Function at 0x10001f32
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x31c
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov eax, 1
test eax, eax
je 0x1000209b
mov dword [ebp - 8], 0x200
jo 0x10001f66
ja 0x10001f64
xchg ebx, ebx
je 0x10001f64
xchg ebp, ebp
nop
jmp 0x10001f69
jo 0x10001f5b
bound ecx, qword [ebp + 0x6a51f04d]
add byte [edx], ch
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0
push 0
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x214]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push eax
add edx, dword [eax]
mov dword [ebp - 0x14], eax
jnp 0x10001f9b
mov esi, esi
nop
nop
ja 0x10001f99
xchg edi, edi
jmp 0x10001fa3
je 0x10001f9e
nop
jnp 0x10001f91
xchg ebp, ebp
xchg dword [ebx + 0xf00ec7d], eax
test edx, ecx
add byte [eax], al
add bh, al
test eax, ebp
std
invalid
cmp dword [ebp - 0x14], 0
jne 0x10002077
mov dword [ebp - 0x218], 0x104
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x31c]
push ecx
lea edx, [ebp - 0x214]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.10002171
add esp, 0x10
mov dword [ebp - 0x14], eax
jmp 0x10001fe4
mov edi, edi
js 0x10001fe7
nop
jns 0x10001fe7
jmp 0x10001fdd
jg 0x10001ff2
nop
xchg ecx, ecx
js 0x10001ff7
xchg ebp, ebp
jns 0x10001ff7
ja 0x10001ff4
jg 0x10001fe9
sbb eax, dword [ebx + 0x7500ec7d]
js 0x10001f89
cmp dword [ebp - 0x14], 0
jne 0x10002075
mov ecx, dword [ebp - 0x218]
mov byte [ebp + ecx - 0x31c], 0
js 0x10002016
invalid
nop
xchg eax, eax
jg 0x1000201b
xchg edx, edx
jle 0x1000201b
je 0x10002018
js 0x1000200d
ror dword [ebp - 0x31b6b], cl
call dword [edx - 0x18]
jle 0x10002025
lea edx, [ebp - 0x31c]
push edx
call 0x100020a5
add byte [eax], al
add esp, 4
and eax, 0xffff
test eax, eax
je 0x10002075
jbe 0x1000203c
nop
nop
je 0x1000203a
nop
jmp 0x10002047
xchg edi, edi
ja 0x10002042
xchg ecx, ecx
jbe 0x10002035
je 0x10002059
add dword [ebx - 0x3899f3bb], ecx
add byte [ecx], al
add byte [edi + 9], bh
mov eax, dword [ebp + 0xc]
mov word [eax], 1
jg 0x1000205a
nop
xchg edi, edi
js 0x1000205f
xchg ebp, ebp
jns 0x1000205f
add eax, 0xf37f0077
ja 0x1000205c
jg 0x10002051
or dword [esp + eax - 0x70], edi
jl 0x10002065
nop
nop
jmp 0x10002073
ja 0x1000206e
xchg ebp, ebp
je 0x1000206e
xchg esi, esi
nop
jl 0x10002061
ja 0x10002085
or bl, ch
jmp 0x10002079
jmp 0x1000209b
jmp 0x10002079
jmp 0x1000209b
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
jl 0x1000208b
nop
nop
ja 0x10002089
nop
jmp 0x10002096
xchg ebx, ebx
je 0x10002091
xchg ebx, ebx
jl 0x10002084
ja 0x100020a8
xchg cl, ch
stosb byte es:[edi], al
invalid
jmp 0x10001f45
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
sub esp, 8
push ebx
push esi
push edi
mov word [ebp - 4], 0
push 0x5c
mov eax, dword [ebp + 8]
push eax
call fcn.1002c8e0
add esp, 8
mov dword [ebp - 8], eax
js 0x100020d0
nop
xchg eax, eax
jg 0x100020d5
xchg esi, esi
jle 0x100020d5
je 0x100020d2
js 0x100020c7
rol dword [ebx + 0x7500f87d], cl
sbb al, 0x8b
dec ebp
or byte [ecx + 0x676f84d], cl
cmp dword [ebp - 8], 0
jne 0x100020f7
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
jbe 0x100020e9
nop
nop
je 0x100020e7
jmp 0x100020f5
xchg esi, esi
ja 0x100020f0
xchg edi, edi
nop
jbe 0x100020e3
je 0x10002107
sub ebx, ebp
sbb dword [ebx - 0x3d7c07ab], ecx
add dword [ecx + 0x97ff855], ecx
jmp 0x10002110
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
jg 0x1000210b
nop
xchg esi, esi
js 0x10002110
xchg eax, eax
jns 0x10002110
ja 0x1000210d
jg 0x10002102
adc ecx, dword [ebx + 0x6850f845]
call 0xf8102581
rcl byte [ebp], cl
add byte [ebx - 0x3f7af73c], al
mov eax, dword [ebp - 8]
push eax
push 0x100467e8
call 0x100076f0
add esp, 8
test eax, eax
jne 0x10002156
jmp 0x1000212e
mov edi, edi
jo 0x10002131
nop
jno 0x10002131
jmp 0x10002127
jae 0x1000213e
je 0x1000213c
xchg ecx, ecx
ja 0x1000213c
xchg esi, esi
nop
jmp 0x10002141
jae 0x10002133
mov cs, word [ebx - 0xaef7b3]
adc eax, sym.imp.KERNEL32.dll_GetFileAttributesA
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x10002156
mov word [ebp - 4], 1
jo 0x10002163
ja 0x10002161
xchg esi, esi
je 0x10002161
xchg edx, edx
nop
jmp 0x10002166
jo 0x10002158
xchg byte [esi - 0x75], ah
inc ebp
cld
mov ax, word [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret