Function at 0x10006c90
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xec
mov eax, dword [0x1002f2a4]
xor eax, ebp
mov dword [ebp - 4], eax
push dword [ebp + 8]
lea eax, [ebp - 0xd0]
push 0
push 1
push 0
push 0x80000000
push eax
call fcn.10006130
add esp, 0x18
test eax, eax
jne 0x10006f58
push str.SoftwareClasses
lea eax, [ebp - 0xd0]
push 0x80000001
push eax
call fcn.10005f90
push str.SoftwareClasses
lea eax, [ebp - 0xd0]
push 0x80000002
push eax
call fcn.10005f90
push 0
lea eax, [ebp - 0xd0]
push 0x80000000
push eax
call fcn.10005f90
lea eax, [ebp - 0xd0]
push eax
call fcn.10006780
lea eax, [ebp - 0xd0]
push eax
call fcn.10006370
mov ecx, dword [ebp - 0xa0]
add esp, 0x2c
test ecx, ecx
je 0x10006f58
push ebx
lea eax, [ecx + ecx*2]
push esi
lea eax, [ebp + eax*4 - 0xc4]
push edi
nop dword [eax]
dec ecx
sub eax, 0xc
mov dword [ebp - 0xe8], ecx
lea ecx, [ebp - 0xe0]
push ecx
push dword [ebp - 0x94]
mov dword [ebp - 0xec], eax
push 0
push str.TypeLib
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10006f40
mov eax, str.46137EEC_703B_4FE5_AFD4_7C9BBBBA0259
nop dword [eax]
lea ecx, [ebp - 0xd4]
sub eax, 4
push ecx
push dword [ebp - 0x94]
mov dword [ebp - 0xe4], eax
push 0
push dword [eax]
push dword [ebp - 0xe0]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10006f2f
mov edi, 0x100234d0
lea eax, [ebp - 0xd8]
sub edi, 4
push eax
push 0x20019
push 0
push dword [edi]
push dword [ebp - 0xd4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10006ef5
lea eax, [ebp - 0xdc]
mov dword [ebp - 0xdc], 0x7f
push eax
lea eax, [ebp - 0x84]
push eax
push 0
push 0
push 0
push dword [ebp - 0xd8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0xd8]
mov ebx, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
test esi, esi
je 0x10006e85
push 0xb80010
call dword [sym.imp.VBoxRT_x86.dll_RTLogRelGetDefaultInstanceEx]
add esp, 4
test eax, eax
je 0x10006e51
push 0
push str.long___cdecl_vbpsCloseKey_struct_VBPSREGSTATE__struct_HKEY____unsigned_int_
push 0x336
push str.C:DevelAntidetect4PersonalVirtualBox_srcVBoxMain_src_allwinVBoxProxyStub.c
push str.AssertLogRel__s__d___s:__s_n
push 0xb8
push 0x10
push eax
call dword [sym.imp.VBoxRT_x86.dll_RTLogLoggerEx]
add esp, 0x20
push 0xb80010
call dword [sym.imp.VBoxRT_x86.dll_RTLogRelGetDefaultInstanceEx]
add esp, 4
test eax, eax
je 0x10006e7f
push esi
push 0x865
push str._d:_close_key_____u_n
push 0xb8
push 0x10
push eax
call dword [sym.imp.VBoxRT_x86.dll_RTLogLoggerEx]
add esp, 0x18
mov dword [ebp - 0x9c], esi
test ebx, ebx
jne 0x10006ef5
mov eax, dword [ebp - 0xdc]
cmp eax, 0x80
jae 0x10006f75
mov byte [ebp + eax - 0x84], bl
lea ecx, [ebp - 0x84]
mov eax, str.VirtualBox_Type_Library
nop dword [eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x10006ed0
test dl, dl
je 0x10006ecc
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x10006ed0
add ecx, 2
add eax, 2
test dl, dl
jne 0x10006eb0
xor eax, eax
jmp 0x10006ed5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x10006ef5
push 0x86f
push dword [edi]
lea eax, [ebp - 0xd0]
push dword [ebp - 0xd4]
push eax
call fcn.10005b40
add esp, 0x10
cmp edi, 0x100234c8
ja 0x10006db3
push 0x874
push dword [ebp - 0xd4]
lea eax, [ebp - 0xd0]
push eax
call fcn.10004cf0
mov eax, dword [ebp - 0xe4]
add esp, 0xc
push dword [eax]
push dword [ebp - 0xe0]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov eax, dword [ebp - 0xe4]
cmp eax, 0x10023420
ja 0x10006d80
mov ecx, dword [ebp - 0xe8]
test ecx, ecx
je 0x10006f55
mov eax, dword [ebp - 0xec]
jmp 0x10006d40
pop edi
pop esi
pop ebx
lea eax, [ebp - 0xd0]
push eax
call fcn.100062c0
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
call fcn.10008170
mov esp, ebp
pop ebp
ret
call fcn.10008093
int3