Function at 0x100aca80
Capabilities:
Query or enumerate registry value
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x1013c014]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x814], eax
mov ax, word [0x10158d40]
mov dword [ebp - 0x818], edx
push esi
push edi
test ax, ax
jne 0x100acc70
mov eax, 0x2a
lea edx, [ebp - 0x20c]
push 0x1011e708
push 0x104
mov word [0x10158d40], ax
call fcn.100a49c0
add esp, 8
mov edi, eax
cmp word [ebp - 0x20c], 0x2d
je 0x100acb99
push 0x20119
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x824], 0
push eax
push SysReAllocString
lea ecx, [ebp - 0x824]
mov dword [ebp - 0x820], 0
mov dword [ebp - 0x81c], 0
call fcn.10013210
mov esi, dword [ebp - 0x824]
test eax, eax
jne 0x100acbee
push 0x1011e708
push 0x104
lea edx, [ebp - 0x20c]
mov ecx, edi
call fcn.100a49c0
add esp, 8
mov dword [ebp - 0x808], 4
mov edi, eax
lea eax, [ebp - 0x808]
push eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x80c]
push eax
push 0
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100acbee
cmp dword [ebp - 0x80c], 4
jne 0x100acbee
cmp dword [ebp - 0x810], eax
je 0x100acbee
test esi, esi
je 0x100acb99
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x1011e708
push 0x104
lea edx, [ebp - 0x20c]
mov ecx, edi
call fcn.100a49c0
add esp, 8
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.SHELL32.dll_DoEnvironmentSubstW]
lea esi, [ebp - 0x20c]
lea ecx, [esi + 2]
nop
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x100acbd0
sub esi, ecx
sar esi, 1
cmp esi, 0x103
jle 0x100acc0d
mov esi, 0x103
jmp 0x100acc11
test esi, esi
je 0x100acd7b
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100d4906
mov esp, ebp
pop ebp
ret
test esi, esi
jle 0x100acc2e
movzx eax, word [ebp + esi*2 - 0x20c]
mov ecx, 0xdc00
cmp ax, cx
jb 0x100acc2e
mov ecx, 0xdfff
cmp ax, cx
ja 0x100acc2e
dec esi
add esi, esi
lea eax, [ebp - 0x20c]
push esi
push eax
push 0x10158d40
call fcn.100d7080
xor eax, eax
add esp, 0xc
mov word [esi + 0x10158d40], ax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
mov ax, word [0x10158d40]
cmp ax, 0x2a
je 0x100acd7b
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push eax
push str._10u__5u
lea eax, [ebp - 0x804]
push 0x400
push eax
call fcn.100a4830
mov esi, eax
lea ebx, [ebp - 0x804]
mov edi, 0x3fe
add esp, 0x14
sub edi, esi
lea ebx, [ebx + esi*2]
test edi, edi
jg 0x100accbe
xor eax, eax
jmp 0x100acce8
push dword [ebp - 0x814]
lea eax, [edi - 1]
mov edx, edi
push ecx
push dword [ebp - 0x818]
mov ecx, ebx
push eax
call fcn.100a4a90
add esp, 0x10
test eax, eax
jns 0x100acce2
lea eax, [edi - 1]
xor ecx, ecx
mov word [ebx + eax*2], cx
add esi, eax
mov eax, dword [0x1010ff30]
push 0x10121fdc
push 0x10158d40
mov dword [ebp + esi*2 - 0x804], eax
xor eax, eax
mov word [ebp + esi*2 - 0x800], ax
lea eax, [ebp - 0x808]
push eax
add esi, 2
call fcn.100de5a6
add esp, 0xc
pop ebx
test eax, eax
jne 0x100acd7b
push 2
push eax
push dword [ebp - 0x808]
call fcn.100e30a5
push dword [ebp - 0x808]
call fcn.100e36c0
add esp, 0x10
test eax, eax
jne 0x100acd58
push dword [ebp - 0x808]
push 1
push 2
push 0x10121fe4
call fcn.100de84d
add esp, 0x10
push dword [ebp - 0x808]
lea eax, [ebp - 0x804]
push esi
push 2
push eax
call fcn.100de84d
push dword [ebp - 0x808]
call fcn.100de929
add esp, 0x14
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100d4906
mov esp, ebp
pop ebp
ret