Function at 0x899590
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1234
call fcn.00a91950
mov eax, dword [0xb196ec]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x217]
push ebx
push eax
mov dword [ebp - 0x121c], ebx
mov byte [ebp - 0x218], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea ecx, [ebp - 0x10f]
push ebx
push ecx
mov byte [ebp - 0x110], bl
call fcn.00a7ffb0
add esp, 0xc
push 0xb52450
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edx, [ebp - 0x121c]
push edx
push 9
push ebx
push str.SoftwareMicroWorldeScan_For_WindowsMwMonitorBlockFiles
push 0x80000002
call edi
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp esi, ebx
je 0x8996a8
lea eax, [ebp - 0x121c]
push eax
push str.SoftwareMicroWorldeScan_For_WindowsMwMonitorBlockFiles
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov esi, eax
cmp esi, ebx
jne 0x8996a8
push str._sysdir_.EXE_
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [ebp - 0x121c]
inc eax
push eax
lea eax, [ebp - 0x110]
push eax
push 1
push ebx
lea ecx, [ebp - 0x218]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x121c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x121c]
push ecx
push 9
push ebx
push str.SoftwareMicroWorldeScan_For_WindowsMwMonitorBlockFiles
push 0x80000002
call edi
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [0xbd0b3c]
cmp eax, ebx
je 0x8996c0
push eax
call fcn.00a78fec
add esp, 4
mov dword [0xbd0b3c], ebx
mov ecx, 0xbe4518
call fcn.0097f8c0
cmp dword [0xb47b88], ebx
jne 0x899722
mov ecx, dword [0xbd0b40]
cmp ecx, ebx
je 0x899722
mov eax, ecx
cmp byte [eax], bl
je 0x8996e7
inc eax
cmp byte [eax], bl
jne 0x8996e2
sub eax, ecx
add eax, 0x104
push eax
call fcn.00a7a155
add esp, 4
mov dword [0xbd0b44], eax
cmp eax, ebx
je 0x89970e
mov edx, dword [0xbd0b40]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [0xbd0b40]
push eax
call fcn.00a78fec
add esp, 4
mov dword [0xbd0b40], ebx
cmp esi, ebx
jne 0x899a0d
push 0x3ff
lea ecx, [ebp - 0x1217]
push ebx
push ecx
call fcn.00a7ffb0
add esp, 0xc
push 0x3ff
lea edx, [ebp - 0x617]
push ebx
push edx
call fcn.00a7ffb0
add esp, 0xc
lea eax, [ebp - 0x1230]
push eax
lea ecx, [ebp - 0x1218]
push ecx
mov ecx, dword [ebp - 0x121c]
push ebx
push ebx
lea edx, [ebp - 0x122c]
push edx
lea eax, [ebp - 0x618]
push eax
push ebx
mov esi, 0x400
push ecx
mov dword [ebp - 0x1228], ebx
mov byte [ebp - 0x1218], bl
mov byte [ebp - 0x618], bl
mov dword [ebp - 0x122c], esi
mov dword [ebp - 0x1230], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x899a0d
cmp byte [ebp - 0x618], bl
je 0x8999af
push 0x3ff
lea edx, [ebp - 0xa17]
push ebx
push edx
mov byte [ebp - 0xa18], bl
call fcn.00a7ffb0
add esp, 0xc
lea eax, [ebp - 0x618]
inc eax
cmp byte [eax], bl
jne 0x8997d8
cmp byte [eax - 1], 0x5c
jne 0x899808
cmp dword [0xb3a424], ebx
je 0x8999af
push ebx
push 0x2c
lea eax, [ebp - 0x618]
push eax
mov edi, 0xbd0b40
call fcn.0098d640
jmp 0x8999af
cmp dword [0xb387d4], ebx
je 0x8999af
push 1
lea ecx, [ebp - 0x618]
push ecx
call fcn.00977760
lea edx, [ebp - 0x618]
push 0x5c
push edx
call fcn.00a7aa50
mov edi, eax
add esp, 8
cmp edi, ebx
je 0x899870
mov al, byte [edi + 1]
inc edi
mov byte [edi], bl
push esi
lea ebx, [ebp - 0xa18]
lea esi, [ebp - 0x618]
mov byte [ebp - 0x1221], al
call fcn.00957fa0
mov cl, byte [ebp - 0x1221]
add esp, 4
push edi
mov edx, ebx
push edx
mov byte [edi], cl
call dword [sym.imp.KERNEL32.dll_lstrcatA]
xor ebx, ebx
jmp 0x899884
lea eax, [ebp - 0x618]
push eax
lea ecx, [ebp - 0xa18]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, 0x11
mov esi, str._sysdir_.EXE___windir_.EXE___sysdir_drivers.SYS__sysdir_.DLL
lea edi, [ebp - 0xe18]
rep movsd dword es:[edi], dword [esi]
push 0x3ba
lea edx, [ebp - 0xdd2]
push ebx
push edx
movsw word es:[edi], word [esi]
call fcn.00a7ffb0
add esp, 0xc
lea eax, [ebp - 0x1220]
push eax
lea ecx, [ebp - 0xe18]
mov dword [ebp - 0x1220], ebx
push ecx
mov bl, 0x2c
lea edi, [ebp - 0x618]
call fcn.0095ae80
or esi, 0xffffffff
add esp, 8
cmp dword [ebp - 0x1220], esi
je 0x899929
lea esp, [esp]
push 1
lea edx, [ebp - 0x618]
push edx
call fcn.00977760
lea eax, [ebp - 0x618]
lea ecx, [ebp - 0xa18]
call fcn.0094c330
test eax, eax
je 0x899974
lea eax, [ebp - 0x1220]
push eax
lea ecx, [ebp - 0xe18]
push ecx
mov bl, 0x2c
lea edi, [ebp - 0x618]
call fcn.0095ae80
add esp, 8
cmp dword [ebp - 0x1220], esi
jne 0x8998e0
push 0
push 0x2c
lea edx, [ebp - 0xa18]
push edx
mov edi, 0xbd0b3c
call fcn.0098d640
push 2
mov eax, 0xabfb58
lea ecx, [ebp - 0xa18]
call fcn.0094c380
add esp, 4
test eax, eax
jne 0x8999ad
cmp byte [ebp - 0xa16], al
je 0x8999ad
push 1
push eax
lea ecx, [ebp - 0xa16]
mov edx, 0xbe4518
call fcn.0097faa0
jmp 0x8999ad
lea eax, [ebp - 0xa18]
push eax
push str.__s__value_IGNORED___
push esi
lea ecx, [ebp - 0xc20]
push 0x208
push ecx
call fcn.00a78fcb
add esp, 0x14
push 0
push 1
lea edx, [ebp - 0xc20]
push edx
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
xor ebx, ebx
mov eax, dword [ebp - 0x1228]
lea ecx, [ebp - 0x1230]
push ecx
lea edx, [ebp - 0x1218]
push edx
push ebx
push ebx
lea ecx, [ebp - 0x122c]
push ecx
inc eax
lea edx, [ebp - 0x618]
push edx
push eax
mov dword [ebp - 0x1228], eax
mov eax, dword [ebp - 0x121c]
mov esi, 0x400
push eax
mov byte [ebp - 0x1218], bl
mov byte [ebp - 0x618], bl
mov dword [ebp - 0x122c], esi
mov dword [ebp - 0x1230], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
je 0x8997ab
mov eax, dword [ebp - 0x121c]
cmp eax, ebx
je 0x899a24
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x121c], ebx
lea ecx, [ebp - 0x1228]
mov dword [ebp - 0x1228], ebx
call fcn.008ae7e0
mov esi, dword [ebp - 0x1228]
cmp esi, ebx
je 0x899ab1
cmp byte [esi], bl
je 0x899ab1
lea ecx, [ebp - 0x1220]
push ecx
mov dword [ebp - 0x1220], ebx
push esi
mov bl, 0x2c
lea edi, [ebp - 0xb20]
call fcn.0095ae80
add esp, 8
cmp dword [ebp - 0x1220], 0xffffffff
je 0x899aa6
lea ebx, [ebx]
push 0
push 0x2c
lea edx, [ebp - 0xb20]
push edx
mov edi, 0xbd0b40
call fcn.0098d640
lea eax, [ebp - 0x1220]
push eax
push esi
mov bl, 0x2c
lea edi, [ebp - 0xb20]
call fcn.0095ae80
add esp, 8
cmp dword [ebp - 0x1220], 0xffffffff
jne 0x899a70
push esi
call fcn.00a78fec
add esp, 4
xor ebx, ebx
push 0xbd5790
push str.ProtectDesktop
mov ecx, 0xaa21e4
mov edx, 0x80000002
mov dword [0xbd5790], ebx
call fcn.0094c0d0
test al, al
jne 0x899aef
mov eax, dword [0xbd5790]
mov esi, str.ProtectDesktop
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
xor ebx, ebx
push 0xbd5794
push str.ProtectDocuments
mov ecx, 0xaa21e4
mov edx, 0x80000002
mov dword [0xbd5794], ebx
call fcn.0094c0d0
test al, al
jne 0x899b2d
mov eax, dword [0xbd5794]
mov esi, str.ProtectDocuments
mov ebx, 0xaa21e4
mov ecx, 0x80000002
call fcn.0094be90
xor ebx, ebx
cmp dword [0xb47b88], ebx
jne 0x899b8d
mov eax, dword [0xbd0b40]
mov ecx, dword [0xbd0b44]
cmp eax, ebx
jne 0x899b48
cmp ecx, ebx
je 0x899b83
xor esi, esi
cmp eax, ebx
jne 0x899b54
cmp ecx, ebx
je 0x899b58
jmp 0x899b67
cmp ecx, ebx
je 0x899b88
call fcn.0094c330
mov ecx, dword [0xbd0b44]
test eax, eax
je 0x899b6c
mov esi, 1
cmp ecx, ebx
je 0x899b7f
push ecx
call fcn.00a78fec
add esp, 4
mov dword [0xbd0b44], ebx
cmp esi, ebx
jne 0x899b88
cmp dword [ebp + 0xc], ebx
je 0x899b8d
call fcn.00898f40
cmp dword [0xb47b88], 1
jne 0x899b9c
mov dword [0xb47b88], ebx
mov ecx, dword [ebp + 8]
push ecx
call fcn.00898be0
add esp, 4
push 0xb52450
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00a78f21
mov esp, ebp
pop ebp
ret