Function at 0xc2820d0
Capabilities:
Parse pe header
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x368
mov eax, dword [0xc2b2728]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x26c], eax
lea eax, [ebp - 0x25c]
push eax
push 0x20019
xor ebx, ebx
push ebx
push 0xc281390
push 0x80000002
mov byte [ebp - 0x108], bl
mov byte [ebp - 0x20c], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xc2823e9
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, 0x104
push edi
lea ecx, [ebp - 0x108]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x108]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0xc282148
sub eax, esi
dec eax
cmp eax, ebx
jl 0xc282163
cmp byte [ebp + eax - 0x108], 0x5c
je 0xc282163
dec eax
jns 0xc282156
lea eax, [ebp + eax - 0x107]
push eax
push edi
lea eax, [ebp - 0x20c]
push eax
call fcn.0c282068
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
lea eax, [ebp - 0x108]
push eax
mov dword [ebp - 0x264], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x250], eax
cmp eax, 0xffffffff
je 0xc282220
lea ecx, [ebp - 0x24c]
push ecx
push eax
push 0x40
pop esi
call fcn.0c282037
test eax, eax
je 0xc282214
mov eax, 0x5a4d
cmp word [ebp - 0x24c], ax
jne 0xc282214
mov esi, dword [ebp - 0x210]
push ebx
push ebx
push esi
push dword [ebp - 0x250]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, esi
jne 0xc282214
lea eax, [ebp - 0x368]
push eax
push dword [ebp - 0x250]
mov esi, 0xf8
call fcn.0c282037
test eax, eax
je 0xc282214
cmp dword [ebp - 0x368], 0x4550
jne 0xc282214
mov eax, dword [ebp - 0x360]
mov dword [ebp - 0x264], eax
push dword [ebp - 0x250]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
lea eax, [ebp - 0x108]
push eax
push ebx
push dword [ebp - 0x25c]
mov dword [ebp - 0x260], ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0xc2823db
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x25c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0xc282379
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x258]
push eax
push ebx
push 0xc281388
push dword [ebp - 0x250]
mov dword [ebp - 0x254], edi
call esi
test eax, eax
jne 0xc282379
cmp dword [ebp - 0x258], 1
jne 0xc282379
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x270]
push eax
lea eax, [ebp - 0x258]
push eax
push ebx
push 0xc281380
push dword [ebp - 0x250]
mov dword [ebp - 0x254], 4
call esi
test eax, eax
jne 0xc282379
push 4
pop eax
cmp dword [ebp - 0x258], eax
je 0xc2822fe
cmp dword [ebp - 0x258], 3
jne 0xc282379
cmp dword [ebp - 0x254], eax
jne 0xc282379
mov dword [ebp - 0x254], eax
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x258]
push eax
push ebx
push 0xc28137c
push dword [ebp - 0x250]
call esi
test eax, eax
jne 0xc282379
cmp dword [ebp - 0x258], 4
je 0xc282346
cmp dword [ebp - 0x258], 3
jne 0xc282379
cmp dword [ebp - 0x254], 4
jne 0xc282379
mov eax, dword [ebp - 0x268]
cmp eax, dword [ebp - 0x264]
je 0xc282358
cmp eax, ebx
jne 0xc282379
push dword [ebp - 0x254]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.msvcrt.dll__memicmp]
add esp, 0xc
test eax, eax
je 0xc2823bd
cmp dword [ebp - 0x250], ebx
je 0xc28238d
push dword [ebp - 0x250]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x260]
push edi
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x260]
mov dword [ebp - 0x250], ebx
push dword [ebp - 0x25c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0xc282249
jmp 0xc2823db
mov ecx, dword [ebp - 0x270]
mov eax, dword [ebp - 0x26c]
push dword [ebp - 0x250]
or dword [eax + 0x1d4], ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x25c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0c2af3be
leave
ret 4