Function at 0x1006c471
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x34
mov eax, 0x100aaad5
call fcn.10002f91
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
xor edi, edi
lea ecx, [ebp - 0x3c]
push edi
push str.ShellNew
push dword [eax + 4]
mov dword [ebp - 4], edi
call fcn.10006b8d
push 0x20019
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 1
call fcn.10006cee
test eax, eax
jne 0x1006c6f5
mov dword [ebp - 0x18], edi
push edi
push str.NullFile
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x3c]
call fcn.100334f9
test eax, eax
jne 0x1006c546
push 0x17
push 0x100d4e78
push 0x100d4de8
lea ecx, [ebp - 0x14]
call fcn.10007692
push esi
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 3
push eax
call fcn.1006c3fb
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
push eax
mov byte [ebp - 4], 4
call fcn.10008fa9
test al, al
jne 0x1006c531
push dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
call fcn.1001ac62
mov ecx, dword [ebp - 0x14]
push esi
call fcn.1001acb8
mov ecx, dword [ebp - 0x14]
push 4
call fcn.1001afed
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
push eax
mov dword [ebp - 0x14], edi
call fcn.100174da
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 5
call fcn.10006c62
mov byte [ebp - 4], 8
jmp 0x1006c6e1
push edi
push str.FileName
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x3c]
call fcn.100334f9
test eax, eax
jne 0x1006c5f7
push 0x17
push 0x100d4e78
push 0x100d4de8
lea ecx, [ebp - 0x14]
call fcn.10007692
push esi
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 9
push eax
call fcn.1006c3fb
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
push eax
mov byte [ebp - 4], 0xa
call fcn.10008fa9
test al, al
jne 0x1006c5e2
push dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
call fcn.1001ac62
mov ecx, dword [ebp - 0x14]
push esi
call fcn.1001acb8
push dword [ebp - 0x18]
call fcn.10008fa9
mov ecx, dword [ebp - 0x14]
test al, al
je 0x1006c5c1
push 4
call fcn.1001afed
jmp 0x1006c5d3
push 1
call fcn.1001afed
push dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
call fcn.1001afbe
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
push eax
mov dword [ebp - 0x14], edi
call fcn.100174da
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0xb
call fcn.10006c62
mov byte [ebp - 4], 0xe
jmp 0x1006c6e1
push edi
push str.Command
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x3c]
call fcn.100334f9
test eax, eax
je 0x1006c6e9
push edi
push edi
lea eax, [ebp - 0x20]
mov ebx, 0x100c2034
push eax
push edi
push ebx
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1006c6e9
cmp dword [ebp - 0x20], 1
jne 0x1006c6e9
push edi
push ebx
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x3c]
call fcn.100334f9
test eax, eax
jne 0x1006c6e9
push 0x17
push 0x100d4e78
push 0x100d4de8
lea ecx, [ebp - 0x14]
call fcn.10007692
push esi
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 0xf
push eax
call fcn.1006c3fb
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
push eax
mov byte [ebp - 4], 0x10
call fcn.10008fa9
test al, al
jne 0x1006c6d1
push dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
call fcn.1001ac62
mov ecx, dword [ebp - 0x14]
push esi
call fcn.1001acb8
push dword [ebp - 0x18]
call fcn.10008fa9
mov ecx, dword [ebp - 0x14]
test al, al
je 0x1006c6b0
push 4
call fcn.1001afed
jmp 0x1006c6c2
push 2
call fcn.1001afed
push dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
call fcn.1001ac37
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
push eax
mov dword [ebp - 0x14], edi
call fcn.100174da
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x11
call fcn.10006c62
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x14]
call fcn.10026d23
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0x15
call fcn.10006c62
lea ecx, [ebp - 0x3c]
call fcn.10007405
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0x18
call fcn.10026d23
call fcn.100034a6
ret 0x10