Function at 0x63611bad
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x7dc]
sub esp, 0x85c
mov eax, dword [0x6363a530]
push ebx
xor ebx, ebx
push 0x50
xor eax, ebp
push ebx
push 0x6363d760
mov dword [ebp + 0x7d8], eax
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x78], ebx
mov dword [0x6363d758], ebx
call fcn.6361d770
push 0x6363d640
call fcn.6361dc80
add esp, 0x10
test eax, eax
jbe 0x63611e64
lea eax, [ebp - 0x6c]
push eax
push 0x2001f
push ebx
push str.SoftwareMicrosoftInternet_ExplorerSearchScopes
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x63611e64
push esi
push edi
push 4
pop eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x70]
push eax
push ebx
push str.bdadd
push dword [ebp - 0x6c]
mov dword [ebp - 0x68], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor edi, edi
inc edi
cmp dword [ebp - 0x68], ebx
jbe 0x63611c52
mov dword [ebp - 0x78], edi
push 0x38
pop esi
push esi
lea eax, [ebp + 0x7a0]
push ebx
push eax
call fcn.6361d770
add esp, 0xc
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp + 0x7a0]
push eax
lea eax, [ebp - 0x70]
push eax
push ebx
push str.DefaultScope
push dword [ebp - 0x6c]
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x64], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x80]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x60]
push eax
mov dword [ebp - 0x68], ebx
mov esi, 0x400
push ebx
jmp 0x63611d51
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp + 0x3a0]
push str.SoftwareMicrosoftInternet_ExplorerSearchScopes_s
push eax
call fcn.6361dd0b
add esp, 0xc
lea eax, [ebp - 0x74]
push eax
push 0x20019
push ebx
lea eax, [ebp + 0x3a0]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x63611d3c
push esi
lea eax, [ebp + 0x3a0]
push ebx
push eax
call fcn.6361d770
add esp, 0xc
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp + 0x3a0]
push eax
lea eax, [ebp - 0x70]
push eax
push ebx
push 0x63630d84
push dword [ebp - 0x74]
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x64], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x63611d33
lea eax, [ebp + 0x3a0]
push 0x6363e080
push eax
call fcn.6361f5d0
test eax, eax
pop ecx
pop ecx
jne 0x63611e7c
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x68]
lea eax, [ebp - 0x80]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x60]
push eax
push dword [ebp - 0x68]
push dword [ebp - 0x6c]
mov dword [ebp - 0x64], esi
mov byte [ebp - 0x60], bl
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x63611ca7
cmp dword [ebp - 0x78], ebx
jne 0x63611e59
push ebx
lea eax, [ebp - 0x74]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push str.SoftwareMicrosoftInternet_ExplorerSearchScopes4633EF93_D676_472f_A0FF_E1916B0B2E30
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x63611e59
lea eax, [ebp + 0x3a0]
push 0x63630d18
push eax
call fcn.6361dd70
lea eax, [ebp + 0x3a0]
push eax
call fcn.6361dc80
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
add esp, 0xc
inc eax
push eax
lea eax, [ebp + 0x3a0]
push eax
push edi
push ebx
push str.DisplayName
push dword [ebp - 0x74]
call esi
lea eax, [ebp + 0x3a0]
push 0x6363d640
push eax
call fcn.6361dd70
lea eax, [ebp + 0x3a0]
push eax
call fcn.6361dc80
add esp, 0xc
inc eax
push eax
lea eax, [ebp + 0x3a0]
push eax
push edi
push ebx
push 0x63630d84
push dword [ebp - 0x74]
call esi
lea eax, [ebp + 0x3a0]
push str.4633EF93_D676_472f_A0FF_E1916B0B2E30
push eax
call fcn.6361dd70
lea eax, [ebp + 0x3a0]
push eax
call fcn.6361dc80
add esp, 0xc
inc eax
push eax
lea eax, [ebp + 0x3a0]
push eax
push edi
push ebx
push str.DefaultScope
push dword [ebp - 0x6c]
call esi
push 4
pop eax
push eax
lea ecx, [ebp - 0x68]
push ecx
push eax
push ebx
push str.bdadd
push dword [ebp - 0x6c]
mov dword [ebp - 0x68], edi
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x64], eax
call esi
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov ecx, dword [ebp + 0x7d8]
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.6361d41e
add ebp, 0x7dc
leave
ret
lea eax, [ebp + 0x3a0]
push eax
call fcn.6361dc80
inc eax
inc eax
push eax
call fcn.6361d9eb
mov ecx, dword [0x6363d758]
mov dword [ecx*4 + 0x6363d760], eax
lea ecx, [ebp + 0x3a0]
push ecx
push eax
call fcn.6361dd70
add esp, 0x10
push dword [ebp - 0x74]
inc dword [0x6363d758]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x63611e59