Function at 0x666498a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov eax, 0x116c
mov ebp, esp
push edi
push esi
push ebx
call fcn.6664fe28
sub esp, eax
mov ebx, dword [ebp + 8]
mov dword [esp + 8], 6
mov dword [esp + 4], str.MSACM.
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll__wcsnicmp]
test eax, eax
je 0x666498e0
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x1148]
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareMicrosoftWindows_NTCurrentVersionDrivers32
mov dword [esp], 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
sub esp, 0x14
test eax, eax
je 0x66649950
test byte [0x66650048], 4
je 0x666498d2
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.unable_to_open_registry_key___0x_08x_n
mov dword [esp + 8], str.MSACM_RegisterDriverFromRegistry
mov dword [esp + 4], 0x66650048
mov dword [esp], 2
call fcn.66647130
jmp 0x666498d2
lea eax, [ebp - 0x114c]
lea edi, [ebp - 0x1018]
mov dword [esp + 4], ebx
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x1148]
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp], eax
mov dword [ebp - 0x114c], 0x1000
call sub.advapi32.dll_RegQueryValueExW
sub esp, 0x18
mov esi, eax
test eax, eax
je 0x66649ab0
test byte [0x66650048], 4
jne 0x666499c8
mov eax, dword [ebp - 0x1148]
mov dword [esp], eax
call sub.advapi32.dll_RegCloseKey
xor eax, eax
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
test ebx, ebx
je 0x66649bed
mov eax, ebx
shr eax, 0x10
je 0x66649bc9
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call sub.kernel32.dll_IsBadStringPtrW
mov edx, 0x666528f6
sub esp, 8
test eax, eax
jne 0x66649af7
movzx edx, word [ebx]
test dx, dx
je 0x66649bf7
lea esi, [esi]
nop
mov ecx, eax
lea eax, [eax + 1]
cmp word [ebx + ecx*2 + 2], 0
jne 0x66649a10
mov eax, 0x224c
mov dword [ebp + 8], ebx
mov word [ebp - 0x1144], ax
lea eax, [ebp - 0x1142]
jmp 0x66649a79
cmp dx, 9
je 0x66649bb8
cmp dx, 0xa
jne 0x66649b4e
mov edi, 0x6e5c
add eax, 2
mov word [eax - 2], di
lea esi, [esi]
nop
lea edx, [ebp - 0x1022]
lea edi, [ecx - 1]
cmp eax, edx
ja 0x66649ac9
test ecx, ecx
jle 0x66649ac9
mov ecx, dword [ebp + 8]
movzx edx, word [ecx]
mov ecx, edi
add dword [ebp + 8], 2
cmp dx, 0xd
je 0x66649b30
jbe 0x66649a38
cmp dx, 0x22
je 0x66649ba0
cmp dx, 0x5c
jne 0x66649b41
mov ebx, 0x5c5c
add eax, 2
mov word [eax - 2], bx
jmp 0x66649a60
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], ebx
call fcn.666493e0
jmp 0x666499a6
mov byte [eax], 0x22
test edi, edi
jle 0x66649c0d
mov ecx, 0x2e2e
mov byte [eax + 3], 0x2e
lea edx, [eax + 4]
mov word [eax + 1], cx
lea eax, [ebp - 0x1144]
mov byte [edx], 0
mov dword [esp], eax
call fcn.6664f9d0
mov edx, eax
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], str.unable_to_query_requested_subkey__s___0x_08x_n
mov dword [esp + 8], str.MSACM_RegisterDriverFromRegistry
mov dword [esp + 4], 0x66650048
mov dword [esp], 2
call fcn.66647130
jmp 0x666499a6
mov ebx, 0x725c
add eax, 2
mov word [eax - 2], bx
jmp 0x66649a60
lea edi, [edx - 0x20]
cmp di, 0x5e
jbe 0x66649be3
mov edi, edx
mov byte [eax], 0x5c
add eax, 5
shr di, 0xc
movzx edi, di
movzx ebx, byte [edi + str.0123456789abcdef]
mov edi, edx
shr di, 8
and edi, 0xf
mov byte [eax - 4], bl
movzx ebx, byte [edi + str.0123456789abcdef]
mov edi, edx
and edx, 0xf
shr di, 4
movzx edx, byte [edx + str.0123456789abcdef]
and edi, 0xf
mov byte [eax - 3], bl
movzx ebx, byte [edi + str.0123456789abcdef]
mov byte [eax - 1], dl
mov byte [eax - 2], bl
jmp 0x66649a60
mov edi, 0x225c
add eax, 2
mov word [eax - 2], di
jmp 0x66649a60
mov edx, 0x745c
add eax, 2
mov word [eax - 2], dx
jmp 0x66649a60
movzx ebx, bx
mov dword [esp], 0x666528e9
mov dword [esp + 4], ebx
call fcn.666475e0
mov edx, eax
jmp 0x66649af7
mov byte [eax], dl
add eax, 1
jmp 0x66649a60
mov edx, 0x666528ef
jmp 0x66649af7
mov word [ebp - 0x1144], 0x224c
lea eax, [ebp - 0x1142]
mov byte [ebp - 0x1142], 0x22
lea edx, [eax + 1]
jmp 0x66649ae4