Function at 0x6f338c88
Capabilities:
Delete file
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x838
mov eax, dword [0x6f34110c]
push ebx
xor ebx, ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp eax, ebx
push esi
push edi
mov dword [ebp - 0x828], ebx
mov dword [ebp - 0x820], ebx
mov dword [ebp - 0x830], ebx
mov dword [ebp - 0x81c], ebx
mov dword [ebp - 0x824], ebx
mov dword [ebp - 0x82c], ebx
je 0x6f33919d
cmp dword [ebp + 0x18], ebx
je 0x6f338cdb
cmp dword [ebp + 0x14], ebx
je 0x6f33919d
mov esi, dword [ebp + 0x10]
cmp esi, ebx
mov edi, dword [eax + 8]
mov dword [ebp - 0x834], edi
jne 0x6f338d60
lea eax, [ebp - 0x820]
push eax
push ebx
lea eax, [ebp - 0x830]
push eax
push ebx
push 0x6f331258
push edi
call fcn.6f33efb2
cmp eax, ebx
mov dword [ebp + 8], eax
je 0x6f338d18
push eax
push 0x3b2025e
jmp 0x6f3391ab
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0x818]
push eax
lea eax, [ebp - 0x838]
push eax
push ebx
push 0x6f331e18
push dword [ebp - 0x820]
mov dword [ebp + 0x10], 0x20a
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
mov dword [ebp + 8], eax
je 0x6f338d55
push eax
push 0x3bc025e
jmp 0x6f3391ab
lea eax, [ebp - 0x818]
mov dword [ebp + 0x10], eax
mov esi, eax
cmp word [esi], 0x5c
jne 0x6f338d6d
cmp word [esi + 2], 0x5c
je 0x6f338dda
cmp edi, ebx
je 0x6f338d97
lea eax, [ebp - 0x82c]
push eax
lea eax, [ebp - 0x824]
push eax
push edi
call fcn.6f33e176
cmp eax, ebx
mov dword [ebp + 8], eax
je 0x6f338db5
push eax
push 0x3c8025e
jmp 0x6f3391ab
lea eax, [ebp - 0x824]
push eax
call fcn.6f33fa27
cmp eax, ebx
mov dword [ebp + 8], eax
je 0x6f338db5
push eax
push 0x3cd025e
jmp 0x6f3391ab
lea eax, [ebp - 0x828]
push eax
push esi
push dword [ebp - 0x824]
call fcn.6f33dd71
cmp eax, ebx
mov dword [ebp + 8], eax
je 0x6f338dda
push eax
push 0x3d0025e
jmp 0x6f3391ab
push esi
mov esi, dword [sym.imp.msvcrt.dll_wcslen]
call esi
mov ebx, 0x6f331fb4
push ebx
mov edi, eax
call esi
pop ecx
add edi, eax
pop ecx
lea eax, [edi + edi + 4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
mov dword [ebp - 0x81c], edi
jne 0x6f338e22
mov eax, 0x8007000e
push eax
push 0x3d9025e
mov dword [ebp + 8], eax
call fcn.6f33d25f
jmp 0x6f3391b6
push dword [ebp + 0x10]
push edi
call dword [sym.imp.msvcrt.dll_wcscpy]
mov esi, dword [sym.imp.msvcrt.dll_wcscat]
push 0x6f331fb0
push edi
call esi
push ebx
push edi
call esi
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
push 0x80094006
lea eax, [ebp - 0x204]
push 0x6f331fa8
push eax
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
add esp, 0x24
push edi
lea eax, [ebp - 0x204]
push eax
push 0x6f331e38
mov edi, 0x6f331e84
push edi
call esi
test eax, eax
jne 0x6f338e89
call fcn.6f33f8fc
push eax
push 0x3e7025e
jmp 0x6f3391a8
cmp dword [ebp + 0x18], 0
je 0x6f338faa
push dword [ebp + 0x18]
lea eax, [ebp - 0x204]
push 0x6f331fa8
push eax
call ebx
add esp, 0xc
push dword [ebp - 0x81c]
lea eax, [ebp - 0x204]
push eax
push 0x6f331f88
push edi
call esi
test eax, eax
jne 0x6f338ed0
call fcn.6f33f8fc
push eax
push 0x3fa025e
jmp 0x6f3391a8
and dword [ebp + 8], 0
cmp dword [ebp + 0x18], 0
jle 0x6f339026
push dword [ebp + 8]
lea eax, [ebp - 0x60c]
push 0x6f331f70
push 0x6f331f64
push eax
call ebx
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
add esp, 0x10
push dword [eax + ecx*8]
lea eax, [ebp - 0x40c]
push eax
call fcn.6f33d175
push dword [ebp - 0x81c]
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x60c]
push eax
push edi
call esi
test eax, eax
je 0x6f338f8a
push dword [ebp + 8]
lea eax, [ebp - 0x60c]
push 0x6f331f5c
push 0x6f331f70
push 0x6f331f48
push eax
call ebx
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
add esp, 0x14
push dword [eax + ecx*8 + 4]
lea eax, [ebp - 0x40c]
push eax
call fcn.6f33d175
push dword [ebp - 0x81c]
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x60c]
push eax
push edi
call esi
test eax, eax
je 0x6f338f9a
inc dword [ebp + 8]
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x18]
jl 0x6f338ede
jmp 0x6f339026
call fcn.6f33f8fc
push eax
push 0x40b025e
jmp 0x6f3391a8
call fcn.6f33f8fc
push eax
push 0x41e025e
jmp 0x6f3391a8
lea eax, [ebp + 0x18]
push eax
push 0x6f331f88
push dword [ebp - 0x81c]
call fcn.6f338c29
cmp eax, 1
mov dword [ebp + 8], eax
jne 0x6f338fcd
mov dword [ebp + 8], 0x80004004
cmp dword [ebp + 8], 0
je 0x6f338fe0
push dword [ebp + 8]
push 0x435025e
jmp 0x6f3391ab
lea eax, [ebp + 0x18]
push eax
push 0x6f331f2c
push dword [ebp - 0x81c]
call fcn.6f338c29
test eax, eax
jne 0x6f339003
mov eax, dword [ebp + 0x18]
cmp dword [ebp + 0x20], eax
jbe 0x6f339003
mov dword [ebp + 0x20], eax
lea eax, [ebp + 0x18]
push eax
push 0x6f331f10
push dword [ebp - 0x81c]
call fcn.6f338c29
test eax, eax
jne 0x6f339026
mov eax, dword [ebp + 0x18]
cmp dword [ebp + 0x24], eax
jae 0x6f339026
mov dword [ebp + 0x24], eax
push dword [ebp + 0x20]
lea eax, [ebp - 0x204]
push 0x6f331fa8
push eax
call ebx
add esp, 0xc
push dword [ebp - 0x81c]
lea eax, [ebp - 0x204]
push eax
push 0x6f331f2c
push edi
call esi
test eax, eax
jne 0x6f339063
call fcn.6f33f8fc
push eax
push 0x455025e
jmp 0x6f3391a8
push dword [ebp + 0x24]
lea eax, [ebp - 0x204]
push 0x6f331fa8
push eax
call ebx
add esp, 0xc
push dword [ebp - 0x81c]
lea eax, [ebp - 0x204]
push eax
push 0x6f331f10
push edi
call esi
test eax, eax
jne 0x6f3390a0
call fcn.6f33f8fc
push eax
push 0x461025e
jmp 0x6f3391a8
push dword [ebp - 0x81c]
push dword [ebp + 0x1c]
push 0x6f331ee8
push edi
call esi
test eax, eax
jne 0x6f3390c5
call fcn.6f33f8fc
push eax
push 0x46c025e
jmp 0x6f3391a8
push dword [ebp - 0x81c]
push dword [ebp + 0xc]
push 0x6f331ec8
push edi
call esi
test eax, eax
jne 0x6f3390ea
call fcn.6f33f8fc
push eax
push 0x477025e
jmp 0x6f3391a8
mov eax, dword [ebp - 0x828]
test eax, eax
jne 0x6f3390f7
mov eax, dword [ebp + 0x10]
push dword [ebp - 0x81c]
push eax
push 0x6f331eb8
push edi
call esi
test eax, eax
jne 0x6f33911a
call fcn.6f33f8fc
push eax
push 0x482025e
jmp 0x6f3391a8
push 0
lea eax, [ebp - 0x204]
push 0x6f331fa8
push eax
call ebx
add esp, 0xc
push dword [ebp - 0x81c]
lea eax, [ebp - 0x204]
push eax
push 0x6f331e94
push edi
call esi
test eax, eax
jne 0x6f339153
call fcn.6f33f8fc
push eax
push 0x48e025e
jmp 0x6f3391a8
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x10]
push dword [ebp - 0x820]
push dword [ebp - 0x834]
call fcn.6f338862
test eax, eax
mov dword [ebp + 8], eax
je 0x6f33917c
push eax
push 0x497025e
jmp 0x6f3391ab
push dword [ebp - 0x81c]
push 0
push 0x6f331e38
push edi
call esi
test eax, eax
jne 0x6f3391e8
call fcn.6f33f8fc
push eax
push 0x4a1025e
jmp 0x6f3391a8
mov eax, 0x80004003
push eax
push 0x3a3025e
mov dword [ebp + 8], eax
call fcn.6f33d25f
cmp dword [ebp + 8], 0
je 0x6f3391e8
cmp dword [ebp - 0x81c], 0
je 0x6f3391e8
push dword [ebp - 0x81c]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x6f3391e8
call fcn.6f33f8fc
test eax, eax
je 0x6f3391e8
call fcn.6f33f8fc
push eax
push 0x4ab025e
call fcn.6f33d25f
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
xor edi, edi
cmp dword [ebp - 0x830], edi
je 0x6f339200
push dword [ebp - 0x830]
call esi
cmp dword [ebp - 0x828], edi
je 0x6f339210
push dword [ebp - 0x828]
call esi
cmp dword [ebp - 0x81c], edi
je 0x6f339220
push dword [ebp - 0x81c]
call esi
cmp dword [ebp - 0x824], edi
je 0x6f339230
push dword [ebp - 0x824]
call esi
cmp dword [ebp - 0x82c], edi
je 0x6f339240
push dword [ebp - 0x82c]
call esi
cmp dword [ebp - 0x820], edi
pop edi
pop esi
pop ebx
je 0x6f339257
push dword [ebp - 0x820]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
call fcn.6f339880
leave
ret 0x20