Function at 0x4ad1cdaa
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x4ad2406c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
cmp eax, edi
mov dword [ebp - 0x214], ecx
jne 0x4ad1cefd
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
push edi
push ecx
mov dword [ebp - 0x210], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov ebx, eax
cmp ebx, edi
jne 0x4ad1cee2
mov edi, str.ShellOpenCommand
cmp word [ebp - 0x20c], 0x2e
je 0x4ad1ceaf
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4ad1ce19
sub eax, edx
sar eax, 1
mov ebx, eax
mov eax, edi
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x4ad1ce2e
sub eax, ecx
sar eax, 1
lea eax, [eax + ebx + 1]
cmp eax, esi
ja 0x4ad1ceaf
push edi
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.4ad014d2
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x214]
call fcn.4ad1c77c
and word [ebp + ebx*2 - 0x20c], 0
test eax, eax
mov dword [ebp - 0x218], eax
je 0x4ad1cea4
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4ad1ce7a
sub eax, edx
sar eax, 1
je 0x4ad1cea4
push dword [ebp - 0x218]
lea eax, [ebp - 0x20c]
push eax
push str._s_s_r_n
call fcn.4ad040bf
add esp, 0xc
push dword [ebp - 0x218]
call fcn.4ad01773
cmp dword [0x4ad2415c], 0
jne 0x4ad1cef5
inc dword [ebp - 0x210]
push esi
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x210]
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov ebx, eax
test ebx, ebx
je 0x4ad1ce02
cmp ebx, 0x103
jne 0x4ad1d05b
xor ebx, ebx
jmp 0x4ad1d05b
xor eax, eax
inc eax
jmp 0x4ad1d05d
cmp word [eax], 0x2e
jne 0x4ad1cf1b
push eax
push 1
push 0x400023a5
call fcn.4ad080e2
add esp, 0xc
push 0x7b
pop eax
jmp 0x4ad1d05d
push edi
push eax
call fcn.4ad0219c
push eax
call fcn.4ad01ebf
mov ebx, eax
cmp ebx, edi
mov dword [ebp - 0x210], ebx
je 0x4ad1cef5
push 0x20
push ebx
call fcn.4ad01a11
cmp eax, edi
je 0x4ad1cf43
mov word [eax], di
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x4ad1cf48
sub eax, edx
sar eax, 1
mov edi, str.ShellOpenCommand
mov edx, eax
mov eax, edi
lea ecx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
test si, si
jne 0x4ad1cf62
sub eax, ecx
sar eax, 1
lea eax, [eax + edx + 1]
mov esi, 0x104
cmp eax, esi
push ebx
jbe 0x4ad1cf9d
push 1
push 0x400023db
call fcn.4ad080e2
add esp, 0xc
push 0x7b
pop esi
push ebx
call fcn.4ad01773
mov eax, esi
jmp 0x4ad1d05d
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.4ad01416
push edi
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.4ad014d2
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov ebx, eax
test ebx, ebx
je 0x4ad1cff7
push dword [ebp - 0x210]
push 1
push 0x400023a5
call fcn.4ad080e2
mov esi, ebx
mov ebx, dword [ebp - 0x210]
add esp, 0xc
jmp 0x4ad1cf90
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x214]
call fcn.4ad1c77c
mov esi, eax
test esi, esi
je 0x4ad1d035
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4ad1d012
sub eax, edx
sar eax, 1
je 0x4ad1d035
push esi
push dword [ebp - 0x210]
push str._s_s_r_n
call fcn.4ad040bf
jmp 0x4ad1d047
push dword [ebp - 0x210]
push 1
push 0x400023a5
call fcn.4ad080e2
add esp, 0xc
push esi
call fcn.4ad01773
push dword [ebp - 0x210]
call fcn.4ad01773
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.4ad013fa
leave
ret 8