Function at 0x1008c792
Capabilities:
Enumerate files on windows
Query or enumerate registry value

Disassembly:
mov eax, 0x100df27d
call fcn.100ac440
sub esp, 0x294
mov eax, dword [0x1011c710]
push ebx
push esi
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
push edi
xor esi, esi
push str.CurrentVersion
lea ecx, [ebp - 0x264]
mov dword [ebp - 0x280], eax
mov dword [ebp - 0x268], esi
mov dword [ebp - 0x274], esi
call fcn.1000223a
push 0x41
pop ecx
xor eax, eax
mov byte [ebp - 0x118], 0
lea edi, [ebp - 0x117]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x25c]
push ecx
inc eax
push eax
push esi
push str.SOFTWAREMacromediaFlashPlayer
mov dword [ebp - 0x25c], esi
mov edi, 0x80000002
mov dword [ebp - 4], esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push edi
mov dword [ebp - 0x298], eax
mov dword [ebp - 0x288], 0x104
call esi
test eax, eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x1008c8bc
cmp dword [ebp - 0x25c], 0
je 0x1008c8ad
lea eax, [ebp - 0x288]
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x298]
push eax
push 0
push dword [ebp - 0x264]
push dword [ebp - 0x25c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1008c8ad
lea eax, [ebp - 0x118]
push eax
call fcn.100ab7d0
test eax, eax
pop ecx
jbe 0x1008c8ad
mov ecx, dword [ebp - 0x280]
lea eax, [ebp - 0x118]
push eax
call fcn.10001f92
mov ecx, dword [ebp - 0x280]
push 0x2e
push 0x2c
call fcn.10022eae
push dword [ebp - 0x25c]
mov dword [ebp - 0x274], 1
call ebx
jmp 0x1008ccb3
push dword [ebp - 0x25c]
call ebx
and dword [ebp - 0x25c], 0
push str.PlayerPath
lea ecx, [ebp - 0x264]
call fcn.10001f92
push 0x105
lea eax, [ebp - 0x118]
push 0
push eax
mov dword [ebp - 0x288], 0x104
call fcn.100ab720
add esp, 0xc
lea eax, [ebp - 0x25c]
push eax
push 1
push 0
push str.SOFTWAREMacromediaFlashPlayerActiveX
push edi
call esi
test eax, eax
jne 0x1008ca12
xor esi, esi
cmp dword [ebp - 0x25c], esi
je 0x1008ca04
lea eax, [ebp - 0x288]
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x298]
push eax
push esi
push dword [ebp - 0x264]
push dword [ebp - 0x25c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1008ca04
lea eax, [ebp - 0x118]
push eax
call fcn.100ab7d0
test eax, eax
pop ecx
jbe 0x1008ca04
lea eax, [ebp - 0x118]
push esi
push eax
call fcn.100ad0b7
test eax, eax
pop ecx
pop ecx
jne 0x1008ca04
lea ecx, [ebp - 0x27c]
call fcn.1001e5ef
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x27c]
mov byte [ebp - 4], 1
call fcn.1001e60d
test eax, eax
lea ecx, [ebp - 0x27c]
je 0x1008c9fb
lea eax, [ebp - 0x270]
push eax
call fcn.1001e6c2
mov ecx, dword [ebp - 0x280]
push eax
mov byte [ebp - 4], 2
call fcn.10001eb6
mov ecx, dword [ebp - 0x270]
add ecx, 0xfffffff0
mov byte [ebp - 4], 1
call fcn.10001199
lea ecx, [ebp - 0x27c]
mov dword [ebp - 0x274], 1
call fcn.1001e5f9
push dword [ebp - 0x25c]
call ebx
lea ecx, [ebp - 0x27c]
mov byte [ebp - 4], 0
call fcn.1001e6bd
jmp 0x1008ccb3
mov byte [ebp - 4], 0
call fcn.1001e6bd
push dword [ebp - 0x25c]
call ebx
mov dword [ebp - 0x25c], esi
push str.C:WINDOWS_system32MacromedFlash_
lea ecx, [ebp - 0x28c]
call fcn.1000223a
push 0x100e4c6c
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x270]
push eax
mov byte [ebp - 4], 3
call fcn.10001e18
add esp, 0xc
lea eax, [ebp - 0x258]
push eax
push dword [ebp - 0x270]
mov byte [ebp - 4], 4
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x1008cc90
mov esi, 0x100e2d52
push esi
lea ecx, [ebp - 0x260]
call fcn.1000223a
push esi
lea ecx, [ebp - 0x284]
mov byte [ebp - 4], 5
call fcn.1000223a
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x26c]
mov byte [ebp - 4], 6
call fcn.1000223a
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x2a0]
push eax
mov byte [ebp - 4], 7
call fcn.10001da8
add esp, 0xc
push eax
lea ecx, [ebp - 0x260]
mov byte [ebp - 4], 8
call fcn.10001eb6
mov ecx, dword [ebp - 0x2a0]
add ecx, 0xfffffff0
mov byte [ebp - 4], 7
call fcn.10001199
push 0x2e
lea ecx, [ebp - 0x260]
call fcn.10003e18
cmp eax, 0xffffffff
je 0x1008cb2f
mov ecx, dword [ebp - 0x260]
mov ecx, dword [ecx - 0xc]
sub ecx, eax
push ecx
lea eax, [ebp - 0x29c]
push eax
lea ecx, [ebp - 0x260]
call fcn.10008b05
push eax
lea ecx, [ebp - 0x284]
mov byte [ebp - 4], 9
call fcn.10001eb6
mov ecx, dword [ebp - 0x29c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 7
call fcn.10001199
push str..ocx
push dword [ebp - 0x284]
call fcn.100ace10
test eax, eax
pop ecx
pop ecx
jne 0x1008cb77
push 5
lea eax, [ebp - 0x278]
push eax
lea ecx, [ebp - 0x26c]
call fcn.1000430d
mov eax, dword [eax]
or dword [ebp - 0x268], 1
push str.Flash
push eax
call fcn.100ace10
test eax, eax
pop ecx
pop ecx
jne 0x1008cb77
mov bl, 1
jmp 0x1008cb79
xor bl, bl
test byte [ebp - 0x268], 1
je 0x1008cb97
mov ecx, dword [ebp - 0x278]
and dword [ebp - 0x268], 0xfffffffe
add ecx, 0xfffffff0
call fcn.10001199
test bl, bl
je 0x1008cbce
lea ecx, [ebp - 0x294]
call fcn.1001e5ef
push dword [ebp - 0x260]
lea ecx, [ebp - 0x294]
mov byte [ebp - 4], 0xa
call fcn.1001e60d
test eax, eax
lea ecx, [ebp - 0x294]
jne 0x1008cc14
mov byte [ebp - 4], 7
call fcn.1001e6bd
mov ecx, dword [ebp - 0x26c]
add ecx, 0xfffffff0
call fcn.10001199
mov ecx, dword [ebp - 0x284]
add ecx, 0xfffffff0
call fcn.10001199
mov ecx, dword [ebp - 0x260]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.10001199
lea eax, [ebp - 0x258]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1008ca68
jmp 0x1008cc90
lea eax, [ebp - 0x278]
push eax
call fcn.1001e6c2
mov ecx, dword [ebp - 0x280]
push eax
mov byte [ebp - 4], 0xb
call fcn.10001eb6
mov ecx, dword [ebp - 0x278]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0xa
call fcn.10001199
lea ecx, [ebp - 0x294]
mov dword [ebp - 0x274], 1
call fcn.1001e5f9
lea ecx, [ebp - 0x294]
mov byte [ebp - 4], 7
call fcn.1001e6bd
mov ecx, dword [ebp - 0x26c]
add ecx, 0xfffffff0
call fcn.10001199
mov ecx, dword [ebp - 0x284]
add ecx, 0xfffffff0
call fcn.10001199
mov ecx, dword [ebp - 0x260]
add ecx, 0xfffffff0
call fcn.10001199
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0x270]
add ecx, 0xfffffff0
call fcn.10001199
mov ecx, dword [ebp - 0x28c]
add ecx, 0xfffffff0
call fcn.10001199
mov ecx, dword [ebp - 0x264]
add ecx, 0xfffffff0
call fcn.10001199
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x274]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
xor ecx, ebp
pop ebx
call fcn.100ac33f
leave
ret 4