Function at 0x6b60e0
Capabilities:
Extract resource via kernel32 functions
Query environment variable
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov dword [ebp - 0x44], 0x2766
mov dword [ebp - 8], 0xe773
mov dword [ebp - 0x14], 0x833
mov dword [ebp - 0x18], 0x13bcb
mov dword [ebp - 0x3c], 0x14d41
mov dword [ebp - 0x24], 0x9344
mov dword [ebp - 0xc], 0x14e0
mov dword [ebp - 0x48], 0x18103
mov dword [ebp - 0x4c], 0xccdd
mov dword [ebp - 0x28], 0x18030
mov dword [ebp - 0x20], 0xf2a2
mov dword [ebp - 0x60], 0x85e3
mov dword [ebp - 0x38], 0x17d80
mov dword [ebp - 0x1c], 0x157b3
mov dword [ebp - 0x58], 0xb2c5
mov dword [ebp - 0x40], 0xf642
mov dword [ebp - 0x10], 0x3036
mov dword [ebp - 0x50], 0x5d93
mov dword [ebp - 0x34], 0x3ac1
mov dword [ebp - 0x54], 0x17b71
mov dword [ebp - 0x2c], 0xa035
mov dword [ebp - 0x30], 0x166cd
mov dword [ebp - 4], 0xe8e7
mov dword [ebp - 0x5c], 0xbc4c
mov eax, dword [0x7f8330]
or eax, dword [0x7f83b8]
and eax, dword [ebp - 0x24]
xor eax, dword [ebp - 0x48]
je 0x6b61ad
mov ecx, dword [ebp - 0x18]
add ecx, 1
mov dword [ebp - 0x18], ecx
mov edx, dword [0x7f83b4]
add edx, 0x7c93
push edx
mov eax, dword [0x7f8330]
add eax, 0x190c
push eax
mov ecx, dword [ebp - 0x54]
sub ecx, 0x80bf
push ecx
mov edx, dword [ebp - 4]
sub edx, 0xa67b
push edx
mov eax, dword [ebp - 0x48]
sub eax, 0x49d6
push eax
mov ecx, dword [ebp - 0x48]
sub ecx, 0x2a08
push ecx
mov edx, dword [ebp - 0x44]
add edx, 0x8e06
push edx
call fcn.004202b0
add esp, 0x1c
mov eax, dword [ebp - 0x40]
sub eax, 0xd459
push eax
mov ecx, dword [0x7f83b4]
add ecx, 0x1c51
push ecx
mov edx, dword [ebp - 0x24]
sub edx, 0x4fca
push edx
mov eax, dword [ebp - 0x5c]
add eax, 0x7b07
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x6994
push ecx
mov edx, dword [ebp - 0x28]
sub edx, 0xb0cd
push edx
mov eax, dword [ebp - 0x38]
sub eax, 0xa613
push eax
mov ecx, dword [0x7f832c]
sub ecx, 0xe0b
push ecx
call fcn.00412040
add esp, 0x20
mov dword [ebp - 0x64], 0
jmp 0x6b626b
mov edx, dword [ebp - 0x64]
add edx, 1
mov dword [ebp - 0x64], edx
mov eax, dword [ebp - 8]
sub eax, 0xe772
cmp dword [ebp - 0x64], eax
jge 0x6b6283
mov ecx, dword [ebp - 0x40]
sub ecx, 1
mov dword [ebp - 0x40], ecx
jmp 0x6b6262
mov edx, dword [ebp - 0x44]
add edx, 0xefc8
push edx
mov eax, dword [ebp - 0x38]
sub eax, 0xff1c
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xbe7e
push ecx
mov edx, dword [ebp - 0x1c]
sub edx, 0x13d22
push edx
mov eax, dword [0x7f8388]
add eax, 0x14a7c
push eax
call fcn.004093e0
add esp, 0x14
mov dword [ebp - 0x68], 0
jmp 0x6b62cf
mov ecx, dword [ebp - 0x68]
add ecx, 1
mov dword [ebp - 0x68], ecx
mov edx, dword [ebp - 0x24]
sub edx, 0x9343
cmp dword [ebp - 0x68], edx
jge 0x6b62e8
mov eax, dword [ebp - 0xc]
sub eax, 1
mov dword [ebp - 0xc], eax
jmp 0x6b62c6
mov dword [ebp - 0x6c], 0
jmp 0x6b62fa
mov ecx, dword [ebp - 0x6c]
add ecx, 1
mov dword [ebp - 0x6c], ecx
mov edx, dword [ebp - 0x54]
sub edx, 0x17b70
cmp dword [ebp - 0x6c], edx
jge 0x6b6317
mov eax, dword [0x7f8334]
sub eax, 1
mov dword [0x7f8334], eax
jmp 0x6b62f1
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0x30]
jge 0x6b6372
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 0xc]
jne 0x6b6372
mov eax, dword [ebp - 0x2c]
cmp eax, dword [0x7f8328]
jne 0x6b6372
mov ecx, dword [0x7f82fc]
cmp ecx, dword [ebp - 0x34]
jne 0x6b6372
push 0x490f
push 0x134b6
push 0x14460
push 0xe177
push 0x133eb
push 0x10a3d
push 0x15afe
call dword [sym.imp.KERNEL32.dll_LoadResource]
add esp, 0x1c
mov edx, dword [ebp - 0x18]
sub edx, 1
mov dword [ebp - 0x18], edx
mov eax, 0xc1ec
sub eax, dword [ebp + 0x10]
xor eax, 0xb505
mov ecx, dword [ebp + 0x24]
add ecx, 0x1fd
xor ecx, 0x1590
mov byte [ecx + str.olNByXAAezUJVSxtUpH], al
mov edx, dword [ebp - 0x24]
add edx, 0x34ab
push edx
mov eax, dword [0x7f82f8]
add eax, 0x7c2e
push eax
mov ecx, dword [0x7f8324]
add ecx, 0x107b1
push ecx
call fcn.00413430
add esp, 0xc
mov edx, dword [ebp + 8]
xor edx, 0x9000
xor edx, 0x4e54
mov eax, dword [ebp + 0xc]
and eax, 0xffff61c6
xor eax, 0x418c
mov byte [eax + str.olNByXAAezUJVSxtUpH], dl
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0xc]
xor edx, 0x7400
xor edx, 0x6c6417e5
mov eax, dword [ebp + 0x10]
and eax, 0x5908
xor eax, 0x804
mov dword [eax + str.olNByXAAezUJVSxtUpH], edx
mov ecx, dword [ebp - 0x20]
cmp ecx, dword [ebp - 0xc]
jge 0x6b641f
mov dword [ebp - 0x9c], 1
jmp 0x6b6429
mov dword [ebp - 0x9c], 0
mov edx, dword [0x7f83b8]
add edx, dword [ebp - 0x10]
cmp edx, dword [0x7f8388]
jge 0x6b6446
mov dword [ebp - 0xa0], 1
jmp 0x6b6450
mov dword [ebp - 0xa0], 0
mov eax, dword [ebp - 0x9c]
or eax, dword [ebp - 0xa0]
je 0x6b6467
mov ecx, dword [ebp - 0x3c]
sub ecx, 1
mov dword [ebp - 0x3c], ecx
mov edx, dword [ebp + 0x28]
and edx, 0xc54e
and edx, 0x4a0e
and edx, 0x3131
xor edx, 0x6c
mov eax, dword [ebp + 0x28]
and eax, 0x79a
xor eax, 0x400
mov byte [eax + str.olNByXAAezUJVSxtUpH], dl
mov ecx, dword [0x7f8324]
sub ecx, 1
mov dword [0x7f8324], ecx
mov dword [ebp - 0x70], 0
jmp 0x6b64b3
mov edx, dword [ebp - 0x70]
add edx, 1
mov dword [ebp - 0x70], edx
mov eax, dword [ebp - 0xc]
sub eax, 0x14de
cmp dword [ebp - 0x70], eax
jge 0x6b64d1
mov ecx, dword [0x7f83b4]
add ecx, 1
mov dword [0x7f83b4], ecx
jmp 0x6b64aa
mov dword [ebp - 0x74], 0
jmp 0x6b64e3
mov edx, dword [ebp - 0x74]
add edx, 1
mov dword [ebp - 0x74], edx
mov eax, dword [ebp - 0x20]
sub eax, 0xf2a1
cmp dword [ebp - 0x74], eax
jge 0x6b6582
mov ecx, dword [0x7f8334]
cmp ecx, dword [ebp - 0x5c]
jge 0x6b650b
mov dword [ebp - 0xa4], 1
jmp 0x6b6515
mov dword [ebp - 0xa4], 0
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
cmp eax, dword [0x7f83b4]
jge 0x6b6535
mov dword [ebp - 0xa8], 1
jmp 0x6b653f
mov dword [ebp - 0xa8], 0
mov ecx, dword [0x7f8330]
add ecx, dword [ebp - 4]
and ecx, dword [ebp - 0xa4]
and ecx, dword [ebp - 0xa8]
je 0x6b657d
mov edx, dword [ebp - 0x50]
cmp edx, dword [ebp - 0x34]
jne 0x6b657d
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x14]
jne 0x6b657d
push 0x16dd9
call dword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
add esp, 4
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
jmp 0x6b64da
mov edx, dword [ebp - 0x40]
cmp edx, dword [ebp - 0x1c]
jge 0x6b6596
mov dword [ebp - 0xac], 1
jmp 0x6b65a0
mov dword [ebp - 0xac], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x100], eax
mov ecx, dword [0x7f8388]
mov dword [ebp - 0x104], ecx
mov edx, dword [ebp - 0x10]
sub edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x100]
cmp eax, dword [ebp - 0x104]
jge 0x6b65d8
mov dword [ebp - 0xb0], 1
jmp 0x6b65e2
mov dword [ebp - 0xb0], 0
mov ecx, dword [ebp - 0xac]
or ecx, dword [ebp - 0xb0]
je 0x6b66cd
mov edx, dword [ebp - 0x58]
cmp edx, dword [0x7f8324]
jne 0x6b66cd
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 8]
jne 0x6b66cd
mov ecx, dword [ebp - 0x2c]
cmp ecx, dword [ebp - 0x20]
jne 0x6b66cd
push 0x3338
push 0x14db9
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
add esp, 8
mov edx, dword [0x7f8320]
add edx, 1
mov dword [0x7f8320], edx
mov eax, dword [0x7f838c]
add eax, dword [0x7f8320]
and eax, dword [ebp - 0x34]
or eax, dword [ebp - 8]
mov dword [ebp - 0x108], eax
mov ecx, dword [ebp - 0x34]
add ecx, 1
mov dword [ebp - 0x34], ecx
cmp dword [ebp - 0x108], 0
je 0x6b66cd
mov edx, dword [ebp - 0x14]
cmp edx, dword [0x7f83b4]
jne 0x6b66cd
mov eax, dword [0x7f8324]
cmp eax, dword [ebp - 0x54]
jne 0x6b66cd
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [0x7f83b4]
jne 0x6b66cd
mov edx, dword [ebp - 0x1c]
and edx, dword [ebp - 4]
je 0x6b6697
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [ebp - 0x1c], eax
push 0x171d9
push 0x13bdf
push 0x18561
push 0x9d8a
push 0x17be7
push 0xe4d
push 0x2117
push 0x13b0c
push 0xfb43
call dword [sym.imp.KERNEL32.dll_CloseThreadpoolCleanupGroup]
add esp, 0x24
mov ecx, dword [0x7f8330]
add ecx, 0xe00
push ecx
mov edx, dword [0x7f83b4]
add edx, 0x50a6
push edx
mov eax, dword [ebp - 0x2c]
sub eax, 0x97a6
push eax
mov ecx, dword [ebp - 0x3c]
add ecx, 0x28f2
push ecx
call fcn.0041f5b0
add esp, 0x10
mov edx, dword [ebp - 0x2c]
add edx, 1
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp + 0x10]
xor eax, 0xcd67
xor eax, 0x6c64b55b
mov ecx, 0x27b5
sub ecx, dword [ebp + 0x14]
xor ecx, 0x231c
mov dword [ecx + str.olNByXAAezUJVSxtUpH], eax
mov dword [ebp - 0x78], 0
jmp 0x6b673e
mov edx, dword [ebp - 0x78]
add edx, 1
mov dword [ebp - 0x78], edx
mov eax, dword [ebp - 0x44]
sub eax, 0x2765
cmp dword [ebp - 0x78], eax
jge 0x6b675c
mov ecx, dword [0x7f838c]
sub ecx, 1
mov dword [0x7f838c], ecx
jmp 0x6b6735
mov dword [ebp - 0x7c], 0
jmp 0x6b676e
mov edx, dword [ebp - 0x7c]
add edx, 1
mov dword [ebp - 0x7c], edx
mov eax, dword [ebp - 0x60]
sub eax, 0x85e2
cmp dword [ebp - 0x7c], eax
jge 0x6b6786
mov ecx, dword [ebp - 0x20]
add ecx, 1
mov dword [ebp - 0x20], ecx
jmp 0x6b6765
mov edx, dword [ebp + 0x24]
or edx, 0x697f
add edx, 0xf12a
xor edx, 0x677a
xor edx, 0x10ad1
mov eax, dword [ebp + 0x24]
or eax, 0x71a4
sub eax, 0xdce0
xor eax, 0x495c
xor eax, 0xffffdf94
mov byte [eax + str.olNByXAAezUJVSxtUpH], dl
mov ecx, dword [ebp - 0x20]
sub ecx, 1
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp + 0x18]
xor edx, 0xc356
xor edx, 0x8894
mov eax, dword [ebp + 0x24]
xor eax, 0xf6bd
xor eax, 0xe537
mov byte [eax + str.olNByXAAezUJVSxtUpH], dl
mov dword [ebp - 0x80], 0
jmp 0x6b67fb
mov ecx, dword [ebp - 0x80]
add ecx, 1
mov dword [ebp - 0x80], ecx
mov edx, dword [ebp - 0x40]
sub edx, 0xf640
cmp dword [ebp - 0x80], edx
jge 0x6b681e
mov eax, dword [0x7f83b8]
cmp eax, dword [ebp - 0x3c]
jge 0x6b681c
mov ecx, dword [ebp - 0x28]
sub ecx, 1
mov dword [ebp - 0x28], ecx
jmp 0x6b67f2
mov edx, dword [0x7f83b4]
sub edx, 1
mov dword [0x7f83b4], edx
mov eax, 0x1f80
sub eax, dword [ebp + 0x28]
sub eax, 0xb62a
xor eax, 0xffff5c2a
mov ecx, dword [ebp + 0x10]
or ecx, 0x38da
xor ecx, 0xe45c
xor ecx, 0xd897
mov byte [ecx + str.olNByXAAezUJVSxtUpH], al
mov edx, dword [ebp - 0xc]
add edx, 0x16bab
push edx
mov eax, dword [0x7f8388]
add eax, 0xb9c6
push eax
mov ecx, dword [0x7f8388]
add ecx, 0x260d
push ecx
mov edx, dword [ebp - 0x38]
add edx, 0x642
push edx
mov eax, dword [ebp - 4]
add eax, 0x742
push eax
call fcn.00407be0
add esp, 0x14
mov ecx, dword [ebp + 0x20]
and ecx, 0x58a6
sub ecx, 0xe7af
xor ecx, 0xffff607b
mov edx, dword [ebp + 0x10]
and edx, 0x3879
xor edx, 0x840
mov byte [edx + str.olNByXAAezUJVSxtUpH], cl
mov dword [ebp - 0x84], 0
jmp 0x6b68dc
mov eax, dword [ebp - 0x84]
add eax, 1
mov dword [ebp - 0x84], eax
mov ecx, dword [ebp - 0x30]
sub ecx, 0x166cc
cmp dword [ebp - 0x84], ecx
jge 0x6b68f8
mov edx, dword [ebp - 0x60]
add edx, 1
mov dword [ebp - 0x60], edx
jmp 0x6b68cd
mov eax, dword [ebp - 0x30]
sub eax, 0x4f9f
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x7631
push ecx
mov edx, dword [0x7f8328]
add edx, 0x78fd
push edx
mov eax, dword [ebp - 0x30]
sub eax, 0x14c3c
push eax
mov ecx, dword [0x7f8320]
add ecx, 0x7a17
push ecx
call fcn.004093e0
add esp, 0x14
mov edx, 0x331f
sub edx, dword [ebp + 0x10]
xor edx, 0x2682
mov eax, dword [ebp + 8]
or eax, 0xffff7937
add eax, 0xd35f
xor eax, 0xd310
mov byte [eax + str.olNByXAAezUJVSxtUpH], dl
mov ecx, dword [0x7f832c]
sub ecx, 0x581
push ecx
mov edx, dword [ebp - 0x40]
sub edx, 0x3d47
push edx
mov eax, dword [ebp - 0x1c]
sub eax, 0x5d00
push eax
mov ecx, dword [ebp - 0x40]
sub ecx, 0xb3d5
push ecx
mov edx, dword [0x7f8388]
add edx, 0x11b72
push edx
mov eax, dword [ebp - 0x14]
add eax, 0x14ec8
push eax
mov ecx, dword [0x7f8320]
sub ecx, 0x36b4
push ecx
call fcn.004202b0
add esp, 0x1c
mov edx, 0x6bc7
sub edx, dword [ebp + 0x28]
xor edx, 0x5f5e
mov eax, 0xdd7b
sub eax, dword [ebp + 0x28]
add eax, 0xabbd
xor eax, 0x17cc6
mov byte [eax + str.olNByXAAezUJVSxtUpH], dl
mov dword [ebp - 0x88], 0
jmp 0x6b69f2
mov ecx, dword [ebp - 0x88]
add ecx, 1
mov dword [ebp - 0x88], ecx
mov edx, dword [ebp - 0x44]
sub edx, 0x2765
cmp dword [ebp - 0x88], edx
jge 0x6b6a0e
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
jmp 0x6b69e3
mov dword [ebp - 0x8c], 0
jmp 0x6b6a29
mov ecx, dword [ebp - 0x8c]
add ecx, 1
mov dword [ebp - 0x8c], ecx
mov edx, dword [ebp - 0x1c]
sub edx, 0x157b1
cmp dword [ebp - 0x8c], edx
jge 0x6b6a49
mov eax, dword [0x7f8320]
sub eax, 1
mov dword [0x7f8320], eax
jmp 0x6b6a1a
mov dword [ebp - 0x90], 0
jmp 0x6b6a64
mov ecx, dword [ebp - 0x90]
add ecx, 1
mov dword [ebp - 0x90], ecx
mov edx, dword [ebp - 0x44]
sub edx, 0x2765
cmp dword [ebp - 0x90], edx
jge 0x6b6b96
mov eax, dword [0x7f832c]
mov dword [ebp - 0x10c], eax
mov ecx, dword [0x7f82fc]
mov dword [ebp - 0x110], ecx
mov edx, dword [0x7f82fc]
sub edx, 1
mov dword [0x7f82fc], edx
mov eax, dword [ebp - 0x10c]
cmp eax, dword [ebp - 0x110]
jge 0x6b6b91
mov ecx, dword [0x7f83b4]
cmp ecx, dword [ebp - 0x50]
jne 0x6b6b91
mov edx, dword [ebp - 0x28]
cmp edx, dword [ebp - 4]
jne 0x6b6b91
mov eax, dword [0x7f8388]
cmp eax, dword [ebp - 8]
jne 0x6b6b91
mov ecx, dword [0x7f8328]
cmp ecx, dword [0x7f8334]
jne 0x6b6b91
push 0x3839
push 0x18047
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
add esp, 8
mov edx, dword [ebp - 0x1c]
sub edx, 1
mov dword [ebp - 0x1c], edx
mov eax, dword [0x7f8388]
sub eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x50]
jge 0x6b6b21
mov dword [ebp - 0xb4], 1
jmp 0x6b6b2b
mov dword [ebp - 0xb4], 0
mov ecx, dword [0x7f838c]
sub ecx, 1
mov dword [0x7f838c], ecx
mov edx, dword [ebp - 0x20]
and edx, dword [0x7f838c]
cmp edx, dword [0x7f832c]
jge 0x6b6b57
mov dword [ebp - 0xb8], 1
jmp 0x6b6b61
mov dword [ebp - 0xb8], 0
mov eax, dword [ebp - 0x28]
add eax, 1
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
imul ecx, dword [0x7f8334]
and ecx, dword [ebp - 0xb4]
and ecx, dword [ebp - 0xb8]
je 0x6b6b91
mov edx, dword [0x7f82fc]
add edx, 1
mov dword [0x7f82fc], edx
jmp 0x6b6a55
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x34]
add ecx, 0x127db
push ecx
mov edx, dword [0x7f83b8]
sub edx, 0x10baf
push edx
mov eax, dword [ebp - 0xc]
add eax, 0xd25d
push eax
call fcn.0040fff0
add esp, 0xc
mov ecx, dword [ebp - 8]
imul ecx, dword [ebp - 0x24]
cmp ecx, dword [ebp - 0x34]
jge 0x6b6bdf
mov dword [ebp - 0xbc], 1
jmp 0x6b6be9
mov dword [ebp - 0xbc], 0
mov edx, dword [0x7f838c]
mov dword [ebp - 0x114], edx
mov eax, dword [0x7f8324]
mov dword [ebp - 0x118], eax
mov ecx, dword [0x7f8324]
add ecx, 1
mov dword [0x7f8324], ecx
mov edx, dword [ebp - 0x114]
cmp edx, dword [ebp - 0x118]
jge 0x6b6c29
mov dword [ebp - 0xc0], 1
jmp 0x6b6c33
mov dword [ebp - 0xc0], 0
mov eax, dword [ebp - 0x20]
xor eax, dword [0x7f82f8]
cmp eax, dword [ebp - 0x48]
jge 0x6b6c4d
mov dword [ebp - 0xc4], 1
jmp 0x6b6c57
mov dword [ebp - 0xc4], 0
mov ecx, dword [ebp - 0xbc]
and ecx, dword [ebp - 0xc0]
and ecx, dword [ebp - 0xc4]
je 0x6b6ca9
mov edx, dword [ebp - 0x34]
cmp edx, dword [0x7f8334]
jne 0x6b6ca9
mov eax, dword [ebp - 0x50]
cmp eax, dword [ebp - 0x5c]
jne 0x6b6ca9
push 0x615b
push 0x5db5
push 0x18585
push 0xf789
push 0x1c8d
call dword [sym.imp.KERNEL32.dll_EnumResourceLanguagesExW]
add esp, 0x14
mov ecx, dword [ebp - 0x24]
add ecx, 1
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x94], 0
jmp 0x6b6cc4
mov edx, dword [ebp - 0x94]
add edx, 1
mov dword [ebp - 0x94], edx
mov eax, dword [ebp - 0x2c]
sub eax, 0xa035
cmp dword [ebp - 0x94], eax
jge 0x6b6d2f
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x4c]
cmp ecx, dword [0x7f8328]
jge 0x6b6cee
mov dword [ebp - 0xc8], 1
jmp 0x6b6cf8
mov dword [ebp - 0xc8], 0
mov edx, dword [ebp - 4]
cmp edx, dword [ebp - 0x30]
jge 0x6b6d0c
mov dword [ebp - 0xcc], 1
jmp 0x6b6d16
mov dword [ebp - 0xcc], 0
mov eax, dword [ebp - 0xc8]
and eax, dword [ebp - 0xcc]
je 0x6b6d2d
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
jmp 0x6b6cb5
mov edx, dword [ebp - 0x3c]
add edx, 1
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [0x7f8334]
jge 0x6b6e5b
mov edx, dword [0x7f83b4]
cmp edx, dword [ebp - 0x50]
jge 0x6b6d67
mov dword [ebp - 0xd0], 1
jmp 0x6b6d71
mov dword [ebp - 0xd0], 0
mov eax, dword [ebp - 0x58]
add eax, dword [ebp - 0x48]
cmp eax, dword [ebp - 0x10]
jge 0x6b6d88
mov dword [ebp - 0xd4], 1
jmp 0x6b6d92
mov dword [ebp - 0xd4], 0
mov ecx, dword [ebp - 0xd0]
and ecx, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x18]
imul edx, dword [ebp - 0x4c]
or ecx, edx
je 0x6b6e5b
mov eax, dword [ebp - 0xc]
cmp eax, dword [0x7f8324]
jne 0x6b6e5b
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [ebp - 0x28]
jne 0x6b6e5b
mov edx, dword [ebp - 0x1c]
and edx, dword [ebp - 0x38]
and edx, dword [ebp - 0x48]
xor edx, dword [ebp - 4]
je 0x6b6e25
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x58]
jne 0x6b6e25
mov ecx, dword [ebp - 0x54]
cmp ecx, dword [ebp - 0x4c]
jne 0x6b6e25
mov edx, dword [0x7f8328]
cmp edx, dword [ebp - 0x30]
jne 0x6b6e25
push 0x46c8
push 0x404d
push 0xd534
push 0x1078d
push 0xb995
push 0x3488
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
add esp, 0x18
mov eax, dword [0x7f8330]
add eax, 1
mov dword [0x7f8330], eax
push 0xb6e4
push 0xa852
push 0x14247
push 0x4a00
push 0xbb8e
push 0x6a39
push 0x6882
push 0x6281
push 0x3685
call dword [sym.imp.KERNEL32.dll_CancelSynchronousIo]
add esp, 0x24
call fcn.004153e0
mov ecx, dword [ebp - 0x30]
sub ecx, 0xb8df
push ecx
mov edx, dword [0x7f82f8]
add edx, 0x115c6
push edx
mov eax, dword [ebp - 0x30]
sub eax, 0x15e3e
push eax
mov ecx, dword [0x7f8328]
add ecx, 0x1007b
push ecx
call fcn.0041f5b0
add esp, 0x10
mov edx, dword [ebp + 0x24]
xor edx, 0x9e20
xor edx, 0x3890
xor edx, 0xb5dd
mov eax, dword [ebp + 0xc]
xor eax, 0xdbc1
xor eax, 0x9642
mov byte [eax + str.olNByXAAezUJVSxtUpH], dl
mov ecx, dword [0x7f8328]
add ecx, 0xfce7
push ecx
mov edx, dword [ebp - 8]
sub edx, 0x2e79
push edx
mov eax, dword [ebp - 0x4c]
add eax, 0x2dd5
push eax
mov ecx, dword [ebp - 0x2c]
sub ecx, 0x5dca
push ecx
mov edx, dword [ebp - 0x38]
sub edx, 0x4653
push edx
mov eax, dword [ebp - 0x14]
add eax, 0x14ec8
push eax
mov ecx, dword [ebp - 0x30]
sub ecx, 0xb161
push ecx
call fcn.004202b0
add esp, 0x1c
mov edx, dword [ebp + 0x18]
or edx, 0xdeff
and edx, 0x6aa
xor edx, 0x677
mov eax, 0xe4ff
sub eax, dword [ebp + 0x10]
xor eax, 0xd8a6
mov byte [eax + str.olNByXAAezUJVSxtUpH], dl
mov dword [ebp - 0x98], 0
jmp 0x6b6f4f
mov ecx, dword [ebp - 0x98]
add ecx, 1
mov dword [ebp - 0x98], ecx
mov edx, dword [ebp - 0x44]
sub edx, 0x2765
cmp dword [ebp - 0x98], edx
jge 0x6b7041
mov eax, dword [0x7f83b4]
cmp eax, dword [ebp - 0x48]
jge 0x6b6f7a
mov dword [ebp - 0xd8], 1
jmp 0x6b6f84
mov dword [ebp - 0xd8], 0
mov ecx, dword [ebp - 0x2c]
cmp ecx, dword [ebp - 0x24]
jge 0x6b6f98
mov dword [ebp - 0xdc], 1
jmp 0x6b6fa2
mov dword [ebp - 0xdc], 0
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 8]
jge 0x6b6fb6
mov dword [ebp - 0xe0], 1
jmp 0x6b6fc0
mov dword [ebp - 0xe0], 0
mov eax, dword [ebp - 0xd8]
and eax, dword [ebp - 0xdc]
and eax, dword [ebp - 0xe0]
or eax, dword [ebp - 0x54]
je 0x6b703c
mov ecx, dword [0x7f83b4]
cmp ecx, dword [0x7f83b8]
jge 0x6b6ff1
mov dword [ebp - 0xe8], 1
jmp 0x6b6ffb
mov dword [ebp - 0xe8], 0
mov edx, dword [ebp - 0x2c]
cmp edx, dword [ebp - 0x14]
jge 0x6b700f
mov dword [ebp - 0xe4], 1
jmp 0x6b7019
mov dword [ebp - 0xe4], 0
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
xor ecx, dword [ebp - 0xe4]
or ecx, dword [ebp - 0xe8]
je 0x6b703c
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
jmp 0x6b6f40
mov eax, dword [ebp - 0x14]
and eax, dword [ebp - 0x24]
je 0x6b7088
mov ecx, dword [0x7f82f8]
cmp ecx, dword [ebp - 0x34]
jne 0x6b7088
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 0x58]
jne 0x6b7088
mov eax, dword [0x7f8334]
cmp eax, dword [ebp - 0x18]
jne 0x6b7088
mov ecx, dword [0x7f8330]
cmp ecx, dword [ebp - 0x50]
jne 0x6b7088
push 0xc7dc
call dword [sym.imp.KERNEL32.dll_GetHandleInformation]
add esp, 4
mov edx, dword [ebp - 0xc]
sub edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x18]
sub eax, 1
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x4c]
sub ecx, 1
mov dword [ebp - 0x4c], ecx
mov edx, dword [ebp - 0x44]
add edx, 0x15924
push edx
mov eax, dword [0x7f8328]
add eax, 0x5fca
push eax
mov ecx, dword [ebp - 0x3c]
sub ecx, 0x10b79
push ecx
mov edx, dword [0x7f82fc]
add edx, 0x14188
push edx
mov eax, dword [0x7f832c]
sub eax, 0x87f6
push eax
call fcn.00407be0
add esp, 0x14
mov eax, str.olNByXAAezUJVSxtUpH
jmp 0x6b73bf
mov esp, ebp
pop ebp
ret