Function at 0x100123ae
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push 0x190
mov eax, 0x1002b969
call fcn.1002a4e9
mov esi, ecx
mov dword [ebp - 0x188], esi
xor ebx, ebx
mov dword [ebp - 0x19c], ebx
mov dword [ebp - 0x198], ebx
mov dword [ebp - 0x194], ebx
push 0x2001f
push dword [0x10032b08]
lea ecx, [ebp - 0x19c]
push SysReAllocString
mov dword [ebp - 4], ebx
call fcn.10025be0
test eax, eax
je 0x10012405
mov ebx, 0x80004005
jmp 0x10012826
push 0x100062ce
lea ecx, [ebp - 0x178]
call fcn.10025be0
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x190]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push 0x10006600
push dword [ebp - 0x19c]
mov byte [ebp - 4], 1
mov dword [ebp - 0x190], 0x106
call edi
test eax, eax
jne 0x100124b9
lea eax, [ebp - 0x130]
push eax
lea ecx, [ebp - 0x178]
call fcn.10025be0
push 0x5c
lea ecx, [ebp - 0x178]
call fcn.10025be0
mov ecx, dword [ebp - 0x178]
mov edx, dword [ecx - 8]
lea ecx, [eax + 1]
cmp ecx, edx
jne 0x100124ab
push eax
lea eax, [ebp - 0x17c]
push eax
lea ecx, [ebp - 0x178]
call fcn.10020e14
push eax
lea ecx, [ebp - 0x178]
mov byte [ebp - 4], 2
call fcn.10025be0
lea ecx, [ebp - 0x17c]
mov byte [ebp - 4], 1
call fcn.1002161e
lea eax, [ebp - 0x178]
push eax
mov ecx, esi
call fcn.1000f610
lea eax, [ebp - 0x190]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push ebx
push 0x10006610
push dword [ebp - 0x19c]
mov dword [ebp - 0x190], 0x106
call edi
test eax, eax
jne 0x10012591
lea eax, [ebp - 0x130]
push eax
lea ecx, [ebp - 0x178]
call fcn.10025be0
push 0x1000661c
lea ecx, [ebp - 0x180]
call fcn.10025be0
push 0x5c
lea ecx, [ebp - 0x178]
mov byte [ebp - 4], 3
call fcn.10025be0
push eax
lea eax, [ebp - 0x184]
push eax
lea ecx, [ebp - 0x178]
call fcn.10020e14
lea ecx, [ebp - 0x180]
push ecx
push eax
lea eax, [ebp - 0x17c]
push eax
mov byte [ebp - 4], 4
call fcn.10020cce
push eax
lea ecx, [ebp - 0x178]
mov byte [ebp - 4], 5
call fcn.10025be0
lea ecx, [ebp - 0x17c]
mov byte [ebp - 4], 4
call fcn.1002161e
lea ecx, [ebp - 0x184]
mov byte [ebp - 4], 3
call fcn.1002161e
lea ecx, [ebp - 0x180]
mov byte [ebp - 4], 1
call fcn.1002161e
lea eax, [ebp - 0x178]
push eax
mov ecx, esi
call fcn.1000f610
lea ecx, [ebp - 0x19c]
call fcn.1000cef2
mov eax, dword [0x1000666c]
push 0x10
pop ecx
mov esi, 0x10006628
lea edi, [ebp - 0x174]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [ebp - 0x18], eax
mov eax, dword [0x10006670]
mov esi, 0x10006674
lea edi, [ebp - 0x28]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x14], eax
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x18c]
push eax
push 0x20019
push ebx
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x174]
push eax
push SysReAllocString
movsw word es:[edi], word [esi]
mov dword [ebp - 0x18c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001273b
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x184]
push eax
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x180]
push eax
push ebx
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x18c]
mov dword [ebp - 0x184], 0x105
call edi
mov byte [ebp - 0x2b], bl
test eax, eax
jne 0x10012696
cmp dword [ebp - 0x180], 1
jne 0x10012696
lea eax, [ebp - 0x130]
push eax
lea ecx, [ebp - 0x178]
call fcn.10025be0
push 0x10006684
lea ecx, [ebp - 0x17c]
call fcn.10025be0
lea eax, [ebp - 0x17c]
push eax
lea ecx, [ebp - 0x178]
mov byte [ebp - 4], 6
call fcn.10025be0
lea ecx, [ebp - 0x17c]
mov byte [ebp - 4], 1
call fcn.1002161e
mov esi, dword [ebp - 0x188]
lea eax, [ebp - 0x178]
push eax
mov ecx, esi
call fcn.1000f610
jmp 0x1001269c
mov esi, dword [ebp - 0x188]
lea eax, [ebp - 0x184]
push eax
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x180]
push eax
push ebx
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x18c]
mov dword [ebp - 0x184], 0x105
call edi
mov byte [ebp - 0x2b], bl
test eax, eax
jne 0x1001272d
cmp dword [ebp - 0x180], 1
jne 0x1001272d
lea eax, [ebp - 0x130]
push eax
lea ecx, [ebp - 0x178]
call fcn.10025be0
push 0x10006684
lea ecx, [ebp - 0x17c]
call fcn.10025be0
lea eax, [ebp - 0x17c]
push eax
lea ecx, [ebp - 0x178]
mov byte [ebp - 4], 7
call fcn.10025be0
lea ecx, [ebp - 0x17c]
mov byte [ebp - 4], 1
call fcn.1002161e
lea eax, [ebp - 0x178]
push eax
mov ecx, esi
call fcn.1000f610
push dword [ebp - 0x18c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10012741
mov esi, dword [ebp - 0x188]
call sub.mfc100.dll_Ordinal_1929
mov eax, dword [eax + 8]
push 0x106
lea ecx, [ebp - 0x130]
push ecx
push eax
call dword [sym.imp.kernel32.dll_GetModuleFileNameA]
test eax, eax
je 0x1001280d
lea eax, [ebp - 0x130]
push eax
lea ecx, [ebp - 0x178]
call fcn.10025be0
push 0x1000661c
lea ecx, [ebp - 0x17c]
call fcn.10025be0
push 0x5c
lea ecx, [ebp - 0x178]
mov byte [ebp - 4], 8
call fcn.10025be0
push eax
lea eax, [ebp - 0x184]
push eax
lea ecx, [ebp - 0x178]
call fcn.10020e14
lea ecx, [ebp - 0x17c]
push ecx
push eax
lea eax, [ebp - 0x180]
push eax
mov byte [ebp - 4], 9
call fcn.10020cce
push eax
lea ecx, [ebp - 0x178]
mov byte [ebp - 4], 0xa
call fcn.10025be0
lea ecx, [ebp - 0x180]
mov byte [ebp - 4], 9
call fcn.1002161e
lea ecx, [ebp - 0x184]
mov byte [ebp - 4], 8
call fcn.1002161e
lea ecx, [ebp - 0x17c]
mov byte [ebp - 4], 1
call fcn.1002161e
lea eax, [ebp - 0x178]
push eax
mov ecx, esi
call fcn.1000f610
push 0xffffffffffffffff
push ebx
lea ecx, [esi + 0x1c]
call fcn.10025be0
lea ecx, [ebp - 0x178]
mov byte [ebp - 4], bl
call fcn.1002161e
lea ecx, [ebp - 0x19c]
call fcn.1000cef2
mov eax, ebx
call fcn.1002a56c
ret