Function at 0x6cee4
Capabilities:
Delete directory
Delete registry key
Delete registry value
Persist via windows service
Persist via winlogon helper dll registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x54
push 0
push 0
dec ecx
jne 0x6ceec
push ecx
push ebx
push esi
push edi
mov eax, 0x6c9f4
call fcn.000169b4
xor eax, eax
push ebp
push 0x6e378
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x6e25b
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x73218], 0
xor eax, eax
mov dword [0x730b4], eax
lea eax, [ebp - 0x10]
call fcn.00019138
mov edx, dword [ebp - 0x10]
mov eax, 0x73230
call fcn.00013aa8
xor eax, eax
call fcn.00023414
test al, al
jne 0x6cf77
lea eax, [ebp - 0x14]
call fcn.00023b6c
mov edx, dword [ebp - 0x14]
mov eax, 0x7322c
call fcn.00013aa8
lea eax, [ebp - 0x18]
call fcn.00023b94
mov edx, dword [ebp - 0x18]
mov eax, 0x73234
call fcn.00013aa8
jmp 0x6cf9b
mov eax, 0x7322c
mov edx, dword [0x704c0]
mov edx, dword [edx]
call fcn.00013aa8
mov eax, 0x73234
mov edx, dword [0x70514]
mov edx, dword [edx]
call fcn.00013aa8
call fcn.00023108
mov eax, dword [0x730b4]
call fcn.00038c48
test al, al
je 0x6d025
xor eax, eax
push ebp
push 0x6d014
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x2800
lea eax, [ebp - 0x20]
call fcn.0001b030
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.0001bae0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x28]
call fcn.00023fcc
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
call fcn.00014240
mov edx, dword [ebp - 0x24]
pop eax
call fcn.000142d0
mov ecx, dword [ebp - 0x1c]
mov dl, 1
mov eax, dword [0x36ee8]
call fcn.00037500
mov dword [0x730b4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6d025
cmp dword [0x730b4], 0
je 0x6d06c
mov eax, dword [0x730b4]
cmp byte [eax + 0x64], 0
jne 0x6d06c
xor eax, eax
push ebp
push 0x6d05b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x730b4]
call fcn.00037e20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6d065
xor eax, eax
mov dword [0x730b4], eax
cmp dword [0x730b4], 0
jne 0x6d0ec
xor eax, eax
push ebp
push 0x6d0db
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x400
lea eax, [ebp - 0x30]
call fcn.000192cc
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
call fcn.0001bae0
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x38]
call fcn.0002402c
mov edx, dword [ebp - 0x38]
lea eax, [ebp - 0x34]
call fcn.00014240
mov edx, dword [ebp - 0x34]
pop eax
call fcn.000142d0
mov ecx, dword [ebp - 0x2c]
mov dl, 1
mov eax, dword [0x36ee8]
call fcn.00037500
mov dword [0x730b4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6d0ec
xor eax, eax
push ebp
push 0x6d14b
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x730b4], 0
je 0x6d141
mov eax, dword [0x730b4]
cmp byte [eax + 0x64], 0
jne 0x6d141
xor eax, eax
push ebp
push 0x6d130
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x730b4]
call fcn.00037e20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6d13a
xor eax, eax
mov dword [0x730b4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6d15c
mov eax, 0x6e394
call fcn.0006b150
lea edx, [ebp - 0x3c]
xor eax, eax
call fcn.0001c900
lea eax, [ebp - 0x3c]
push eax
push 0x6e3ac
lea edx, [ebp - 0x48]
xor eax, eax
call fcn.0001c900
mov eax, dword [ebp - 0x48]
call fcn.000142b4
lea edx, [ebp - 0x44]
call fcn.000197c4
push dword [ebp - 0x44]
push 0x6e3b8
push 0
push 0xa
lea eax, [ebp - 0x50]
call fcn.00018ef8
mov edx, dword [ebp - 0x50]
lea eax, [ebp - 0x4c]
call fcn.00014240
push dword [ebp - 0x4c]
push 0x6e3c0
lea eax, [ebp - 0x40]
mov edx, 5
call fcn.00014394
mov edx, dword [ebp - 0x40]
pop eax
call fcn.000142d0
mov eax, dword [ebp - 0x3c]
call fcn.0006b1c0
lea eax, [ebp - 0x54]
mov ecx, dword [0x7322c]
mov edx, 0x6e3cc
call fcn.00013d20
mov eax, dword [ebp - 0x54]
call fcn.0006b150
lea eax, [ebp - 0x58]
mov ecx, dword [0x73234]
mov edx, 0x6e3e0
call fcn.00013d20
mov eax, dword [ebp - 0x58]
call fcn.0006b150
call fcn.0001abc8
mov ebx, eax
mov eax, ebx
call fcn.00017588
mov edx, dword [0x7049c]
cmp ax, word [edx]
jne 0x6d238
mov eax, dword [0x705f0]
mov ax, word [eax]
cmp ax, bx
je 0x6d2ba
push 0x6e3f4
mov eax, dword [0x7049c]
movzx eax, word [eax]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x60]
call fcn.00018ef8
push dword [ebp - 0x60]
push 0x6e414
mov eax, dword [0x705f0]
movzx eax, word [eax]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x64]
call fcn.00018ef8
push dword [ebp - 0x64]
push 0x6e420
mov eax, ebx
call fcn.00017588
movzx eax, ax
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x68]
call fcn.00018ef8
push dword [ebp - 0x68]
push 0x6e414
movzx eax, bx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x6c]
call fcn.00018ef8
push dword [ebp - 0x6c]
lea eax, [ebp - 0x5c]
mov edx, 8
call fcn.00013d94
mov eax, dword [ebp - 0x5c]
call fcn.0006b230
mov eax, dword [0x730b4]
call fcn.00038c48
test al, al
je 0x6e181
mov eax, 0x800
call fcn.000126e0
mov dword [0x73238], eax
mov eax, 4
call fcn.000126e0
mov dword [0x7321c], eax
mov eax, 4
call fcn.000126e0
mov dword [0x730ac], eax
mov eax, 4
call fcn.000126e0
mov dword [0x730b8], eax
mov eax, 0x6e430
call fcn.0006b150
xor ebx, ebx
lea eax, [ebp - 0x70]
call fcn.00023ef4
mov edx, dword [ebp - 0x70]
xor ecx, ecx
mov eax, dword [0x730b4]
call fcn.0003a27c
mov dword [0x730bc], eax
cmp dword [0x730bc], 0
jl 0x6d38c
push 0x6e444
push dword [0x73234]
push 0x6e454
mov eax, ebx
cdq
push edx
push eax
lea eax, [ebp - 0x78]
call fcn.00018ef8
push dword [ebp - 0x78]
push 0x6e468
lea eax, [ebp - 0x74]
mov edx, 5
call fcn.00013d94
mov eax, dword [ebp - 0x74]
call fcn.0006b150
push 0
mov eax, dword [0x730bc]
push eax
push 0
call sub.wtsapi32.dll_WTSLogoffSession
push 0x3e8
call sub.kernel32.dll_Sleep
inc ebx
cmp dword [0x730bc], 0
jl 0x6d39f
cmp ebx, 0x14
jl 0x6d314
call fcn.0006b764
mov eax, 0x6e474
call fcn.0006b150
push 0x730a8
push 0x73228
push 0
mov eax, dword [0x70348]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0
push 0
push 0x6e480
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
mov eax, dword [0x7321c]
mov dword [eax], 1
push 4
mov eax, dword [0x7321c]
push eax
push 4
push 0
push 0x6e4b4
mov eax, dword [0x73228]
push eax
call sub.advapi32.dll_RegSetValueExA
call fcn.00023c3c
mov ebx, dword [0x73238]
mov ecx, dword [0x70350]
mov ecx, dword [ecx]
mov eax, 0x73220
mov edx, 0x6e4d4
call fcn.00013d20
mov ecx, dword [0x70420]
mov ecx, dword [ecx]
mov eax, 0x7323c
mov edx, 0x6e4e4
call fcn.00013d20
mov ecx, dword [0x70568]
mov ecx, dword [ecx]
mov eax, 0x73224
mov edx, 0x6e4d4
call fcn.00013d20
mov ecx, dword [0x7063c]
mov ecx, dword [ecx]
mov eax, 0x730b0
mov edx, 0x6e4e4
call fcn.00013d20
mov eax, dword [0x73238]
xor ecx, ecx
mov edx, 0x800
call fcn.000129f0
xor eax, eax
mov dword [0x730bc], eax
mov eax, dword [0x70350]
mov eax, dword [eax]
call fcn.0002638c
test al, al
je 0x6d50d
mov eax, dword [0x73220]
call fcn.00013cd4
push eax
mov eax, 0x73220
call fcn.00013ea4
mov edx, ebx
pop ecx
call fcn.000127f8
mov eax, dword [0x73220]
call fcn.00013cd4
inc eax
add ebx, eax
mov eax, dword [0x7323c]
call fcn.00013cd4
push eax
mov eax, 0x7323c
call fcn.00013ea4
mov edx, ebx
pop ecx
call fcn.000127f8
mov eax, dword [0x7323c]
call fcn.00013cd4
inc eax
add ebx, eax
mov eax, dword [0x73220]
call fcn.00013cd4
mov esi, eax
add esi, dword [0x730bc]
mov eax, dword [0x7323c]
call fcn.00013cd4
add esi, eax
add esi, 2
mov dword [0x730bc], esi
mov eax, dword [0x70568]
mov eax, dword [eax]
call fcn.0002638c
test al, al
je 0x6d598
mov eax, dword [0x73224]
call fcn.00013cd4
push eax
mov eax, 0x73224
call fcn.00013ea4
mov edx, ebx
pop ecx
call fcn.000127f8
mov eax, dword [0x73224]
call fcn.00013cd4
inc eax
add ebx, eax
mov eax, dword [0x730b0]
call fcn.00013cd4
push eax
mov eax, 0x730b0
call fcn.00013ea4
mov edx, ebx
pop ecx
call fcn.000127f8
mov eax, dword [0x730b0]
call fcn.00013cd4
inc eax
add ebx, eax
mov eax, dword [0x73224]
call fcn.00013cd4
mov esi, eax
add esi, dword [0x730bc]
mov eax, dword [0x730b0]
call fcn.00013cd4
add esi, eax
add esi, 2
mov dword [0x730bc], esi
mov ecx, dword [0x70470]
mov ecx, dword [ecx]
mov eax, 0x73220
mov edx, 0x6e4d4
call fcn.00013d20
mov eax, dword [0x73220]
call fcn.00013cd4
push eax
mov eax, 0x73220
call fcn.00013ea4
mov edx, ebx
pop ecx
call fcn.000127f8
mov eax, dword [0x73220]
call fcn.00013cd4
mov eax, dword [0x73220]
call fcn.00013cd4
add eax, dword [0x730bc]
add eax, 2
mov dword [0x730bc], eax
inc dword [0x730bc]
mov eax, dword [0x730bc]
push eax
mov eax, dword [0x73238]
push eax
push 7
push 0
push 0x6e4ec
mov eax, dword [0x73228]
push eax
call sub.advapi32.dll_RegSetValueExA
mov eax, dword [0x73228]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, 0x6e510
call fcn.0006b150
push 0x730a8
push 0x73228
push 0
mov eax, dword [0x70348]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0
push 0
push 0x6e51c
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
push 0x6e558
mov eax, dword [0x73228]
push eax
call sub.advapi32.dll_RegDeleteValueA
push 0x6e56c
mov eax, dword [0x73228]
push eax
call sub.advapi32.dll_RegDeleteValueA
push 0x6e580
mov eax, dword [0x73228]
push eax
call sub.advapi32.dll_RegDeleteValueA
push 0x6e58c
mov eax, dword [0x73228]
push eax
call sub.advapi32.dll_RegDeleteValueA
push 0x6e59c
mov eax, dword [0x73228]
push eax
call sub.advapi32.dll_RegDeleteValueA
mov eax, dword [0x73228]
push eax
call sub.advapi32.dll_RegCloseKey_1
push 0x730a8
push 0x73228
push 0
mov eax, dword [0x70348]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0
push 0
push 0x6e5a8
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
push 0x6e5e0
mov eax, dword [0x73228]
push eax
call sub.advapi32.dll_RegDeleteValueA
mov eax, dword [0x73228]
push eax
call sub.advapi32.dll_RegCloseKey_1
push 0x730a8
push 0x73228
push 0
mov eax, dword [0x70348]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0
push 0
push 0x6e5f8
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
push 0x6e638
mov eax, dword [0x73228]
push eax
call sub.advapi32.dll_RegDeleteValueA
mov eax, dword [0x73228]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov al, 1
call fcn.00068024
xor eax, eax
mov dword [0x73228], eax
push 0x73228
mov eax, dword [0x70348]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0x6e654
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x6d817
mov eax, 0x73220
mov edx, 0x400
call fcn.00014008
mov eax, 0x73220
call fcn.00013ea4
xor ecx, ecx
mov edx, 0x400
call fcn.000129f0
mov eax, dword [0x7321c]
mov dword [eax], 0x3ff
mov eax, dword [0x7321c]
push eax
mov eax, dword [0x73220]
call fcn.00013e98
push eax
mov eax, dword [0x730ac]
push eax
push 0
push 0x6e690
mov eax, dword [0x73228]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x6d817
mov eax, dword [0x7321c]
mov eax, dword [eax]
push eax
mov eax, dword [0x73220]
call fcn.00013e98
push eax
mov eax, dword [0x730ac]
mov eax, dword [eax]
push eax
push 0
push 0x6e69c
mov eax, dword [0x73228]
push eax
call sub.advapi32.dll_RegSetValueExA
push 0x6e690
mov eax, dword [0x73228]
push eax
call sub.advapi32.dll_RegDeleteValueA
cmp dword [0x73228], 0
je 0x6d82b
mov eax, dword [0x73228]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [0x73228], eax
push 0x73228
mov eax, dword [0x70348]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0x6e6a8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x6d8f7
mov eax, 0x73220
mov edx, 0x400
call fcn.00014008
mov eax, 0x73220
call fcn.00013ea4
xor ecx, ecx
mov edx, 0x400
call fcn.000129f0
mov eax, dword [0x7321c]
mov dword [eax], 0x3ff
mov eax, dword [0x7321c]
push eax
mov eax, dword [0x73220]
call fcn.00013e98
push eax
mov eax, dword [0x730ac]
push eax
push 0
push 0x6e6e0
mov eax, dword [0x73228]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x6d8f7
mov eax, dword [0x7321c]
mov eax, dword [eax]
push eax
mov eax, dword [0x73220]
call fcn.00013e98
push eax
mov eax, dword [0x730ac]
mov eax, dword [eax]
push eax
push 0
push 0x6e6ec
mov eax, dword [0x73228]
push eax
call sub.advapi32.dll_RegSetValueExA
push 0x6e6e0
mov eax, dword [0x73228]
push eax
call sub.advapi32.dll_RegDeleteValueA
cmp dword [0x73228], 0
je 0x6d90b
mov eax, dword [0x73228]
push eax
call sub.advapi32.dll_RegCloseKey_1
lea eax, [ebp - 0x88]
mov ecx, dword [0x7322c]
mov edx, 0x6e700
call fcn.00013d20
mov edx, dword [ebp - 0x88]
lea eax, [ebp - 0x84]
call fcn.00014240
mov eax, dword [ebp - 0x84]
lea edx, [ebp - 0x80]
call fcn.00065d40
mov ecx, dword [ebp - 0x80]
lea eax, [ebp - 0x7c]
mov edx, 0x6e714
call fcn.00014330
mov eax, dword [ebp - 0x7c]
call fcn.0006b1c0
lea edx, [ebp - 0x90]
mov eax, 0x6e734
call fcn.00065d40
mov ecx, dword [ebp - 0x90]
lea eax, [ebp - 0x8c]
mov edx, 0x6e76c
call fcn.00014330
mov eax, dword [ebp - 0x8c]
call fcn.0006b1c0
lea edx, [ebp - 0x98]
mov eax, 0x6e790
call fcn.00065d40
mov ecx, dword [ebp - 0x98]
lea eax, [ebp - 0x94]
mov edx, 0x6e76c
call fcn.00014330
mov eax, dword [ebp - 0x94]
call fcn.0006b1c0
call fcn.0006b2a0
xor eax, eax
push ebp
push 0x6d9f5
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x702d0], 0
je 0x6d9eb
mov eax, dword [0x702d0]
mov dword [eax], 1
push 0x3e8
call sub.kernel32.dll_Sleep
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6d9ff
mov eax, 0x6e7c8
call fcn.00024f0c
cdq
push edx
push eax
lea eax, [ebp - 0xa0]
call fcn.00018ef8
mov ecx, dword [ebp - 0xa0]
lea eax, [ebp - 0x9c]
mov edx, 0x6e7dc
call fcn.00013d20
mov eax, dword [ebp - 0x9c]
call fcn.0006b150
mov eax, 0x6e7f4
call fcn.00024f0c
cdq
push edx
push eax
lea eax, [ebp - 0xa8]
call fcn.00018ef8
mov ecx, dword [ebp - 0xa8]
lea eax, [ebp - 0xa4]
mov edx, 0x6e808
call fcn.00013d20
mov eax, dword [ebp - 0xa4]
call fcn.0006b150
call fcn.0006ae98
cdq
push edx
push eax
lea eax, [ebp - 0xb0]
call fcn.00018ef8
mov ecx, dword [ebp - 0xb0]
lea eax, [ebp - 0xac]
mov edx, 0x6e820
call fcn.00013d20
mov eax, dword [ebp - 0xac]
call fcn.0006b150
mov eax, 0x6e838
call fcn.0006b150
mov eax, dword [0x730b4]
call fcn.0006a230
mov eax, 0x6e854
call fcn.0006b150
push 0
lea eax, [ebp - 0xb8]
call fcn.0001955c
mov eax, dword [ebp - 0xb8]
lea edx, [ebp - 0xb4]
call fcn.0001902c
lea eax, [ebp - 0xb4]
push eax
lea eax, [ebp - 0xbc]
call fcn.00024094
mov edx, dword [ebp - 0xbc]
pop eax
call fcn.00013cdc
mov eax, dword [ebp - 0xb4]
mov cl, 1
mov edx, dword [0x730b4]
call fcn.00066598
lea eax, [ebp - 0xc4]
call fcn.0001955c
mov eax, dword [ebp - 0xc4]
lea edx, [ebp - 0xc0]
call fcn.000190b4
lea eax, [ebp - 0xc0]
push eax
lea eax, [ebp - 0xc8]
call fcn.00024094
mov edx, dword [ebp - 0xc8]
pop eax
call fcn.00013cdc
mov eax, dword [ebp - 0xc0]
call fcn.00013e98
push eax
call sub.kernel32.dll_RemoveDirectoryA
test eax, eax
jne 0x6dc42
push 0x7d0
call sub.kernel32.dll_Sleep
push 0
lea eax, [ebp - 0xd0]
call fcn.0001955c
mov eax, dword [ebp - 0xd0]
lea edx, [ebp - 0xcc]
call fcn.0001902c
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0xd4]
call fcn.00024094
mov edx, dword [ebp - 0xd4]
pop eax
call fcn.00013cdc
mov eax, dword [ebp - 0xcc]
mov cl, 1
mov edx, dword [0x730b4]
call fcn.00066598
lea eax, [ebp - 0xdc]
call fcn.0001955c
mov eax, dword [ebp - 0xdc]
lea edx, [ebp - 0xd8]
call fcn.000190b4
lea eax, [ebp - 0xd8]
push eax
lea eax, [ebp - 0xe0]
call fcn.00024094
mov edx, dword [ebp - 0xe0]
pop eax
call fcn.00013cdc
mov eax, dword [ebp - 0xd8]
call fcn.00013e98
push eax
call sub.kernel32.dll_RemoveDirectoryA
test eax, eax
jne 0x6dc42
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
lea edx, [ebp - 0xe8]
mov eax, ebx
call fcn.00018f2c
mov ecx, dword [ebp - 0xe8]
lea eax, [ebp - 0xe4]
mov edx, 0x6e868
call fcn.00013d20
mov eax, dword [ebp - 0xe4]
call fcn.0006b230
mov eax, 0x6e880
call fcn.0006b150
push 1
lea edx, [ebp - 0xf4]
mov eax, dword [0x73230]
call fcn.0001902c
push dword [ebp - 0xf4]
push dword [0x73234]
push 0x6e898
lea eax, [ebp - 0xf0]
mov edx, 3
call fcn.00013d94
mov eax, dword [ebp - 0xf0]
lea edx, [ebp - 0xec]
call fcn.0001902c
mov eax, dword [ebp - 0xec]
mov cl, 1
mov edx, dword [0x730b4]
call fcn.00066598
lea edx, [ebp - 0x100]
mov eax, dword [0x73230]
call fcn.0001902c
push dword [ebp - 0x100]
push dword [0x73234]
push 0x6e898
lea eax, [ebp - 0xfc]
mov edx, 3
call fcn.00013d94
mov eax, dword [ebp - 0xfc]
lea edx, [ebp - 0xf8]
call fcn.000190b4
mov eax, dword [ebp - 0xf8]
call fcn.00013e98
push eax
call sub.kernel32.dll_RemoveDirectoryA
mov eax, dword [0x70390]
cmp dword [eax], 0
je 0x6ddca
mov eax, 0x6e8a8
call fcn.0006b150
push 0
lea eax, [ebp - 0x108]
call fcn.0001ae74
mov eax, dword [ebp - 0x108]
lea edx, [ebp - 0x104]
call fcn.0001bae0
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x110]
call fcn.00023b6c
mov edx, dword [ebp - 0x110]
lea eax, [ebp - 0x10c]
call fcn.00014240
mov edx, dword [ebp - 0x10c]
pop eax
call fcn.000142d0
mov eax, dword [ebp - 0x104]
mov cl, 1
mov edx, dword [0x730b4]
call fcn.00066c78
lea eax, [ebp - 0x118]
call fcn.0001ae74
mov eax, dword [ebp - 0x118]
lea edx, [ebp - 0x114]
call fcn.0001bae0
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x120]
call fcn.00023b6c
mov edx, dword [ebp - 0x120]
lea eax, [ebp - 0x11c]
call fcn.00014240
mov edx, dword [ebp - 0x11c]
pop eax
call fcn.000142d0
mov eax, dword [ebp - 0x114]
call fcn.000142b4
push eax
call sub.kernel32.dll_RemoveDirectoryW
call fcn.0001acd8
lea eax, [ebp - 0x128]
call fcn.00023b6c
mov ecx, dword [ebp - 0x128]
lea eax, [ebp - 0x124]
mov edx, 0x6e8c0
call fcn.00013d20
mov eax, dword [ebp - 0x124]
call fcn.0006b150
mov eax, dword [0x70390]
cmp dword [eax], 0
jne 0x6de31
lea eax, [ebp - 0x130]
call fcn.00023b6c
mov ecx, dword [ebp - 0x130]
lea eax, [ebp - 0x12c]
mov edx, 0x6e8e0
call fcn.00013d20
mov eax, dword [ebp - 0x12c]
call fcn.0006b6d4
xor eax, eax
mov dword [0x73228], eax
push 0x73228
mov eax, dword [0x70348]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0x6e8ec
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
mov ebx, eax
test ebx, ebx
jne 0x6dfad
mov eax, dword [0x70390]
cmp dword [eax], 0
je 0x6def7
lea eax, [ebp - 0x134]
call fcn.00023b6c
mov eax, dword [ebp - 0x134]
call fcn.00013e98
mov edx, eax
mov eax, dword [0x73228]
call fcn.0001add0
mov ebx, eax
test ebx, ebx
je 0x6decb
lea edx, [ebp - 0x13c]
mov eax, ebx
call fcn.00018f2c
mov ecx, dword [ebp - 0x13c]
lea eax, [ebp - 0x138]
mov edx, 0x6e900
call fcn.00013d20
mov eax, dword [ebp - 0x138]
call fcn.0006b230
jmp 0x6def7
lea eax, [ebp - 0x144]
call fcn.00023b6c
mov ecx, dword [ebp - 0x144]
lea eax, [ebp - 0x140]
mov edx, 0x6e910
call fcn.00013d20
mov eax, dword [ebp - 0x140]
call fcn.0006b150
mov eax, dword [0x70390]
cmp dword [eax], 0
je 0x6df27
lea eax, [ebp - 0x148]
call fcn.00023b6c
mov eax, dword [ebp - 0x148]
call fcn.00013e98
mov edx, eax
mov eax, dword [0x73228]
call fcn.0001ae20
mov ebx, eax
jmp 0x6df4b
lea eax, [ebp - 0x14c]
call fcn.00023b6c
mov eax, dword [ebp - 0x14c]
call fcn.00013e98
push eax
mov eax, dword [0x73228]
push eax
call sub.advapi32.dll_RegDeleteKeyA
mov ebx, eax
test ebx, ebx
je 0x6df7f
lea edx, [ebp - 0x154]
mov eax, ebx
call fcn.00018f2c
mov ecx, dword [ebp - 0x154]
lea eax, [ebp - 0x150]
mov edx, 0x6e92c
call fcn.00013d20
mov eax, dword [ebp - 0x150]
call fcn.0006b230
jmp 0x6dfdb
lea eax, [ebp - 0x15c]
call fcn.00023b6c
mov ecx, dword [ebp - 0x15c]
lea eax, [ebp - 0x158]
mov edx, 0x6e93c
call fcn.00013d20
mov eax, dword [ebp - 0x158]
call fcn.0006b150
jmp 0x6dfdb
lea edx, [ebp - 0x164]
mov eax, ebx
call fcn.00018f2c
mov ecx, dword [ebp - 0x164]
lea eax, [ebp - 0x160]
mov edx, 0x6e950
call fcn.00013d20
mov eax, dword [ebp - 0x160]
call fcn.0006b230
cmp dword [0x73228], 0
je 0x6dfef
mov eax, dword [0x73228]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [0x73228], eax
mov eax, 0x6e960
call fcn.0006b150
lea eax, [ebp - 0x168]
call fcn.00023f54
mov eax, dword [ebp - 0x168]
call fcn.000142b4
push eax
push 0
call fcn.0001888c
mov ebx, eax
test ebx, ebx
jne 0x6e052
lea eax, [ebp - 0x170]
call fcn.00023ef4
mov ecx, dword [ebp - 0x170]
lea eax, [ebp - 0x16c]
mov edx, 0x6e974
call fcn.00013d20
mov eax, dword [ebp - 0x16c]
call fcn.0006b150
jmp 0x6e0b9
push 0x6e98c
lea eax, [ebp - 0x178]
call fcn.00023ef4
push dword [ebp - 0x178]
push 0x6e9ac
mov eax, dword [0x730bc]
cdq
push edx
push eax
lea eax, [ebp - 0x17c]
call fcn.00018ef8
push dword [ebp - 0x17c]
lea eax, [ebp - 0x174]
mov edx, 4
call fcn.00013d94
mov eax, dword [ebp - 0x174]
call fcn.0006b230
lea edx, [ebp - 0x180]
mov eax, ebx
call fcn.00018f2c
mov eax, dword [ebp - 0x180]
call fcn.0006b230
mov eax, 0x6e9c8
call fcn.0006b150
push 0
lea eax, [ebp - 0x188]
call fcn.0001a60c
mov eax, dword [ebp - 0x188]
lea edx, [ebp - 0x184]
call fcn.0001902c
lea eax, [ebp - 0x184]
mov edx, 0x6e9f0
call fcn.00013cdc
mov eax, dword [ebp - 0x184]
xor ecx, ecx
mov edx, dword [0x730b4]
call fcn.00066598
call fcn.00023204
cdq
push edx
push eax
lea eax, [ebp - 0x190]
call fcn.00018ef8
mov ecx, dword [ebp - 0x190]
lea eax, [ebp - 0x18c]
mov edx, 0x6ea00
call fcn.00013d20
mov eax, dword [ebp - 0x18c]
call fcn.0006b150
mov edx, 2
mov eax, 0x6ea14
call fcn.0006a544
mov ax, 0xd3d
call fcn.00067f38
mov eax, dword [0x7321c]
call fcn.000126f8
mov eax, dword [0x730ac]
call fcn.000126f8
mov eax, dword [0x730b8]
call fcn.000126f8
mov eax, dword [0x73238]
call fcn.000126f8
mov byte [0x73218], 1
jmp 0x6e1be
lea eax, [ebp - 0x19c]
call fcn.0003911c
mov edx, dword [ebp - 0x19c]
lea eax, [ebp - 0x198]
call fcn.00013c9c
mov ecx, dword [ebp - 0x198]
lea eax, [ebp - 0x194]
mov edx, 0x6ea28
call fcn.00013d20
mov eax, dword [ebp - 0x194]
call fcn.0006b150
lea edx, [ebp - 0x2a4]
mov al, byte [0x73218]
call fcn.0001a388
lea edx, [ebp - 0x2a4]
lea eax, [ebp - 0x1a4]
call fcn.00013c78
mov ecx, dword [ebp - 0x1a4]
lea eax, [ebp - 0x1a0]
mov edx, 0x6ea4c
call fcn.00013d20
mov eax, dword [ebp - 0x1a0]
call fcn.0006b150
xor eax, eax
push ebp
push 0x6e22b
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x730b4], 0
je 0x6e221
mov eax, dword [0x730b4]
call fcn.00037e20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6e235
xor eax, eax
mov dword [0x730b4], eax
cmp byte [0x73218], 0
je 0x6e251
mov dl, 1
mov eax, 6
call fcn.00065bb8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6e265
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6e382
lea eax, [ebp - 0x1a4]
mov edx, 2
call fcn.00013a78
lea eax, [ebp - 0x19c]
call fcn.00014084
lea eax, [ebp - 0x198]
mov edx, 0xc
call fcn.00013a78
lea eax, [ebp - 0x168]
call fcn.00014084
lea eax, [ebp - 0x164]
mov edx, 0x12
call fcn.00013a78
lea eax, [ebp - 0x11c]
mov edx, 3
call fcn.0001409c
lea eax, [ebp - 0x110]
call fcn.00013a54
lea eax, [ebp - 0x10c]
mov edx, 3
call fcn.0001409c
lea eax, [ebp - 0x100]
mov edx, 0x1a
call fcn.00013a78
lea eax, [ebp - 0x98]
mov edx, 4
call fcn.0001409c
lea eax, [ebp - 0x88]
call fcn.00013a54
lea eax, [ebp - 0x84]
mov edx, 3
call fcn.0001409c
lea eax, [ebp - 0x78]
mov edx, 0xb
call fcn.00013a78
lea eax, [ebp - 0x4c]
mov edx, 5
call fcn.0001409c
lea eax, [ebp - 0x38]
call fcn.00013a54
lea eax, [ebp - 0x34]
mov edx, 3
call fcn.0001409c
lea eax, [ebp - 0x28]
call fcn.00013a54
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.0001409c
lea eax, [ebp - 0x18]
call fcn.00013a54
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00013a78
ret