Function at 0x100ceaa
Capabilities:
Get hostname
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x6b8
mov eax, dword [0x101d044]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0x104
lea ecx, [ebp - 0x22c]
push ecx
push eax
mov dword [ebp - 0x644], eax
call fcn.0101312b
test eax, eax
jl 0x100d1b8
push ebx
xor ebx, ebx
inc ebx
push ebx
call fcn.01003bef
cmp word [ebp - 0x22c], 0x5c
jne 0x100cf06
cmp word [ebp - 0x22a], 0x5c
lea eax, [ebp - 0x228]
je 0x100cf0c
lea eax, [ebp - 0x22c]
push esi
push edi
push eax
mov dword [ebp - 0x638], eax
call dword [sym.imp.USER32.dll_a_wLPbbUV___v8m0H2huz4fdL4y:n]
push ebx
push dword [ebp - 0x638]
call dword [sym.imp.USER32.dll_CharUpperBuffW]
lea eax, [ebp - 0x648]
push eax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x648], 0x10
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x100cf6a
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x638]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x100cf6a
mov dword [ebp - 0x63c], 0x99
jmp 0x100d18b
mov eax, dword [0x101d090]
mov esi, dword [sym.imp.USER32.dll__q_yqzvt__JNggR__S_Oj___y2___T6_BUejm_V_]
push 0
push 0
mov edi, 0x110a
push edi
push eax
mov dword [ebp - 0x63c], eax
mov dword [ebp - 0x6b8], 0x15
call esi
lea ecx, [ebp - 0x434]
mov dword [ebp - 0x6b4], eax
mov dword [ebp - 0x6a8], ecx
mov dword [ebp - 0x6a4], 0x104
jmp 0x100cfe5
lea eax, [ebp - 0x6b8]
push eax
push 0
push 0x113e
push dword [ebp - 0x63c]
call esi
lea eax, [ebp - 0x434]
push eax
push dword [ebp - 0x638]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x100d037
jl 0x100d000
mov eax, dword [ebp - 0x6b4]
push eax
push ebx
push edi
push dword [ebp - 0x63c]
mov dword [ebp - 0x640], eax
call esi
mov dword [ebp - 0x6b4], eax
test eax, eax
jne 0x100cfb0
lea eax, [ebp - 0x64c]
push eax
push 0x80000002
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
xor ecx, ecx
cmp eax, ecx
je 0x100d051
cmp eax, 5
sete cl
lea ecx, [ecx + ecx + 0x9a]
mov dword [ebp - 0x63c], ecx
jmp 0x100d18b
push dword [ebp - 0x6b4]
push 9
push 0x110b
push dword [ebp - 0x63c]
call esi
jmp 0x100d1b5
mov eax, dword [ebp - 0x640]
mov edi, dword [0x101d090]
mov dword [ebp - 0x68c], eax
mov eax, dword [ebp - 0x638]
mov dword [ebp - 0x678], eax
lea eax, [ebp - 0x690]
push eax
push ecx
push 0x1132
push edi
mov dword [ebp - 0x63c], ecx
mov dword [ebp - 0x690], 0xffff0000
mov dword [ebp - 0x688], 0x67
mov dword [ebp - 0x670], ebx
mov dword [ebp - 0x66c], ebx
mov dword [ebp - 0x668], ebx
mov dword [ebp - 0x664], ecx
call esi
and dword [ebp - 0x638], 0
mov dword [ebp - 0x690], eax
mov dword [ebp - 0x670], 2
mov dword [ebp - 0x66c], 3
mov eax, dword [ebp - 0x638]
imul eax, eax, 0xc
cmp dword [ebp - 0x638], 2
mov ecx, dword [eax + 0x1001c38]
mov dword [ebp - 0x678], ecx
jne 0x100d1c6
mov eax, dword [ebp - 0x64c]
mov dword [ebp - 0x664], eax
push 0x100
lea eax, [ebp - 0x634]
push eax
push 0
push dword [ebp - 0x664]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x668], eax
lea eax, [ebp - 0x690]
push eax
push 0
push 0x1132
push edi
call esi
inc dword [ebp - 0x638]
cmp dword [ebp - 0x638], 6
jb 0x100d0d2
push dword [ebp - 0x690]
push 2
push 0x1102
push edi
call esi
push dword [ebp - 0x690]
xor ebx, ebx
push ebx
push 0x1114
push edi
call esi
push ebx
call fcn.01003bef
push dword [ebp - 0x690]
push 9
push 0x110b
push edi
call esi
push edi
call dword [sym.imp.USER32.dll___Ve_kE1__Zmg5tRGnfXQPriKD_i3nRL3uz9t]
cmp dword [ebp - 0x63c], ebx
je 0x100d1b5
lea eax, [ebp - 0x22c]
push eax
movzx eax, word [ebp - 0x63c]
push 0x10
push 0x98
push eax
push dword [ebp - 0x644]
push dword [0x101d054]
call fcn.0100ca02
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0100160d
leave
ret 4
cmp dword [ebp - 0x638], ebx
je 0x100d136
cmp dword [ebp - 0x638], 5
je 0x100d136
cmp dword [ebp - 0x638], 4
je 0x100d136
cmp dword [ebp - 0x638], 0
je 0x100d136
lea ecx, [ebp - 0x664]
push ecx
push dword [eax + 0x1001c3c]
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
test eax, eax
je 0x100d100
mov dword [ebp - 0x63c], 0x9b
jmp 0x100d136