Function at 0x1001aeaf
Capabilities:
Connect pipe
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x1001b189
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x28], 0x7647
mov dword [ebp - 0x3c], str.neoabcp_gfbiker_mjnr_pqifkv_auafahe_vbiwjjele_rmsdbgpiy_swwdal_mltccm_kuthctca_qvxmkj_jwi_xsv_mlaqa
cmp dword [ebp - 0x28], 0x78c0
jle 0x1001af63
and dword [ebp - 0x1c], 0
jmp 0x1001af03
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x62ae
jge 0x1001af63
and dword [ebp - 0x24], 0
jmp 0x1001af19
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x273f
jge 0x1001af61
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x24]
cdq
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], edx
push dword [ebp - 0x70]
push dword [ebp - 0x74]
lea ecx, [ebp - 0xac]
call fcn.100019c5
pop ecx
pop ecx
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x4c]
call fcn.1000cba0
push eax
call fcn.1004d87c
pop ecx
lea ecx, [ebp - 0xac]
call fcn.1000cb96
jmp 0x1001af12
jmp 0x1001aefc
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x28], 0x75bf
jge 0x1001af7b
push dword [ebp - 0x3c]
call fcn.1004d87c
pop ecx
mov eax, dword [ebp - 0x84]
movzx eax, byte [eax]
test eax, eax
je 0x1001b162
mov dword [ebp - 0x2c], 0x12b2
mov dword [ebp - 0x6c], str.fgnff_tgg_olqew_vjxvw_odeeu
cmp dword [ebp - 0x2c], 0x1319
jle 0x1001b01e
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
and dword [ebp - 0x14], 0
jmp 0x1001afc2
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x6ed0
jge 0x1001b01e
and dword [ebp - 0x20], 0
jmp 0x1001afd8
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x5ed9
jge 0x1001b01c
and dword [ebp - 8], 0
jmp 0x1001afee
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x2fb2
jge 0x1001b01a
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x20]
or eax, dword [ebp - 8]
cdq
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], edx
push dword [ebp - 0x7c]
push dword [ebp - 0x80]
mov ecx, 0x1007bbb8
call fcn.1000cbc0
jmp 0x1001afe7
jmp 0x1001afd1
jmp 0x1001afbb
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x2c], 0xf7f
jge 0x1001b03a
mov edx, dword [ebp - 0x6c]
mov ecx, 0x1007bbb8
call fcn.1000ee07
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x30], 0x4c52
mov dword [ebp - 0x78], str.bsvan_nvwbkos_reykm_vbrue_uojdnnt_rkc_vvuqvwu_bprymfjvm_npyoshkth_swsjwy_dupkxjqvl_hkcri_qhvpyskg_ljsqwbl
cmp dword [ebp - 0x30], 0x4c91
jle 0x1001b109
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
and dword [ebp - 0x18], 0
jmp 0x1001b072
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xfdd
jge 0x1001b109
and dword [ebp - 0xc], 0
jmp 0x1001b08c
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x34ac
jge 0x1001b104
and dword [ebp - 0x10], 0
jmp 0x1001b0a2
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x441b
jge 0x1001b102
mov eax, dword [ebp - 0xc]
cdq
idiv dword [ebp - 0x10]
and edx, dword [ebp - 0x18]
mov eax, edx
cdq
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], edx
push dword [ebp - 0x88]
push dword [ebp - 0x8c]
lea ecx, [ebp - 0xc4]
call fcn.100019c5
pop ecx
pop ecx
mov dword [ebp - 0x94], eax
mov ecx, dword [ebp - 0x94]
call fcn.1000cba0
push eax
call fcn.1004d87c
pop ecx
lea ecx, [ebp - 0xc4]
call fcn.1000cb96
jmp 0x1001b09b
jmp 0x1001b085
jmp 0x1001b06b
mov eax, dword [ebp - 0x54]
mov dword [ebp - 4], eax
cmp dword [ebp - 0x30], 0x49af
jge 0x1001b121
push dword [ebp - 0x78]
call fcn.1004d87c
pop ecx
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1001b140
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x1001b160
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x90]
call fcn.1000ce77
mov dword [eax], 0x16df251d
jmp 0x1001b135
jmp 0x1001b187
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
push dword [eax]
mov ecx, dword [ebp - 0x58]
call fcn.10013ce2
jmp 0x1001b1b1
lea eax, [ebp + 8]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x60], eax
push 0x6af3
push dword [ebp - 0x60]
push 0x3877
mov eax, dword [ebp - 0x68]
push dword [eax]
push 0
call fcn.10016f36
add esp, 0x14
mov esp, ebp
pop ebp
ret