Function at 0x10066ab4
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x87c
mov eax, dword [0x1008a418]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, edx
mov dword [ebp - 0x874], ecx
push edi
xor edi, edi
mov dword [ebp - 0x878], eax
mov dword [ebp - 0x848], edi
mov esi, 0x80004005
mov dword [ebp - 0x864], edi
mov ebx, edi
mov dword [ebp - 0x850], edi
test eax, eax
je 0x10066e63
mov dword [eax], edi
lea eax, [ebp - 0x848]
push eax
push 0x20019
push edi
push 0x10007ef0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10066e3f
push edi
push edi
push edi
mov word [ebp - 0x418], ax
lea eax, [ebp - 0x850]
push edi
push eax
lea eax, [ebp - 0x418]
push eax
push edi
jmp 0x10066e17
xor eax, eax
lea edi, [ebp - 0x838]
stosd dword es:[edi], eax
push 0x208
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x828]
xor edi, edi
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x418]
mov edx, 0x104
lea ecx, [ebp - 0x828]
push eax
call fcn.1000b82d
lea eax, [ebp - 0x838]
push eax
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
test eax, eax
js 0x10066dee
lea eax, [ebp - 0x83c]
mov dword [ebp - 0x83c], edi
push eax
push 0x20019
push edi
lea eax, [ebp - 0x418]
push eax
push dword [ebp - 0x848]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10066dd9
push edi
push edi
mov word [ebp - 0x210], ax
mov esi, edi
lea eax, [ebp - 0x844]
mov dword [ebp - 0x860], esi
push eax
push edi
lea eax, [ebp - 0x854]
mov dword [ebp - 0x854], 0x104
push eax
lea eax, [ebp - 0x210]
mov dword [ebp - 0x844], edi
push eax
mov dword [ebp - 0x85c], edi
mov dword [ebp - 0x84c], 4
push edi
jmp 0x10066dc5
xor eax, eax
lea edi, [ebp - 0x870]
stosd dword es:[edi], eax
push 4
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
xor edi, edi
mov word [ebp - 0x620], ax
pop eax
mov dword [ebp - 0x858], edi
mov dword [ebp - 0x840], edi
cmp dword [ebp - 0x844], eax
jne 0x10066c56
mov dword [ebp - 0x84c], eax
lea eax, [ebp - 0x84c]
push eax
lea eax, [ebp - 0x85c]
jmp 0x10066c76
cmp dword [ebp - 0x844], 1
jne 0x10066c9a
lea eax, [ebp - 0x84c]
mov dword [ebp - 0x84c], 0x104
push eax
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x844]
push eax
push edi
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x83c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10066dac
lea eax, [ebp - 0x838]
lea ecx, [ebp - 0x620]
mov dword [ebp - 0x870], eax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x10066caf
sub ecx, edx
sar ecx, 1
je 0x10066cd2
mov dword [ebp - 0x86c], 1
lea eax, [ebp - 0x620]
jmp 0x10066cde
mov eax, dword [ebp - 0x85c]
mov dword [ebp - 0x86c], edi
mov dword [ebp - 0x868], eax
lea ecx, [ebp - 0x840]
lea eax, [ebp - 0x870]
mov edi, esp
push ecx
mov dword [ebp - 0x858], eax
lea ecx, [ebp - 0x858]
mov eax, dword [ebp - 0x874]
push 2
push ecx
push 1
mov esi, dword [eax]
push eax
mov ecx, dword [esi + 0x34]
call dword [0x1008c6d4]
call dword [esi + 0x34]
cmp edi, esp
je 0x10066d24
mov ecx, 4
int 0x29
xor edi, edi
test eax, eax
js 0x10066d8c
mov eax, dword [ebp - 0x840]
cmp dword [eax + 4], edi
je 0x10066d82
cmp dword [eax], edi
je 0x10066d82
push 0xc
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x10066d7c
lea ecx, [ebp - 0x210]
call fcn.100250dd
mov dword [esi + 4], eax
test eax, eax
je 0x10066d75
mov eax, dword [ebp - 0x840]
mov eax, dword [eax + 4]
and eax, 0xffff001e
mov dword [esi + 8], ebx
or eax, 0x1e
mov ebx, esi
mov dword [esi], eax
jmp 0x10066d7c
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x840]
test eax, eax
je 0x10066d8c
push eax
call fcn.10033470
mov esi, dword [ebp - 0x860]
inc esi
mov dword [ebp - 0x854], 0x104
xor eax, eax
mov dword [ebp - 0x860], esi
mov word [ebp - 0x210], ax
push edi
push edi
lea eax, [ebp - 0x844]
push eax
push edi
lea eax, [ebp - 0x854]
push eax
lea eax, [ebp - 0x210]
push eax
push esi
push dword [ebp - 0x83c]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x10066c14
cmp dword [ebp - 0x83c], 0
je 0x10066dee
push dword [ebp - 0x83c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x864]
push edi
push edi
inc eax
xor ecx, ecx
push edi
mov word [ebp - 0x418], cx
lea ecx, [ebp - 0x850]
push edi
push ecx
lea ecx, [ebp - 0x418]
mov dword [ebp - 0x864], eax
push ecx
push eax
push dword [ebp - 0x848]
mov dword [ebp - 0x850], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x10066b43
mov eax, dword [ebp - 0x878]
mov esi, edi
mov dword [eax], ebx
cmp dword [ebp - 0x848], 0
je 0x10066e54
push dword [ebp - 0x848]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jns 0x10066e63
test ebx, ebx
je 0x10066e63
mov ecx, ebx
call fcn.10066a8f
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10087900
mov esp, ebp
pop ebp
ret