Function at 0x10050c6
Capabilities:
Get common file path
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4a4
mov eax, dword [0x10150c4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
xor esi, esi
lea eax, [ebp - 0x484]
push eax
push 0x2000000
push esi
push 0x1005700
mov ebx, 0x80000002
push ebx
mov dword [ebp - 0x470], esi
mov dword [ebp - 0x468], esi
mov dword [ebp - 0x478], esi
mov dword [ebp - 0x47c], esi
mov dword [ebp - 0x46c], esi
mov dword [ebp - 0x484], esi
mov dword [ebp - 0x474], esi
call edi
test eax, eax
je 0x1007aab
mov eax, dword [0x10150c0]
cmp eax, 0x10150c0
je 0x100515c
test byte [eax + 0x1c], 1
je 0x100515c
cmp byte [eax + 0x19], 4
jb 0x100515c
push 0x10025ac
push 0x3f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010015b6
call fcn.01006bea
mov dword [ebp - 0x460], eax
cmp eax, esi
jne 0x1007b30
push 8
pop eax
mov word [0x10150d4], ax
lea eax, [ebp - 0x470]
push eax
call fcn.01003f7c
test eax, eax
je 0x1007b66
lea eax, [ebp - 0x470]
push eax
call fcn.01004385
lea eax, [ebp - 0x468]
push eax
push 0x20019
push esi
push 0x1006898
push ebx
call edi
test eax, eax
jne 0x10051f6
lea eax, [ebp - 0x47c]
push eax
lea eax, [ebp - 0x46c]
push eax
lea eax, [ebp - 0x478]
push eax
push esi
push str.DontWatchSysProcs
push dword [ebp - 0x468]
mov dword [ebp - 0x47c], 4
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
test eax, eax
je 0x1007b9b
push dword [ebp - 0x468]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
push esi
push esi
push 0x10056b8
call fcn.01006981
mov dword [ebp - 0x464], eax
cmp eax, esi
je 0x1007f2c
mov eax, dword [0x10150c0]
cmp eax, 0x10150c0
je 0x1005240
test byte [eax + 0x1c], 1
je 0x1005240
cmp byte [eax + 0x19], 4
jb 0x1005240
push dword [ebp - 0x464]
push 0x10025ac
push 0x42
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100375d
push esi
push esi
push 2
push dword [ebp - 0x470]
push 0x80
push esi
push esi
push 0x100369c
push dword [ebp - 0x464]
call fcn.01006a7f
mov dword [ebp - 0x460], eax
lea eax, [ebp - 0x464]
push eax
call fcn.0100575d
cmp dword [ebp - 0x460], esi
jne 0x1007bb8
push 9
pop eax
mov word [0x10150d4], ax
cmp dword [0x10150fc], esi
jne 0x1007bee
lea eax, [ebp - 0x468]
push eax
push 0x2001b
push esi
push 0x1005650
push ebx
call edi
test eax, eax
je 0x1007c05
lea eax, [ebp - 0x468]
push eax
push 0x20019
push esi
push 0x10055d8
push ebx
call edi
cmp eax, esi
je 0x1007def
lea eax, [ebp - 0x468]
push eax
push 0x20019
push esi
push 0x1005568
push ebx
call edi
cmp eax, esi
jne 0x100532b
mov edi, dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
push esi
push esi
push esi
push esi
push 0x100553c
push dword [ebp - 0x468]
call edi
mov ebx, eax
cmp ebx, esi
je 0x1005317
push esi
push esi
push esi
push esi
push 0x1005510
push dword [ebp - 0x468]
call edi
mov ebx, eax
push dword [ebp - 0x468]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
cmp ebx, esi
je 0x1007dfb
mov ebx, 0x80
mov edi, 0x100369c
push esi
push 1
push 0x10054d0
call fcn.01006981
mov dword [ebp - 0x464], eax
cmp eax, esi
je 0x1007f2c
mov eax, dword [0x10150c0]
cmp eax, 0x10150c0
je 0x1005380
test byte [eax + 0x1c], 1
je 0x1005380
cmp byte [eax + 0x19], 4
jb 0x1005380
push dword [ebp - 0x464]
push 0x10025ac
push 0x46
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100375d
push esi
push esi
push 2
push dword [ebp - 0x470]
push ebx
push esi
push 1
push edi
push dword [ebp - 0x464]
call fcn.01006a7f
mov dword [ebp - 0x460], eax
lea eax, [ebp - 0x464]
push eax
call fcn.0100575d
cmp dword [ebp - 0x460], esi
jne 0x1007ef9
push 0xa
pop eax
mov word [0x10150d4], ax
call fcn.01002f01
test eax, eax
jne 0x1007f7c
push esi
push 4
push 0x1005490
call fcn.01006981
mov dword [ebp - 0x464], eax
cmp eax, esi
je 0x1007f2c
mov eax, dword [0x10150c0]
cmp eax, 0x10150c0
je 0x1005419
test byte [eax + 0x1c], 1
je 0x1005419
cmp byte [eax + 0x19], 4
jb 0x1005419
push dword [ebp - 0x464]
push 0x10025ac
push 0x48
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100375d
push esi
push esi
push 2
push dword [ebp - 0x470]
push ebx
push 8
push 4
push edi
push dword [ebp - 0x464]
call fcn.01006a7f
mov dword [ebp - 0x460], eax
lea eax, [ebp - 0x464]
push eax
call fcn.0100575d
cmp dword [ebp - 0x460], esi
jne 0x1007f3b
push 0xb
pop eax
mov word [0x10150d4], ax
mov edi, 0x10150c0
push dword [ebp - 0x470]
call dword [sym.imp.ntdll.dll_RtlDestroyEnvironment]
cmp dword [ebp - 0x474], esi
jne 0x1007fb9
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x460]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010015a4
leave
ret
push 0x10081c4
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0x474], eax
mov eax, dword [0x10150c0]
cmp eax, 0x10150c0
je 0x1007af6
test byte [eax + 0x1c], 2
je 0x1007af6
cmp byte [eax + 0x19], 5
jb 0x1007af6
xor ecx, ecx
cmp dword [ebp - 0x474], esi
setne cl
push ecx
push 0x10025ac
push 0x3e
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01002f89
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 4
mov dword [ebp - 0x46c], eax
lea eax, [ebp - 0x46c]
push eax
push 4
push esi
push 0x10081a8
push dword [ebp - 0x484]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegSetValueExW]
push dword [ebp - 0x484]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
jmp 0x1005132
mov eax, dword [0x10150c0]
cmp eax, 0x10150c0
je 0x1005478
test byte [eax + 0x1c], 2
je 0x1005478
cmp byte [eax + 0x19], 1
jb 0x1005478
push dword [ebp - 0x46c]
push 0x10025ac
push 0x40
jmp 0x1007f6c
mov eax, dword [0x10150c0]
cmp eax, 0x10150c0
je 0x1007b90
test byte [eax + 0x1c], 2
je 0x1007b90
cmp byte [eax + 0x19], 2
jb 0x1007b90
push 0x10025ac
push 0x41
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010015b6
mov dword [ebp - 0x470], esi
jmp 0x1005198
cmp dword [ebp - 0x478], 4
jne 0x10051ea
mov eax, dword [ebp - 0x46c]
mov dword [0x1015898], eax
jmp 0x10051ea
mov eax, dword [0x10150c0]
cmp eax, 0x10150c0
je 0x1005478
test byte [eax + 0x1c], 2
je 0x1005478
cmp byte [eax + 0x19], 2
jb 0x1005478
push dword [ebp - 0x460]
push 0x10025ac
push 0x43
jmp 0x1007f6c
cmp dword [0x10150f8], 4
je 0x1005294
call fcn.0100e4c4
jmp 0x1005294
lea eax, [ebp - 0x47c]
push eax
lea eax, [ebp - 0x46c]
push eax
lea eax, [ebp - 0x478]
push eax
push esi
push 0x1008194
push dword [ebp - 0x468]
mov dword [ebp - 0x47c], 4
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x1007dde
cmp dword [ebp - 0x478], 4
jne 0x1007dde
cmp dword [ebp - 0x46c], esi
je 0x1007dde
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
dec eax
cmp eax, 0x102
ja 0x1007db7
push 0x100817c
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.010018e7
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x480], eax
cmp eax, 0xffffffff
je 0x1007db7
mov ebx, dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push 0x10080e0
lea eax, [ebp - 0x48c]
push eax
call ebx
push esi
push 1
push esi
lea eax, [ebp - 0x48c]
mov dword [ebp - 0x49c], eax
push esi
lea eax, [ebp - 0x4a4]
push eax
push 0x2001f
lea eax, [ebp - 0x460]
push eax
mov dword [ebp - 0x4a4], 0x18
mov dword [ebp - 0x4a0], esi
mov dword [ebp - 0x498], 0x40
mov dword [ebp - 0x494], esi
mov dword [ebp - 0x490], esi
call dword [sym.imp.ntdll.dll_NtCreateKey]
test eax, eax
jl 0x1007da6
push 0x10080c8
lea eax, [ebp - 0x48c]
push eax
mov dword [ebp - 0x464], 1
call ebx
lea eax, [ebp - 0x20c]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, si
jne 0x1007d3b
mov edi, dword [sym.imp.ntdll.dll_NtSetValueKey]
sub eax, ecx
sar eax, 1
add eax, eax
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push esi
lea eax, [ebp - 0x48c]
push eax
push dword [ebp - 0x460]
call edi
push 0x10080a8
lea eax, [ebp - 0x48c]
push eax
call ebx
push 4
lea eax, [ebp - 0x464]
push eax
push 4
push esi
lea eax, [ebp - 0x48c]
push eax
push dword [ebp - 0x460]
call edi
push dword [ebp - 0x460]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov edi, dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
push dword [ebp - 0x480]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ebx, 0x80000002
push 4
lea eax, [ebp - 0x46c]
push eax
push dword [ebp - 0x478]
mov dword [ebp - 0x46c], esi
push esi
push 0x1008194
push dword [ebp - 0x468]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegSetValueExW]
push dword [ebp - 0x468]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
jmp 0x10052b1
push dword [ebp - 0x468]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
push 0x1008060
push 0x1008040
call fcn.0100e078
mov dword [ebp - 0x480], eax
cmp eax, esi
je 0x1007e35
push 0x1008030
push 3
push eax
call fcn.01006981
mov dword [ebp - 0x464], eax
lea eax, [ebp - 0x480]
push eax
call fcn.0100575d
jmp 0x1007e3b
mov dword [ebp - 0x464], esi
cmp dword [ebp - 0x464], esi
je 0x100532b
mov eax, dword [0x10150c0]
cmp eax, 0x10150c0
je 0x1007e77
test byte [eax + 0x1c], 1
je 0x1007e77
cmp byte [eax + 0x19], 4
jb 0x1007e77
push dword [ebp - 0x464]
push 0x10025ac
push 0x44
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100375d
push esi
push esi
push esi
push dword [ebp - 0x470]
mov ebx, 0x80
push ebx
push esi
push 3
mov edi, 0x100369c
push edi
push dword [ebp - 0x464]
call fcn.01006a7f
mov dword [ebp - 0x460], eax
lea eax, [ebp - 0x464]
push eax
call fcn.0100575d
cmp dword [ebp - 0x460], esi
je 0x1005335
mov eax, dword [0x10150c0]
cmp eax, 0x10150c0
je 0x1005335
test byte [eax + 0x1c], 2
je 0x1005335
cmp byte [eax + 0x19], 2
jb 0x1005335
push dword [ebp - 0x460]
push 0x10025ac
push 0x45
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01002f89
jmp 0x1005335
mov eax, dword [0x10150c0]
cmp eax, 0x10150c0
je 0x1005478
test byte [eax + 0x1c], 2
je 0x1005478
cmp byte [eax + 0x19], 2
jb 0x1005478
push dword [ebp - 0x460]
push 0x10025ac
push 0x47
jmp 0x1007f6c
mov dword [ebp - 0x460], 0xd
jmp 0x1005478
mov eax, dword [0x10150c0]
cmp eax, 0x10150c0
je 0x1005478
test byte [eax + 0x1c], 2
je 0x1005478
cmp byte [eax + 0x19], 2
jb 0x1005478
push dword [ebp - 0x460]
push 0x10025ac
push 0x49
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01002f89
jmp 0x1005478
mov eax, dword [0x10150c0]
mov edi, 0x10150c0
cmp eax, edi
je 0x1005460
test byte [eax + 0x1c], 2
je 0x1005460
cmp byte [eax + 0x19], 4
jb 0x1005460
push 0x10025ac
push 0x4a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010015b6
jmp 0x1005460
mov eax, dword [0x10150c0]
cmp eax, edi
je 0x1007fe0
test byte [eax + 0x1c], 2
je 0x1007fe0
cmp byte [eax + 0x19], 5
jb 0x1007fe0
push 0x10025ac
push 0x4b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010015b6
push 0xffffffffffffffff
push dword [ebp - 0x474]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x460], eax
cmp eax, esi
jne 0x1007fe0
mov eax, dword [0x10150c0]
cmp eax, edi
je 0x100801f
test byte [eax + 0x1c], 2
je 0x100801f
cmp byte [eax + 0x19], 5
jb 0x100801f
push 0x10025ac
push 0x4c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010015b6
push dword [ebp - 0x474]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1005478