Function at 0x106666c
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x10d0640]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x410], 0
push esi
mov esi, dword [ebp + 0xc]
push edi
lea ecx, [ebp - 0x410]
push ecx
push 9
push 0
mov dword [ebp - 0x418], eax
mov eax, dword [ebp + 0x10]
push esi
push eax
mov dword [ebp - 0x41c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
je 0x10666d4
push edi
push 0x1012fe8
call fcn.0108bd70
push edi
push 0x410013a
push esi
call fcn.0108c53e
jmp 0x10669ab
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push ebx
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x414]
push eax
push 0
push 0x1012fd0
push dword [ebp - 0x410]
mov ebx, 0x400
mov dword [ebp - 0x40c], ebx
call esi
mov edi, eax
test edi, edi
je 0x106672b
push edi
push 0x1012fb0
call fcn.0108bd70
push edi
push 0x420013a
push 0x1012fd0
jmp 0x10669a5
mov eax, dword [ebp - 0x40c]
shr eax, 1
xor ecx, ecx
push 0x897
mov word [ebp + eax*2 - 0x408], cx
call fcn.0108bbbd
push eax
call fcn.0109c1c3
push dword [ebp - 0x41c]
push dword [ebp - 0x418]
push 0x1012f9c
call fcn.0109c1c3
add esp, 0x10
push 0x892
call fcn.0108bbbd
push eax
call fcn.0109c1c3
lea eax, [ebp - 0x408]
push eax
push 0x1008bc8
call fcn.0109c1c3
add esp, 0xc
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x414]
push eax
push 0
push 0x1012f8c
push dword [ebp - 0x410]
mov dword [ebp - 0x40c], ebx
call esi
mov edi, eax
test edi, edi
je 0x10667d5
push edi
push 0x1012fb0
call fcn.0108bd70
push edi
push 0x434013a
push 0x1012f8c
jmp 0x10669a5
mov eax, dword [ebp - 0x40c]
shr eax, 1
xor ecx, ecx
mov word [ebp + eax*2 - 0x408], cx
lea eax, [ebp - 0x408]
push eax
push 0x898
call fcn.0108bbbd
push eax
call fcn.0109c1c3
push 0x10042f8
call fcn.0109c1c3
add esp, 0xc
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x414]
push eax
push 0
push 0x1012f7c
push dword [ebp - 0x410]
mov dword [ebp - 0x40c], ebx
call esi
mov edi, eax
test edi, edi
jne 0x106687f
mov eax, dword [ebp - 0x40c]
shr eax, 1
xor ecx, ecx
mov word [ebp + eax*2 - 0x408], cx
lea eax, [ebp - 0x408]
push eax
push 0x1001d34
call fcn.0109c1c3
pop ecx
pop ecx
lea eax, [ebp - 0x408]
push eax
call fcn.010664e4
mov edi, eax
test edi, edi
je 0x10668a7
push edi
push 0x44a013a
call fcn.0108c503
jmp 0x10668a7
cmp edi, 2
jne 0x106697c
push 0x884
call fcn.0108bbbd
push eax
call fcn.0109c1c3
mov dword [esp], 0x10042f8
call fcn.0109c1c3
pop ecx
xor edi, edi
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x414]
push eax
mov dword [ebp - 0x40c], ebx
push 0
mov ebx, 0x1012f64
push ebx
push dword [ebp - 0x410]
call esi
mov esi, eax
test esi, esi
jne 0x1066923
mov eax, dword [ebp - 0x40c]
shr eax, 1
xor ecx, ecx
mov word [ebp + eax*2 - 0x408], cx
lea eax, [ebp - 0x408]
push eax
push 0x1001d34
call fcn.0109c1c3
pop ecx
pop ecx
lea eax, [ebp - 0x408]
push eax
call fcn.01066479
mov esi, eax
test esi, esi
je 0x1066947
push esi
push 0x468013a
lea eax, [ebp - 0x408]
push eax
call fcn.0108c53e
jmp 0x1066947
cmp esi, 2
jne 0x106694f
push 0x886
call fcn.0108bbbd
push eax
call fcn.0109c1c3
mov dword [esp], 0x10042f8
call fcn.0109c1c3
pop ecx
xor esi, esi
test edi, edi
jne 0x10669aa
mov edi, esi
jmp 0x10669aa
push esi
push 0x885
call fcn.0108bbbd
push eax
call fcn.0109c1c3
push 0x10042f8
call fcn.0109c1c3
add esp, 0xc
test edi, edi
jne 0x1066973
mov edi, esi
push esi
push 0x478013a
push ebx
jmp 0x10669a5
push edi
push 0x885
call fcn.0108bbbd
push eax
call fcn.0109c1c3
push 0x10042f8
call fcn.0109c1c3
add esp, 0xc
push edi
push 0x456013a
push 0x1012f7c
call fcn.0108c53e
pop ebx
push 0x10042f8
call fcn.0109c1c3
cmp dword [ebp - 0x410], 0
pop ecx
je 0x10669cb
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.01077d0b
leave
ret 0xc