Function at 0x6a8053
Capabilities:
Set registry value
Terminate process

Disassembly:
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push eax
mov eax, dword fs:[0x20]
je 0x6a8019
pop eax
jmp 0x6a801a
pop eax
jmp 0x6a801d
mov eax, 0x6ac8d0
jmp 0x6a8023
call eax
cmp dword [0x6ad970], 0
jne 0x6a8104
cmp dword [0x6ad994], 0
je 0x6a8104
mov dword [0x6ad994], 0
mov eax, dword [0x6ad090]
mov dword [0x6af07c], eax
push 0x32
push 0x6ad180
call fcn.006ac60d
add esp, 8
push 0xc8
push 0x6ad1b8
call fcn.006ac60d
add esp, 8
push 0xc8
push 0x6ad288
call fcn.006ac60d
add esp, 8
push 0xc8
push 0x6ad358
call fcn.006ac60d
add esp, 8
push 0xc8
push 0x6ad428
call fcn.006ac60d
add esp, 8
push 0xc8
push 0x6ad4f8
call fcn.006ac60d
add esp, 8
push 0xc8
push 0x6ad5c8
call fcn.006ac60d
add esp, 8
push 0xc8
push 0x6ad698
call fcn.006ac60d
add esp, 8
push 0xc8
push 0x6ad768
call fcn.006ac60d
add esp, 8
push 0xc8
push 0x6ad838
call fcn.006ac60d
add esp, 8
cmp dword [0x6ad970], 0
jne 0x6a818d
push 0x6ad180
push 0x6ade38
push 0x6ade80
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x6ade28
push 2
push 0
push 0x6ade80
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6a8183
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x6adf00
push 0x6adf20
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x6adf10
push 0x6adf38
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x6a818d
mov dword [0x6ade28], 0
call fcn.006ac41b
test byte [0x6ad048], 0x20
je 0x6a823a
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov dword [0x6ad968], eax
pop ebp
cmp dword [0x6ad968], 1
je 0x6a81c5
cmp dword [0x6ad968], 2
jne 0x6a81d4
mov dword [0x6ad96c], 1
jmp 0x6a81de
mov dword [0x6ad96c], 0
cmp dword [0x6ad968], 1
jne 0x6a81f2
inc word [0x6ade24]
cmp dword [0x6ad968], 0
jne 0x6a8235
dec word [0x6ade24]
xor eax, eax
mov ax, word [0x6ade24]
test eax, eax
jne 0x6a8235
mov eax, dword [0x6ade1c]
push eax
push 0
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [0x6ade20]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call fcn.006ac6b3
jmp 0x6a8244
mov dword [0x6ad96c], 1
mov dword [0x6ad974], 0
mov eax, entry0
sub eax, dword [0x6ad018]
mov dword [0x6ad908], eax
mov eax, dword [0x6ad034]
add eax, dword [0x6ad908]
mov dword [0x6ad910], eax
mov eax, dword [0x6ad908]
add eax, dword [0x6ad044]
mov dword [0x6ad914], eax
mov eax, dword [0x6ad908]
mov dword [0x6adf50], eax
mov eax, dword [0x6ad908]
mov eax, dword [eax + 0x3c]
add eax, dword [0x6ad908]
mov dword [0x6adf50], eax
mov eax, dword [0x6adf50]
mov eax, dword [eax + 0xa0]
mov dword [0x6adf50], eax
cmp dword [0x6ad96c], 0
je 0x6a8501
cmp dword [0x6ad970], 0
jne 0x6a8501
mov dword [0x6ad970], 1
mov dword [0x6ad974], 1
call fcn.006ac29e
test eax, eax
je 0x6a8501
call fcn.006aa66a
test eax, eax
je 0x6a8501
mov eax, dword [0x6ad078]
xor dword [0x6ad080], eax
mov eax, dword [0x6ad070]
xor dword [0x6ad084], eax
mov eax, dword [0x6ad070]
xor dword [0x6ad088], eax
call fcn.006ab2e3
test eax, eax
je 0x6a84e5
call fcn.006a983d
push 0x6af0a8
call fcn.006a991e
add esp, 4
test byte [0x6ad049], 2
je 0x6a8345
call fcn.006ac008
call fcn.006ab2f9
mov dword [0x6ad90c], eax
cmp dword [0x6ad90c], 0
je 0x6a84a8
call fcn.006ab526
test eax, eax
je 0x6a84a8
test byte [0x6ad048], 0x20
je 0x6a8388
push 0x6af0bc
call fcn.006a991e
add esp, 4
jmp 0x6a8395
push 0x6af0cc
call fcn.006a991e
add esp, 4
call fcn.006aa16e
test eax, eax
je 0x6a849e
test byte [0x6ad048], 0x80
je 0x6a83e2
call fcn.006ab0a4
test eax, eax
je 0x6a83e2
push 0x6ad180
push 0x6ad5c8
call fcn.006a9d3d
add esp, 8
mov dword [0x6ade2c], 1
jmp 0x6a8690
mov eax, dword [0x6ad078]
xor dword [0x6ad080], eax
mov eax, dword [0x6ad070]
xor dword [0x6ad084], eax
call fcn.006ac708
call fcn.006aa412
mov dword [0x6ade18], eax
cmp dword [0x6ade18], 0
je 0x6a8486
mov eax, dword [0x6ad908]
add eax, dword [0x6ad014]
push eax
call fcn.006a9393
add esp, 4
test eax, eax
je 0x6a8486
mov eax, dword [0x6ad908]
add eax, dword [0x6ad010]
push eax
call fcn.006a8e07
add esp, 4
test eax, eax
je 0x6a8486
call fcn.006a923b
test eax, eax
je 0x6a8486
call fcn.006a94a4
test eax, eax
je 0x6a8486
mov dword [0x6ad974], 0
mov eax, dword [0x6ade18]
xor dword [0x6ad080], eax
mov eax, dword [0x6ad070]
xor dword [0x6ad084], eax
call fcn.006ac808
push 0x8000
push 0
mov eax, dword [0x6ad960]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
call fcn.006a9ca4
jmp 0x6a84e0
mov dword [0x6ade2c], 2
call fcn.006a9ca4
push 0xc8
push 0x6add10
push 0x6ad1b8
call fcn.006ab23f
add esp, 0xc
push 0x6ad180
push 0x6add10
call fcn.006a9d3d
add esp, 8
jmp 0x6a8501
mov dword [0x6ade2c], 3
push 0x6ad180
push 0x6ad358
call fcn.006a9d3d
add esp, 8
mov dword [0x6ade10], 0
cmp dword [0x6ade10], 0
je 0x6a8543
test byte [0x6ad049], 1
jne 0x6a8539
push 0x10
push 0x6ad180
push 0x6af0e0
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [0x6ad974], 1
cmp dword [0x6ade28], 0
je 0x6a85ac
call dword [0x6ad9c4]
movzx eax, ax
mov dword [0x6ade30], eax
push 4
push 0x6ade30
push 4
push 0
push 0x6adf20
mov eax, dword [0x6ade28]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
push 0x6ade2c
push 4
push 0
push 0x6adf38
mov eax, dword [0x6ade28]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [0x6ade28]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x6ade28], 0
cmp dword [0x6ad974], 0
je 0x6a85d9
test byte [0x6ad048], 0x20
je 0x6a85d1
mov eax, 0
ret
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [0x6ade0c], 1
test byte [0x6ad90d], 0x80
je 0x6a8611
mov eax, dword [0x6ad050]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*2]
lea eax, [eax + eax*4]
shl eax, 5
mov dword [0x6adf54], eax
jmp 0x6a8627
mov eax, dword [0x6ad054]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
lea eax, [eax + eax*4]
shl eax, 3
mov dword [0x6adf54], eax
mov ecx, 0x3e8
mov eax, dword [0x6adf54]
sub edx, edx
div ecx
mov dword [0x6ad990], eax
push 0x6ad980
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov eax, dword [0x6ad908]
add eax, dword [0x6ad008]
mov dword [0x6ad904], eax
mov eax, dword [0x6ade18]
cmp dword [0x6ad078], eax
je 0x6a8670
mov eax, dword [0x6ade18]
mov dword [0x6ad078], eax
mov eax, dword [0x6ad904]
jmp 0x6a8676
jmp eax
jmp 0x6a8543