Function at 0x7cf6b84d
Capabilities:
Delete registry key
Delete registry value
Get common file path
Get session user name
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x62c
push ebx
push esi
lea eax, [ebp - 0x1c]
push edi
push eax
lea eax, [ebp - 0x62c]
push eax
mov dword [ebp - 0x1c], 0x200
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x7cf6b88f
lea eax, [ebp - 0x62c]
push 0x7cf4aabc
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x7cf6bc11
xor esi, esi
cmp dword [ebp + 8], esi
je 0x7cf6bbda
push esi
push 0x7cf3c510
lea eax, [ebp - 0x224]
push 0x104
push eax
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x14], esi
call fcn.7d032e56
lea eax, [ebp + 8]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push eax
lea eax, [ebp - 4]
push eax
push esi
push 5
push esi
push esi
lea eax, [ebp - 0x224]
push esi
mov edi, reloc.SHLWAPI.dll_ParseURLA
push eax
push edi
call ebx
test eax, eax
jne 0x7cf6bc11
cmp dword [ebp + 8], 2
jne 0x7cf6b925
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push esi
push 0x7cf3c4f0
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_SHQueryValueExW]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push esi
push 0x7cf4a00c
push dword [ebp - 4]
call dword [sym.imp.SHLWAPI.dll_SHQueryValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xc], 0x10e
jae 0x7cf6bafe
lea eax, [ebp - 0x224]
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 4]
push eax
push esi
push 6
push esi
push esi
lea eax, [ebp - 0x224]
push esi
push eax
push edi
call ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x7cf6b9c9
lea eax, [ebp - 8]
push 4
push eax
push 4
push esi
push 0x7cf3c4f0
push dword [ebp - 4]
mov dword [ebp - 8], 0x110
call ebx
lea eax, [ebp - 8]
push 4
push eax
push 4
push esi
push 0x7cf4a00c
push dword [ebp - 4]
mov dword [ebp - 8], 3
call ebx
lea eax, [ebp - 8]
push 4
push eax
push 4
push esi
push 0x7cf3c5f8
push dword [ebp - 4]
mov dword [ebp - 8], 1
call ebx
push 1
call fcn.7d035331
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 4]
push eax
push esi
push 4
push esi
push esi
push esi
push 0x7cf4aa50
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x7cf6ba6e
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push esi
push 6
push esi
push esi
push esi
push 0x7cf4aa40
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x7cf6ba65
lea eax, [ebp - 0x42c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x42c]
push 0x7cf4aa1c
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x42c]
push esi
push eax
push 0x7cf3d390
push esi
push dword [ebp - 8]
call dword [sym.imp.SHLWAPI.dll_SHRegSetPathW]
lea eax, [ebp - 0x10]
push 4
push eax
push 4
push esi
push 0x7cf4aa00
push dword [ebp - 8]
mov dword [ebp - 0x10], esi
call ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 4]
push eax
push esi
push 6
push esi
push esi
push esi
push 0x7cf4a2a8
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x7cf6babd
push 2
push 0x7cf32b54
push 1
push esi
push 0x7cf43de4
push dword [ebp - 4]
call ebx
push 2
push 0x7cf32b54
push 1
push esi
push 0x7cf4a298
push dword [ebp - 4]
call ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
push 1
call fcn.7d032936
push esi
push 0x7cf49ee0
lea eax, [ebp - 0x224]
push 0x104
push eax
call fcn.7d032e56
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 4]
push eax
push esi
push 4
push esi
push esi
lea eax, [ebp - 0x224]
push esi
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
jmp 0x7cf6bbcf
cmp dword [ebp - 0xc], 0x110
jae 0x7cf6bb20
lea eax, [ebp - 0xc]
push 4
push eax
push 4
push 0x7cf3c4d4
push 0x7cf3c478
push edi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
cmp dword [ebp - 0x14], 3
jae 0x7cf6bc11
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 4]
push eax
push esi
push 6
push esi
push esi
lea eax, [ebp - 0x224]
push esi
push eax
push edi
call ebx
test eax, eax
jne 0x7cf6bb6d
lea eax, [ebp - 0x10]
push 4
push eax
push 4
push esi
push 0x7cf4a00c
push dword [ebp - 4]
mov dword [ebp - 0x10], 3
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xc], 0x10f
ja 0x7cf6bb82
cmp dword [ebp - 0x14], 1
ja 0x7cf6bb82
push esi
call fcn.7d035331
push 1
push 1
call fcn.7d032936
push esi
push 0x7cf49ee0
lea eax, [ebp - 0x224]
push 0x104
push eax
call fcn.7d032e56
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push esi
push 0x2001f
push esi
push esi
lea eax, [ebp - 0x224]
push esi
push eax
push edi
call ebx
test eax, eax
jne 0x7cf6bc11
push 0x7cf4a6c4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x7cf6bc11
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push 0x7cf4a5d0
push reloc.SHLWAPI.dll_ParseURLW
call esi
mov edi, reloc.SHLWAPI.dll_ParseURLA
push 0x7cf4a488
push edi
call esi
push 0x7cf4a994
push edi
call esi
push 0x7cf4aa50
push edi
call esi
push 0x7cf4a2a8
push edi
call esi
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 4