Function at 0x1022f0a0
Capabilities:
Accept command line arguments
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44c
mov eax, dword [0x11ad127c]
xor eax, esp
mov dword [esp + 0x448], eax
push ebx
push esi
push edi
push 0x105
mov dword [esp + 0x3c], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call fcn.10450898
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
je 0x1022f0f5
mov byte [eax], 0
inc dword [0x11d0d904]
lea ecx, [esp + 0x14]
push 0
push 0x1046c220
call fcn.101ffd90
mov eax, dword [esp + 0x18]
mov dword [esp + 0x2c], 0
mov dword [esp + 0x24], 4
test eax, eax
jne 0x1022f149
cmp dword [esp + 0x14], eax
jne 0x1022f149
mov ecx, dword [esp + 0x20]
test ecx, ecx
je 0x1022f1cd
lea eax, [esp + 0x2c]
push eax
push 0x1046f820
call fcn.10200690
jmp 0x1022f1cd
lea ecx, [esp + 0x24]
push ecx
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0x48]
push ecx
push 0
push 0x1046f820
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
sub eax, 0
je 0x1022f1c5
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x1022f129
cmp byte [0x11d213c0], 0
je 0x1022f1ab
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x38]
push eax
push 0x1046f820
call fcn.100f6950
test al, al
je 0x1022f1cd
cmp dword [esp + 0x10], 0
jne 0x1022f1cd
lea eax, [esp + 0x2c]
push eax
push dword [esp + 0x38]
call fcn.100f76e0
jmp 0x1022f1cd
mov edx, 0x1046f820
call fcn.101ff260
test eax, eax
je 0x1022f1cd
cmp word [eax + 2], 4
jne 0x1022f1cd
mov eax, dword [eax + 6]
jmp 0x1022f1c9
mov eax, dword [esp + 0x28]
mov dword [esp + 0x2c], eax
lea ecx, [esp + 0x14]
call fcn.102000a0
mov eax, dword [esp + 0x2c]
sub eax, 1
je 0x1022f1f9
sub eax, 1
jne 0x1022f206
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
nop word [eax + eax]
push 0x1f4
call esi
jmp 0x1022f1f0
lea eax, [esp + 0x10]
mov word [esp + 0x10], 0xc3cc
call eax
test byte [0x11cd362c], 1
je 0x1022f25f
cmp dword [0x11cd3624], 0
jne 0x1022f226
mov ecx, 0x11cd3610
call fcn.100f5b00
test al, al
je 0x1022f25f
mov edx, dword [0x11cd3618]
xor eax, eax
mov esi, dword [0x11cd3614]
test edx, edx
je 0x1022f25f
lea ecx, [esi + 4]
nop dword [eax + eax]
cmp dword [ecx], 0x161903
je 0x1022f252
inc eax
add ecx, 0x10
cmp eax, edx
jb 0x1022f240
jmp 0x1022f25f
add eax, eax
cmp dword [esi + eax*8 + 0xc], 1
je 0x1022f370
mov eax, dword fs:[0x2c]
mov ecx, dword [0x11d0c5b8]
mov esi, dword [eax + ecx*4]
mov dword [esp + 0x10], esi
mov edi, dword [esi + 0x10]
mov eax, dword [edi + 0xbe28]
cmp dword [eax + 0x3b55], 0xa
jne 0x1022f2a0
cmp dword [eax + 0x3b59], 0
jne 0x1022f2a0
cmp dword [eax + 0x3b5d], 0x2800
ja 0x1022f2a0
mov bl, 1
jmp 0x1022f2a2
xor bl, bl
test edi, edi
je 0x1022f313
cmp dword [edi + 0xf944], 2
jbe 0x1022f313
mov esi, dword [edi + 0xfd48]
xor eax, eax
test esi, esi
je 0x1022f30f
lea ecx, [edi + 0xf968]
mov edx, ecx
cmp dword [edx], 1
je 0x1022f2d2
inc eax
add edx, 0x20
cmp eax, esi
jb 0x1022f2c3
jmp 0x1022f30f
cmp eax, 0x1f
jne 0x1022f2ef
xor eax, eax
nop dword [eax]
cmp dword [ecx], 1
je 0x1022f2f9
inc eax
add ecx, 0x20
cmp eax, esi
jb 0x1022f2e0
jmp 0x1022f30f
cmp eax, 0xffffffff
je 0x1022f30f
cmp eax, 0x1f
jae 0x1022f30f
shl eax, 5
cmp dword [eax + edi + 0xf96c], 0
setne al
test al, al
je 0x1022f30f
test bl, bl
jne 0x1022f370
mov esi, dword [esp + 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x1046de20
call ebx
test eax, eax
jne 0x1022f44b
call fcn.101ff770
mov eax, dword [esi + 0x10]
lea ecx, [esp + 0x28]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push ecx
lea ecx, [esp + 0x3c]
mov dword [esp + 0x2c], 4
mov eax, dword [eax + 0xbe28]
push ecx
push 0
push 0
push 0x1046d380
push dword [eax + 0x26e0]
call ebx
test eax, eax
jne 0x1022f370
cmp dword [esp + 0x38], eax
jne 0x1022f4e5
cmp dword [esp + 0x18], 0
je 0x1022f380
lea ecx, [esp + 0x14]
call fcn.102000a0
mov eax, dword [0x11d0d904]
dec eax
mov dword [0x11d0d904], eax
test eax, eax
jg 0x1022f409
mov eax, dword [0x11d0d920]
mov dword [0x11d0d920], 0
test eax, eax
je 0x1022f3ab
push eax
call fcn.10450877
add esp, 4
mov eax, dword [0x11d0d918]
mov dword [0x11d0d918], 0
test eax, eax
je 0x1022f3c7
push eax
call fcn.10450877
add esp, 4
mov eax, dword [0x11d0d91c]
mov dword [0x11d0d91c], 0
test eax, eax
je 0x1022f3e3
push eax
call fcn.10450877
add esp, 4
mov eax, dword [0x11d0d914]
mov dword [0x11d0d914], 0
test eax, eax
je 0x1022f3ff
push eax
call fcn.10450877
add esp, 4
mov dword [0x11d0d904], 0
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x1022f41a
push eax
call fcn.10450877
add esp, 4
mov esi, dword [esp + 0x20]
test esi, esi
je 0x1022f434
mov ecx, esi
call fcn.101ffa20
push 0x10
push esi
call fcn.1045088a
add esp, 8
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x448]
xor ecx, esp
call fcn.1045066c
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x10]
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x3c]
mov dword [esp + 0x2c], 4
push ecx
mov eax, dword [eax + 0xbe28]
push 0
push 0
push 0x1046d380
push dword [eax + 0x26e0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1022f488
cmp dword [esp + 0x38], eax
jne 0x1022f4df
call fcn.101d0e60
test eax, eax
jne 0x1022f370
push 0x1046de20
xor edi, edi
call ebx
mov esi, eax
call fcn.101fedc0
test al, al
je 0x1022f4db
test esi, esi
jne 0x1022f4bf
call fcn.101ff770
push 0x1046de20
call ebx
mov esi, eax
test esi, esi
je 0x1022f4cd
push 0x1046f830
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x1022f4db
call edi
test al, al
je 0x1022f370
mov esi, dword [esp + 0x10]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0
push 0x1046c220
lea ecx, [esp + 0x1c]
call fcn.101ffd90
mov eax, dword [esp + 0x18]
mov dword [esp + 0x30], 0
mov dword [esp + 0x28], 4
test eax, eax
jne 0x1022f5a1
cmp dword [esp + 0x14], eax
jne 0x1022f5a1
mov ecx, dword [esp + 0x20]
test ecx, ecx
je 0x1022f53a
lea eax, [esp + 0x30]
push eax
push 0x1046f850
call fcn.10200690
test al, al
jne 0x1022f64d
lea ecx, [esp + 0x14]
call fcn.102000a0
push 0
push 0x1046c220
lea ecx, [esp + 0x1c]
call fcn.101ffd90
test al, al
je 0x1022f71b
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], 0
mov dword [esp + 0x3c], 4
test eax, eax
jne 0x1022f666
cmp dword [esp + 0x14], eax
jne 0x1022f666
mov ecx, dword [esp + 0x20]
test ecx, ecx
je 0x1022f6ea
lea eax, [esp + 0x24]
push eax
push 0x1046e140
call fcn.10200690
jmp 0x1022f6ea
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x40]
push ecx
lea ecx, [esp + 0x48]
push ecx
push 0
push 0x1046f850
push eax
call ebx
sub eax, 0
je 0x1022f645
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x1022f51b
cmp byte [0x11d213c0], 0
je 0x1022f617
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x28]
push eax
push 0x1046f850
call fcn.100f6950
test al, al
je 0x1022f53a
cmp dword [esp + 0x34], 0
jne 0x1022f53a
lea eax, [esp + 0x30]
push eax
push dword [esp + 0x28]
call fcn.100f76e0
test al, al
je 0x1022f53a
jmp 0x1022f64d
mov edx, 0x1046f850
call fcn.101ff260
test eax, eax
je 0x1022f53a
xor cl, cl
cmp word [eax + 2], 4
jne 0x1022f63b
mov eax, dword [eax + 6]
mov cl, 1
mov dword [esp + 0x30], eax
test cl, cl
je 0x1022f53a
jmp 0x1022f64d
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x30], eax
cmp dword [esp + 0x30], 0
je 0x1022f53a
lea ecx, [esp + 0x14]
call fcn.102000a0
jmp 0x1022f370
lea ecx, [esp + 0x3c]
push ecx
lea ecx, [esp + 0x44]
push ecx
lea ecx, [esp + 0x4c]
push ecx
push 0
push 0x1046e140
push eax
call ebx
sub eax, 0
je 0x1022f6e2
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x1022f581
cmp byte [0x11d213c0], 0
je 0x1022f6c8
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x38]
push eax
push 0x1046e140
call fcn.100f6950
test al, al
je 0x1022f6ea
cmp dword [esp + 0x28], 0
jne 0x1022f6ea
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x38]
call fcn.100f76e0
jmp 0x1022f6ea
mov edx, 0x1046e140
call fcn.101ff260
test eax, eax
je 0x1022f6ea
cmp word [eax + 2], 4
jne 0x1022f6ea
mov eax, dword [eax + 6]
jmp 0x1022f6e6
mov eax, dword [esp + 0x40]
mov dword [esp + 0x24], eax
mov ecx, dword [esi + 0x10]
cmp dword [ecx + 0xd590], 1
jne 0x1022f714
mov eax, dword [esp + 0x24]
and eax, 0xfffffff3
mov dword [esp + 0x24], eax
test byte [ecx + 0xd58c], 2
jne 0x1022f714
and eax, 0xfffffffc
mov dword [esp + 0x24], eax
test byte [esp + 0x24], 4
jne 0x1022f725
mov dword [0x11cd5db8], 0x1046f810
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
xor edx, edx
lea ecx, [esp + 0x48]
mov bl, byte [eax]
test bl, bl
je 0x1022f75c
mov esi, ecx
sub eax, esi
nop dword [eax + eax]
cmp edx, 0x400
jae 0x1022f75f
mov byte [ecx], bl
inc edx
mov bl, byte [eax + ecx + 1]
inc ecx
test bl, bl
jne 0x1022f740
cmp edx, 0x400
jae 0x1022f75f
mov byte [ecx], 0
lea eax, [esp + 0x48]
mov byte [esp + 0x448], 0
push eax
call fcn.1043a9cb
lea ecx, [esp + 0x4c]
add esp, 4
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1022f780
sub ecx, edx
cmp byte [esp + ecx + 0x47], 0x22
jne 0x1022f7a1
dec ecx
cmp ecx, 0x401
jae 0x1022f91a
mov byte [esp + ecx + 0x48], al
xor esi, esi
mov eax, dword [esi + 0x11cd5d70]
test eax, eax
je 0x1022f7c3
push eax
lea eax, [esp + 0x4c]
push eax
call fcn.10425570
add esp, 8
test eax, eax
jne 0x1022f370
add esi, 4
cmp esi, 0x4c
jb 0x1022f7a3
mov esi, dword [esp + 0x10]
cmp byte [esi + 0x14], 0
jne 0x1022f7eb
call fcn.101ff770
mov byte [esi + 0x14], al
test al, al
je 0x1022f370
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edi, edi
push 0x1046de20
call ebx
mov esi, eax
call fcn.101fedc0
test al, al
je 0x1022f370
test esi, esi
jne 0x1022f81f
call fcn.101ff770
push 0x1046de20
call ebx
mov esi, eax
test esi, esi
je 0x1022f82d
push 0x1046de80
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x1022f370
call edi
test al, al
je 0x1022f370
cmp dword [esp + 0x18], 0
je 0x1022f84f
lea ecx, [esp + 0x14]
call fcn.102000a0
mov eax, dword [0x11d0d904]
dec eax
mov dword [0x11d0d904], eax
test eax, eax
jg 0x1022f8d8
mov eax, dword [0x11d0d920]
mov dword [0x11d0d920], 0
test eax, eax
je 0x1022f87a
push eax
call fcn.10450877
add esp, 4
mov eax, dword [0x11d0d918]
mov dword [0x11d0d918], 0
test eax, eax
je 0x1022f896
push eax
call fcn.10450877
add esp, 4
mov eax, dword [0x11d0d91c]
mov dword [0x11d0d91c], 0
test eax, eax
je 0x1022f8b2
push eax
call fcn.10450877
add esp, 4
mov eax, dword [0x11d0d914]
mov dword [0x11d0d914], 0
test eax, eax
je 0x1022f8ce
push eax
call fcn.10450877
add esp, 4
mov dword [0x11d0d904], 0
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x1022f8e9
push eax
call fcn.10450877
add esp, 4
mov esi, dword [esp + 0x20]
test esi, esi
je 0x1022f903
mov ecx, esi
call fcn.101ffa20
push 0x10
push esi
call fcn.1045088a
add esp, 8
mov ecx, dword [esp + 0x454]
mov al, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1045066c
mov esp, ebp
pop ebp
ret
call fcn.1045079c
int3