Function at 0x200069fb
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
push esi
push edi
push 0x40
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x113]
mov byte [ebp - 0x114], bl
push 0x40
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x217]
mov byte [ebp - 0x218], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 4]
mov dword [ebp - 8], 2
push eax
push 0xf003f
push ebx
push 0x20002b9c
push 0x80000002
mov dword [ebp - 0x10], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, dword [sym.imp.MSVCRT.dll_sprintf]
mov esi, 0x104
test eax, eax
jne 0x20006d13
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0x20002b8c
mov dword [ebp - 8], 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x20006af2
lea eax, [ebp - 0x114]
push 0x22
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
pop ecx
cmp eax, ebx
pop ecx
je 0x20006aaf
mov byte [eax], bl
lea eax, [ebp - 0x113]
push eax
lea eax, [ebp - 0x218]
push 0x20002b84
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x10]
push ebx
push eax
push ebx
push ebx
lea eax, [ebp - 0x218]
push esi
push eax
push 0x22001b
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push 0x20002b8c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0x20002b78
mov dword [ebp - 8], 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x20006b78
lea eax, [ebp - 0x114]
push 0x22
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
pop ecx
cmp eax, ebx
pop ecx
je 0x20006b35
mov byte [eax], bl
lea eax, [ebp - 0x113]
push eax
lea eax, [ebp - 0x218]
push 0x20002b84
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x10]
push ebx
push eax
push ebx
push ebx
lea eax, [ebp - 0x218]
push esi
push eax
push 0x22001b
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push 0x20002b78
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0x20002b5c
mov dword [ebp - 8], 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x20006bfe
lea eax, [ebp - 0x114]
push 0x22
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
pop ecx
cmp eax, ebx
pop ecx
je 0x20006bbb
mov byte [eax], bl
lea eax, [ebp - 0x113]
push eax
lea eax, [ebp - 0x218]
push 0x20002b84
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x10]
push ebx
push eax
push ebx
push ebx
lea eax, [ebp - 0x218]
push esi
push eax
push 0x22001b
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push 0x20002b5c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0x20002b54
mov dword [ebp - 8], 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x20006c84
lea eax, [ebp - 0x114]
push 0x22
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
pop ecx
cmp eax, ebx
pop ecx
je 0x20006c41
mov byte [eax], bl
lea eax, [ebp - 0x113]
push eax
lea eax, [ebp - 0x218]
push 0x20002b84
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x10]
push ebx
push eax
push ebx
push ebx
lea eax, [ebp - 0x218]
push esi
push eax
push 0x22001b
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push 0x20002b54
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0x20002b50
mov dword [ebp - 8], 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x20006d0a
lea eax, [ebp - 0x114]
push 0x22
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
pop ecx
cmp eax, ebx
pop ecx
je 0x20006cc7
mov byte [eax], bl
lea eax, [ebp - 0x113]
push eax
lea eax, [ebp - 0x218]
push 0x20002b84
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x10]
push ebx
push eax
push ebx
push ebx
lea eax, [ebp - 0x218]
push esi
push eax
push 0x22001b
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push 0x20002b50
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push 0x20002b1c
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x20006db6
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0x20002b10
mov dword [ebp - 8], 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x20006dad
lea eax, [ebp - 0x114]
push 0x22
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
pop ecx
cmp eax, ebx
pop ecx
je 0x20006d78
mov byte [eax], bl
lea eax, [ebp - 0x113]
push eax
lea eax, [ebp - 0x218]
push 0x20002b84
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x10]
push ebx
push eax
push ebx
push ebx
lea eax, [ebp - 0x218]
push esi
push eax
push 0x22001b
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push 0x20002ae0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x20006e59
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0x20002b10
mov dword [ebp - 8], 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x20006e50
lea eax, [ebp - 0x114]
push 0x22
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
pop ecx
cmp eax, ebx
pop ecx
je 0x20006e1b
mov byte [eax], bl
lea eax, [ebp - 0x113]
push eax
lea eax, [ebp - 0x218]
push 0x20002b84
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x10]
push ebx
push eax
push ebx
push ebx
lea eax, [ebp - 0x218]
push esi
push eax
push 0x22001b
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push 0x20002ab0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x20006efc
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0x20002b10
mov dword [ebp - 8], 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x20006ef3
lea eax, [ebp - 0x114]
push 0x22
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
pop ecx
cmp eax, ebx
pop ecx
je 0x20006ebe
mov byte [eax], bl
lea eax, [ebp - 0x113]
push eax
lea eax, [ebp - 0x218]
push 0x20002b84
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x10]
push ebx
push eax
push ebx
push ebx
lea eax, [ebp - 0x218]
push esi
push eax
push 0x22001b
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push 0x20002a84
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x20006f9f
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0x20002b10
mov dword [ebp - 8], 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x20006f96
lea eax, [ebp - 0x114]
push 0x22
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
pop ecx
cmp eax, ebx
pop ecx
je 0x20006f61
mov byte [eax], bl
lea eax, [ebp - 0x113]
push eax
lea eax, [ebp - 0x218]
push 0x20002b84
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x10]
push ebx
push eax
push ebx
push ebx
lea eax, [ebp - 0x218]
push esi
push eax
push 0x22001b
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push 0x20002a58
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x20007042
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0x20002b10
mov dword [ebp - 8], 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x20007039
lea eax, [ebp - 0x114]
push 0x22
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
pop ecx
cmp eax, ebx
pop ecx
je 0x20007004
mov byte [eax], bl
lea eax, [ebp - 0x113]
push eax
lea eax, [ebp - 0x218]
push 0x20002b84
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x10]
push ebx
push eax
push ebx
push ebx
lea eax, [ebp - 0x218]
push esi
push eax
push 0x22001b
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push 0x20002a28
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x200070e5
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], esi
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0x20002b10
mov dword [ebp - 8], 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x200070dc
lea eax, [ebp - 0x114]
push 0x22
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
pop ecx
cmp eax, ebx
pop ecx
je 0x200070a7
mov byte [eax], bl
lea eax, [ebp - 0x113]
push eax
lea eax, [ebp - 0x218]
push 0x20002b84
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x10]
push ebx
push eax
push ebx
push ebx
lea eax, [ebp - 0x218]
push esi
push eax
push 0x22001b
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret