Function at 0x6f33efb2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x3c4]
sub esp, 0x444
mov eax, dword [0x6f34110c]
push ebx
xor ebx, ebx
mov dword [ebp + 0x3c0], eax
mov eax, dword [ebp + 0x3e0]
cmp eax, ebx
push esi
push edi
mov dword [ebp - 0x5c], 0x80000002
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x70], ebx
je 0x6f33eff2
mov dword [eax], ebx
mov eax, dword [ebp + 0x3dc]
cmp eax, ebx
je 0x6f33effe
mov dword [eax], ebx
mov eax, dword [ebp + 0x3d8]
cmp eax, ebx
jne 0x6f33f018
mov esi, 0x80004003
push esi
push 0x89b01b5
jmp 0x6f33f5ab
mov edi, dword [ebp + 0x3d0]
push 8
push edi
push 0x6f332f30
mov dword [eax], ebx
call fcn.6f33ef7a
cmp eax, ebx
mov dword [ebp - 0x64], eax
je 0x6f33f044
test byte [ebp + 0x3d4], 4
je 0x6f33f044
mov dword [ebp - 0x5c], 0x80000001
cmp dword [ebp + 0x3cc], ebx
je 0x6f33f0a4
lea eax, [ebp + 0x3cc]
push eax
lea eax, [ebp - 0x6c]
push eax
push dword [ebp + 0x3cc]
call fcn.6f33e0c3
mov esi, eax
cmp esi, ebx
je 0x6f33f073
push esi
push 0x8ac01b5
jmp 0x6f33f5ab
cmp dword [ebp + 0x3cc], ebx
jne 0x6f33f0a4
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 0x5c]
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
mov esi, eax
cmp esi, ebx
je 0x6f33f0a4
push esi
push 0x8b101b5
push dword [ebp - 0x6c]
call fcn.6f33d289
jmp 0x6f33f5b0
cmp dword [ebp - 0x64], ebx
jne 0x6f33f11e
lea eax, [ebp - 0x58]
push eax
mov eax, dword [ebp + 0x3d4]
and al, 2
neg al
mov ebx, 0x6f331fd8
sbb eax, eax
and eax, 0xd0026
add eax, 0x20019
push eax
push 0
push ebx
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, 2
jne 0x6f33f10f
test byte [ebp + 0x3d4], 8
je 0x6f33f113
push eax
push 0x8bf01b5
call fcn.6f33d25f
lea eax, [ebp - 0x58]
push eax
push ebx
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov esi, eax
test esi, esi
je 0x6f33f11e
push esi
push 0x8c101b5
jmp 0x6f33f5ab
test esi, esi
je 0x6f33f11e
push esi
push 0x8c301b5
jmp 0x6f33f5ab
push 0x5c
push edi
call dword [sym.imp.msvcrt.dll_wcschr]
xor ebx, ebx
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0x7c], eax
mov esi, 0x6f332f20
jne 0x6f33f1a5
push 2
push edi
push 0x6f332d70
call fcn.6f33ef7a
test eax, eax
jne 0x6f33f1a5
push 6
push edi
push 0x6f332f10
call fcn.6f33ef7a
test eax, eax
jne 0x6f33f1a5
push 4
push edi
push 0x6f332f04
call fcn.6f33ef7a
test eax, eax
jne 0x6f33f1a5
push 7
push edi
push 0x6f331e84
call fcn.6f33ef7a
test eax, eax
jne 0x6f33f1a5
push 6
push edi
push esi
call fcn.6f33ef7a
test eax, eax
jne 0x6f33f1a5
cmp dword [ebp - 0x64], ebx
jne 0x6f33f1aa
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x54], edi
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x58], ebx
mov word [ebp + 0x1b8], bx
jmp 0x6f33f3cd
cmp dword [ebp - 0x64], ebx
je 0x6f33f1c7
lea eax, [ebp + 0x1b8]
add edi, 0x10
push 0x6f332e90
push eax
mov dword [ebp - 0x54], edi
call dword [sym.imp.msvcrt.dll_wcscpy]
jmp 0x6f33f3cb
push 6
push edi
push esi
mov word [ebp + 0x1b8], bx
call fcn.6f33ef7a
test eax, eax
mov ebx, 0x6f332d58
jne 0x6f33f235
lea eax, [ebp + 0x3d0]
push eax
lea eax, [ebp + 0x1b8]
push eax
lea eax, [ebp - 0x68]
push eax
push 0
push ebx
push dword [ebp - 0x58]
mov dword [ebp + 0x3d0], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
je 0x6f33f219
push esi
push 0x8f001b5
jmp 0x6f33f36d
cmp dword [ebp - 0x68], 1
je 0x6f33f235
cmp dword [ebp - 0x68], 7
je 0x6f33f235
mov esi, 0x8007000d
push esi
push 0x8f501b5
jmp 0x6f33f36d
push 2
push edi
push 0x6f332d70
call fcn.6f33ef7a
test eax, eax
je 0x6f33f251
add edi, 4
mov dword [ebp - 0x54], edi
jmp 0x6f33f2f9
push 6
push edi
push 0x6f332f10
call fcn.6f33ef7a
test eax, eax
je 0x6f33f26b
mov dword [ebp - 0x70], 0x6f332dfc
jmp 0x6f33f2ca
push 4
push edi
push 0x6f332f04
call fcn.6f33ef7a
test eax, eax
je 0x6f33f288
mov dword [ebp - 0x70], 0x6f332de4
add edi, 8
jmp 0x6f33f2cd
push 7
push edi
push 0x6f331e84
call fcn.6f33ef7a
test eax, eax
je 0x6f33f2b5
lea eax, [ebp + 0x1b8]
add edi, 0xe
push 0x6f331e54
push eax
mov dword [ebp - 0x54], edi
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
jmp 0x6f33f2f9
push 6
push edi
push 0x6f332f20
call fcn.6f33ef7a
test eax, eax
je 0x6f33f5a0
add edi, 0xc
cmp dword [ebp - 0x70], 0
mov dword [ebp - 0x54], edi
je 0x6f33f2f9
mov esi, dword [sym.imp.msvcrt.dll_wcscat]
lea eax, [ebp + 0x1b8]
push 0x6f331fb0
push eax
call esi
push dword [ebp - 0x70]
lea eax, [ebp + 0x1b8]
push eax
call esi
add esp, 0x10
cmp dword [ebp + 0x3dc], 0
je 0x6f33f3b5
lea eax, [ebp - 0x74]
push eax
push 0x20019
push 0
lea eax, [ebp + 0x1b8]
push eax
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
je 0x6f33f332
push esi
push 0x93901b5
jmp 0x6f33f41f
cmp dword [ebp - 0x70], 0
je 0x6f33f3cd
lea eax, [ebp + 0x3d0]
push eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x68]
push eax
push 0
push ebx
push dword [ebp - 0x74]
mov dword [ebp + 0x3d0], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
je 0x6f33f373
push esi
push 0x94501b5
push ebx
jmp 0x6f33f09a
cmp dword [ebp - 0x68], 1
je 0x6f33f38f
cmp dword [ebp - 0x68], 7
je 0x6f33f38f
mov esi, 0x8007000d
push esi
push 0x94a01b5
jmp 0x6f33f41f
mov esi, dword [sym.imp.msvcrt.dll_wcscat]
lea eax, [ebp + 0x1b8]
push 0x6f331fb0
push eax
call esi
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp + 0x1b8]
push eax
call esi
add esp, 0x10
jmp 0x6f33f3cd
cmp dword [ebp - 0x7c], 0
je 0x6f33f3cd
push dword [ebp - 0x7c]
lea eax, [ebp + 0x1b8]
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
pop ecx
pop ecx
cmp dword [ebp - 0x60], 0
jne 0x6f33f42b
mov eax, dword [ebp - 0x58]
test eax, eax
jne 0x6f33f3dd
mov eax, dword [ebp - 0x5c]
lea ecx, [ebp - 0x80]
push ecx
lea ecx, [ebp - 0x60]
push ecx
mov ecx, dword [ebp + 0x3d4]
and cl, 2
xor edi, edi
neg cl
push edi
sbb ecx, ecx
and ecx, 0xd0026
add ecx, 0x20019
push ecx
push edi
push edi
push edi
lea ecx, [ebp + 0x1b8]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
cmp esi, edi
je 0x6f33f42b
push esi
push 0x96f01b5
lea eax, [ebp + 0x1b8]
push eax
jmp 0x6f33f09a
mov eax, dword [ebp - 0x54]
cmp word [eax], 0x5c
jne 0x6f33f438
add dword [ebp - 0x54], 2
xor edi, edi
cmp dword [ebp + 0x3dc], edi
je 0x6f33f4a6
mov eax, dword [ebp - 0x54]
cmp word [eax], di
je 0x6f33f4a6
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x50]
push eax
mov dword [ebp + 0x3cc], edi
mov ebx, 0x104
push edi
jmp 0x6f33f492
push dword [ebp - 0x54]
lea eax, [ebp - 0x50]
push eax
call fcn.6f33dfc9
test eax, eax
je 0x6f33f4a0
inc dword [ebp + 0x3cc]
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x50]
push eax
push dword [ebp + 0x3cc]
push dword [ebp - 0x60]
mov dword [ebp - 0x78], ebx
call esi
test eax, eax
je 0x6f33f46a
jmp 0x6f33f4a6
lea eax, [ebp - 0x50]
mov dword [ebp - 0x54], eax
lea eax, [ebp + 0x1b8]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
cmp dword [ebp - 0x64], edi
lea eax, [eax + eax + 2]
pop ecx
mov dword [ebp + 0x3d0], eax
jne 0x6f33f4d3
test byte [ebp + 0x3d4], 1
je 0x6f33f4d3
add dword [ebp + 0x3d0], 0x70
push dword [ebp + 0x3d0]
mov esi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
push edi
call esi
cmp eax, edi
mov ebx, dword [ebp + 0x3d8]
mov dword [ebx], eax
jne 0x6f33f4fe
mov esi, 0x8007000e
push esi
push 0x99701b5
jmp 0x6f33f5ab
cmp dword [ebp - 0x64], edi
mov word [eax], di
jne 0x6f33f51e
test byte [ebp + 0x3d4], 1
je 0x6f33f51e
push 0x6f332e18
push dword [ebx]
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
lea eax, [ebp + 0x1b8]
push eax
push dword [ebx]
call dword [sym.imp.msvcrt.dll_wcscat]
cmp word [ebp + 0x1b8], di
pop ecx
pop ecx
jne 0x6f33f54f
mov eax, dword [ebp + 0x3d0]
mov ecx, dword [ebx]
shr eax, 1
lea eax, [ecx + eax*2 - 4]
cmp word [eax], 0x5c
jne 0x6f33f54f
mov word [eax], di
mov ebx, dword [ebp + 0x3dc]
cmp ebx, edi
je 0x6f33f58a
push dword [ebp - 0x54]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push edi
call esi
cmp eax, edi
mov dword [ebx], eax
jne 0x6f33f57e
mov esi, 0x8007000e
push esi
push 0x9ad01b5
jmp 0x6f33f5ab
push dword [ebp - 0x54]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
mov eax, dword [ebp + 0x3e0]
cmp eax, edi
je 0x6f33f59c
mov ecx, dword [ebp - 0x60]
mov dword [eax], ecx
mov dword [ebp - 0x60], edi
xor esi, esi
jmp 0x6f33f5b0
mov esi, 0x80070057
push esi
push 0x92301b5
call fcn.6f33d25f
cmp dword [ebp - 0x5c], 0x80000002
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x6f33f5cd
cmp dword [ebp - 0x5c], 0x80000001
je 0x6f33f5cd
push dword [ebp - 0x5c]
call edi
xor ebx, ebx
cmp dword [ebp - 0x58], ebx
je 0x6f33f5d9
push dword [ebp - 0x58]
call edi
cmp dword [ebp - 0x74], ebx
je 0x6f33f5e3
push dword [ebp - 0x74]
call edi
cmp dword [ebp - 0x60], ebx
je 0x6f33f5ed
push dword [ebp - 0x60]
call edi
cmp dword [ebp - 0x6c], ebx
mov edi, dword [sym.imp.KERNEL32.dll_LocalFree]
je 0x6f33f5fd
push dword [ebp - 0x6c]
call edi
cmp esi, ebx
je 0x6f33f632
mov eax, dword [ebp + 0x3d8]
cmp eax, ebx
je 0x6f33f61c
mov eax, dword [eax]
cmp eax, ebx
je 0x6f33f61c
push eax
call edi
mov eax, dword [ebp + 0x3d8]
mov dword [eax], ebx
mov ebx, dword [ebp + 0x3dc]
test ebx, ebx
je 0x6f33f632
mov eax, dword [ebx]
test eax, eax
je 0x6f33f632
push eax
call edi
and dword [ebx], 0
push esi
call fcn.6f33f8d1
mov ecx, dword [ebp + 0x3c0]
pop edi
pop esi
pop ebx
call fcn.6f339880
add ebp, 0x3c4
leave
ret 0x18