Function at 0x1007e1d
Capabilities:
Create thread
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
xor esi, esi
push 0x1016613
mov dword [ebp - 8], esi
mov dword [ebp - 0x20], 9
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 1
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x1008220
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp eax, esi
mov dword [ebp - 0x24], eax
je 0x100f652
mov esi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 1
lea eax, [ebp - 2]
push eax
mov ebx, 0x10081d8
push ebx
call esi
mov edi, eax
cmp edi, 1
jbe 0x1007ea2
lea eax, [edi + edi]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
mov dword [0x101a508], eax
je 0x10080b9
push edi
push eax
push ebx
call esi
cmp eax, edi
ja 0x10080b9
push 1
lea eax, [ebp - 2]
push eax
mov ebx, 0x1008198
push ebx
call esi
mov edi, eax
cmp edi, 1
jbe 0x1007edd
lea eax, [edi + edi]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
mov dword [0x101a55c], eax
je 0x10080b9
push edi
push eax
push ebx
call esi
cmp eax, edi
ja 0x10080b9
call fcn.0100c734
test eax, eax
jl 0x10080b9
push 0x101a53c
push 0xf003f
xor esi, esi
push esi
push 0x1008128
mov edi, 0x80000002
push edi
call fcn.01002ccf
test eax, eax
jne 0x1007f25
push esi
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp eax, esi
je 0x100f587
push esi
push eax
call fcn.01008981
lea eax, [ebp - 4]
push eax
call fcn.0100c567
test eax, eax
je 0x10080b9
call fcn.0100bab2
test eax, eax
jne 0x10080b9
push 0x101a7c4
call dword [sym.imp.ntdll.dll_RtlGetNtProductType]
test al, al
je 0x10080b9
call fcn.0100b7d9
test eax, eax
je 0x10080b9
call fcn.0100bb80
test eax, eax
je 0x10080b9
call fcn.0100b147
test eax, eax
je 0x10080b9
call fcn.0100abaa
test eax, eax
je 0x10080b9
call fcn.0100ad84
call fcn.0100acc6
call fcn.0100ae64
test eax, eax
je 0x10080b9
lea eax, [ebp - 0xc]
push eax
push 0x10080c0
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x100f5a5
call fcn.0100af11
call fcn.0100aebc
call fcn.0100ad55
test eax, eax
je 0x10080b9
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.USER32.dll_RegisterServicesProcess]
lea eax, [ebp - 8]
push eax
xor ebx, ebx
push 0x10024c0
inc ebx
push ebx
call fcn.0100695e
test eax, eax
jne 0x10080b9
call fcn.0100b02c
test eax, eax
jne 0x10080b9
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetEvent]
push ebx
push 0x10162e9
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
push ebx
push 0x1e0
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
push 0x100aa0d
call sub.SCESRV.dll_ScesrvInitializeServer
test eax, eax
jne 0x10080b9
push 0x100cdaa
push 0x100c8e0
call sub.umpnpmgr.dll_RegisterScmCallback
call fcn.0100a8fd
call fcn.0100a7ac
lea eax, [ebp - 8]
push eax
call fcn.0100824f
test eax, eax
jne 0x10080b9
xor esi, esi
cmp dword [0x101a54c], esi
jne 0x100f67f
cmp dword [0x101a548], esi
jne 0x100f6a7
test byte [0x101a534], 2
jne 0x100f6a7
lea eax, [ebp - 8]
push eax
call fcn.01006b3b
push 4
lea eax, [ebp - 0x20]
push eax
push 5
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtSetInformationProcess]
call fcn.0100837c
push esi
push dword [ebp - 0x24]
call dword [sym.imp.ntdll.dll_NtSetEvent]
mov dword [0x101a3a8], esi
push esi
call dword [sym.imp.KERNEL32.dll_ExitThread]
xor esi, esi
jmp 0x100f652
push dword [0x101a53c]
call dword [sym.imp.ntdll.dll_NtClose]
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [0x101a53c], esi
jmp 0x1007f25
lea eax, [ebp - 0x10]
push eax
push 0x101a544
xor esi, esi
push esi
push esi
push 0x100f7b4
push dword [ebp - 0xc]
mov dword [ebp - 0x10], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x100f5d1
mov dword [0x101a544], esi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x101a544]
cmp eax, esi
je 0x1007fb9
dec eax
mov esi, dword [sym.imp.msvcrt.dll_wcscpy]
mov dword [0x101a2fc], 0x2a
je 0x100f61c
dec eax
je 0x100f615
dec eax
jne 0x100f631
push 0x100f7a0
push 0x101a83c
call esi
add dword [0x101a2fc], 8
jmp 0x100f62f
push 0x100f790
jmp 0x100f621
push 0x100f780
push 0x101a83c
call esi
add dword [0x101a2fc], 7
pop ecx
pop ecx
mov eax, dword [0x101a2fc]
lea eax, [eax*2 + str.systemcurrentcontrolsetcontrol_safeboot_]
push 0x1009164
push eax
call esi
inc dword [0x101a2fc]
pop ecx
pop ecx
jmp 0x1007fb9
mov dword [0x101a3a8], esi
call fcn.01015936
call fcn.01016624
cmp dword [ebp - 8], esi
je 0x100f670
lea eax, [ebp - 8]
push eax
call fcn.01006b3b
push 0x1016840
call sub.SCESRV.dll_ScesrvTerminateServer
jmp 0x10080b2
lea eax, [ebp - 4]
push eax
call fcn.010165ab
push dword [ebp - 4]
push 0x1c
call fcn.0100d30d
pop ecx
pop ecx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.0101659c
jmp 0x100806b
cmp dword [0x7ffe0264], ebx
je 0x1008084
cmp dword [0x101a544], esi
jne 0x1008084
push esi
push esi
call fcn.01009835
test eax, eax
jne 0x1008084
lea eax, [ebp - 4]
push eax
push 0x20019
push esi
push 0x1007bc8
push edi
mov bl, 1
mov dword [ebp - 4], esi
call fcn.01002ccf
test eax, eax
jne 0x100f734
push 4
pop edi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push esi
push 0x100f760
push dword [ebp - 4]
mov dword [ebp - 0x14], edi
call fcn.01002e6e
test eax, eax
jne 0x100f71c
cmp dword [ebp - 0x18], edi
jne 0x100f71c
cmp dword [ebp - 0x1c], esi
je 0x100f71c
xor bl, bl
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtClose]
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test bl, bl
je 0x1008084
lea eax, [ebp - 0x10]
push eax
push esi
push dword [0x101a548]
push 0x101630f
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, esi
je 0x1008084
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1008084