Function at 0x1001df20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
lea eax, [ebp - 4]
mov dword [ebp - 0x14], ecx
push eax
push 0x20019
push 0
push str.SoftwareCLASSESFASTPROXY
push reloc.ODBC32.dll_SQLAllocEnv
mov dword [ecx + 0x1990], 0
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1001e195
push ebx
push esi
mov dword [ebp - 8], eax
push edi
nop word [eax + eax]
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x10], 0x100
push ecx
lea ecx, [ebp - 0x154]
mov dword [ebp - 0xc], 0x100
push ecx
push 0
push 0
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x254]
push ecx
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x1001e154
lea eax, [ebp - 0x154]
xor edi, edi
push eax
xor esi, esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, eax
test edx, edx
jle 0x1001e114
mov ecx, esi
cmp esi, edx
jge 0x1001dfe9
nop dword [eax + eax]
cmp byte [ebp + ecx - 0x154], 0x3a
je 0x1001dfe1
inc ecx
cmp ecx, edx
jl 0x1001dfd0
jmp 0x1001dfe9
mov byte [ebp + ecx - 0x154], 0
lea eax, [ebp - 0x154]
add eax, esi
lea esi, [ecx + 1]
mov dword [ebp + edi*4 - 0x54], eax
inc edi
cmp edi, 0x10
je 0x1001e002
cmp esi, edx
jl 0x1001dfc5
cmp edi, 6
jne 0x1001e114
mov ecx, dword [ebp - 0x50]
xor eax, eax
xor edi, edi
mov dh, byte [ecx]
cmp dh, 0x2d
sete al
mov dl, byte [eax + ecx]
lea esi, [eax + ecx]
test dl, dl
je 0x1001e042
lea eax, [edx - 0x30]
cmp al, 9
ja 0x1001e128
inc esi
movsx eax, dl
lea edi, [edi + edi*4]
lea edi, [edi - 0x18]
mov dl, byte [esi]
lea edi, [eax + edi*2]
test dl, dl
jne 0x1001e024
mov ecx, dword [ebp - 0x4c]
mov ebx, edi
neg ebx
cmp dh, 0x2d
cmovne ebx, edi
xor edi, edi
mov dh, byte [ecx]
xor eax, eax
cmp dh, 0x2d
sete al
mov dl, byte [eax + ecx]
lea esi, [eax + ecx]
test dl, dl
je 0x1001e083
lea eax, [edx - 0x30]
cmp al, 9
ja 0x1001e13e
inc esi
movsx eax, dl
lea edi, [edi + edi*4]
lea edi, [edi - 0x18]
mov dl, byte [esi]
lea edi, [eax + edi*2]
test dl, dl
jne 0x1001e065
mov esi, dword [ebp - 0x14]
mov ecx, edi
neg ecx
cmp dh, 0x2d
push 0x40
cmovne ecx, edi
imul eax, dword [esi + 0x1990], 0xc4
push dword [ebp - 0x54]
mov word [eax + esi + 0x112], bx
imul eax, dword [esi + 0x1990], 0xc4
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov word [eax + esi + 0x110], cx
imul eax, dword [esi + 0x1990], 0xc4
add eax, 0x114
add eax, esi
push eax
call ebx
imul eax, dword [esi + 0x1990], 0xc4
push 0x40
push dword [ebp - 0x48]
add eax, 0x154
add eax, esi
push eax
call ebx
imul eax, dword [esi + 0x1990], 0xc4
push 0x40
push dword [ebp - 0x44]
add eax, 0x194
add eax, esi
push eax
call ebx
inc dword [esi + 0x1990]
cmp dword [esi + 0x1990], 0x20
jge 0x1001e16f
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp eax, 0x3e8
jl 0x1001df70
jmp 0x1001e16f
push 0
mov edx, 0x171
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXSetting.cpp
call fcn.10024152
add esp, 4
jmp 0x1001e114
push 0
mov edx, 0x176
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXSetting.cpp
call fcn.10024152
add esp, 4
jmp 0x1001e114
cmp eax, 0x103
je 0x1001e16f
push 0
mov edx, 0x15b
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXSetting.cpp
call fcn.10024152
add esp, 4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
test eax, eax
je 0x1001e193
push 0
mov edx, 0x189
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXSetting.cpp
call fcn.10024152
add esp, 4
xor eax, eax
mov esp, ebp
pop ebp
ret