Function at 0x6c543140
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x158
mov edi, dword [ecx]
mov esi, dword [ecx + 4]
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x124], 0
test byte [0x6c546018], 8
jne 0x6c5432f0
lea eax, [ebp - 0x128]
mov dword [esp + 0xc], 0x20006
mov ebx, 1
mov dword [esp + 0x10], eax
mov eax, dword [sym.imp.advapi32.dll_RegOpenKeyExW]
mov dword [esp + 8], 0
mov dword [esp + 4], str.DirectShowMediaObjects
mov dword [esp], 0x80000000
mov dword [ebp - 0x12c], eax
call eax
sub esp, 0x14
test eax, eax
je 0x6c5431d0
lea esp, [ebp - 0x10]
mov eax, ebx
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 8
lea ecx, [ebp - 0x118]
mov edx, edi
mov eax, ecx
call fcn.6c541420
mov edx, dword [sym.imp.advapi32.dll_RegDeleteKeyW]
mov eax, dword [ebp - 0x128]
lea ecx, [ebp - 0x118]
mov dword [esp + 4], ecx
mov dword [ebp - 0x134], edx
mov dword [esp], eax
call edx
lea eax, [ebp - 0x124]
sub esp, 8
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x128]
mov dword [esp + 0xc], 0x2000e
mov dword [esp], eax
mov eax, dword [ebp - 0x12c]
mov dword [esp + 8], 0
mov dword [esp + 4], str.Categories
call eax
mov ebx, eax
mov eax, dword [ebp - 0x128]
sub esp, 0x14
mov dword [esp], eax
mov eax, dword [sym.imp.advapi32.dll_RegCloseKey]
mov dword [ebp - 0x130], eax
call eax
sub esp, 4
test ebx, ebx
jne 0x6c543430
mov eax, dword [0x6c54ef34]
cmp dword [esi], eax
je 0x6c543448
lea edi, [ebp - 0x98]
mov edx, esi
mov eax, edi
call fcn.6c541420
lea eax, [ebp - 0x11c]
mov dword [esp + 4], edi
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x124]
mov dword [esp + 0xc], 0x20006
mov dword [esp], eax
mov eax, dword [ebp - 0x12c]
mov dword [esp + 8], 0
call eax
sub esp, 0x14
mov ebx, eax
test eax, eax
je 0x6c5435a0
test ebx, ebx
setne bl
movzx ebx, bl
mov eax, dword [ebp - 0x124]
test eax, eax
je 0x6c5431bf
mov dword [esp], eax
mov eax, dword [ebp - 0x130]
call eax
mov eax, ebx
sub esp, 4
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 8
test esi, esi
je 0x6c543590
mov eax, esi
shr eax, 0x10
je 0x6c543410
movzx eax, byte [esi + 0xf]
mov dword [esp + 0x2c], eax
movzx eax, byte [esi + 0xe]
mov dword [esp + 0x28], eax
movzx eax, byte [esi + 0xd]
mov dword [esp + 0x24], eax
movzx eax, byte [esi + 0xc]
mov dword [esp + 0x20], eax
movzx eax, byte [esi + 0xb]
mov dword [esp + 0x1c], eax
movzx eax, byte [esi + 0xa]
mov dword [esp + 0x18], eax
movzx eax, byte [esi + 9]
mov dword [esp + 0x14], eax
movzx eax, byte [esi + 8]
mov dword [esp + 0x10], eax
movzx eax, word [esi + 6]
mov dword [esp + 0xc], eax
movzx eax, word [esi + 4]
mov dword [esp + 8], eax
mov eax, dword [esi]
mov dword [esp], str._08x__04x__04x__02x_02x__02x_02x_02x_02x_02x_02x
mov dword [esp + 4], eax
call fcn.6c541370
mov ebx, eax
test edi, edi
je 0x6c543580
mov eax, edi
shr eax, 0x10
je 0x6c543560
movzx eax, byte [edi + 0xf]
mov dword [esp + 0x2c], eax
movzx eax, byte [edi + 0xe]
mov dword [esp + 0x28], eax
movzx eax, byte [edi + 0xd]
mov dword [esp + 0x24], eax
movzx eax, byte [edi + 0xc]
mov dword [esp + 0x20], eax
movzx eax, byte [edi + 0xb]
mov dword [esp + 0x1c], eax
movzx eax, byte [edi + 0xa]
mov dword [esp + 0x18], eax
movzx eax, byte [edi + 9]
mov dword [esp + 0x14], eax
movzx eax, byte [edi + 8]
mov dword [esp + 0x10], eax
movzx eax, word [edi + 6]
mov dword [esp + 0xc], eax
movzx eax, word [edi + 4]
mov dword [esp + 8], eax
mov eax, dword [edi]
mov dword [esp], str._08x__04x__04x__02x_02x__02x_02x_02x_02x_02x_02x
mov dword [esp + 4], eax
call fcn.6c541370
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str._s__s_n
mov dword [esp + 8], str.DMOUnregister
mov dword [esp + 4], 0x6c546018
mov dword [esp], 3
call fcn.6c541730
jmp 0x6c54317d
movzx eax, si
mov dword [esp], str._guid_0x_04hx_
mov dword [esp + 4], eax
call fcn.6c541370
mov ebx, eax
jmp 0x6c543367
movzx eax, bx
or eax, 0x80070000
test ebx, ebx
cmovg ebx, eax
jmp 0x6c5432bc
mov eax, dword [0x6c54ef38]
cmp dword [esi + 4], eax
jne 0x6c543269
mov eax, dword [0x6c54ef3c]
cmp dword [esi + 8], eax
jne 0x6c543269
mov eax, dword [0x6c54ef40]
cmp dword [esi + 0xc], eax
jne 0x6c543269
xor eax, eax
mov ebx, 1
mov dword [ebp - 0x120], 0x40
lea esi, [ebp - 0x98]
jmp 0x6c54349a
test ebx, ebx
mov eax, edi
setne bl
movzx ebx, bl
mov dword [esp + 4], eax
lea edi, [eax + 1]
mov eax, dword [ebp - 0x124]
lea edx, [ebp - 0x120]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edx
mov dword [esp + 8], esi
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegEnumKeyExW]
sub esp, 0x20
test eax, eax
jne 0x6c5432bc
lea eax, [ebp - 0x11c]
mov dword [esp + 0xc], 0x20006
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x124]
mov dword [esp + 8], 0
mov dword [esp], eax
mov eax, dword [ebp - 0x12c]
mov dword [esp + 4], esi
call eax
sub esp, 0x14
mov ebx, eax
test eax, eax
jne 0x6c543490
lea eax, [ebp - 0x118]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x11c]
mov dword [esp], eax
mov eax, dword [ebp - 0x134]
call eax
mov ebx, eax
mov eax, dword [ebp - 0x11c]
sub esp, 8
mov dword [esp], eax
mov eax, dword [ebp - 0x130]
call eax
sub esp, 4
jmp 0x6c543490
movzx eax, di
mov dword [esp], str._guid_0x_04hx_
mov dword [esp + 4], eax
call fcn.6c541370
jmp 0x6c5433dc
mov eax, str._null_
jmp 0x6c5433dc
mov ebx, str._null_
jmp 0x6c543367
lea eax, [ebp - 0x118]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x11c]
mov dword [esp], eax
mov eax, dword [ebp - 0x134]
call eax
mov ebx, eax
mov eax, dword [ebp - 0x11c]
sub esp, 8
mov dword [esp], eax
mov eax, dword [ebp - 0x130]
call eax
sub esp, 4
jmp 0x6c5432b4