Function at 0x6360a288
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x7dc]
sub esp, 0x85c
mov eax, dword [0x6362e4e0]
push ebx
xor ebx, ebx
push 0x50
xor eax, ebp
push ebx
push 0x63630d70
mov dword [ebp + 0x7d8], eax
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x78], ebx
mov dword [0x63630d68], ebx
call fcn.63615500
push 0x63630c68
call fcn.63615900
add esp, 0x10
test eax, eax
jbe 0x6360a53f
lea eax, [ebp - 0x6c]
push eax
push 0x2001f
push ebx
push str.SoftwareMicrosoftInternet_ExplorerSearchScopes
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6360a53f
push esi
push edi
push 4
pop eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x70]
push eax
push ebx
push str.bdadd
push dword [ebp - 0x6c]
mov dword [ebp - 0x68], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor edi, edi
inc edi
cmp dword [ebp - 0x68], ebx
jbe 0x6360a32d
mov dword [ebp - 0x78], edi
push 0x38
pop esi
push esi
lea eax, [ebp + 0x7a0]
push ebx
push eax
call fcn.63615500
add esp, 0xc
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp + 0x7a0]
push eax
lea eax, [ebp - 0x70]
push eax
push ebx
push str.DefaultScope
push dword [ebp - 0x6c]
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x64], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x80]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x60]
push eax
mov dword [ebp - 0x68], ebx
mov esi, 0x400
push ebx
jmp 0x6360a42c
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp + 0x3a0]
push str.SoftwareMicrosoftInternet_ExplorerSearchScopes_s
push eax
call fcn.636161f1
add esp, 0xc
lea eax, [ebp - 0x74]
push eax
push 0x20019
push ebx
lea eax, [ebp + 0x3a0]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6360a417
push esi
lea eax, [ebp + 0x3a0]
push ebx
push eax
call fcn.63615500
add esp, 0xc
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp + 0x3a0]
push eax
lea eax, [ebp - 0x70]
push eax
push ebx
push 0x636258a4
push dword [ebp - 0x74]
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x64], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x6360a40e
lea eax, [ebp + 0x3a0]
push str.www.baidu.com
push eax
call fcn.636163a0
test eax, eax
pop ecx
pop ecx
jne 0x6360a557
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x68]
lea eax, [ebp - 0x80]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x60]
push eax
push dword [ebp - 0x68]
push dword [ebp - 0x6c]
mov dword [ebp - 0x64], esi
mov byte [ebp - 0x60], bl
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x6360a382
cmp dword [ebp - 0x78], ebx
jne 0x6360a534
push ebx
lea eax, [ebp - 0x74]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push str.SoftwareMicrosoftInternet_ExplorerSearchScopes4633EF93_D676_472f_A0FF_E1916B0B2E30
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x6360a534
lea eax, [ebp + 0x3a0]
push 0x63625828
push eax
call fcn.63616430
lea eax, [ebp + 0x3a0]
push eax
call fcn.63615900
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
add esp, 0xc
inc eax
push eax
lea eax, [ebp + 0x3a0]
push eax
push edi
push ebx
push str.DisplayName
push dword [ebp - 0x74]
call esi
lea eax, [ebp + 0x3a0]
push 0x63630c68
push eax
call fcn.63616430
lea eax, [ebp + 0x3a0]
push eax
call fcn.63615900
add esp, 0xc
inc eax
push eax
lea eax, [ebp + 0x3a0]
push eax
push edi
push ebx
push 0x636258a4
push dword [ebp - 0x74]
call esi
lea eax, [ebp + 0x3a0]
push str.4633EF93_D676_472f_A0FF_E1916B0B2E30
push eax
call fcn.63616430
lea eax, [ebp + 0x3a0]
push eax
call fcn.63615900
add esp, 0xc
inc eax
push eax
lea eax, [ebp + 0x3a0]
push eax
push edi
push ebx
push str.DefaultScope
push dword [ebp - 0x6c]
call esi
push 4
pop eax
push eax
lea ecx, [ebp - 0x68]
push ecx
push eax
push ebx
push str.bdadd
push dword [ebp - 0x6c]
mov dword [ebp - 0x68], edi
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x64], eax
call esi
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov ecx, dword [ebp + 0x7d8]
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.636151ae
add ebp, 0x7dc
leave
ret
lea eax, [ebp + 0x3a0]
push eax
call fcn.63615900
inc eax
inc eax
push eax
call fcn.6361576d
mov ecx, dword [0x63630d68]
mov dword [ecx*4 + 0x63630d70], eax
lea ecx, [ebp + 0x3a0]
push ecx
push eax
call fcn.63616430
add esp, 0x10
push dword [ebp - 0x74]
inc dword [0x63630d68]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x6360a534