Function at 0x1066d05
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x828
mov eax, dword [0x10d0620]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
dec eax
push edi
mov dword [ebp - 0x818], esi
mov dword [ebp - 0x810], esi
je 0x1066d38
push 0x88e
jmp 0x1066d3d
push 0x88d
call fcn.0108bc14
push eax
call fcn.0109c1a8
mov ebx, 0x1004310
push ebx
call fcn.0109c1a8
test byte [ebp + 8], 1
pop ecx
pop ecx
lea eax, [ebp - 0x818]
push eax
push 9
push esi
mov edi, 0x1013030
push edi
push 0
pop eax
setne al
add eax, 0x80000001
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x80c], eax
cmp eax, esi
je 0x1066dd3
push edi
push eax
push esi
push 0x1012fd8
call fcn.0108bcf3
push 0x88f
call fcn.0108bc14
push eax
call fcn.0109c1a8
push ebx
call fcn.0109c1a8
pop ecx
pop ecx
push dword [ebp - 0x80c]
push 0x62f013a
push edi
call fcn.0108c595
cmp dword [ebp - 0x80c], 2
jne 0x1066fcc
mov dword [ebp - 0x80c], esi
jmp 0x1066fcc
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [ebp - 0x828]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x404]
push eax
mov dword [ebp - 0x820], esi
mov ebx, 0x200
push esi
jmp 0x1066f0d
lea eax, [ebp - 0x810]
push eax
push 9
push esi
lea eax, [ebp - 0x404]
push eax
push dword [ebp - 0x818]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x808], eax
cmp eax, esi
jne 0x1066f60
lea eax, [ebp - 0x828]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x804]
push eax
mov dword [ebp - 0x81c], esi
push esi
jmp 0x1066eb4
push dword [ebp - 0x810]
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x404]
push eax
call fcn.0106671d
mov dword [ebp - 0x808], eax
cmp eax, esi
je 0x1066e7c
push eax
push 0x67a013a
call fcn.0108c55a
cmp dword [ebp - 0x80c], esi
jne 0x1066e90
mov eax, dword [ebp - 0x808]
mov dword [ebp - 0x80c], eax
inc dword [ebp - 0x81c]
lea eax, [ebp - 0x828]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x804]
push eax
push dword [ebp - 0x81c]
push dword [ebp - 0x810]
mov dword [ebp - 0x814], ebx
call edi
mov dword [ebp - 0x808], eax
cmp eax, esi
je 0x1066e4e
cmp eax, 0x103
jne 0x1066f98
push dword [ebp - 0x810]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x820]
lea eax, [ebp - 0x828]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x404]
push eax
push dword [ebp - 0x820]
mov dword [ebp - 0x810], esi
push dword [ebp - 0x818]
mov dword [ebp - 0x814], ebx
call edi
mov dword [ebp - 0x808], eax
cmp eax, esi
je 0x1066e02
cmp eax, 0x103
je 0x1066fcc
push eax
push 0x1013010
call fcn.0108bdc7
cmp dword [ebp - 0x80c], esi
jne 0x1066f53
mov eax, dword [ebp - 0x808]
mov dword [ebp - 0x80c], eax
push dword [ebp - 0x808]
push 0x64f013a
jmp 0x1066fc7
push eax
push 0x1012fd8
call fcn.0108bdc7
cmp dword [ebp - 0x80c], esi
jne 0x1066f7f
mov eax, dword [ebp - 0x808]
mov dword [ebp - 0x80c], eax
push dword [ebp - 0x808]
lea eax, [ebp - 0x404]
push 0x65e013a
push eax
call fcn.0108c595
jmp 0x1066fcc
push dword [ebp - 0x808]
push 0x1013010
call fcn.0108bdc7
cmp dword [ebp - 0x80c], esi
jne 0x1066fbc
mov eax, dword [ebp - 0x808]
mov dword [ebp - 0x80c], eax
push dword [ebp - 0x808]
push 0x677013a
call fcn.0108c55a
cmp dword [ebp - 0x810], esi
je 0x1066fe0
push dword [ebp - 0x810]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x818], esi
pop edi
pop esi
pop ebx
je 0x1066ff7
push dword [ebp - 0x818]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x80c]
xor ecx, ebp
call fcn.01077dc7
leave
ret 4