Function at 0x100128ba
Capabilities:
Create thread
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d0
mov eax, dword [0x1002b1f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 0x290], esi
mov dword [ebp - 0x290], ebp
xor ebx, ebx
inc ebx
push ebx
push dword [ebp - 0x290]
push str.int___cdecl_SendSystemInfoStat_wchar_t__
call fcn.1000b484
mov edi, eax
add esp, 0xc
mov eax, 0x10023878
cmp edi, esi
jne 0x10012902
mov edi, eax
push esi
push esi
push esi
push esi
push eax
push 0x1002384c
push edi
lea ecx, [ebp - 0x2d0]
call fcn.1000a370
cmp edi, esi
jne 0x1001291e
push ebp
pop ebp
cmp dword [ebp + 8], esi
je 0x10012b93
push str.umachine
lea ecx, [ebp - 0x288]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
lea eax, [ebp - 0x64]
push str.0000000000000000
push eax
call dword [sym.imp.MSVCR90.dll_wcscpy]
pop ecx
pop ecx
lea eax, [ebp - 0x28c]
push eax
push str.SOFTWAREThunder_NetworkXmp
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x28c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x100129cb
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x298]
push eax
push esi
push str.PeerId
push dword [ebp - 0x28c]
mov dword [ebp - 0x298], ebx
mov dword [ebp - 0x29c], 0x3f
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push str.u1
lea ecx, [ebp - 0x288]
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x288]
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
push dword [ebp - 0x28c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.u2
lea ecx, [ebp - 0x288]
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
lea eax, [ebp - 0x2b8]
push eax
call fcn.1000cdb8
pop ecx
push eax
lea ecx, [ebp - 0x288]
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
lea ecx, [ebp - 0x2b8]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
push str.u3
lea ecx, [ebp - 0x288]
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
lea eax, [ebp - 0x2b8]
push eax
call fcn.1000cc6f
pop ecx
push eax
lea ecx, [ebp - 0x288]
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
lea ecx, [ebp - 0x2b8]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
push 7
xor eax, eax
pop ecx
mov word [ebp - 0x24], ax
lea edi, [ebp - 0x22]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push esi
call edi
mov esi, dword [sym.imp.MSVCR90.dll__swprintf]
push eax
mov ebx, 0x1001b67c
lea eax, [ebp - 0x24]
push ebx
push eax
call esi
add esp, 0xc
push str.u4
lea ecx, [ebp - 0x288]
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x288]
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
push 1
call edi
push 0x10
mov dword [ebp - 0x298], eax
xor edi, edi
lea eax, [ebp - 0x24]
push edi
push eax
call sub.MSVCR90.dll_memset
push dword [ebp - 0x298]
lea eax, [ebp - 0x24]
push ebx
push eax
call esi
add esp, 0x18
push str.u5
lea ecx, [ebp - 0x288]
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x288]
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
xor eax, eax
push 0x206
mov word [ebp - 0x26c], ax
lea eax, [ebp - 0x26a]
push edi
push eax
call sub.MSVCR90.dll_memset
mov ebx, dword [ebp - 0x284]
add esp, 0xc
cmp dword [ebp - 0x270], 8
jae 0x10012b05
lea ebx, [ebp - 0x284]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push ebx
lea eax, [ebp - 0x26c]
push str.http:__kkpgv2.stat.kankan.com___srd_d
push eax
call esi
mov esi, 0x10023794
push esi
call fcn.10005425
add esp, 0x14
test eax, eax
jne 0x10012b4d
push 1
lea eax, [ebp - 0x26c]
push eax
push edi
push esi
call fcn.10009855
pop ecx
pop ecx
mov ecx, eax
call fcn.100016a4
mov ecx, eax
call fcn.1000a33f
lea eax, [ebp - 0x26c]
push eax
lea ecx, [ebp - 0x298]
call fcn.100052f3
lea eax, [ebp - 0x294]
push eax
push edi
push dword [ebp - 0x298]
mov dword [ebp - 0x294], edi
push 0x1000de52
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
push edi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea ecx, [ebp - 0x288]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [ebp - 0x2d0]
call fcn.1000be71
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.10018dd2
leave
ret