Function at 0x1006f112
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x538
mov eax, dword [0x1007641c]
push ebx
xor ebx, ebx
cmp byte [0x1007679d], bl
mov dword [ebp - 4], eax
jne 0x1006f3f7
push edi
mov edi, 0x104
push edi
lea eax, [ebp - 0x518]
push eax
push ebx
mov byte [0x1007679d], 1
mov byte [0x100769e0], bl
call fcn.1006ed87
cmp eax, ebx
jbe 0x1006f3f6
push esi
mov dword [ebp - 0x520], 1
lea esi, [ebp + eax*2 - 0x518]
jmp 0x1006f17f
cmp word [esi], 0x5c
je 0x1006f195
dec esi
dec esi
inc dword [ebp - 0x520]
lea eax, [ebp - 0x518]
cmp esi, eax
mov dword [ebp - 0x530], esi
jne 0x1006f171
cmp word [esi], 0x5c
jne 0x1006f1a3
dec dword [ebp - 0x520]
inc esi
inc esi
mov dword [ebp - 0x530], esi
cmp dword [ebp - 0x520], ebx
jbe 0x1006f3f5
cmp dword [0x10076a54], 2
lea eax, [ebp - 0x524]
push eax
push 9
mov dword [ebp - 0x524], ebx
mov dword [ebp - 0x52c], ebx
push ebx
jne 0x1006f1e1
push dword [0x100763f0]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
jmp 0x1006f1f2
push dword [0x100763f4]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x1006f3d5
mov dword [ebp - 0x51c], ebx
cmp dword [0x10076a54], 2
push ebx
push ebx
push ebx
mov dword [ebp - 0x534], edi
mov word [ebp - 0x310], bx
push ebx
jne 0x1006f244
lea eax, [ebp - 0x534]
push eax
lea eax, [ebp - 0x310]
push eax
push dword [ebp - 0x51c]
push dword [ebp - 0x524]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
mov eax, dword [ebp - 0x534]
jmp 0x1006f29d
lea eax, [ebp - 0x528]
push eax
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x51c]
mov dword [ebp - 0x528], edi
push dword [ebp - 0x524]
mov byte [ebp - 0x108], bl
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov esi, eax
cmp esi, ebx
jne 0x1006f3bb
push ebx
push edi
lea eax, [ebp - 0x310]
push eax
push dword [ebp - 0x528]
lea eax, [ebp - 0x108]
push eax
push ebx
push ebx
call fcn.1006e089
mov dword [ebp - 0x534], eax
cmp esi, ebx
jne 0x1006f3bb
cmp eax, ebx
jbe 0x1006f3bb
inc dword [ebp - 0x51c]
mov ecx, 0x103
cmp eax, ecx
jl 0x1006f2c4
mov eax, ecx
mov dword [ebp - 0x534], eax
mov word [ebp + eax*2 - 0x310], bx
inc eax
cmp eax, dword [ebp - 0x520]
jne 0x1006f200
lea eax, [ebp - 0x310]
push eax
push dword [ebp - 0x530]
call fcn.1006cf97
test eax, eax
jne 0x1006f200
cmp dword [0x10076a54], 2
lea eax, [ebp - 0x51c]
push eax
push 1
mov dword [ebp - 0x51c], ebx
mov byte [0x100769e0], 1
push ebx
jne 0x1006f328
lea eax, [ebp - 0x310]
push eax
push dword [ebp - 0x524]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
jmp 0x1006f33b
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x524]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x1006f39d
cmp dword [0x10076a54], 2
lea eax, [ebp - 0x528]
push eax
lea eax, [ebp - 0x52c]
push eax
lea eax, [ebp - 0x538]
push eax
mov dword [ebp - 0x528], 4
push ebx
jne 0x1006f37b
push 0x10006610
push dword [ebp - 0x51c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x1006f38c
push 0x10006604
push dword [ebp - 0x51c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x1006f39d
mov al, byte [ebp - 0x52c]
and al, 1
mov byte [0x100769e0], al
cmp dword [ebp - 0x51c], ebx
je 0x1006f3b1
push dword [ebp - 0x51c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x52c], 1
push dword [ebp - 0x524]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x52c], ebx
jne 0x1006f3f5
mov esi, dword [ebp - 0x530]
cmp dword [ebp - 0x520], 0xc
jne 0x1006f3f5
push dword [0x100763f8]
push esi
call fcn.1006cf97
test eax, eax
jne 0x1006f3f5
mov byte [0x100769e0], 1
pop esi
pop edi
mov ecx, dword [ebp - 4]
movzx eax, byte [0x100769e0]
pop ebx
call fcn.1007344b
leave
ret