Function at 0x100bcaa
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xe6c
mov eax, dword [reloc.KERNEL32.dll_GetStartupInfoA]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 4], eax
push esi
push edi
lea eax, reloc.KERNEL32.dll_GetStartupInfoA
mov dword [ebp - reloc.KERNEL32.dll_GetStartupInfoA], eax
mov eax, 0x80
mov dword [ebp - reloc.KERNEL32.dll_GetStartupInfoA], eax
mov dword [ebp - reloc.KERNEL32.dll_GetStartupInfoA], eax
mov dword [ebp - reloc.KERNEL32.dll_GetStartupInfoA], eax
mov dword [ebp - reloc.KERNEL32.dll_GetStartupInfoA], eax
mov dword [ebp - reloc.KERNEL32.dll_GetStartupInfoA], eax
lea eax, reloc.KERNEL32.dll_GetStartupInfoA
lea edi, reloc.KERNEL32.dll_GetStartupInfoA
mov dword [ebp - reloc.KERNEL32.dll_GetStartupInfoA], edi
mov dword [ebp - reloc.KERNEL32.dll_GetStartupInfoA], eax
xor esi, esi
lea eax, reloc.KERNEL32.dll_GetStartupInfoA
push eax
lea edi, reloc.KERNEL32.dll_GetStartupInfoA
mov dword [ebp - reloc.KERNEL32.dll_GetStartupInfoA], ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - reloc.KERNEL32.dll_GetStartupInfoA], edi
push edx
lea edi, reloc.KERNEL32.dll_GetStartupInfoA
push ecx
push dword [ebp + 8]
mov dword [ebp - reloc.KERNEL32.dll_GetStartupInfoA], edi
lea edi, reloc.KERNEL32.dll_GetStartupInfoA
mov dword [ebp - reloc.KERNEL32.dll_GetStartupInfoA], esi
mov dword [ebp - reloc.KERNEL32.dll_GetStartupInfoA], esi
mov dword [ebp - reloc.KERNEL32.dll_GetStartupInfoA], esi
mov dword [ebp - reloc.KERNEL32.dll_GetStartupInfoA], esi
mov dword [ebp - reloc.KERNEL32.dll_GetStartupInfoA], esi
mov dword [ebp - reloc.KERNEL32.dll_GetStartupInfoA], esi
mov dword [ebp - reloc.KERNEL32.dll_GetStartupInfoA], esi
mov dword [ebp - reloc.KERNEL32.dll_GetStartupInfoA], esi
mov dword [ebp - reloc.KERNEL32.dll_GetStartupInfoA], esi
mov dword [ebp - reloc.KERNEL32.dll_GetStartupInfoA], edi
mov dword [ebp - reloc.KERNEL32.dll_GetStartupInfoA], esi
mov dword [ebp - reloc.KERNEL32.dll_GetStartupInfoA], 0x100
call fcn.0100b2e1
mov edi, eax
cmp edi, esi
jge 0x100bb5b
lea ecx, reloc.KERNEL32.dll_GetStartupInfoA
call fcn.01012aaf
lea ecx, reloc.KERNEL32.dll_GetStartupInfoA
call fcn.01002c92
lea ecx, reloc.KERNEL32.dll_GetStartupInfoA
call fcn.01002c92
lea ecx, reloc.KERNEL32.dll_GetStartupInfoA
call fcn.01002c92
lea ecx, reloc.KERNEL32.dll_GetStartupInfoA
call fcn.01002c92
lea ecx, reloc.KERNEL32.dll_GetStartupInfoA
call fcn.01002c92
mov eax, edi
jmp 0x100bddf
mov dword [ebp - reloc.KERNEL32.dll_GetStartupInfoA], esi
push ebx
lea eax, reloc.KERNEL32.dll_GetStartupInfoA
push eax
push dword [ebp - 0xe64]
lea eax, reloc.KERNEL32.dll_GetStartupInfoA
push eax
mov dword [ebp - reloc.KERNEL32.dll_GetStartupInfoA], esi
mov dword [ebp - reloc.KERNEL32.dll_GetStartupInfoA], esi
call fcn.0100b3fa
cmp dword [reloc.KERNEL32.dll_GetStartupInfoA], 3
jne 0x100bc25
mov ecx, dword [ebp - reloc.KERNEL32.dll_GetStartupInfoA]
lea eax, reloc.KERNEL32.dll_GetStartupInfoA
push eax
lea eax, reloc.KERNEL32.dll_GetStartupInfoA
push eax
lea eax, reloc.KERNEL32.dll_GetStartupInfoA
push eax
lea eax, reloc.KERNEL32.dll_GetStartupInfoA
push eax
lea eax, reloc.KERNEL32.dll_GetStartupInfoA
push eax
lea eax, reloc.KERNEL32.dll_GetStartupInfoA
push eax
mov dword [ebp - reloc.KERNEL32.dll_GetStartupInfoA], esi
mov dword [ebp - reloc.KERNEL32.dll_GetStartupInfoA], esi
mov dword [ebp - reloc.KERNEL32.dll_GetStartupInfoA], esi
mov dword [ebp - reloc.KERNEL32.dll_GetStartupInfoA], esi
call fcn.0100b7d7
test eax, eax
jl 0x100bd88
mov ecx, dword [ebp - reloc.KERNEL32.dll_GetStartupInfoA]
push esi
push 1
push esi
push dword [ebp - 0xe6c]
lea eax, reloc.KERNEL32.dll_GetStartupInfoA
push eax
lea eax, reloc.KERNEL32.dll_GetStartupInfoA
push eax
lea eax, reloc.KERNEL32.dll_GetStartupInfoA
push eax
lea eax, reloc.KERNEL32.dll_GetStartupInfoA
push eax
mov dword [ebp - reloc.KERNEL32.dll_GetStartupInfoA], esi
call fcn.0100b1fa
jmp 0x100bd79
cmp dword [ebp - reloc.KERNEL32.dll_GetStartupInfoA], esi
jge 0x100bc31
xor eax, eax
jmp 0x100bc37
mov eax, dword [ebp - reloc.KERNEL32.dll_GetStartupInfoA]
push 0x400
lea ecx, reloc.KERNEL32.dll_GetStartupInfoA
push ecx
push eax
lea ecx, reloc.KERNEL32.dll_GetStartupInfoA
call fcn.010035fa
push eax
call fcn.0100cab1
test eax, eax
jne 0x100bd88
mov edi, dword [sym.imp.msvcrt.dll_wcschr]
lea eax, reloc.KERNEL32.dll_GetStartupInfoA
push 0x3f
push eax
call edi
mov ebx, eax
cmp ebx, esi
pop ecx
pop ecx
je 0x100bd7d
cmp word [ebx + 2], si
je 0x100bd7d
add ebx, 4
push 0x3f
push ebx
call edi
mov edi, eax
cmp edi, esi
pop ecx
pop ecx
je 0x100bd7d
cmp word [edi + 2], si
je 0x100bd7d
add edi, 4
push 0x3a
push edi
call dword [sym.imp.msvcrt.dll_wcschr]
cmp eax, esi
pop ecx
pop ecx
je 0x100bd7d
cmp word [eax + 2], si
je 0x100bd7d
add eax, 4
mov word [ebx - 4], si
mov word [edi - 6], si
mov dword [ebp - reloc.KERNEL32.dll_GetStartupInfoA], eax
mov word [eax - 6], si
lea eax, reloc.KERNEL32.dll_GetStartupInfoA
push eax
call dword [sym.imp.msvcrt.dll__wtoi]
pop ecx
push 0xffffffffffffffff
push ebx
lea ecx, reloc.KERNEL32.dll_GetStartupInfoA
mov dword [ebp - reloc.KERNEL32.dll_GetStartupInfoA], esi
mov dword [ebp - reloc.KERNEL32.dll_GetStartupInfoA], esi
call fcn.0100365f
test eax, eax
jl 0x100bd88
push 0xffffffffffffffff
push edi
lea ecx, reloc.KERNEL32.dll_GetStartupInfoA
mov dword [ebp - reloc.KERNEL32.dll_GetStartupInfoA], esi
mov dword [ebp - reloc.KERNEL32.dll_GetStartupInfoA], esi
call fcn.0100365f
test eax, eax
jl 0x100bd88
push 0xffffffffffffffff
push dword [ebp - 0xe60]
lea ecx, reloc.KERNEL32.dll_GetStartupInfoA
mov dword [ebp - reloc.KERNEL32.dll_GetStartupInfoA], esi
mov dword [ebp - reloc.KERNEL32.dll_GetStartupInfoA], esi
call fcn.0100365f
test eax, eax
jl 0x100bd88
mov ecx, dword [ebp - reloc.KERNEL32.dll_GetStartupInfoA]
push esi
push 1
push esi
lea eax, reloc.KERNEL32.dll_GetStartupInfoA
push eax
lea eax, reloc.KERNEL32.dll_GetStartupInfoA
push eax
lea eax, reloc.KERNEL32.dll_GetStartupInfoA
push eax
lea eax, reloc.KERNEL32.dll_GetStartupInfoA
push eax
mov dword [ebp - reloc.KERNEL32.dll_GetStartupInfoA], esi
call fcn.0100b104
cmp eax, esi
jl 0x100bd88
inc dword [ebp - reloc.KERNEL32.dll_GetStartupInfoA]
jmp 0x100bb62
lea ecx, reloc.KERNEL32.dll_GetStartupInfoA
call fcn.01012aaf
lea ecx, reloc.KERNEL32.dll_GetStartupInfoA
call fcn.01002c92
lea ecx, reloc.KERNEL32.dll_GetStartupInfoA
call fcn.01002c92
lea ecx, reloc.KERNEL32.dll_GetStartupInfoA
call fcn.01002c92
lea ecx, reloc.KERNEL32.dll_GetStartupInfoA
call fcn.01002c92
lea ecx, reloc.KERNEL32.dll_GetStartupInfoA
call fcn.01002c92
mov eax, dword [ebp - reloc.KERNEL32.dll_GetStartupInfoA]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
pop ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.01007613
leave
ret 0xc