp - 0x1fc]
call fcn.01005c4a
pop ecx
pop ecx
cmp esi, ebx
jne 0x1006d62
cmp byte [ebp + 0x10], bl
jne 0x1006d54
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x211]
push eax
push ebx
push dword [ebp - 0x1fc]
mov dword [ebp - 0x21c], 1
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, 0x103
jne 0x1006d38
lea eax, [ebp - 0x1f8]
push eax
push dword [ebp - 0x200]
call fcn.01005c4a
pop ecx
pop ecx
test eax, eax
jne 0x1006d38
dec dword [ebp - 0x20c]
lea eax, [ebp - 0x1f8]
push eax
push 0x100189c
call fcn.0100d383
pop ecx
pop ecx
mov byte [0x101977a], 1
jmp 0x1006d83
lea eax, [ebp - 0x1f8]
push eax
push 0x1001878
jmp 0x1006d44
cmp esi, 2
je 0x1006d83
push esi
lea eax, [ebp - 0x1f8]
push eax
push 0x1001840
call fcn.0100d383
add esp, 0xc
mov byte [ebp - 0x201], 1
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x1f8]
push eax
push dword [ebp - 0x20c]
push dword [ebp - 0x200]
mov dword [ebp - 0x210], 0x1f4
call edi
cmp eax, ebx
je 0x1006b05
cmp eax, 0x103
je 0x1006dce
push eax
push 0x1001804
call fcn.0100d383
pop ecx
pop ecx
jmp 0x1006bd2
lea ecx, [ebp - 0x1fc]
call fcn.01005bf7
lea ecx, [ebp - 0x200]
call fcn.01005bf7
lea ecx, [ebp - 0x208]
call fcn.01005bf7
cmp byte [ebp - 0x201], bl
sete al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100d419
leave
ret