Function at 0x1006cfd0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d8871
mov eax, dword fs:[0]
push eax
sub esp, 0x90
mov eax, dword [0x101120a8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x48
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x14], 0
push 0
push eax
call fcn.1008da10
add dword [sym.XNewLookSch.dll_unsigned_int_LString::_ui_instance_count], 2
xor eax, eax
add esp, 0xc
mov dword [ebp - 0x50], vtable.LString.0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 7
mov word [ebp - 0x4c], ax
mov dword [ebp - 0x34], vtable.LString.0
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 7
mov word [ebp - 0x30], ax
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], al
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
sub esp, 0x34
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], 0x200
push 0x6b
push 0x6f
push 0x6f
push 0x4c
push 0x77
push 0x65
push 0x4e
push 0x58
sub esp, 0x20
lea ecx, [ebp - 0x90]
call fcn.1006d460
add esp, 0x138
xor ecx, ecx
mov dword [ebp - 0x78], vtable.LString.0
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 7
mov word [ebp - 0x74], cx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x74]
inc dword [sym.XNewLookSch.dll_unsigned_int_LString::_ui_instance_count]
cmp ecx, eax
je 0x1006d0f5
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0x1006d0e9
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x74]
call fcn.10002b70
push 0x2001f
push connect
push 1
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x5c]
call sym.XNewLookSch.dll_public:_bool___thiscall_LRegEdit::OpenDir_class_LString_const___bool__struct_HKEY_____unsigned_long_int_
lea ecx, [ebp - 0x78]
call sym.XNewLookSch.dll_public_virtual:_void___thiscall_LString::destructor_void_
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x7c]
cmp edx, 8
jb 0x1006d15a
mov ecx, dword [ebp - 0x90]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1006d150
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1006d422
push edx
push ecx
call fcn.1008bfe4
add esp, 8
xor eax, eax
mov dword [ebp - 0x94], vtable.LString.0
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x7c], 7
mov word [ebp - 0x90], ax
push 7
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x90]
inc dword [sym.XNewLookSch.dll_unsigned_int_LString::_ui_instance_count]
push str.Channel
call fcn.10002b70
mov byte [ebp - 4], 0
cmp byte [ebp - 0x58], 0
mov dword [ebp - 0x5c], 0
je 0x1006d1f4
cmp dword [ebp - 0x7c], 8
lea ecx, [ebp - 0x98]
push ecx
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x9c], 4
push ecx
lea ecx, [ebp - 0x9c]
mov dword [ebp - 0x98], 4
push ecx
lea eax, [ebp - 0x90]
cmovae eax, dword [ebp - 0x90]
push 0
push eax
push dword [ebp - 0x54]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x5c], eax
lea ecx, [ebp - 0x94]
call sym.XNewLookSch.dll_public_virtual:_void___thiscall_LString::destructor_void_
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x1006d230
mov al, byte [ebp - 0x58]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x5c], 0
test al, al
je 0x1006d3da
push dword [ebp - 0x54]
call edi
mov esi, dword [ebp - 0x14]
xor al, al
mov byte [ebp - 0x58], al
jmp 0x1006d3da
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
sub esp, 0x34
lea ecx, [ebp - 0x90]
push 0x6b
push 0x6f
push 0x6f
push 0x4c
push 0x77
push 0x65
push 0x4e
push 0x58
sub esp, 0x20
call fcn.1006d460
add esp, 0x138
xor ecx, ecx
mov dword [ebp - 0x78], vtable.LString.0
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 7
mov word [ebp - 0x74], cx
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x74]
inc dword [sym.XNewLookSch.dll_unsigned_int_LString::_ui_instance_count]
cmp ecx, eax
je 0x1006d2fb
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0x1006d2ef
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x74]
call fcn.10002b70
push 0x2001f
push reloc.OLEAUT32.dll_SysReAllocString
push 1
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 7
push eax
lea ecx, [ebp - 0x5c]
call sym.XNewLookSch.dll_public:_bool___thiscall_LRegEdit::OpenDir_class_LString_const___bool__struct_HKEY_____unsigned_long_int_
lea ecx, [ebp - 0x78]
call sym.XNewLookSch.dll_public_virtual:_void___thiscall_LString::destructor_void_
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x7c]
cmp edx, 8
jb 0x1006d360
mov ecx, dword [ebp - 0x90]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1006d356
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1006d427
push edx
push ecx
call fcn.1008bfe4
add esp, 8
xor eax, eax
mov dword [ebp - 0x78], vtable.LString.0
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 7
mov word [ebp - 0x74], ax
push 7
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x74]
inc dword [sym.XNewLookSch.dll_unsigned_int_LString::_ui_instance_count]
push str.Channel
call fcn.10002b70
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x78]
push eax
lea ecx, [ebp - 0x5c]
call sym.XNewLookSch.dll_public:_bool___thiscall_LRegEdit::GetDWORD_class_LString_const___unsigned_long_int__
lea ecx, [ebp - 0x78]
call sym.XNewLookSch.dll_public_virtual:_void___thiscall_LString::destructor_void_
mov al, byte [ebp - 0x58]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x5c], 0
test al, al
je 0x1006d3ca
push dword [ebp - 0x54]
call edi
xor al, al
mov byte [ebp - 0x58], al
mov esi, dword [ebp - 0x14]
mov ecx, 0x63
test esi, esi
cmove esi, ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x5c], 0
test al, al
je 0x1006d3f5
push dword [ebp - 0x54]
call edi
mov dword [ebp - 0x5c], 0
mov byte [ebp - 0x58], 0
lea ecx, [ebp - 0x34]
call sym.XNewLookSch.dll_public_virtual:_void___thiscall_LString::destructor_void_
lea ecx, [ebp - 0x50]
call sym.XNewLookSch.dll_public_virtual:_void___thiscall_LString::destructor_void_
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1008bffe
mov esp, ebp
pop ebp
ret
call fcn.10092486
call fcn.10092486
int3