Function at 0x6f338862
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x800]
sub esp, 0x880
mov eax, dword [0x6f34110c]
mov ecx, dword [ebp + 0x814]
or dword [ebp - 0x74], 0xffffffff
mov dword [ebp + 0x7fc], eax
xor eax, eax
cmp dword [ebp + 0x818], ecx
push esi
push edi
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x70], eax
jae 0x6f3388af
mov esi, 0x80070057
push esi
push 0x106025e
call fcn.6f33d25f
jmp 0x6f338a74
mov edi, dword [sym.imp.msvcrt.dll_wcscpy]
push ebx
mov ebx, dword [ebp + 0x808]
cmp ebx, eax
mov word [ebp + 0x5f4], ax
je 0x6f3388f5
jmp 0x6f3388cb
inc ebx
inc ebx
cmp word [ebx], 0x5c
je 0x6f3388c9
lea eax, [ebp + 0x5f4]
push ebx
push eax
call edi
lea eax, [ebp + 0x5f4]
push 0x5c
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
add esp, 0x10
test eax, eax
je 0x6f3388f5
and word [eax], 0
mov eax, dword [ebp + 0x810]
test eax, eax
jne 0x6f33897b
cmp dword [ebp + 0x80c], eax
jne 0x6f33891c
mov esi, 0x80004003
push esi
push 0x121025e
call fcn.6f33d25f
jmp 0x6f338a73
lea eax, [ebp + 0x808]
push eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x80]
push eax
push 0
push 0x6f331e18
push dword [ebp + 0x80c]
mov dword [ebp + 0x808], 0x410
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
je 0x6f338956
push esi
push 0x12b025e
jmp 0x6f338912
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0x5f4]
push eax
call fcn.6f33dd71
mov esi, eax
test esi, esi
je 0x6f338978
push esi
push 0x133025e
jmp 0x6f338912
mov eax, dword [ebp - 0x78]
test ebx, ebx
jne 0x6f33899d
lea ecx, [ebp - 0x7c]
push ecx
push eax
call fcn.6f33de67
mov esi, eax
test esi, esi
je 0x6f33899a
push esi
push 0x13d025e
jmp 0x6f338912
mov eax, dword [ebp - 0x7c]
lea ecx, [ebp - 0x70]
push ecx
push 0
push 0x6f331e04
push eax
call fcn.6f33dcce
mov esi, eax
test esi, esi
je 0x6f3389bf
push esi
push 0x14d025e
jmp 0x6f338912
push dword [ebp - 0x70]
lea eax, [ebp - 0x6c]
push eax
call edi
lea eax, [ebp - 0x6c]
push 0x5c
push eax
call dword [sym.imp.msvcrt.dll_wcsrchr]
add esp, 0x10
mov esi, eax
lea eax, [ebp + 0x3a4]
push eax
push dword [ebp - 0x70]
inc esi
inc esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x74], eax
je 0x6f338a71
push 0x10
lea eax, [ebp + 0x3d6]
push 0
push eax
call dword [sym.imp.msvcrt.dll_wcstoul]
add esp, 0xc
cmp eax, dword [ebp + 0x814]
jb 0x6f338a17
cmp eax, dword [ebp + 0x818]
jbe 0x6f338a31
lea eax, [ebp + 0x3d0]
push eax
push esi
call edi
pop ecx
pop ecx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x6f338a5f
lea eax, [ebp + 0x3a4]
push eax
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x6f3389f3
call fcn.6f33f8fc
mov esi, eax
cmp esi, 0x80070012
je 0x6f338a71
push esi
push 0x17b025e
jmp 0x6f338912
call fcn.6f33f8fc
mov esi, eax
push esi
push 0x16f025e
jmp 0x6f338912
xor esi, esi
pop ebx
cmp dword [ebp - 0x78], 0
mov edi, dword [sym.imp.KERNEL32.dll_LocalFree]
je 0x6f338a85
push dword [ebp - 0x78]
call edi
cmp dword [ebp - 0x7c], 0
je 0x6f338a90
push dword [ebp - 0x7c]
call edi
cmp dword [ebp - 0x70], 0
je 0x6f338a9b
push dword [ebp - 0x70]
call edi
cmp dword [ebp - 0x74], 0xffffffff
je 0x6f338aaa
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x7fc]
pop edi
mov eax, esi
pop esi
call fcn.6f339880
add ebp, 0x800
leave
ret 0x14