Function at 0x6f33ebc4
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push dword [ebp + 8]
xor edi, edi
mov ebx, ecx
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0xc], edi
call fcn.6f33ebad
test al, al
je 0x6f33ec1f
push dword [ebp + 0xc]
call fcn.6f33ebad
test al, al
jne 0x6f33ec02
mov esi, 0x80070057
push esi
push 0x6401a0
jmp 0x6f33ee0f
mov ecx, ebx
call fcn.6f33eaa1
mov esi, eax
cmp esi, edi
je 0x6f33ec1a
push esi
push 0x6801a0
jmp 0x6f33ee0f
mov eax, dword [ebx + 4]
jmp 0x6f33ec3d
push dword [ebp + 8]
mov ecx, ebx
call fcn.6f33eb39
mov esi, eax
cmp esi, edi
je 0x6f33ec3a
push esi
push 0x6f01a0
jmp 0x6f33ee0f
mov eax, dword [ebx + 8]
push dword [ebp + 0xc]
mov dword [ebp + 8], eax
call fcn.6f33ebad
test al, al
jne 0x6f33ec9c
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call ebx
mov esi, eax
cmp esi, 5
jne 0x6f33ec7f
lea eax, [ebp - 0xc]
push eax
push 0x20019
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call ebx
mov esi, eax
cmp esi, edi
je 0x6f33ec96
push esi
push 0x8701a0
push dword [ebp + 0xc]
call fcn.6f33d289
jmp 0x6f33ee14
mov eax, dword [ebp - 0xc]
mov dword [ebp + 8], eax
push dword [ebp + 0x10]
call fcn.6f33ebad
test al, al
je 0x6f33ed87
push edi
push edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push edi
push edi
push edi
push dword [ebp + 8]
mov dword [ebp - 0x10], 7
mov dword [ebp - 4], 2
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov esi, eax
cmp esi, edi
je 0x6f33ece5
push esi
push 0x9601a0
jmp 0x6f33ee0f
mov eax, dword [ebp - 0x14]
inc eax
imul eax, dword [ebp - 0x18]
shl eax, 1
push eax
push edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
cmp ebx, edi
mov dword [ebp - 8], ebx
jne 0x6f33ed13
mov esi, 0x8007000e
push esi
push 0x9d01a0
jmp 0x6f33ee0f
cmp dword [ebp - 0x18], edi
mov dword [ebp + 0xc], edi
jbe 0x6f33ed53
mov eax, dword [ebp - 4]
push edi
push edi
push edi
push edi
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
cmp esi, edi
jne 0x6f33ed7c
push ebx
call dword [sym.imp.msvcrt.dll_wcslen]
inc dword [ebp + 0xc]
lea ebx, [ebx + eax*2 + 2]
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 0x18]
pop ecx
jb 0x6f33ed1b
push dword [ebp + 0x14]
mov word [ebx], di
push dword [ebp - 8]
push dword [ebp - 4]
push dword [ebp - 0x10]
call fcn.6f33d363
mov esi, eax
cmp esi, edi
je 0x6f33ee14
push esi
push 0xb601a0
jmp 0x6f33ee0f
push esi
push 0xab01a0
jmp 0x6f33ee0f
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 0x10]
push eax
push edi
push dword [ebp + 0x10]
push dword [ebp + 8]
call ebx
mov esi, eax
cmp esi, edi
je 0x6f33edb4
push 2
push esi
push 0xc101a0
call fcn.6f33d273
jmp 0x6f33ee14
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
cmp eax, edi
mov dword [ebp - 8], eax
jne 0x6f33edd2
mov esi, 0x8007000e
push esi
push 0xc701a0
jmp 0x6f33ee0f
lea ecx, [ebp - 4]
push ecx
push eax
lea eax, [ebp - 0x10]
push eax
push edi
push dword [ebp + 0x10]
push dword [ebp + 8]
call ebx
mov esi, eax
cmp esi, edi
je 0x6f33edf2
push esi
push 0xd101a0
jmp 0x6f33ee0f
push dword [ebp + 0x14]
push dword [ebp - 8]
push dword [ebp - 4]
push dword [ebp - 0x10]
call fcn.6f33d363
mov esi, eax
cmp esi, edi
je 0x6f33ee14
push esi
push 0xd801a0
call fcn.6f33d25f
cmp dword [ebp - 0xc], edi
je 0x6f33ee22
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], edi
je 0x6f33ee30
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push esi
call fcn.6f33f8d1
pop edi
pop esi
pop ebx
leave
ret 0x10