Function at 0x6608116e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov ax, word [0x6610eff4]
push ebx
push esi
push edi
push dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
push 1
push ebx
push eax
push dword [ebp + 8]
call fcn.66080bd0
cmp eax, ebx
je 0x660811af
mov ecx, dword [ebp + 0x10]
mov dx, word [0x6610eff4]
mov word [ecx], dx
lea esp, [ebp - 0x30]
pop edi
pop esi
pop ebx
leave
ret 0xc
push dword [ebp + 0xc]
mov ax, word [0x6610eff0]
push 1
push ebx
push eax
push dword [ebp + 8]
call fcn.66080bd0
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x660813c3
mov ecx, dword [ebp + 0x10]
mov dx, word [0x6610eff0]
push eax
mov word [ecx], dx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
push ebx
mov dword [ebp - 0x14], ebx
call edi
lea esi, [eax + ebx + 1]
push esi
mov dword [ebp + 0x10], esi
call edi
mov ebx, eax
lea esi, [ebx + esi + 1]
push esi
mov dword [ebp - 0x10], esi
call edi
mov esi, dword [ebp - 8]
mov dword [ebp + 0xc], eax
lea eax, [ebp - 8]
push eax
push 0
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x6608122d
test eax, eax
mov dword [ebp - 8], esi
jne 0x6608136f
mov edx, dword [ebp + 0xc]
mov eax, dword [0x6610e6c4]
mov ecx, dword [eax]
lea edx, [ebx + edx + 0x204]
push edx
push eax
call dword [ecx + 0xc]
mov esi, eax
test esi, esi
mov dword [ebp - 4], esi
je 0x6608136f
lea eax, [esi + 0x101]
mov dword [ebp + 8], 0x100
mov dword [ebp + 0xc], eax
lea eax, [ebp + 8]
push eax
push esi
push 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x6608136f
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp + 0xc]
call esi
push dword [ebp - 4]
call edi
mov ecx, dword [ebp + 0xc]
push dword [ebp + 0x10]
add eax, ecx
lea edi, [eax + 1]
mov byte [eax], 0x20
push edi
call esi
push dword [ebp - 0x10]
lea eax, [ebx + edi]
mov byte [eax], 0x20
inc eax
push eax
call esi
mov esi, dword [ebp - 0x14]
mov eax, esi
shr eax, 0x10
test ax, ax
je 0x660813b1
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx + ecx + 2]
add eax, 3
and al, 0xfc
call fcn.660300e8
mov eax, esp
push esi
push eax
call fcn.660035d5
lea ecx, [ebp - 0x24]
push ecx
push eax
call fcn.66085dfa
mov esi, dword [ebp + 0xc]
mov eax, esi
shr eax, 0x10
test ax, ax
je 0x660813b8
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx + ecx + 2]
add eax, 3
and al, 0xfc
call fcn.660300e8
mov eax, esp
push esi
push eax
call fcn.660035d5
mov ebx, eax
mov esi, dword [ebp - 4]
mov eax, esi
shr eax, 0x10
test ax, ax
je 0x660813bf
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx + ecx + 2]
add eax, 3
and al, 0xfc
call fcn.660300e8
mov eax, esp
push esi
push eax
call fcn.660035d5
push ebx
push eax
xor eax, eax
push 0
push eax
push eax
push eax
push eax
push 1
sub esp, 0x10
lea esi, [ebp - 0x24]
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.66080d38
mov dword [ebp + 0xc], eax
xor esi, esi
cmp dword [ebp - 4], esi
je 0x66081384
mov eax, dword [0x6610e6c4]
push dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
cmp dword [ebp - 0xc], esi
je 0x6608139b
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [ebp - 8], esi
je 0x660813a9
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0xc]
jmp 0x660811a5
mov eax, esi
jmp 0x660812db
mov ebx, esi
jmp 0x6608131b
mov eax, esi
jmp 0x6608134f
push dword [ebp + 0xc]
mov ax, word [0x6610eff8]
push 1
push ebx
push eax
push dword [ebp + 8]
call fcn.66080bd0
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x6608136f
mov ecx, dword [ebp + 0x10]
mov dx, word [0x6610eff8]
push eax
mov word [ecx], dx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
mov dword [ebp + 0xc], esi
mov dword [ebp + 8], esi
shr dword [ebp + 0xc], 0x10
cmp word [ebp + 0xc], bx
je 0x660814d6
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx + ecx + 2]
add eax, 3
and al, 0xfc
call fcn.660300e8
mov eax, esp
push esi
push eax
call fcn.660035d5
lea ecx, [ebp - 0x24]
push ecx
push eax
call dword [sym.imp.ole32.dll_GetClassFile]
cmp eax, ebx
je 0x66081449
lea eax, [ebp - 0x24]
push eax
push 0x6604ff34
call fcn.66085dfa
mov eax, dword [0x6610e6c4]
mov esi, 0x100
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov ebx, eax
test ebx, ebx
mov dword [ebp - 4], ebx
je 0x6608136f
push 0
push esi
lea eax, [ebp - 0x24]
push ebx
push eax
call fcn.660815fc
cmp word [ebp + 0xc], 0
je 0x660814dd
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx + ecx + 2]
add eax, 3
and al, 0xfc
call fcn.660300e8
mov eax, esp
push dword [ebp + 8]
push eax
call fcn.660035d5
mov esi, eax
mov eax, ebx
shr eax, 0x10
test ax, ax
je 0x660814e2
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx + ecx + 2]
add eax, 3
and al, 0xfc
call fcn.660300e8
mov eax, esp
push ebx
push eax
call fcn.660035d5
push esi
jmp 0x66081350
mov eax, esi
jmp 0x6608142c
mov esi, dword [ebp + 8]
jmp 0x660814a3
mov eax, ebx
jmp 0x660814d0