Function at 0x6dd3e000
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4e0
mov eax, dword [0x6de41080]
push ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + 4]
xor ebx, ebx
mov dword [ebp - 4], eax
mov dword [edi + 0x18], ebx
mov dword [edi + 0x20], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [ebp + 8]
mov dword [edi + 0x1c], eax
mov eax, 1
mov dword [esi], 0x6dd314c0
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x33c8], ebx
mov dword [esi + 0x34e0], ecx
mov dword [esi + 0x24], esi
push edi
mov dword [edi + 0x18], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor edx, edx
mov dword [esi + 0x1ad0], edx
mov dword [esi + 0x1ad4], edx
mov dword [esi + 0x1ad8], edx
mov dword [esi + 0x1adc], edx
mov dword [esi + 0x1ae0], edx
mov dword [esi + 0x1ae4], edx
mov dword [esi + 0x1ae8], edx
mov dword [esi + 0x1aec], edx
mov dword [esi + 0x1af0], edx
mov dword [esi + 0x1af4], edx
mov dword [esi + 0x1af8], edx
xor eax, eax
mov dword [esi + 0x1afc], edx
lea edi, [esi + 0x30]
mov ecx, 0x6a8
rep stosd dword es:[edi], eax
mov ecx, 0x6a
lea edi, [ebp - 0x4c0]
rep stosd dword es:[edi], eax
push ebx
lea eax, [ebp - 0x4c0]
push eax
push ebx
push ebx
mov dword [ebp - 0x4c0], 0x1a8
xor edi, edi
call fcn.6dd3ed40
add esp, 0x10
test eax, eax
je 0x6dd3e1ab
mov al, byte [ebp - 0x41c]
test al, 8
jne 0x6dd3e190
test al, 1
je 0x6dd3e190
test al, 4
je 0x6dd3e190
mov ecx, dword [esi + 0x2c]
mov eax, dword [str.YUhg]
imul ecx, ecx, 0x238
lea edx, [ecx + esi + 0x30]
mov dword [edx], eax
mov ecx, dword [0x6de41004]
mov dword [edx + 4], ecx
mov eax, dword [0x6de41008]
mov dword [edx + 8], eax
mov ecx, dword [0x6de4100c]
mov dword [edx + 0xc], ecx
mov edx, dword [esi + 0x2c]
imul edx, edx, 0x238
mov ecx, dword [edx + esi + 0x30]
lea eax, [edx + esi + 0x30]
add ecx, edi
mov dword [eax], ecx
mov ecx, dword [esi + 0x2c]
imul ecx, ecx, 0x238
push 0x104
lea eax, [ebp - 0x4bc]
push eax
lea edx, [ecx + esi + 0x40]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov eax, dword [esi + 0x2c]
mov ecx, dword [ebp - 0x41c]
imul eax, eax, 0x238
mov dword [eax + esi + 0x144], ecx
mov edx, dword [esi + 0x2c]
imul edx, edx, 0x238
mov dword [edx + esi + 0x148], 1
inc dword [esi + 0x2c]
push ebx
lea eax, [ebp - 0x4c0]
push eax
inc edi
push edi
push ebx
call fcn.6dd3ed40
add esp, 0x10
test eax, eax
jne 0x6dd3e0e2
push ebx
lea ecx, [ebp - 0x4c0]
push ecx
push ebx
push ebx
xor edi, edi
call fcn.6dd3ed40
add esp, 0x10
test eax, eax
je 0x6dd3e2a2
jmp 0x6dd3e1d0
mov al, byte [ebp - 0x41c]
test al, 8
jne 0x6dd3e287
test al, 1
je 0x6dd3e287
test al, 4
jne 0x6dd3e287
mov eax, dword [esi + 0x2c]
cmp eax, 0xc
jae 0x6dd3e287
imul eax, eax, 0x238
lea edx, [eax + esi + 0x30]
mov eax, dword [str.YUhg]
mov dword [edx], eax
mov ecx, dword [0x6de41004]
mov dword [edx + 4], ecx
mov eax, dword [0x6de41008]
mov dword [edx + 8], eax
mov ecx, dword [0x6de4100c]
mov dword [edx + 0xc], ecx
mov edx, dword [esi + 0x2c]
imul edx, edx, 0x238
mov ecx, dword [edx + esi + 0x30]
lea eax, [edx + esi + 0x30]
add ecx, edi
mov dword [eax], ecx
mov ecx, dword [esi + 0x2c]
imul ecx, ecx, 0x238
push 0x104
lea eax, [ebp - 0x4bc]
push eax
lea edx, [ecx + esi + 0x40]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov eax, dword [esi + 0x2c]
mov ecx, dword [ebp - 0x41c]
imul eax, eax, 0x238
mov dword [eax + esi + 0x144], ecx
mov edx, dword [esi + 0x2c]
imul edx, edx, 0x238
mov dword [edx + esi + 0x148], 1
inc dword [esi + 0x2c]
push ebx
lea eax, [ebp - 0x4c0]
push eax
inc edi
push edi
push ebx
call fcn.6dd3ed40
add esp, 0x10
test eax, eax
jne 0x6dd3e1d0
lea ecx, [ebp - 0x4d8]
push ecx
push 0x6dd314a0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x6dd3e4e3
mov eax, dword [ebp - 0x4d8]
push 0x100
lea edx, [ebp - 0x208]
push edx
push ebx
push eax
mov dword [ebp - 0x4c4], ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x6dd3e4d6
lea esp, [esp]
lea ecx, [ebp - 0x318]
push ecx
lea ecx, [ebp - 0x208]
call fcn.6dd3be60
add esp, 4
test eax, eax
je 0x6dd3e4a7
mov ecx, dword [ebp - 0x4d8]
lea edx, [ebp - 0x4e0]
push edx
lea eax, [ebp - 0x208]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x6dd3e4a7
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [ebp - 0x4d0]
push edx
mov edx, dword [ebp - 0x4e0]
lea eax, [ebp - 0x308]
push eax
lea ecx, [ebp - 0x4dc]
push ecx
push ebx
push 0x6dd31494
push edx
mov dword [ebp - 0x4d0], 0xff
call edi
test eax, eax
jne 0x6dd3e49a
cmp dword [ebp - 0x4dc], 1
jne 0x6dd3e49a
mov eax, dword [ebp - 0x4d0]
lea ecx, [ebp - 0x4d0]
push ecx
mov ecx, dword [ebp - 0x4e0]
lea edx, [ebp - 0x108]
push edx
mov byte [ebp + eax - 0x308], 0
lea eax, [ebp - 0x4dc]
push eax
push ebx
push 0x6dd31488
push ecx
mov dword [ebp - 0x4d0], 0x103
call edi
test eax, eax
jne 0x6dd3e49a
mov edx, dword [ebp - 0x4d0]
mov byte [ebp + edx - 0x108], al
lea eax, [ebp - 0x318]
push eax
call fcn.6dd481e0
add esp, 4
test eax, eax
je 0x6dd3e3f0
lea ecx, [ebp - 0x108]
push ecx
call fcn.6dd3fc80
add esp, 4
mov edi, eax
jmp 0x6dd3e3f2
xor edi, edi
cmp dword [ebp - 0x4dc], 1
jne 0x6dd3e48d
cmp edi, ebx
je 0x6dd3e49a
mov eax, dword [esi + 0x2c]
cmp eax, 0xc
jae 0x6dd3e48d
mov edx, dword [ebp - 0x4d0]
imul eax, eax, 0x238
mov ecx, dword [ebp - 0x318]
mov byte [ebp + edx - 0x108], 0
lea eax, [eax + esi + 0x30]
mov dword [eax], ecx
mov edx, dword [ebp - 0x314]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x310]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 0x30c]
mov dword [eax + 0xc], edx
mov ecx, dword [esi + 0x2c]
imul ecx, ecx, 0x238
push 0x104
lea eax, [ebp - 0x108]
push eax
lea edx, [ecx + esi + 0x40]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov eax, dword [esi + 0x2c]
imul eax, eax, 0x238
mov dword [eax + esi + 0x144], ebx
mov ecx, dword [esi + 0x2c]
imul ecx, ecx, 0x238
mov dword [ecx + esi + 0x148], ebx
inc dword [esi + 0x2c]
cmp edi, ebx
je 0x6dd3e49a
push edi
call fcn.6dd3ee20
add esp, 4
mov edx, dword [ebp - 0x4e0]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x4c4]
mov edx, dword [ebp - 0x4d8]
push 0x100
lea ecx, [ebp - 0x208]
inc eax
push ecx
push eax
push edx
mov dword [ebp - 0x4c4], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x6dd3e2f0
mov eax, dword [ebp - 0x4d8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esi + 0x2c], ebx
mov dword [ebp - 0x4c8], ebx
jbe 0x6dd3e75b
lea ebx, [esi + 0x30]
xor edi, edi
push edi
push edi
push edi
push edi
push 1
lea ecx, [ebp - 0x4cc]
push ebx
push ecx
call fcn.6dd3fd00
add esp, 0x1c
test eax, eax
jge 0x6dd3e535
mov edx, dword [ebp - 0x4c8]
push edx
xor eax, eax
mov ecx, 0x42
lea edi, [ebx + 0x128]
push ebx
rep stosd dword es:[edi], eax
call fcn.6dd3cb90
add esp, 8
jmp 0x6dd3e73b
mov eax, dword [ebp - 0x4cc]
mov ecx, dword [ebp - 0x4c8]
push ebx
push eax
push ecx
call fcn.6dd3ca40
mov edx, dword [ebp - 0x4cc]
mov edx, dword [edx + 0x1c4]
add esp, 0xc
cmp edx, edi
jne 0x6dd3e580
xor eax, eax
mov ecx, 0x42
lea edi, [ebx + 0x128]
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x4c8]
push eax
push ebx
call fcn.6dd3cb90
add esp, 8
jmp 0x6dd3e73b
cmp dword [ebx + 0x224], edi
mov dword [ebp - 0x4d4], edi
mov dword [ebp - 0x4c4], edi
jbe 0x6dd3e5d5
mov eax, dword [ebx + 0x228]
mov edi, dword [ebx + 0x224]
add eax, 0x50
mov ecx, dword [eax + 8]
test ch, 4
je 0x6dd3e5cf
mov ecx, dword [eax]
cmp ecx, 0x16
je 0x6dd3e5c5
jbe 0x6dd3e5cf
cmp ecx, 0x18
ja 0x6dd3e5cf
mov dword [ebp - 0x4c4], 1
jmp 0x6dd3e5cf
mov dword [ebp - 0x4d4], 1
add eax, 0x6c
dec edi
jne 0x6dd3e5a3
mov ecx, dword [ebp - 0x4d4]
push ecx
mov ecx, dword [ebp - 0x4c4]
push ecx
push edx
mov edx, dword [ebx + 0x124]
push edx
lea edi, [ebx + 0x11c]
push edi
lea eax, [ebx + 0x10]
push 0
push eax
call fcn.6dd43960
cmp dword [edi], 0
je 0x6dd3e6ac
mov eax, dword [edi]
shl eax, 4
push eax
call fcn.6dd47440
add esp, 4
test eax, eax
mov dword [ebx + 0x120], eax
je 0x6dd3e6a6
mov ecx, dword [ebp - 0x4d4]
mov edx, dword [ebp - 0x4c4]
push ecx
mov ecx, dword [ebp - 0x4cc]
push edx
mov edx, dword [ecx + 0x1c4]
mov ecx, dword [ebx + 0x124]
push edx
push ecx
push edi
push eax
lea eax, [ebx + 0x10]
push eax
call fcn.6dd43960
cmp dword [edi], 0
jne 0x6dd3e6ac
mov edx, dword [ebx + 0x120]
push edx
call fcn.6dd47460
mov eax, dword [ebp - 0x4d4]
mov ecx, dword [ebp - 0x4c4]
mov edx, dword [ebp - 0x4cc]
add esp, 4
push eax
push ecx
mov dword [ebx + 0x120], 0
mov eax, dword [edx + 0x1c4]
mov ecx, dword [ebx + 0x124]
push eax
push ecx
push edi
push 0
lea eax, [ebx + 0x10]
push eax
call fcn.6dd43960
cmp dword [edi], 0
jne 0x6dd3e606
jmp 0x6dd3e6ac
mov dword [edi], 0
mov eax, dword [ebp - 0x4d4]
test eax, eax
je 0x6dd3e72c
mov eax, dword [ebx + 0x144]
test eax, eax
jne 0x6dd3e72c
cmp dword [ebx + 0x204], 0x16
je 0x6dd3e72c
mov edx, dword [edi]
xor ecx, ecx
test edx, edx
jbe 0x6dd3e6ed
mov eax, dword [ebx + 0x120]
add eax, 0xc
lea ebx, [ebx]
cmp dword [eax], 0x16
je 0x6dd3e6ed
inc ecx
add eax, 0x10
cmp ecx, dword [edi]
jb 0x6dd3e6e0
cmp ecx, edx
jb 0x6dd3e72c
mov eax, dword [ebx + 0x224]
xor edi, edi
test eax, eax
jbe 0x6dd3e72c
xor ecx, ecx
nop
mov edx, dword [ebx + 0x228]
lea eax, [edx + ecx]
mov edx, dword [eax + 0x58]
test dh, 4
je 0x6dd3e71e
cmp dword [eax + 0x50], 0x16
jne 0x6dd3e71e
and dword [eax + 0x58], 0xfffffbff
mov eax, dword [ebx + 0x224]
inc edi
add ecx, 0x6c
cmp edi, eax
jb 0x6dd3e700
mov eax, dword [ebp - 0x4cc]
push eax
call fcn.6dd3fa70
add esp, 4
mov eax, dword [ebp - 0x4c8]
mov ecx, dword [esi + 0x2c]
inc eax
add ebx, 0x238
cmp eax, ecx
mov dword [ebp - 0x4c8], eax
jb 0x6dd3e4f5
xor ebx, ebx
lea ecx, [ebp - 0x4c4]
push ecx
push 0x6dd31458
push 0x80000002
mov dword [esi + 0x33cc], ebx
mov dword [esi + 0x33d0], ebx
mov dword [esi + 0x33d4], ebx
mov dword [esi + 0x33d8], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x6dd3e7eb
mov ecx, dword [ebp - 0x4c4]
lea edx, [ebp - 0x4c8]
push edx
lea edi, [esi + 0x33dc]
push edi
lea eax, [ebp - 0x4cc]
push eax
push ebx
push 0x6dd31450
push ecx
mov dword [ebp - 0x4c8], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x6dd3e7de
mov ecx, dword [ebp - 0x4cc]
mov eax, 1
cmp ecx, eax
jne 0x6dd3e7de
cmp byte [edi], 0
je 0x6dd3e7de
mov dword [esi + 0x33d8], eax
mov edx, dword [ebp - 0x4c4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x4c4]
push eax
push 0x6dd3142c
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x6dd3e85c
lea ecx, [ebp - 0x4c8]
push ecx
mov ecx, dword [ebp - 0x4c4]
lea edx, [ebp - 0x4cc]
push edx
lea eax, [ebp - 0x4d4]
push eax
push ebx
push 0x6dd3141c
push ecx
mov dword [ebp - 0x4c8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x6dd3e84f
mov eax, dword [ebp - 0x4cc]
xor edx, edx
cmp eax, ebx
setne dl
mov dword [esi + 0x33c4], edx
mov eax, dword [ebp - 0x4c4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
pop ebx
call fcn.6dd58dd9
mov esp, ebp
pop ebp
ret 4