Function at 0x1069add
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x454
mov eax, dword [0x1079e94]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x18]
push ebx
xor ebx, ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x1c]
cmp eax, ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x44c], ecx
mov dword [ebp - 0x440], edx
mov dword [ebp - 0x450], eax
mov dword [ebp - 0x428], Ordinal_11
mov dword [ebp - 0x424], ebx
mov dword [ebp - 0x444], ebx
mov dword [ebp - 0x41c], ebx
mov dword [ebp - 0x430], ebx
mov dword [ebp - 0x420], ebx
je 0x1069b44
mov dword [eax], ebx
cmp edx, ebx
je 0x1069b4a
mov dword [edx], ebx
cmp ecx, ebx
jne 0x1069b5e
mov edi, 0x80004003
push edi
push 0x8a101b5
jmp 0x106a19c
push 8
push esi
push 0x1002b24
mov dword [ecx], ebx
call fcn.01069a9d
cmp eax, ebx
mov dword [ebp - 0x438], eax
je 0x1069b87
test byte [ebp + 0x10], 4
je 0x1069b87
mov dword [ebp - 0x428], Ordinal_6
cmp edi, ebx
je 0x1069bed
lea eax, [ebp - 0x43c]
push eax
lea eax, [ebp - 0x430]
push eax
push edi
call fcn.01055c84
mov edi, eax
cmp edi, ebx
je 0x1069bb0
push edi
push 0x8b201b5
jmp 0x106a19c
cmp dword [ebp - 0x43c], ebx
jne 0x1069bed
lea eax, [ebp - 0x428]
push eax
push dword [ebp - 0x428]
push dword [ebp - 0x430]
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
mov edi, eax
cmp edi, ebx
je 0x1069bed
push edi
push 0x8b701b5
push dword [ebp - 0x430]
call fcn.0105364b
jmp 0x106a1a1
cmp dword [ebp - 0x438], ebx
jne 0x1069c70
lea eax, [ebp - 0x424]
push eax
mov eax, dword [ebp + 0x10]
and al, 2
neg al
mov ebx, 0x100d820
sbb eax, eax
and eax, 0xd0026
add eax, 0x20019
push eax
push 0
push ebx
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp edi, 2
jne 0x1069c61
test byte [ebp + 0x10], 8
je 0x1069c65
push eax
push 0x8c501b5
call fcn.01053610
lea eax, [ebp - 0x424]
push eax
push ebx
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov edi, eax
test edi, edi
je 0x1069c70
push edi
push 0x8c701b5
jmp 0x106a19c
test edi, edi
je 0x1069c70
push edi
push 0x8c901b5
jmp 0x106a19c
push 0x5c
push esi
call dword [sym.imp.msvcrt.dll_wcschr]
xor ebx, ebx
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0x43c], eax
mov edi, 0x10020c0
jne 0x1069d09
push 2
push esi
push 0x1003220
call fcn.01069a9d
test eax, eax
jne 0x1069d09
push 6
push esi
push 0x1012570
call fcn.01069a9d
test eax, eax
jne 0x1069d09
push 4
push esi
push 0x1012564
call fcn.01069a9d
test eax, eax
jne 0x1069d09
push 7
push esi
push 0x1012554
call fcn.01069a9d
test eax, eax
jne 0x1069d09
push 6
push esi
push edi
call fcn.01069a9d
test eax, eax
jne 0x1069d09
cmp dword [ebp - 0x438], ebx
jne 0x1069d11
mov eax, dword [ebp - 0x424]
mov dword [ebp - 0x418], esi
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x424], ebx
mov word [ebp - 0x20c], bx
jmp 0x1069f79
cmp dword [ebp - 0x438], ebx
je 0x1069d31
lea eax, [ebp - 0x20c]
add esi, 0x10
push 0x100bfa0
push eax
mov dword [ebp - 0x418], esi
call dword [sym.imp.msvcrt.dll_wcscpy]
jmp 0x1069f77
push 6
push esi
push edi
mov word [ebp - 0x20c], bx
call fcn.01069a9d
test eax, eax
mov ebx, 0x10093fc
jne 0x1069dab
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x434]
push eax
push 0
push ebx
push dword [ebp - 0x424]
mov dword [ebp - 0x42c], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test edi, edi
je 0x1069d89
push edi
push 0x8f601b5
jmp 0x1069f0a
cmp dword [ebp - 0x434], 1
je 0x1069dab
cmp dword [ebp - 0x434], 7
je 0x1069dab
mov edi, 0x8007000d
push edi
push 0x8fb01b5
jmp 0x1069f0a
push 2
push esi
push 0x1003220
call fcn.01069a9d
test eax, eax
je 0x1069dca
add esi, 4
mov dword [ebp - 0x418], esi
jmp 0x1069e84
push 6
push esi
push 0x1012570
call fcn.01069a9d
test eax, eax
je 0x1069de7
mov dword [ebp - 0x420], 0x100e634
jmp 0x1069e4c
push 4
push esi
push 0x1012564
call fcn.01069a9d
test eax, eax
je 0x1069e07
mov dword [ebp - 0x420], 0x101253c
add esi, 8
jmp 0x1069e4f
push 7
push esi
push 0x1012554
call fcn.01069a9d
test eax, eax
je 0x1069e37
lea eax, [ebp - 0x20c]
add esi, 0xe
push 0x1011430
push eax
mov dword [ebp - 0x418], esi
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
jmp 0x1069e84
push 6
push esi
push 0x10020c0
call fcn.01069a9d
test eax, eax
je 0x106a191
add esi, 0xc
cmp dword [ebp - 0x420], 0
mov dword [ebp - 0x418], esi
je 0x1069e84
mov esi, dword [sym.imp.msvcrt.dll_wcscat]
lea eax, [ebp - 0x20c]
push 0x1006b9c
push eax
call esi
push dword [ebp - 0x420]
lea eax, [ebp - 0x20c]
push eax
call esi
add esp, 0x10
cmp dword [ebp - 0x440], 0
je 0x1069f5b
lea eax, [ebp - 0x444]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
je 0x1069ec3
push edi
push 0x93f01b5
jmp 0x1069fd7
cmp dword [ebp - 0x420], 0
je 0x1069f79
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x434]
push eax
push 0
push ebx
push dword [ebp - 0x444]
mov dword [ebp - 0x42c], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test edi, edi
je 0x1069f10
push edi
push 0x94b01b5
push ebx
jmp 0x1069be3
cmp dword [ebp - 0x434], 1
je 0x1069f32
cmp dword [ebp - 0x434], 7
je 0x1069f32
mov edi, 0x8007000d
push edi
push 0x95001b5
jmp 0x1069fd7
mov edi, dword [sym.imp.msvcrt.dll_wcscat]
lea eax, [ebp - 0x20c]
push 0x1006b9c
push eax
call edi
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call edi
add esp, 0x10
jmp 0x1069f79
cmp dword [ebp - 0x43c], 0
je 0x1069f79
push dword [ebp - 0x43c]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
pop ecx
pop ecx
cmp dword [ebp - 0x41c], 0
jne 0x1069fe3
mov eax, dword [ebp - 0x424]
test eax, eax
jne 0x1069f92
mov eax, dword [ebp - 0x428]
lea ecx, [ebp - 0x454]
push ecx
lea ecx, [ebp - 0x41c]
push ecx
mov ecx, dword [ebp + 0x10]
and cl, 2
xor esi, esi
neg cl
push esi
sbb ecx, ecx
and ecx, 0xd0026
add ecx, 0x20019
push ecx
push esi
push esi
push esi
lea ecx, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
cmp edi, esi
je 0x1069fe3
push edi
push 0x97501b5
lea eax, [ebp - 0x20c]
push eax
jmp 0x1069be3
mov eax, dword [ebp - 0x418]
cmp word [eax], 0x5c
jne 0x1069ff7
inc eax
inc eax
mov dword [ebp - 0x418], eax
cmp dword [ebp - 0x440], 0
je 0x106a086
cmp word [eax], 0
je 0x106a086
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x448]
push eax
lea eax, [ebp - 0x414]
push eax
mov dword [ebp - 0x420], ebx
mov esi, 0x104
push ebx
jmp 0x106a066
push dword [ebp - 0x418]
lea eax, [ebp - 0x414]
push eax
call fcn.010559b5
test eax, eax
je 0x106a07a
inc dword [ebp - 0x420]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x448]
push eax
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x420]
push dword [ebp - 0x41c]
mov dword [ebp - 0x448], esi
call edi
test eax, eax
je 0x106a032
jmp 0x106a086
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
mov esi, dword [sym.imp.msvcrt.dll_wcslen]
lea eax, [ebp - 0x20c]
push eax
call esi
cmp dword [ebp - 0x438], 0
lea eax, [eax + eax + 2]
pop ecx
mov dword [ebp - 0x42c], eax
jne 0x106a0b6
test byte [ebp + 0x10], 1
je 0x106a0b6
add dword [ebp - 0x42c], 0x70
push dword [ebp - 0x42c]
mov edi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
push 0
call edi
test eax, eax
mov ebx, dword [ebp - 0x44c]
mov dword [ebx], eax
jne 0x106a0e2
mov edi, 0x8007000e
push edi
push 0x99d01b5
jmp 0x106a19c
and word [eax], 0
cmp dword [ebp - 0x438], 0
jne 0x106a104
test byte [ebp + 0x10], 1
je 0x106a104
push 0x1010598
push dword [ebx]
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
lea eax, [ebp - 0x20c]
push eax
push dword [ebx]
call dword [sym.imp.msvcrt.dll_wcscat]
cmp word [ebp - 0x20c], 0
pop ecx
pop ecx
jne 0x106a137
mov eax, dword [ebp - 0x42c]
mov ecx, dword [ebx]
shr eax, 1
lea eax, [ecx + eax*2 - 4]
cmp word [eax], 0x5c
jne 0x106a137
and word [eax], 0
mov ebx, dword [ebp - 0x440]
test ebx, ebx
je 0x106a175
push dword [ebp - 0x418]
call esi
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0
call edi
test eax, eax
mov dword [ebx], eax
jne 0x106a166
mov edi, 0x8007000e
push edi
push 0x9b301b5
jmp 0x106a19c
push dword [ebp - 0x418]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
mov eax, dword [ebp - 0x450]
xor edi, edi
cmp eax, edi
je 0x106a1a1
mov ecx, dword [ebp - 0x41c]
mov dword [eax], ecx
mov dword [ebp - 0x41c], edi
jmp 0x106a1a1
mov edi, 0x80070057
push edi
push 0x92901b5
call fcn.01053610
cmp dword [ebp - 0x428], 0x80000002
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x106a1c7
cmp dword [ebp - 0x428], 0x80000001
je 0x106a1c7
push dword [ebp - 0x428]
call esi
cmp dword [ebp - 0x424], 0
je 0x106a1d8
push dword [ebp - 0x424]
call esi
cmp dword [ebp - 0x444], 0
je 0x106a1e9
push dword [ebp - 0x444]
call esi
cmp dword [ebp - 0x41c], 0
je 0x106a1fa
push dword [ebp - 0x41c]
call esi
cmp dword [ebp - 0x430], 0
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
je 0x106a211
push dword [ebp - 0x430]
call esi
test edi, edi
je 0x106a241
mov ebx, dword [ebp - 0x44c]
test ebx, ebx
je 0x106a22b
mov eax, dword [ebx]
test eax, eax
je 0x106a22b
push eax
call esi
and dword [ebx], 0
mov ebx, dword [ebp - 0x440]
test ebx, ebx
je 0x106a241
mov eax, dword [ebx]
test eax, eax
je 0x106a241
push eax
call esi
and dword [ebx], 0
push edi
call fcn.0106d6ca
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0104b509
leave
ret 0x18