Function at 0x10018e30
Capabilities:
Delete registry value
Print debug messages
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100901f8
push 0x1005aa50
mov eax, dword fs:[0]
push eax
sub esp, 0x558
mov eax, dword [0x1009cbc0]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x55c], ecx
xor eax, eax
mov dword [ebp - 0x554], eax
mov dword [ebp - 0x540], eax
mov dword [ebp - 0x548], 4
mov dword [ebp - 0x550], 4
mov dword [ebp - 0x544], eax
mov dword [ebp - 0x53c], str.l0_dep
lea eax, [ecx + 0x54]
mov dword [ebp - 0x538], eax
mov dword [ebp - 0x534], str.l0_dephdlr
lea eax, [ecx + 0x58]
mov dword [ebp - 0x530], eax
mov dword [ebp - 0x52c], str.l0_ah
lea eax, [ecx + 0x5c]
mov dword [ebp - 0x528], eax
mov dword [ebp - 0x524], str.l0_baslr
lea eax, [ecx + 0x60]
mov dword [ebp - 0x520], eax
mov dword [ebp - 0x51c], str.l0_vb_disable
lea eax, [ecx + 0x64]
mov dword [ebp - 0x518], eax
mov dword [ebp - 0x514], str.l0_xmlhttp
lea eax, [ecx + 0x68]
mov dword [ebp - 0x510], eax
mov dword [ebp - 0x50c], str.l0_dah
lea eax, [ecx + 0x6c]
mov dword [ebp - 0x508], eax
mov dword [ebp - 0x504], str.l0_macro_disable
lea eax, [ecx + 0x70]
mov dword [ebp - 0x500], eax
mov dword [ebp - 0x4fc], str.l1_dep
lea eax, [ecx + 0x88]
mov dword [ebp - 0x4f8], eax
mov dword [ebp - 0x4f4], str.l1_wpm
lea eax, [ecx + 0x8c]
mov dword [ebp - 0x4f0], eax
mov dword [ebp - 0x4ec], str.l1_piv
lea eax, [ecx + 0x90]
mov dword [ebp - 0x4e8], eax
mov dword [ebp - 0x4e4], str.l1_ropc32
lea eax, [ecx + 0x94]
mov dword [ebp - 0x4e0], eax
mov dword [ebp - 0x4dc], str.l1_ropr32
lea eax, [ecx + 0x98]
mov dword [ebp - 0x4d8], eax
mov dword [ebp - 0x4d4], str.l1_stk32
lea eax, [ecx + 0x9c]
mov dword [ebp - 0x4d0], eax
mov dword [ebp - 0x4cc], str.l1_ropc64
lea eax, [ecx + 0xa0]
mov dword [ebp - 0x4c8], eax
mov dword [ebp - 0x4c4], str.l1_ropr64
lea eax, [ecx + 0xa4]
mov dword [ebp - 0x4c0], eax
mov dword [ebp - 0x4bc], str.l1_stk64
lea eax, [ecx + 0xa8]
mov dword [ebp - 0x4b8], eax
mov dword [ebp - 0x4b4], str.l2_caller
lea eax, [ecx + 0xcc]
mov dword [ebp - 0x4b0], eax
mov dword [ebp - 0x4ac], str.l3_dll
lea eax, [ecx + 0xf0]
mov dword [ebp - 0x4a8], eax
mov dword [ebp - 0x4a4], str.l3_file
lea eax, [ecx + 0xf4]
mov dword [ebp - 0x4a0], eax
mov dword [ebp - 0x49c], str.l3_process
lea eax, [ecx + 0xf8]
mov dword [ebp - 0x498], eax
mov dword [ebp - 0x494], str.l3_vb_exec
lea eax, [ecx + 0xfc]
mov dword [ebp - 0x490], eax
mov dword [ebp - 0x48c], str.l3_msgbox
lea eax, [ecx + 0x100]
mov dword [ebp - 0x488], eax
mov dword [ebp - 0x484], str.l3_office_wmi
lea eax, [ecx + 0x118]
mov dword [ebp - 0x480], eax
mov dword [ebp - 0x47c], str.l3_office_vba7
lea eax, [ecx + 0x120]
mov dword [ebp - 0x478], eax
mov dword [ebp - 0x474], str.l3_office_vbe7_object_abuse
lea eax, [ecx + 0xd0]
mov dword [ebp - 0x470], eax
mov dword [ebp - 0x46c], str.l3_office_scriting_abuse
lea eax, [ecx + 0xd4]
mov dword [ebp - 0x468], eax
mov dword [ebp - 0x464], str.l3_office_loading_points_abuse
lea eax, [ecx + 0xd8]
mov dword [ebp - 0x460], eax
mov dword [ebp - 0x45c], str.l3_office_spawing_batch_commands
lea eax, [ecx + 0x12c]
mov dword [ebp - 0x458], eax
mov dword [ebp - 0x454], str.l3_excel_macro_4dot0_abuse
lea eax, [ecx + 0xdc]
mov dword [ebp - 0x450], eax
mov dword [ebp - 0x44c], str.l3_email_clnt_scriting_abuse
lea eax, [ecx + 0xe0]
mov dword [ebp - 0x448], eax
mov dword [ebp - 0x444], str.l3_javain
lea eax, [ecx + 0x104]
mov dword [ebp - 0x440], eax
mov dword [ebp - 0x43c], str.l3_javasock
lea eax, [ecx + 0x108]
mov dword [ebp - 0x438], eax
mov dword [ebp - 0x434], str.l3_javaout
lea eax, [ecx + 0x10c]
mov dword [ebp - 0x430], eax
mov dword [ebp - 0x42c], str.l3_javacmd
lea eax, [ecx + 0x110]
mov dword [ebp - 0x428], eax
mov dword [ebp - 0x424], str.l3_javacmd2
lea eax, [ecx + 0x11c]
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x41c], str.l3_javaintranet
lea eax, [ecx + 0x114]
mov dword [ebp - 0x418], eax
mov dword [ebp - 0x414], str.autoupgrades
lea eax, [ecx + 0x3c]
mov dword [ebp - 0x410], eax
mov dword [ebp - 0x40c], str.logprotectionevents
lea eax, [ecx + 0x40]
mov dword [ebp - 0x408], eax
mov dword [ebp - 0x404], str.tooltips
lea eax, [ecx + 0x44]
mov dword [ebp - 0x400], eax
mov dword [ebp - 0x3fc], str.submit_exploit_kit_urls
lea eax, [ecx + 0x48]
mov dword [ebp - 0x3f8], eax
mov dword [ebp - 0x3f4], str.submit_exploit_payloads
lea eax, [ecx + 0x4c]
mov dword [ebp - 0x3f0], eax
mov dword [ebp - 0x3ec], str.submit_file_format
lea eax, [ecx + 0x50]
mov dword [ebp - 0x3e8], eax
mov dword [ebp - 0x3e4], str.block_malicious_emailattachment
lea eax, [ecx + 0x130]
mov dword [ebp - 0x3e0], eax
mov dword [ebp - 0x3dc], str.pen_testing_mode
lea eax, [ecx + 0x128]
mov dword [ebp - 0x3d8], eax
mov dword [ebp - 0x3d4], str.api_urldownloadtofilea
lea eax, [ecx + 0x134]
mov dword [ebp - 0x3d0], eax
mov dword [ebp - 0x3cc], str.api_urldownloadtofilew
lea eax, [ecx + 0x138]
mov dword [ebp - 0x3c8], eax
mov dword [ebp - 0x3c4], str.api_urldownloadtocachefilea
lea eax, [ecx + 0x13c]
mov dword [ebp - 0x3c0], eax
mov dword [ebp - 0x3bc], str.api_urldownloadtocachefilew
lea eax, [ecx + 0x140]
mov dword [ebp - 0x3b8], eax
mov dword [ebp - 0x3b4], str.api_wsastartup
lea eax, [ecx + 0x144]
mov dword [ebp - 0x3b0], eax
mov dword [ebp - 0x3ac], str.api_httpopenrequesta
lea eax, [ecx + 0x148]
mov dword [ebp - 0x3a8], eax
mov dword [ebp - 0x3a4], str.api_httpopenrequestw
lea eax, [ecx + 0x14c]
mov dword [ebp - 0x3a0], eax
mov dword [ebp - 0x39c], str.api_urlopenblockingstreama
lea eax, [ecx + 0x150]
mov dword [ebp - 0x398], eax
mov dword [ebp - 0x394], str.api_urlopenblockingstreamw
lea eax, [ecx + 0x154]
mov dword [ebp - 0x390], eax
mov dword [ebp - 0x38c], str.api_urlopenstreama
lea eax, [ecx + 0x158]
mov dword [ebp - 0x388], eax
mov dword [ebp - 0x384], str.api_urlopenstreamw
lea eax, [ecx + 0x15c]
mov dword [ebp - 0x380], eax
mov dword [ebp - 0x37c], str.api_accept
lea eax, [ecx + 0x160]
mov dword [ebp - 0x378], eax
mov dword [ebp - 0x374], str.api_internetopenurla
lea eax, [ecx + 0x164]
mov dword [ebp - 0x370], eax
mov dword [ebp - 0x36c], str.api_internetopenurlw
lea eax, [ecx + 0x168]
mov dword [ebp - 0x368], eax
mov dword [ebp - 0x364], str.api_internetreadfile
lea eax, [ecx + 0x16c]
mov dword [ebp - 0x360], eax
mov dword [ebp - 0x35c], str.api_internetreadfileex
lea eax, [ecx + 0x170]
mov dword [ebp - 0x358], eax
mov dword [ebp - 0x354], str.api_httpsendrequesta
lea eax, [ecx + 0x174]
mov dword [ebp - 0x350], eax
mov dword [ebp - 0x34c], str.api_httpsendrequestw
lea eax, [ecx + 0x178]
mov dword [ebp - 0x348], eax
mov dword [ebp - 0x344], str.api_httpsendrequestexa
lea eax, [ecx + 0x17c]
mov dword [ebp - 0x340], eax
mov dword [ebp - 0x33c], str.api_httpsendrequestexw
lea eax, [ecx + 0x180]
mov dword [ebp - 0x338], eax
mov dword [ebp - 0x334], str.api_bind
lea eax, [ecx + 0x184]
mov dword [ebp - 0x330], eax
mov dword [ebp - 0x32c], str.api_connect
lea eax, [ecx + 0x188]
mov dword [ebp - 0x328], eax
mov dword [ebp - 0x324], str.api_winexec
lea eax, [ecx + 0x18c]
mov dword [ebp - 0x320], eax
mov dword [ebp - 0x31c], str.api_createprocessa
lea eax, [ecx + 0x190]
mov dword [ebp - 0x318], eax
mov dword [ebp - 0x314], str.api_createprocessw
lea eax, [ecx + 0x194]
mov dword [ebp - 0x310], eax
mov dword [ebp - 0x30c], str.api_shellexecutew
lea eax, [ecx + 0x198]
mov dword [ebp - 0x308], eax
mov dword [ebp - 0x304], str.api_createprocessinternala
lea eax, [ecx + 0x19c]
mov dword [ebp - 0x300], eax
mov dword [ebp - 0x2fc], str.api_createprocessinternalw
lea eax, [ecx + 0x1a0]
mov dword [ebp - 0x2f8], eax
mov dword [ebp - 0x2f4], str.api_msvcrt_system
lea eax, [ecx + 0x1a4]
mov dword [ebp - 0x2f0], eax
mov dword [ebp - 0x2ec], str.api_msvcrt_wsystem
lea eax, [ecx + 0x1a8]
mov dword [ebp - 0x2e8], eax
mov dword [ebp - 0x2e4], str.api_loadlibraryexw
lea eax, [ecx + 0x1ac]
mov dword [ebp - 0x2e0], eax
mov dword [ebp - 0x2dc], str.api_shellexecuteexw
lea eax, [ecx + 0x1b0]
mov dword [ebp - 0x2d8], eax
mov dword [ebp - 0x2d4], str.api_getmodulehandlea
lea eax, [ecx + 0x1b4]
mov dword [ebp - 0x2d0], eax
mov dword [ebp - 0x2cc], str.api_getmodulehandlew
lea eax, [ecx + 0x1b8]
mov dword [ebp - 0x2c8], eax
mov dword [ebp - 0x2c4], str.api_ldrgetdllhandle
lea eax, [ecx + 0x1bc]
mov dword [ebp - 0x2c0], eax
mov dword [ebp - 0x2bc], str.api_i_rpc_send
lea eax, [ecx + 0x1c0]
mov dword [ebp - 0x2b8], eax
mov dword [ebp - 0x2b4], str.api_createfilea
lea eax, [ecx + 0x1c4]
mov dword [ebp - 0x2b0], eax
mov dword [ebp - 0x2ac], str.api_createfilew
lea eax, [ecx + 0x1c8]
mov dword [ebp - 0x2a8], eax
mov dword [ebp - 0x2a4], str.api_getfileattributesexw
lea eax, [ecx + 0x1cc]
mov dword [ebp - 0x2a0], eax
mov dword [ebp - 0x29c], str.api_movefilea
lea eax, [ecx + 0x1d0]
mov dword [ebp - 0x298], eax
mov dword [ebp - 0x294], str.api_movefilew
lea eax, [ecx + 0x1d4]
mov dword [ebp - 0x290], eax
mov dword [ebp - 0x28c], str.api_copyfilea
lea eax, [ecx + 0x1d8]
mov dword [ebp - 0x288], eax
mov dword [ebp - 0x284], str.api_copyfilew
lea eax, [ecx + 0x1dc]
mov dword [ebp - 0x280], eax
mov dword [ebp - 0x27c], str.api_setprocessdeppolicy
lea eax, [ecx + 0x1e0]
mov dword [ebp - 0x278], eax
mov dword [ebp - 0x274], str.api_virtualprotectex
lea eax, [ecx + 0x1e4]
mov dword [ebp - 0x270], eax
mov dword [ebp - 0x26c], str.api_virtualallocex
lea eax, [ecx + 0x1e8]
mov dword [ebp - 0x268], eax
mov dword [ebp - 0x264], str.api_writeprocessmemory
lea eax, [ecx + 0x1ec]
mov dword [ebp - 0x260], eax
mov dword [ebp - 0x25c], str.api_heapcreate
lea eax, [ecx + 0x1f0]
mov dword [ebp - 0x258], eax
mov dword [ebp - 0x254], str.api_ntprotectvirtualmemory
lea eax, [ecx + 0x1f4]
mov dword [ebp - 0x250], eax
mov dword [ebp - 0x24c], str.api_ntallocatevirtualmemory
lea eax, [ecx + 0x1f8]
mov dword [ebp - 0x248], eax
mov dword [ebp - 0x244], str.api_virtualprotect
lea eax, [ecx + 0x1fc]
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x23c], str.api_virtualalloc
lea eax, [ecx + 0x200]
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x234], str.api_messageboxa
lea eax, [ecx + 0x204]
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x22c], str.api_messageboxw
lea eax, [ecx + 0x208]
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x558], 0
mov dword [ebp - 4], 0
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ebx, [eax + 0x1e]
mov dword [ebp - 0x564], 0
push 0x1000a
call fcn.1005218a
mov edi, eax
mov dword [ebp - 0x54c], edi
push 0x2000a
call fcn.1005218a
add esp, 8
mov esi, eax
test edi, edi
je 0x100197e3
test esi, esi
je 0x100197e3
push 0x1008aacc
push 0xffff
push esi
call fcn.1005211a
add esp, 0xc
test eax, eax
jle 0x100197ce
xor eax, eax
mov word [esi + 0x1fffe], ax
push 0xffffffffffffffff
push esi
mov ecx, esi
call fcn.10001b80
inc eax
push eax
push edi
lea eax, [ebp - 0x564]
push eax
call fcn.10052d14
add esp, 0x14
test eax, eax
je 0x100197a5
push ebx
push esi
push str.wcstombs_s_error_in_log_file:__s____d_n
call fcn.10052604
add esp, 0xc
push esi
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call edi
jmp 0x100197ab
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push ebx
mov ebx, dword [ebp - 0x54c]
push ebx
push str.LoadConfigFromRegistry
push 4
mov edx, 0x18b
mov ecx, str...StandAloneSvcAppFiles.cpp
call fcn.10001cf0
add esp, 0x10
jmp 0x10019803
push ebx
push str.Error__d_in_swprintf_s_n
call fcn.10052604
add esp, 8
push str.Error_in_swprintf_s_n
jmp 0x100197f5
push str.Memory_allocation_error_in_log_file_n
call fcn.10052604
add esp, 4
push str.Memory_allocation_error_in_log_file_n
mov edi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call edi
mov ebx, dword [ebp - 0x54c]
test ebx, ebx
je 0x10019810
push ebx
call fcn.10052152
add esp, 4
test esi, esi
je 0x1001981d
push esi
call fcn.10052152
add esp, 4
lea eax, [ebp - 0x540]
push eax
push 0xf003f
push 0
push str.SOFTWAREMalwarebytes_Anti_Exploit
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x100198e1
lea ebx, [eax + 0x1e]
push 0x1000a
call fcn.1005218a
add esp, 4
mov esi, eax
test esi, esi
jne 0x1001986f
push str.Memory_allocation_error_in_log_file_n
call fcn.10052604
add esp, 4
push str.Memory_allocation_error_in_log_file_n
call edi
jmp 0x100198c7
push 0x100865c0
push 0xffff
push esi
call fcn.10052136
add esp, 0xc
push ebx
test eax, eax
jle 0x100198aa
mov byte [esi + 0xffff], 0
push esi
push str.LoadConfigFromRegistry
push 1
mov edx, 0x18e
mov ecx, str...StandAloneSvcAppFiles.cpp
call fcn.10001cf0
add esp, 0x10
jmp 0x100198be
push str.Error__d_in_swprintf_s_n
call fcn.10052604
add esp, 8
push str.Error_in_swprintf_s_n
call edi
push esi
call fcn.10052152
add esp, 4
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x1009cbc0
call fcn.10062b20
add esp, 0xc
mov eax, ebx
jmp 0x10019adb
lea eax, [ebp - 0x548]
push eax
lea eax, [ebp - 0x544]
push eax
lea eax, [ebp - 0x550]
push eax
push 0
push str.mbaet
push dword [ebp - 0x540]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call ebx
cmp dword [ebp - 0x544], 0x577ed7
jne 0x10019921
mov dword [0x100e2838], 1
mov dword [ebp - 0x548], 4
xor edi, edi
mov dword [ebp - 0x560], edi
cmp edi, 0x63
jge 0x100199f8
mov esi, dword [ebp + edi*8 - 0x53c]
push esi
push str._s_mask
lea eax, [ebp - 0x224]
push eax
call fcn.10004ed0
add esp, 0xc
lea eax, [ebp - 0x548]
push eax
lea eax, [ebp - 0x558]
push eax
lea eax, [ebp - 0x550]
push eax
push 0
lea eax, [ebp - 0x224]
push eax
push dword [ebp - 0x540]
call ebx
test eax, eax
jne 0x100199f2
lea eax, [ebp - 0x224]
push eax
push dword [ebp - 0x540]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea eax, [ebp - 0x548]
push eax
lea eax, [ebp - 0x544]
push eax
lea eax, [ebp - 0x550]
push eax
push 0
push esi
push dword [ebp - 0x540]
call ebx
test eax, eax
jne 0x100199f2
mov ecx, dword [ebp + edi*8 - 0x538]
mov eax, dword [ebp - 0x558]
not eax
and dword [ecx], eax
mov eax, dword [ecx]
or eax, dword [ebp - 0x544]
mov dword [ecx], eax
push esi
push dword [ebp - 0x540]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, 1
mov dword [ebp - 0x554], eax
mov dword [ebp - 0x568], eax
inc edi
jmp 0x1001992d
mov eax, dword [ebp - 0x554]
test eax, eax
je 0x10019a0d
mov ecx, dword [ebp - 0x55c]
call fcn.10019b00
mov dword [ebp - 4], 0
call fcn.10019a27
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
jmp 0x10019adb
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1005132c
mov esp, ebp
pop ebp
ret