Function at 0x66e12200
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x68
mov eax, dword [0x66fe31a0]
xor eax, esp
mov dword [esp + 0x64], eax
push ebx
push ebp
mov ebp, dword [esp + 0x78]
mov dword [esp + 8], ebp
push esi
mov esi, ecx
push edi
test ebp, ebp
je 0x66e12227
mov dword [ebp], 2
mov eax, dword [esi + 0xc]
lea edi, [esi + 0xc]
mov bl, byte [esp + 0x7c]
test eax, eax
je 0x66e1224b
cmp byte [esi + 0x11], bl
je 0x66e12459
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [edi], 0
mov eax, dword [esi + 4]
mov dword [edi], 0
mov byte [esi + 0x11], bl
test eax, eax
je 0x66e12457
push edi
test bl, bl
je 0x66e1226b
push 0x20019
jmp 0x66e12270
push 0xf003f
push 0
push eax
push dword [esi + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [esp + 0x1c], eax
cmp eax, 2
jne 0x66e12450
cmp byte [esi + 0x10], 0
je 0x66e12450
cmp dword [0x66fe20c4], eax
jne 0x66e12434
push str.AdvAPI32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
je 0x66e12427
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x66f8c2c0
push ebx
call ebp
push str.FreeSid
push ebx
mov dword [esp + 0x20], eax
call ebp
push str.SetEntriesInAcl
push ebx
mov dword [esp + 0x28], eax
call ebp
mov dword [esp + 0x14], eax
test eax, eax
jne 0x66e122ee
push str.SetEntriesInAclA
push ebx
call ebp
mov dword [esp + 0x14], eax
push 0x66f8c308
push ebx
call ebp
push 0x66f8c328
push ebx
mov dword [esp + 0x2c], eax
call ebp
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x28], eax
test ecx, ecx
je 0x66e12423
cmp dword [esp + 0x20], 0
je 0x66e12423
mov ebp, dword [esp + 0x14]
test ebp, ebp
je 0x66e12423
cmp dword [esp + 0x24], 0
je 0x66e12423
test eax, eax
je 0x66e12423
lea eax, [esp + 0x18]
mov dword [esp + 0x6c], 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
lea eax, [esp + 0x94]
mov word [esp + 0x98], 0x100
push eax
call ecx
mov eax, dword [esp + 0x18]
movdqa xmm0, xmmword [0x66f8c350]
mov dword [esp + 0x54], eax
lea eax, [esp + 0x14]
push eax
push 0
lea eax, [esp + 0x40]
mov dword [esp + 0x40], 0xf003f
push eax
push 1
movdqu xmmword [esp + 0x54], xmm0
mov dword [esp + 0x4c], 2
mov dword [esp + 0x50], 3
mov dword [esp + 0x24], 0
call ebp
push 1
lea eax, [esp + 0x5c]
push eax
call dword [esp + 0x2c]
push 0
push dword [esp + 0x18]
lea eax, [esp + 0x60]
push 1
push eax
call dword [esp + 0x38]
push 0
push edi
lea eax, [esp + 0x60]
mov dword [esp + 0x34], 0xc
mov dword [esp + 0x38], eax
lea eax, [esp + 0x34]
push eax
push 0xf003f
push 0
push 0
push 0
push dword [esi + 4]
mov dword [esp + 0x54], 1
push dword [esi + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push dword [esp + 0x18]
mov dword [esp + 0x20], eax
call dword [esp + 0x24]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x66e12423
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ebp, dword [esp + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 0x1c]
jmp 0x66e12450
push 0
push edi
push 0
push 0xf003f
push 0
push 0
push 0
push dword [esi + 4]
push dword [esi + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test ebp, ebp
je 0x66e12457
mov dword [ebp], eax
mov eax, dword [edi]
mov ecx, dword [esp + 0x74]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.66f2a29c
add esp, 0x68
ret 8