Function at 0x100867a
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x5f4
mov eax, dword [0x101d6a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
or dword [ebp - 0x598], 0xffffffff
or dword [ebp - 0x5b0], 0xffffffff
mov dword [ebp - 0x5c8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x5d4], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x58c], eax
mov eax, dword [ebp + 0x18]
push ebx
push esi
mov dword [ebp - 0x5ec], eax
mov eax, dword [ebp + 0x1c]
xor ebx, ebx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x5cc], eax
mov eax, dword [ebp + 0x20]
mov esi, 0x128
push esi
mov dword [ebp - 0x5e8], eax
lea eax, [ebp - 0x264]
push ebx
push eax
mov dword [ebp - 0x5f0], edi
mov dword [ebp - 0x5d8], ebx
mov dword [ebp - 0x594], ebx
mov dword [ebp - 0x5c0], ebx
mov dword [ebp - 0x5b4], ebx
mov dword [ebp - 0x5a0], ebx
mov dword [ebp - 0x5b8], ebx
mov dword [ebp - 0x5ac], ebx
mov dword [ebp - 0x5c4], ebx
call fcn.0100b750
add esp, 0xc
mov dword [ebp - 0x264], esi
cmp edi, ebx
je 0x1009034
cmp dword [ebp - 0x5c8], ebx
je 0x1009034
cmp dword [ebp - 0x5d4], ebx
je 0x1009034
cmp dword [ebp - 0x58c], ebx
je 0x1009034
cmp dword [ebp - 0x5ec], ebx
je 0x1009034
cmp dword [ebp - 0x5cc], ebx
je 0x1009034
cmp dword [ebp - 0x5e8], ebx
je 0x1009034
add esi, 0xfffffff4
push esi
lea eax, [ebp - 0x13c]
push ebx
push eax
call fcn.0100b750
add esp, 0xc
lea eax, [ebp - 0x13c]
push eax
mov dword [ebp - 0x13c], esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x10087c8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1001d3c
push 4
call fcn.01005bd8
add esp, 0xc
mov eax, 0x80004005
jmp 0x1009039
push dword [ebp - 0x58c]
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea eax, [ebp - 0x598]
push eax
push 0x20019
push ebx
push 0x1001ce0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1008882
lea eax, [ebp - 0x594]
push eax
push ebx
push ebx
push ebx
mov esi, 0x1001cc8
push esi
push dword [ebp - 0x598]
call edi
test eax, eax
je 0x1008825
mov edi, 0x80004005
jmp 0x1008fe1
mov eax, dword [ebp - 0x594]
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0100aeb2
pop ecx
mov dword [ebp - 0x5c0], eax
cmp eax, ebx
jne 0x1008855
mov edi, 0x8007000e
jmp 0x1008f7d
mov ecx, dword [ebp - 0x594]
mov dword [ebp - 0x5d8], ecx
lea ecx, [ebp - 0x5d8]
push ecx
push eax
push ebx
push ebx
push esi
push dword [ebp - 0x598]
call edi
test eax, eax
je 0x1008889
mov edi, 0x80004005
jmp 0x1008f7d
or dword [ebp - 0x598], 0xffffffff
or dword [ebp - 0x59c], 0xffffffff
xor eax, eax
mov esi, 0x1001c60
mov dword [ebp - 0x5bc], ebx
mov dword [ebp - 0x5e0], ebx
mov dword [ebp - 0x584], ebx
mov dword [ebp - 0x588], ebx
cmp eax, esi
je 0x1008a0b
cmp eax, 0x1001c38
je 0x1008a0b
lea eax, [ebp - 0x5b4]
test eax, eax
je 0x1008a0b
lea eax, [ebp - 0x59c]
push eax
push 0x20019
push ebx
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10089d3
lea eax, [ebp - 0x5bc]
push eax
push ebx
push ebx
push ebx
push 0x1001c38
push dword [ebp - 0x59c]
call edi
cmp eax, 2
jne 0x100891c
mov dword [ebp - 0x588], 1
jmp 0x10089da
cmp eax, ebx
je 0x1008935
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1001470
call fcn.0100b6b5
pop ecx
pop ecx
jmp 0x10089ad
mov eax, dword [ebp - 0x5bc]
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0100aeb2
pop ecx
mov dword [ebp - 0x584], eax
cmp eax, ebx
jne 0x1008967
mov dword [ebp - 0x588], 0x8007000e
jmp 0x10089da
mov eax, dword [ebp - 0x5bc]
lea eax, [eax + eax + 2]
push eax
push ebx
push dword [ebp - 0x584]
call fcn.0100b750
mov eax, dword [ebp - 0x5bc]
add esp, 0xc
mov dword [ebp - 0x5e0], eax
lea eax, [ebp - 0x5e0]
push eax
push dword [ebp - 0x584]
push ebx
push ebx
push 0x1001c38
push dword [ebp - 0x59c]
call edi
test eax, eax
je 0x10089b9
mov dword [ebp - 0x588], 0x80004005
jmp 0x10089da
mov eax, dword [ebp - 0x584]
mov dword [ebp - 0x5b4], eax
mov eax, dword [ebp - 0x5bc]
mov dword [ebp - 0x594], eax
jmp 0x10089da
or dword [ebp - 0x59c], 0xffffffff
cmp dword [ebp - 0x59c], 0xffffffff
je 0x10089ef
push dword [ebp - 0x59c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x588], ebx
jge 0x1008a0b
cmp dword [ebp - 0x584], ebx
je 0x1008a0b
push dword [ebp - 0x584]
call fcn.0100ae38
pop ecx
or dword [ebp - 0x590], 0xffffffff
xor eax, eax
mov dword [ebp - 0x5a8], ebx
mov dword [ebp - 0x5dc], ebx
mov dword [ebp - 0x584], ebx
mov dword [ebp - 0x588], ebx
cmp eax, esi
je 0x1008b83
mov edi, 0x1001c14
cmp eax, edi
je 0x1008b83
lea eax, [ebp - 0x5a0]
test eax, eax
je 0x1008b83
lea eax, [ebp - 0x590]
push eax
push 0x20019
push ebx
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1008b4b
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x5a8]
push eax
push ebx
push ebx
push ebx
push edi
push dword [ebp - 0x590]
call esi
cmp eax, 2
jne 0x1008a9d
mov dword [ebp - 0x588], 1
jmp 0x1008b52
cmp eax, ebx
je 0x1008ab6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1001470
call fcn.0100b6b5
pop ecx
pop ecx
jmp 0x1008b25
mov eax, dword [ebp - 0x5a8]
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0100aeb2
pop ecx
mov dword [ebp - 0x584], eax
cmp eax, ebx
jne 0x1008ae8
mov dword [ebp - 0x588], 0x8007000e
jmp 0x1008b52
mov ecx, dword [ebp - 0x5a8]
lea ecx, [ecx + ecx + 2]
push ecx
push ebx
push eax
call fcn.0100b750
mov eax, dword [ebp - 0x5a8]
add esp, 0xc
mov dword [ebp - 0x5dc], eax
lea eax, [ebp - 0x5dc]
push eax
push dword [ebp - 0x584]
push ebx
push ebx
push edi
push dword [ebp - 0x590]
call esi
test eax, eax
je 0x1008b31
mov dword [ebp - 0x588], 0x80004005
jmp 0x1008b52
mov eax, dword [ebp - 0x584]
mov dword [ebp - 0x5a0], eax
mov eax, dword [ebp - 0x5a8]
mov dword [ebp - 0x594], eax
jmp 0x1008b52
or dword [ebp - 0x590], 0xffffffff
cmp dword [ebp - 0x590], 0xffffffff
je 0x1008b67
push dword [ebp - 0x590]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x588], ebx
jge 0x1008b83
cmp dword [ebp - 0x584], ebx
je 0x1008b83
push dword [ebp - 0x584]
call fcn.0100ae38
pop ecx
or dword [ebp - 0x588], 0xffffffff
xor ecx, ecx
mov eax, 0x1001bd0
mov dword [ebp - 0x5a4], ebx
mov dword [ebp - 0x5e4], ebx
mov dword [ebp - 0x584], ebx
mov dword [ebp - 0x58c], ebx
cmp ecx, eax
je 0x1008d0f
mov esi, 0x1001bb4
cmp ecx, esi
je 0x1008d0f
lea ecx, [ebp - 0x5b8]
test ecx, ecx
je 0x1008d0f
lea ecx, [ebp - 0x588]
push ecx
push 0x20019
push ebx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1008ccd
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x5a4]
push eax
push ebx
push ebx
push ebx
push esi
push dword [ebp - 0x588]
call edi
cmp eax, 2
jne 0x1008c1a
mov dword [ebp - 0x58c], 1
jmp 0x1008cd4
cmp eax, ebx
je 0x1008c33
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1001470
call fcn.0100b6b5
pop ecx
pop ecx
jmp 0x1008ca7
mov eax, dword [ebp - 0x5a4]
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0100aeb2
pop ecx
mov dword [ebp - 0x584], eax
cmp eax, ebx
jne 0x1008c65
mov dword [ebp - 0x58c], 0x8007000e
jmp 0x1008cd4
mov eax, dword [ebp - 0x5a4]
lea eax, [eax + eax + 2]
push eax
push ebx
push dword [ebp - 0x584]
call fcn.0100b750
mov eax, dword [ebp - 0x5a4]
add esp, 0xc
mov dword [ebp - 0x5e4], eax
lea eax, [ebp - 0x5e4]
push eax
push dword [ebp - 0x584]
push ebx
push ebx
push esi
push dword [ebp - 0x588]
call edi
test eax, eax
je 0x1008cb3
mov dword [ebp - 0x58c], 0x80004005
jmp 0x1008cd4
mov eax, dword [ebp - 0x584]
mov dword [ebp - 0x5b8], eax
mov eax, dword [ebp - 0x5a4]
mov dword [ebp - 0x594], eax
jmp 0x1008cd4
or dword [ebp - 0x588], 0xffffffff
cmp dword [ebp - 0x588], 0xffffffff
je 0x1008ce9
push dword [ebp - 0x588]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x58c]
cmp esi, ebx
jge 0x1008d07
cmp dword [ebp - 0x584], ebx
je 0x1008d07
push dword [ebp - 0x584]
call fcn.0100ae38
pop ecx
mov dword [ebp - 0x5d0], esi
jmp 0x1008d19
mov dword [ebp - 0x5d0], 0x80070057
push 0x12
push ebx
push ebx
push 0x10012d8
call dword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsA]
mov dword [ebp - 0x584], eax
cmp eax, 0xffffffff
jne 0x1008d4e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1001b58
push 4
call fcn.01005bd8
add esp, 0xc
jmp 0x1008878
lea ecx, [ebp - 0x20]
push ecx
push ebx
mov dword [ebp - 0x20], 0x1c
mov dword [ebp - 0x580], 0x31c
mov dword [ebp - 0x58c], ebx
push eax
jmp 0x1008e29
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x584]
mov dword [ebp - 0x25c], 0x4000000
call dword [sym.imp.SETUPAPI.dll_SetupDiSetDeviceInstallParamsA]
test eax, eax
je 0x1008eb1
push 2
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x584]
call dword [sym.imp.SETUPAPI.dll_SetupDiBuildDriverInfoList]
test eax, eax
je 0x1008eb1
lea eax, [ebp - 0x580]
push eax
push ebx
push 2
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x584]
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDriverInfoA]
test eax, eax
je 0x1008e8e
push 0x31c
call fcn.0100ae48
pop ecx
mov dword [ebp - 0x5f4], eax
cmp eax, ebx
je 0x1008ed1
mov edi, eax
mov ecx, 0xc7
lea esi, [ebp - 0x580]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x5c8]
mov eax, dword [ecx + 4]
lea edx, [ebp - 0x5f4]
push edx
push eax
call fcn.01008289
inc dword [ebp - 0x58c]
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x58c]
push dword [ebp - 0x584]
call dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
jne 0x1008d70
push 0x20019
push 1
push ebx
push 1
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x584]
call dword [sym.imp.SETUPAPI.dll_SetupDiOpenDevRegKey]
mov dword [ebp - 0x5b0], eax
cmp eax, 0xffffffff
je 0x1008eb1
mov esi, dword [sym.imp.ADVAPI32.dll_RegGetValueW]
lea eax, [ebp - 0x5c4]
push eax
push ebx
push ebx
push 8
push ebx
mov edi, 0x1001b30
push edi
push dword [ebp - 0x5b0]
call esi
cmp eax, 2
jne 0x1008ea6
mov eax, dword [ebp - 0x5cc]
mov dword [eax], ebx
jmp 0x1008f12
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1001b04
push 4
call fcn.01005bd8
add esp, 0xc
jmp 0x1008eb1
cmp eax, 0xea
je 0x1008ebb
cmp eax, ebx
je 0x1008ebb
mov edi, 0x80004005
jmp 0x1008f57
push dword [ebp - 0x5c4]
call fcn.0100aeb2
pop ecx
mov dword [ebp - 0x5ac], eax
cmp eax, ebx
jne 0x1008ed8
mov edi, 0x8007000e
jmp 0x1008f57
lea eax, [ebp - 0x5c4]
push eax
push dword [ebp - 0x5ac]
push ebx
push 8
push ebx
push edi
push dword [ebp - 0x5b0]
call esi
test eax, eax
jne 0x1008eb1
mov eax, dword [ebp - 0x5c4]
mov ecx, dword [ebp - 0x5cc]
mov dword [ecx], eax
mov eax, dword [ebp - 0x5ec]
mov ecx, dword [ebp - 0x5ac]
mov dword [eax], ecx
mov edi, dword [ebp - 0x5f0]
mov eax, dword [ebp - 0x5c0]
push 0x27
pop ecx
lea esi, [ebp - 0x13c]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x5d4]
mov edi, dword [ebp - 0x5d0]
mov dword [ecx], eax
mov eax, dword [ebp - 0x5e8]
mov ecx, dword [ebp - 0x5b4]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x5a0]
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 0x5b8]
mov dword [eax + 8], ecx
push 2
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x584]
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDriverInfoList]
push dword [ebp - 0x584]
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
cmp edi, ebx
jge 0x1009006
cmp dword [ebp - 0x5c0], ebx
je 0x1008f91
push dword [ebp - 0x5c0]
call fcn.0100ae38
pop ecx
cmp dword [ebp - 0x5ac], ebx
je 0x1008fa5
push dword [ebp - 0x5ac]
call fcn.0100ae38
pop ecx
cmp dword [ebp - 0x5b4], ebx
je 0x1008fb9
push dword [ebp - 0x5b4]
call fcn.0100ae38
pop ecx
cmp dword [ebp - 0x5a0], ebx
je 0x1008fcd
push dword [ebp - 0x5a0]
call fcn.0100ae38
pop ecx
cmp dword [ebp - 0x5b8], ebx
je 0x1008fe1
push dword [ebp - 0x5b8]
call fcn.0100ae38
pop ecx
mov eax, dword [ebp - 0x5c8]
mov eax, dword [eax + 4]
mov esi, dword [eax]
cmp esi, eax
je 0x1009006
push dword [esi + 8]
call fcn.0100ae38
mov esi, dword [esi]
mov eax, dword [ebp - 0x5c8]
pop ecx
cmp esi, dword [eax + 4]
jne 0x1008ff0
cmp dword [ebp - 0x598], 0xffffffff
je 0x100901b
push dword [ebp - 0x598]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x5b0], 0xffffffff
je 0x1009030
push dword [ebp - 0x5b0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x1009039
mov eax, 0x80070057
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100b6a0
leave
ret 0x1c