Function at 0x101443c
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x1080c8e
call fcn.0105c800
sub esp, 0x530
mov eax, dword [0x1098824]
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x14], eax
and dword [ebp - 4], 0
and byte [ebp - 0xd], 0
cmp dword [esi], 4
je 0x101453a
push 0x10
call fcn.0105b249
pop ecx
mov dword [ebp - 0x30], eax
test eax, eax
mov byte [ebp - 4], 1
je 0x1014495
push 1
mov ecx, eax
push dword [0x10a4280]
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.01016e3e
mov ebx, eax
jmp 0x1014497
xor ebx, ebx
and byte [ebp - 4], 0
cmp byte [ebx + 0xc], 0
je 0x101451e
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
push dword [0x10a4278]
push dword [0x10a427c]
call fcn.01016f4e
mov eax, dword [ebp - 0x14]
cmp dword [eax - 8], 0
je 0x101451e
push dword [esi + 0x5c]
call fcn.0105ad60
push dword [ebp - 0x14]
call fcn.0105c0e0
add eax, 0x10
push eax
call fcn.0105b249
mov edi, str.__aol.exe
mov dword [esi + 0x5c], eax
mov eax, edi
add esp, 0xc
test eax, eax
je 0x10144f4
push edi
call fcn.0105c0e0
pop ecx
jmp 0x10144f6
xor eax, eax
push edi
push eax
lea ecx, [ebp - 0x14]
call fcn.01008a89
push dword [ebp - 0x14]
push dword [esi + 0x5c]
call fcn.0105d010
pop ecx
mov dword [esi + 4], 3
pop ecx
mov dword [esi], 4
mov byte [ebp - 0xd], 1
test ebx, ebx
je 0x1014530
mov ecx, ebx
call fcn.01016e63
push ebx
call fcn.0105ad60
pop ecx
cmp byte [ebp - 0xd], 0
jne 0x1014a11
and dword [esi], 0
and dword [esi + 4], 0
mov ecx, esi
call fcn.010140fd
test al, al
jne 0x1014553
mov ecx, esi
call fcn.01014118
push 0x10
call fcn.0105b249
pop ecx
mov dword [ebp - 0x30], eax
test eax, eax
mov byte [ebp - 4], 2
mov edi, 0x10a40b8
je 0x101457e
push 1
push edi
push SysReAllocStringLen
mov ecx, eax
call fcn.01016e3e
mov ebx, eax
jmp 0x1014580
xor ebx, ebx
and byte [ebp - 4], 0
lea eax, [ebp - 0x14]
push eax
push edi
push dword [0x10a4218]
mov ecx, ebx
call fcn.01016f4e
xor edi, edi
cmp ebx, edi
je 0x10145aa
mov ecx, ebx
call fcn.01016e63
push ebx
call fcn.0105ad60
pop ecx
push dword [0x10a4214]
push dword [ebp - 0x14]
call fcn.0105d410
pop ecx
cmp eax, edi
pop ecx
jne 0x10146b2
mov ecx, esi
mov dword [esi + 4], 1
call fcn.01014e58
test al, al
jne 0x1014a11
and byte [ebp - 0xd], al
lea eax, [ebp - 0xd]
push eax
mov ecx, esi
push dword [0x10a4274]
push SysReAllocStringLen
call fcn.01014b83
cmp byte [ebp - 0xd], 0
jne 0x1014a11
lea eax, [ebp - 0x24]
push eax
push 8
push edi
push edi
push reloc.WSOCK32.dll_closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1014a11
xor ebx, ebx
lea eax, [ebp - 0x34]
and byte [ebp - 0x53c], 0
push eax
push edi
push edi
lea eax, [ebp - 0x28]
push edi
push eax
lea eax, [ebp - 0x53c]
mov dword [ebp - 0x28], 0x400
push eax
push ebx
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp byte [ebp - 0x53c], 0
mov dword [ebp - 0x1c], eax
je 0x1014694
cmp byte [ebp - 0x53c], 0x2e
je 0x1014694
lea eax, [ebp - 0x53c]
push 0x10989d8
push eax
call fcn.0105d020
push dword [0x10a4274]
lea eax, [ebp - 0x53c]
push eax
call fcn.0105d020
add esp, 0x10
lea eax, [ebp - 0xd]
mov ecx, esi
push eax
lea eax, [ebp - 0x53c]
push eax
push reloc.WSOCK32.dll_closesocket
call fcn.01014b83
inc ebx
cmp dword [ebp - 0x1c], edi
jne 0x10146a4
cmp byte [ebp - 0xd], 0
je 0x1014618
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1014a11
push dword [0x10a424c]
push dword [ebp - 0x14]
call fcn.0105d410
pop ecx
cmp eax, edi
pop ecx
jne 0x1014a11
mov ecx, esi
mov dword [esi + 4], 2
call fcn.01014e58
test al, al
jne 0x1014a11
push 0x10
call fcn.0105b249
pop ecx
mov dword [ebp - 0x30], eax
cmp eax, edi
mov byte [ebp - 4], 3
je 0x101470d
push edi
mov ecx, eax
push dword [0x10a4270]
push SysReAllocStringLen
call fcn.01016e3e
mov ebx, eax
mov dword [ebp - 0x28], ebx
jmp 0x1014712
mov dword [ebp - 0x28], edi
mov ebx, edi
and byte [ebp - 4], 0
cmp byte [ebx + 0xc], 0
je 0x10149ff
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
push dword [0x10a4244]
push dword [0x10a4248]
call fcn.01016f4e
push 1
push 0x5c
lea ecx, [ebp - 0x14]
call fcn.010091bd
mov ecx, dword [0x1098824]
mov dword [ebp - 0x24], ecx
cmp eax, 0xffffffff
mov byte [ebp - 4], 4
je 0x101477b
push eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x14]
call fcn.01008d4e
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 5
call fcn.01008a01
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 4
call fcn.01001190
mov eax, dword [0x10a4240]
push eax
mov ecx, dword [eax - 8]
push ecx
lea ecx, [ebp - 0x24]
call fcn.01008a89
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
push dword [0x10a422c]
push dword [0x10a4230]
call fcn.01016f4e
push 1
push 0x1098ff8
push 0x10987d0
lea ecx, [ebp - 0x14]
call fcn.01008fbc
mov eax, dword [0x10a4228]
push eax
mov ecx, dword [eax - 8]
push ecx
lea ecx, [ebp - 0x14]
call fcn.01008a89
push 0x1098ff4
push dword [ebp - 0x14]
call fcn.0105dfc4
pop ecx
cmp eax, edi
pop ecx
mov dword [ebp - 0x1c], eax
je 0x101498c
xor ebx, ebx
and dword [ebp - 0x2c], ebx
and byte [ebp - 0xd], bl
push dword [ebp - 0x1c]
lea eax, [ebp - 0x13c]
push 0xff
push eax
call fcn.0105e2ca
add esp, 0xc
lea eax, [ebp - 0x13c]
lea ecx, [ebp - 0x20]
push 0xffffffffffffff9b
push eax
call fcn.010087b8
push dword [0x10a4224]
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 6
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.01014a28
add esp, 0xc
mov eax, dword [ebp - 0x18]
mov byte [ebp - 4], 7
cmp dword [eax - 8], 0
je 0x1014859
push 0x1098bb4
push eax
call fcn.0105d410
pop ecx
test eax, eax
pop ecx
jne 0x1014920
mov byte [ebp - 0xd], 1
jmp 0x1014920
push dword [0x10a4220]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.01014a28
add esp, 0xc
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 8
call fcn.01008a01
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 7
call fcn.01001190
mov eax, dword [ebp - 0x18]
cmp dword [eax - 8], 0
je 0x10148af
push eax
call fcn.0105c0e0
inc eax
push eax
call fcn.0105b249
push dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
push eax
call fcn.0105d010
add esp, 0x10
jmp 0x1014920
push dword [0x10a421c]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.01014a28
add esp, 0xc
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 9
call fcn.01008a01
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 7
call fcn.01001190
mov eax, dword [ebp - 0x18]
mov eax, dword [eax - 8]
test eax, eax
je 0x1014920
lea edi, [eax - 2]
lea eax, [edi + 1]
push eax
call fcn.0105b249
pop ecx
mov ebx, eax
push 0xffffffffffffff9b
lea eax, [ebp - 0x30]
push 1
push eax
lea ecx, [ebp - 0x18]
call fcn.01008cd8
mov eax, dword [eax]
push edi
push eax
push ebx
call fcn.0105d100
add esp, 0xc
lea ecx, [ebp - 0x30]
call fcn.01001190
and byte [ebx + edi], 0
lea ecx, [ebp - 0x18]
call fcn.01001190
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 4
call fcn.01001190
mov eax, dword [ebp - 0x1c]
test byte [eax + 0xc], 0x10
je 0x10147ec
cmp byte [ebp - 0xd], 0
je 0x101496c
test ebx, ebx
je 0x101496c
cmp dword [ebp - 0x2c], 0
je 0x101496c
push ebx
lea ecx, [esi + 0x28]
mov byte [esi + 0x20], 1
call fcn.01008a50
push dword [ebp - 0x2c]
call fcn.0105b81b
pop ecx
mov dword [esi + 0x2c], eax
jmp 0x1014973
push ebx
call fcn.0105ad60
pop ecx
push dword [ebp - 0x2c]
call fcn.0105ad60
push dword [ebp - 0x1c]
call fcn.0105ddff
mov ebx, dword [ebp - 0x28]
pop ecx
pop ecx
xor edi, edi
jmp 0x10149f3
push edi
mov ecx, ebx
push dword [0x10a423c]
push dword [0x10a4250]
call fcn.01017013
cmp eax, 1
jne 0x10149f3
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
push dword [0x10a4238]
push dword [0x10a4250]
call fcn.01016f4e
lea ecx, [ebp - 0x14]
call fcn.0100884b
mov eax, dword [ebp - 0x14]
cmp byte [eax], 0
je 0x10149f3
lea eax, [ebp - 0x14]
lea ecx, [esi + 0x28]
push eax
mov byte [esi + 0x20], 1
call fcn.01008a01
push edi
mov ecx, ebx
push dword [0x10a4234]
push dword [0x10a4250]
call fcn.01017013
mov dword [esi + 0x2c], eax
and byte [ebp - 4], 0
lea ecx, [ebp - 0x24]
call fcn.01001190
cmp ebx, edi
je 0x1014a11
mov ecx, ebx
call fcn.01016e63
push ebx
call fcn.0105ad60
pop ecx
lea ecx, [ebp - 0x14]
call fcn.01001190
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret