Function at 0x100bee03
Capabilities:
Query environment variable
Set registry value

Disassembly:
push 0x430
mov eax, 0x1016b20d
call fcn.1012b71c
mov edi, ecx
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x438], eax
test esi, esi
je 0x100bf931
cmp dword [esi + 0x24], 4
je 0x100bf928
xor ecx, ecx
mov dword [edi + 0x20], ecx
mov dword [edi + 0x1c], ecx
mov dword [edi + 0x18], ecx
mov dword [edi + 0xa10], ecx
xor eax, eax
inc eax
mov ebx, eax
mov edx, dword [esi + 0xc]
mov ecx, edx
cmp ecx, 0xf7
ja 0x100bf8ef
je case.0x100bee68.12
dec ecx
cmp ecx, 0xf0
ja case.0x100bee68.5
jmp dword [ecx*4 + 0x100bf94f]
mov eax, 0x10181720
push eax
push eax
push esi
mov ecx, edi
call fcn.100ba521
jmp 0x100bf922
mov eax, 0x101817a4
jmp 0x100bee74
push esi
mov ecx, edi
call fcn.100b948b
jmp 0x100bf922
push dword [ebp - 0x438]
push esi
mov ecx, edi
call fcn.100bc866
jmp 0x100bf922
push esi
mov ecx, edi
call fcn.100bcff7
jmp 0x100bf922
push esi
mov ecx, edi
call fcn.100b9614
jmp 0x100bf922
xor ebx, ebx
cmp edx, 0x18
je 0x100beed4
cmp edx, 0x19
jne 0x100befa4
mov eax, dword [esi + 0x1c]
test eax, eax
jne 0x100beee0
mov eax, 0x101bd7f8
push eax
call fcn.1001441f
test eax, eax
je 0x100befa1
mov ecx, dword [esi + 0x18]
test ecx, ecx
jne 0x100beefa
mov ecx, 0x101bd7f8
mov eax, dword [esi + 0x1c]
test eax, eax
jne 0x100bef06
mov eax, 0x101bd7f8
push ecx
push eax
call fcn.101311cd
pop ecx
pop ecx
test eax, eax
jne 0x100befa1
mov eax, dword [esi + 0x1c]
test eax, eax
jne 0x100bef23
mov eax, 0x101bd7f8
push 0x5c
push 0
push eax
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
test eax, eax
jne 0x100bef44
mov dword [0x1024c32c], 0x1c
xor ebx, ebx
inc ebx
jmp case.0x100bee68.11
push 0x1019b0e8
push eax
call fcn.1012e6fe
pop ecx
pop ecx
test eax, eax
jne 0x100bef61
mov dword [0x1024c32c], 0x1d
jmp 0x100bef3c
add eax, 2
push eax
call fcn.100570b9
pop ecx
test eax, eax
jne 0x100bef7b
mov dword [0x1024c32c], 0x1e
jmp 0x100bef3c
test byte [esi + 0x20], 3
je case.0x100bee68.11
mov eax, dword [esi + 0x1c]
test eax, eax
jne 0x100bef91
mov eax, 0x101bd7f8
push eax
push dword [esi + 0xc]
mov ecx, edi
call fcn.100af834
jmp 0x100bf922
xor eax, eax
inc eax
mov ebx, 0x101bd7f8
mov dword [ebp - 0x430], eax
and dword [ebp - 0x428], 0
mov ecx, dword [esi + 0x1c]
test ecx, ecx
jne 0x100befbf
mov ecx, ebx
mov eax, dword [edi]
lea edx, [ebp - 0x428]
push edx
lea edx, [ebp - 0x430]
push edx
push ecx
push dword [esi + 0x20]
mov ecx, edi
call dword [eax + 0xc]
mov dword [ebp - 0x42c], eax
test dword [esi + 0x20], 0x801
je 0x100bf922
cmp dword [edi + 0xa9c], 0
je 0x100bf00a
mov ecx, dword [esi + 0x18]
test ecx, ecx
jne 0x100beffd
mov ecx, ebx
mov eax, dword [edi]
push ecx
mov ecx, edi
call dword [eax + 0x18]
jmp 0x100bf0a9
cmp dword [ebp - 0x430], 0
je 0x100bf922
test byte [esi + 0x20], 1
jne 0x100bf037
cmp dword [ebp - 0x428], 0
je 0x100bf922
test dword [esi + 0x20], 0x800
je 0x100bf922
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x100bf040
mov eax, ebx
push 1
push eax
mov ecx, edi
call fcn.100b5a89
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x100bf053
mov eax, ebx
push 2
push eax
mov ecx, edi
call fcn.100b5a89
and dword [ebp - 0x434], 0
mov ecx, dword [esi + 0x18]
test ecx, ecx
jne 0x100bf06d
mov ecx, ebx
push 1
push 1
lea eax, [ebp - 0x434]
push eax
push dword [edi + 0x28]
lea eax, [edi + 0x1c]
push eax
mov eax, dword [esi + 0x20]
and eax, 0x40
push eax
push ecx
call fcn.1006c2af
add esp, 0x1c
mov ebx, eax
cmp dword [ebp - 0x434], 0
je 0x100bf0a1
mov dword [edi + 0x24], 1
test ebx, ebx
jne case.0x100bee68.11
mov eax, dword [ebp - 0x42c]
jmp 0x100bf922
mov dword [ebp - 0x42c], eax
and dword [ebp - 0x434], 0
mov ecx, dword [esi + 0x1c]
mov ebx, 0x101bd7f8
test ecx, ecx
jne 0x100bf0cf
mov ecx, ebx
mov eax, dword [edi]
lea edx, [ebp - 0x434]
push edx
lea edx, [ebp - 0x42c]
push edx
push ecx
push dword [esi + 0x20]
mov ecx, edi
call dword [eax + 0xc]
mov dword [ebp - 0x428], eax
test dword [esi + 0x20], 0x801
je 0x100bf922
cmp dword [edi + 0xa9c], 0
je 0x100bf11a
mov ecx, dword [esi + 0x18]
test ecx, ecx
jne 0x100bf10d
mov ecx, ebx
mov eax, dword [edi]
push ecx
mov ecx, edi
call dword [eax + 0x18]
jmp 0x100bf1f3
cmp dword [ebp - 0x42c], 0
je 0x100bf922
test byte [esi + 0x20], 1
jne 0x100bf147
cmp dword [ebp - 0x434], 0
je 0x100bf922
test dword [esi + 0x20], 0x800
je 0x100bf922
cmp dword [edi + 0x28], 0
je 0x100bf16e
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x100bf156
mov eax, ebx
push eax
call fcn.10073b06
mov ecx, eax
call fcn.10073a45
test eax, eax
je 0x100bf16e
mov dword [edi + 0x24], 1
and dword [ebp - 0x430], 0
push esi
mov ecx, edi
call fcn.100b6032
mov ebx, eax
test ebx, ebx
je 0x100bf1db
mov eax, dword [esi + 0x18]
mov ebx, 0x101bd7f8
test eax, eax
jne 0x100bf191
mov eax, ebx
push 1
push eax
mov ecx, edi
call fcn.100b5a89
mov eax, dword [esi + 0x18]
test eax, eax
jne 0x100bf1a4
mov eax, ebx
push 2
push eax
mov ecx, edi
call fcn.100b5a89
mov ecx, dword [esi + 0x18]
test ecx, ecx
jne 0x100bf1b7
mov ecx, ebx
push 1
push 1
lea eax, [ebp - 0x430]
push eax
push dword [edi + 0x28]
lea eax, [edi + 0x1c]
push eax
mov eax, dword [esi + 0x20]
and eax, 0x40
push eax
push ecx
call fcn.1006c2af
add esp, 0x1c
mov ebx, eax
cmp dword [ebp - 0x430], 0
je 0x100bf1eb
mov dword [edi + 0x24], 1
test ebx, ebx
jne case.0x100bee68.11
mov eax, dword [ebp - 0x428]
jmp 0x100bf922
push 0x10181720
push 0x101817a4
jmp 0x100bee76
push esi
mov ecx, edi
call fcn.100b9614
mov ebx, eax
push esi
mov ecx, edi
call fcn.100b9028
jmp case.0x100bee68.11
push esi
mov ecx, edi
call fcn.100bb5b6
jmp 0x100bf922
push eax
push esi
mov ecx, edi
call fcn.100b9d43
jmp 0x100bf922
push 0
jmp 0x100bf232
push esi
mov ecx, edi
call fcn.100b8371
jmp 0x100bf922
push esi
mov ecx, edi
call fcn.100b7e7b
jmp 0x100bf922
push esi
mov ecx, edi
call fcn.100ade42
jmp 0x100bf922
push esi
mov ecx, edi
call fcn.100bc670
jmp 0x100bf922
push esi
mov ecx, edi
call fcn.100b772d
jmp 0x100bf922
push esi
mov ecx, edi
call fcn.100b7f63
jmp 0x100bf922
push esi
mov ecx, edi
call fcn.100b8a38
jmp 0x100bf922
push esi
mov ecx, edi
call fcn.100ad3a9
jmp 0x100bf922
push 0x208
push 0
lea eax, [ebp - 0x21c]
push eax
call fcn.1012db70
add esp, 0xc
push SysReAllocString
push str._SystemRoot__system32_ntvdm.exe__o
push 0
push 0x104
lea eax, [ebp - 0x21c]
push eax
call fcn.10015d3f
push 2
lea eax, [ebp - 0x21c]
push eax
push esi
mov ecx, edi
call fcn.100be34d
jmp 0x100bf922
push 0x208
push 0
lea eax, [ebp - 0x21c]
push eax
call fcn.1012db70
add esp, 0xc
push SysReAllocString
push str._SystemRoot__system32_ntvdm.exe__a__SystemRoot__system32krnl386
jmp 0x100bf2cb
push 0x208
push 0
lea eax, [ebp - 0x21c]
push eax
call fcn.1012db70
add esp, 0xc
push SysReAllocString
push str._SystemRoot__system32cmd.exe
jmp 0x100bf2cb
mov dword [ebp - 0x42c], eax
and dword [ebp - 0x434], 0
mov ecx, dword [esi + 0x1c]
mov ebx, 0x101bd7f8
test ecx, ecx
jne 0x100bf353
mov ecx, ebx
mov eax, dword [edi]
lea edx, [ebp - 0x434]
push edx
lea edx, [ebp - 0x42c]
push edx
push ecx
push dword [esi + 0x20]
mov ecx, edi
call dword [eax + 0xc]
mov dword [ebp - 0x438], eax
test dword [esi + 0x20], 0x801
je 0x100bf922
xor edx, edx
cmp dword [edi + 0xa9c], edx
jne 0x100bf3b4
cmp dword [ebp - 0x42c], edx
je 0x100bf922
test byte [esi + 0x20], 1
jne 0x100bf3b4
cmp dword [ebp - 0x434], edx
je 0x100bf922
test dword [esi + 0x20], 0x800
je 0x100bf922
mov ecx, dword [esi + 0x15c]
test ecx, ecx
jne 0x100bf3c0
mov ecx, ebx
push edx
push edx
push ecx
push 0x42
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0xc]
mov ebx, eax
test ebx, ebx
jne case.0x100bee68.11
mov eax, dword [ebp - 0x438]
jmp 0x100bf922
push esi
mov ecx, edi
call fcn.100baa9c
jmp 0x100bf922
mov ecx, dword [esi + 0x1c]
test ecx, ecx
jne 0x100bf3fa
mov ecx, 0x101bd7f8
push 0
push 0
push ecx
push dword [esi + 0x20]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0xc]
jmp 0x100bf922
push esi
mov ecx, edi
call fcn.100bb018
jmp 0x100bf922
push esi
push edx
mov ecx, edi
call fcn.100b4b9f
jmp 0x100bf922
push eax
push 0x101bd7f8
jmp 0x100bf2e7
push 2
push str.__ProgramFiles_Internet_Exploreriexplore.exe___1
jmp 0x100bf2e7
push esi
mov ecx, edi
call fcn.100b50e3
jmp 0x100bf922
push esi
mov ecx, edi
call fcn.100b8fa7
jmp 0x100bf922
push esi
mov ecx, edi
call fcn.100b77b4
jmp 0x100bf922
push esi
mov ecx, edi
call fcn.100b982c
jmp 0x100bf922
mov ecx, dword [esi + 0x1c]
test ecx, ecx
jne 0x100bf480
mov ecx, 0x101bd7f8
push 0
push 0
push ecx
push 0x42
jmp 0x100bf402
push esi
mov ecx, edi
call fcn.100b78e4
jmp 0x100bf922
push esi
mov ecx, edi
call fcn.100b55b5
jmp 0x100bf922
push esi
mov ecx, edi
call fcn.100b4f79
jmp 0x100bf922
push str.00021494_0000_0000_C000_000000000046
push esi
mov ecx, edi
call fcn.100b587f
jmp 0x100bf922
push str.00021493_0000_0000_C000_000000000046
jmp 0x100bf4b8
push str.00021492_0000_0000_C000_000000000046
jmp 0x100bf4b8
push esi
mov ecx, edi
call fcn.100b668e
jmp 0x100bf922
push esi
mov ecx, edi
call fcn.100b6d47
jmp 0x100bf922
and dword [ebp - 4], 0
push esi
mov ecx, edi
call fcn.100bcf1f
mov ebx, eax
mov dword [ebp - 0x43c], ebx
or dword [ebp - 4], 0xffffffff
jmp case.0x100bee68.11
push 0x118
push 0
lea eax, [ebp - 0x12c]
push eax
call fcn.1012db70
mov dword [ebp - 0x130], 0x11c
lea eax, [ebp - 0x130]
push eax
call fcn.1001820d
add esp, 0x10
test eax, eax
jne 0x100bf572
mov dword [0x1024c32c], 0x20
jmp 0x100bf942
xor ebx, ebx
inc ebx
cmp dword [ebp - 0x12c], 6
jb 0x100bf58a
push 2
push str._systemroot_System32mlang.dll
jmp 0x100bf2e7
push 0x208
push 0
lea eax, [ebp - 0x424]
push eax
call fcn.1012db70
add esp, 0xc
push 0x104
lea eax, [ebp - 0x424]
push eax
push str._systemroot_System32mlang.dll
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je case.0x100bee68.11
push 1
lea eax, [ebp - 0x424]
jmp 0x100bf2e6
mov eax, dword [esi + 0x154]
mov ebx, 0x101bd7f8
test eax, eax
jne 0x100bf5dd
mov eax, ebx
push str._ftp_shell_
push eax
call fcn.101160fa
pop ecx
pop ecx
test eax, eax
jne case.0x100bee68.148
mov eax, dword [esi + 0x154]
test eax, eax
jne 0x100bf5fe
mov eax, ebx
push str.http_shell_
push eax
call fcn.101160fa
pop ecx
pop ecx
test eax, eax
jne case.0x100bee68.148
mov eax, dword [esi + 0x154]
test eax, eax
jne 0x100bf61f
mov eax, ebx
push str.https_shell_
push eax
call fcn.101160fa
pop ecx
pop ecx
test eax, eax
jne case.0x100bee68.148
mov eax, dword [esi + 0x154]
test eax, eax
jne 0x100bf640
mov eax, ebx
push eax
lea ecx, [ebp - 0x428]
call fcn.100088c7
mov dword [ebp - 4], 2
mov eax, dword [esi + 0x154]
test eax, eax
jne 0x100bf65f
mov eax, ebx
push eax
lea ecx, [ebp - 0x42c]
call fcn.100088c7
mov byte [ebp - 4], 3
push 0x5c
push dword [ebp - 0x428]
call fcn.1012e65c
pop ecx
pop ecx
test eax, eax
je 0x100bf6d1
sub eax, dword [ebp - 0x428]
sar eax, 1
cmp eax, 0xffffffff
je 0x100bf6d1
push eax
lea eax, [ebp - 0x438]
push eax
lea ecx, [ebp - 0x428]
call fcn.10014b9c
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x428]
call fcn.10010aef
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x438]
lea ecx, [ecx - 0x10]
call fcn.100078bc
push dword [ebp - 0x428]
mov ecx, esi
call fcn.1001607b
push esi
mov ecx, edi
call fcn.100b948b
mov ebx, eax
push dword [ebp - 0x42c]
mov ecx, esi
call fcn.1001607b
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x42c]
lea ecx, [ecx - 0x10]
call fcn.100078bc
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x428]
lea ecx, [ecx - 0x10]
call fcn.100078bc
jmp case.0x100bee68.11
push esi
mov ecx, edi
call fcn.100b7244
jmp 0x100bf922
push esi
mov ecx, edi
call fcn.100b7c21
jmp 0x100bf922
push esi
mov ecx, edi
call fcn.100aeffc
jmp 0x100bf922
push esi
mov ecx, edi
call fcn.100aed36
jmp 0x100bf922
push esi
mov ecx, edi
call fcn.100ad9da
jmp 0x100bf922
push esi
mov ecx, edi
call fcn.100b490b
jmp 0x100bf922
mov ecx, dword [esi + 0x1c]
test ecx, ecx
jne 0x100bf76b
mov ecx, 0x101bd7f8
push 0
push 0
push ecx
push 0x80
jmp 0x100bf402
push esi
mov ecx, edi
call fcn.100b4654
jmp 0x100bf922
push esi
mov ecx, edi
call fcn.100af2fd
jmp 0x100bf922
call fcn.10051524
test eax, eax
jne 0x100bf7af
xor ebx, ebx
inc ebx
mov dword [0x1024c32c], 0x21
jmp case.0x100bee68.11
and dword [ebp - 0x428], 0
mov eax, dword [esi + 0x154]
mov dword [ebp - 0x430], eax
test eax, eax
jne 0x100bf7d0
mov dword [ebp - 0x430], 0x101bd7f8
push 0x37
call fcn.10010082
pop ecx
test eax, eax
je 0x100bf7fe
xor edx, edx
push edx
lea ecx, [ebp - 0x428]
push ecx
push edx
push 0xf013f
push edx
push edx
push edx
push dword [ebp - 0x430]
push reloc.OLEAUT32.dll_SysReAllocString
call eax
jmp 0x100bf822
xor ecx, ecx
push ecx
lea eax, [ebp - 0x428]
push eax
push ecx
push 0xf013f
push ecx
push ecx
push ecx
push dword [ebp - 0x430]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne case.0x100bee68.11
cmp dword [ebp - 0x428], eax
je case.0x100bee68.11
push str.4ed3a719_cea8_4bd9_910d_e252f997afc2
lea ecx, [ebp - 0x438]
call fcn.100088c7
mov dword [ebp - 4], 8
mov eax, dword [ebp - 0x438]
mov dword [ebp - 0x434], eax
mov eax, dword [eax - 0xc]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x42c], eax
mov eax, dword [ebp - 0x428]
mov dword [ebp - 0x430], eax
push 0x45
call fcn.10010082
pop ecx
push dword [ebp - 0x42c]
push dword [ebp - 0x434]
push 1
push 0
push str.DelegateExecute
push dword [ebp - 0x430]
test eax, eax
je 0x100bf8a0
call eax
jmp 0x100bf8a6
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x100bf8b4
push esi
mov ecx, edi
call fcn.100b9614
mov ebx, eax
push dword [ebp - 0x428]
call fcn.10017c01
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x438]
jmp 0x100bf704
mov eax, dword [esi + 0x1c]
test eax, eax
jne 0x100bf8da
mov eax, 0x101bd7f8
push eax
push edx
mov ecx, edi
call fcn.100b597d
jmp 0x100bf922
push esi
mov ecx, edi
call fcn.100af2cd
jmp 0x100bf922
sub ecx, 0x468
je case.0x100bee68.85
sub ecx, 1
je case.0x100bee68.85
sub ecx, 0x1ebf
je 0x100bf910
mov dword [0x1024c32c], 0x22
jmp case.0x100bee68.11
push esi
mov ecx, edi
call fcn.100af76b
jmp 0x100bf922
push esi
mov ecx, edi
call fcn.100ae553
mov ebx, eax
mov eax, ebx
jmp 0x100bf945
mov dword [edi + 0x20], 2
jmp 0x100bf938
mov dword [edi + 0x20], 1
mov dword [0x1024c32c], 0x1b
xor eax, eax
inc eax
call fcn.1012b669
ret 8