Function at 0x6c0a10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a0
push ebx
push esi
mov ebx, ecx
push edi
mov edi, dword [0x770b48]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x2a0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x2a0]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [0x796968]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [ebp - 0x14]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x770b48]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 1
push 0
push ecx
push reloc.ijl15.dll_Ordinal_2
call edi
test eax, eax
jne 0x6c0b16
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [0x770b48]
lea eax, [ebp - 0x10]
push eax
push 1
push 0
push ecx
push reloc.ijl15.dll_Ordinal_2
call edi
test eax, eax
jne 0x6c0b16
mov eax, 4
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
lea edx, [ebp - 8]
lea eax, [ebx + 0x3668]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edx
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x796f5c
push ecx
call esi
test eax, eax
je 0x6c0af7
mov dword [ebx + 0x3668], 1
mov eax, dword [ebx + 0x3668]
xor edx, edx
test eax, eax
mov eax, dword [ebp - 0x10]
setne dl
push eax
mov dword [ebx + 0x3668], edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x6c0b1c
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x2a0]
push ecx
push 1
push 0
push edx
push reloc.ijl15.dll_Ordinal_2
call edi
test eax, eax
jne 0x6c12b9
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0xc]
lea edx, [ebp - 0x2a0]
push ecx
push 1
push 0
push edx
push reloc.ijl15.dll_Ordinal_2
call edi
test eax, eax
jne 0x6c12fc
mov eax, 4
mov edx, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
lea edi, [ebx + 0x36a4]
push eax
lea ecx, [ebp - 4]
push edi
push ecx
push 0
push 0x796f50
push edx
call esi
test eax, eax
je 0x6c0b93
mov dword [edi], 1
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
lea edi, [ebx + 0x36ac]
push eax
lea ecx, [ebp - 4]
push edi
push ecx
push 0
push 0x796f48
push edx
call esi
test eax, eax
je 0x6c0bb9
mov dword [edi], 1
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
push 0x76a54c
push ecx
push 0
push 0x796f3c
push edx
call esi
test eax, eax
je 0x6c0be1
mov dword [0x76a54c], 1
lea eax, [ebp - 8]
lea ecx, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 4]
push ecx
push edx
push 0
push 0x796f2c
push eax
call esi
test eax, eax
je 0x6c0c05
mov dword [ebp - 0x18], 0x64
lea ecx, [ebp - 8]
lea edx, [ebp - 0x10]
push ecx
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 4]
push edx
push eax
push 0
push 0x796f20
push ecx
call esi
test eax, eax
je 0x6c0c29
mov dword [ebp - 0x10], 0x64
mov ecx, dword [ebp - 0xc]
lea edx, [ebp - 8]
lea eax, [ebx + 0x36dc]
push edx
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x796efc
push ecx
call esi
test eax, eax
je 0x6c0c53
mov dword [ebx + 0x36dc], 1
mov eax, dword [ebx + 0x36a4]
xor edx, edx
test eax, eax
setne dl
mov dword [ebx + 0x36a4], edx
mov ecx, dword [0x76a54c]
xor eax, eax
test ecx, ecx
setne al
mov dword [0x76a54c], eax
mov edx, dword [edi]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
test edx, edx
setne cl
mov dword [edi], ecx
push eax
mov dword [0x83be54], eax
call fcn.0041ba30
mov edx, dword [ebp - 0x10]
push edx
call fcn.0041ba80
mov eax, dword [ebp - 0x10]
push eax
call fcn.0041bac0
mov eax, dword [ebp - 0xc]
add esp, 0xc
lea ecx, [ebp - 8]
lea edi, [ebx + 0x1490]
push ecx
lea edx, [ebp - 4]
push edi
push edx
push 0
push 0x796ee4
push eax
call esi
test eax, eax
je 0x6c0ccc
mov dword [edi], 1
cmp dword [edi], 0
je 0x6c0cd7
mov dword [edi], 1
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 8]
lea edi, [ebx + 0x1494]
push ecx
lea edx, [ebp - 4]
push edi
push edx
push 0
push 0x796ecc
push eax
call esi
test eax, eax
je 0x6c0cfd
mov dword [edi], 0
cmp dword [edi], 0
je 0x6c0d08
mov dword [edi], 1
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 8]
lea edi, [ebx + 0x1488]
push ecx
lea edx, [ebp - 4]
push edi
push edx
push 0
push 0x796ebc
push eax
call esi
test eax, eax
je 0x6c0d2e
mov dword [edi], 0
cmp dword [edi], 0
je 0x6c0d39
mov dword [edi], 1
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 8]
lea edi, [ebx + 0x147c]
push ecx
lea edx, [ebp - 4]
push edi
push edx
push 0
push 0x796ea8
push eax
call esi
test eax, eax
je 0x6c0d5f
mov dword [edi], 1
cmp dword [edi], 0
je 0x6c0d6a
mov dword [edi], 1
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 8]
lea edi, [ebx + 0x1484]
push ecx
lea edx, [ebp - 4]
push edi
push edx
push 0
push 0x796e8c
push eax
call esi
test eax, eax
je 0x6c0d90
mov dword [edi], 1
cmp dword [edi], 0
je 0x6c0d9f
mov dword [ebx + 0x147c], 1
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 8]
lea edi, [ebx + 0x1480]
push ecx
lea edx, [ebp - 4]
push edi
push edx
push 0
push 0x796e70
push eax
call esi
test eax, eax
je 0x6c0dc5
mov dword [edi], 1
cmp dword [edi], 0
je 0x6c0dd0
mov dword [edi], 1
mov eax, dword [ebx + 0x1494]
mov dword [ebx + 0x1b80], 0
test eax, eax
je 0x6c0dee
mov dword [ebx + 0x1b80], 1
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 8]
lea edi, [ebx + 0x36d4]
push ecx
lea edx, [ebp - 4]
push edi
push edx
push 0
push 0x796e5c
push eax
call esi
test eax, eax
je 0x6c0e16
mov dword [edi], 1
jmp 0x6c0e21
mov eax, dword [edi]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edi], ecx
mov ecx, dword [ebp - 0xc]
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 4]
push 0x83868c
push eax
push 0
push 0x796e4c
push ecx
call esi
test eax, eax
je 0x6c0e4b
mov dword [0x83868c], 0
jmp 0x6c0e5d
mov eax, dword [0x83868c]
xor edx, edx
test eax, eax
setne dl
mov dword [0x83868c], edx
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
push 0x78c92c
push ecx
push 0
push 0x796e34
push edx
call esi
test eax, eax
je 0x6c0e85
mov dword [0x78c92c], 0xc2340000
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
push 0x78c930
push ecx
push 0
push 0x796e1c
push edx
call esi
test eax, eax
je 0x6c0ead
mov dword [0x78c930], 0x43960000
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
push 0x78c924
push ecx
push 0
push 0x796e04
push edx
call esi
test eax, eax
je 0x6c0ed5
mov dword [0x78c924], 0xc2340000
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
push 0x78c928
push ecx
push 0
push 0x796dec
push edx
call esi
test eax, eax
je 0x6c0efd
mov dword [0x78c928], 0x43960000
fld dword [0x78c918]
fld dword [0x78c924]
fcomp dword [0x74a204]
fnstsw ax
test ah, 1
je 0x6c0f22
mov dword [0x78c924], 0xc25c0000
jmp 0x6c0f3f
fld dword [0x78c924]
fcomp dword [0x74a200]
fnstsw ax
test ah, 0x41
jne 0x6c0f3f
mov dword [0x78c924], 0xc20c0000
fld dword [0x78c928]
fcomp dword [0x78c910]
fnstsw ax
test ah, 1
je 0x6c0f5c
mov eax, dword [0x78c910]
mov dword [0x78c928], eax
fld dword [0x78c928]
fcomp st(1)
fnstsw ax
test ah, 0x41
jne 0x6c0f73
fstp dword [0x78c928]
jmp 0x6c0f75
fstp st(0)
fld dword [0x78c914]
fld dword [0x78c92c]
fcomp dword [0x74a1fc]
fnstsw ax
test ah, 1
je 0x6c0f9a
mov dword [0x78c92c], 0xc2820000
jmp 0x6c0fb7
fld dword [0x78c92c]
fcomp dword [0x74a1f8]
fnstsw ax
test ah, 0x41
jne 0x6c0fb7
mov dword [0x78c92c], 0xc1c80000
fld dword [0x78c930]
fcomp dword [0x78c910]
fnstsw ax
test ah, 1
je 0x6c0fd6
mov ecx, dword [0x78c910]
mov dword [0x78c930], ecx
fld dword [0x78c930]
fcomp st(1)
fnstsw ax
test ah, 0x41
jne 0x6c0fed
fstp dword [0x78c930]
jmp 0x6c0fef
fstp st(0)
lea edx, [ebp - 8]
lea eax, [ebp - 0xa0]
push edx
mov edx, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push eax
push ecx
push 0
push 0x796de0
push edx
mov dword [ebp - 4], 1
mov dword [ebp - 8], 0x80
call esi
test eax, eax
je 0x6c104b
mov edi, 0x76a63c
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0xa0]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edi, [ebp - 0xa0]
or ecx, 0xffffffff
xor eax, eax
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ecx
cmp edi, 0xfffffffd
mov dword [ebp - 0x1c], edi
jbe 0x6c106e
call fcn.00704fbb
xor edx, edx
mov eax, dword [0x7da938]
cmp eax, edx
je 0x6c1092
mov cl, byte [eax - 1]
test cl, cl
je 0x6c1092
cmp cl, 0xff
je 0x6c1092
cmp edi, edx
jne 0x6c1111
dec cl
mov byte [eax - 1], cl
jmp 0x6c10b9
cmp edi, edx
jne 0x6c10d0
cmp eax, edx
je 0x6c10b9
mov cl, byte [eax - 1]
test cl, cl
je 0x6c10ad
cmp cl, 0xff
je 0x6c10ad
dec cl
mov byte [eax - 1], cl
jmp 0x6c10b9
dec eax
push eax
call fcn.00703996
add esp, 4
xor edx, edx
mov dword [0x7da938], edx
mov dword [0x7da93c], edx
mov dword [0x7da940], edx
jmp 0x6c1152
mov ecx, dword [0x7da940]
cmp ecx, 0x1f
ja 0x6c10df
cmp ecx, edi
jae 0x6c1121
cmp eax, edx
je 0x6c1100
mov cl, byte [eax - 1]
test cl, cl
je 0x6c10f6
cmp cl, 0xff
je 0x6c10f6
dec cl
mov byte [eax - 1], cl
jmp 0x6c1100
dec eax
push eax
call fcn.00703996
add esp, 4
xor eax, eax
mov dword [0x7da938], eax
mov dword [0x7da93c], eax
mov dword [0x7da940], eax
push edi
mov ecx, 0x7da934
call fcn.00421d90
mov eax, dword [0x7da938]
mov edx, dword [ebp - 0x1c]
mov edi, eax
mov ecx, edx
lea esi, [ebp - 0xa0]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x7da938]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [0x7da93c], edx
mov byte [ecx + edx], 0
mov ecx, dword [ebp - 0xc]
lea edx, [ebp - 8]
lea edi, [ebx + 0x387c]
push edx
lea eax, [ebp - 4]
push edi
push eax
push 0
push 0x796dd4
push ecx
call esi
test eax, eax
je 0x6c1178
mov dword [edi], 0
mov eax, dword [edi]
xor edx, edx
test eax, eax
setne dl
mov dword [edi], edx
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
lea edi, [ebx + 0x390c]
push eax
lea ecx, [ebp - 4]
push edi
push ecx
push 0
push 0x796dc8
push edx
call esi
test eax, eax
je 0x6c11a9
mov dword [edi], 0
mov ecx, dword [edi]
xor eax, eax
test ecx, ecx
setne al
mov dword [edi], eax
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 8]
lea edi, [ebx + 0x3674]
push ecx
lea edx, [ebp - 4]
push edi
push edx
push 0
push 0x796dbc
push eax
call esi
test eax, eax
je 0x6c11da
mov dword [edi], 0
cmp dword [edi], 0
je 0x6c11e5
mov dword [edi], 1
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 8]
lea edi, [ebx + 0xa50]
push ecx
lea edx, [ebp - 4]
push edi
push edx
push 0
push 0x796da8
push eax
call esi
test eax, eax
je 0x6c120b
mov dword [edi], 0
cmp dword [edi], 0
je 0x6c1216
mov dword [edi], 1
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 8]
lea edi, [ebx + 0xa54]
push ecx
lea edx, [ebp - 4]
push edi
push edx
push 0
push 0x796d90
push eax
call esi
test eax, eax
je 0x6c123c
mov dword [edi], 0
cmp dword [edi], 0
je 0x6c1247
mov dword [edi], 1
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 4]
push 0x7dabee
push edx
push 0
push 0x796d7c
push eax
call esi
test eax, eax
je 0x6c126e
mov byte [0x7dabee], 1
jmp 0x6c127e
mov al, byte [0x7dabee]
test al, al
jne 0x6c127e
mov byte [0x7dabec], 1
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 8]
lea edi, [ebx + 0x3b78]
push ecx
lea edx, [ebp - 4]
push edi
push edx
push 0
push 0x796d6c
push eax
call esi
test eax, eax
je 0x6c12a1
mov byte [edi], 0
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, ebx
call fcn.006f9180
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, 1
push 0x64
mov dword [ebx + 0x3668], esi
mov dword [ebx + 0x36a4], esi
mov dword [ebx + 0x36ac], esi
call fcn.0041ba80
push 0x64
call fcn.0041bac0
push 0x64
mov dword [0x76a54c], esi
call fcn.0041ba30
add esp, 0xc
xor eax, eax
mov dword [ebx + 0x390c], eax
mov dword [ebx + 0x387c], eax
mov ecx, ebx
call fcn.006f9180
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret