Function at 0x1001e8f0
Capabilities:
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100cdce8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c4
mov eax, dword [0x101025ec]
xor eax, esp
mov dword [esp + 0x2bc], eax
push esi
push edi
mov eax, dword [0x101025ec]
xor eax, esp
push eax
lea eax, [esp + 0x2d0]
mov dword fs:[0], eax
xor eax, eax
push 0xfe
push eax
mov word [esp + 0xcc], ax
lea eax, [esp + 0xce]
push eax
call fcn.10034ae0
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0xc
jmp 0x1001e960
mov dword [esp + 0x78], 0xf
mov dword [esp + 0x74], 0
mov byte [esp + 0x64], 0
lea edx, [esp + 0x64]
mov dword [esp + 0x2d8], 0
mov ecx, str.http:__tongji.16kucun.com
call fcn.10009d20
mov dword [esp + 0x2d8], 0xffffffff
lea esi, [eax - 1]
neg esi
sbb esi, esi
inc esi
cmp dword [esp + 0x78], 0x10
jb 0x1001e9b4
push dword [esp + 0x64]
call fcn.1002f7b8
add esp, 4
test esi, esi
jne 0x1001e9c1
push 0xbb8
call edi
jmp 0x1001e960
lea ecx, [esp + 0xc4]
mov byte [0x1010a985], 1
call fcn.10004a60
push 0
push 0x100f1358
lea ecx, [esp + 0xb4]
mov dword [esp + 0xc8], 0xf
mov dword [esp + 0xc4], 0
mov byte [esp + 0xb4], 0
call fcn.10007fb0
lea eax, [esp + 0x40]
mov dword [esp + 0x2d8], 1
push 0
push eax
call sym.SmUtils.dll_public:_static_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_CSmUtils::GetPath_enum_EMIPath_
push str.cmtlog_
mov edx, eax
mov byte [esp + 0x2e4], 2
lea ecx, [esp + 0xa0]
call fcn.10003a00
add esp, 0xc
mov byte [esp + 0x2d8], 4
cmp dword [esp + 0x54], 8
jb 0x1001ea55
push dword [esp + 0x40]
call fcn.1002f7b8
add esp, 4
push 1
sub esp, 0x18
mov dword [esp + 0x70], 7
mov edi, esp
mov dword [esp + 0x6c], 0
sub esp, 0x18
xor eax, eax
mov edx, esp
mov word [esp + 0x74], ax
mov dword [edx + 0x14], 7
mov dword [edx + 0x10], eax
mov word [edx], ax
cmp word [0x1010a7be], ax
jne 0x1001ea92
xor ecx, ecx
jmp 0x1001eaaf
mov ecx, 0x1010a7be
lea esi, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001eaa0
sub ecx, esi
sar ecx, 1
push ecx
push 0x1010a7be
mov ecx, edx
call fcn.10001b10
mov ecx, edi
call fcn.10004d10
add esp, 0x18
lea ecx, [esp + 0x28]
call fcn.10006950
add esp, 0x18
mov byte [esp + 0x2dc], 5
cmp dword [eax + 0x14], 8
jb 0x1001eae2
mov eax, dword [eax]
push eax
mov edx, 0x100f2330
lea ecx, [esp + 0x9c]
call fcn.10006bd0
add esp, 8
mov byte [esp + 0x2d8], 4
cmp dword [esp + 0x20], 8
jb 0x1001eb12
push dword [esp + 0xc]
call fcn.1002f7b8
add esp, 4
push 0
sub esp, 0x18
xor eax, eax
mov esi, esp
sub esp, 0x18
mov ecx, esp
push eax
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x100eefb8
mov word [ecx], ax
call fcn.10001b10
mov ecx, esi
call fcn.10004d10
add esp, 0x18
lea ecx, [esp + 0x28]
call fcn.10006950
add esp, 0x18
mov byte [esp + 0x2dc], 6
cmp dword [eax + 0x14], 8
jb 0x1001eb62
mov eax, dword [eax]
push eax
mov edx, 0x100f2338
lea ecx, [esp + 0x9c]
call fcn.10006bd0
add esp, 8
mov byte [esp + 0x2d8], 4
cmp dword [esp + 0x20], 8
jb 0x1001eb92
push dword [esp + 0xc]
call fcn.1002f7b8
add esp, 4
push 0
sub esp, 0x18
xor eax, eax
mov edi, esp
sub esp, 0x18
mov edx, esp
mov dword [edx + 0x14], 7
mov dword [edx + 0x10], 0
mov word [edx], ax
cmp word [0x1010a8de], ax
jne 0x1001ebbe
xor ecx, ecx
jmp 0x1001ebd5
mov ecx, 0x1010a8de
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001ebc6
sub ecx, esi
sar ecx, 1
push ecx
push 0x1010a8de
mov ecx, edx
call fcn.10001b10
mov ecx, edi
call fcn.10004d10
add esp, 0x18
lea ecx, [esp + 0x28]
call fcn.10006950
add esp, 0x18
mov byte [esp + 0x2dc], 7
cmp dword [eax + 0x14], 8
jb 0x1001ec08
mov eax, dword [eax]
push eax
mov edx, 0x100f2340
lea ecx, [esp + 0x9c]
call fcn.10006bd0
add esp, 8
mov byte [esp + 0x2d8], 4
cmp dword [esp + 0x20], 8
jb 0x1001ec38
push dword [esp + 0xc]
call fcn.1002f7b8
add esp, 4
push 0
push dword [0x1010a994]
mov edx, 0x100f2348
lea ecx, [esp + 0x9c]
call fcn.10006b00
add esp, 8
xor eax, eax
push 0
sub esp, 0x18
mov edi, esp
sub esp, 0x18
mov edx, esp
mov dword [edx + 0x14], 7
mov dword [edx + 0x10], 0
mov word [edx], ax
cmp word [esp + 0xf8], ax
jne 0x1001ec81
xor ecx, ecx
jmp 0x1001ec9f
lea ecx, [esp + 0xf8]
lea esi, [ecx + 2]
jmp 0x1001ec90
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001ec90
sub ecx, esi
sar ecx, 1
push ecx
lea eax, [esp + 0xfc]
mov ecx, edx
push eax
call fcn.10001b10
mov ecx, edi
call fcn.10004d10
add esp, 0x18
lea ecx, [esp + 0x28]
call fcn.10006950
add esp, 0x18
mov byte [esp + 0x2dc], 8
cmp dword [eax + 0x14], 8
jb 0x1001ecd5
mov eax, dword [eax]
push eax
mov edx, 0x100f2350
lea ecx, [esp + 0x9c]
call fcn.10006bd0
add esp, 8
mov byte [esp + 0x2d8], 4
cmp dword [esp + 0x20], 8
jb 0x1001ed05
push dword [esp + 0xc]
call fcn.1002f7b8
add esp, 4
push 0
push dword [sym.SmUtils.dll_struct__IAPP_GLOBAL_INFO_CSmUtils::m_Info]
mov edx, 0x100f2358
lea ecx, [esp + 0x9c]
call fcn.10006b00
xor eax, eax
lea ecx, [esp + 0x9c]
cmp dword [sym.SmUtils.dll_int_CSmUtils::m_bIsAd], eax
mov edx, 0x100f2360
push 0
setne al
push eax
call fcn.10006b00
sub esp, 8
lea esi, [esp + 0xc4]
mov ecx, esp
xor eax, eax
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esp + 0xb4]
push eax
call fcn.10001790
lea ecx, [esp + 0x24]
call fcn.10004f40
add esp, 0x18
mov byte [esp + 0x2d8], 9
cmp dword [eax + 0x14], 0x10
jb 0x1001ed88
mov eax, dword [eax]
mov edx, esi
mov ecx, eax
call fcn.10009d20
mov byte [esp + 0x2d8], 4
cmp dword [esp + 0x20], 0x10
jb 0x1001edac
push dword [esp + 0xc]
call fcn.1002f7b8
add esp, 4
cmp dword [esp + 0xc0], 0x10
lea ecx, [esp + 0xac]
mov esi, dword [esp + 0xbc]
mov eax, 1
cmovae ecx, dword [esp + 0xac]
mov edx, 0x100f2368
cmp esi, eax
cmovb eax, esi
push eax
call fcn.100043b0
add esp, 4
test eax, eax
jne 0x1001edfa
cmp esi, 1
jae 0x1001edf0
or eax, 0xffffffff
jmp 0x1001edf8
xor eax, eax
cmp esi, 1
setne al
test eax, eax
sete al
test al, al
je 0x1001f1e2
xor eax, eax
push 0xfe
push eax
mov word [esp + 0x1cc], ax
lea eax, [esp + 0x1ce]
push eax
call fcn.10034ae0
add esp, 0xc
mov dword [esp + 0x5c], 0
lea eax, [esp + 0x5c]
push eax
push 0x201
push 0
push 0x100f236c
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1001ee7f
lea eax, [esp + 0x60]
mov dword [esp + 0x60], 0x100
push eax
lea eax, [esp + 0x1c8]
push eax
push 0
push 0
push str.PPName
push dword [esp + 0x70]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0xc]
push 0
push eax
call sym.SmUtils.dll_public:_static_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_CSmUtils::GetPath_enum_EMIPath_
push str.cmtins_
mov edx, eax
mov byte [esp + 0x2e4], 0xa
lea ecx, [esp + 0x70]
call fcn.10003a00
add esp, 0xc
mov byte [esp + 0x2d8], 0xc
cmp dword [esp + 0x20], 8
jb 0x1001eec1
push dword [esp + 0xc]
call fcn.1002f7b8
add esp, 4
xor eax, eax
mov dword [esp + 0x20], 7
push 1
push 1
mov edx, 0x100f23a0
mov dword [esp + 0x24], 0
lea ecx, [esp + 0x6c]
mov word [esp + 0x14], ax
call fcn.10006b00
add esp, 8
xor eax, eax
push 0
sub esp, 0x18
mov edi, esp
sub esp, 0x18
mov edx, esp
mov dword [edx + 0x14], 7
mov dword [edx + 0x10], 0
mov word [edx], ax
cmp word [0x1010a7be], ax
jne 0x1001ef19
xor ecx, ecx
jmp 0x1001ef30
mov ecx, 0x1010a7be
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001ef21
sub ecx, esi
sar ecx, 1
push ecx
push 0x1010a7be
mov ecx, edx
call fcn.10001b10
mov ecx, edi
call fcn.10004d10
add esp, 0x18
lea ecx, [esp + 0x40]
call fcn.10006950
add esp, 0x18
mov byte [esp + 0x2dc], 0xd
cmp dword [eax + 0x14], 8
jb 0x1001ef63
mov eax, dword [eax]
push eax
mov edx, 0x100f2330
lea ecx, [esp + 0x6c]
call fcn.10006bd0
add esp, 8
mov byte [esp + 0x2d8], 0xc
cmp dword [esp + 0x38], 8
jb 0x1001ef90
push dword [esp + 0x24]
call fcn.1002f7b8
add esp, 4
push 0
sub esp, 0x18
mov edi, esp
sub esp, 0x18
mov esi, esp
sub esp, 0x18
push esp
call fcn.1002d9b0
add esp, 4
mov ecx, esi
call fcn.10004e50
add esp, 0x18
mov ecx, edi
call fcn.10004d10
add esp, 0x18
lea ecx, [esp + 0x40]
call fcn.10006950
add esp, 0x18
mov byte [esp + 0x2dc], 0xe
cmp dword [eax + 0x14], 8
jb 0x1001efd8
mov eax, dword [eax]
push eax
mov edx, 0x100f23a8
lea ecx, [esp + 0x6c]
call fcn.10006bd0
add esp, 8
mov byte [esp + 0x2d8], 0xc
cmp dword [esp + 0x38], 8
jb 0x1001f005
push dword [esp + 0x24]
call fcn.1002f7b8
add esp, 4
push 0
sub esp, 0x18
xor eax, eax
mov edx, esp
mov dword [edx + 0x14], 7
mov dword [edx + 0x10], 0
mov word [edx], ax
cmp word [0x1010a8be], ax
jne 0x1001f02c
xor ecx, ecx
jmp 0x1001f043
mov ecx, 0x1010a8be
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001f034
sub ecx, esi
sar ecx, 1
push ecx
push 0x1010a8be
mov ecx, edx
call fcn.10001b10
lea ecx, [esp + 0x40]
call fcn.10004f40
add esp, 0x18
mov byte [esp + 0x2dc], 0xf
cmp dword [eax + 0x14], 0x10
jb 0x1001f06c
mov eax, dword [eax]
push eax
call fcn.10031b76
add esp, 4
lea ecx, [esp + 0x68]
mov edx, 0x100f1f60
push eax
call fcn.10006b00
add esp, 8
mov byte [esp + 0x2d8], 0xc
cmp dword [esp + 0x38], 0x10
jb 0x1001f0a2
push dword [esp + 0x24]
call fcn.1002f7b8
add esp, 4
lea eax, [esp + 0x1c4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0
sub esp, 0x18
test eax, eax
je 0x1001f0ed
mov esi, esp
lea eax, [esp + 0x1e0]
sub esp, 0x18
mov ecx, esp
push eax
call fcn.10001c10
mov ecx, esi
call fcn.10004f40
add esp, 0x18
lea ecx, [esp + 0x40]
call fcn.10006950
add esp, 0x18
mov byte [esp + 0x2dc], 0x10
jmp 0x1001f12b
mov edi, esp
sub esp, 0x18
mov esi, esp
sub esp, 0x18
mov ecx, esp
push 0x100eeedc
call fcn.10001c10
mov ecx, esi
call fcn.10004f40
add esp, 0x18
mov ecx, edi
call fcn.1000b150
add esp, 0x18
lea ecx, [esp + 0x40]
call fcn.10006950
add esp, 0x18
mov byte [esp + 0x2dc], 0x11
cmp dword [eax + 0x14], 8
jb 0x1001f133
mov eax, dword [eax]
push eax
mov edx, 0x100f23b0
lea ecx, [esp + 0x6c]
call fcn.10006bd0
add esp, 8
mov byte [esp + 0x2d8], 0xc
cmp dword [esp + 0x38], 8
jb 0x1001f160
push dword [esp + 0x24]
call fcn.1002f7b8
add esp, 4
sub esp, 0x18
lea esi, [esp + 0xc4]
mov ecx, esp
xor eax, eax
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esp + 0x84]
push eax
call fcn.10001790
lea ecx, [esp + 0x3c]
call fcn.10004f40
add esp, 0x18
mov byte [esp + 0x2d8], 0x12
cmp dword [eax + 0x14], 0x10
jb 0x1001f1ab
mov eax, dword [eax]
mov edx, esi
mov ecx, eax
call fcn.10009d20
cmp dword [esp + 0x38], 0x10
jb 0x1001f1c7
push dword [esp + 0x24]
call fcn.1002f7b8
add esp, 4
mov byte [esp + 0x2d8], 4
cmp dword [esp + 0x78], 8
jb 0x1001f1e2
push dword [esp + 0x64]
call fcn.1002f7b8
add esp, 4
lea eax, [esp + 0xc]
push 0
push eax
call sym.SmUtils.dll_public:_static_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_CSmUtils::GetPath_enum_EMIPath_
push str.cmtact_
mov edx, eax
mov byte [esp + 0x2e4], 0x13
lea ecx, [esp + 0x88]
call fcn.10003a00
add esp, 0xc
mov byte [esp + 0x2d8], 0x15
cmp dword [esp + 0x20], 8
jb 0x1001f227
push dword [esp + 0xc]
call fcn.1002f7b8
add esp, 4
push 2
xor eax, eax
mov dword [esp + 0x24], 7
push 0x100f1f60
lea ecx, [esp + 0x84]
mov dword [esp + 0x24], 0
mov word [esp + 0x14], ax
call fcn.10003920
push 1
push 0x100f1828
lea ecx, [esp + 0x84]
call fcn.10003920
cmp word [0x1010a8be], 0
jne 0x1001f272
xor ecx, ecx
jmp 0x1001f28f
mov ecx, 0x1010a8be
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001f280
sub ecx, edx
sar ecx, 1
push ecx
push 0x1010a8be
lea ecx, [esp + 0x84]
call fcn.10003920
push 1
push 0x100f1824
lea ecx, [esp + 0x84]
call fcn.10003920
push 2
push 0x100f1f68
lea ecx, [esp + 0x84]
call fcn.10003920
push 1
push 0x100f1828
lea ecx, [esp + 0x84]
call fcn.10003920
cmp word [0x1010a7be], 0
jne 0x1001f2e8
xor ecx, ecx
jmp 0x1001f2ff
mov ecx, 0x1010a7be
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001f2f0
sub ecx, edx
sar ecx, 1
push ecx
push 0x1010a7be
lea ecx, [esp + 0x84]
call fcn.10003920
xor eax, eax
mov dword [esp + 0x78], 7
push 0xffffffffffffffff
push eax
mov word [esp + 0x6c], ax
lea ecx, [esp + 0x6c]
lea eax, [esp + 0x84]
mov dword [esp + 0x7c], 0
push eax
call fcn.10001790
sub esp, 0x18
mov byte [esp + 0x2f0], 0x16
mov ecx, esp
xor eax, eax
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esp + 0x84]
push eax
call fcn.10001790
mov ecx, sym.SmUtils.dll_class_CBehaviorAudit_CSmUtils::m_BehaviorAudit
call fcn.10008dc0
mov byte [esp + 0x2d8], 0x15
cmp dword [esp + 0x78], 8
jb 0x1001f391
push dword [esp + 0x64]
call fcn.1002f7b8
add esp, 4
sub esp, 0x18
xor eax, eax
mov edx, esp
mov dword [esp + 0x78], esp
mov dword [edx + 0x14], 7
mov dword [edx + 0x10], 0
mov word [edx], ax
cmp word [0x1010a7be], ax
jne 0x1001f3ba
xor ecx, ecx
jmp 0x1001f3d1
mov ecx, 0x1010a7be
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001f3c2
sub ecx, esi
sar ecx, 1
push ecx
push 0x1010a7be
mov ecx, edx
call fcn.10001b10
sub esp, 0x18
mov byte [esp + 0x308], 0x17
mov ecx, esp
mov dword [esp + 0x8c], esp
xor eax, eax
push 3
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push 0x100f23c8
mov word [ecx], ax
call fcn.10001b10
sub esp, 0x18
mov byte [esp + 0x320], 0x18
mov ecx, esp
mov dword [esp + 0xa0], esp
xor eax, eax
push 6
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push str.suswnd
mov word [ecx], ax
call fcn.10001b10
lea eax, [esp + 0x6c]
mov byte [esp + 0x320], 0x19
push 6
push eax
call sym.SmUtils.dll_public:_static_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_CSmUtils::GetPath_enum_EMIPath_
mov esi, eax
mov ecx, 0x100ef400
mov byte [esp + 0x328], 0x1a
call fcn.1000aff0
sub esp, 0x10
mov edx, esi
mov ecx, esp
push eax
call fcn.10003a00
add esp, 4
mov byte [esp + 0x338], 0x1b
call fcn.1000ae40
add esp, 0x60
cmp dword [esp + 0x38], 8
jb 0x1001f49f
push dword [esp + 0x24]
call fcn.1002f7b8
add esp, 4
cmp dword [esp + 0x90], 8
mov byte [0x1010a990], 1
jb 0x1001f4bc
push dword [esp + 0x7c]
call fcn.1002f7b8
add esp, 4
xor eax, eax
mov dword [esp + 0x90], 7
cmp dword [esp + 0xa8], 8
mov dword [esp + 0x8c], 0
mov word [esp + 0x7c], ax
jb 0x1001f4f2
push dword [esp + 0x94]
call fcn.1002f7b8
add esp, 4
xor eax, eax
mov dword [esp + 0xa8], 7
cmp dword [esp + 0xc0], 0x10
mov dword [esp + 0xa4], 0
mov word [esp + 0x94], ax
jb 0x1001f52b
push dword [esp + 0xac]
call fcn.1002f7b8
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x2d0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x2bc]
xor ecx, esp
call fcn.1002f7bd
mov esp, ebp
pop ebp
ret 4