Function at 0x1002be0d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10044855
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x6c8
push esi
mov dword [ebp - 0x6c4], ecx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x6c4]
call fcn.1002ba4b
test eax, eax
je 0x1002be74
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
call fcn.1004126a
mov dword [ebp - 0x14], 0
cmp dword [0x10051ab8], 0
je 0x1002bfa1
push 0
push 2
call dword [0x10051abc]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x148], 0x128
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call dword [0x10051ac0]
mov dword [ebp - 0x20], eax
jmp 0x1002bec9
lea eax, [ebp - 0x148]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [0x10051ac4]
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x1002bf92
cmp dword [ebp - 0x20], 0
je 0x1002bf8d
mov edx, 1
test edx, edx
je 0x1002bef7
mov dword [ebp - 0x6c8], 0
jmp 0x1002bf1a
lea eax, [ebp - 0x124]
push eax
lea ecx, [ebp - 0x10]
call fcn.10027650
push eax
push str.checking__s_____s_n
call fcn.1002aa30
add esp, 0xc
mov dword [ebp - 0x6c8], eax
lea ecx, [ebp - 0x124]
push ecx
lea ecx, [ebp - 0x14c]
call sub.MFC42.DLL_CString::CString_3
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::MakeLower
lea ecx, [ebp - 0x14c]
call sub.MFC42.DLL_CString::MakeLower
lea ecx, [ebp - 0x14c]
call fcn.10027650
push eax
lea ecx, [ebp - 0x10]
call fcn.10027650
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x1002bf7e
mov edx, dword [ebp - 0x140]
mov dword [ebp - 0x14], edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14c]
call fcn.100411da
jmp 0x1002bf92
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14c]
call fcn.100411da
jmp 0x1002beb5
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1002c680
mov dword [ebp - 0x160], 0
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x180]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 3
push 0x5c
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::ReverseFind
mov dword [ebp - 0x15c], eax
lea ecx, [ebp - 0x698]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 4
cmp dword [ebp - 0x15c], 0
jl 0x1002c036
mov edx, dword [ebp - 0x15c]
add edx, 1
push edx
lea eax, [ebp - 0x6a8]
push eax
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::Mid
mov dword [ebp - 0x6cc], eax
mov ecx, dword [ebp - 0x6cc]
mov dword [ebp - 0x6d0], ecx
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0x6d0]
push edx
lea ecx, [ebp - 0x180]
call fcn.1004126a
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x6a8]
call fcn.100411da
lea ecx, [ebp - 0x180]
call sub.MFC42.DLL_CString::MakeUpper
mov word [ebp - 0x158], 9
mov eax, dword [ebp - 0x158]
and eax, 0xffff
push eax
push str.softwaremicrosoftwindows_ntcurrentversionperflib
push str._s_03x
lea ecx, [ebp - 0x694]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea edx, [ebp - 0x154]
push edx
push 0x20019
push 0
lea eax, [ebp - 0x694]
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0
je 0x1002c0a4
jmp 0x1002c631
lea ecx, [ebp - 0x18c]
push ecx
push 0
lea edx, [ebp - 0x164]
push edx
push 0
push 0x1005103c
mov eax, dword [ebp - 0x154]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0
je 0x1002c0dc
jmp 0x1002c631
mov ecx, dword [ebp - 0x18c]
push ecx
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [ebp - 0x6ac], eax
mov edx, dword [ebp - 0x6ac]
mov dword [ebp - 0x160], edx
cmp dword [ebp - 0x160], 0
jne 0x1002c10b
jmp 0x1002c631
mov eax, dword [ebp - 0x18c]
push eax
push 0
mov ecx, dword [ebp - 0x160]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
lea edx, [ebp - 0x18c]
push edx
mov eax, dword [ebp - 0x160]
push eax
lea ecx, [ebp - 0x164]
push ecx
push 0
push str.Counters
mov edx, dword [ebp - 0x154]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0
je 0x1002c160
jmp 0x1002c631
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x150], eax
mov ecx, dword [ebp - 0x150]
movsx edx, byte [ecx]
test edx, edx
je 0x1002c2c0
mov eax, dword [ebp - 0x150]
cmp eax, dword [ebp - 0x160]
jbe 0x1002c1c4
mov ecx, dword [ebp - 0x150]
sub ecx, 2
mov dword [ebp - 0x188], ecx
jmp 0x1002c1ab
mov edx, dword [ebp - 0x188]
sub edx, 1
mov dword [ebp - 0x188], edx
mov eax, dword [ebp - 0x188]
movsx ecx, byte [eax]
push ecx
call dword [sym.imp.MSVCRT.dll_isdigit]
add esp, 4
test eax, eax
je 0x1002c1c4
jmp 0x1002c19c
push str.process
mov edx, dword [ebp - 0x150]
push edx
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
test eax, eax
jne 0x1002c231
mov eax, dword [ebp - 0x150]
sub eax, 2
mov dword [ebp - 0x188], eax
jmp 0x1002c1fd
mov ecx, dword [ebp - 0x188]
sub ecx, 1
mov dword [ebp - 0x188], ecx
mov edx, dword [ebp - 0x188]
movsx eax, byte [edx]
push eax
call dword [sym.imp.MSVCRT.dll_isdigit]
add esp, 4
test eax, eax
je 0x1002c216
jmp 0x1002c1ee
mov ecx, dword [ebp - 0x188]
add ecx, 1
push ecx
lea edx, [ebp - 0x694]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
jmp 0x1002c29c
push str.id_process
mov eax, dword [ebp - 0x150]
push eax
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
test eax, eax
jne 0x1002c29c
mov ecx, dword [ebp - 0x150]
sub ecx, 2
mov dword [ebp - 0x188], ecx
jmp 0x1002c26a
mov edx, dword [ebp - 0x188]
sub edx, 1
mov dword [ebp - 0x188], edx
mov eax, dword [ebp - 0x188]
movsx ecx, byte [eax]
push ecx
call dword [sym.imp.MSVCRT.dll_isdigit]
add esp, 4
test eax, eax
je 0x1002c283
jmp 0x1002c25b
mov edx, dword [ebp - 0x188]
add edx, 1
push edx
call dword [sym.imp.MSVCRT.dll_atol]
add esp, 4
mov dword [ebp - 0x174], eax
mov eax, dword [ebp - 0x150]
push eax
call sub.MSVCRT.dll_strlen
add esp, 4
mov ecx, dword [ebp - 0x150]
lea edx, [ecx + eax + 1]
mov dword [ebp - 0x150], edx
jmp 0x1002c16c
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x6b0], eax
mov ecx, dword [ebp - 0x6b0]
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov dword [ebp - 0x18c], 0xc800
mov edx, dword [ebp - 0x18c]
push edx
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [ebp - 0x6b4], eax
mov eax, dword [ebp - 0x6b4]
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0
jne 0x1002c314
jmp 0x1002c631
mov ecx, dword [ebp - 0x18c]
push ecx
push 0
mov edx, dword [ebp - 0x160]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x18c]
push eax
mov ecx, dword [ebp - 0x160]
push ecx
lea edx, [ebp - 0x164]
push edx
push 0
lea eax, [ebp - 0x694]
push eax
push reloc.WSOCK32.dll_connect
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x168], eax
mov ecx, dword [ebp - 0x160]
mov dword [ebp - 0x6a0], ecx
cmp dword [ebp - 0x168], 0
jne 0x1002c3be
cmp dword [ebp - 0x18c], 0
jbe 0x1002c3be
mov edx, dword [ebp - 0x6a0]
xor eax, eax
mov ax, word [edx]
cmp eax, 0x50
jne 0x1002c3be
mov ecx, dword [ebp - 0x6a0]
xor edx, edx
mov dx, word [ecx + 2]
cmp edx, 0x45
jne 0x1002c3be
mov eax, dword [ebp - 0x6a0]
xor ecx, ecx
mov cx, word [eax + 4]
cmp ecx, 0x52
jne 0x1002c3be
mov edx, dword [ebp - 0x6a0]
xor eax, eax
mov ax, word [edx + 6]
cmp eax, 0x46
jne 0x1002c3be
jmp 0x1002c403
cmp dword [ebp - 0x168], 0xea
jne 0x1002c3f9
mov ecx, dword [ebp - 0x18c]
add ecx, 0x6400
mov dword [ebp - 0x18c], ecx
mov edx, dword [ebp - 0x160]
mov dword [ebp - 0x6b8], edx
mov eax, dword [ebp - 0x6b8]
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
jmp 0x1002c3fe
jmp 0x1002c631
jmp 0x1002c2e5
mov ecx, dword [ebp - 0x6a0]
mov edx, dword [ebp - 0x6a0]
add edx, dword [ecx + 0x18]
mov dword [ebp - 0x170], edx
mov eax, dword [ebp - 0x170]
mov ecx, dword [ebp - 0x170]
add ecx, dword [eax + 8]
mov dword [ebp - 0x294], ecx
mov dword [ebp - 0x184], 0
jmp 0x1002c448
mov edx, dword [ebp - 0x184]
add edx, 1
mov dword [ebp - 0x184], edx
mov eax, dword [ebp - 0x170]
mov ecx, dword [ebp - 0x184]
cmp ecx, dword [eax + 0x20]
jae 0x1002c48c
mov edx, dword [ebp - 0x294]
mov eax, dword [edx + 4]
cmp eax, dword [ebp - 0x174]
jne 0x1002c47b
mov ecx, dword [ebp - 0x294]
mov edx, dword [ecx + 0x24]
mov dword [ebp - 0x178], edx
jmp 0x1002c48c
mov eax, dword [ebp - 0x294]
add eax, 0x28
mov dword [ebp - 0x294], eax
jmp 0x1002c439
mov ecx, dword [ebp - 0x170]
mov edx, dword [ecx + 0x28]
mov dword [ebp - 0x69c], edx
mov eax, dword [ebp - 0x170]
mov ecx, dword [ebp - 0x170]
add ecx, dword [eax + 4]
mov dword [ebp - 0x16c], ecx
mov dword [ebp - 0x184], 0
jmp 0x1002c4cb
mov edx, dword [ebp - 0x184]
add edx, 1
mov dword [ebp - 0x184], edx
mov eax, dword [ebp - 0x184]
cmp eax, dword [ebp - 0x69c]
jae 0x1002c631
mov ecx, dword [ebp - 0x16c]
mov edx, dword [ebp - 0x16c]
add edx, dword [ecx + 0x10]
mov dword [ebp - 0x150], edx
push 0
push 0
push 0x104
lea eax, [ebp - 0x290]
push eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x150]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0
je 0x1002c618
mov edx, dword [ebp - 0x16c]
mov eax, dword [ebp - 0x16c]
add eax, dword [edx]
mov dword [ebp - 0x17c], eax
mov ecx, dword [ebp - 0x17c]
add ecx, dword [ebp - 0x178]
mov edx, dword [ecx]
mov dword [ebp - 0x6a4], edx
cmp dword [ebp - 0x6a4], 0
jbe 0x1002c618
lea eax, [ebp - 0x290]
push eax
lea ecx, [ebp - 0x698]
call fcn.100411e6
mov ecx, 1
test ecx, ecx
je 0x1002c584
mov dword [ebp - 0x6d4], 0
jmp 0x1002c5b6
lea ecx, [ebp - 0x180]
call fcn.10027650
push eax
mov edx, dword [ebp - 0x6a4]
push edx
lea ecx, [ebp - 0x698]
call fcn.10027650
push eax
push str.found_process:___s__:__lu_check___s__n
call fcn.1002aa30
add esp, 0x10
mov dword [ebp - 0x6d4], eax
lea ecx, [ebp - 0x698]
call fcn.1000ab00
mov esi, eax
lea ecx, [ebp - 0x180]
call fcn.1000ab00
cmp esi, eax
jg 0x1002c618
lea ecx, [ebp - 0x698]
call sub.MFC42.DLL_CString::MakeUpper
lea ecx, [ebp - 0x698]
call fcn.1000ab00
push eax
lea ecx, [ebp - 0x180]
call fcn.10027650
push eax
lea ecx, [ebp - 0x698]
call fcn.10027650
push eax
call fcn.1002d000
add esp, 0xc
test eax, eax
jne 0x1002c618
mov eax, dword [ebp - 0x6a4]
mov dword [ebp - 0x14], eax
jmp 0x1002c631
mov ecx, dword [ebp - 0x17c]
mov edx, dword [ebp - 0x17c]
add edx, dword [ecx]
mov dword [ebp - 0x16c], edx
jmp 0x1002c4bc
cmp dword [ebp - 0x160], 0
je 0x1002c655
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x6bc], eax
mov ecx, dword [ebp - 0x6bc]
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov edx, dword [ebp - 0x154]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x698]
call fcn.100411da
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x180]
call fcn.100411da
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x6c0], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.100411da
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.100411da
mov eax, dword [ebp - 0x6c0]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4