Function at 0x1000bd7e
Capabilities:
Enumerate files on windows
Query or enumerate registry key
Set current directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb48
mov eax, dword [ebp + 0x24]
push ebx
xor ebx, ebx
push esi
cmp eax, ebx
push edi
je 0x1000bd95
mov dword [eax], ebx
mov esi, dword [ebp + 0xc]
cmp esi, ebx
je 0x1000bf52
cmp word [esi], bx
je 0x1000bf52
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x4e20
jge 0x1000bf52
mov dword [ebp - 4], esi
mov eax, dword [ebp - 4]
mov dword [ebp + 0xc], ebx
mov cx, word [eax]
cmp cx, bx
je 0x1000bf27
cmp cx, 0xd
je 0x1000bde9
cmp word [eax], 0xa
je 0x1000bde9
inc dword [ebp + 0xc]
inc eax
inc eax
mov cx, word [eax]
cmp cx, bx
jne 0x1000bdd0
cmp dword [ebp + 0xc], ebx
jle 0x1000bf27
cmp dword [ebp - 4], ebx
jne 0x1000bdfb
xor eax, eax
jmp 0x1000be38
mov eax, dword [ebp + 0xc]
lea edi, [eax + eax + 2]
mov eax, edi
add eax, 3
and al, 0xfc
call fcn.10012fc0
mov esi, esp
cmp esi, ebx
je 0x1000be30
push ebx
push ebx
push edi
push esi
push dword [ebp + 0xc]
mov byte [esi], bl
push dword [ebp - 4]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
neg eax
sbb eax, eax
and eax, esi
jmp 0x1000be32
xor eax, eax
mov ecx, dword [ebp + 0xc]
mov byte [eax + ecx], bl
push eax
call fcn.1000f307
mov esi, eax
push 1
push ebx
push esi
call fcn.1000e028
lea eax, [ebp - 0x65c]
push 0x3e8
push eax
push esi
call fcn.1000dde2
add esp, 0x1c
test eax, eax
jne 0x1000c03e
push 6
push str.HKCU__
push esi
call fcn.1000ad66
add esp, 0xc
test eax, eax
jne 0x1000bf27
add esi, 6
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x274]
push str.HKUR__
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edi, 0x1ea
lea eax, [ebp - 0x26e]
sub edi, dword [ebp - 0xc]
mov dword [ebp - 8], 1
push edi
push eax
push ebx
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x1000bf27
lea eax, [ebp - 0x274]
push 0x10018218
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x274]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 1
lea eax, [ebp - 0x274]
push ebx
push eax
call fcn.1000e028
lea eax, [ebp - 0x65c]
push 0x3e8
push eax
lea eax, [ebp - 0x274]
push eax
call fcn.1000dde2
add esp, 0x18
test eax, eax
jne 0x1000c03e
mov eax, dword [ebp - 8]
inc dword [ebp - 8]
lea ecx, [ebp - 0x26e]
push edi
push ecx
push eax
jmp 0x1000beb5
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
lea eax, [eax + ecx*2]
mov dword [ebp - 4], eax
mov cx, word [eax]
cmp cx, 0xd
je 0x1000bf42
cmp cx, 0xa
jne 0x1000bf46
inc eax
inc eax
jmp 0x1000bf33
cmp word [eax], bx
mov dword [ebp - 4], eax
jne 0x1000bdbe
cmp dword [ebp + 0x10], ebx
je 0x1000c6b3
cmp dword [ebp + 0x14], ebx
je 0x1000c6b3
mov eax, dword [ebp + 0x10]
cmp word [eax], bx
je 0x1000c6b3
mov eax, dword [ebp + 0x14]
cmp word [eax], bx
je 0x1000c6b3
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x12c
jge 0x1000c6b3
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x2710
jge 0x1000c6b3
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [eax + eax + 2]
mov eax, edi
add eax, 3
and al, 0xfc
call fcn.10012fc0
mov esi, esp
push ebx
push ebx
push edi
push esi
push 0xffffffffffffffff
push dword [ebp + 0x10]
mov byte [esi], bl
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [ebp - 0x65c]
push 0x3e8
push eax
push esi
call fcn.1000dde2
add esp, 0xc
test eax, eax
je 0x1000c03e
cmp byte [ebp - 0x65c], bl
je 0x1000c03e
mov edi, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov esi, 0x3e7
lea eax, [ebp - 0x65c]
push esi
push eax
lea eax, [ebp - 0x65c]
push eax
call edi
cmp eax, esi
jae 0x1000c03e
cmp eax, ebx
jbe 0x1000c03e
cmp dword [ebp + 0x20], ebx
mov esi, 0x12b
jne 0x1000c045
lea eax, [ebp - 0x788]
push esi
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x1000c03e
cmp byte [ebp - 0x788], bl
jne 0x1000c065
xor eax, eax
jmp 0x1000c855
push dword [ebp + 0x20]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0x12c
jae 0x1000c03e
push dword [ebp + 0x20]
lea eax, [ebp - 0x788]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x788]
push esi
push eax
lea eax, [ebp - 0x788]
push eax
call edi
cmp eax, esi
jae 0x1000c03e
cmp eax, ebx
jbe 0x1000c03e
lea eax, [ebp - 0x65c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x788]
push eax
lea eax, [ebp - 0x65c]
push eax
call fcn.1000ad66
add esp, 0xc
test eax, eax
jne 0x1000c03e
lea eax, [ebp - 0x65c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov eax, dword [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp + 0xc], ebx
mov cx, word [eax]
cmp cx, bx
je 0x1000c688
cmp cx, 0xd
je 0x1000c0e4
cmp word [eax], 0xa
je 0x1000c0e4
inc dword [ebp + 0xc]
inc eax
inc eax
mov cx, word [eax]
cmp cx, bx
jne 0x1000c0cb
cmp dword [ebp + 0xc], ebx
jle 0x1000c688
cmp dword [ebp - 4], ebx
jne 0x1000c0f6
xor eax, eax
jmp 0x1000c133
mov eax, dword [ebp + 0xc]
lea edi, [eax + eax + 2]
mov eax, edi
add eax, 3
and al, 0xfc
call fcn.10012fc0
mov esi, esp
cmp esi, ebx
je 0x1000c12b
push ebx
push ebx
push edi
push esi
push dword [ebp + 0xc]
mov byte [esi], bl
push dword [ebp - 4]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
neg eax
sbb eax, eax
and eax, esi
jmp 0x1000c12d
xor eax, eax
mov ecx, dword [ebp + 0xc]
mov byte [eax + ecx], bl
push eax
call fcn.1000f307
lea ecx, [ebp - 0x65c]
mov dword [esp], 0x3e8
push ecx
push eax
mov dword [ebp - 0x14], eax
call fcn.1000dde2
add esp, 0xc
test eax, eax
je 0x1000c688
cmp byte [ebp - 0x65c], bl
je 0x1000c688
mov esi, dword [ebp - 0x14]
push 6
push str.HKCU__
push esi
mov dword [ebp - 8], ebx
call fcn.1000ad66
add esp, 0xc
test eax, eax
jne 0x1000c1a9
add esi, 6
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x274]
push str.HKUR__
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp + 0x14], 1
jmp 0x1000c1ac
mov dword [ebp + 0x14], ebx
lea eax, [ebp - 0x65c]
push 0x3e7
push eax
lea eax, [ebp - 0x65c]
push eax
mov byte [ebp - 0x80], bl
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov edi, eax
cmp edi, ebx
jne 0x1000c2d6
lea eax, [ebp - 0x65c]
push 0x2a
push eax
call fcn.1000a92a
mov esi, eax
lea eax, [ebp - 0x65c]
push 0x3f
push eax
call fcn.1000a92a
add esp, 0x10
cmp esi, ebx
je 0x1000c1ff
cmp eax, ebx
je 0x1000c201
cmp eax, esi
jae 0x1000c201
mov esi, eax
cmp esi, ebx
je 0x1000c5e7
lea eax, [ebp - 0x65c]
cmp esi, eax
jbe 0x1000c5e7
dec esi
lea eax, [ebp - 0x65c]
cmp esi, eax
jbe 0x1000c227
cmp byte [esi], 0x5c
jne 0x1000c217
cmp esi, ebx
je 0x1000c5e7
cmp byte [esi], 0x5c
jne 0x1000c5e7
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0x64
jae 0x1000c5e7
lea eax, [ebp - 0x80]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x65c]
push 0x3e7
push eax
lea eax, [ebp - 0x65c]
push eax
mov byte [esi], bl
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov edi, eax
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, edi
cmp eax, 0x3e7
jae 0x1000c2d3
cmp edi, ebx
jbe 0x1000c2d3
lea eax, [ebp - 0x7f]
push 0x5c
push eax
call fcn.1000a92a
mov esi, eax
pop ecx
cmp esi, ebx
pop ecx
je 0x1000c2a5
cmp byte [esi + 1], bl
jne 0x1000c2a3
xor esi, esi
jmp 0x1000c2a5
mov byte [esi], bl
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x65c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp esi, ebx
je 0x1000c2d3
inc esi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x7f]
push esi
push eax
call fcn.1000a965
add esp, 0xc
jmp 0x1000c2d6
mov byte [ebp - 0x80], bl
cmp edi, 0x3e7
jae 0x1000c5e7
cmp edi, ebx
jbe 0x1000c5e7
lea eax, [ebp - 0x65c]
push 0x5c
push eax
call fcn.1000ac56
pop ecx
cmp eax, ebx
pop ecx
je 0x1000c5e7
cmp byte [eax + 1], bl
jne 0x1000c319
mov byte [eax], bl
lea eax, [ebp - 0x65c]
push 0x5c
push eax
call fcn.1000ac56
pop ecx
pop ecx
cmp eax, ebx
je 0x1000c5e7
cmp byte [eax + 1], bl
lea edi, [eax + 1]
mov dword [ebp + 0x10], edi
je 0x1000c5e7
lea eax, [ebp - 0xa08]
push eax
lea eax, [ebp - 0x65c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
je 0x1000c5e7
lea eax, [ebp - 0x9dc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp - 0xa08]
and eax, 0x10
cmp al, 0x10
jne 0x1000c576
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp - 0x80]
push eax
call esi
mov edx, eax
lea eax, [ebp - 0x65c]
push eax
mov dword [ebp + 0x20], edx
call esi
mov ecx, dword [ebp + 0x20]
add ecx, eax
cmp ecx, 0x3e8
jae 0x1000c576
cmp byte [ebp - 0x80], bl
mov eax, str..
je 0x1000c3a7
lea eax, [ebp - 0x80]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x8c8]
push eax
lea eax, [ebp - 0x65c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x1000c564
lea eax, [ebp - 0x89c]
push eax
lea eax, [ebp - 0x9dc]
push eax
push str._s_s
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [ebp - 0x8c8]
add esp, 0x10
and eax, 0x10
xor ecx, ecx
cmp al, 0x10
setne cl
mov esi, ecx
cmp esi, ebx
jne 0x1000c433
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpA]
lea eax, [ebp - 0x89c]
push 0x10018204
push eax
call edi
test eax, eax
je 0x1000c433
lea eax, [ebp - 0x89c]
push 0x10018200
push eax
call edi
test eax, eax
je 0x1000c433
push 1
pop edi
jmp 0x1000c435
xor edi, edi
lea eax, [ebp - 0x8c8]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
cmp esi, ebx
mov dword [ebp + 0x20], eax
je 0x1000c47c
lea eax, [ebp - 0x65c]
push 0x20
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x65c]
push 1
push eax
call fcn.1000eec1
cmp dword [ebp + 0x24], ebx
pop ecx
pop ecx
je 0x1000c54f
mov eax, dword [ebp + 0x24]
jmp 0x1000c549
cmp edi, ebx
je 0x1000c54f
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
push str..
add esi, dword [ebp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0xb48]
push eax
lea eax, [ebp - 0x65c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x1000c531
lea eax, [ebp - 0xb1c]
push eax
push 0x100181fc
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [ebp - 0xb48]
add esp, 0xc
and eax, 0x10
xor ecx, ecx
cmp al, 0x10
lea eax, [ebp - 0xb48]
setne cl
push eax
push edi
mov dword [ebp - 0x1c], ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
cmp dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], eax
je 0x1000c525
lea eax, [ebp - 0x65c]
push 0x20
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x65c]
push 1
push eax
call fcn.1000eec1
cmp dword [ebp + 0x24], ebx
pop ecx
pop ecx
je 0x1000c525
mov eax, dword [ebp + 0x24]
mov dword [eax], 1
cmp dword [ebp - 0x18], ebx
jne 0x1000c4b9
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x65c]
push ebx
push eax
mov byte [esi], bl
call fcn.1000eec1
mov eax, dword [ebp + 0x24]
pop ecx
cmp eax, ebx
pop ecx
je 0x1000c54f
mov dword [eax], 1
cmp dword [ebp + 0x20], ebx
jne 0x1000c3cf
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0x9dc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor esi, esi
jmp 0x1000c579
push 1
pop esi
lea eax, [ebp - 0xa08]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
cmp esi, ebx
mov dword [ebp + 0x20], eax
je 0x1000c5b9
lea eax, [ebp - 0x65c]
push 0x20
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x65c]
push 1
push eax
call fcn.1000eec1
cmp dword [ebp + 0x24], ebx
pop ecx
pop ecx
je 0x1000c5d5
mov eax, dword [ebp + 0x24]
jmp 0x1000c5cf
lea eax, [ebp - 0x65c]
push ebx
push eax
call fcn.1000eec1
mov eax, dword [ebp + 0x24]
pop ecx
cmp eax, ebx
pop ecx
je 0x1000c5d5
mov dword [eax], 1
cmp dword [ebp + 0x20], ebx
jne 0x1000c350
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 0x14], ebx
je 0x1000c688
mov eax, dword [ebp - 8]
mov esi, 0x1ea
sub esi, dword [ebp - 0xc]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
inc dword [ebp - 8]
lea ecx, [ebp - 0x26e]
push esi
push ecx
push eax
push SysReAllocStringLen
call edi
test eax, eax
jne 0x1000c67c
mov eax, dword [ebp - 0x14]
add eax, 6
mov dword [ebp + 0x10], eax
lea eax, [ebp - 0x274]
push 0x10018218
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push dword [ebp + 0x10]
lea eax, [ebp - 0x274]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x65c]
push 0x3e8
push eax
lea eax, [ebp - 0x274]
push eax
call fcn.1000dde2
add esp, 0xc
test eax, eax
jne 0x1000c67f
mov eax, dword [ebp - 8]
inc dword [ebp - 8]
lea ecx, [ebp - 0x26e]
push esi
push ecx
push eax
push SysReAllocStringLen
call edi
test eax, eax
je 0x1000c621
mov dword [ebp + 0x14], ebx
cmp dword [ebp + 0x14], ebx
jne 0x1000c1ac
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
lea ecx, [eax + ecx*2]
mov dword [ebp - 4], ecx
mov ax, word [ecx]
cmp ax, 0xd
je 0x1000c6a3
cmp ax, 0xa
jne 0x1000c6a7
inc ecx
inc ecx
jmp 0x1000c694
cmp word [ecx], bx
mov dword [ebp - 4], ecx
jne 0x1000c0b9
mov esi, dword [ebp + 0x18]
cmp esi, ebx
je 0x1000c852
cmp word [esi], bx
je 0x1000c852
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x2710
jge 0x1000c852
mov eax, esi
push 1
mov dword [ebp - 4], eax
pop edi
mov dx, word [eax]
mov dword [ebp + 0xc], ebx
cmp dx, bx
je 0x1000c826
mov ecx, eax
cmp dx, 0xd
je 0x1000c70b
cmp word [ecx], 0xa
je 0x1000c70b
inc dword [ebp + 0xc]
inc ecx
inc ecx
mov dx, word [ecx]
cmp dx, bx
jne 0x1000c6f2
cmp dword [ebp + 0xc], ebx
jle 0x1000c826
cmp eax, ebx
jne 0x1000c71c
xor esi, esi
jmp 0x1000c75b
mov eax, dword [ebp + 0xc]
lea esi, [eax + eax + 2]
mov eax, esi
add eax, 3
and al, 0xfc
call fcn.10012fc0
mov edi, esp
cmp edi, ebx
je 0x1000c753
push ebx
push ebx
push esi
push edi
push dword [ebp + 0xc]
mov byte [edi], bl
push dword [ebp - 4]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
neg esi
sbb esi, esi
and esi, edi
jmp 0x1000c755
xor esi, esi
mov eax, dword [ebp + 0xc]
mov byte [esi + eax], bl
push 1
push ebx
push esi
call fcn.1000e028
lea eax, [ebp - 0x65c]
push 0x3e8
push eax
push esi
call fcn.1000dde2
mov edi, eax
push 6
neg edi
sbb edi, edi
push str.HKCU__
push esi
inc edi
call fcn.1000ad66
add esp, 0x24
test eax, eax
jne 0x1000c823
add esi, 6
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x274]
push str.HKUR__
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, 0x1ea
mov dword [ebp - 8], 1
sub eax, dword [ebp - 0xc]
mov dword [ebp + 0x24], eax
push eax
lea eax, [ebp - 0x26e]
push eax
push ebx
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x1000c823
lea eax, [ebp - 0x274]
push 0x10018218
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x274]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 1
lea eax, [ebp - 0x274]
push ebx
push eax
call fcn.1000e028
mov eax, dword [ebp - 8]
add esp, 0xc
inc dword [ebp - 8]
lea ecx, [ebp - 0x26e]
push dword [ebp + 0x24]
push ecx
push eax
jmp 0x1000c7cf
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
lea eax, [eax + ecx*2]
mov dword [ebp - 4], eax
mov cx, word [eax]
cmp cx, 0xd
je 0x1000c83e
cmp cx, 0xa
jne 0x1000c842
inc eax
inc eax
jmp 0x1000c82f
cmp word [eax], bx
mov dword [ebp - 4], eax
jne 0x1000c6e1
mov eax, edi
jmp 0x1000c855
push 1
pop eax
lea esp, [ebp - 0xb54]
pop edi
pop esi
pop ebx
leave
ret