Function at 0x1001cbc0
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e1c9d
mov eax, dword fs:[0]
push eax
sub esp, 0x22c
mov eax, dword [0x101237f8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov edi, 1
mov dword [ebp - 0x228], esi
call fcn.10004e30
mov ecx, eax
test ecx, ecx
je 0x1001d0b2
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x220], eax
push str.__fromnewinstall
lea ecx, [ebp - 0x220]
mov dword [ebp - 4], 0
call fcn.10004200
test al, al
jne 0x1001cc46
push 0x11
push str.__fromnewinstall
lea ecx, [ebp - 0x220]
call fcn.100055f0
lea eax, [ebp - 0x234]
mov dword [ebp - 4], 1
push eax
lea eax, [ebp - 0x230]
mov dword [ebp - 0x238], 4
push eax
lea eax, [ebp - 0x238]
mov dword [ebp - 0x230], 0
push eax
push str.shortcut
push str.SOFTWAREJianDesk
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x234], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
or ebx, 0xffffffff
test eax, eax
jne 0x1001cca9
cmp dword [ebp - 0x230], 1
je 0x1001d014
lea eax, [ebp - 0x21c]
push eax
call fcn.1000c6c0
add esp, 4
mov eax, dword [ebp - 0x21c]
mov byte [ebp - 4], 2
mov edi, dword [eax - 0xc]
lea edx, [eax - 0x10]
test edi, edi
jne 0x1001ccf2
mov edi, 2
mov byte [ebp - 4], 1
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1001d014
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x1001d014
mov esi, dword [esi]
sub esi, 0x10
cmp edx, esi
je 0x1001cd48
cmp dword [esi + 0xc], 0
jl 0x1001cd35
mov ecx, dword [edx]
cmp ecx, dword [esi]
jne 0x1001cd35
push edx
call fcn.10004340
add esp, 4
lea edx, [esi + 0xc]
mov edi, eax
mov ecx, ebx
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x1001cd28
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [ebp - 0x228]
lea eax, [edi + 0x10]
mov dword [ecx], eax
jmp 0x1001cd42
mov ecx, dword [ebp - 0x228]
push edi
push eax
call fcn.100055f0
mov eax, dword [ebp - 0x21c]
mov ecx, dword [eax - 8]
mov edx, 1
sub edx, dword [eax - 4]
sub ecx, 0x104
or ecx, edx
jge 0x1001cd73
push 0x104
lea ecx, [ebp - 0x21c]
call fcn.100051c0
mov eax, dword [ebp - 0x21c]
push 0x100edb38
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov eax, dword [ebp - 0x21c]
push dword [eax - 8]
push eax
call fcn.100871f1
mov ecx, eax
add esp, 8
test ecx, ecx
js 0x1001d0a8
mov eax, dword [ebp - 0x21c]
cmp ecx, dword [eax - 8]
jg 0x1001d0a8
mov dword [eax - 0xc], ecx
xor edx, edx
mov eax, dword [ebp - 0x21c]
mov word [eax + ecx*2], dx
push dword [ebp - 0x21c]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1001cdd7
mov edx, dword [ebp - 0x21c]
add edx, 0xfffffff0
jmp 0x1001cccc
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.1006a830
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push dword [0x10126b48]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call fcn.10004e30
mov ecx, eax
test ecx, ecx
je 0x1001d0bc
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x228], eax
lea eax, [ebp - 0x228]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.10010aa0
add esp, 8
call fcn.10004e30
mov ecx, eax
test ecx, ecx
je 0x1001d0c6
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x22c], eax
mov byte [ebp - 4], 4
call fcn.10004e30
mov ecx, eax
test ecx, ecx
je 0x1001d0d0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x224], eax
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x224]
call fcn.10004200
test al, al
jne 0x1001cec2
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001cea0
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x224]
call fcn.100055f0
lea eax, [ebp - 0x22c]
mov byte [ebp - 4], 6
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.10010aa0
mov edx, dword [ebp - 0x224]
add esp, 8
mov byte [ebp - 4], 4
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1001cefd
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x22c]
cmp dword [esi - 0xc], 0
jne 0x1001cf58
mov edi, 2
mov byte [ebp - 4], 3
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x1001cf29
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x228]
mov eax, ebx
mov byte [ebp - 4], 2
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1001cf4a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x21c]
add edx, 0xfffffff0
jmp 0x1001ccd1
mov edi, dword [ebp - 0x228]
push edi
push esi
call fcn.1000c1b0
add esp, 8
lea ecx, [ebp - 0x220]
test eax, eax
jns 0x1001cf89
push 0
push 0x100eec50
call fcn.100055f0
or eax, 0xffffffff
mov dword [ebp - 0x224], eax
jmp 0x1001cfb7
jne 0x1001cfa1
push 0
push 0x100eec50
call fcn.100055f0
xor eax, eax
mov dword [ebp - 0x224], eax
jmp 0x1001cfb7
push 0x10
push str.__fromupinstall
mov dword [ebp - 0x224], 1
call fcn.100055f0
mov byte [ebp - 4], 3
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x1001cfd2
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 2
add edi, 0xfffffff0
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x1001cfed
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x21c]
mov eax, ebx
mov byte [ebp - 4], 1
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1001d00e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x224]
mov esi, dword [ebp - 0x220]
cmp dword [esi - 4], 1
jle 0x1001d034
push dword [esi - 0xc]
lea ecx, [ebp - 0x220]
call fcn.10004d80
mov esi, dword [ebp - 0x220]
call fcn.10016a00
add eax, 0x44
mov dword [ebp - 0x22c], eax
test esi, esi
jne 0x1001d04a
xor ecx, ecx
jmp 0x1001d065
mov ecx, esi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001d050
mov eax, dword [ebp - 0x22c]
sub ecx, edx
sar ecx, 1
push ecx
push esi
mov ecx, eax
call fcn.100055f0
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x1001d08a
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005a0a8
mov esp, ebp
pop ebp
ret
push 0x80070057
call fcn.100041e0
push 0x80004005
call fcn.100041e0
push 0x80004005
call fcn.100041e0
push 0x80004005
call fcn.100041e0
push 0x80004005
call fcn.100041e0
int3