Function at 0x1001efb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x564
push ebx
push esi
push edi
push 6
pop ecx
mov esi, 0x1001270
lea edi, [ebp - 0x2d8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor eax, eax
mov ecx, 0x9c
lea edi, [ebp - 0x2be]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov eax, 0x32f4
xor ebx, ebx
push eax
push ebx
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], ebx
call edi
mov esi, eax
cmp esi, ebx
je 0x1002017
lea eax, [ebp - 0x2d8]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.ntdll.dll_RtlInitString]
push 1
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.ntdll.dll_RtlAnsiStringToUnicodeString]
push ebx
push ebx
push ebx
push 3
push 3
push 0x80
lea eax, [ebp - 0x28]
mov dword [ebp - 0x38], eax
push ebx
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x40]
push eax
push 0x20100000
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x40], 0x18
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x34], 0x40
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
call dword [sym.imp.ntdll.dll_NtCreateFile]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
cmp dword [ebp - 8], ebx
jge 0x1001fc9
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x100208e
push ebx
push ebx
push 0x2100d6
push dword [ebp - 4]
push esi
push dword [ebp - 0x10]
call fcn.01001508
cmp eax, 0x80000005
mov dword [ebp - 8], eax
jne 0x1002021
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 4]
add eax, eax
cmp eax, 0xffff
mov dword [ebp - 4], eax
jae 0x1002006
push eax
push ebx
call edi
mov esi, eax
cmp esi, ebx
jne 0x1001fc9
push dword [ebp - 0x10]
call dword [sym.imp.ntdll.dll_NtClose]
push ebx
push 0x10
call fcn.01002745
mov eax, 0xc000009a
jmp 0x1002171
cmp eax, ebx
jne 0x100207e
push dword [ebp - 0x10]
call dword [sym.imp.ntdll.dll_NtClose]
cmp dword [esi], ebx
mov dword [ebp - 4], ebx
jle 0x10020e5
lea eax, [esi + 8]
xor edi, edi
mov dword [ebp - 8], eax
push ebx
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.ntdll.dll_RtlInitString]
push dword [ebp - 8]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push 1
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.ntdll.dll_RtlUnicodeStringToAnsiString]
test eax, eax
jl 0x10020d0
cmp word [ebp - 0x1c], 0x28a
jbe 0x1002096
mov dword [ebp - 0xc], 0x28a
jmp 0x100209d
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0x10]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, dword [ebp - 8]
jmp 0x1002171
movzx eax, word [ebp - 0x1c]
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
lea eax, [edi + 0x1003320]
push dword [ebp - 0x18]
push eax
call dword [sym.imp.msvcrt.dll_strncpy]
mov eax, dword [ebp - 0xc]
mov byte [edi + eax + 0x1003320], bl
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.ntdll.dll_RtlFreeAnsiString]
inc dword [ebp - 0x14]
add edi, 0x28b
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
add dword [ebp - 8], 0x518
cmp eax, dword [esi]
jl 0x1002041
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x14]
cmp eax, 0x40
jae 0x1002102
mov ecx, eax
imul ecx, ecx, 0x28b
mov byte [ecx + 0x1003320], bl
mov dword [0x10032ec], eax
lea eax, [ebp - 0x20]
push eax
push 0x20019
push ebx
push 0x100123c
push 0x80000002
mov dword [ebp - 0xc], 0x28a
mov byte [0x100d880], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100216f
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x564]
push eax
lea eax, [ebp - 0x44]
push eax
push ebx
push 0x1001234
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1002166
mov cl, byte [ebp + eax - 0x564]
mov byte [eax + 0x100d880], cl
inc eax
cmp cl, bl
jne 0x1002154
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret