Function at 0x66081dae
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov ax, word [0x6611000c]
push ebx
push esi
push edi
push dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
push 1
push ebx
push eax
push dword [ebp + 8]
call fcn.66081810
cmp eax, ebx
je 0x66081def
mov ecx, dword [ebp + 0x10]
mov dx, word [0x6611000c]
mov word [ecx], dx
lea esp, [ebp - 0x30]
pop edi
pop esi
pop ebx
leave
ret 0xc
push dword [ebp + 0xc]
mov ax, word [0x66110008]
push 1
push ebx
push eax
push dword [ebp + 8]
call fcn.66081810
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x66082003
mov ecx, dword [ebp + 0x10]
mov dx, word [0x66110008]
push eax
mov word [ecx], dx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
push ebx
mov dword [ebp - 0x14], ebx
call edi
lea esi, [eax + ebx + 1]
push esi
mov dword [ebp + 0x10], esi
call edi
mov ebx, eax
lea esi, [ebx + esi + 1]
push esi
mov dword [ebp - 0x10], esi
call edi
mov esi, dword [ebp - 8]
mov dword [ebp + 0xc], eax
lea eax, [ebp - 8]
push eax
push 0
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x66081e6d
test eax, eax
mov dword [ebp - 8], esi
jne 0x66081faf
mov edx, dword [ebp + 0xc]
mov eax, dword [0x6610f6c4]
mov ecx, dword [eax]
lea edx, [edx + ebx + 0x204]
push edx
push eax
call dword [ecx + 0xc]
mov esi, eax
test esi, esi
mov dword [ebp - 4], esi
je 0x66081faf
lea eax, [esi + 0x101]
mov dword [ebp + 8], 0x100
mov dword [ebp + 0xc], eax
lea eax, [ebp + 8]
push eax
push esi
push 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x66081faf
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp + 0xc]
call esi
push dword [ebp - 4]
call edi
mov ecx, dword [ebp + 0xc]
push dword [ebp + 0x10]
add eax, ecx
lea edi, [eax + 1]
mov byte [eax], 0x20
push edi
call esi
push dword [ebp - 0x10]
lea eax, [ebx + edi]
mov byte [eax], 0x20
inc eax
push eax
call esi
mov esi, dword [ebp - 0x14]
mov eax, esi
shr eax, 0x10
test ax, ax
je 0x66081ff1
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx + ecx + 2]
add eax, 3
and al, 0xfc
call fcn.660300d8
mov eax, esp
push esi
push eax
call fcn.660035e5
lea ecx, [ebp - 0x24]
push ecx
push eax
call fcn.66086a9a
mov esi, dword [ebp + 0xc]
mov eax, esi
shr eax, 0x10
test ax, ax
je 0x66081ff8
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx + ecx + 2]
add eax, 3
and al, 0xfc
call fcn.660300d8
mov eax, esp
push esi
push eax
call fcn.660035e5
mov ebx, eax
mov esi, dword [ebp - 4]
mov eax, esi
shr eax, 0x10
test ax, ax
je 0x66081fff
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx + ecx + 2]
add eax, 3
and al, 0xfc
call fcn.660300d8
mov eax, esp
push esi
push eax
call fcn.660035e5
push ebx
push eax
xor eax, eax
push 0
push eax
push eax
push eax
push eax
push 1
sub esp, 0x10
lea esi, [ebp - 0x24]
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.66081978
mov dword [ebp + 0xc], eax
xor esi, esi
cmp dword [ebp - 4], esi
je 0x66081fc4
mov eax, dword [0x6610f6c4]
push dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
cmp dword [ebp - 0xc], esi
je 0x66081fdb
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [ebp - 8], esi
je 0x66081fe9
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0xc]
jmp 0x66081de5
mov eax, esi
jmp 0x66081f1b
mov ebx, esi
jmp 0x66081f5b
mov eax, esi
jmp 0x66081f8f
push dword [ebp + 0xc]
mov ax, word [0x66110010]
push 1
push ebx
push eax
push dword [ebp + 8]
call fcn.66081810
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x66081faf
mov ecx, dword [ebp + 0x10]
mov dx, word [0x66110010]
push eax
mov word [ecx], dx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
mov dword [ebp + 0xc], esi
mov dword [ebp + 8], esi
shr dword [ebp + 0xc], 0x10
cmp word [ebp + 0xc], bx
je 0x66082116
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx + ecx + 2]
add eax, 3
and al, 0xfc
call fcn.660300d8
mov eax, esp
push esi
push eax
call fcn.660035e5
lea ecx, [ebp - 0x24]
push ecx
push eax
call dword [sym.imp.ole32.dll_GetClassFile]
cmp eax, ebx
je 0x66082089
lea eax, [ebp - 0x24]
push eax
push 0x6604fd4c
call fcn.66086a9a
mov eax, dword [0x6610f6c4]
mov esi, 0x100
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov ebx, eax
test ebx, ebx
mov dword [ebp - 4], ebx
je 0x66081faf
push 0
push esi
lea eax, [ebp - 0x24]
push ebx
push eax
call fcn.6608223c
cmp word [ebp + 0xc], 0
je 0x6608211d
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx + ecx + 2]
add eax, 3
and al, 0xfc
call fcn.660300d8
mov eax, esp
push dword [ebp + 8]
push eax
call fcn.660035e5
mov esi, eax
mov eax, ebx
shr eax, 0x10
test ax, ax
je 0x66082122
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx + ecx + 2]
add eax, 3
and al, 0xfc
call fcn.660300d8
mov eax, esp
push ebx
push eax
call fcn.660035e5
push esi
jmp 0x66081f90
mov eax, esi
jmp 0x6608206c
mov esi, dword [ebp + 8]
jmp 0x660820e3
mov eax, ebx
jmp 0x66082110