Function at 0x69641dea
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x86c
mov dword [ebp - 0x1c], str.2f9f85ae22403d497f409e77647e0055a79c80b659b06d1771f0d12cf2876c4632fa532ed2f69fb5a87ceea67c361b445d74de90a8ebcb73daf0dbd66c2c598ec1fb1ec79ce4e4bcb373d55badf45612495e64219116dc71857e14895443596397a746f18eb4f0caa72a93d326b22bcbe413be5947272275f2dff1584186f68a1134fcf1bc937ebc2f3681c603ee90d5224930d1264a95d0f70b185de2f2149a7164d731f735aac9e1cf6a6dcbae48ea16aec944d6e8b21b0eaf8a4d8bab7079f816249d3b9b5829bb224229c1107669a7f6dd0d1181ae1da662c0d2124bc45301f965ba0c19ee6319ef869fc43aa6675bccda7bc88bd021b41f038e13522d51ec1f236ac05e3bc21e44a406f70842b0347c757a40cf5079bf146cee2643000ad8471be56b097c29c4e737dd350b8f6b852b13856033c137edcb4296ee25dea0c1e27e2e4f27e604b435d720cfb5f5cd2a751a1fdb661331653c79099746e71f60889aaab1bd16cbae6fa407ab54f3dee2205a820cd304e06a1778abf12c6789c25c5d425bdcd5525ea71722881db08a743808055069342bf79608d260e22885e5480c81f0cec4cfae42f756f57f4e59b92f2966c0528cbdbace011c058f1fc4280fab324b38c624badb43f2bf51ecc4993f88e8f18793070bfd5e727016c746c46ae72137202f78
lea eax, [ebp - 0x3f3]
mov ebx, 0x69648020
mov edx, 0x3bb
mov ecx, dword [ebx]
mov dword [eax], ecx
mov ecx, dword [ebx + edx - 4]
mov dword [eax + edx - 4], ecx
lea edi, [eax + 4]
and edi, 0xfffffffc
sub eax, edi
sub ebx, eax
add edx, eax
and edx, 0xfffffffc
mov eax, edx
shr eax, 2
mov esi, ebx
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x3f3]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 3
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], 0x3bb
call sym._y2Ob5
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], str.96d69f69354e342f19b8ac8b4a209a35c5f3a2eaeb59652ca26d8d53b0eaefb739b3ac221cd1484e292146b381bfcc476b94c87a739c94b090015aeea4fd5b4538bdfcd5687b166add882bb16d917419053e7227ae414dad4244cdb4be10b7d3c994095672b8ba19d24ec861a18276b7f3b615e0cf62913c9870fb607b52a3a3739ab0b69167f0bb6b7f91ea09469e14416fde23c7beb189abd6152bff795a6f50d5a4200d1ae88db063fc08a6e9a37c0bc787d716a823dbeccb459427711caedbcbf138b45583fc0e4c879ef2b1312988b667f844ae770f543208cf2456a9fa36e7452d2ce3e40b9ff991547068604e13b8d616892694510ddb66e8a3351e349b7f2e48a8a47ca494017619e15025a8a9ea293499e7f7544470b9117fb0da15a658a967382a186219cc518ead8df9ffb93a2c6d8c9563e8d28258f8a258ee7b68344717aaac82d12ebb1549be56b74e893a104f1942d9e42ab43f13739e28f832d7b13d0c40cc785f1f9d29a7037842d997aee874cbc590e415ffa21cb1b92cc8c94099f9f5659107ccaa35d90c19aa9ebdca63c60e307a0f33aa3fa66894005d46210fcb43c759f983c5496053a33560e167e8090545d0
lea eax, [ebp - 0x839]
mov ebx, 0x696483e0
mov edx, 0x441
mov ecx, dword [ebx]
mov dword [eax], ecx
mov ecx, dword [ebx + edx - 4]
mov dword [eax + edx - 4], ecx
lea edi, [eax + 4]
and edi, 0xfffffffc
sub eax, edi
sub ebx, eax
add edx, eax
and edx, 0xfffffffc
mov eax, edx
shr eax, 2
mov esi, ebx
mov ecx, eax
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x839]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 3
mov eax, dword [ebp - 0x24]
mov dword [esp + 4], eax
mov dword [esp], 0x441
call sym._y2Ob5
mov dword [ebp - 0x28], eax
cmp dword [ebp + 8], 0xaf9d
jne 0x69641ff1
mov dword [esp + 0x20], 0
lea eax, [ebp - 0x3f8]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 2
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov eax, dword [ebp - 0x28]
mov dword [esp + 4], eax
mov dword [esp], 0x80000001
mov eax, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
call eax
sub esp, 0x24
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x69641f48
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sym._free
mov eax, 0
jmp 0x69642259
mov eax, dword [ebp - 0x3f8]
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0x69657789
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov edx, dword [ebp - 0x20]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x69641fbe
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x3f8]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call sym._free
mov eax, 0
jmp 0x69642259
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x3f8]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sym._free
mov eax, 1
jmp 0x69642259
cmp dword [ebp + 8], 0x6b30
jne 0x69642243
mov dword [esp + 0x20], 0
lea eax, [ebp - 0x3f8]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x20019
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov eax, dword [ebp - 0x28]
mov dword [esp + 4], eax
mov dword [esp], 0x80000001
mov eax, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
call eax
sub esp, 0x24
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x69642079
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sym._free
mov eax, 0
jmp 0x69642259
mov dword [ebp - 0x844], 0
mov eax, dword [ebp - 0x3f8]
lea edx, [ebp - 0x844]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], 0
lea edx, [ebp - 0x840]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov edx, dword [ebp - 0x20]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x696420d4
mov eax, dword [ebp - 0x844]
test eax, eax
jne 0x69642107
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x3f8]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
mov eax, 0
jmp 0x69642259
mov eax, dword [ebp - 0x844]
mov dword [esp], eax
call sym._affZoZyj5QQfO
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x844]
add eax, 1
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sym._memset
mov eax, dword [ebp - 0x3f8]
lea edx, [ebp - 0x844]
mov dword [esp + 0x14], edx
mov edx, dword [ebp - 0x38]
mov dword [esp + 0x10], edx
lea edx, [ebp - 0x840]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov edx, dword [ebp - 0x20]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x696421bc
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x3f8]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call sym._free
mov eax, 0
jmp 0x69642259
mov edx, dword [ebp - 0x844]
mov eax, dword [ebp - 0x38]
add eax, edx
mov byte [eax], 0
mov eax, dword [ebp - 0x3f8]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
mov eax, dword [ebp - 0x20]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sym._strstr
test eax, eax
je 0x6964221b
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sym._free
mov eax, 1
jmp 0x69642259
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x38]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call sym._free
mov eax, 0
jmp 0x69642259
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sym._free
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call sym._free
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret