Function at 0x1006c130
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100de6a9
mov eax, dword fs:[0]
push eax
sub esp, 0x34c
mov eax, dword [0x1010e07c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2a4], eax
mov edi, ecx
mov dword [ebp - 0x2a8], edi
mov esi, edx
mov dword [ebp - 0x2ac], esi
xor ebx, ebx
mov dword [ebp - 0x2a0], ebx
mov dword [ebp - 0x29c], ebx
mov dword [ebp - 0x298], ebx
mov dword [ebp - 4], ebx
cmp dword [esi + 0x14], 8
jb 0x1006c19b
mov eax, dword [esi]
jmp 0x1006c19d
mov eax, esi
push 0x20219
push eax
push edi
lea ecx, [ebp - 0x2a0]
call fcn.10008480
test eax, eax
jne 0x1006c465
xor ecx, ecx
mov word [ebp - 0x220], cx
push 0x206
push ebx
lea edx, [ebp - 0x21e]
push edx
call fcn.100b2ed0
add esp, 0xc
mov dword [ebp - 0x294], 0x104
xor esi, esi
lea eax, [ebp - 0x2b8]
push eax
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x294]
push ecx
lea edx, [ebp - 0x220]
push edx
push esi
mov edi, dword [ebp - 0x2a0]
push edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1006c442
inc esi
mov dword [ebp - 0x2b0], esi
mov dword [ebp - 0x294], 0x104
mov edi, 7
mov dword [ebp - 0x228], edi
mov dword [ebp - 0x22c], ebx
mov word [ebp - 0x23c], ax
lea eax, [ebp - 0x220]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1006c241
sub eax, edx
sar eax, 1
push eax
lea ecx, [ebp - 0x220]
push ecx
lea ecx, [ebp - 0x23c]
call fcn.10006a20
mov byte [ebp - 4], 1
cmp dword [ebp - 0x22c], ebx
jne 0x1006c2a4
mov byte [ebp - 4], bl
cmp dword [ebp - 0x228], 8
jb 0x1006c28a
mov edx, dword [ebp - 0x23c]
push edx
call fcn.100b2678
add esp, 4
mov dword [ebp - 0x228], edi
mov dword [ebp - 0x22c], ebx
xor eax, eax
mov word [ebp - 0x23c], ax
jmp 0x1006c1e1
mov byte [ebp - 4], 2
push 4
push ebx
push str..KB
lea ecx, [ebp - 0x23c]
call fcn.10014a40
cmp eax, 0xffffffff
jne 0x1006c329
push 8
push ebx
push str._Office
lea ecx, [ebp - 0x23c]
call fcn.10014a40
cmp eax, 0xffffffff
jne 0x1006c329
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x23c]
mov edi, dword [ebp - 0x2a4]
call fcn.1005f8e0
mov byte [ebp - 4], bl
cmp dword [ebp - 0x228], 8
jb 0x1006c30b
mov ecx, dword [ebp - 0x23c]
push ecx
call fcn.100b2678
add esp, 4
mov dword [ebp - 0x228], 7
mov dword [ebp - 0x22c], ebx
xor edx, edx
mov word [ebp - 0x23c], dx
jmp 0x1006c1e1
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x23c]
call fcn.100041b0
mov byte [ebp - 4], bl
jmp 0x1006c1e1
cmp edi, ebx
je 0x1006c453
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x2a0], ebx
mov dword [ebp - 0x29c], ebx
mov esi, dword [ebp - 0x2ac]
mov edi, dword [ebp - 0x2a8]
cmp byte [ebp + 0xc], bl
je 0x1006c71a
cmp dword [esi + 0x14], 8
jb 0x1006c478
mov eax, dword [esi]
jmp 0x1006c47a
mov eax, esi
push 0x20119
push eax
push edi
lea ecx, [ebp - 0x2a0]
call fcn.10008480
test eax, eax
jne 0x1006c71a
mov dword [ebp - 0x294], 0x104
xor esi, esi
lea ecx, [ebp - 0x2b8]
push ecx
push ebx
push ebx
push ebx
lea edx, [ebp - 0x294]
push edx
lea eax, [ebp - 0x220]
push eax
push esi
mov edi, dword [ebp - 0x2a0]
push edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1006c703
inc esi
mov dword [ebp - 0x2a8], esi
mov dword [ebp - 0x294], 0x104
mov edi, 7
mov dword [ebp - 0x228], edi
mov dword [ebp - 0x22c], ebx
xor ecx, ecx
mov word [ebp - 0x23c], cx
lea eax, [ebp - 0x220]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1006c502
sub eax, edx
sar eax, 1
push eax
lea edx, [ebp - 0x220]
push edx
lea ecx, [ebp - 0x23c]
call fcn.10006a20
mov byte [ebp - 4], 8
cmp dword [ebp - 0x22c], ebx
jne 0x1006c565
mov byte [ebp - 4], bl
cmp dword [ebp - 0x228], 8
jb 0x1006c54b
mov eax, dword [ebp - 0x23c]
push eax
call fcn.100b2678
add esp, 4
mov dword [ebp - 0x228], edi
mov dword [ebp - 0x22c], ebx
xor ecx, ecx
mov word [ebp - 0x23c], cx
jmp 0x1006c4a0
mov byte [ebp - 4], 9
push 4
push ebx
push str..KB
lea ecx, [ebp - 0x23c]
call fcn.10014a40
cmp eax, 0xffffffff
jne 0x1006c5ea
push 8
push ebx
push str._Office
lea ecx, [ebp - 0x23c]
call fcn.10014a40
cmp eax, 0xffffffff
jne 0x1006c5ea
mov dword [ebp - 4], 8
lea ecx, [ebp - 0x23c]
mov edi, dword [ebp - 0x2a4]
call fcn.1005f8e0
mov byte [ebp - 4], bl
cmp dword [ebp - 0x228], 8
jb 0x1006c5cc
mov edx, dword [ebp - 0x23c]
push edx
call fcn.100b2678
add esp, 4
mov dword [ebp - 0x228], 7
mov dword [ebp - 0x22c], ebx
xor eax, eax
mov word [ebp - 0x23c], ax
jmp 0x1006c4a0
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x23c]
call fcn.100041b0
mov byte [ebp - 4], bl
jmp 0x1006c4a0
cmp edi, ebx
je 0x1006c714
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x2a0], ebx
mov dword [ebp - 0x29c], ebx
mov eax, dword [ebp - 0x2a4]
mov ecx, dword [eax + 4]
sub ecx, dword [eax]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov edi, edx
shr edi, 0x1f
add edi, edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x2a0]
cmp eax, ebx
je 0x1006c756
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x2a0], ebx
mov eax, edi
mov dword [ebp - 0x29c], ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100b2b2c
mov esp, ebp
pop ebp
ret