Function at 0x6b764
Capabilities:
Delete registry key
Delete registry value
Disable system features via registry on windows
Get session user name
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x25
push 0
push 0
dec ecx
jne 0x6b76c
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x6c4d9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x6c4f0
call fcn.0006b150
xor ecx, ecx
push ebp
push 0x6c488
push dword fs:[ecx]
mov dword fs:[ecx], esp
mov eax, 0x400
call fcn.000126e0
mov esi, eax
mov eax, 0x400
call fcn.000126e0
mov dword [ebp - 8], eax
mov eax, 0x5000
call fcn.000126e0
mov dword [ebp - 0xc], eax
mov dl, 1
mov eax, dword [0x392e8]
call fcn.00039390
mov ebx, eax
mov edx, 0x80000002
mov eax, ebx
call fcn.00039430
mov dword [ebx + 0x18], 0xf003f
xor ecx, ecx
mov edx, 0x6c51c
mov eax, ebx
call fcn.00039498
test al, al
je 0x6c459
mov dword [ebp - 0x10], 0x3ff
lea eax, [ebp - 0x10]
push eax
push esi
call sub.advapi32.dll_GetUserNameA
lea ecx, [ebp - 0x28]
mov edx, 0x6c568
mov eax, ebx
call fcn.000399bc
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 0x28]
call fcn.00013aec
mov edx, dword [ebp - 0x28]
mov eax, 0x6c580
call fcn.00013fc0
mov edi, eax
test edi, edi
jle 0x6b846
lea eax, [ebp - 0x2c]
mov ecx, edi
mov edx, 1
call fcn.00013f1c
mov edx, dword [ebp - 0x2c]
mov eax, 0x6c580
call fcn.00013fc0
mov dword [ebp - 4], eax
test edi, edi
jle 0x6b860
cmp dword [ebp - 4], 0
jg 0x6b877
mov eax, 0x6c58c
call fcn.0006b230
mov eax, dword [ebp - 0x28]
call fcn.0006b230
jmp 0x6c459
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 4]
add ecx, edi
mov edx, 1
mov eax, dword [ebp - 0x28]
call fcn.00013edc
xor eax, eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
neg eax
sbb eax, eax
neg eax
test al, al
je 0x6b8f7
lea eax, [ebp - 0x4c]
push eax
push 0x6c5bc
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x50], 1
mov dword [ebp - 0x44], 2
mov edx, 0x10
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
test al, al
je 0x6b8f7
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x40]
push eax
push edx
lea eax, [ebp - 0x50]
push eax
push 0
mov eax, dword [ebp - 0x20]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
cmp dword [ebp - 0x20], 0
je 0x6b906
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
neg eax
sbb eax, eax
neg eax
test al, al
je 0x6b970
lea eax, [ebp - 0x4c]
push eax
push 0x6c5d0
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x50], 1
mov dword [ebp - 0x44], 2
mov edx, 0x10
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
test al, al
je 0x6b970
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x40]
push eax
push edx
lea eax, [ebp - 0x50]
push eax
push 0
mov eax, dword [ebp - 0x20]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
cmp dword [ebp - 0x20], 0
je 0x6b97f
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
mov dword [ebp - 0x20], eax
lea edx, [ebp - 0x54]
mov eax, dword [ebp - 0x28]
call fcn.0001902c
lea eax, [ebp - 0x54]
mov edx, 0x6c5ec
call fcn.00013cdc
mov eax, dword [ebp - 0x54]
mov ecx, 0x730c0
mov edx, 0x13
call fcn.00026414
test byte [0x730c8], 0x10
je 0x6bfc2
lea edx, [ebp - 0x58]
mov eax, dword [ebp - 0x28]
call fcn.0001902c
lea eax, [ebp - 0x58]
mov edx, dword [0x730cc]
call fcn.00013cdc
mov eax, dword [ebp - 0x58]
lea edx, [ebp - 0x2c]
call fcn.0001902c
lea edx, [ebp - 0x5c]
mov eax, dword [0x730cc]
call fcn.00018ebc
mov eax, dword [ebp - 0x5c]
push eax
lea eax, [ebp - 0x64]
call fcn.00023ef4
mov eax, dword [ebp - 0x64]
lea edx, [ebp - 0x60]
call fcn.00018ebc
mov edx, dword [ebp - 0x60]
pop eax
call fcn.00013de4
jne 0x6ba3d
lea eax, [ebp - 0x68]
mov ecx, dword [ebp - 0x2c]
mov edx, 0x6c5f8
call fcn.00013d20
mov eax, dword [ebp - 0x68]
call fcn.0006b150
push 0
mov cl, 1
mov edx, dword [0x730b4]
mov eax, dword [ebp - 0x2c]
call fcn.00066598
jmp 0x6bfc2
lea eax, [ebp - 0x6c]
mov ecx, 0x6c60c
mov edx, dword [ebp - 0x2c]
call fcn.00013d20
mov eax, dword [ebp - 0x6c]
call fcn.0002638c
test al, al
je 0x6bfc2
lea eax, [ebp - 0x70]
mov ecx, dword [ebp - 0x2c]
mov edx, 0x6c620
call fcn.00013d20
mov eax, dword [ebp - 0x70]
call fcn.0006b150
lea eax, [ebp - 0x74]
mov ecx, 0x6c60c
mov edx, dword [ebp - 0x2c]
call fcn.00013d20
mov eax, dword [ebp - 0x74]
call fcn.0002639c
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x78]
mov ecx, 0x6c60c
mov edx, dword [ebp - 0x2c]
call fcn.00013d20
mov eax, dword [ebp - 0x78]
mov edx, 0x20
call fcn.00019004
lea eax, [ebp - 0x7c]
mov ecx, 0x6c60c
mov edx, dword [ebp - 0x2c]
call fcn.00013d20
mov edx, dword [ebp - 0x7c]
mov eax, dword [ebp - 8]
call fcn.000266c4
mov eax, dword [ebp - 8]
push eax
push 0x6c638
push 0x80000003
call sub.advapi32.dll_RegLoadKeyA
mov edi, eax
test edi, edi
sete al
test al, al
jne 0x6bb1b
lea eax, [ebp - 0x80]
mov ecx, 0x6c64c
mov edx, dword [ebp - 0x2c]
call fcn.00013d20
mov edx, dword [ebp - 0x80]
mov eax, dword [ebp - 8]
call fcn.000266c4
mov eax, dword [ebp - 8]
push eax
push 0x6c638
push 0x80000003
call sub.advapi32.dll_RegLoadKeyA
mov edi, eax
test edi, edi
sete al
test al, al
je 0x6bf4c
xor eax, eax
mov dword [0x73228], eax
lea eax, [ebp - 0x14]
mov edx, 0x6c65c
call fcn.00013aec
push 0x73228
push 0xf003f
push 0
mov eax, dword [ebp - 0x14]
call fcn.00013e98
push eax
push 0x80000003
call sub.advapi32.dll_RegOpenKeyExA_1
mov edi, eax
test edi, edi
jne 0x6bc0b
mov eax, dword [ebp - 0x2c]
call fcn.0006b150
push 0x6c6a4
mov eax, dword [0x73228]
push eax
call sub.advapi32.dll_RegDeleteValueA
mov edi, eax
test edi, edi
je 0x6bbac
lea edx, [ebp - 0x88]
mov eax, edi
call fcn.00018f2c
mov ecx, dword [ebp - 0x88]
lea eax, [ebp - 0x84]
mov edx, 0x6c6b8
call fcn.00013d20
mov eax, dword [ebp - 0x84]
call fcn.0006b230
lea eax, [ebp - 0x8c]
mov ecx, 0x6c6cc
mov edx, dword [ebp - 0x14]
call fcn.00013d20
mov eax, dword [ebp - 0x8c]
call fcn.00013e98
push eax
push 0x80000003
call sub.advapi32.dll_RegDeleteKeyA
mov edi, eax
test edi, edi
je 0x6bc4b
lea edx, [ebp - 0x94]
mov eax, edi
call fcn.00018f2c
mov ecx, dword [ebp - 0x94]
lea eax, [ebp - 0x90]
mov edx, 0x6c6e4
call fcn.00013d20
mov eax, dword [ebp - 0x90]
call fcn.0006b230
jmp 0x6bc4b
push 0x6c6f8
push dword [ebp - 0x2c]
push 0x6c708
lea edx, [ebp - 0x9c]
mov eax, edi
call fcn.00018f2c
push dword [ebp - 0x9c]
push 0x6c714
lea eax, [ebp - 0x98]
mov edx, 5
call fcn.00013d94
mov eax, dword [ebp - 0x98]
call fcn.0006b230
cmp dword [0x73228], 0
je 0x6bc5f
mov eax, dword [0x73228]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [0x73228], eax
xor eax, eax
mov dword [0x73228], eax
lea eax, [ebp - 0x14]
mov edx, 0x6c720
call fcn.00013aec
push 0x73228
push 0xf003f
push 0
mov eax, dword [ebp - 0x14]
call fcn.00013e98
push eax
push 0x80000003
call sub.advapi32.dll_RegOpenKeyExA_1
mov edi, eax
test edi, edi
jne 0x6bced
mov eax, dword [ebp - 0x2c]
call fcn.0006b150
push 0x6c768
mov eax, dword [0x73228]
push eax
call sub.advapi32.dll_RegDeleteValueA
mov edi, eax
test edi, edi
je 0x6bd2d
lea edx, [ebp - 0xa4]
mov eax, edi
call fcn.00018f2c
mov ecx, dword [ebp - 0xa4]
lea eax, [ebp - 0xa0]
mov edx, 0x6c780
call fcn.00013d20
mov eax, dword [ebp - 0xa0]
call fcn.0006b230
jmp 0x6bd2d
push 0x6c794
push dword [ebp - 0x2c]
push 0x6c708
lea edx, [ebp - 0xac]
mov eax, edi
call fcn.00018f2c
push dword [ebp - 0xac]
push 0x6c714
lea eax, [ebp - 0xa8]
mov edx, 5
call fcn.00013d94
mov eax, dword [ebp - 0xa8]
call fcn.0006b230
cmp dword [0x73228], 0
je 0x6bd41
mov eax, dword [0x73228]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [0x73228], eax
xor eax, eax
mov dword [0x73228], eax
lea eax, [ebp - 0x14]
mov edx, 0x6c7a4
call fcn.00013aec
push 0x73228
push 0xf003f
push 0
mov eax, dword [ebp - 0x14]
call fcn.00013e98
push eax
push 0x80000003
call sub.advapi32.dll_RegOpenKeyExA_1
mov edi, eax
test edi, edi
jne 0x6beef
mov eax, dword [ebp - 0x2c]
call fcn.0006b150
mov dword [ebp - 0x24], 0x4ffe
mov edx, 0x5000
mov eax, dword [ebp - 0xc]
call fcn.000175a4
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0x6c7bc
mov eax, dword [0x73228]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov edi, eax
test edi, edi
jne 0x6be39
cmp dword [ebp - 0x18], 1
je 0x6bdd7
cmp dword [ebp - 0x18], 2
je 0x6bdd7
cmp dword [ebp - 0x18], 7
jne 0x6be39
push 0x6c7c8
mov eax, dword [0x73228]
push eax
call sub.advapi32.dll_RegDeleteValueA
mov eax, dword [ebp - 0x24]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 0
push 0x6c7d0
mov eax, dword [0x73228]
push eax
call sub.advapi32.dll_RegSetValueExW
mov edi, eax
test edi, edi
je 0x6be39
lea edx, [ebp - 0xb4]
mov eax, edi
call fcn.00018f2c
mov ecx, dword [ebp - 0xb4]
lea eax, [ebp - 0xb0]
mov edx, 0x6c7e4
call fcn.00013d20
mov eax, dword [ebp - 0xb0]
call fcn.0006b230
mov dword [ebp - 0x24], 0x4ffe
mov edx, 0x5000
mov eax, dword [ebp - 0xc]
call fcn.000175a4
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0x6c7f0
mov eax, dword [0x73228]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov edi, eax
test edi, edi
jne 0x6bf2f
cmp dword [ebp - 0x18], 1
je 0x6be8b
cmp dword [ebp - 0x18], 2
je 0x6be8b
cmp dword [ebp - 0x18], 7
jne 0x6bf2f
push 0x6c7fc
mov eax, dword [0x73228]
push eax
call sub.advapi32.dll_RegDeleteValueA
mov eax, dword [ebp - 0x24]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 0
push 0x6c804
mov eax, dword [0x73228]
push eax
call sub.advapi32.dll_RegSetValueExW
mov edi, eax
test edi, edi
je 0x6bf2f
lea edx, [ebp - 0xbc]
mov eax, edi
call fcn.00018f2c
mov ecx, dword [ebp - 0xbc]
lea eax, [ebp - 0xb8]
mov edx, 0x6c814
call fcn.00013d20
mov eax, dword [ebp - 0xb8]
call fcn.0006b230
jmp 0x6bf2f
push 0x6c828
push dword [ebp - 0x2c]
push 0x6c708
lea edx, [ebp - 0xc4]
mov eax, edi
call fcn.00018f2c
push dword [ebp - 0xc4]
push 0x6c714
lea eax, [ebp - 0xc0]
mov edx, 5
call fcn.00013d94
mov eax, dword [ebp - 0xc0]
call fcn.0006b230
cmp dword [0x73228], 0
je 0x6bf43
mov eax, dword [0x73228]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [0x73228], eax
jmp 0x6bf92
lea eax, [ebp - 0xc8]
mov ecx, dword [ebp - 0x2c]
mov edx, 0x6c838
call fcn.00013d20
mov eax, dword [ebp - 0xc8]
call fcn.0006b230
lea edx, [ebp - 0x14]
mov eax, edi
call fcn.00018f2c
lea eax, [ebp - 0xcc]
mov ecx, dword [ebp - 0x14]
mov edx, 0x6c844
call fcn.00013d20
mov eax, dword [ebp - 0xcc]
call fcn.0006b230
push 0x6c638
push 0x80000003
call sub.advapi32.dll_RegUnLoadKeyA
lea eax, [ebp - 0xd0]
mov ecx, 0x6c60c
mov edx, dword [ebp - 0x2c]
call fcn.00013d20
mov eax, dword [ebp - 0xd0]
mov edx, dword [ebp - 0x30]
call fcn.00019004
mov eax, 0x730c0
call fcn.00026464
test eax, eax
je 0x6b9ae
mov eax, 0x730c0
call fcn.00026488
xor eax, eax
mov dword [0x73228], eax
lea eax, [ebp - 0x14]
mov edx, 0x6c850
call fcn.00013aec
push 0x73228
push 0xf003f
push 0
mov eax, dword [ebp - 0x14]
call fcn.00013e98
push eax
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA_1
mov edi, eax
test edi, edi
jne 0x6c0da
lea eax, [ebp - 0xd4]
mov edx, esi
call fcn.00013c0c
mov eax, dword [ebp - 0xd4]
call fcn.0006b150
push 0x6c6a4
mov eax, dword [0x73228]
push eax
call sub.advapi32.dll_RegDeleteValueA
mov edi, eax
test edi, edi
je 0x6c077
lea edx, [ebp - 0xdc]
mov eax, edi
call fcn.00018f2c
mov ecx, dword [ebp - 0xdc]
lea eax, [ebp - 0xd8]
mov edx, 0x6c894
call fcn.00013d20
mov eax, dword [ebp - 0xd8]
call fcn.0006b230
lea eax, [ebp - 0xe0]
mov ecx, 0x6c6cc
mov edx, dword [ebp - 0x14]
call fcn.00013d20
mov eax, dword [ebp - 0xe0]
call fcn.00013e98
push eax
push 0x80000001
call sub.advapi32.dll_RegDeleteKeyA
mov edi, eax
test edi, edi
je 0x6c12a
lea edx, [ebp - 0xe8]
mov eax, edi
call fcn.00018f2c
mov ecx, dword [ebp - 0xe8]
lea eax, [ebp - 0xe4]
mov edx, 0x6c8a8
call fcn.00013d20
mov eax, dword [ebp - 0xe4]
call fcn.0006b230
jmp 0x6c12a
push 0x6c8bc
lea eax, [ebp - 0xf0]
mov edx, esi
call fcn.00013c0c
push dword [ebp - 0xf0]
push 0x6c708
lea edx, [ebp - 0xf4]
mov eax, edi
call fcn.00018f2c
push dword [ebp - 0xf4]
push 0x6c714
lea eax, [ebp - 0xec]
mov edx, 5
call fcn.00013d94
mov eax, dword [ebp - 0xec]
call fcn.0006b230
cmp dword [0x73228], 0
je 0x6c13e
mov eax, dword [0x73228]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [0x73228], eax
xor eax, eax
mov dword [0x73228], eax
lea eax, [ebp - 0x14]
mov edx, 0x6c8cc
call fcn.00013aec
push 0x73228
push 0xf003f
push 0
mov eax, dword [ebp - 0x14]
call fcn.00013e98
push eax
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA_1
mov edi, eax
test edi, edi
jne 0x6c1e0
lea eax, [ebp - 0xf8]
mov edx, esi
call fcn.00013c0c
mov eax, dword [ebp - 0xf8]
call fcn.0006b150
push 0x6c768
mov eax, dword [0x73228]
push eax
call sub.advapi32.dll_RegDeleteValueA
mov edi, eax
test edi, edi
je 0x6c230
lea edx, [ebp - 0x100]
mov eax, edi
call fcn.00018f2c
mov ecx, dword [ebp - 0x100]
lea eax, [ebp - 0xfc]
mov edx, 0x6c910
call fcn.00013d20
mov eax, dword [ebp - 0xfc]
call fcn.0006b230
jmp 0x6c230
push 0x6c924
lea eax, [ebp - 0x108]
mov edx, esi
call fcn.00013c0c
push dword [ebp - 0x108]
push 0x6c708
lea edx, [ebp - 0x10c]
mov eax, edi
call fcn.00018f2c
push dword [ebp - 0x10c]
push 0x6c714
lea eax, [ebp - 0x104]
mov edx, 5
call fcn.00013d94
mov eax, dword [ebp - 0x104]
call fcn.0006b230
cmp dword [0x73228], 0
je 0x6c244
mov eax, dword [0x73228]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [0x73228], eax
xor eax, eax
mov dword [0x73228], eax
lea eax, [ebp - 0x14]
mov edx, 0x6c934
call fcn.00013aec
push 0x73228
push 0xf003f
push 0
mov eax, dword [ebp - 0x14]
call fcn.00013e98
push eax
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA_1
mov edi, eax
test edi, edi
jne 0x6c3ee
mov dword [ebp - 0x24], 0x4ffe
mov edx, 0x5000
mov eax, dword [ebp - 0xc]
call fcn.000175a4
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0x6c7bc
mov eax, dword [0x73228]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov edi, eax
test edi, edi
jne 0x6c334
cmp dword [ebp - 0x18], 1
je 0x6c2d2
cmp dword [ebp - 0x18], 2
je 0x6c2d2
cmp dword [ebp - 0x18], 7
jne 0x6c334
push 0x6c7c8
mov eax, dword [0x73228]
push eax
call sub.advapi32.dll_RegDeleteValueA
mov eax, dword [ebp - 0x24]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 0
push 0x6c7d0
mov eax, dword [0x73228]
push eax
call sub.advapi32.dll_RegSetValueExW
mov edi, eax
test edi, edi
je 0x6c334
lea edx, [ebp - 0x114]
mov eax, edi
call fcn.00018f2c
mov ecx, dword [ebp - 0x114]
lea eax, [ebp - 0x110]
mov edx, 0x6c948
call fcn.00013d20
mov eax, dword [ebp - 0x110]
call fcn.0006b230
mov dword [ebp - 0x24], 0x4ffe
mov edx, 0x5000
mov eax, dword [ebp - 0xc]
call fcn.000175a4
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0x6c7f0
mov eax, dword [0x73228]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov edi, eax
test edi, edi
jne 0x6c43e
cmp dword [ebp - 0x18], 1
je 0x6c386
cmp dword [ebp - 0x18], 2
je 0x6c386
cmp dword [ebp - 0x18], 7
jne 0x6c43e
push 0x6c7fc
mov eax, dword [0x73228]
push eax
call sub.advapi32.dll_RegDeleteValueA
mov eax, dword [ebp - 0x24]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 0
push 0x6c804
mov eax, dword [0x73228]
push eax
call sub.advapi32.dll_RegSetValueExW
mov edi, eax
test edi, edi
je 0x6c43e
lea edx, [ebp - 0x11c]
mov eax, edi
call fcn.00018f2c
mov ecx, dword [ebp - 0x11c]
lea eax, [ebp - 0x118]
mov edx, 0x6c95c
call fcn.00013d20
mov eax, dword [ebp - 0x118]
call fcn.0006b230
jmp 0x6c43e
push 0x6c970
lea eax, [ebp - 0x124]
mov edx, esi
call fcn.00013c0c
push dword [ebp - 0x124]
push 0x6c708
lea edx, [ebp - 0x128]
mov eax, edi
call fcn.00018f2c
push dword [ebp - 0x128]
push 0x6c714
lea eax, [ebp - 0x120]
mov edx, 5
call fcn.00013d94
mov eax, dword [ebp - 0x120]
call fcn.0006b230
cmp dword [0x73228], 0
je 0x6c452
mov eax, dword [0x73228]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [0x73228], eax
mov eax, ebx
call fcn.00039400
mov eax, ebx
call fcn.00012d44
mov eax, dword [ebp - 0xc]
call fcn.000126f8
mov eax, dword [ebp - 8]
call fcn.000126f8
mov eax, esi
call fcn.000126f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x6c49c
mov eax, 0x6c998
call fcn.0006b150
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6c4e0
lea eax, [ebp - 0x128]
mov edx, 0x36
call fcn.00013a78
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.00013a78
lea eax, [ebp - 0x14]
call fcn.00013a54
ret