Function at 0x1006f61
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x101803c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
push edi
cmp byte [0x1019778], bl
jne 0x10071ec
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x108], ebx
call fcn.01005bd9
push eax
mov edi, 0x20019
push edi
push ebx
push 0x10022c0
mov esi, 0x80000002
push esi
call fcn.01005c13
add esp, 0x14
cmp eax, ebx
je 0x1006fce
cmp eax, 2
je 0x1006fce
lea ecx, [ebp - 0x108]
call fcn.01005bf7
xor al, al
jmp 0x100721e
mov dword [ebp - 0x118], ebx
cmp dword [ebp - 0x108], ebx
je 0x1006ffd
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x118]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x108]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x1006fbc
lea ecx, [ebp - 0x10c]
mov dword [ebp - 0x10c], ebx
call fcn.01005bd9
push eax
push edi
push ebx
push 0x1002284
push esi
call fcn.01005c13
add esp, 0x14
cmp eax, ebx
je 0x1007035
cmp eax, 2
je 0x1007035
lea ecx, [ebp - 0x10c]
call fcn.01005bf7
jmp 0x1006fbc
mov dword [ebp - 0x120], ebx
cmp dword [ebp - 0x10c], ebx
je 0x1007064
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x120]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x1007028
mov eax, dword [ebp - 0x118]
mov ecx, dword [ebp - 0x120]
lea esi, [ecx + eax + 2]
xor ecx, ecx
push 4
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0100d7aa
pop ecx
mov dword [0x1019780], eax
cmp eax, ebx
je 0x1007028
push 0x1001398
call fcn.0100d85f
pop ecx
mov ecx, dword [0x1019780]
mov dword [ecx], eax
xor ecx, ecx
inc ecx
cmp esi, ecx
mov eax, ecx
jle 0x10070be
mov edx, dword [0x1019780]
mov dword [edx + eax*4], ebx
inc eax
cmp eax, esi
jl 0x10070b0
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov edi, 0x100
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x110], edi
cmp dword [ebp - 0x118], ebx
je 0x100713b
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push ebx
jmp 0x100712f
lea eax, [ebp - 0x104]
push eax
call fcn.0100d85f
mov edx, dword [0x1019780]
pop ecx
mov ecx, dword [ebp - 0x114]
push ebx
push ebx
mov dword [edx + ecx*4], eax
push ebx
push ebx
lea eax, [ebp - 0x110]
push eax
inc ecx
lea eax, [ebp - 0x104]
mov dword [ebp - 0x114], ecx
push eax
dec ecx
mov dword [ebp - 0x110], edi
push ecx
push dword [ebp - 0x108]
call esi
test eax, eax
je 0x10070f2
cmp dword [ebp - 0x120], ebx
je 0x10071d4
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push ebx
push dword [ebp - 0x10c]
mov dword [ebp - 0x110], edi
mov dword [ebp - 0x11c], ebx
call esi
test eax, eax
jne 0x10071d4
mov eax, dword [ebp - 0x114]
shl eax, 2
mov dword [ebp - 0x114], eax
lea eax, [ebp - 0x104]
push eax
call fcn.0100d85f
mov edx, dword [ebp - 0x114]
inc dword [ebp - 0x11c]
add dword [ebp - 0x114], 4
pop ecx
mov ecx, dword [0x1019780]
push ebx
push ebx
push ebx
mov dword [edx + ecx], eax
push ebx
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x11c]
mov dword [ebp - 0x110], edi
push dword [ebp - 0x10c]
call esi
test eax, eax
je 0x1007181
lea ecx, [ebp - 0x10c]
call fcn.01005bf7
lea ecx, [ebp - 0x108]
call fcn.01005bf7
jmp 0x100721c
push 8
call fcn.0100d7aa
pop ecx
mov dword [0x1019780], eax
cmp eax, ebx
je 0x1006fc7
push 0x1002278
call fcn.0100d85f
pop ecx
mov ecx, dword [0x1019780]
mov dword [ecx], eax
mov eax, dword [0x1019780]
mov dword [eax + 4], ebx
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100d419
leave
ret