Function at 0x1001d2b2
Capabilities:
Delete file
Query or enumerate registry key

Disassembly:
mov eax, 0x1008b3ba
call fcn.1008ab58
sub esp, 0xc0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], 0x831713b9
push edi
mov dword [ebp - 0x28], ebx
mov al, cl
cmp dword [ebp - 0x28], 0xfffffffe
push 3
mov byte [ebp - 0x15], al
pop esi
jle 0x1001d324
push esi
lea ecx, [ebp - 0x9c]
call fcn.10019689
mov dword [ebp - 0x20], ebx
jmp 0x1001d2ff
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x9c]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1001d2f0
mov eax, dword [ebp - 0x9c]
lea ecx, [ebp - 0x9c]
mov dword [eax + 4], ebx
call fcn.1001970b
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffffe
jg 0x1001d2df
mov al, byte [ebp - 0x15]
test al, al
je 0x1001d50d
mov dword [ebp - 0x14], 0xfffffffd
xor edi, edi
mov dword [ebp - 0x30], 0x8fb8ceff
inc edi
mov dword [ebp - 0x28], 0x911b9c6f
mov eax, 0xfa6b86d5
mov dword [ebp - 0x20], 0x50dfa014
mov dword [ebp - 0x24], edi
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x34], 0x184bafc8
mov esi, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
neg esi
mov eax, dword [ebp - 0x14]
sbb esi, esi
xor edx, edx
neg esi
cmp ecx, eax
mov eax, 0xb79df948
setl dl
cmp eax, esi
sbb eax, eax
neg eax
cmp edx, eax
jge 0x1001d39e
mov eax, ebx
cmp dword [ebp - 0x14], ebx
je 0x1001d3a0
mov eax, edi
inc eax
je 0x1001d3aa
mov eax, edi
cmp dword [ebp - 0x14], ebx
jne 0x1001d3ac
mov eax, ebx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x14]
jl 0x1001d3be
mov ecx, ebx
cmp dword [ebp - 0x14], ebx
je 0x1001d3c0
mov ecx, edi
mov eax, dword [ebp - 0x14]
xor edx, edx
add eax, ecx
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setge dl
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], ebx
je 0x1001d3e0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x28], ebx
je 0x1001d3fe
mov dword [ebp - 0x24], 0xfffffffe
mov dword [ebp - 0x24], 0xe6286c8a
jmp 0x1001d4f9
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x1c], 0x1f13d464
cmp dword [ebp - 0x34], ebx
je 0x1001d488
xor edx, edx
mov dword [ebp - 0x20], 0xfffffffb
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x34]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x28]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setle dl
xor ecx, ecx
cmp eax, edx
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
setl cl
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
neg ecx
jne 0x1001d45e
mov edx, ebx
cmp dword [ebp - 0x28], ebx
je 0x1001d460
mov edx, edi
mov eax, dword [ebp - 0x34]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x28]
setl cl
sub eax, ecx
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x24]
jge 0x1001d482
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x34]
push 2
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], ebx
pop esi
jmp 0x1001d4f4
mov dword [ebp - 0x14], ebx
jmp 0x1001d4cf
mov eax, dword [ebp - 0xa8]
sub eax, 0x44077424
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jne 0x1001d4c2
mov eax, dword [ebp - 0x24]
mov ecx, ebx
neg eax
je 0x1001d4c4
mov ecx, edi
mov eax, dword [ebp - 0x1c]
sub ecx, eax
mov dword [ebp - 0x34], ecx
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe4
je 0x1001d49b
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], bl
je 0x1001d4f1
push ebx
push 0x6da
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetTimer]
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], esi
jg 0x1001d496
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnumChildWindows]
jmp 0x1001dba2
push dword [ebp - 0x4c]
movdqa xmm0, xmmword [0x10008080]
lea eax, [ebp - 0xbc]
push eax
lea eax, [ebp - 0xcc]
mov dword [ebp - 0x60], ebx
push eax
push ebx
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x5c], ebx
movdqu xmmword [ebp - 0xcc], xmm0
mov dword [ebp - 0x58], ebx
call fcn.1001ac2d
push 2
pop esi
push esi
lea ecx, [ebp - 0x6c]
mov dword [ebp - 4], ebx
call fcn.10019689
xor edi, edi
inc edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x1c], ebx
jmp 0x1001d566
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x6c]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1001d55a
mov ecx, dword [ebp - 0x6c]
xor eax, eax
cmp dword [ecx + 4], ebx
sete al
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], 0xfffffff0
cmp dword [ebp - 0x28], 0xb
je 0x1001d662
mov esi, ecx
mov dword [ebp - 0x20], 0x8f738f58
mov dword [ebp - 0x24], 0xfffffff7
mov dword [ebp - 0x24], 0xfffffffc
mov dword [ebp - 0x20], ebx
jmp 0x1001d5fe
mov dword [ebp - 0x1c], 0xed55c59c
mov dword [ebp - 0x34], edi
cmp dword [ebp - 0x34], ebx
je 0x1001d5d1
mov eax, dword [ebp - 0x34]
xor edx, edx
mov eax, dword [ebp - 0x60]
mov ecx, dword [esi + 4]
cmp dword [eax + 4], ecx
mov eax, dword [ebp - 0x6c]
sete dl
add edx, dword [eax]
mov eax, edi
add edx, ecx
jne 0x1001d5d3
mov eax, ebx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
or eax, 0xffffffff
imul ecx, dword [ebp - 0x20]
sub eax, ecx
je 0x1001d5f1
mov eax, edi
cmp dword [ebp - 0x1c], ebx
jne 0x1001d5f3
mov eax, ebx
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x34], ebx
jne 0x1001d604
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe3
jne 0x1001d5a6
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001d652
push 0x21d7
push 0x16d3
push 0x1e9e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x37b
push 0x4de
push 0xb54
push 0xc51
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xb
jne 0x1001d58c
push 2
pop esi
lea ecx, [ebp - 0x6c]
call fcn.1001970b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x60]
call fcn.1001970b
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
jmp 0x1001d68c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x4c], 0x35568345
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1001d67e
mov dword [ebp - 0x20], ebx
jmp 0x1001d6a4
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x4c], 0xffffffff
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1001d696
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001d6c4
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x1236
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0x20], 0xc0ce695e
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x1c], 0x35555d5d
mov dword [ebp - 0x24], 0xdcede6a6
mov dword [ebp - 0x24], 0x5b818e96
push 4
call fcn.10019689
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x24], 0xfffffffa
mov dword [ebp - 0x34], 0xdcdedc29
push 4
mov dword [ebp - 0x28], 0x8019
mov dword [ebp - 0x14], ebx
pop edx
jmp 0x1001d718
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x48], 0xb770a77c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1001d70a
push 3
mov dword [ebp - 0x14], ebx
pop ecx
jmp 0x1001d736
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x84], 0x5a0349b8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1001d725
mov dword [ebp - 0x14], ebx
jmp 0x1001d750
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x78]
mov dword [eax + ecx*4], 0x431bb57c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1001d740
mov dword [ebp - 0x14], ebx
jmp 0x1001d768
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x54], 0xde87
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1001d75a
mov eax, dword [ebp - 0x48]
mov ecx, 0x8552ad14
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
mov edx, ebx
setl cl
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], ebx
je 0x1001d79a
mov edx, edi
mov eax, dword [ebp - 0x44]
xor ecx, ecx
cmp edx, eax
sete cl
cmp ecx, dword [ebp - 0x1c]
je 0x1001d7b0
mov edx, ebx
cmp dword [ebp - 0x40], ebx
je 0x1001d7b2
mov edx, edi
mov dword [ebp - 0x7c], edx
xor ecx, ecx
mov eax, dword [ebp - 0x40]
cmp edx, eax
setle cl
mov dword [ebp - 0x24], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 0x20]
sub edx, eax
mov eax, dword [ebp - 0x1c]
cmp edx, eax
setle cl
mov dword [ebp - 0x24], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
cmp eax, 0xa21d
setle cl
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], 5
jge 0x1001d803
cmp dword [ebp - 0x34], ebx
jne 0x1001d803
mov eax, ebx
push 3
pop edx
cmp edx, eax
push 0xfffffffffffffff6
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0xfffffffd
pop eax
setg cl
imul ecx, dword [ebp - 0x48]
neg ecx
sbb ecx, ecx
inc ecx
cmp eax, ecx
mov eax, dword [ebp - 0x50]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
mov eax, dword [ebp - 0x78]
sete cl
sub ecx, 0xd979
mov esi, dword [eax]
mov dword [ebp - 0x34], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x34]
cmp eax, 7
mov eax, dword [ebp - 0x1c]
setge cl
xor edx, edx
sub ecx, esi
cmp ecx, esi
setl dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, 0x5c78859b
setne al
xor ecx, ecx
cmp eax, 0x60ee
mov eax, 0xc96aae11
setle cl
cmp eax, ecx
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x50]
jl 0x1001d887
mov edx, edi
cmp dword [ebp - 0x7c], ebx
jne 0x1001d889
mov edx, ebx
mov eax, dword [ebp - 0x54]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x78]
setg cl
xor edx, edx
cmp ecx, dword [eax + 8]
setg dl
xor ecx, ecx
mov dword [ebp - 0x24], edx
mov edx, dword [ebp - 0x28]
imul edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x50]
cmp edx, eax
setle cl
cmp ecx, 4
jne 0x1001d8be
mov ecx, ebx
cmp dword [ebp - 0x40], ebx
je 0x1001d8c0
mov ecx, edi
mov eax, dword [ebp - 0x48]
imul eax, ecx
test eax, eax
je 0x1001d8d1
mov edx, edi
cmp dword [ebp - 0x7c], ebx
jne 0x1001d8d3
mov edx, ebx
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x48]
neg ecx
sbb ecx, ecx
add eax, edx
add ecx, 0x10000
xor edx, edx
add ecx, eax
mov eax, dword [ebp - 0x28]
cmp ecx, eax
lea ecx, [ebp - 0x78]
setle dl
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
call fcn.1001970b
mov byte [ebp - 0x29], bl
mov dword [ebp - 0x20], 0xb9f9b31
mov dword [ebp - 0x20], 0xffffffe2
cmp dword [ebp - 0x20], 0xffffffe8
jne 0x1001da33
push 2
pop esi
push 3
pop eax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x34], ebx
jmp 0x1001da18
mov dword [ebp - 0x14], edi
lea ecx, [ebp - 0x90]
push eax
call fcn.10019689
push 3
mov dword [ebp - 0x1c], ebx
pop edx
jmp 0x1001d958
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x90]
mov dword [eax + ecx*4], 9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1001d945
mov dword [ebp - 0x14], 0xffffffe9
jmp 0x1001d9ae
mov dword [ebp - 0x1c], 0xffffffff
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001d988
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x1236
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0x1c], ebx
jmp 0x1001d9a6
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001d9a3
push ebx
push 0xc6b
push ebx
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x1001d98d
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jle 0x1001d966
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x14], ebx
jl 0x1001da07
mov dword [ebp - 0x1c], 0x3dda37bb
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001d9e0
push ebx
push ebx
push 0x2325
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DefWindowProcA]
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], ebx
jl 0x1001da02
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x90]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
mov eax, dword [ebp - 0x14]
dec dword [ebp - 0x1c]
jns 0x1001d9e8
dec dword [ebp - 0x14]
jns 0x1001d9bc
lea ecx, [ebp - 0x90]
call fcn.1001970b
inc dword [ebp - 0x34]
push 3
pop eax
cmp dword [ebp - 0x34], eax
jle 0x1001d92e
cmp dword [ebp - 0x20], ebx
jne 0x1001da33
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe8
je 0x1001d923
cmp byte [ebp - 0x29], 0
je 0x1001da56
push ebx
push 0xc65
push 0x1448
push 0x1576
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollRange]
mov dword [ebp - 0x30], 8
mov dword [ebp - 0x24], 0xfffffff7
mov dword [ebp - 0x1c], ebx
jmp 0x1001da77
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x38], 0x6e83
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1001da69
cmp dword [ebp - 0x38], ebx
jne 0x1001dabd
mov eax, dword [ebp - 0x38]
xor ecx, ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
cmp eax, 0xde6b
setle cl
xor edx, edx
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x30]
cmp eax, ecx
mov eax, dword [ebp - 0x38]
setl dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x38]
setge cl
imul eax, ecx
test eax, eax
mov eax, ebx
je 0x1001dabf
mov eax, edi
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x38], ebx
je 0x1001db7c
mov dword [ebp - 0x14], 0xffffffff
mov eax, 0xb3533b01
mov dword [ebp - 0x1c], 0xc2f00273
mov dword [ebp - 0x24], 0xc1a1fd29
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x38]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [ebp - 0x14]
je 0x1001db1b
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
cmp eax, ecx
setne dl
sub edx, dword [ebp - 0x14]
jne 0x1001db40
cmp dword [ebp - 0x14], ebx
jne 0x1001db40
mov edi, ebx
mov dword [ebp - 0x1c], edi
xor edx, edx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
cmp ecx, eax
setg dl
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], ebx
jne 0x1001db5b
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xb8], eax
mov byte [ebp - 0x29], bl
cmp byte [ebp - 0x29], 0
je 0x1001dba2
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1001dba2
mov dword [ebp - 0x30], ebx
jmp 0x1001db9c
mov byte [ebp - 0x29], bl
cmp byte [ebp - 0x29], 0
je 0x1001db99
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnumChildWindows]
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xffffffef
jg 0x1001db81
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret