Function at 0x1066563
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x828
mov eax, dword [0x10cd598]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
dec eax
push edi
mov dword [ebp - 0x818], esi
mov dword [ebp - 0x810], esi
je 0x1066596
push 0x88e
jmp 0x106659b
push 0x88d
call fcn.01088aa0
push eax
call fcn.01099014
mov ebx, 0x1004208
push ebx
call fcn.01099014
test byte [ebp + 8], 1
pop ecx
pop ecx
lea eax, [ebp - 0x818]
push eax
push 9
push esi
mov edi, 0x1012f30
push edi
push 0
pop eax
setne al
add eax, 0x80000001
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x80c], eax
cmp eax, esi
je 0x1066631
push edi
push eax
push esi
push 0x1012ed8
call fcn.01088b7f
push 0x88f
call fcn.01088aa0
push eax
call fcn.01099014
push ebx
call fcn.01099014
pop ecx
pop ecx
push dword [ebp - 0x80c]
push 0x62f013a
push edi
call fcn.01089421
cmp dword [ebp - 0x80c], 2
jne 0x106682a
mov dword [ebp - 0x80c], esi
jmp 0x106682a
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [ebp - 0x828]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x404]
push eax
mov dword [ebp - 0x820], esi
mov ebx, 0x200
push esi
jmp 0x106676b
lea eax, [ebp - 0x810]
push eax
push 9
push esi
lea eax, [ebp - 0x404]
push eax
push dword [ebp - 0x818]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x808], eax
cmp eax, esi
jne 0x10667be
lea eax, [ebp - 0x828]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x804]
push eax
mov dword [ebp - 0x81c], esi
push esi
jmp 0x1066712
push dword [ebp - 0x810]
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x404]
push eax
call fcn.01065f7b
mov dword [ebp - 0x808], eax
cmp eax, esi
je 0x10666da
push eax
push 0x67a013a
call fcn.010893e6
cmp dword [ebp - 0x80c], esi
jne 0x10666ee
mov eax, dword [ebp - 0x808]
mov dword [ebp - 0x80c], eax
inc dword [ebp - 0x81c]
lea eax, [ebp - 0x828]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x804]
push eax
push dword [ebp - 0x81c]
push dword [ebp - 0x810]
mov dword [ebp - 0x814], ebx
call edi
mov dword [ebp - 0x808], eax
cmp eax, esi
je 0x10666ac
cmp eax, 0x103
jne 0x10667f6
push dword [ebp - 0x810]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x820]
lea eax, [ebp - 0x828]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x404]
push eax
push dword [ebp - 0x820]
mov dword [ebp - 0x810], esi
push dword [ebp - 0x818]
mov dword [ebp - 0x814], ebx
call edi
mov dword [ebp - 0x808], eax
cmp eax, esi
je 0x1066660
cmp eax, 0x103
je 0x106682a
push eax
push 0x1012f10
call fcn.01088c53
cmp dword [ebp - 0x80c], esi
jne 0x10667b1
mov eax, dword [ebp - 0x808]
mov dword [ebp - 0x80c], eax
push dword [ebp - 0x808]
push 0x64f013a
jmp 0x1066825
push eax
push 0x1012ed8
call fcn.01088c53
cmp dword [ebp - 0x80c], esi
jne 0x10667dd
mov eax, dword [ebp - 0x808]
mov dword [ebp - 0x80c], eax
push dword [ebp - 0x808]
lea eax, [ebp - 0x404]
push 0x65e013a
push eax
call fcn.01089421
jmp 0x106682a
push dword [ebp - 0x808]
push 0x1012f10
call fcn.01088c53
cmp dword [ebp - 0x80c], esi
jne 0x106681a
mov eax, dword [ebp - 0x808]
mov dword [ebp - 0x80c], eax
push dword [ebp - 0x808]
push 0x677013a
call fcn.010893e6
cmp dword [ebp - 0x810], esi
je 0x106683e
push dword [ebp - 0x810]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x818], esi
pop edi
pop esi
pop ebx
je 0x1066855
push dword [ebp - 0x818]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x80c]
xor ecx, ebp
call fcn.01074bd5
leave
ret 4