Function at 0x1001f4f
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x56c
mov eax, dword [0x1004008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 6
pop ecx
mov esi, 0x1001218
lea edi, [ebp - 0x290]
rep movsd dword es:[edi], dword [esi]
push 0x270
xor ebx, ebx
lea eax, [ebp - 0x276]
push ebx
push eax
movsw word es:[edi], word [esi]
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x290]
push eax
lea eax, [ebp - 0x530]
push eax
mov dword [ebp - 0x534], ebx
call dword [sym.imp.ntdll.dll_RtlInitString]
push 1
lea eax, [ebp - 0x530]
push eax
lea eax, [ebp - 0x54c]
push eax
call dword [sym.imp.ntdll.dll_RtlAnsiStringToUnicodeString]
test eax, eax
jge 0x1001fce
mov eax, 0xc000009a
jmp 0x1002216
push ebx
push ebx
push ebx
push 3
push 3
push 0x80
lea eax, [ebp - 0x54c]
mov dword [ebp - 0x55c], eax
push ebx
lea eax, [ebp - 0x56c]
push eax
lea eax, [ebp - 0x564]
push eax
push 0x2000000
lea eax, [ebp - 0x544]
push eax
mov dword [ebp - 0x564], 0x18
mov dword [ebp - 0x560], ebx
mov dword [ebp - 0x558], 0x40
mov dword [ebp - 0x554], ebx
mov dword [ebp - 0x550], ebx
call dword [sym.imp.ntdll.dll_NtCreateFile]
mov esi, eax
lea eax, [ebp - 0x54c]
push eax
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
cmp esi, ebx
jge 0x1002047
mov eax, esi
jmp 0x1002216
push ebx
push ebx
push 0x32f4
lea eax, [ebp - 0x524]
push eax
push 0x2100d6
push dword [ebp - 0x544]
call fcn.01001809
mov esi, dword [ebp - 0x524]
cmp esi, ebx
je 0x1002216
push dword [ebp - 0x544]
call dword [sym.imp.ntdll.dll_NtClose]
cmp dword [esi], ebx
mov dword [ebp - 0x528], ebx
jle 0x100215a
xor edi, edi
add esi, 8
mov dword [ebp - 0x538], esi
mov esi, 0x28b
push ebx
lea eax, [ebp - 0x530]
push eax
call dword [sym.imp.ntdll.dll_RtlInitString]
push dword [ebp - 0x538]
lea eax, [ebp - 0x54c]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push 1
lea eax, [ebp - 0x54c]
push eax
lea eax, [ebp - 0x530]
push eax
call dword [sym.imp.ntdll.dll_RtlUnicodeStringToAnsiString]
test eax, eax
jl 0x1002134
mov eax, 0x28a
mov ecx, eax
cmp word [ebp - 0x530], cx
ja 0x10020ef
movzx eax, word [ebp - 0x530]
push dword [ebp - 0x52c]
mov dword [ebp - 0x520], eax
push esi
lea eax, [edi + 0x1004640]
push eax
call fcn.0100168e
test eax, eax
jge 0x1002112
mov dword [ebp - 0x520], ebx
mov eax, dword [ebp - 0x520]
mov byte [edi + eax + 0x1004640], bl
lea eax, [ebp - 0x530]
push eax
call dword [sym.imp.ntdll.dll_RtlFreeAnsiString]
inc dword [ebp - 0x534]
add edi, esi
inc dword [ebp - 0x528]
mov eax, dword [ebp - 0x524]
mov ecx, dword [ebp - 0x528]
add dword [ebp - 0x538], 0x518
cmp ecx, dword [eax]
jl 0x100209d
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x534]
cmp eax, 0x40
jae 0x100217a
mov ecx, eax
imul ecx, ecx, 0x28b
mov byte [ecx + 0x1004640], bl
mov dword [0x10042ec], eax
lea eax, [ebp - 0x540]
push eax
push 0x20019
push ebx
push 0x10011e4
mov esi, 0x28a
push 0x80000002
mov dword [ebp - 0x520], esi
mov byte [0x100eba0], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1002214
lea eax, [ebp - 0x520]
push eax
lea eax, [ebp - 0x51c]
push eax
lea eax, [ebp - 0x53c]
push eax
push ebx
push 0x10011dc
push dword [ebp - 0x540]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp dword [ebp - 0x53c], 1
je 0x10021ea
cmp dword [ebp - 0x53c], 2
jne 0x1002208
cmp eax, ebx
jne 0x1002208
lea eax, [ebp - 0x51c]
push eax
push esi
push 0x100eba0
call fcn.0100168e
test eax, eax
jl 0x1001fc4
push dword [ebp - 0x540]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01002a74
leave
ret