Function at 0x10006185
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1001f5d0
mov eax, dword fs:[0]
push eax
sub esp, 0x280
mov eax, dword [0x1002c018]
xor eax, esp
mov dword [esp + 0x278], eax
push ebx
push esi
push edi
mov eax, dword [0x1002c018]
xor eax, esp
push eax
lea eax, [esp + 0x290]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
lea ecx, [esp + 0x44]
mov dword [esp + 0x14], eax
call dword [sym.imp.Utility.dll_public:_void___thiscall_util::CRegistry::constructor_void_]
xor ebx, ebx
mov dword [esp + 0x298], ebx
cmp dword [esi + 0x20], 8
push 0xf003f
push ebx
jb 0x100061f3
mov eax, dword [esi + 0xc]
jmp 0x100061f6
lea eax, [esi + 0xc]
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x34], esp
push eax
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
lea ecx, [esp + 0x68]
call dword [sym.imp.Utility.dll_public:_struct_HKEY______thiscall_util::CRegistry::SetFullKey_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t____int__unsigned_long_int_]
mov dword [esp + 0x10], eax
cmp eax, ebx
je 0x1000635e
inc dword [esi + 0x24]
mov edi, dword [esi + 0x24]
xor eax, eax
push 0x206
mov word [esp + 0x80], ax
lea eax, [esp + 0x82]
push ebx
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x90]
push eax
push edi
push dword [esp + 0x2c]
mov dword [esp + 0x38], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, ebx
jne 0x10006354
cmp dword [esi + 0x20], 8
jb 0x10006279
mov esi, dword [esi + 0xc]
jmp 0x1000627c
add esi, 0xc
lea eax, [esp + 0x7c]
push eax
push esi
lea eax, [esp + 0x24]
push 0x10023608
push eax
call dword [sym.imp.Utility.dll_public:_static_class_util::AutoPtr_wchar_t____cdecl_util::StringHelper::FormatW_wchar_t_const__]
add esp, 0x10
mov byte [esp + 0x298], 1
push dword [eax]
lea ecx, [esp + 0x2c]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
mov byte [esp + 0x298], 3
push dword [esp + 0x1c]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov edi, dword [esp + 0x14]
mov esi, dword [edi]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
cmp esi, ebx
je 0x100062e9
sub esp, 0x1c
lea eax, [esp + 0x44]
mov ecx, esp
mov dword [esp + 0x30], esp
push eax
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
mov eax, dword [esi]
push esi
call dword [eax + 0x38]
jmp 0x10006322
push 0x24
call sub.MSVCR90.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
pop ecx
mov dword [esp + 0x14], esi
mov byte [esp + 0x298], 4
cmp esi, ebx
je 0x1000631e
sub esp, 0x1c
lea eax, [esp + 0x44]
mov ecx, esp
mov dword [esp + 0x40], esp
push eax
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
call fcn.10004f93
jmp 0x10006320
xor eax, eax
mov dword [edi], eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x298], bl
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [esp + 0x298], 0xffffffff
lea ecx, [esp + 0x44]
call dword [sym.imp.Utility.dll_public_virtual:_void___thiscall_util::CRegistry::destructor_void_]
xor eax, eax
inc eax
jmp 0x10006372
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [esp + 0x298], 0xffffffff
lea ecx, [esp + 0x44]
call dword [sym.imp.Utility.dll_public_virtual:_void___thiscall_util::CRegistry::destructor_void_]
xor eax, eax
mov ecx, dword [esp + 0x290]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x278]
xor ecx, esp
call fcn.1001da62
mov esp, ebp
pop ebp
ret 8