Function at 0x660000
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74c
push edi
mov dword [ebp - 0x62c], 0
mov dword [ebp - 0x41c], 0
mov byte [ebp - 0x210], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x20f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x524], 0x104
mov dword [ebp - 0x10c], 0
mov byte [ebp - 0x314], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x313]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x108], 0
mov byte [ebp - 0x628], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x627]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x418], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x417]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x520], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x51f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x62c]
push eax
push 0x20019
push 0
push 0x6e2bd4
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x660492
mov dword [ebp - 0x630], 0
jmp 0x660113
mov ecx, dword [ebp - 0x630]
add ecx, 1
mov dword [ebp - 0x630], ecx
mov edx, dword [0x6e973c]
mov eax, dword [ebp - 0x630]
cmp eax, dword [edx + 0xc]
jae 0x660483
mov ecx, dword [ebp - 0x630]
push ecx
push 0x6e2c04
lea edx, [ebp - 0x210]
push edx
call fcn.00642944
add esp, 0xc
push 0x104
push 0
lea eax, [ebp - 0x104]
push eax
call fcn.00642ec0
add esp, 0xc
mov dword [ebp - 0x524], 0x104
lea ecx, [ebp - 0x524]
push ecx
lea edx, [ebp - 0x104]
push edx
push 0
push 0
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [ebp - 0x62c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x660456
mov dword [ebp - 0x740], 0x5c
mov dword [ebp - 0x73c], 0
mov dword [ebp - 0x738], 0
mov edx, dword [ebp - 0x740]
push edx
lea eax, [ebp - 0x104]
push eax
call fcn.0064b420
add esp, 8
mov dword [ebp - 0x73c], eax
mov ecx, dword [ebp - 0x73c]
lea edx, [ebp - 0x104]
sub ecx, edx
mov dword [ebp - 0x738], ecx
mov eax, dword [ebp - 0x738]
push eax
lea ecx, [ebp - 0x104]
push ecx
lea edx, [ebp - 0x418]
push edx
call fcn.00642a60
add esp, 0xc
mov byte [ebp - 0x734], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x733]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x1c
mov eax, dword [ebp - 0x630]
imul eax, eax, 0x2c
mov ecx, dword [0x6e973c]
lea edx, [ecx + eax + 0x8a]
push edx
lea eax, [ebp - 0x734]
push eax
call fcn.00642a60
add esp, 0xc
push 0x6e2c08
call fcn.00642f60
add esp, 4
push eax
push 0x6e2c10
lea ecx, [ebp - 0x418]
push ecx
call fcn.00652046
add esp, 0xc
test eax, eax
jne 0x66042a
lea edx, [ebp - 0x104]
push edx
push 0x6e2c18
lea eax, [ebp - 0x628]
push eax
call fcn.00642944
add esp, 0xc
lea ecx, [ebp - 0x41c]
push ecx
push 0x20019
push 0
lea edx, [ebp - 0x628]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x660428
mov dword [ebp - 0x524], 0x104
lea eax, [ebp - 0x524]
push eax
lea ecx, [ebp - 0x104]
push ecx
push 0
push 0
push 0x6e2c3c
mov edx, dword [ebp - 0x41c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x66041b
lea eax, [ebp - 0x104]
push eax
push 2
call fcn.00660bff
add esp, 8
mov dword [ebp - 0x744], eax
cmp dword [ebp - 0x744], 1
jne 0x660351
cmp dword [ebp - 0x744], 0
je 0x660317
lea ecx, [ebp - 0x418]
mov dword [ebp - 0x74c], ecx
jmp 0x660321
mov dword [ebp - 0x74c], 0x6e2c44
mov edx, dword [ebp - 0x74c]
push edx
push 0x6e2c4c
mov eax, dword [ebp - 0x630]
imul eax, eax, 0x2c
mov ecx, dword [0x6e973c]
lea edx, [ecx + eax + 0x4fa]
push edx
call fcn.00642944
add esp, 0xc
jmp 0x66041b
mov dword [ebp - 0x524], 4
mov dword [ebp - 0x748], 0
lea eax, [ebp - 0x524]
push eax
lea ecx, [ebp - 0x748]
push ecx
push 0
push 0
push 0x6e2c50
mov edx, dword [ebp - 0x41c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x6603f0
mov eax, dword [ebp - 0x748]
and eax, 4
test eax, eax
je 0x6603c6
lea ecx, [ebp - 0x418]
push ecx
push 0x6e2c60
mov edx, dword [ebp - 0x630]
imul edx, edx, 0x2c
mov eax, dword [0x6e973c]
lea ecx, [eax + edx + 0x4fa]
push ecx
call fcn.00642944
add esp, 0xc
jmp 0x6603ee
push 0x6e2c64
push 0x6e2c6c
mov edx, dword [ebp - 0x630]
imul edx, edx, 0x2c
mov eax, dword [0x6e973c]
lea ecx, [eax + edx + 0x4fa]
push ecx
call fcn.00642944
add esp, 0xc
jmp 0x66041b
lea edx, [ebp - 0x418]
push edx
push 0x6e2c70
mov eax, dword [ebp - 0x630]
imul eax, eax, 0x2c
mov ecx, dword [0x6e973c]
lea edx, [ecx + eax + 0x4fa]
push edx
call fcn.00642944
add esp, 0xc
mov eax, dword [ebp - 0x41c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x660454
lea ecx, [ebp - 0x418]
push ecx
push 0x6e2c74
mov edx, dword [ebp - 0x630]
imul edx, edx, 0x2c
mov eax, dword [0x6e973c]
lea ecx, [eax + edx + 0x4fa]
push ecx
call fcn.00642944
add esp, 0xc
jmp 0x66047e
push 0x6e2c78
push 0x6e2c7c
mov edx, dword [ebp - 0x630]
imul edx, edx, 0x2c
mov eax, dword [0x6e973c]
lea ecx, [eax + edx + 0x4fa]
push ecx
call fcn.00642944
add esp, 0xc
jmp 0x660104
mov edx, dword [ebp - 0x62c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x660496
xor eax, eax
jmp 0x6604ca
push 0x6e2c80
call fcn.00642f60
add esp, 4
push eax
push 0x6e2c88
mov eax, dword [ebp + 8]
imul eax, eax, 0x2c
mov ecx, dword [0x6e973c]
lea edx, [ecx + eax + 0x4fa]
push edx
call fcn.00652046
add esp, 0xc
neg eax
sbb eax, eax
inc eax
pop edi
mov esp, ebp
pop ebp
ret