Function at 0x6c37802b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
push dword [0x6c3a74c4]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
xor esi, esi
mov dword [ebp - 8], esi
call edi
push dword [str._7l]
mov ebx, eax
call edi
mov edi, dword [sym.imp.ntdll.dll_RtlGetThreadPreferredUILanguages]
lea ebx, [ebx + eax + 0x10]
lea eax, [ebp - 0x28]
push eax
push esi
lea eax, [ebp - 0x2c]
push eax
push 0x24
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x28], esi
call edi
cmp eax, esi
je 0x6c37807e
cmp eax, 0xc0000023
jne 0x6c3780c2
mov eax, dword [ebp - 0x28]
cmp eax, esi
jbe 0x6c3780c2
add eax, eax
push eax
push 0x7b
push 0x6c37276c
call fcn.6c375051
lea ecx, [ebp - 0x28]
push ecx
push eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x2c]
push eax
push 0x24
call edi
test eax, eax
jl 0x6c3780ad
cmp dword [ebp - 0x2c], esi
jne 0x6c3780c2
push dword [ebp - 0x20]
push 0x81
push 0x6c37276c
call fcn.6c3750c2
mov dword [ebp - 0x20], esi
lea eax, [ebx + ebx]
push eax
push 0x86
push 0x6c37276c
call fcn.6c375051
mov dword [ebp - 4], eax
cmp eax, esi
jne 0x6c3780e8
mov dword [ebp + 8], 0xc0000bbb
jmp 0x6c3783cd
cmp dword [ebp + 0xc], esi
jne 0x6c3780f8
lea eax, [ebp - 8]
push eax
push 0x80000002
jmp 0x6c378106
cmp dword [ebp + 8], esi
je 0x6c378114
lea eax, [ebp - 8]
push eax
push 0x80000004
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
mov dword [ebp + 8], eax
jmp 0x6c37811e
mov dword [ebp + 8], esi
mov dword [ebp - 8], 0x80000004
cmp dword [ebp + 8], esi
jne 0x6c3783cd
mov eax, dword [ebp - 0x20]
cmp eax, esi
je 0x6c3783b1
cmp word [eax], si
je 0x6c3783b1
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x24], eax
mov ebx, 0x20019
push dword [ebp - 0x24]
call fcn.6c377737
mov dword [ebp - 0x10], eax
push eax
cmp dword [ebp + 0xc], esi
jne 0x6c378199
push dword [0x6c3a74c4]
push dword [str._7l]
push 0x6c3727b0
push dword [ebp - 0xc]
push dword [ebp - 4]
call fcn.6c377fcc
add esp, 0x18
lea eax, [ebp - 0x14]
push eax
push ebx
push esi
push dword [ebp - 4]
push dword [ebp - 8]
call edi
mov dword [ebp + 8], eax
cmp eax, esi
jne 0x6c3781da
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x6c3781d1
push dword [0x6c3a746c]
push 0x6c3727a0
push dword [ebp - 0xc]
push dword [ebp - 4]
call fcn.6c377fcc
add esp, 0x14
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0x1c]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0x1c], esi
push dword [ebp - 8]
mov dword [ebp - 0x18], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp + 8], eax
cmp dword [ebp + 8], esi
je 0x6c37831e
and dword [ebp - 0x10], 0x3ff
push dword [ebp - 0x10]
cmp dword [ebp + 0xc], esi
jne 0x6c378228
push dword [0x6c3a74c4]
push dword [str._7l]
push 0x6c3727b0
push dword [ebp - 0xc]
push dword [ebp - 4]
call fcn.6c377fcc
add esp, 0x18
lea eax, [ebp - 0x14]
push eax
push ebx
push esi
push dword [ebp - 4]
push dword [ebp - 8]
call edi
mov dword [ebp + 8], eax
cmp eax, esi
jne 0x6c378269
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x6c378260
push dword [0x6c3a746c]
push 0x6c3727a0
push dword [ebp - 0xc]
push dword [ebp - 4]
call fcn.6c377fcc
add esp, 0x14
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0x1c]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0x1c], esi
push dword [ebp - 8]
mov dword [ebp - 0x18], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp + 8], eax
cmp dword [ebp + 8], esi
je 0x6c37831e
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x24]
lea eax, [ecx + eax*2 + 2]
mov dword [ebp - 0x24], eax
cmp word [eax], si
jne 0x6c378149
cmp dword [ebp + 8], esi
je 0x6c37831e
push 9
pop eax
mov dword [ebp - 0x10], eax
push eax
cmp dword [ebp + 0xc], esi
jne 0x6c3782dd
push dword [0x6c3a74c4]
push dword [str._7l]
push 0x6c3727b0
push dword [ebp - 0xc]
push dword [ebp - 4]
call fcn.6c377fcc
add esp, 0x18
lea eax, [ebp - 0x14]
push eax
push ebx
push esi
push dword [ebp - 4]
push dword [ebp - 8]
call edi
mov dword [ebp + 8], eax
cmp eax, esi
jne 0x6c3783cd
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x6c378315
push dword [0x6c3a746c]
push 0x6c3727a0
push dword [ebp - 0xc]
push dword [ebp - 4]
call fcn.6c377fcc
add esp, 0x14
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0x1c]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0x1c], esi
push dword [ebp - 8]
mov dword [ebp - 0x18], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp + 8], eax
cmp dword [ebp + 8], esi
jne 0x6c3783cd
push 9
pop eax
mov dword [ebp - 0x24], eax
cmp dword [ebp + 0xc], esi
jne 0x6c378369
push eax
push dword [0x6c3a74c4]
push dword [str._7l]
push 0x6c3727b0
push dword [ebp - 0xc]
push dword [ebp - 4]
call fcn.6c377fcc
add esp, 0x18
lea eax, [ebp - 0x14]
push eax
push ebx
push esi
push dword [ebp - 4]
push dword [ebp - 8]
call edi
mov dword [ebp + 8], eax
cmp eax, esi
jne 0x6c3783a9
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x6c3783a4
push dword [ebp - 0x10]
push dword [0x6c3a746c]
push 0x6c3727a0
push dword [ebp - 0xc]
push dword [ebp - 4]
call fcn.6c377fcc
add esp, 0x14
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0x1c]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0x1c], esi
push dword [ebp - 8]
mov dword [ebp - 0x18], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp + 8], eax
cmp dword [ebp + 8], esi
je 0x6c3783bd
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
jmp 0x6c3783b8
mov dword [ebp + 8], 0xc0000bc6
cmp dword [ebp + 8], esi
jne 0x6c3783cd
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x24]
mov dword [eax], ecx
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
mov eax, dword [ebp - 8]
cmp eax, esi
je 0x6c3783e7
cmp eax, 0xffffffff
je 0x6c3783e7
cmp eax, 0x80000004
je 0x6c3783e7
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x20]
mov esi, 0x6c37276c
push 0xf3
push esi
call fcn.6c3750c2
push dword [ebp - 4]
push 0xf4
push esi
call fcn.6c3750c2
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret 0x10