Function at 0x12007e3c
Capabilities:
Enumerate files on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5a0
mov eax, dword [ebp + 0xc]
push ebx
xor ebx, ebx
push esi
cmp dword [eax], ebx
push edi
jne 0x120081eb
mov esi, dword [ebp + 8]
cmp esi, ebx
je 0x120081eb
cmp byte [esi], bl
je 0x120081eb
mov al, byte [0x120b7bd0]
push 0x40
mov byte [ebp - 0x154], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x153]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, 0x104
lea eax, [ebp - 0x154]
push edi
push eax
push ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x2c], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x154]
push eax
call fcn.12007d4f
add esp, 0xc
mov dword [ebp - 0x10], ebx
jmp 0x12007ebe
mov edi, 0x104
mov eax, dword [ebp + 0xc]
cmp dword [eax], ebx
jne 0x120081eb
push 0x5c
push esi
call fcn.12055fb0
pop ecx
test eax, eax
pop ecx
jne 0x12007f8a
cmp dword [ebp - 0x10], ebx
jne 0x12007ef1
lea eax, [ebp - 0x154]
push edi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
jmp 0x12007f70
lea eax, [ebp - 0x34]
push eax
push 0x20019
push ebx
push str.softwareGator.comGatordyn
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x12007f70
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], edi
push eax
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push str.AppPath
mov dword [ebp - 0x1c], ebx
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x34]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
jne 0x120081eb
lea eax, [ebp - 0x154]
push eax
call fcn.12055dd0
cmp byte [ebp + eax - 0x155], 0x5c
pop ecx
je 0x12007f70
lea eax, [ebp - 0x154]
push 0x120a9b58
push eax
call fcn.12055e90
pop ecx
pop ecx
lea eax, [ebp - 0x154]
push 0x5c
push eax
call fcn.12055f70
pop ecx
cmp eax, ebx
pop ecx
push dword [ebp + 8]
je 0x12007f8b
inc eax
jmp 0x12007f91
push esi
lea eax, [ebp - 0x154]
push eax
call fcn.12055e80
pop ecx
lea eax, [ebp - 0x154]
pop ecx
push 0x5c
push eax
call fcn.12055f70
inc eax
pop ecx
mov dword [ebp - 0x38], eax
pop ecx
lea eax, [ebp - 0x294]
push eax
lea eax, [ebp - 0x154]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x30], eax
je 0x120081cd
xor edi, edi
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x40], ebx
xor esi, esi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], ebx
lea eax, [ebp - 0x268]
push eax
push dword [ebp - 0x38]
call fcn.12055e80
pop ecx
lea eax, [ebp - 0x154]
pop ecx
push 8
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
cmp eax, ebx
mov dword [ebp - 0x28], eax
je 0x12008108
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x154]
push eax
call fcn.12007d4f
push dword [ebp - 0x2c]
push dword [ebp - 0x24]
push dword [ebp - 0x18]
push dword [ebp - 0x20]
call fcn.12007e1e
add esp, 0x1c
test eax, eax
jne 0x1200807f
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x280]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.12007dcb
add esp, 0x10
test eax, eax
je 0x12008108
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x398]
jmp 0x12008100
push esi
push edi
push dword [ebp - 0x18]
push dword [ebp - 0x20]
call fcn.12007e1e
add esp, 0x10
cmp eax, 1
jg 0x120080c8
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x280]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.12007dcb
add esp, 0x10
test eax, eax
je 0x12008108
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x18]
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x5a0]
jmp 0x12008100
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x280]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.12007dcb
add esp, 0x10
test eax, eax
je 0x12008108
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x49c]
push eax
call fcn.12055e80
pop ecx
pop ecx
lea eax, [ebp - 0x294]
push eax
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x12007ff2
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 8]
cmp eax, ebx
je 0x12008150
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
mov dword [ecx], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x24]
mov dword [ecx], eax
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp - 0x2c]
mov dword [ecx], eax
lea eax, [ebp - 0x398]
jmp 0x12008196
mov eax, dword [ebp - 4]
cmp eax, ebx
je 0x12008171
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ebx
mov dword [ecx], eax
mov eax, dword [ebp + 0x10]
mov dword [eax], edi
mov eax, dword [ebp + 0x14]
mov dword [eax], esi
lea eax, [ebp - 0x5a0]
jmp 0x12008196
mov eax, dword [ebp - 0xc]
cmp eax, ebx
je 0x120081cd
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc], ebx
mov dword [ecx], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x1c]
mov dword [ecx], eax
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp - 0x14]
mov dword [ecx], eax
lea eax, [ebp - 0x49c]
push eax
push 0x120b7d00
call fcn.12055e80
cmp dword [ebp - 8], ebx
pop ecx
pop ecx
je 0x120081b1
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 4], ebx
je 0x120081bf
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0xc], ebx
je 0x120081cd
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [ebp + 8]
push 0x5c
push esi
call fcn.12055fb0
pop ecx
test eax, eax
pop ecx
jne 0x120081eb
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x12007eb9
mov ecx, dword [ebp + 0xc]
xor eax, eax
pop edi
pop esi
cmp dword [ecx], ebx
pop ebx
setne al
leave
ret