Function at 0x100262f0
Capabilities:
Check if file exists
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100844b1
mov eax, dword fs:[0]
push eax
sub esp, 0x25c
mov eax, dword [0x100ac1c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push 0x210
mov dword [ebp - 0x268], eax
lea eax, [ebp - 0x220]
push 0
push eax
mov dword [ebp - 0x264], 0
mov dword [ebp - 0x260], 1
call fcn.100503b0
mov esi, dword [str.8FA908C0_EAC5_47F9_8074_FFC5EBBEB255]
add esp, 0xc
call fcn.100085e0
mov ecx, eax
test ecx, ecx
je 0x10026e91
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x244], eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x244]
push esi
call fcn.100079e0
test al, al
jne 0x100263bc
test esi, esi
jne 0x10026393
xor ecx, ecx
jmp 0x100263af
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100263a0
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x244]
call fcn.1000ffb0
mov dword [ebp - 4], 1
mov esi, dword [str.TK8Fj70YG_v5TNxF0s46exCoTJuexFrC]
call fcn.100085e0
mov ecx, eax
test ecx, ecx
je 0x10026e9b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x24c], eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x24c]
push esi
call fcn.100079e0
test al, al
jne 0x10026423
test esi, esi
jne 0x10026402
xor ecx, ecx
jmp 0x10026416
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10026407
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x24c]
call fcn.1000ffb0
mov byte [ebp - 4], 3
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x240]
push eax
call fcn.1002f1d0
add esp, 0xc
mov byte [ebp - 4], 4
mov edx, dword [eax]
mov ecx, edx
xor eax, eax
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x224], 7
lea esi, [ecx + 2]
mov word [ebp - 0x238], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10026480
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x238]
call fcn.10011da0
mov byte [ebp - 4], 6
or ebx, 0xffffffff
mov edx, dword [ebp - 0x240]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100264c0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 8
mov eax, ebx
mov edx, dword [ebp - 0x24c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100264e1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xa
mov eax, ebx
mov edx, dword [ebp - 0x244]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10026502
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 0x25c], 0
mov dword [ebp - 0x258], 0
mov dword [ebp - 0x254], 0
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x23c]
cmp dword [ebp - 0x224], 8
lea eax, [ebp - 0x238]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmovae eax, dword [ebp - 0x238]
push ecx
push 0x20219
push 0
push eax
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x23c], 0
call esi
test eax, eax
jne 0x10026580
mov esi, dword [ebp - 0x23c]
mov dword [ebp - 0x258], eax
mov dword [ebp - 0x25c], esi
mov dword [ebp - 0x258], 0x200
jmp 0x100265d8
cmp dword [ebp - 0x224], 8
lea ecx, [ebp - 0x23c]
push ecx
push 0x20119
lea eax, [ebp - 0x238]
mov dword [ebp - 0x23c], 0
cmovae eax, dword [ebp - 0x238]
push 0
push eax
push reloc.WS2_32.dll_bind
call esi
test eax, eax
jne 0x10026e4f
mov esi, dword [ebp - 0x23c]
mov dword [ebp - 0x258], eax
mov dword [ebp - 0x25c], esi
mov dword [ebp - 0x258], 0x100
lea eax, [ebp - 0x23c]
mov dword [ebp - 0x24c], esi
push eax
lea eax, [ebp - 0x220]
mov dword [ebp - 0x23c], 0x210
push eax
lea eax, [ebp - 0x240]
push eax
push 0
push str.InstallDir
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10026631
mov eax, dword [ebp - 0x240]
cmp eax, 1
je 0x1002661f
cmp eax, 2
jne 0x10026631
cmp dword [ebp - 0x23c], 0
jne 0x10026631
xor eax, eax
mov word [ebp - 0x220], ax
push str.sysdeepopt.ini
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10026676
mov byte [ebp - 4], 0xa
test esi, esi
je 0x10026e53
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x25c], 0
jmp 0x10026e53
call fcn.100085e0
mov ecx, eax
test ecx, ecx
je 0x10026ea5
mov eax, dword [ecx]
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x244], edi
mov byte [ebp - 4], 0xe
call fcn.100085e0
mov ecx, eax
test ecx, ecx
je 0x10026eaf
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x23c], eax
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x23c]
push 0x10089d50
call fcn.100079e0
test al, al
jne 0x100266de
push 1
push 0x10089d50
lea ecx, [ebp - 0x23c]
call fcn.1000ffb0
mov byte [ebp - 4], 0x11
mov esi, dword [ebp - 0x23c]
mov ecx, dword [esi - 0x10]
lea eax, [esi - 0x10]
mov dword [ebp - 0x250], eax
test ecx, ecx
je 0x10026703
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x10026719
call fcn.100085e0
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
test ecx, ecx
je 0x10026eb9
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x248], eax
mov byte [ebp - 4], 0x11
mov eax, dword [ebp - 0x268]
mov dword [ebp - 0x264], 1
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
push dword [esi - 0xc]
lea eax, [ebp - 0x248]
push esi
push eax
call fcn.10027ac0
mov eax, dword [ebp - 0x248]
add edi, 0xfffffff0
add esp, 0x14
lea esi, [eax - 0x10]
cmp esi, edi
je 0x100267b5
cmp dword [edi + 0xc], 0
jl 0x100267a6
mov ecx, dword [esi]
cmp ecx, dword [edi]
jne 0x100267a6
push esi
call fcn.10007d10
mov dword [ebp - 0x240], eax
lea ecx, [edi + 0xc]
add esp, 4
mov eax, ebx
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x10026795
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x240]
add eax, 0x10
mov dword [ebp - 0x244], eax
jmp 0x100267b5
push dword [eax - 0xc]
lea ecx, [ebp - 0x244]
push eax
call fcn.1000ffb0
mov eax, 1
mov dword [ebp - 0x264], eax
and eax, 0xfffffffe
mov dword [ebp - 0x264], eax
mov byte [ebp - 4], 0x10
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x100267e1
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xe
mov eax, ebx
mov edx, dword [ebp - 0x250]
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100267ff
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x220]
push eax
push 0
push str.count
push 0x1008bee8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edi, 1
mov dword [ebp - 0x250], eax
mov dword [ebp - 0x240], edi
cmp eax, edi
jl 0x1002697f
call fcn.100085e0
mov ecx, eax
test ecx, ecx
je 0x10026e91
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x248], esi
mov byte [ebp - 4], 0x16
call fcn.100085e0
mov ecx, eax
test ecx, ecx
je 0x10026e91
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x23c], eax
mov byte [ebp - 4], 0x18
lea eax, [ebp - 0x23c]
push edi
push str.job_d
push eax
call fcn.10007e90
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x105
add esp, 0xc
or eax, ecx
jge 0x100268b2
push 0x105
lea ecx, [ebp - 0x248]
call fcn.1000f930
mov esi, dword [ebp - 0x248]
cmp dword [esi - 8], 0x105
jl 0x10026ec8
mov edi, dword [ebp - 0x23c]
xor eax, eax
mov dword [esi - 0xc], 0x105
mov word [esi + 0x20a], ax
lea eax, [ebp - 0x220]
push eax
push 0x104
push esi
push 0x10089d54
push str.name
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push dword [esi - 8]
push esi
call fcn.100576ba
add esp, 8
test eax, eax
js 0x10026ec8
cmp eax, dword [esi - 8]
jg 0x10026ec8
push esi
push dword [ebp - 0x244]
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
call fcn.10057865
add esp, 8
test eax, eax
je 0x10026d15
mov byte [ebp - 4], 0x16
add edi, 0xfffffff0
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x1002694b
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xe
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x10026966
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x240]
inc edi
mov dword [ebp - 0x240], edi
cmp edi, dword [ebp - 0x250]
jle 0x10026831
lea eax, [ebp - 0x220]
push eax
push 0
push str.count
push str.hkcurun
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edi, 1
mov dword [ebp - 0x250], eax
mov dword [ebp - 0x23c], edi
cmp eax, edi
jl 0x10026b01
call fcn.100085e0
mov ecx, eax
test ecx, ecx
je 0x10026e91
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x240], esi
mov byte [ebp - 4], 0x1f
call fcn.100085e0
mov ecx, eax
test ecx, ecx
je 0x10026e91
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x248], eax
mov byte [ebp - 4], 0x21
lea eax, [ebp - 0x248]
push edi
push str.hkcurun_d
push eax
call fcn.10007e90
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x105
add esp, 0xc
or eax, ecx
jge 0x10026a32
push 0x105
lea ecx, [ebp - 0x240]
call fcn.1000f930
mov esi, dword [ebp - 0x240]
cmp dword [esi - 8], 0x105
jl 0x10026ec8
mov edi, dword [ebp - 0x248]
xor eax, eax
mov dword [esi - 0xc], 0x105
mov word [esi + 0x20a], ax
lea eax, [ebp - 0x220]
push eax
push 0x104
push esi
push 0x10089d54
push str.name
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push dword [esi - 8]
push esi
call fcn.100576ba
add esp, 8
test eax, eax
js 0x10026ec8
cmp eax, dword [esi - 8]
jg 0x10026ec8
mov dword [esi - 0xc], eax
xor ecx, ecx
mov word [esi + eax*2], cx
mov eax, dword [ebp - 0x268]
push esi
push dword [eax]
call fcn.10057865
add esp, 8
test eax, eax
je 0x10026d9c
mov byte [ebp - 4], 0x1f
add edi, 0xfffffff0
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x10026acd
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xe
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x10026ae8
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x23c]
inc edi
mov dword [ebp - 0x23c], edi
cmp edi, dword [ebp - 0x250]
jle 0x100269b1
lea eax, [ebp - 0x220]
push eax
push 0
push str.count
push str.hklmrun
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edi, 1
mov dword [ebp - 0x250], eax
mov dword [ebp - 0x23c], edi
cmp eax, edi
jl 0x10026c83
call fcn.100085e0
mov ecx, eax
test ecx, ecx
je 0x10026e91
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x240], esi
mov byte [ebp - 4], 0x28
call fcn.100085e0
mov ecx, eax
test ecx, ecx
je 0x10026e91
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x248], eax
mov byte [ebp - 4], 0x2a
lea eax, [ebp - 0x248]
push edi
push str.hklmrun_d
push eax
call fcn.10007e90
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, 0x105
add esp, 0xc
or eax, ecx
jge 0x10026bb4
push 0x105
lea ecx, [ebp - 0x240]
call fcn.1000f930
mov esi, dword [ebp - 0x240]
cmp dword [esi - 8], 0x105
jl 0x10026ec8
mov edi, dword [ebp - 0x248]
xor eax, eax
mov dword [esi - 0xc], 0x105
mov word [esi + 0x20a], ax
lea eax, [ebp - 0x220]
push eax
push 0x104
push esi
push 0x10089d54
push str.name
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push dword [esi - 8]
push esi
call fcn.100576ba
add esp, 8
test eax, eax
js 0x10026ec8
cmp eax, dword [esi - 8]
jg 0x10026ec8
mov dword [esi - 0xc], eax
xor ecx, ecx
mov word [esi + eax*2], cx
mov eax, dword [ebp - 0x268]
push esi
push dword [eax]
call fcn.10057865
add esp, 8
test eax, eax
je 0x10026de1
mov byte [ebp - 4], 0x28
add edi, 0xfffffff0
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x10026c4f
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xe
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x10026c6a
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x23c]
inc edi
mov dword [ebp - 0x23c], edi
cmp edi, dword [ebp - 0x250]
jle 0x10026b33
mov byte [ebp - 4], 0xc
mov edx, dword [ebp - 0x244]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x10026ca2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0x24c]
test eax, eax
je 0x10026cc1
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x25c], 0
mov dword [ebp - 0x258], 0
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x224]
cmp edx, 8
jb 0x10026e30
mov ecx, dword [ebp - 0x238]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10026e26
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10026ec3
jmp 0x10026e26
mov dword [ebp - 0x260], 0
mov byte [ebp - 4], 0x16
add edi, 0xfffffff0
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x10026d3a
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xe
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x10026d55
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xc
mov edx, dword [ebp - 0x244]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x10026d74
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0x24c]
test eax, eax
je 0x10026e53
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x25c], 0
jmp 0x10026e53
mov dword [ebp - 0x260], 0
mov byte [ebp - 4], 0x1f
add edi, 0xfffffff0
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x10026dc1
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xe
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x10026ddc
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x10026d55
mov dword [ebp - 0x260], 0
mov byte [ebp - 4], 0x28
add edi, 0xfffffff0
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x10026e06
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xe
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x10026e21
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x10026d55
push edx
push ecx
call fcn.1004774c
add esp, 8
xor eax, eax
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x224], 7
mov word [ebp - 0x238], ax
jmp 0x10026e6f
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x258], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x238]
call fcn.10005880
mov eax, dword [ebp - 0x260]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10047acb
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.100079c0
push 0x80004005
call fcn.100079c0
push 0x80004005
call fcn.100079c0
push 0x80004005
call fcn.100079c0
push 0x80004005
call fcn.100079c0
call fcn.100534b3
push 0x80070057
call fcn.100079c0
int3