Function at 0x1006026a
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x54
mov eax, 0x1006a2ca
call fcn.10049974
mov edi, ecx
test dword [0x100a5dc0], 0x200
je 0x1006029b
push edi
push 0x1001d2a0
push dword [0x100a5dcc]
push dword [0x100a5dc8]
call fcn.1005805e
xor ebx, ebx
mov byte [0x100a5e60], 1
cmp dword [edi + 0x5c], ebx
je 0x100602b3
push 0x1c084d
call fcn.10042c89
cmp byte [edi + 0x13b], bl
je 0x100602c5
push 0x1c084e
call fcn.10042c89
mov byte [edi + 0x13b], bl
cmp dword [edi + 0x38], ebx
je 0x100602da
push 0x1c084f
call fcn.10042c89
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 0x30
pop esi
push esi
mov dword [edi + 0x38], eax
lea eax, [ebp - 0x60]
push ebx
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x60]
push eax
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x58], 0x10060b2a
mov dword [ebp - 0x38], 0x1001d07c
call dword [sym.imp.USER32.dll_RegisterClassExW]
movzx eax, ax
test ax, ax
jne 0x10060321
mov ebx, 0x80004005
jmp 0x10060801
push ebx
mov byte [edi + 0x138], 1
call fcn.100622b7
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x10]
push eax
push 0x20019
push ebx
push 0x1001dcd8
push Ordinal_4
call esi
test eax, eax
jne 0x10060389
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push 0x1001dc80
push dword [ebp - 0x10]
mov dword [ebp - 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1006037b
mov dword [ebp - 0x14], 0x3a98
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x14]
jmp 0x1006038e
mov eax, 0x3a98
mov ecx, 0x2710
mov dword [edi + 0x238], eax
cmp eax, ecx
jae 0x100603a3
mov dword [edi + 0x238], ecx
lea eax, [ebp - 0x14]
push eax
push 0x20019
push ebx
push 0x1001dcd8
push Ordinal_4
call esi
test eax, eax
jne 0x100603f9
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push 0x1001dd38
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, 0x7530
test eax, eax
je 0x100603eb
mov dword [ebp - 0x10], esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
jmp 0x10060400
mov esi, 0x7530
mov eax, esi
mov dword [edi + 0x234], eax
lea eax, [ebp - 0x14]
push eax
push 0x20019
push ebx
push 0x1001dcd8
push Ordinal_4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1006045b
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push 0x1001dd90
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1006044d
mov dword [ebp - 0x10], ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
jmp 0x1006045d
mov eax, ebx
mov dword [edi + 0x23c], eax
lea eax, [ebp - 0x14]
push eax
push 0x20019
push ebx
push 0x1001dcd8
push Ordinal_4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100604b8
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push 0x1001ddd8
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x100604aa
mov dword [ebp - 0x10], ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
jmp 0x100604ba
mov eax, ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x8000000
mov dword [edi + 0x240], eax
mov eax, 0x1001d07c
push eax
push eax
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [edi + 0x5c], eax
test eax, eax
je 0x10060317
lea eax, [ebp - 0x14]
push eax
push 0x20019
push ebx
push 0x1001de58
push Ordinal_4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10060539
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push 0x1001de20
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1006052d
mov dword [ebp - 0x10], esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push eax
push 0x20019
push ebx
push 0x1001de58
push Ordinal_4
mov dword [edi + 0x190], esi
mov dword [edi + 0x194], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1006059e
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push 0x1001dea8
push dword [ebp - 0x14]
mov dword [ebp - 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x10060590
mov dword [ebp - 0x10], 0x1f4
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
jmp 0x100605a3
mov eax, 0x1f4
mov dword [edi + 0x188], eax
mov dword [edi + 0x18c], ebx
cmp byte [0x100a1e84], bl
je 0x1006061e
push ebx
push dword [edi + 0x5c]
call fcn.10060819
test al, al
je 0x10060317
mov eax, dword [edi + 0x190]
cmp dword [edi + 0x194], ebx
ja 0x100606b7
jb 0x100605e5
cmp eax, 0xffffffff
ja 0x100606b7
push 5
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0xfff
pop eax
cmp byte [edi + 0x13c], bl
je 0x100605ff
mov eax, 0x105
push ebx
lea ecx, [ebp - 0x20]
push ecx
push eax
push dword [edi + 0x5c]
call fcn.10068992
add esp, 0x10
test eax, eax
jne 0x1006061e
push 0x1c0852
call fcn.10042c89
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
push 0xffffffffffffffeb
push dword [edi + 0x5c]
call dword [sym.imp.USER32.dll_SetWindowLongW]
test eax, eax
jne 0x10060643
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10060317
push 7
mov dword [ebp - 0x20], 0x1388
mov dword [ebp - 0x1c], 0x2710
pop eax
cmp byte [edi + 0x13c], bl
je 0x10060661
mov eax, 0x107
push ebx
lea ecx, [ebp - 0x20]
push ecx
push eax
push dword [edi + 0x5c]
call fcn.10068992
add esp, 0x10
test eax, eax
jne 0x10060687
push 0x1c0853
call fcn.10042c89
mov ecx, edi
call fcn.10061997
push edi
lea ecx, [ebp - 0x30]
call fcn.10062199
mov dword [ebp - 4], ebx
cmp dword [edi + 0x60], ebx
je 0x100606c6
cmp dword [edi + 0x64], ebx
je 0x100606c6
lea eax, [ebp - 0x30]
push eax
mov ecx, edi
call fcn.100612a6
mov eax, dword [ebp - 0x30]
shr eax, 0xb
test al, 1
je 0x100606bc
mov eax, dword [edi + 0x60]
jmp 0x100606bf
call fcn.1005e4d0
mov eax, dword [edi + 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
mov word [edi + 0x139], 0x101
call fcn.100621c5
mov esi, dword [sym.imp.KERNEL32.dll_CreateMemoryResourceNotification]
push ebx
call esi
push 1
mov dword [edi + 0x198], eax
call esi
mov dword [edi + 0x19c], eax
cmp dword [edi + 0x198], ebx
je 0x10060700
test eax, eax
jne 0x1006070a
push 0x1c0854
call fcn.10042c89
mov eax, dword [edi + 0x198]
test eax, eax
je 0x100607ab
cmp dword [edi + 0x19c], ebx
je 0x100607a9
push 0x10
call fcn.10058207
test eax, eax
je 0x1006073b
push edi
mov ecx, eax
call fcn.1006203f
mov esi, eax
jmp 0x1006073d
mov esi, ebx
test esi, esi
jne 0x10060771
push 0x1c0855
call fcn.10042c89
mov eax, dword [edi + 0x58]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
test eax, eax
jne 0x10060762
push 0x1c0856
call fcn.10042c89
test esi, esi
je 0x100607cf
lea eax, [esi + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x100607cf
mov edx, dword [edi + 0x58]
lea eax, [edi + 0x1a0]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x18]
mov eax, dword [edx]
lea ecx, [esi + 8]
push ecx
push 0x2101
push edx
call dword [eax + 0x14]
test eax, eax
js 0x1006074b
mov eax, dword [edi + 0x1a0]
mov ecx, dword [eax]
push 0xffffffffffffffff
push dword [edi + 0x198]
push eax
call dword [ecx + 0x6c]
jmp 0x10060762
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x100607bc
push eax
call esi
mov dword [edi + 0x198], ebx
mov eax, dword [edi + 0x19c]
test eax, eax
je 0x100607cf
push eax
call esi
mov dword [edi + 0x19c], ebx
push dword [0x100a5dd4]
push ebx
push 0x1006230c
push 5
call dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov dword [edi + 0x244], eax
test eax, eax
jne 0x10060801
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10060801
push 0x24a759
call fcn.10042c89
cmp byte [edi + 0x13a], 0
jne 0x10060811
mov ecx, edi
call fcn.10060006
mov eax, ebx
call fcn.10049a4c
ret