Function at 0x100142c1
Capabilities:
Enumerate files on windows
Query or enumerate registry key
Set current directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb74
mov eax, dword [0x1002f060]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xb58], eax
mov eax, dword [ebp + 0xc]
push ebx
mov dword [ebp - 0xb50], eax
mov eax, dword [ebp + 0x10]
push esi
mov esi, ecx
mov dword [ebp - 0xb48], eax
mov eax, dword [ebp + 0x14]
push edi
mov dword [ebp - 0xb5c], eax
test esi, esi
je 0x100144b3
xor eax, eax
cmp ax, word [esi]
je 0x100144b3
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x4e20
jge 0x100144b3
mov dword [ebp - 0xb44], esi
mov eax, dword [ebp - 0xb44]
movzx eax, word [eax]
xor ecx, ecx
xor ebx, ebx
cmp cx, ax
je 0x10014481
push 0xd
pop ecx
cmp cx, ax
je 0x10014360
push 0xa
pop ecx
cmp cx, ax
je 0x10014360
mov eax, dword [ebp - 0xb44]
inc ebx
movzx eax, word [eax + ebx*2]
xor ecx, ecx
cmp cx, ax
jne 0x1001433e
test ebx, ebx
jle 0x10014481
lea edi, [ebx + ebx + 2]
mov eax, edi
call fcn.1001d9d0
mov esi, esp
push edi
push ebx
push dword [ebp - 0xb44]
call fcn.1001428a
test eax, eax
je 0x1001438a
mov byte [eax + ebx], 0
call fcn.100163a0
mov esi, eax
push esi
call fcn.10003aab
lea eax, [ebp - 0x458]
mov dword [esp], 0x3e8
push eax
push esi
call fcn.100039de
add esp, 0xc
test eax, eax
jne 0x10014514
push 6
push str.HKCU__
push esi
call fcn.10019d58
add esp, 0xc
test eax, eax
jne 0x10014481
and dword [ebp - 0xb4c], eax
add esi, 6
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0xb54], eax
push str.HKUR__
lea eax, [ebp - 0x650]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edi, 0x1ea
sub edi, dword [ebp - 0xb54]
lea eax, [ebp - 0x64a]
push edi
push eax
push 0
jmp 0x10014472
inc dword [ebp - 0xb4c]
push 0x10026c48
lea eax, [ebp - 0x650]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push esi
lea eax, [ebp - 0x650]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x650]
push eax
call fcn.10003aab
lea eax, [ebp - 0x458]
mov dword [esp], 0x3e8
push eax
lea eax, [ebp - 0x650]
push eax
call fcn.100039de
add esp, 0xc
test eax, eax
jne 0x10014514
push edi
lea eax, [ebp - 0x64a]
push eax
push dword [ebp - 0xb4c]
push VariantInit
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x1001440d
mov eax, dword [ebp - 0xb44]
lea ebx, [eax + ebx*2]
movzx eax, word [ebx]
push 0xd
pop ecx
cmp cx, ax
je 0x1001449d
push 0xa
pop ecx
cmp cx, ax
jne 0x100144a2
add ebx, 2
jmp 0x1001448a
xor eax, eax
mov dword [ebp - 0xb44], ebx
cmp ax, word [ebx]
jne 0x10014328
mov esi, dword [ebp - 0xb50]
test esi, esi
je 0x10014bde
mov ebx, dword [ebp - 0xb48]
test ebx, ebx
je 0x10014bde
xor eax, eax
cmp ax, word [esi]
je 0x10014bde
cmp ax, word [ebx]
je 0x10014bde
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
call edi
cmp eax, 0x12c
jge 0x10014bde
push ebx
call edi
cmp eax, 0x2710
jge 0x10014bde
push esi
call edi
inc eax
cmp eax, 0x3fffffff
jle 0x1001451b
xor eax, eax
jmp 0x10014535
xor eax, eax
jmp 0x10014da1
lea edi, [eax + eax]
mov eax, edi
call fcn.1001d9d0
mov esi, esp
push 3
push edi
push dword [ebp - 0xb50]
call fcn.100096ca
push 0x3e8
lea ecx, [ebp - 0x458]
push ecx
push eax
call fcn.100039de
add esp, 0xc
test eax, eax
je 0x10014514
cmp byte [ebp - 0x458], 0
je 0x10014514
mov edi, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push 0x3e7
lea eax, [ebp - 0x458]
push eax
push eax
call edi
dec eax
cmp eax, 0x3e5
ja 0x10014514
mov esi, 0x12b
push esi
lea eax, [ebp - 0x780]
push eax
push dword [ebp - 0xb58]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x10014514
cmp byte [ebp - 0x780], 0
je 0x10014514
push esi
lea eax, [ebp - 0x780]
push eax
push eax
call edi
dec eax
cmp eax, 0x129
ja 0x10014514
lea eax, [ebp - 0x458]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x780]
push eax
lea eax, [ebp - 0x458]
push eax
call fcn.10019d58
add esp, 0xc
test eax, eax
jne 0x10014514
lea eax, [ebp - 0x458]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov dword [ebp - 0xb44], ebx
mov eax, dword [ebp - 0xb44]
movzx eax, word [eax]
and dword [ebp - 0xb48], 0
xor ecx, ecx
cmp cx, ax
je 0x10014ba6
push 0xd
pop ecx
cmp cx, ax
je 0x1001463c
push 0xa
pop ecx
cmp cx, ax
je 0x1001463c
inc dword [ebp - 0xb48]
mov ecx, dword [ebp - 0xb48]
mov eax, dword [ebp - 0xb44]
movzx eax, word [eax + ecx*2]
xor ecx, ecx
cmp cx, ax
jne 0x1001460f
cmp dword [ebp - 0xb48], 0
jle 0x10014ba6
mov edi, dword [ebp - 0xb48]
lea esi, [edi + edi + 2]
mov eax, esi
call fcn.1001d9d0
mov eax, esp
push esi
push edi
push dword [ebp - 0xb44]
mov esi, eax
call fcn.1001428a
test eax, eax
je 0x10014673
mov byte [eax + edi], 0
call fcn.100163a0
mov esi, eax
push 0x3e8
lea eax, [ebp - 0x458]
push eax
push esi
mov dword [ebp - 0xb70], esi
mov byte [ebp - 0x458], 0
call fcn.100039de
and dword [ebp - 0xb4c], 0
push 6
push str.HKCU__
push esi
call fcn.10019d58
add esp, 0x18
test eax, eax
jne 0x100146e2
add esi, 6
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0xb54], eax
push str.HKUR__
lea eax, [ebp - 0x650]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0xb50], 1
jmp 0x100146e9
and dword [ebp - 0xb50], 0
cmp byte [ebp - 0x458], 0
mov byte [ebp - 0x70], 0
je 0x10014b09
push 0x3e7
lea eax, [ebp - 0x458]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov edi, eax
test edi, edi
jne 0x10014817
lea eax, [ebp - 0x458]
push 0x2a
push eax
call fcn.10019900
mov esi, eax
lea eax, [ebp - 0x458]
push 0x3f
push eax
call fcn.10019900
add esp, 0x10
test esi, esi
je 0x10014744
test eax, eax
je 0x10014746
cmp eax, esi
jae 0x10014746
mov esi, eax
test esi, esi
je 0x10014b09
lea eax, [ebp - 0x458]
cmp esi, eax
jbe 0x10014b09
jmp 0x10014763
cmp byte [esi], 0x5c
je 0x1001476e
lea eax, [ebp - 0x458]
dec esi
cmp esi, eax
ja 0x1001475e
test esi, esi
je 0x10014b09
cmp byte [esi], 0x5c
jne 0x10014b09
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0x64
jae 0x10014b09
push esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov byte [esi], 0
mov esi, 0x3e7
push esi
lea eax, [ebp - 0x458]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
lea eax, [ebp - 0x70]
push eax
call ebx
add eax, edi
cmp eax, esi
jae 0x10014813
test edi, edi
je 0x10014813
lea eax, [ebp - 0x6f]
push 0x5c
push eax
call fcn.10019900
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x100147e9
cmp byte [esi + 1], 0
jne 0x100147e6
xor esi, esi
jmp 0x100147e9
mov byte [esi], 0
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x458]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
test esi, esi
je 0x10014813
inc esi
push esi
call ebx
inc eax
push eax
lea eax, [ebp - 0x6f]
push esi
push eax
call fcn.10019f30
add esp, 0xc
jmp 0x10014817
mov byte [ebp - 0x70], 0
dec edi
cmp edi, 0x3e5
ja 0x10014b09
lea eax, [ebp - 0x458]
push 0x5c
push eax
call fcn.1001a9f0
pop ecx
pop ecx
test eax, eax
je 0x10014b09
cmp byte [eax + 1], 0
jne 0x10014855
mov byte [eax], 0
lea eax, [ebp - 0x458]
push 0x5c
push eax
call fcn.1001a9f0
pop ecx
pop ecx
test eax, eax
je 0x10014b09
lea ebx, [eax + 1]
cmp byte [ebx], 0
mov dword [ebp - 0xb74], ebx
je 0x10014b09
lea eax, [ebp - 0xa00]
push eax
lea eax, [ebp - 0x458]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0xb58], eax
cmp eax, 0xffffffff
je 0x10014b09
lea eax, [ebp - 0x9d4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp - 0xa00]
and eax, 0x10
cmp al, 0x10
jne 0x10014ab8
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp - 0x70]
push eax
call esi
mov edi, eax
lea eax, [ebp - 0x458]
push eax
call esi
add edi, eax
cmp edi, 0x3e8
jae 0x10014ab8
cmp byte [ebp - 0x70], 0
mov eax, 0x1002a240
je 0x100148e4
lea eax, [ebp - 0x70]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x5c
push ebx
call fcn.1001a9f0
mov edi, eax
cmp byte [edi + 1], 0
pop ecx
pop ecx
jne 0x10014913
lea eax, [ebp - 0x458]
push 0x5c
push eax
mov byte [edi], 0
call fcn.1001a9f0
pop ecx
pop ecx
mov edi, eax
lea eax, [ebp - 0x8c0]
push eax
lea eax, [ebp - 0x458]
push eax
inc edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0xb60], eax
cmp eax, 0xffffffff
je 0x10014aa6
lea eax, [ebp - 0x894]
push eax
push 0x1002a248
push edi
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [ebp - 0x8c0]
xor ecx, ecx
and eax, 0x10
add esp, 0xc
cmp al, 0x10
setne cl
mov esi, ecx
test esi, esi
jne 0x10014992
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpA]
push 0x1002a24c
lea eax, [ebp - 0x894]
push eax
call ebx
test eax, eax
je 0x10014992
push 0x1002a250
lea eax, [ebp - 0x894]
push eax
call ebx
test eax, eax
je 0x10014992
xor ebx, ebx
inc ebx
jmp 0x10014994
xor ebx, ebx
lea eax, [ebp - 0x8c0]
push eax
push dword [ebp - 0xb60]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov dword [ebp - 0xb6c], eax
test esi, esi
je 0x100149c7
push 0x20
lea eax, [ebp - 0x458]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 1
jmp 0x10014a7b
test ebx, ebx
je 0x10014a87
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [edi + eax]
push 0x1002a240
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0xb40]
push eax
lea eax, [ebp - 0x458]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10014a76
lea eax, [ebp - 0xb14]
push eax
push 0x1002a254
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [ebp - 0xb40]
add esp, 0xc
and eax, 0x10
xor ecx, ecx
cmp al, 0x10
setne cl
lea eax, [ebp - 0xb40]
push eax
push ebx
mov dword [ebp - 0xb68], ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
cmp dword [ebp - 0xb68], 0
mov dword [ebp - 0xb64], eax
je 0x10014a66
push 0x20
lea eax, [ebp - 0x458]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 1
lea ecx, [ebp - 0x458]
call fcn.10004869
pop ecx
cmp dword [ebp - 0xb64], 0
jne 0x10014a00
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov byte [esi], 0
push 0
lea ecx, [ebp - 0x458]
call fcn.10004869
pop ecx
cmp dword [ebp - 0xb6c], 0
jne 0x10014937
push dword [ebp - 0xb60]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ebx, dword [ebp - 0xb74]
lea eax, [ebp - 0x9d4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor esi, esi
jmp 0x10014abb
xor esi, esi
inc esi
lea eax, [ebp - 0xa00]
push eax
push dword [ebp - 0xb58]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov edi, eax
test esi, esi
je 0x10014ae7
push 0x20
lea eax, [ebp - 0x458]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 1
jmp 0x10014ae9
push 0
lea ecx, [ebp - 0x458]
call fcn.10004869
pop ecx
test edi, edi
jne 0x10014892
push dword [ebp - 0xb58]
call dword [sym.imp.KERNEL32.dll_FindClose]
xor ebx, ebx
mov byte [ebp - 0x458], 0
cmp dword [ebp - 0xb50], ebx
je 0x10014ba6
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov esi, 0x1ea
sub esi, dword [ebp - 0xb54]
push esi
lea eax, [ebp - 0x64a]
push eax
push dword [ebp - 0xb4c]
push VariantInit
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
inc dword [ebp - 0xb4c]
test eax, eax
jne 0x10014b94
push 0x10026c48
lea eax, [ebp - 0x650]
push eax
call edi
mov eax, dword [ebp - 0xb70]
add eax, 6
push eax
lea eax, [ebp - 0x650]
push eax
call edi
push 0x3e8
lea eax, [ebp - 0x458]
push eax
lea eax, [ebp - 0x650]
push eax
call fcn.100039de
add esp, 0xc
test eax, eax
je 0x10014b2f
jmp 0x10014b9a
mov dword [ebp - 0xb50], ebx
cmp dword [ebp - 0xb50], ebx
jne 0x100146e9
mov eax, dword [ebp - 0xb44]
mov ecx, dword [ebp - 0xb48]
lea ecx, [eax + ecx*2]
movzx eax, word [ecx]
push 0xd
pop edx
cmp dx, ax
je 0x10014bc8
push 0xa
pop edx
cmp dx, ax
jne 0x10014bcd
add ecx, 2
jmp 0x10014bb5
xor eax, eax
mov dword [ebp - 0xb44], ecx
cmp ax, word [ecx]
jne 0x100145f4
mov eax, dword [ebp - 0xb5c]
test eax, eax
je 0x10014d9e
xor ecx, ecx
cmp cx, word [eax]
je 0x10014d9e
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x2710
jge 0x10014d9e
mov eax, dword [ebp - 0xb5c]
xor edi, edi
mov dword [ebp - 0xb44], eax
inc edi
mov eax, dword [ebp - 0xb44]
movzx eax, word [eax]
and dword [ebp - 0xb48], 0
xor ecx, ecx
cmp cx, ax
je 0x10014d62
push 0xd
pop ecx
cmp cx, ax
je 0x10014c60
push 0xa
pop ecx
cmp cx, ax
je 0x10014c60
inc dword [ebp - 0xb48]
mov ecx, dword [ebp - 0xb48]
mov eax, dword [ebp - 0xb44]
movzx eax, word [eax + ecx*2]
xor ecx, ecx
cmp cx, ax
jne 0x10014c33
cmp dword [ebp - 0xb48], 0
jle 0x10014d62
mov ebx, dword [ebp - 0xb48]
lea edi, [ebx + ebx + 2]
mov eax, edi
call fcn.1001d9d0
mov esi, esp
push edi
push ebx
push dword [ebp - 0xb44]
call fcn.1001428a
test eax, eax
je 0x10014c95
mov byte [eax + ebx], 0
call fcn.100163a0
mov esi, eax
push esi
call fcn.10003aab
lea eax, [ebp - 0x458]
mov dword [esp], 0x3e8
push eax
push esi
call fcn.100039de
neg eax
push 6
sbb edi, edi
push str.HKCU__
push esi
inc edi
call fcn.10019d58
add esp, 0x18
test eax, eax
jne 0x10014d62
and dword [ebp - 0xb4c], eax
add esi, 6
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0xb54], eax
push str.HKUR__
lea eax, [ebp - 0x650]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ebx, 0x1ea
sub ebx, dword [ebp - 0xb54]
lea eax, [ebp - 0x64a]
push ebx
push eax
push 0
jmp 0x10014d53
inc dword [ebp - 0xb4c]
push 0x10026c48
lea eax, [ebp - 0x650]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push esi
lea eax, [ebp - 0x650]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x650]
push eax
call fcn.10003aab
pop ecx
push ebx
lea eax, [ebp - 0x64a]
push eax
push dword [ebp - 0xb4c]
push VariantInit
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x10014d12
mov eax, dword [ebp - 0xb44]
mov ecx, dword [ebp - 0xb48]
lea ecx, [eax + ecx*2]
movzx eax, word [ecx]
push 0xd
pop edx
cmp dx, ax
je 0x10014d84
push 0xa
pop edx
cmp dx, ax
jne 0x10014d89
add ecx, 2
jmp 0x10014d71
xor eax, eax
mov dword [ebp - 0xb44], ecx
cmp ax, word [ecx]
jne 0x10014c18
mov eax, edi
jmp 0x10014da1
xor eax, eax
inc eax
lea esp, [ebp - 0xb80]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10017a76
leave
ret