Function at 0x6e915880
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea esi, [ebp - 0x220]
push ebx
mov ebx, eax
mov eax, esi
sub esp, 0x40c
mov dword [ebp - 0x3d4], edx
shr eax, 0x10
mov dword [ebp - 0x3d8], eax
lea eax, [ebp - 0x39e]
mov dword [ebp - 0x3e0], ecx
shr eax, 0x10
mov dword [ebp - 0x3dc], eax
lea edi, [ebp - 0x3c0]
xor eax, eax
jmp 0x6e9158ce
mov eax, dword [ebp - 0x3cc]
mov dword [esp + 0xc], edi
lea ecx, [eax + 1]
mov edx, 0x104
mov dword [ebp - 0x3c0], edx
xor edx, edx
mov dword [ebp - 0x3cc], ecx
xor ecx, ecx
mov dword [esp + 0x1c], ecx
xor ecx, ecx
mov dword [esp + 0x18], edx
xor edx, edx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.advapi32.dll_RegEnumKeyExW
sub esp, 0x20
test eax, eax
jne 0x6e9159a0
xor ecx, ecx
mov edx, 0x20019
mov dword [esp + 0xc], edx
lea eax, [ebp - 0x3bc]
mov dword [esp + 0x10], eax
mov dword [esp + 8], ecx
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.advapi32.dll_RegOpenKeyExW
sub esp, 0x14
test eax, eax
jne 0x6e9158c8
mov dword [esp + 0x14], edi
xor eax, eax
mov dword [ebp - 0x3c0], eax
xor eax, eax
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 8], eax
mov eax, str.Blob
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x3bc]
mov dword [esp], eax
call sub.advapi32.dll_RegQueryValueExW
sub esp, 0x18
test eax, eax
je 0x6e9159b0
mov eax, dword [ebp - 0x3bc]
mov dword [esp], eax
call sub.advapi32.dll_RegCloseKey
sub esp, 4
jmp 0x6e9158c8
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x3c0]
mov dword [esp], eax
call sym.crypt32.dll_CryptMemAlloc
mov dword [ebp - 0x3d0], eax
sub esp, 4
test eax, eax
je 0x6e915981
mov dword [esp + 0x10], eax
xor eax, eax
xor edx, edx
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x3bc]
mov ecx, str.Blob
mov dword [esp + 0x14], edi
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
call sub.advapi32.dll_RegQueryValueExW
sub esp, 0x18
test eax, eax
jne 0x6e915ad0
test byte [0x6e928c98], 8
jne 0x6e915ae6
lea eax, [ebp - 0x3b8]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x3d4]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x3c0]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x3d0]
mov dword [esp], eax
call fcn.6e9196c0
mov dword [ebp - 0x3e4], eax
test eax, eax
je 0x6e915ad0
mov eax, dword [ebp - 0x3b8]
cmp eax, 2
je 0x6e915c75
cmp eax, 3
je 0x6e915c85
dec eax
jne 0x6e915ad0
mov eax, dword [0x6e928d4c]
mov dword [ebp - 0x3e8], eax
mov eax, dword [ebp - 0x3e8]
test eax, eax
je 0x6e915ad0
mov dword [esp + 0xc], edi
mov edx, 3
mov ecx, 0x14
mov dword [esp + 4], edx
mov edx, dword [ebp - 0x3e4]
mov dword [ebp - 0x3c0], ecx
lea ecx, [ebp - 0x3b2]
mov dword [esp + 8], ecx
mov dword [esp], edx
call dword [eax + 0x14]
lea ecx, [ebp - 0x3b2]
sub esp, 0x10
test eax, eax
jne 0x6e915cc9
mov eax, dword [ebp - 0x3e4]
sub eax, 0x1c
mov dword [esp], eax
call fcn.6e8d8900
nop
lea esi, [esi]
mov eax, dword [ebp - 0x3d0]
mov dword [esp], eax
call sym.crypt32.dll_CryptMemFree
sub esp, 4
jmp 0x6e915981
mov eax, dword [ebp - 0x3d8]
test eax, eax
je 0x6e915d3a
mov dword [esp], esi
mov eax, 0xffffffff
mov dword [esp + 4], eax
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
sub esp, 8
test eax, eax
jne 0x6e915bbc
cmp word [ebp - 0x220], 0
je 0x6e915d93
nop
mov edx, eax
cmp word [esi + edx*2 + 2], 0
lea eax, [eax + 1]
jne 0x6e915b20
mov dword [ebp - 0x3e8], ebx
mov ecx, 0x224c
mov word [ebp - 0x34c], cx
lea ecx, [ebp - 0x34a]
mov dword [ebp - 0x3e4], esi
jmp 0x6e915b8b
cmp eax, 9
je 0x6e915c00
cmp eax, 0xa
jne 0x6e915c1a
mov word [ecx], 0x6e5c
add ecx, 2
lea esi, [esi]
lea eax, [edx - 1]
test edx, edx
jle 0x6e915c95
lea edx, [ebp - 0x22a]
cmp ecx, edx
ja 0x6e915c95
mov edx, eax
add dword [ebp - 0x3e4], 2
mov eax, dword [ebp - 0x3e4]
movzx eax, word [eax - 2]
cmp eax, 0xd
je 0x6e915bf1
jbe 0x6e915b50
cmp eax, 0x22
je 0x6e915c68
cmp eax, 0x5c
nop
jne 0x6e915c0d
mov word [ecx], 0x5c5c
add ecx, 2
jmp 0x6e915b70
mov eax, 0x6e935034
mov dword [esp + 0x10], eax
mov eax, str.CRYPT_RegReadSerializedFromReg
mov ecx, str.Adding_cert_with_hash__s_n
mov dword [esp + 8], eax
mov eax, 0x6e928c98
mov dword [esp + 0xc], ecx
mov dword [esp + 4], eax
mov dword [esp], 3
call fcn.6e915430
jmp 0x6e915a0e
mov word [ecx], 0x725c
add ecx, 2
jmp 0x6e915b70
mov word [ecx], 0x745c
add ecx, 2
jmp 0x6e915b70
lea ebx, [eax - 0x20]
cmp bx, 0x5e
jbe 0x6e915d52
mov byte [ecx], 0x5c
mov ebx, eax
add ecx, 5
shr ebx, 0xc
movzx ebx, byte [ebx + str.0123456789abcdefCRYPT_RegWriteToReg]
mov byte [ecx - 4], bl
mov ebx, eax
shr ebx, 8
and ebx, 0xf
movzx ebx, byte [ebx + str.0123456789abcdefCRYPT_RegWriteToReg]
mov byte [ecx - 3], bl
mov ebx, eax
and eax, 0xf
shr ebx, 4
movzx eax, byte [eax + str.0123456789abcdefCRYPT_RegWriteToReg]
and ebx, 0xf
movzx ebx, byte [ebx + str.0123456789abcdefCRYPT_RegWriteToReg]
mov byte [ecx - 1], al
mov byte [ecx - 2], bl
jmp 0x6e915b70
mov word [ecx], 0x225c
add ecx, 2
jmp 0x6e915b70
mov eax, dword [0x6e928d48]
mov dword [ebp - 0x3e8], eax
jmp 0x6e915a6e
mov eax, dword [0x6e928d44]
mov dword [ebp - 0x3e8], eax
jmp 0x6e915a6e
mov byte [ecx], 0x22
test eax, eax
mov ebx, dword [ebp - 0x3e8]
jle 0x6e915dac
mov word [ecx + 1], 0x2e2e
lea eax, [ecx + 4]
mov byte [ecx + 3], 0x2e
mov byte [eax], 0
lea eax, [ebp - 0x34c]
mov dword [esp], eax
call fcn.6e9257e0
jmp 0x6e915bc1
lea edx, [ebp - 0x39e]
mov eax, ecx
call fcn.6e9152d0
test byte [0x6e928c98], 8
jne 0x6e915db4
mov dword [esp + 4], esi
lea eax, [ebp - 0x39e]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_wcscmp]
test eax, eax
jne 0x6e915d5a
test byte [0x6e928c98], 8
jne 0x6e915f02
mov eax, dword [ebp - 0x3e4]
xor edx, edx
mov ecx, 3
mov dword [esp + 0xc], edx
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x3e0]
mov dword [esp], eax
mov eax, dword [ebp - 0x3e8]
call dword [eax + 4]
sub esp, 0x10
jmp 0x6e915ab7
mov dword [esp], 0x6e93502e
movzx eax, si
mov dword [esp + 4], eax
call fcn.6e9156e0
jmp 0x6e915bc1
mov byte [ecx], al
inc ecx
jmp 0x6e915b70
test byte [0x6e928c98], 8
je 0x6e915ab7
mov dword [esp], 3
mov eax, str.hash_doesnt_match__ignoring_n
mov dword [esp + 0xc], eax
mov eax, str.CRYPT_RegReadSerializedFromReg
mov dword [esp + 8], eax
mov eax, 0x6e928c98
mov dword [esp + 4], eax
call fcn.6e915430
jmp 0x6e915ab7
mov byte [ebp - 0x34a], 0x22
lea ecx, [ebp - 0x34a]
mov eax, 0x224c
mov word [ebp - 0x34c], ax
lea eax, [ecx + 1]
jmp 0x6e915cb3
mov edx, dword [ebp - 0x3dc]
test edx, edx
je 0x6e91614c
mov eax, 0xffffffff
mov dword [esp + 4], eax
lea eax, [ebp - 0x39e]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
sub esp, 8
test eax, eax
jne 0x6e916185
cmp word [ebp - 0x39e], 0
je 0x6e91618f
mov edx, eax
cmp word [ebp + edx*2 - 0x39c], 0
lea eax, [eax + 1]
jne 0x6e915df3
mov dword [ebp - 0x3f0], ebx
lea ecx, [ebp - 0x34a]
mov eax, 0x224c
mov word [ebp - 0x34c], ax
lea eax, [ebp - 0x39e]
mov dword [ebp - 0x3ec], eax
jmp 0x6e915e5a
cmp eax, 9
je 0x6e915ef5
cmp eax, 0xa
jne 0x6e915e9d
mov word [ecx], 0x6e5c
add ecx, 2
lea ebx, [ebp - 0x22a]
lea eax, [edx - 1]
cmp ecx, ebx
ja 0x6e915f2e
test edx, edx
jle 0x6e915f2e
mov edx, eax
add dword [ebp - 0x3ec], 2
mov eax, dword [ebp - 0x3ec]
movzx eax, word [eax - 2]
cmp eax, 0xd
je 0x6e915e86
jbe 0x6e915e29
cmp eax, 0x22
je 0x6e915ee8
cmp eax, 0x5c
jne 0x6e915e90
mov word [ecx], 0x5c5c
add ecx, 2
jmp 0x6e915e3f
mov word [ecx], 0x725c
add ecx, 2
jmp 0x6e915e3f
lea ebx, [eax - 0x20]
cmp bx, 0x5e
jbe 0x6e916174
mov byte [ecx], 0x5c
mov ebx, eax
add ecx, 5
shr ebx, 0xc
movzx ebx, byte [ebx + str.0123456789abcdefCRYPT_RegWriteToReg]
mov byte [ecx - 4], bl
mov ebx, eax
shr ebx, 8
and ebx, 0xf
movzx ebx, byte [ebx + str.0123456789abcdefCRYPT_RegWriteToReg]
mov byte [ecx - 3], bl
mov ebx, eax
and eax, 0xf
shr ebx, 4
movzx eax, byte [eax + str.0123456789abcdefCRYPT_RegWriteToReg]
and ebx, 0xf
movzx ebx, byte [ebx + str.0123456789abcdefCRYPT_RegWriteToReg]
mov byte [ecx - 1], al
mov byte [ecx - 2], bl
jmp 0x6e915e3f
mov word [ecx], 0x225c
add ecx, 2
jmp 0x6e915e3f
mov word [ecx], 0x745c
add ecx, 2
jmp 0x6e915e3f
mov dword [esp], 3
mov eax, str.hash_matches__adding_n
mov dword [esp + 0xc], eax
mov eax, str.CRYPT_RegReadSerializedFromReg
mov dword [esp + 8], eax
mov eax, 0x6e928c98
mov dword [esp + 4], eax
call fcn.6e915430
jmp 0x6e915d07
mov byte [ecx], 0x22
test eax, eax
mov ebx, dword [ebp - 0x3f0]
jle 0x6e9161a5
mov word [ecx + 1], 0x2e2e
lea eax, [ecx + 4]
mov byte [ecx + 3], 0x2e
mov byte [eax], 0
lea eax, [ebp - 0x34c]
mov dword [esp], eax
call fcn.6e9257e0
mov dword [esp + 0x10], eax
mov eax, str.comparing__s_n
mov dword [esp + 0xc], eax
mov eax, str.CRYPT_RegReadSerializedFromReg
mov dword [esp + 8], eax
mov eax, 0x6e928c98
mov dword [esp + 4], eax
mov dword [esp], 3
call fcn.6e915430
test byte [0x6e928c98], 8
je 0x6e915ce3
mov eax, dword [ebp - 0x3d8]
test eax, eax
je 0x6e916137
mov dword [esp], esi
mov ecx, 0xffffffff
mov dword [esp + 4], ecx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
sub esp, 8
test eax, eax
jne 0x6e9161ad
cmp word [ebp - 0x220], 0
je 0x6e9161b7
mov edx, eax
cmp word [esi + edx*2 + 2], 0
lea eax, [eax + 1]
jne 0x6e915fce
mov dword [ebp - 0x3ec], esi
lea ecx, [ebp - 0x34a]
mov eax, 0x224c
mov word [ebp - 0x34c], ax
mov dword [ebp - 0x3f0], ebx
jmp 0x6e91602c
cmp eax, 9
je 0x6e9160cb
cmp eax, 0xa
jne 0x6e916073
mov word [ecx], 0x6e5c
add ecx, 2
lea eax, [edx - 1]
test edx, edx
jle 0x6e9160d8
lea edx, [ebp - 0x22a]
cmp ecx, edx
ja 0x6e9160d8
mov edx, eax
add dword [ebp - 0x3ec], 2
mov eax, dword [ebp - 0x3ec]
movzx eax, word [eax - 2]
cmp eax, 0xd
je 0x6e91605c
jbe 0x6e915ffb
cmp eax, 0x22
je 0x6e9160be
cmp eax, 0x5c
lea esi, [esi]
jne 0x6e916066
mov word [ecx], 0x5c5c
add ecx, 2
jmp 0x6e916011
mov word [ecx], 0x725c
add ecx, 2
jmp 0x6e916011
lea ebx, [eax - 0x20]
cmp bx, 0x5e
jbe 0x6e91617c
mov byte [ecx], 0x5c
mov ebx, eax
add ecx, 5
shr ebx, 0xc
movzx ebx, byte [ebx + str.0123456789abcdefCRYPT_RegWriteToReg]
mov byte [ecx - 4], bl
mov ebx, eax
shr ebx, 8
and ebx, 0xf
movzx ebx, byte [ebx + str.0123456789abcdefCRYPT_RegWriteToReg]
mov byte [ecx - 3], bl
mov ebx, eax
and eax, 0xf
shr ebx, 4
movzx eax, byte [eax + str.0123456789abcdefCRYPT_RegWriteToReg]
and ebx, 0xf
movzx ebx, byte [ebx + str.0123456789abcdefCRYPT_RegWriteToReg]
mov byte [ecx - 1], al
mov byte [ecx - 2], bl
jmp 0x6e916011
mov word [ecx], 0x225c
add ecx, 2
jmp 0x6e916011
mov word [ecx], 0x745c
add ecx, 2
jmp 0x6e916011
mov byte [ecx], 0x22
test eax, eax
mov ebx, dword [ebp - 0x3f0]
jle 0x6e9161cd
mov word [ecx + 1], 0x2e2e
lea eax, [ecx + 4]
mov byte [ecx + 3], 0x2e
mov byte [eax], 0
lea eax, [ebp - 0x34c]
mov dword [esp], eax
call fcn.6e9257e0
mov dword [esp + 0x10], eax
mov eax, str.with__s_n
mov edx, 0x6e928c98
mov dword [esp + 0xc], eax
mov eax, str.CRYPT_RegReadSerializedFromReg
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], 3
call fcn.6e915430
jmp 0x6e915ce3
mov dword [esp], 0x6e93502e
movzx eax, si
mov dword [esp + 4], eax
call fcn.6e9156e0
jmp 0x6e916107
mov dword [esp], 0x6e93502e
lea eax, [ebp - 0x39e]
mov dword [ebp - 0x3ec], eax
movzx eax, word [ebp - 0x3ec]
mov dword [esp + 4], eax
call fcn.6e9156e0
jmp 0x6e915f5d
mov byte [ecx], al
inc ecx
jmp 0x6e915e3f
mov byte [ecx], al
inc ecx
nop
jmp 0x6e916011
mov eax, 0x6e935034
jmp 0x6e915f5d
mov word [ebp - 0x34c], 0x224c
lea ecx, [ebp - 0x34a]
mov byte [ebp - 0x34a], 0x22
lea eax, [ecx + 1]
jmp 0x6e915f4c
mov eax, 0x6e935034
jmp 0x6e916107
mov word [ebp - 0x34c], 0x224c
lea ecx, [ebp - 0x34a]
mov byte [ebp - 0x34a], 0x22
lea eax, [ecx + 1]
jmp 0x6e9160f6