Function at 0x1001ce4e
Capabilities:
Delete directory
Enumerate files on windows
Query or enumerate registry key
Set current directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb44
push ebx
push esi
push edi
mov edi, dword [ebp + 0x24]
xor ebx, ebx
cmp edi, ebx
je 0x1001ce65
mov dword [edi], ebx
cmp dword [ebp + 0x1c], ebx
je 0x1001ceb3
mov esi, str.MyWebSearch_Email_Plugin
push str.mwsoemon.exe
push esi
push dword [ebp + 8]
call fcn.1001da21
push esi
push edi
call fcn.1001dc60
push edi
call fcn.1001ddb4
push edi
call fcn.1001de97
push str.f3pssavr.scr
push edi
call fcn.1001df27
push edi
call fcn.1001e0e1
call fcn.100287ff
push str.SoftwareMyWebSearch_bar
call fcn.1001dfb6
add esp, 0x2c
mov esi, dword [ebp + 0xc]
cmp esi, ebx
je 0x1001d06d
cmp word [esi], bx
je 0x1001d06d
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x4e20
jge 0x1001d06d
mov edi, esi
mov dword [ebp + 0xc], edi
mov cx, word [edi]
mov dword [ebp + 0x1c], ebx
cmp cx, bx
je 0x1001d045
mov eax, edi
cmp cx, 0xd
je 0x1001cf08
cmp word [eax], 0xa
je 0x1001cf08
inc dword [ebp + 0x1c]
inc eax
inc eax
mov cx, word [eax]
cmp cx, bx
jne 0x1001ceef
cmp dword [ebp + 0x1c], ebx
jle 0x1001d045
cmp edi, ebx
jne 0x1001cf19
xor esi, esi
jmp 0x1001cf5b
mov eax, dword [ebp + 0x1c]
lea esi, [eax + eax + 2]
mov eax, esi
add eax, 3
and al, 0xfc
call fcn.100392b0
mov edi, esp
cmp edi, ebx
je 0x1001cf50
push ebx
push ebx
push esi
push edi
push dword [ebp + 0x1c]
mov byte [edi], bl
push dword [ebp + 0xc]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
neg esi
sbb esi, esi
and esi, edi
jmp 0x1001cf52
xor esi, esi
mov eax, dword [ebp + 0x1c]
mov edi, dword [ebp + 0xc]
mov byte [esi + eax], bl
push 1
push ebx
push esi
call fcn.100204a6
lea eax, [ebp - 0x464]
push 0x3e8
push eax
push esi
call fcn.10020306
add esp, 0x18
test eax, eax
jne 0x1001d159
push 6
push str.HKCU__
push esi
call fcn.1001416f
add esp, 0xc
test eax, eax
jne 0x1001d045
add esi, 6
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x658]
push str.HKUR__
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edi, 0x1ea
lea eax, [ebp - 0x652]
sub edi, dword [ebp - 8]
mov dword [ebp - 4], 1
push edi
push eax
push ebx
push VariantInit
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x1001d042
lea eax, [ebp - 0x658]
push 0x10041064
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x658]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 1
lea eax, [ebp - 0x658]
push ebx
push eax
call fcn.100204a6
lea eax, [ebp - 0x464]
push 0x3e8
push eax
lea eax, [ebp - 0x658]
push eax
call fcn.10020306
add esp, 0x18
test eax, eax
jne 0x1001d159
mov eax, dword [ebp - 4]
inc dword [ebp - 4]
lea ecx, [ebp - 0x652]
push edi
push ecx
push eax
jmp 0x1001cfd0
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x1c]
lea edi, [edi + eax*2]
mov dword [ebp + 0xc], edi
mov ax, word [edi]
cmp ax, 0xd
je 0x1001d05d
cmp ax, 0xa
jne 0x1001d061
inc edi
inc edi
jmp 0x1001d04e
cmp word [edi], bx
mov dword [ebp + 0xc], edi
jne 0x1001cede
cmp dword [ebp + 0x10], ebx
je 0x1001d874
cmp dword [ebp + 0x14], ebx
je 0x1001d874
mov eax, dword [ebp + 0x10]
cmp word [eax], bx
je 0x1001d874
mov eax, dword [ebp + 0x14]
cmp word [eax], bx
je 0x1001d874
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x12c
jge 0x1001d874
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x2710
jge 0x1001d874
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [eax + eax + 2]
mov eax, edi
add eax, 3
and al, 0xfc
call fcn.100392b0
mov esi, esp
push ebx
push ebx
push edi
push esi
push 0xffffffffffffffff
push dword [ebp + 0x10]
mov byte [esi], bl
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [ebp - 0x464]
push 0x3e8
push eax
push esi
call fcn.10020306
add esp, 0xc
test eax, eax
je 0x1001d159
cmp byte [ebp - 0x464], bl
je 0x1001d159
mov edi, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov esi, 0x3e7
lea eax, [ebp - 0x464]
push esi
push eax
lea eax, [ebp - 0x464]
push eax
call edi
cmp eax, esi
jae 0x1001d159
cmp eax, ebx
jbe 0x1001d159
cmp dword [ebp + 0x20], ebx
mov esi, 0x12b
jne 0x1001d160
lea eax, [ebp - 0x784]
push esi
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x1001d159
cmp byte [ebp - 0x784], bl
jne 0x1001d180
xor eax, eax
jmp 0x1001da16
push dword [ebp + 0x20]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0x12c
jae 0x1001d159
push dword [ebp + 0x20]
lea eax, [ebp - 0x784]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x784]
push esi
push eax
lea eax, [ebp - 0x784]
push eax
call edi
cmp eax, esi
jae 0x1001d159
cmp eax, ebx
jbe 0x1001d159
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp - 0x464]
push eax
call edi
mov esi, eax
lea eax, [ebp - 0x784]
push 0x5c
push eax
call fcn.1001401f
pop ecx
cmp eax, ebx
pop ecx
je 0x1001d1da
lea ecx, [ebp - 0x782]
cmp eax, ecx
jbe 0x1001d1da
mov byte [eax + 1], bl
lea eax, [ebp - 0x784]
push eax
call edi
cmp eax, esi
jge 0x1001d1da
mov esi, eax
lea eax, [ebp - 0x784]
push esi
push eax
lea eax, [ebp - 0x464]
push eax
call fcn.1001416f
add esp, 0xc
test eax, eax
jne 0x1001d159
lea eax, [ebp - 0x464]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov eax, dword [ebp + 0x14]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0x1c], ebx
mov cx, word [eax]
cmp cx, bx
je 0x1001d849
cmp cx, 0xd
je 0x1001d237
cmp word [eax], 0xa
je 0x1001d237
inc dword [ebp + 0x1c]
inc eax
inc eax
mov cx, word [eax]
cmp cx, bx
jne 0x1001d21e
cmp dword [ebp + 0x1c], ebx
jle 0x1001d849
cmp dword [ebp + 0xc], ebx
jne 0x1001d24a
mov dword [ebp + 0x10], ebx
jmp 0x1001d28e
mov eax, dword [ebp + 0x1c]
lea edi, [eax + eax + 2]
mov eax, edi
add eax, 3
and al, 0xfc
call fcn.100392b0
mov esi, esp
cmp esi, ebx
je 0x1001d282
push ebx
push ebx
push edi
push esi
push dword [ebp + 0x1c]
mov byte [esi], bl
push dword [ebp + 0xc]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
neg eax
sbb eax, eax
and eax, esi
mov dword [ebp + 0x10], eax
jmp 0x1001d285
mov dword [ebp + 0x10], ebx
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x10]
mov byte [ecx + eax], bl
lea eax, [ebp - 0x464]
push 0x3e8
push eax
push dword [ebp + 0x10]
call fcn.10020306
add esp, 0xc
test eax, eax
je 0x1001d849
cmp byte [ebp - 0x464], bl
je 0x1001d849
mov esi, dword [ebp + 0x10]
push 6
push str.HKCU__
push esi
mov dword [ebp - 4], ebx
call fcn.1001416f
add esp, 0xc
test eax, eax
jne 0x1001d2fb
add esi, 6
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x658]
push str.HKUR__
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp + 0x20], 1
jmp 0x1001d2fe
mov dword [ebp + 0x20], ebx
lea eax, [ebp - 0x464]
push 0x3e7
push eax
lea eax, [ebp - 0x464]
push eax
mov byte [ebp - 0x7c], bl
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov edi, eax
cmp edi, ebx
jne 0x1001d428
lea eax, [ebp - 0x464]
push 0x2a
push eax
call fcn.10013bf5
mov esi, eax
lea eax, [ebp - 0x464]
push 0x3f
push eax
call fcn.10013bf5
add esp, 0x10
cmp esi, ebx
je 0x1001d351
cmp eax, ebx
je 0x1001d353
cmp eax, esi
jae 0x1001d353
mov esi, eax
cmp esi, ebx
je 0x1001d7a8
lea eax, [ebp - 0x464]
cmp esi, eax
jbe 0x1001d7a8
dec esi
lea eax, [ebp - 0x464]
cmp esi, eax
jbe 0x1001d379
cmp byte [esi], 0x5c
jne 0x1001d369
cmp esi, ebx
je 0x1001d7a8
cmp byte [esi], 0x5c
jne 0x1001d7a8
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0x64
jae 0x1001d7a8
lea eax, [ebp - 0x7c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x464]
push 0x3e7
push eax
lea eax, [ebp - 0x464]
push eax
mov byte [esi], bl
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov edi, eax
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, edi
cmp eax, 0x3e7
jae 0x1001d425
cmp edi, ebx
jbe 0x1001d425
lea eax, [ebp - 0x7b]
push 0x5c
push eax
call fcn.10013bf5
mov esi, eax
pop ecx
cmp esi, ebx
pop ecx
je 0x1001d3f7
cmp byte [esi + 1], bl
jne 0x1001d3f5
xor esi, esi
jmp 0x1001d3f7
mov byte [esi], bl
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x464]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp esi, ebx
je 0x1001d425
inc esi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x7b]
push esi
push eax
call fcn.10013c80
add esp, 0xc
jmp 0x1001d428
mov byte [ebp - 0x7c], bl
cmp edi, 0x3e7
jae 0x1001d7a8
cmp edi, ebx
jbe 0x1001d7a8
lea eax, [ebp - 0x464]
push 0x5c
push eax
call fcn.1001401f
pop ecx
cmp eax, ebx
pop ecx
je 0x1001d7a8
cmp byte [eax + 1], bl
jne 0x1001d46b
mov byte [eax], bl
lea eax, [ebp - 0x464]
push 0x5c
push eax
call fcn.1001401f
pop ecx
pop ecx
cmp eax, ebx
je 0x1001d7a8
cmp byte [eax + 1], bl
lea edi, [eax + 1]
mov dword [ebp + 0x14], edi
je 0x1001d7a8
lea eax, [ebp - 0x8c4]
push eax
lea eax, [ebp - 0x464]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
je 0x1001d7a8
lea eax, [ebp - 0x898]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp - 0x8c4]
and eax, 0x10
cmp al, 0x10
jne 0x1001d70e
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp - 0x7c]
push eax
call esi
mov edx, eax
lea eax, [ebp - 0x464]
push eax
mov dword [ebp + 8], edx
call esi
mov ecx, dword [ebp + 8]
add ecx, eax
cmp ecx, 0x3e8
jae 0x1001d70e
cmp byte [ebp - 0x7c], bl
mov eax, str..
je 0x1001d4f9
lea eax, [ebp - 0x7c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0xa04]
push eax
lea eax, [ebp - 0x464]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0xc], eax
je 0x1001d6fc
lea eax, [ebp - 0x9d8]
push eax
lea eax, [ebp - 0x898]
push eax
push str._s_s
push dword [ebp + 0x14]
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [ebp - 0xa04]
add esp, 0x10
and eax, 0x10
xor ecx, ecx
cmp al, 0x10
setne cl
mov esi, ecx
cmp esi, ebx
jne 0x1001d585
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpA]
lea eax, [ebp - 0x9d8]
push 0x100429b8
push eax
call edi
test eax, eax
je 0x1001d585
lea eax, [ebp - 0x9d8]
push 0x100429b4
push eax
call edi
test eax, eax
je 0x1001d585
push 1
pop edi
jmp 0x1001d587
xor edi, edi
lea eax, [ebp - 0xa04]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
cmp esi, ebx
mov dword [ebp + 8], eax
je 0x1001d5e3
lea eax, [ebp - 0x464]
push 0x20
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x464]
push eax
call fcn.1001c8b7
test eax, eax
pop ecx
jne 0x1001d6e7
lea eax, [ebp - 0x464]
push 1
push eax
call fcn.1001cbf4
cmp dword [ebp + 0x24], ebx
pop ecx
pop ecx
je 0x1001d6e7
mov eax, dword [ebp + 0x24]
jmp 0x1001d6e1
cmp edi, ebx
je 0x1001d6e7
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
push str..
add esi, dword [ebp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0xb44]
push eax
lea eax, [ebp - 0x464]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x1001d6b1
lea eax, [ebp - 0xb18]
push eax
push 0x100429b0
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [ebp - 0xb44]
add esp, 0xc
and eax, 0x10
xor ecx, ecx
cmp al, 0x10
lea eax, [ebp - 0xb44]
setne cl
push eax
push edi
mov dword [ebp - 0x14], ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
cmp dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], eax
je 0x1001d6a1
lea eax, [ebp - 0x464]
push 0x20
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x464]
push eax
call fcn.1001c8b7
test eax, eax
pop ecx
jne 0x1001d6a1
lea eax, [ebp - 0x464]
push 1
push eax
call fcn.1001cbf4
cmp dword [ebp + 0x24], ebx
pop ecx
pop ecx
je 0x1001d6a1
mov eax, dword [ebp + 0x24]
mov dword [eax], 1
cmp dword [ebp - 0x18], ebx
jne 0x1001d624
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebx
mov byte [esi], bl
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [ebp - 0x464]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x1001d6e7
lea eax, [ebp - 0x464]
push ebx
push eax
call fcn.1001cbf4
mov eax, dword [ebp + 0x24]
pop ecx
cmp eax, ebx
pop ecx
je 0x1001d6e7
mov dword [eax], 1
cmp dword [ebp + 8], ebx
jne 0x1001d521
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edi, dword [ebp + 0x14]
lea eax, [ebp - 0x898]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor esi, esi
jmp 0x1001d711
push 1
pop esi
lea eax, [ebp - 0x8c4]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
cmp esi, ebx
mov dword [ebp + 8], eax
je 0x1001d762
lea eax, [ebp - 0x464]
push 0x20
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x464]
push eax
call fcn.1001c8b7
test eax, eax
pop ecx
jne 0x1001d796
lea eax, [ebp - 0x464]
push 1
push eax
call fcn.1001cbf4
cmp dword [ebp + 0x24], ebx
pop ecx
pop ecx
je 0x1001d796
mov eax, dword [ebp + 0x24]
jmp 0x1001d790
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [ebp - 0x464]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x1001d796
lea eax, [ebp - 0x464]
push ebx
push eax
call fcn.1001cbf4
mov eax, dword [ebp + 0x24]
pop ecx
cmp eax, ebx
pop ecx
je 0x1001d796
mov dword [eax], 1
cmp dword [ebp + 8], ebx
jne 0x1001d4a2
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 0x20], ebx
je 0x1001d849
mov eax, dword [ebp - 4]
mov esi, 0x1ea
sub esi, dword [ebp - 8]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
inc dword [ebp - 4]
lea ecx, [ebp - 0x652]
push esi
push ecx
push eax
push VariantInit
call edi
test eax, eax
jne 0x1001d83d
mov eax, dword [ebp + 0x10]
add eax, 6
mov dword [ebp + 0x14], eax
lea eax, [ebp - 0x658]
push 0x10041064
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push dword [ebp + 0x14]
lea eax, [ebp - 0x658]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x464]
push 0x3e8
push eax
lea eax, [ebp - 0x658]
push eax
call fcn.10020306
add esp, 0xc
test eax, eax
jne 0x1001d840
mov eax, dword [ebp - 4]
inc dword [ebp - 4]
lea ecx, [ebp - 0x652]
push esi
push ecx
push eax
push VariantInit
call edi
test eax, eax
je 0x1001d7e2
mov dword [ebp + 0x20], ebx
cmp dword [ebp + 0x20], ebx
jne 0x1001d2fe
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x1c]
lea ecx, [eax + ecx*2]
mov dword [ebp + 0xc], ecx
mov ax, word [ecx]
cmp ax, 0xd
je 0x1001d864
cmp ax, 0xa
jne 0x1001d868
inc ecx
inc ecx
jmp 0x1001d855
cmp word [ecx], bx
mov dword [ebp + 0xc], ecx
jne 0x1001d20c
mov esi, dword [ebp + 0x18]
cmp esi, ebx
je 0x1001da13
cmp word [esi], bx
je 0x1001da13
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x2710
jge 0x1001da13
mov eax, esi
push 1
mov dword [ebp + 0xc], eax
pop edi
mov dx, word [eax]
mov dword [ebp + 0x1c], ebx
cmp dx, bx
je 0x1001d9e7
mov ecx, eax
cmp dx, 0xd
je 0x1001d8cc
cmp word [ecx], 0xa
je 0x1001d8cc
inc dword [ebp + 0x1c]
inc ecx
inc ecx
mov dx, word [ecx]
cmp dx, bx
jne 0x1001d8b3
cmp dword [ebp + 0x1c], ebx
jle 0x1001d9e7
cmp eax, ebx
jne 0x1001d8dd
xor esi, esi
jmp 0x1001d91c
mov eax, dword [ebp + 0x1c]
lea esi, [eax + eax + 2]
mov eax, esi
add eax, 3
and al, 0xfc
call fcn.100392b0
mov edi, esp
cmp edi, ebx
je 0x1001d914
push ebx
push ebx
push esi
push edi
push dword [ebp + 0x1c]
mov byte [edi], bl
push dword [ebp + 0xc]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
neg esi
sbb esi, esi
and esi, edi
jmp 0x1001d916
xor esi, esi
mov eax, dword [ebp + 0x1c]
mov byte [esi + eax], bl
push 1
push ebx
push esi
call fcn.100204a6
lea eax, [ebp - 0x464]
push 0x3e8
push eax
push esi
call fcn.10020306
mov edi, eax
push 6
neg edi
sbb edi, edi
push str.HKCU__
push esi
inc edi
call fcn.1001416f
add esp, 0x24
test eax, eax
jne 0x1001d9e4
add esi, 6
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x658]
push str.HKUR__
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, 0x1ea
mov dword [ebp - 4], 1
sub eax, dword [ebp - 8]
mov dword [ebp + 0x24], eax
push eax
lea eax, [ebp - 0x652]
push eax
push ebx
push VariantInit
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x1001d9e4
lea eax, [ebp - 0x658]
push 0x10041064
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x658]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 1
lea eax, [ebp - 0x658]
push ebx
push eax
call fcn.100204a6
mov eax, dword [ebp - 4]
add esp, 0xc
inc dword [ebp - 4]
lea ecx, [ebp - 0x652]
push dword [ebp + 0x24]
push ecx
push eax
jmp 0x1001d990
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x1c]
lea eax, [eax + ecx*2]
mov dword [ebp + 0xc], eax
mov cx, word [eax]
cmp cx, 0xd
je 0x1001d9ff
cmp cx, 0xa
jne 0x1001da03
inc eax
inc eax
jmp 0x1001d9f0
cmp word [eax], bx
mov dword [ebp + 0xc], eax
jne 0x1001d8a2
mov eax, edi
jmp 0x1001da16
push 1
pop eax
lea esp, [ebp - 0xb50]
pop edi
pop esi
pop ebx
leave
ret