Function at 0xa69c70
Capabilities:
Delete registry value
Persist via default file association registry key
Persist via filter handlers registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xabc5ae
mov eax, dword fs:[0]
push eax
sub esp, 0x490
mov eax, dword [0xae6d50]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x480], edi
mov dword [ebp - 0x42c], 7
mov dword [ebp - 0x430], ebx
mov word [ebp - 0x440], ax
lea ecx, [ebp - 0x47c]
push ecx
push 0x20019
push ebx
push 0xac8d98
push 0x80000002
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edx, dword [ebp - 0x47c]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0xa69d5e
push 1
push 0xac3064
mov esi, 0xac8dc4
mov ecx, 0xac8d98
call fcn.00a69a40
push 0xac8dd8
push edi
call fcn.00a64730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 0x10
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0xa69d3f
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0xa69d3f
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0xa69d5e
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0xa69d57
or eax, 4
push ebx
push eax
call fcn.00a52d10
push 1
push 0xac3064
mov esi, 0xac8e60
mov ecx, 0xac8eb0
call fcn.00a69a40
push 1
push 0xac8f34
mov esi, 0xac8f00
mov ecx, 0xac8d98
call fcn.00a69a40
add esp, 0x10
mov ecx, 0xac3064
mov ebx, 0xac8d98
mov edx, 0x80000002
lea esi, [ebp - 0x45c]
call fcn.00a69920
push eax
lea ecx, [ebp - 0x440]
mov byte [ebp - 4], 1
call fcn.00a51560
mov byte [ebp - 4], 0
cmp dword [ebp - 0x448], 8
jb 0xa69dd3
mov edx, dword [ebp - 0x45c]
push edx
call fcn.00a9e60d
add esp, 4
push 1
push 0xac8d98
mov edi, 0xac8dc4
mov esi, 0xac3064
call fcn.00a697e0
mov ebx, dword [ebp - 0x480]
add esp, 8
test eax, eax
je 0xa69ec6
push 0xac8f50
push ecx
lea eax, [ebp - 0x440]
push eax
push ecx
push 0xac8f58
push ebx
call fcn.00a64730
add esp, 0xc
push eax
call fcn.00a649f0
add esp, 0xc
push eax
call fcn.00a65080
mov esi, eax
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0xa69e4f
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0xa69e4f
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0xa69e70
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], 0
jne 0xa69e68
or eax, 4
push 0
push eax
call fcn.00a52d10
push 0xac8fc8
push ebx
call fcn.00a64730
mov esi, eax
mov edx, dword [esi]
mov eax, dword [edx + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0xa69ea5
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0xa69ea5
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0xa69ec6
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], 0
jne 0xa69ebe
or eax, 4
push 0
push eax
call fcn.00a52d10
mov edx, 0xac9044
lea ecx, [ebp - 0x424]
call fcn.00a69630
lea edx, [ebp - 0x424]
push edx
push 0x80000002
call fcn.00a69680
add esp, 8
test eax, eax
je 0xa69f44
push 0xac9080
push ebx
call fcn.00a64730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0xa69f23
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0xa69f23
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0xa69f44
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], 0
jne 0xa69f3c
or eax, 4
push 0
push eax
call fcn.00a52d10
mov edx, 0xac90f8
lea ecx, [ebp - 0x424]
call fcn.00a69630
lea edx, [ebp - 0x424]
push edx
push 0x80000002
call fcn.00a69680
add esp, 8
test eax, eax
je 0xa69fc2
push 0xac9140
push ebx
call fcn.00a64730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0xa69fa1
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0xa69fa1
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0xa69fc2
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], 0
jne 0xa69fba
or eax, 4
push 0
push eax
call fcn.00a52d10
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea edx, [ebp - 0x47c]
push edx
push 0x20019
push 0
push 0xac91c4
push 0x80000002
call ebx
mov esi, eax
mov eax, dword [ebp - 0x47c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0xa6a07c
push 1
push 0xac3064
mov esi, 0xac91f8
mov ecx, 0xac9208
call fcn.00a69a40
push 1
push 0xac3064
mov ecx, 0xac9260
call fcn.00a69a40
mov ecx, dword [ebp - 0x480]
push 0xac92c0
push ecx
call fcn.00a64730
mov esi, eax
mov edx, dword [esi]
mov eax, dword [edx + 4]
add esp, 0x18
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0xa6a05b
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0xa6a05b
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0xa6a07c
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], 0
jne 0xa6a074
or eax, 4
push 0
push eax
call fcn.00a52d10
push 1
push 0xac3064
mov esi, 0xac9350
mov ecx, 0xac91c4
call fcn.00a69a40
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
add esp, 8
push 0
lea edx, [ebp - 0x47c]
push edx
push 0
push 0xf013f
push 0
push 0
push 0
push 0xac91c4
push 0x80000002
mov dword [ebp - 0x490], 0x738
mov dword [ebp - 0x48c], 0
call esi
test eax, eax
jne 0xa6a107
mov ecx, dword [ebp - 0x47c]
push 4
lea eax, [ebp - 0x490]
push eax
push 3
push 0
push 0xac9368
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0xa6a116
mov edx, dword [ebp - 0x47c]
push edx
jmp 0xa6a114
mov eax, dword [ebp - 0x47c]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call edi
push 0
lea ecx, [ebp - 0x47c]
push ecx
push 0
push 0xf013f
push 0
push 0
push 0
push 0xac9380
push 0x80000002
call esi
test eax, eax
jne 0xa6a167
push 4
lea edx, [ebp - 0x48c]
push edx
push 3
push eax
mov eax, dword [ebp - 0x47c]
push 0xac9368
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0xa6a170
mov ecx, dword [ebp - 0x47c]
push ecx
jmp 0xa6a16e
mov edx, dword [ebp - 0x47c]
push edx
call edi
push 1
push 0xac3064
mov esi, 0xac93c8
mov ecx, 0xac93d0
call fcn.00a69a40
push 1
push 0xac9474
mov esi, 0xac9420
mov ecx, 0xac91c4
call fcn.00a69a40
push 1
push 0xac94f4
mov esi, 0xac9488
mov ecx, 0xac91c4
call fcn.00a69a40
push 1
push 0xac3064
mov esi, 0xac9508
mov ecx, 0xac9558
call fcn.00a69a40
mov eax, dword [ebp + 8]
add esp, 0x20
cmp dword [eax + 0x330], 1
jne 0xa6a1f0
push 1
push 0xac3064
mov esi, 0xac3064
mov ecx, 0xac95b8
call fcn.00a69a40
add esp, 8
push 1
push 0xac3064
mov esi, 0xac9678
mov ecx, 0xac96c8
call fcn.00a69a40
add esp, 8
lea ecx, [ebp - 0x47c]
push ecx
push 0xf013f
push 0
push 0xac9208
push 0x80000002
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0xa6a23f
mov edx, dword [ebp - 0x47c]
push 0xac9768
push edx
call esi
test eax, eax
je 0xa6a248
mov eax, dword [ebp - 0x47c]
push eax
call edi
lea ecx, [ebp - 0x47c]
push ecx
push 0xf013f
push 0
push 0xac9260
push 0x80000002
call ebx
test eax, eax
jne 0xa6a278
mov edx, dword [ebp - 0x47c]
push 0xac9768
push edx
call esi
test eax, eax
je 0xa6a281
mov eax, dword [ebp - 0x47c]
push eax
call edi
lea ecx, [ebp - 0x47c]
push ecx
push 0xf013f
push 0
push 0xac91c4
push 0x80000002
call ebx
test eax, eax
jne 0xa6a2b1
mov edx, dword [ebp - 0x47c]
push 0xac8f34
push edx
call esi
test eax, eax
je 0xa6a2ba
mov eax, dword [ebp - 0x47c]
push eax
call edi
push 1
push 0xac9208
mov edi, 0xac91f8
mov esi, 0xac3064
call fcn.00a697e0
add esp, 8
test eax, eax
je 0xa6a333
mov ecx, dword [ebp - 0x480]
push 0xac9788
push ecx
call fcn.00a64730
mov esi, eax
mov edx, dword [esi]
mov eax, dword [edx + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0xa6a312
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0xa6a312
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0xa6a333
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], 0
jne 0xa6a32b
or eax, 4
push 0
push eax
call fcn.00a52d10
push 1
push 0xac9260
mov edi, 0xac91f8
mov esi, 0xac3064
call fcn.00a697e0
add esp, 8
test eax, eax
je 0xa6a3ac
mov edx, dword [ebp - 0x480]
push 0xac9850
push edx
call fcn.00a64730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0xa6a38b
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0xa6a38b
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0xa6a3ac
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], 0
jne 0xa6a3a4
or eax, 4
push 0
push eax
call fcn.00a52d10
lea edx, [ebp - 0x47c]
push edx
push 0x20019
push 0
push 0xac9918
push 0x80000001
call ebx
mov esi, eax
mov eax, dword [ebp - 0x47c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0xa6a654
cmp dword [ebp - 0x42c], 8
mov eax, dword [ebp - 0x440]
mov dword [ebp - 0x430], esi
jae 0xa6a3f8
lea eax, [ebp - 0x440]
xor ecx, ecx
mov word [eax], cx
mov ecx, 0xac3064
mov ebx, 0xac9918
mov edx, 0x80000001
lea esi, [ebp - 0x478]
call fcn.00a69920
push eax
lea ecx, [ebp - 0x440]
mov byte [ebp - 4], 2
call fcn.00a51560
mov byte [ebp - 4], 0
cmp dword [ebp - 0x464], 8
jb 0xa6a443
mov edx, dword [ebp - 0x478]
push edx
call fcn.00a9e60d
add esp, 4
mov ebx, dword [ebp - 0x480]
push 0xac8f50
push ecx
lea eax, [ebp - 0x440]
push eax
push ecx
push 0xac9948
push ebx
call fcn.00a64730
add esp, 0xc
push eax
call fcn.00a649f0
add esp, 0xc
push eax
call fcn.00a65080
mov esi, eax
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0xa6a49e
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0xa6a49e
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0xa6a4bf
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], 0
jne 0xa6a4b7
or eax, 4
push 0
push eax
call fcn.00a52d10
mov edx, 0xac9918
lea ecx, [ebp - 0x424]
call fcn.00a69630
lea edx, [ebp - 0x424]
push edx
push 0x80000001
call fcn.00a69680
add esp, 8
test eax, eax
je 0xa6a53d
push 0xac99c0
push ebx
call fcn.00a64730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0xa6a51c
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0xa6a51c
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0xa6a53d
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], 0
jne 0xa6a535
or eax, 4
push 0
push eax
call fcn.00a52d10
push 0x11
xor edx, edx
push 0xac9a28
lea ecx, [ebp - 0x45c]
mov dword [ebp - 0x448], 7
mov dword [ebp - 0x44c], 0
mov word [ebp - 0x45c], dx
call fcn.00a51740
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x440]
push eax
lea ecx, [ebp - 0x45c]
mov byte [ebp - 4], 3
call fcn.00a61f30
cmp dword [ebp - 0x448], 8
mov edx, dword [ebp - 0x45c]
jae 0xa6a59b
lea edx, [ebp - 0x45c]
lea ecx, [ebp - 0x424]
call fcn.00a69630
lea ecx, [ebp - 0x424]
push ecx
push 0x80000001
call fcn.00a69680
add esp, 8
test eax, eax
je 0xa6a632
push 0xac9a4c
push ecx
lea edx, [ebp - 0x440]
push edx
push ecx
push 0xac9a7c
push ebx
call fcn.00a64730
add esp, 0xc
push eax
call fcn.00a649f0
add esp, 0xc
push eax
call fcn.00a64730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0xa6a613
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0xa6a613
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0xa6a632
or edi, dword [ecx + 0xc]
cmp dword [ecx + 0x38], 0
jne 0xa6a62a
or edi, 4
push 0
push edi
call fcn.00a52d10
mov byte [ebp - 4], 0
cmp dword [ebp - 0x448], 8
jb 0xa6a64e
mov edx, dword [ebp - 0x45c]
push edx
call fcn.00a9e60d
add esp, 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x47c]
push eax
push 0x20019
push 0
push 0xac9ab4
push 0x80000002
call ebx
mov ecx, dword [ebp - 0x47c]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0xa6a6f3
push 1
push 0xac3064
mov esi, 0xac9ae0
mov ecx, 0xac9ab4
call fcn.00a69a40
mov edx, dword [ebp - 0x480]
push 0xac9af0
push edx
call fcn.00a64730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 0x10
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0xa6a6d2
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0xa6a6d2
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0xa6a6f3
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], 0
jne 0xa6a6eb
or eax, 4
push 0
push eax
call fcn.00a52d10
cmp dword [ebp - 0x42c], 8
mov eax, dword [ebp - 0x440]
mov dword [ebp - 0x430], 0
jae 0xa6a712
lea eax, [ebp - 0x440]
xor edx, edx
mov word [eax], dx
mov ecx, 0xac3064
mov ebx, 0xac9ab4
mov edx, 0x80000002
lea esi, [ebp - 0x478]
call fcn.00a69920
push eax
lea ecx, [ebp - 0x440]
mov byte [ebp - 4], 4
call fcn.00a51560
xor ebx, ebx
mov byte [ebp - 4], bl
cmp dword [ebp - 0x464], 8
jb 0xa6a75e
mov eax, dword [ebp - 0x478]
push eax
call fcn.00a9e60d
add esp, 4
push 1
push 0xac9ab4
mov edi, 0xac9ae0
mov esi, 0xac3064
call fcn.00a697e0
add esp, 8
test eax, eax
je 0xa6a853
mov edx, dword [ebp - 0x480]
push 0xac8f50
push ecx
lea ecx, [ebp - 0x440]
push ecx
push ecx
push 0xac9b78
push edx
call fcn.00a64730
add esp, 0xc
push eax
call fcn.00a649f0
add esp, 0xc
push eax
call fcn.00a65080
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0xa6a7da
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0xa6a7da
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0xa6a7f9
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0xa6a7f2
or eax, 4
push ebx
push eax
call fcn.00a52d10
mov edx, dword [ebp - 0x480]
push 0xac9be0
push edx
call fcn.00a64730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0xa6a834
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0xa6a834
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0xa6a853
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0xa6a84c
or eax, 4
push ebx
push eax
call fcn.00a52d10
push 1
push 0xac3064
mov esi, 0xac9c60
mov ecx, 0xac9cb0
call fcn.00a69a40
add esp, 8
lea edx, [ebp - 0x47c]
push edx
push 0x20019
push ebx
push 0xac9d04
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov eax, dword [ebp - 0x47c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0xa6a93c
push 2
push 0xac3064
mov esi, 0xac9d38
mov ecx, 0xac9d88
call fcn.00a69a40
push 1
push 0xac3064
mov esi, 0xac91f8
mov ecx, 0xac9de0
call fcn.00a69a40
push 2
push 0xac3064
mov esi, 0xac9e38
mov ecx, 0xac9e88
call fcn.00a69a40
mov ecx, dword [ebp - 0x480]
push 0xac9af0
push ecx
call fcn.00a64730
mov esi, eax
mov edx, dword [esi]
mov eax, dword [edx + 4]
add esp, 0x20
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0xa6a91d
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0xa6a91d
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0xa6a93c
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0xa6a935
or eax, 4
push ebx
push eax
call fcn.00a52d10
mov edx, dword [ebp + 8]
cmp dword [edx + 0x330], 2
push 1
mov ecx, 0xac9d04
push 0xac3064
mov esi, 0xac9ee4
je 0xa6a95e
mov esi, 0xac9f0c
call fcn.00a69a40
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
add esp, 8
push ebx
lea eax, [ebp - 0x47c]
push eax
push ebx
push 0xf013f
push ebx
push ebx
push ebx
push 0xac9d04
push 0x80000002
mov dword [ebp - 0x494], 0x430
mov dword [ebp - 0x488], ebx
call esi
cmp eax, ebx
jne 0xa6a9ce
mov edx, dword [ebp - 0x47c]
push 4
lea ecx, [ebp - 0x494]
push ecx
push 3
push ebx
push 0xac9368
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0xa6a9dd
mov eax, dword [ebp - 0x47c]
push eax
jmp 0xa6a9db
mov ecx, dword [ebp - 0x47c]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call edi
push ebx
lea edx, [ebp - 0x47c]
push edx
push ebx
push 0xf013f
push ebx
push ebx
push ebx
push 0xac9f30
push 0x80000002
call esi
cmp eax, ebx
jne 0xa6aa29
mov ecx, dword [ebp - 0x47c]
push 4
lea eax, [ebp - 0x488]
push eax
push 3
push ebx
push 0xac9368
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0xa6aa32
mov edx, dword [ebp - 0x47c]
push edx
jmp 0xa6aa30
mov eax, dword [ebp - 0x47c]
push eax
call edi
push 2
push 0xac9d88
mov edi, 0xac9d38
mov esi, 0xac3064
call fcn.00a697e0
add esp, 8
test eax, eax
je 0xa6aaa9
mov ecx, dword [ebp - 0x480]
push 0xac9f78
push ecx
call fcn.00a64730
mov esi, eax
mov edx, dword [esi]
mov eax, dword [edx + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0xa6aa8a
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0xa6aa8a
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0xa6aaa9
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0xa6aaa2
or eax, 4
push ebx
push eax
call fcn.00a52d10
push 1
push 0xac9de0
mov edi, 0xac91f8
mov esi, 0xac3064
call fcn.00a697e0
add esp, 8
test eax, eax
je 0xa6ab20
mov edx, dword [ebp - 0x480]
push 0xaca028
push edx
call fcn.00a64730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0xa6ab01
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0xa6ab01
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0xa6ab20
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0xa6ab19
or eax, 4
push ebx
push eax
call fcn.00a52d10
push 2
push 0xac9e88
mov edi, 0xac9e38
mov esi, 0xac3064
call fcn.00a697e0
add esp, 8
test eax, eax
je 0xa6ab97
mov edx, dword [ebp - 0x480]
push 0xaca0d8
push edx
call fcn.00a64730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0xa6ab78
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0xa6ab78
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0xa6ab97
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0xa6ab90
or eax, 4
push ebx
push eax
call fcn.00a52d10
push 2
push 0xac3064
mov esi, 0xaca188
mov ecx, 0xaca1d8
call fcn.00a69a40
push 1
push 0xac3064
mov esi, 0xac9508
mov ecx, 0xaca228
call fcn.00a69a40
push 1
push 0xac3064
mov esi, 0xac9678
mov ecx, 0xaca288
call fcn.00a69a40
add esp, 0x18
lea edx, [ebp - 0x47c]
push edx
push 0x20019
push ebx
push 0xaca328
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov eax, dword [ebp - 0x47c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
jne 0xa6ae85
cmp dword [ebp - 0x42c], 8
mov eax, dword [ebp - 0x440]
mov dword [ebp - 0x430], ebx
jae 0xa6ac2b
lea eax, [ebp - 0x440]
xor ecx, ecx
mov word [eax], cx
mov ecx, 0xac3064
mov ebx, 0xaca328
mov edx, 0x80000001
lea esi, [ebp - 0x478]
call fcn.00a69920
push eax
lea ecx, [ebp - 0x440]
mov byte [ebp - 4], 5
call fcn.00a51560
mov byte [ebp - 4], 0
cmp dword [ebp - 0x464], 8
jb 0xa6ac76
mov edx, dword [ebp - 0x478]
push edx
call fcn.00a9e60d
add esp, 4
mov ebx, dword [ebp - 0x480]
push 0xac8f50
push ecx
lea eax, [ebp - 0x440]
push eax
push ecx
push 0xaca358
push ebx
call fcn.00a64730
add esp, 0xc
push eax
call fcn.00a649f0
add esp, 0xc
push eax
call fcn.00a65080
mov esi, eax
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0xa6acd1
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0xa6acd1
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0xa6acf2
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], 0
jne 0xa6acea
or eax, 4
push 0
push eax
call fcn.00a52d10
mov edx, 0xaca328
lea ecx, [ebp - 0x424]
call fcn.00a69630
lea edx, [ebp - 0x424]
push edx
push 0x80000001
call fcn.00a69680
add esp, 8
test eax, eax
je 0xa6ad70
push 0xaca3d0
push ebx
call fcn.00a64730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0xa6ad4f
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0xa6ad4f
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0xa6ad70
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], 0
jne 0xa6ad68
or eax, 4
push 0
push eax
call fcn.00a52d10
push 0x11
xor edx, edx
push 0xac9a28
lea ecx, [ebp - 0x45c]
mov dword [ebp - 0x448], 7
mov dword [ebp - 0x44c], 0
mov word [ebp - 0x45c], dx
call fcn.00a51740
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x440]
push eax
lea ecx, [ebp - 0x45c]
mov byte [ebp - 4], 6
call fcn.00a61f30
cmp dword [ebp - 0x448], 8
mov edx, dword [ebp - 0x45c]
jae 0xa6adce
lea edx, [ebp - 0x45c]
lea ecx, [ebp - 0x424]
call fcn.00a69630
lea ecx, [ebp - 0x424]
push ecx
push 0x80000001
call fcn.00a69680
add esp, 8
test eax, eax
je 0xa6ae67
push 0xac9a4c
push ecx
lea edx, [ebp - 0x440]
push edx
push ecx
push 0xac9a7c
push ebx
call fcn.00a64730
add esp, 0xc
push eax
call fcn.00a649f0
add esp, 0xc
push eax
call fcn.00a64730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0xa6ae46
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0xa6ae46
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
test edi, edi
je 0xa6ae67
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], 0
jne 0xa6ae5f
or eax, 4
push 0
push eax
call fcn.00a52d10
mov byte [ebp - 4], 0
cmp dword [ebp - 0x448], 8
jb 0xa6ae83
mov edx, dword [ebp - 0x45c]
push edx
call fcn.00a9e60d
add esp, 4
xor ebx, ebx
lea eax, [ebp - 0x47c]
push eax
push 0x20019
push ebx
push 0xaca438
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [ebp - 0x47c]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0xa6af25
push 1
push 0xac3064
mov esi, 0xaca464
mov ecx, 0xaca438
call fcn.00a69a40
mov edx, dword [ebp - 0x480]
push 0xaca478
push edx
call fcn.00a64730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 0x10
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0xa6af06
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0xa6af06
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0xa6af25
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0xa6af1e
or eax, 4
push ebx
push eax
call fcn.00a52d10
cmp dword [ebp - 0x42c], 8
mov eax, dword [ebp - 0x440]
mov dword [ebp - 0x430], ebx
jae 0xa6af40
lea eax, [ebp - 0x440]
xor edx, edx
mov word [eax], dx
mov ecx, 0xac3064
mov ebx, 0xaca438
mov edx, 0x80000002
lea esi, [ebp - 0x478]
call fcn.00a69920
push eax
lea ecx, [ebp - 0x440]
mov byte [ebp - 4], 7
call fcn.00a51560
xor ebx, ebx
mov byte [ebp - 4], bl
cmp dword [ebp - 0x464], 8
jb 0xa6af8c
mov eax, dword [ebp - 0x478]
push eax
call fcn.00a9e60d
add esp, 4
push 1
push 0xaca438
mov edi, 0xaca464
mov esi, 0xac3064
call fcn.00a697e0
add esp, 8
test eax, eax
je 0xa6b081
mov edx, dword [ebp - 0x480]
push 0xac8f50
push ecx
lea ecx, [ebp - 0x440]
push ecx
push ecx
push 0xaca500
push edx
call fcn.00a64730
add esp, 0xc
push eax
call fcn.00a649f0
add esp, 0xc
push eax
call fcn.00a65080
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0xa6b008
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0xa6b008
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0xa6b027
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0xa6b020
or eax, 4
push ebx
push eax
call fcn.00a52d10
mov edx, dword [ebp - 0x480]
push 0xaca570
push edx
call fcn.00a64730
mov esi, eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0xa6b062
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0xa6b062
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0xa6b081
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0xa6b07a
or eax, 4
push ebx
push eax
call fcn.00a52d10
push 1
push 0xac3064
mov esi, 0xac8e60
mov ecx, 0xaca5e8
call fcn.00a69a40
add esp, 8
lea edx, [ebp - 0x47c]
push edx
push 0x20019
push ebx
push 0xaca63c
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov eax, dword [ebp - 0x47c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0xa6b13a
push 1
push 0xac3064
mov esi, 0xac91f8
mov ecx, 0xaca670
call fcn.00a69a40
mov ecx, dword [ebp - 0x480]
push 0xaca6c8
push ecx
call fcn.00a64730
mov esi, eax
mov edx, dword [esi]
mov eax, dword [edx + 4]
add esp, 0x10
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0xa6b11b
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0xa6b11b
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0xa6b13a
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0xa6b133
or eax, 4
push ebx
push eax
call fcn.00a52d10
mov edx, dword [ebp + 8]
cmp dword [edx + 0x330], 2
push 1
mov ecx, 0xaca63c
push 0xac3064
mov esi, 0xac9350
je 0xa6b15c
mov esi, 0xaca758
call fcn.00a69a40
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
add esp, 8
push ebx
lea eax, [ebp - 0x47c]
push eax
push ebx
push 0xf013f
push ebx
push ebx
push ebx
push 0xaca63c
push 0x80000002
mov dword [ebp - 0x484], 0x30
mov dword [ebp - 0x498], ebx
call esi
cmp eax, ebx
jne 0xa6b1cc
mov edx, dword [ebp - 0x47c]
push 4
lea ecx, [ebp - 0x484]
push ecx
push 3
push ebx
push 0xac9368
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0xa6b1db
mov eax, dword [ebp - 0x47c]
push eax
jmp 0xa6b1d9
mov ecx, dword [ebp - 0x47c]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call edi
push ebx
lea edx, [ebp - 0x47c]
push edx
push ebx
push 0xf013f
push ebx
push ebx
push ebx
push 0xaca780
push 0x80000002
call esi
cmp eax, ebx
jne 0xa6b227
mov ecx, dword [ebp - 0x47c]
push 4
lea eax, [ebp - 0x498]
push eax
push 3
push ebx
push 0xac9368
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0xa6b230
mov edx, dword [ebp - 0x47c]
push edx
jmp 0xa6b22e
mov eax, dword [ebp - 0x47c]
push eax
call edi
push 2
push 0xac3064
mov esi, 0xaca7c8
mov ecx, 0xaca810
call fcn.00a69a40
push 1
push 0xac3064
mov esi, 0xac9508
mov ecx, 0xaca860
call fcn.00a69a40
push 1
push 0xaca670
mov edi, 0xac91f8
mov esi, 0xac3064
call fcn.00a697e0
add esp, 0x18
test eax, eax
je 0xa6b2d3
mov ecx, dword [ebp - 0x480]
push 0xaca8c0
push ecx
call fcn.00a64730
mov esi, eax
mov edx, dword [esi]
mov eax, dword [edx + 4]
add esp, 8
xor edi, edi
test byte [eax + esi + 0xc], 6
jne 0xa6b2b4
mov eax, dword [eax + esi + 0x38]
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x34]
call eax
cmp eax, 0xffffffff
jne 0xa6b2b4
mov edi, 4
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
add ecx, esi
cmp edi, ebx
je 0xa6b2d3
mov eax, dword [ecx + 0xc]
or eax, edi
cmp dword [ecx + 0x38], ebx
jne 0xa6b2cc
or eax, 4
push ebx
push eax
call fcn.00a52d10
lea edx, [ebp - 0x47c]
push edx
push 0x20019
push ebx
push 0xaca990
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov eax, dword [ebp - 0x47c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
jne 0xa6b4b1
cmp dword [ebp - 0x42c], 8
mov eax, dword [ebp - 0x440]
mov dword [ebp - 0x430], ebx
jae 0xa6b322
lea eax, [ebp - 0x440]
xor ecx, ecx
mov word [eax], cx
mov ecx, 0xac3064
mov ebx, 0xaca990
mov edx, 0x80000001
lea esi, [ebp - 0x478]
call fcn.00a69920
mov ebx, 8
push eax
lea ecx, [ebp - 0x440]
mov byte [ebp - 4], bl
call fcn.00a51560
mov byte [ebp - 4], 0
cmp dword [ebp - 0x464], ebx
jb 0xa6b370
mov edx, dword [ebp - 0x478]
push edx
call fcn.00a9e60d
add esp, 4
mov esi, dword [ebp - 0x480]
push 0xac8f50
push ecx
lea eax, [ebp - 0x440]
push eax
push ecx
push 0xaca9c0
push esi
call fcn.00a64730
add esp, 0xc
push eax
call fcn.00a649f0
add esp, 0xc
push eax
call fcn.00a65080
push eax
call fcn.00a53070
add esp, 0xc
mov edx, 0xaca990
lea ecx, [ebp - 0x424]
call fcn.00a69630
lea ecx, [ebp - 0x424]
push ecx
push 0x80000001
call fcn.00a69680
add esp, 8
test eax, eax
je 0xa6b3e6
push 0xacaa38
push esi
call fcn.00a64730
push eax
call fcn.00a53070
add esp, 0xc
push 0x11
xor edx, edx
push 0xac9a28
lea ecx, [ebp - 0x45c]
mov dword [ebp - 0x448], 7
mov dword [ebp - 0x44c], 0
mov word [ebp - 0x45c], dx
call fcn.00a51740
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x440]
push eax
lea ecx, [ebp - 0x45c]
mov byte [ebp - 4], 9
call fcn.00a61f30
mov edx, dword [ebp - 0x45c]
cmp dword [ebp - 0x448], ebx
jae 0xa6b443
lea edx, [ebp - 0x45c]
lea ecx, [ebp - 0x424]
call fcn.00a69630
lea ecx, [ebp - 0x424]
push ecx
push 0x80000001
call fcn.00a69680
add esp, 8
test eax, eax
je 0xa6b49a
push 0xac9a4c
push ecx
lea edx, [ebp - 0x440]
push edx
push ecx
push 0xac9a7c
push esi
call fcn.00a64730
add esp, 0xc
push eax
call fcn.00a649f0
add esp, 0xc
push eax
call fcn.00a64730
push eax
call fcn.00a53070
add esp, 0xc
cmp dword [ebp - 0x448], ebx
jb 0xa6b4b1
mov eax, dword [ebp - 0x45c]
push eax
call fcn.00a9e60d
add esp, 4
cmp dword [ebp - 0x42c], 8
jb 0xa6b4c9
mov ecx, dword [ebp - 0x440]
push ecx
call fcn.00a9e60d
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00a9e488
mov esp, ebp
pop ebp
ret