Function at 0x106671d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x10d0620]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x410], 0
push esi
mov esi, dword [ebp + 0xc]
push edi
lea ecx, [ebp - 0x410]
push ecx
push 9
push 0
mov dword [ebp - 0x418], eax
mov eax, dword [ebp + 0x10]
push esi
push eax
mov dword [ebp - 0x41c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
je 0x1066785
push edi
push 0x1012fd8
call fcn.0108bdc7
push edi
push 0x410013a
push esi
call fcn.0108c595
jmp 0x1066a5c
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push ebx
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x414]
push eax
push 0
push 0x1012fc0
push dword [ebp - 0x410]
mov ebx, 0x400
mov dword [ebp - 0x40c], ebx
call esi
mov edi, eax
test edi, edi
je 0x10667dc
push edi
push 0x1012fa0
call fcn.0108bdc7
push edi
push 0x420013a
push 0x1012fc0
jmp 0x1066a56
mov eax, dword [ebp - 0x40c]
shr eax, 1
xor ecx, ecx
push 0x897
mov word [ebp + eax*2 - 0x408], cx
call fcn.0108bc14
push eax
call fcn.0109c1a8
push dword [ebp - 0x41c]
push dword [ebp - 0x418]
push 0x1012f8c
call fcn.0109c1a8
add esp, 0x10
push 0x892
call fcn.0108bc14
push eax
call fcn.0109c1a8
lea eax, [ebp - 0x408]
push eax
push 0x1008be0
call fcn.0109c1a8
add esp, 0xc
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x414]
push eax
push 0
push 0x1012f7c
push dword [ebp - 0x410]
mov dword [ebp - 0x40c], ebx
call esi
mov edi, eax
test edi, edi
je 0x1066886
push edi
push 0x1012fa0
call fcn.0108bdc7
push edi
push 0x434013a
push 0x1012f7c
jmp 0x1066a56
mov eax, dword [ebp - 0x40c]
shr eax, 1
xor ecx, ecx
mov word [ebp + eax*2 - 0x408], cx
lea eax, [ebp - 0x408]
push eax
push 0x898
call fcn.0108bc14
push eax
call fcn.0109c1a8
push 0x1004310
call fcn.0109c1a8
add esp, 0xc
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x414]
push eax
push 0
push 0x1012f6c
push dword [ebp - 0x410]
mov dword [ebp - 0x40c], ebx
call esi
mov edi, eax
test edi, edi
jne 0x1066930
mov eax, dword [ebp - 0x40c]
shr eax, 1
xor ecx, ecx
mov word [ebp + eax*2 - 0x408], cx
lea eax, [ebp - 0x408]
push eax
push 0x1001d38
call fcn.0109c1a8
pop ecx
pop ecx
lea eax, [ebp - 0x408]
push eax
call fcn.01066595
mov edi, eax
test edi, edi
je 0x1066958
push edi
push 0x44a013a
call fcn.0108c55a
jmp 0x1066958
cmp edi, 2
jne 0x1066a2d
push 0x884
call fcn.0108bc14
push eax
call fcn.0109c1a8
mov dword [esp], 0x1004310
call fcn.0109c1a8
pop ecx
xor edi, edi
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x414]
push eax
mov dword [ebp - 0x40c], ebx
push 0
mov ebx, 0x1012f54
push ebx
push dword [ebp - 0x410]
call esi
mov esi, eax
test esi, esi
jne 0x10669d4
mov eax, dword [ebp - 0x40c]
shr eax, 1
xor ecx, ecx
mov word [ebp + eax*2 - 0x408], cx
lea eax, [ebp - 0x408]
push eax
push 0x1001d38
call fcn.0109c1a8
pop ecx
pop ecx
lea eax, [ebp - 0x408]
push eax
call fcn.0106652a
mov esi, eax
test esi, esi
je 0x10669f8
push esi
push 0x468013a
lea eax, [ebp - 0x408]
push eax
call fcn.0108c595
jmp 0x10669f8
cmp esi, 2
jne 0x1066a00
push 0x886
call fcn.0108bc14
push eax
call fcn.0109c1a8
mov dword [esp], 0x1004310
call fcn.0109c1a8
pop ecx
xor esi, esi
test edi, edi
jne 0x1066a5b
mov edi, esi
jmp 0x1066a5b
push esi
push 0x885
call fcn.0108bc14
push eax
call fcn.0109c1a8
push 0x1004310
call fcn.0109c1a8
add esp, 0xc
test edi, edi
jne 0x1066a24
mov edi, esi
push esi
push 0x478013a
push ebx
jmp 0x1066a56
push edi
push 0x885
call fcn.0108bc14
push eax
call fcn.0109c1a8
push 0x1004310
call fcn.0109c1a8
add esp, 0xc
push edi
push 0x456013a
push 0x1012f6c
call fcn.0108c595
pop ebx
push 0x1004310
call fcn.0109c1a8
cmp dword [ebp - 0x410], 0
pop ecx
je 0x1066a7c
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.01077dc7
leave
ret 0xc