Function at 0x981420
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0xb12d80
push 0xa847a0
mov eax, dword fs:[0]
push eax
sub esp, 0xd48
mov eax, dword [0xb196ec]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, ecx
mov dword [ebp - 0xd3c], edi
mov esi, edx
mov dword [ebp - 0xd34], esi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xd30], ebx
mov dword [ebp - 0xd40], ebx
mov byte [ebp - 0xd28], bl
push 0x3ff
push ebx
lea eax, [ebp - 0xd27]
push eax
call fcn.00a7ffb0
add esp, 0xc
mov byte [ebp - 0x528], bl
push 0x3ff
push ebx
lea ecx, [ebp - 0x527]
push ecx
call fcn.00a7ffb0
add esp, 0xc
cmp dword [0xbd85c8], ebx
jne 0x9814d1
mov dword [0xbd85c8], 1
mov edx, 0xc00cb0
mov ecx, str.DESKTOP_SPBNIC1
call fcn.00984760
mov byte [esi], 0
cmp byte [edi], 0x5c
jne 0x981673
cmp byte [edi + 1], 0x5c
jne 0x981673
mov byte [ebp - 0x928], 0
push 0x3ff
push ebx
lea edx, [ebp - 0x927]
push edx
call fcn.00a7ffb0
add esp, 0xc
xor eax, eax
mov dword [ebp - 0xd2c], eax
jmp 0x981510
mov cl, byte [edi + eax + 2]
test cl, cl
je 0x98153d
cmp eax, 0x400
jge 0x98153d
mov byte [ebp + eax - 0x928], cl
inc eax
mov dword [ebp - 0xd2c], eax
cmp byte [edi + eax + 2], 0x5c
jne 0x981510
lea ecx, [eax + 3]
mov dword [ebp - 0xd30], ecx
mov byte [ebp + eax - 0x928], 0
cmp byte [ebp - 0x928], 0
je 0x981673
mov eax, str.127.
mov dword [ebp - 0xd48], eax
cmp byte [eax], 0
je 0x981565
inc eax
jmp 0x981557
sub eax, str.127.
push eax
mov eax, str.127.
lea ecx, [ebp - 0x928]
call fcn.0094c380
add esp, 4
test eax, eax
je 0x98165b
mov eax, str.localhost
lea ecx, [ebp - 0x928]
call fcn.0094c330
test eax, eax
je 0x98165b
mov eax, str.DESKTOP_SPBNIC1
lea ecx, [ebp - 0x928]
call fcn.0094c330
test eax, eax
je 0x98165b
mov ebx, dword [0xc00cb0]
test ebx, ebx
je 0x981673
mov dword [ebp - 0xd2c], 0
mov byte [ebp - 0x128], 0
push 0x103
push 0
lea edx, [ebp - 0x127]
push edx
call fcn.00a7ffb0
add esp, 0xc
lea eax, [ebp - 0xd2c]
push eax
push ebx
mov bl, 0x2c
lea edi, [ebp - 0x128]
call fcn.0095ae80
add esp, 8
or esi, 0xffffffff
cmp dword [ebp - 0xd2c], esi
je 0x981667
lea eax, [ebp - 0x128]
lea ecx, [ebp - 0x928]
call fcn.0094c330
test eax, eax
jne 0x98163b
mov dword [ebp - 0xd40], 1
mov edi, dword [ebp - 0xd3c]
mov esi, dword [ebp - 0xd34]
jmp 0x981680
lea ecx, [ebp - 0xd2c]
push ecx
mov edx, dword [0xc00cb0]
push edx
mov bl, 0x2c
lea edi, [ebp - 0x128]
call fcn.0095ae80
add esp, 8
jmp 0x981606
mov dword [ebp - 0xd40], 1
jmp 0x981680
mov edi, dword [ebp - 0xd3c]
mov esi, dword [ebp - 0xd34]
cmp dword [ebp - 0xd40], 0
je 0x98189f
xor ecx, ecx
mov edx, dword [ebp - 0xd30]
mov dword [ebp - 0xd54], ecx
mov al, byte [edi + edx]
test al, al
je 0x9816aa
cmp al, 0x5c
je 0x9816aa
mov byte [ebp + ecx - 0x528], al
inc edx
mov dword [ebp - 0xd30], edx
inc ecx
jmp 0x981688
mov byte [ebp + ecx - 0x528], 0
push 0x80000002
lea eax, [ebp - 0xd38]
mov ecx, 1
mov edx, str.SystemCurrentControlSetServicesLanmanServerShares
call fcn.0097f000
add esp, 4
test eax, eax
jne 0x981821
mov dword [ebp - 0xd44], eax
lea eax, [ebp - 0xd44]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 0x528]
push ecx
mov edx, dword [ebp - 0xd38]
push edx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call ebx
test eax, eax
je 0x98170f
cmp eax, 0xea
jne 0x981821
mov eax, dword [ebp - 0xd44]
add eax, 0x104
call fcn.00966e40
mov esi, eax
mov eax, dword [ebp - 0xd38]
test esi, esi
jne 0x981737
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x98181b
lea ecx, [ebp - 0xd44]
push ecx
push esi
push 0
push 0
lea edx, [ebp - 0x528]
push edx
push eax
call ebx
test eax, eax
jne 0x981805
xor ebx, ebx
cmp byte [ebx + esi], 0
je 0x9817cf
mov eax, str.Path
mov dword [ebp - 0xd50], eax
cmp byte [eax], 0
je 0x981770
inc eax
jmp 0x981762
lea edi, [ebx + esi]
sub eax, str.Path
push eax
mov eax, str.Path
mov ecx, edi
call fcn.0094c380
add esp, 4
test eax, eax
jne 0x981871
mov eax, str.Path
mov dword [ebp - 0xd4c], eax
cmp byte [eax], 0
je 0x9817a3
inc eax
jmp 0x981795
sub eax, str.Path
add eax, ebx
add eax, esi
push eax
lea ecx, [ebp - 0xd28]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0xd28]
push edx
call fcn.0095ad70
add esp, 4
mov edi, dword [ebp - 0xd3c]
cmp byte [ebp - 0xd28], 0
je 0x981805
lea eax, [ebp - 0xd28]
push eax
mov ebx, dword [ebp - 0xd34]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, ebx
call fcn.00960910
mov ecx, dword [ebp - 0xd30]
lea edx, [edi + ecx + 1]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [ebp - 0xd38]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.00a78fec
add esp, 4
mov esi, dword [ebp - 0xd34]
cmp byte [esi], 0
jne 0x981863
cmp byte [ebp - 0x527], 0x24
jne 0x98189f
cmp byte [ebp - 0x526], 0
jne 0x98189f
lea ecx, [ebp - 0x528]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov byte [esi + 1], 0x3a
mov ecx, esi
call fcn.00960910
mov edx, dword [ebp - 0xd30]
lea eax, [edi + edx + 1]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 4], 0xfffffffe
mov eax, 1
jmp 0x9818a8
mov ecx, edi
call fcn.0094c3d0
lea ebx, [ebx + eax + 1]
mov edi, dword [ebp - 0xd3c]
jmp 0x981757
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00a78f21
mov esp, ebp
pop ebp
ret