Function at 0x8baca0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x22c
mov eax, dword [0xb196ec]
xor eax, esp
mov dword [esp + 0x228], eax
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push edi
lea eax, [esp + 0xc]
push eax
xor ebx, ebx
push 0x20019
push ebx
push 0xaa21e4
push 0x80000002
mov byte [str.C:PROGRA2eScanLOG_avpM.rpt], bl
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
call esi
test eax, eax
jne 0x8bad21
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ecx
push str.C:PROGRA2eScanLOG_avpM.rpt
push ebx
push ebx
push str.ReportPath
push edx
mov dword [esp + 0x28], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x8bad21
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [str.C:PROGRA2eScanLOG_avpM.rpt], bl
jne 0x8bada3
push 0xb55508
push str._sLOG_
push str.C:PROGRA2eScanLOG_avpM.rpt
call fcn.00a78f30
add esp, 0xc
xor ecx, ecx
mov edi, str.C:PROGRA2eScanLOG_avpM.rpt
call fcn.0095a6d0
cmp eax, 1
jne 0x8bad78
mov eax, edi
dec eax
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x8bad54
mov ecx, dword [str.avpM.rpt]
mov edx, dword [0xaba758]
mov dword [eax], ecx
mov cl, byte [0xaba75c]
mov dword [eax + 4], edx
mov byte [eax + 8], cl
jmp 0x8bad8a
push str.avpM.rpt
push str.C:PROGRA2eScanLOG_avpM.rpt
call fcn.00a78f30
add esp, 8
push str.C:PROGRA2eScanLOG_avpM.rpt
push 0xaa21e4
mov edx, str.ReportPath
mov ecx, 0x80000002
call fcn.0094bd00
lea edx, [esp + 0xc]
push edx
push 0x20019
push ebx
push 0xaa21e4
push 0x80000002
mov byte [str.C:PROGRA2eScanInfected], bl
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
call esi
test eax, eax
jne 0x8badff
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
push str.C:PROGRA2eScanInfected
push ebx
push ebx
push str.BackUpFolder
push ecx
mov dword [esp + 0x28], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x8badff
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [str.C:PROGRA2eScanInfected], bl
jne 0x8bae9b
xor eax, eax
lea ecx, [ecx]
mov cl, byte [eax + 0xb55508]
mov byte [eax + str.C:PROGRA2eScanInfected], cl
inc eax
cmp cl, bl
jne 0x8bae10
cmp byte [str.C:PROGRA2eScanInfected], bl
je 0x8bae55
mov eax, str.C:PROGRA2eScanInfected
mov edi, edi
inc eax
cmp byte [eax], bl
jne 0x8bae30
sub eax, str.C:PROGRA2eScanInfected
je 0x8bae55
cmp byte [eax + 0xbc23d7], 0x5c
je 0x8bae55
push 0xaa1564
push str.C:PROGRA2eScanInfected
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, str.C:PROGRA2eScanInfected
dec eax
jmp 0x8bae60
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x8bae60
mov edx, dword [str.Infected]
mov ecx, dword [0xaba774]
mov dword [eax], edx
mov dl, byte [0xaba778]
mov dword [eax + 4], ecx
push str.C:PROGRA2eScanInfected
mov byte [eax + 8], dl
push 0xaa21e4
mov edx, str.BackUpFolder
mov ecx, 0x80000002
call fcn.0094bd00
cmp dword [0xb3ddd0], 0xffffffff
jne 0x8baeae
call fcn.0091ded0
mov dword [0xb3ddd0], eax
push str.FBackUpFolder
lea eax, [esp + 0x1c]
mov edi, 0xb8dff8
mov ecx, str.SoftwareMicroWorld
mov edx, 0x80000002
mov byte [0xb8dff8], bl
mov dword [esp + 0x1c], 0x208
call fcn.0094c020
cmp al, 1
jne 0x8baf0a
cmp byte [0xb8dff8], bl
je 0x8baf0a
cmp dword [0xb45d94], ebx
je 0x8baf0a
cmp dword [0xb3ddd0], ebx
je 0x8bb05c
mov eax, edi
call fcn.00974c00
test eax, eax
jne 0x8baf0a
mov byte [0xb8dff8], bl
cmp dword [0xb3ddd0], ebx
je 0x8bb05c
cmp byte [0xb8dff8], bl
jne 0x8bb05c
xor eax, eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x1c], bl
mov dword [esp + 0x1d], eax
mov dword [esp + 0x21], eax
mov byte [esp + 0x25], al
call fcn.0098bef0
cmp byte [esp + 0x1c], bl
je 0x8bafa4
lea eax, [esp + 0x1c]
push eax
push 0xb8dff8
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, 0xb8dff8
call fcn.00960910
push 0xaba78c
push 0xb8dff8
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp dword [0xb45d94], ebx
je 0x8bafa4
mov eax, 0xb8dff8
call fcn.00974c00
test eax, eax
jne 0x8baf8b
mov byte [0xb8dff8], bl
jmp 0x8bafb0
push 0xb8dff8
push str.SoftwareMicroWorld
mov edx, str.FBackUpFolder
mov ecx, 0x80000002
call fcn.0094bd00
cmp byte [0xb8dff8], bl
jne 0x8bb05c
cmp byte [str.C:PROGRA2eScanInfected], bl
je 0x8bb020
push 0x207
lea ecx, [esp + 0x2d]
push ebx
push ecx
mov byte [esp + 0x34], bl
call fcn.00a7ffb0
add esp, 0xc
xor eax, eax
mov cl, byte [eax + str.C:PROGRA2eScanInfected]
mov byte [esp + eax + 0x28], cl
inc eax
cmp cl, bl
jne 0x8bafd1
lea esi, [esp + 0x28]
call fcn.00960950
mov edx, esi
push 0x5c
push edx
call fcn.00a7bbc7
add esp, 8
cmp eax, ebx
je 0x8bb018
mov ecx, esi
mov byte [eax], bl
call fcn.00960910
mov eax, esi
push eax
push str._sFBackUp
push 0xb8dff8
call fcn.00a78f30
add esp, 0xc
cmp byte [0xb8dff8], bl
jne 0x8bb05c
xor eax, eax
mov cl, byte [eax + 0xb55508]
mov byte [eax + 0xb8dff8], cl
inc eax
cmp cl, bl
jne 0x8bb022
mov ecx, 0xb8dff8
call fcn.00960910
mov eax, 0xb8dff8
dec eax
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x8bb043
mov ecx, dword [str.FBackUp]
mov edx, dword [0xaba7a4]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov byte [str.C:PROGRA2eScanGroups], bl
mov byte [str.C:Program_Files__x86_eScanGroupsTemp], bl
xor eax, eax
lea ebx, [ebx]
mov cl, byte [eax + 0xb55508]
mov byte [eax + str.C:PROGRA2eScanGroups], cl
inc eax
cmp cl, bl
jne 0x8bb070
cmp byte [str.C:PROGRA2eScanGroups], bl
je 0x8bb0b9
mov eax, str.C:PROGRA2eScanGroups
mov edi, edi
inc eax
cmp byte [eax], bl
jne 0x8bb090
sub eax, str.C:PROGRA2eScanGroups
je 0x8bb0b9
cmp byte [eax + 0xbd106f], 0x5c
je 0x8bb0b9
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0xaa1564
push str.C:PROGRA2eScanGroups
call esi
jmp 0x8bb0bf
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, str.C:PROGRA2eScanGroups
dec eax
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x8bb0c5
mov ecx, dword [str.Groups]
mov dx, word [0xac8740]
mov dword [eax], ecx
mov cl, byte [0xac8742]
mov word [eax + 4], dx
mov byte [eax + 6], cl
mov ecx, str.C:PROGRA2eScanGroups
call fcn.0095a450
test eax, eax
je 0x8bb14d
push str.C:PROGRA2eScanGroups
push str.C:Program_Files__x86_eScanGroupsTemp
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp byte [str.C:Program_Files__x86_eScanGroupsTemp], bl
je 0x8bb135
mov eax, str.C:Program_Files__x86_eScanGroupsTemp
inc eax
cmp byte [eax], bl
jne 0x8bb114
sub eax, str.C:Program_Files__x86_eScanGroupsTemp
je 0x8bb135
cmp byte [eax + 0xbd1177], 0x5c
je 0x8bb135
push 0xaa1564
push str.C:Program_Files__x86_eScanGroupsTemp
call esi
push str.TEMP
push str.C:Program_Files__x86_eScanGroupsTemp
call esi
mov eax, str.C:Program_Files__x86_eScanGroupsTemp
call fcn.00974c00
jmp 0x8bb153
mov byte [str.C:PROGRA2eScanGroups], bl
cmp byte [str.C:Program_Files__x86_eScanGroupsTemp], bl
je 0x8bb193
xor ecx, ecx
mov edi, str.C:Program_Files__x86_eScanGroupsTemp
call fcn.0095a6d0
cmp eax, 1
jne 0x8bb18d
push 0x104
lea ebx, [esp + 0x2c]
mov esi, edi
call fcn.00957fa0
add esp, 4
mov edx, ebx
push edx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor ebx, ebx
jmp 0x8bb193
mov byte [str.C:Program_Files__x86_eScanGroupsTemp], bl
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 0xc]
push eax
push 0x20019
push ebx
push 0xaa21e4
push 0x80000002
mov byte [0xbc27e8], bl
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
call edi
test eax, eax
jne 0x8bb1f5
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ecx
push 0xbc27e8
push ebx
push ebx
push str.Extension_of_Infected_File
push edx
mov dword [esp + 0x28], 0x14
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x8bb1f5
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [0xbc27e8], bl
jne 0x8bb220
push 0xbc27e8
push 0xaa21e4
mov edx, str.Extension_of_Infected_File
mov ecx, 0x80000002
mov dword [0xbc27e8], 0x524956
call fcn.0094bd00
lea eax, [esp + 0xc]
push eax
push 0x20019
push ebx
push 0xaa21e4
push 0x80000002
mov byte [str.C:PROGRA2eScanInfected.wav], bl
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
call edi
test eax, eax
jne 0x8bb27c
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ecx
push str.C:PROGRA2eScanInfected.wav
push ebx
push ebx
push str.InfectedSound
push edx
mov dword [esp + 0x28], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x8bb27c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [str.C:PROGRA2eScanInfected.wav], bl
jne 0x8bb324
xor eax, eax
lea ebx, [ebx]
mov cl, byte [eax + 0xb55508]
mov byte [eax + str.C:PROGRA2eScanInfected.wav], cl
inc eax
cmp cl, bl
jne 0x8bb290
cmp byte [str.C:PROGRA2eScanInfected.wav], bl
je 0x8bb2d5
mov eax, str.C:PROGRA2eScanInfected.wav
mov edi, edi
inc eax
cmp byte [eax], bl
jne 0x8bb2b0
sub eax, str.C:PROGRA2eScanInfected.wav
je 0x8bb2d5
cmp byte [eax + 0xbc25df], 0x5c
je 0x8bb2d5
push 0xaa1564
push str.C:PROGRA2eScanInfected.wav
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, str.C:PROGRA2eScanInfected.wav
dec eax
jmp 0x8bb2e0
mov cl, byte [eax + 1]
inc eax
cmp cl, bl
jne 0x8bb2e0
mov ecx, dword [str.Infected.wav]
mov edx, dword [0xaba7dc]
mov dword [eax], ecx
mov ecx, dword [0xaba7e0]
mov dword [eax + 4], edx
mov dl, byte [0xaba7e4]
mov dword [eax + 8], ecx
push str.C:PROGRA2eScanInfected.wav
mov byte [eax + 0xc], dl
push 0xaa21e4
mov edx, str.InfectedSound
mov ecx, 0x80000002
call fcn.0094bd00
lea eax, [esp + 0xc]
push eax
push 0x20019
push ebx
push 0xaa21e4
push 0x80000002
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
call edi
mov esi, 4
test eax, eax
je 0x8bb350
xor eax, eax
jmp 0x8bb387
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push edx
push ebx
push ebx
push str.ReturnWithoutScanning
push eax
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x8bb383
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0xc]
push ecx
push 0x20019
push ebx
push 0xaa21e4
push 0x80000002
mov dword [0xb8db14], eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], ebx
call edi
test eax, eax
je 0x8bb3ca
mov dword [0xb8db10], ebx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x228]
xor ecx, esp
call fcn.00a78f21
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
push ebx
push ebx
push str.UseAskUser
push ecx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 0xc]
cmp eax, ebx
je 0x8bb3fd
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x234]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
xor ecx, esp
mov dword [0xb8db10], eax
call fcn.00a78f21
mov esp, ebp
pop ebp
ret