Function at 0x6601b804
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d4
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov eax, dword [eax]
xor ebx, ebx
or edi, 0xffffffff
cmp eax, ebx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x1c], eax
je 0x6603c504
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea eax, [ebp - 0x18]
push eax
push ebx
push SysReAllocStringLen
call esi
cmp eax, ebx
jne 0x6603c513
mov edi, dword [ebp - 0xc]
lea eax, [ebp - 0xc]
push eax
push 0x6601bdb0
push dword [ebp - 0x18]
call esi
cmp eax, ebx
jne 0x6603c523
mov edi, dword [ebp - 0x14]
lea eax, [ebp - 0x14]
push eax
push 0x6601bdc0
push dword [ebp - 0x18]
call esi
cmp eax, ebx
jne 0x6603c533
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x1c]
lea ebx, [ecx + eax]
mov eax, dword [ecx + eax]
mov dword [ebp - 0x1c], eax
mov ax, word [ebx + 0x38]
test al, 1
jne 0x6601ba39
cmp word [ebp + 0x14], 8
jb 0x6601b8b5
mov dx, word [ebx + 0x3e]
test dl, 1
jne 0x6601bb6d
lea ecx, [ebp - 0x1d0]
lea eax, [ebx + 0x14]
push 0x100
push ecx
push eax
call fcn.6601bc33
mov eax, dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x1d0]
push eax
push dword [ebp - 0xc]
call esi
mov edi, eax
test edi, edi
jne 0x6603c569
xor ecx, ecx
mov eax, edi
test edi, edi
sete cl
test edi, edi
jne 0x6603c574
test ecx, ecx
je 0x6601b991
cmp dword [ebp + 0x10], 0
mov edi, dword [ebp - 8]
lea eax, [ebp - 8]
push eax
je 0x6603c582
push 0x6601bde0
push dword [ebp - 4]
call esi
test eax, eax
je 0x6603c58c
test eax, eax
mov dword [ebp - 8], edi
je 0x6603c58c
mov edi, dword [ebp - 8]
lea eax, [ebp - 8]
push eax
push 0x6601bdd0
push dword [ebp - 4]
call esi
test eax, eax
je 0x6603c7b3
test eax, eax
mov dword [ebp - 8], edi
je 0x6603c7b3
lea eax, [ebp - 8]
push eax
push 0x6601bdf0
push dword [ebp - 4]
call esi
test eax, eax
je 0x6603c7b3
test eax, eax
mov dword [ebp - 8], edi
je 0x6603c7b3
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
test eax, eax
jne 0x6601bb20
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x6603c5e2
mov eax, dword [ebp + 0xc]
lea edx, [ecx + eax]
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x6603c5ef
add eax, ecx
push edx
push eax
lea eax, [ebp - 0x1d0]
push 0x6601be00
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x1d0]
push eax
push dword [ebp - 0x18]
call fcn.6601bcc2
mov esi, eax
test esi, esi
jne 0x6603c5f9
lea eax, [ebp - 0x1d0]
push 0x100
push eax
lea eax, [ebx + 0x14]
push eax
call fcn.6601bc33
lea eax, [ebp - 0x1d0]
push eax
push dword [ebp - 0xc]
call fcn.6601bcc2
mov esi, eax
test esi, esi
jne 0x6603c60a
mov edi, dword [ebx + 0x28]
mov eax, dword [ebx + 0x24]
add edi, dword [ebp + 0xc]
and dword [ebp - 0x10], 0
dec eax
test eax, eax
jg 0x6603c61b
mov edi, dword [ebx + 0x2c]
mov eax, dword [ebx + 0x30]
add edi, dword [ebp + 0xc]
and dword [ebp - 0x10], 0
dec eax
test eax, eax
jg 0x6603c663
cmp dword [ebp - 0x1c], 0
jne 0x6601b886
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 0x14], 0xffffffff
test eax, eax
jne 0x6601bb20
lea eax, [ebp - 0x2d4]
push 0x104
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x6601bb05
lea eax, [ebp - 0x2d4]
shr eax, 0x10
test ax, ax
je 0x6603c6ab
lea edi, [ebp - 0x2d4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx + ecx + 2]
add eax, 3
and al, 0xfc
call fcn.660300d8
lea ecx, [ebp - 0x2d4]
mov eax, esp
push ecx
push eax
call fcn.660035e5
lea ecx, [ebp - 0x20]
push ecx
push 2
push eax
call dword [sym.imp.OLEAUT32.dll_SystemTimeToVariantTime]
test eax, eax
jl 0x6601bb05
mov eax, dword [ebp - 0x20]
lea edx, [ebp + 0x14]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
jl 0x6601bafc
mov eax, dword [ebp + 0x14]
push dword [eax + 0x14]
mov cx, word [eax + 0x1a]
push dword [eax + 0x10]
push ecx
mov cx, word [eax + 0x18]
push ecx
push eax
call dword [sym.imp.OLEAUT32.dll_VarDecFix]
mov eax, dword [ebp - 0x20]
push dword [ebp + 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x30]
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0x24], 0
jne 0x6603c6b6
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 0xc], 0xffffffff
test eax, eax
jne 0x6601bb20
push eax
call fcn.6601bd76
mov esi, eax
or ebx, 0xffffffff
cmp dword [ebp - 0x14], ebx
jne 0x6603c78f
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xc], ebx
jne 0x6603c79f
cmp dword [ebp - 4], ebx
jne 0x6603c7a9
cmp dword [ebp - 0x18], ebx
je 0x6601bb56
push dword [ebp - 0x18]
call edi
lea ecx, [ebp - 0x2c]
call fcn.6601bd9e
mov eax, esi
lea esp, [ebp - 0x2e0]
pop edi
pop esi
pop ebx
leave
ret 0x10
lea esi, [ebx + 0x14]
lea edi, [ebp - 0x98]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov word [ebp - 0x4c], ax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp + 0xc]
lea edi, [ebp - 0x78]
mov ecx, dword [ebx + 0x40]
lea esi, [eax + 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov si, word [eax + 0x26]
lea edi, [ebp - 0x44]
mov word [ebp - 0x50], si
mov si, word [eax + 0x28]
mov word [ebp - 0x4e], si
lea esi, [ecx + eax]
mov word [ebp - 0x46], dx
mov edx, dword [ecx + eax + 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
test edx, edx
mov dword [ebp - 0x34], edx
je 0x6603c543
lea ecx, [ecx + eax + 0x14]
mov dword [ebp - 0x30], ecx
mov ecx, dword [eax + 4]
test ecx, ecx
je 0x6603c54b
add ecx, eax
mov dword [ebp - 0xa4], ecx
mov ecx, dword [ebx + 4]
test ecx, ecx
je 0x6603c55a
add ecx, eax
mov dword [ebp - 0xa0], ecx
push dword [ebp - 0xa0]
lea eax, [ebp - 0xd0]
push dword [ebp - 0xa4]
push 0x6601be00
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0xd0]
push 0
push eax
lea eax, [ebp - 0xa8]
push eax
call fcn.6601be2c
mov esi, eax
test esi, esi
jne 0x6601bb28
jmp 0x6601b8b5
lea ecx, [ebp - 0x2c]
call fcn.6601bd9e
xor eax, eax
jmp 0x6601bb60
cmp eax, ebx
mov dword [ebp - 0x18], edi
jne 0x6601bb20
jmp 0x6601b854
cmp eax, ebx
mov dword [ebp - 0xc], edi
jne 0x6601bb20
jmp 0x6601b86d
cmp eax, ebx
mov dword [ebp - 0x14], edi
je 0x6601b886
jmp 0x6601bb20
and dword [ebp - 0x30], edx
jmp 0x6601bbc8
mov dword [ebp - 0xa4], 0x66005020
jmp 0x6601bbdb
mov dword [ebp - 0xa0], 0x66005020
jmp 0x6601bbee
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x6601b8f0
cmp edi, 2
je 0x6601b901
jmp 0x6601bb20
push 0x660583d0
jmp 0x6601b91f
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp + 0x10], 0
je 0x6603c5db
push 0x660583d0
push dword [ebp - 4]
call fcn.6601bcc2
mov esi, eax
test esi, esi
je 0x6603c5ba
cmp esi, 0x150
jne 0x6601bb28
mov dword [ebp - 0x24], 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
test eax, eax
je 0x6601ba39
jmp 0x6601bb20
push 0x6601bde0
jmp 0x6603c5a0
mov eax, dword [ebp + 0xc]
mov edx, 0x66005020
jmp 0x6601b9a2
mov eax, 0x66005020
jmp 0x6601b9af
cmp esi, 0x150
jne 0x6601bb28
jmp 0x6601b9df
cmp esi, 0x150
jne 0x6601bb28
jmp 0x6601ba0d
lea eax, [ebp - 0x1d0]
push 0x100
push eax
push edi
call fcn.6601bc33
lea eax, [ebp - 0x1d0]
push eax
push dword [ebp - 0x14]
call fcn.6601bcc2
mov esi, eax
test esi, esi
je 0x6603c64e
cmp esi, 0x150
jne 0x6601bb28
mov eax, dword [ebx + 0x24]
inc dword [ebp - 0x10]
add edi, 0x10
dec eax
cmp dword [ebp - 0x10], eax
jge 0x6601ba23
jmp 0x6603c61b
lea eax, [ebp - 0x1d0]
push 0x100
push eax
push edi
call fcn.6601bc33
lea eax, [ebp - 0x1d0]
push eax
push dword [ebp - 0x14]
call fcn.6601bcc2
mov esi, eax
test esi, esi
je 0x6603c696
cmp esi, 0x150
jne 0x6601bb28
mov eax, dword [ebx + 0x30]
inc dword [ebp - 0x10]
add edi, 0x10
dec eax
cmp dword [ebp - 0x10], eax
jge 0x6601ba39
jmp 0x6603c663
lea eax, [ebp - 0x2d4]
jmp 0x6601bab4
mov eax, dword [ebp + 0xc]
mov esi, dword [eax]
test esi, esi
je 0x6601bb0f
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x1d0]
add eax, esi
push 0x100
push ecx
mov esi, dword [eax]
add eax, 0x14
push eax
call fcn.6601bc33
lea eax, [ebp - 4]
mov edi, dword [ebp - 4]
push eax
lea eax, [ebp - 0x1d0]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x6603c70b
test eax, eax
mov dword [ebp - 4], edi
jne 0x6601bb20
cmp dword [ebp + 0x10], 0
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp - 0x2d4]
mov dword [ebp + 0x14], 0x104
push eax
je 0x6603c788
push 0x6601bde0
push dword [ebp - 4]
call ebx
test eax, eax
jne 0x6603c766
lea eax, [ebp - 0x2d4]
lea ecx, [ebp - 0x2c]
push eax
call fcn.66087474
test eax, eax
je 0x6603c766
lea eax, [ebp + 8]
lea ecx, [ebp - 0x2c]
push eax
push 1
call fcn.660874f0
push eax
call dword [sym.imp.OLEAUT32.dll_SystemTimeToVariantTime]
test eax, eax
jl 0x6603c766
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
test eax, eax
jne 0x6601bb20
test esi, esi
je 0x6601bb0f
jmp 0x6603c6c9
push 0x660583d0
jmp 0x6603c728
push dword [ebp - 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call edi
jmp 0x6601bb3a
push dword [ebp - 0xc]
call edi
jmp 0x6601bb43
push dword [ebp - 4]
call edi
jmp 0x6601bb4c
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp + 0x10], 0
je 0x6603c7ea
push 0x660583d0
push dword [ebp - 4]
call fcn.6601bcc2
mov esi, eax
test esi, esi
je 0x6603c5c1
cmp esi, 0x150
jne 0x6601bb28
jmp 0x6603c5c1
push 0x6601bde0
jmp 0x6603c7c7